net-vpn/tor: drop 0.4.7.13-r1, 0.4.7.16, 0.4.7.16-r1, 0.4.8.10

Bug: https://bugs.gentoo.org/916759
Bug: https://bugs.gentoo.org/917142
Signed-off-by: Sam James <sam@gentoo.org>

7 files changed, 0 insertions, 1233 deletions

diff --git a/net-vpn/tor/Manifest b/net-vpn/tor/Manifest
index 06f3b10d8861..710454f24605 100644
--- a/net-vpn/tor/Manifest
+++ b/net-vpn/tor/Manifest
@@ -1,12 +1,3 @@
-DIST tor-0.4.7.13.tar.gz 8031948 BLAKE2B 338a0a541423f27f594a091307b5edeafc9826bb651c2bd050f3282c9355d9d43d1ef4791f3c98a37dc4c0f64bc40925ea1c1e32cbdff78b1a7308df501f279a SHA512 0900416887afbb24f7b72e6ef181b7b01308d1bb35c37736f3b13e06810a07febf9f47fadd9ff6c0e73204d93b49545e4e2516906eb3ba74398ad2b299f530be
-DIST tor-0.4.7.13.tar.gz.sha256sum 86 BLAKE2B 339db9869bfe485cbd328fe942cc23e60c08ad67fc2d9e7927ed3c9f3b606192e5efac34013c5bf0b0e8b26e957dcf8b586e1cc0a0c27756b8b3d823af37fdee SHA512 ec1d19fa662255df5dd575ba943f4ccb30d9dfa49ff656cdfa73df2d24248b52a3bfd715f4d3efe11d8129968b0e06e3c75e8d82416e1807020ebf65f65401a0
-DIST tor-0.4.7.13.tar.gz.sha256sum.asc 716 BLAKE2B 968a3852293ab9bcadac626862c9dc360b17de5afd00af7c46358fa2adfc03b55c02dfe029e9427efba999f553489a04388b395e8fb8fe16325e0895663c2deb SHA512 eb78e8369941d8de833e3616a9a1c1e59b0d3dde918353e2f4fa5eb5da09f038238c46f5e180844bd3cba1211a9daa6d60e9ddb5690998e27a6b7d1616aa20cc
-DIST tor-0.4.7.16.tar.gz 8120424 BLAKE2B 59b7cf6b69cf552caac09ab000732bf6fa6cd5a171f00e86bea5a89ba9ce548e404fa7adb25d3aebed9f500b15ae2ca5272b07f61921f19bc5bc71b3f42a88e6 SHA512 4b1e08f158369dfd51f72a45b67fccb42095980c674e94c7a917f44996783296544b15ec1cbb7506f78d2a1473679326a128501d4341bb0251966770cf6a3d1b
-DIST tor-0.4.7.16.tar.gz.sha256sum 86 BLAKE2B 8468b7728bb47ee1e27b2895f264f1fbbb4e21a20532da76bf7b5de139b7d1c5307a9016159ee834b4f696f156acfb6f252c95d094e62480ce36a7414815cc71 SHA512 858bb461c4d7a10b32aa4088c5e75eaa6527211314bfa02197578dfb8837cc263abe06ea565a352e6255eb0b1c7c1b80807713b1906f52c2bf883b6c945345d2
-DIST tor-0.4.7.16.tar.gz.sha256sum.asc 716 BLAKE2B 108bf2ba3c5678da0be72e6816b3ebe981d56733ddae00bcc79ecae050753580df3da2c2aef179310efc426e7caa5e6df991ac9e4b87d4a7aaa53556e00fb8ce SHA512 9595dbedef35fabdd0b19bf055329580326447cefd269c21c8e73c9f65f2f02ec70fdf3431255b4b3356d3d82175c8a5c99d0368bf733c63d87d81ca9f7ce4a3
-DIST tor-0.4.8.10.tar.gz 8272740 BLAKE2B ef470664d85e019f6cac2366e934d5dc31b8ae92f121a2b4c8c95f8267abce5ce4413d30a24affa40a069d587212364ae5a7c3cd114488e50a535f01c54c6e77 SHA512 3827902541a0289ed1bfcae9bb0ac8bf8dee7bedacbfdf9c703bb38c3c586d1cfe5eeb20a477664e10a2b81b90a7fd5d623e556f3ee32aad4f8a9f828bc4dd83
-DIST tor-0.4.8.10.tar.gz.sha256sum 86 BLAKE2B 1410a5e7e486c7c33b6b217a53d250bc3e1d76c87e74ad29f6c6a67cbdacb3627521cc8936f7e8e8d72c3333078cede222d13c825b8d66df7c1d50721043f89e SHA512 853a88b75ecd195e6b155361c8321b575c5fd526f5d73da8b5de99ac875b2f22f2b8668f7c9a68a8e599170290041533345fd324dd56a0102d5cd5ddf8020461
-DIST tor-0.4.8.10.tar.gz.sha256sum.asc 716 BLAKE2B 0154ef1defa1a8227813ef3589f1fd4215f5bd305447fec1404f7950c0b89e6d9fcb6686900e4819d0f1a635d3b08e60cdc9c96a4f74e603185afb6eb1e29279 SHA512 aaeee664c9342a6cddaacfeea6e6974ce374d746153a28943dee1db3db48a8e08f36a076856358819cae8ea2f8b7d912d0e6dc2dc772465dba3283b553f43b91
 DIST tor-0.4.8.11.tar.gz 9690074 BLAKE2B b7f5bb855a6f8fe7dfd0e0efe7b48798e9d4642e401641c83554ed0f98fe238a5f303e9466e9e24a7ade63488a745b3c957ed6cc53a2f5e21f5f9c3f78f7fa78 SHA512 186fb690a751b4c0dda87afc741627a4c8c9b1a781b295dcf25b767c40c3b62664c08c63fc98f80095af76dfa1060b42e19936941528d091db50fafdce88be6e
 DIST tor-0.4.8.11.tar.gz.sha256sum 86 BLAKE2B 062077991dc4ca70c457a7c1a70c815d288b5afcd54246a51dd86685454fb0cf52aa8e12974e7909ef2c0b8e764c369278113c5b7d84e866fad0a66bdff93ebc SHA512 061411e2e5695fec84fcade7cf8ed36e14d5ea3ccfab7b0d7abdb53a57ca1d3647f73f416e5cc55c0d11f8d5405bba1a972d0b8ed05e6e20d088de57eac027bf
 DIST tor-0.4.8.11.tar.gz.sha256sum.asc 1321 BLAKE2B fbb12fbef8ef2c33a0a1c40eefb7b180e63f1d0c97ef15352e209a55decdcbfee3ed82be0ce28e95e47dc22f85602ff53008d585b15c82e2b669f39d987c106a SHA512 9f35e5a17293f4e5175fb617de913ad2622a695461d0f5fb78ad8b942c6af1e8d1de782e6bb06796ce7e8acb70c0c9c75ff6d6ac605defb73526c26dbe313546
diff --git a/net-vpn/tor/files/tor-0.4.7.13-libressl.patch b/net-vpn/tor/files/tor-0.4.7.13-libressl.patch
deleted file mode 100644
index bba0c45f3fc3..000000000000
--- a/net-vpn/tor/files/tor-0.4.7.13-libressl.patch
+++ /dev/null
@@ -1,202 +0,0 @@
-Upstream-MR: https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/598
-Upstream-Commit: https://gitlab.torproject.org/tpo/core/tor/-/commit/da52d7206a4a8e4fa8b5e80b5ed73de50fbe8692
-Upstream-MR: https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/713
-Upstream-Commit: https://gitlab.torproject.org/tpo/core/tor/-/commit/9850dc59c0db5cbcadc314be8d324a992880fce1
-
-From f3dabd705f26c56076934323f24b5b05ecdfd39c Mon Sep 17 00:00:00 2001
-From: "Alex Xu (Hello71)" <alex_y_xu@yahoo.ca>
-Date: Tue, 5 Jul 2022 11:37:30 -0400
-Subject: [PATCH 1/2] LibreSSL 3.5 compatibility
-
-LibreSSL is now closer to OpenSSL 1.1 than OpenSSL 1.0. According to
-https://undeadly.org/cgi?action=article;sid=20220116121253, this is the
-intention of OpenBSD developers.
-
-According to #40630, many special cases are needed to compile Tor against
-LibreSSL 3.5 when using Tor's OpenSSL 1.0 compatibility mode, whereas only a
-small number of #defines are required when using OpenSSL 1.1 compatibility
-mode. One additional workaround is required for LibreSSL 3.4 compatibility.
-
-Compiles and passes unit tests with LibreSSL 3.4.3 and 3.5.1.
----
- configure.ac                           |  2 +-
- src/lib/crypt_ops/compat_openssl.h     | 22 +++++++++++++---------
- src/lib/crypt_ops/crypto_openssl_mgt.h |  3 +--
- src/lib/crypt_ops/crypto_rsa_openssl.c |  8 +++++---
- 4 files changed, 20 insertions(+), 15 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 8baae007cf..6ab7903010 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1022,7 +1022,7 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
- AC_MSG_CHECKING([for OpenSSL < 1.0.1])
- AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
- #include <openssl/opensslv.h>
--#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x1000100fL
-+#if OPENSSL_VERSION_NUMBER < 0x1000100fL
- #error "too old"
- #endif
-    ]], [[]])],
-diff --git a/src/lib/crypt_ops/compat_openssl.h b/src/lib/crypt_ops/compat_openssl.h
-index 0f56f338b5..c5eccdb015 100644
---- a/src/lib/crypt_ops/compat_openssl.h
-+++ b/src/lib/crypt_ops/compat_openssl.h
-@@ -20,32 +20,36 @@
-  * \brief compatibility definitions for working with different openssl forks
-  **/
- 
--#if !defined(LIBRESSL_VERSION_NUMBER) && \
--  OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,0,1)
-+#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,0,1)
- #error "We require OpenSSL >= 1.0.1"
- #endif
- 
--#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) && \
--   ! defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0)
- /* We define this macro if we're trying to build with the majorly refactored
-  * API in OpenSSL 1.1 */
- #define OPENSSL_1_1_API
- #endif /* OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) && ... */
- 
--#ifndef OPENSSL_1_1_API
--#define OpenSSL_version(v) SSLeay_version(v)
--#define tor_OpenSSL_version_num() SSLeay()
-+/* LibreSSL claims to be OpenSSL 2.0 but lacks these OpenSSL 1.1 APIs */
-+#if !defined(OPENSSL_1_1_API) || defined(LIBRESSL_VERSION_NUMBER)
- #define RAND_OpenSSL() RAND_SSLeay()
- #define STATE_IS_SW_SERVER_HELLO(st)       \
-   (((st) == SSL3_ST_SW_SRVR_HELLO_A) ||    \
-    ((st) == SSL3_ST_SW_SRVR_HELLO_B))
- #define OSSL_HANDSHAKE_STATE int
- #define CONST_IF_OPENSSL_1_1_API
--#else /* defined(OPENSSL_1_1_API) */
--#define tor_OpenSSL_version_num() OpenSSL_version_num()
-+#else
- #define STATE_IS_SW_SERVER_HELLO(st) \
-   ((st) == TLS_ST_SW_SRVR_HELLO)
- #define CONST_IF_OPENSSL_1_1_API const
-+#endif
-+
-+/* OpenSSL 1.1 and LibreSSL both have these APIs */
-+#ifndef OPENSSL_1_1_API
-+#define OpenSSL_version(v) SSLeay_version(v)
-+#define tor_OpenSSL_version_num() SSLeay()
-+#else /* defined(OPENSSL_1_1_API) */
-+#define tor_OpenSSL_version_num() OpenSSL_version_num()
- #endif /* !defined(OPENSSL_1_1_API) */
- 
- #endif /* defined(ENABLE_OPENSSL) */
-diff --git a/src/lib/crypt_ops/crypto_openssl_mgt.h b/src/lib/crypt_ops/crypto_openssl_mgt.h
-index c6f63ffa08..96a37721dd 100644
---- a/src/lib/crypt_ops/crypto_openssl_mgt.h
-+++ b/src/lib/crypt_ops/crypto_openssl_mgt.h
-@@ -54,8 +54,7 @@
- #define DISABLE_ENGINES
- #endif
- 
--#if OPENSSL_VERSION_NUMBER >= OPENSSL_VER(1,1,0,0,5) && \
--  !defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VER(1,1,0,0,5)
- /* OpenSSL as of 1.1.0pre4 has an "new" thread API, which doesn't require
-  * setting up various callbacks.
-  *
-diff --git a/src/lib/crypt_ops/crypto_rsa_openssl.c b/src/lib/crypt_ops/crypto_rsa_openssl.c
-index a21c4a65cf..544d72e6ca 100644
---- a/src/lib/crypt_ops/crypto_rsa_openssl.c
-+++ b/src/lib/crypt_ops/crypto_rsa_openssl.c
-@@ -572,7 +572,9 @@ static bool
- rsa_private_key_too_long(RSA *rsa, int max_bits)
- {
-   const BIGNUM *n, *e, *p, *q, *d, *dmp1, *dmq1, *iqmp;
--#ifdef OPENSSL_1_1_API
-+#if defined(OPENSSL_1_1_API) && \
-+    (!defined(LIBRESSL_VERSION_NUMBER) || \
-+     LIBRESSL_VERSION_NUMBER >= OPENSSL_V_SERIES(3,5,0))
- 
- #if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,1)
-   n = RSA_get0_n(rsa);
-@@ -591,7 +593,7 @@ rsa_private_key_too_long(RSA *rsa, int max_bits)
- 
-   if (RSA_bits(rsa) > max_bits)
-     return true;
--#else /* !defined(OPENSSL_1_1_API) */
-+#else /* !defined(OPENSSL_1_1_API) && ... */
-   n = rsa->n;
-   e = rsa->e;
-   p = rsa->p;
-@@ -600,7 +602,7 @@ rsa_private_key_too_long(RSA *rsa, int max_bits)
-   dmp1 = rsa->dmp1;
-   dmq1 = rsa->dmq1;
-   iqmp = rsa->iqmp;
--#endif /* defined(OPENSSL_1_1_API) */
-+#endif /* defined(OPENSSL_1_1_API) && ... */
- 
-   if (n && BN_num_bits(n) > max_bits)
-     return true;
--- 
-GitLab
-
-
-From b1545b6d18fbef6c790e2731a814fa54230d8857 Mon Sep 17 00:00:00 2001
-From: "Alex Xu (Hello71)" <alex_y_xu@yahoo.ca>
-Date: Tue, 19 Jul 2022 16:18:29 -0400
-Subject: [PATCH 2/2] Changes file for #40630 (LibreSSL 3.5 compatibility)
-
----
- changes/issue40630 | 3 +++
- 1 file changed, 3 insertions(+)
- create mode 100644 changes/issue40630
-
-diff --git a/changes/issue40630 b/changes/issue40630
-new file mode 100644
-index 0000000000..faf04941b6
---- /dev/null
-+++ b/changes/issue40630
-@@ -0,0 +1,3 @@
-+  o Minor features (portability, compilation):
-+    - Use OpenSSL 1.1 APIs for LibreSSL, fixing LibreSSL 3.5 compatibility.
-+      Fixes issue 40630; patch by Alex Xu (Hello71).
--- 
-GitLab
-
-From 9850dc59c0db5cbcadc314be8d324a992880fce1 Mon Sep 17 00:00:00 2001
-From: orbea <orbea@riseup.net>
-Date: Mon, 29 May 2023 12:56:37 -0700
-Subject: [PATCH] tls: Disable a warning with LibreSSL >= 3.8.0
-
-Skip a warning using EC_GFp_nist_method() which was removed in LibreSSL
-3.8.
-
-Based on a patch from OpenBSD.
-
-https://github.com/openbsd/ports/commit/33fe251a08cb11f30ce6094a2e0759c3bb63ed16
-
-These functions are deprecated since OpenSSL 3.0.
-
-https://www.openssl.org/docs/man3.1/man3/EC_GFp_nist_method.html
----
- src/lib/tls/tortls_openssl.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/src/lib/tls/tortls_openssl.c b/src/lib/tls/tortls_openssl.c
-index 12260c09d3..c0a89ac272 100644
---- a/src/lib/tls/tortls_openssl.c
-+++ b/src/lib/tls/tortls_openssl.c
-@@ -340,8 +340,10 @@ tor_tls_init(void)
-     SSL_load_error_strings();
- #endif /* defined(OPENSSL_1_1_API) */
- 
--#if (SIZEOF_VOID_P >= 8 &&                              \
--     OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,0,1))
-+#if (SIZEOF_VOID_P >= 8 &&                                \
-+     OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,0,1) && \
-+     (!defined(LIBRESSL_VERSION_NUMBER) ||                \
-+      LIBRESSL_VERSION_NUMBER < 0x3080000fL))
-     long version = tor_OpenSSL_version_num();
- 
-     /* LCOV_EXCL_START : we can't test these lines on the same machine */
--- 
-GitLab
-
diff --git a/net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch b/net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch
deleted file mode 100644
index 2b473bf981b6..000000000000
--- a/net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch
+++ /dev/null
@@ -1,337 +0,0 @@
-From https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/574
-Gentoo Bug: https://bugs.gentoo.org/920063
-From: Pierre Bourdon <delroth@gmail.com>
-Date: Sat, 30 Apr 2022 11:52:59 +0200
-Subject: [PATCH 1/4] sandbox: fix openat filtering on AArch64
-
-New glibc versions not sign-extending 32 bit negative constants seems to
-not be a thing on AArch64. I suspect that this might not be the only
-architecture where the sign-extensions is happening, and the correct fix
-might be instead to use a proper 32 bit comparison for the first openat
-parameter. For now, band-aid fix this so the sandbox can work again on
-AArch64.
---- a/src/lib/sandbox/sandbox.c
-+++ b/src/lib/sandbox/sandbox.c
-@@ -518,7 +518,12 @@ libc_uses_openat_for_opendir(void)
- static int
- libc_negative_constant_needs_cast(void)
- {
-+#if defined(__aarch64__) && defined(__LP64__)
-+  /* Existing glibc versions always sign-extend to 64 bits on AArch64. */
-+  return 0;
-+#else
-   return is_libc_at_least(2, 27);
-+#endif
- }
- 
- /** Allow a single file to be opened.  If <b>use_openat</b> is true,
--- 
-GitLab
-
-
-From 8fd13f7a7bfd4efc02d888ce9d10bcb6a80a03c8 Mon Sep 17 00:00:00 2001
-From: Pierre Bourdon <delroth@gmail.com>
-Date: Sat, 30 Apr 2022 13:02:16 +0200
-Subject: [PATCH 2/4] sandbox: filter {chown,chmod,rename} via their *at
- variant on Aarch64
-
-The chown/chmod/rename syscalls have never existed on AArch64, and libc
-implements the POSIX functions via the fchownat/fchmodat/renameat
-syscalls instead.
-
-Add new filter functions for fchownat/fchmodat/renameat, not made
-architecture specific since the syscalls exists everywhere else too.
-However, in order to limit seccomp filter space usage, we only insert
-rules for one of {chown, chown32, fchownat} depending on the
-architecture (resp. {chmod, fchmodat}, {rename, renameat}).
---- a/src/lib/sandbox/sandbox.c
-+++ b/src/lib/sandbox/sandbox.c
-@@ -614,6 +614,32 @@ sb_chmod(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-   return 0;
- }
- 
-+static int
-+sb_fchmodat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-+{
-+  int rc;
-+  sandbox_cfg_t *elem = NULL;
-+
-+  // for each dynamic parameter filters
-+  for (elem = filter; elem != NULL; elem = elem->next) {
-+    smp_param_t *param = elem->param;
-+
-+    if (param != NULL && param->prot == 1 && param->syscall
-+        == SCMP_SYS(fchmodat)) {
-+      rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchmodat),
-+          SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+          SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
-+      if (rc != 0) {
-+        log_err(LD_BUG,"(Sandbox) failed to add fchmodat syscall, received "
-+            "libseccomp error %d", rc);
-+        return rc;
-+      }
-+    }
-+  }
-+
-+  return 0;
-+}
-+
- #ifdef __i386__
- static int
- sb_chown32(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-@@ -666,6 +692,32 @@ sb_chown(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
- }
- #endif /* defined(__i386__) */
- 
-+static int
-+sb_fchownat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-+{
-+  int rc;
-+  sandbox_cfg_t *elem = NULL;
-+
-+  // for each dynamic parameter filters
-+  for (elem = filter; elem != NULL; elem = elem->next) {
-+    smp_param_t *param = elem->param;
-+
-+    if (param != NULL && param->prot == 1 && param->syscall
-+        == SCMP_SYS(fchownat)) {
-+      rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchownat),
-+          SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+          SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
-+      if (rc != 0) {
-+        log_err(LD_BUG,"(Sandbox) failed to add fchownat syscall, received "
-+            "libseccomp error %d", rc);
-+        return rc;
-+      }
-+    }
-+  }
-+
-+  return 0;
-+}
-+
- /**
-  * Function responsible for setting up the rename syscall for
-  * the seccomp filter sandbox.
-@@ -697,6 +749,39 @@ sb_rename(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-   return 0;
- }
- 
-+/**
-+ * Function responsible for setting up the renameat syscall for
-+ * the seccomp filter sandbox.
-+ */
-+static int
-+sb_renameat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-+{
-+  int rc;
-+  sandbox_cfg_t *elem = NULL;
-+
-+  // for each dynamic parameter filters
-+  for (elem = filter; elem != NULL; elem = elem->next) {
-+    smp_param_t *param = elem->param;
-+
-+    if (param != NULL && param->prot == 1 &&
-+        param->syscall == SCMP_SYS(renameat)) {
-+
-+      rc = seccomp_rule_add_4(ctx, SCMP_ACT_ALLOW, SCMP_SYS(renameat),
-+            SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+            SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
-+            SCMP_CMP_NEG(2, SCMP_CMP_EQ, AT_FDCWD),
-+            SCMP_CMP_STR(3, SCMP_CMP_EQ, param->value2));
-+      if (rc != 0) {
-+        log_err(LD_BUG,"(Sandbox) failed to add renameat syscall, received "
-+            "libseccomp error %d", rc);
-+        return rc;
-+      }
-+    }
-+  }
-+
-+  return 0;
-+}
-+
- /**
-  * Function responsible for setting up the openat syscall for
-  * the seccomp filter sandbox.
-@@ -1317,7 +1402,9 @@ static sandbox_filter_func_t filter_func[] = {
- #else
-     sb_chown,
- #endif
-+    sb_fchownat,
-     sb_chmod,
-+    sb_fchmodat,
-     sb_open,
-     sb_openat,
-     sb_opendir,
-@@ -1325,6 +1412,7 @@ static sandbox_filter_func_t filter_func[] = {
-     sb_ptrace,
- #endif
-     sb_rename,
-+    sb_renameat,
- #ifdef __NR_fcntl64
-     sb_fcntl64,
- #endif
-@@ -1592,10 +1680,24 @@ new_element(int syscall, char *value)
- 
- #ifdef __i386__
- #define SCMP_chown SCMP_SYS(chown32)
-+#elif defined(__aarch64__) && defined(__LP64__)
-+#define SCMP_chown SCMP_SYS(fchownat)
- #else
- #define SCMP_chown SCMP_SYS(chown)
- #endif
- 
-+#if defined(__aarch64__) && defined(__LP64__)
-+#define SCMP_chmod SCMP_SYS(fchmodat)
-+#else
-+#define SCMP_chmod SCMP_SYS(chmod)
-+#endif
-+
-+#if defined(__aarch64__) && defined(__LP64__)
-+#define SCMP_rename SCMP_SYS(renameat)
-+#else
-+#define SCMP_rename SCMP_SYS(rename)
-+#endif
-+
- #ifdef __NR_stat64
- #define SCMP_stat SCMP_SYS(stat64)
- #else
-@@ -1633,7 +1735,7 @@ sandbox_cfg_allow_chmod_filename(sandbox_cfg_t **cfg, char *file)
- {
-   sandbox_cfg_t *elem = NULL;
- 
--  elem = new_element(SCMP_SYS(chmod), file);
-+  elem = new_element(SCMP_chmod, file);
- 
-   elem->next = *cfg;
-   *cfg = elem;
-@@ -1659,7 +1761,7 @@ sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2)
- {
-   sandbox_cfg_t *elem = NULL;
- 
--  elem = new_element2(SCMP_SYS(rename), file1, file2);
-+  elem = new_element2(SCMP_rename, file1, file2);
- 
-   elem->next = *cfg;
-   *cfg = elem;
--- 
-GitLab
-
-
-From eb0749d64917fee6ff74c3810dbec8cd063f546c Mon Sep 17 00:00:00 2001
-From: Pierre Bourdon <delroth@gmail.com>
-Date: Wed, 4 May 2022 07:19:40 +0200
-Subject: [PATCH 3/4] sandbox: replace SCMP_CMP_NEG with masked equality checks
-
-For some syscalls the kernel ABI uses 32 bit signed integers. Whether
-these 32 bit integer values are sign extended or zero extended to the
-native 64 bit register sizes is undefined and dependent on the {arch,
-compiler, libc} being used. Instead of trying to detect which cases
-zero-extend and which cases sign-extend, this commit uses a masked
-equality check on the lower 32 bits of the value.
---- a/src/lib/sandbox/sandbox.c
-+++ b/src/lib/sandbox/sandbox.c
-@@ -141,10 +141,12 @@ static sandbox_cfg_t *filter_dynamic = NULL;
-  * the high bits of the value might get masked out improperly. */
- #define SCMP_CMP_MASKED(a,b,c) \
-   SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, ~(scmp_datum_t)(b), (c))
--/* For negative constants, the rule to add depends on the glibc version. */
--#define SCMP_CMP_NEG(a,op,b) (libc_negative_constant_needs_cast() ? \
--                              (SCMP_CMP((a), (op), (unsigned int)(b))) : \
--                              (SCMP_CMP_STR((a), (op), (b))))
-+/* Negative constants aren't consistently sign extended or zero extended.
-+ * Different compilers, libc, and architectures behave differently. For cases
-+ * where the kernel ABI uses a 32 bit integer, this macro can be used to
-+ * mask-compare only the lower 32 bits of the value. */
-+#define SCMP_CMP_LOWER32_EQ(a,b) \
-+  SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, 0xFFFFFFFF, (unsigned int)(b))
- 
- /** Variable used for storing all syscall numbers that will be allowed with the
-  * stage 1 general Tor sandbox.
-@@ -513,19 +515,6 @@ libc_uses_openat_for_opendir(void)
-          (is_libc_at_least(2, 15) && !is_libc_at_least(2, 22));
- }
- 
--/* Return true if we think we're running with a libc that needs to cast
-- * negative arguments like AT_FDCWD for seccomp rules. */
--static int
--libc_negative_constant_needs_cast(void)
--{
--#if defined(__aarch64__) && defined(__LP64__)
--  /* Existing glibc versions always sign-extend to 64 bits on AArch64. */
--  return 0;
--#else
--  return is_libc_at_least(2, 27);
--#endif
--}
--
- /** Allow a single file to be opened.  If <b>use_openat</b> is true,
-  * we're using a libc that remaps all the opens into openats. */
- static int
-@@ -533,7 +522,7 @@ allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file)
- {
-   if (use_openat) {
-     return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
--                              SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+                              SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
-                               SCMP_CMP_STR(1, SCMP_CMP_EQ, file));
-   } else {
-     return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open),
-@@ -627,7 +616,7 @@ sb_fchmodat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-     if (param != NULL && param->prot == 1 && param->syscall
-         == SCMP_SYS(fchmodat)) {
-       rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchmodat),
--          SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+          SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
-           SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
-       if (rc != 0) {
-         log_err(LD_BUG,"(Sandbox) failed to add fchmodat syscall, received "
-@@ -705,7 +694,7 @@ sb_fchownat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-     if (param != NULL && param->prot == 1 && param->syscall
-         == SCMP_SYS(fchownat)) {
-       rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchownat),
--          SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+          SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
-           SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
-       if (rc != 0) {
-         log_err(LD_BUG,"(Sandbox) failed to add fchownat syscall, received "
-@@ -767,9 +756,9 @@ sb_renameat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-         param->syscall == SCMP_SYS(renameat)) {
- 
-       rc = seccomp_rule_add_4(ctx, SCMP_ACT_ALLOW, SCMP_SYS(renameat),
--            SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+            SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
-             SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
--            SCMP_CMP_NEG(2, SCMP_CMP_EQ, AT_FDCWD),
-+            SCMP_CMP_LOWER32_EQ(2, AT_FDCWD),
-             SCMP_CMP_STR(3, SCMP_CMP_EQ, param->value2));
-       if (rc != 0) {
-         log_err(LD_BUG,"(Sandbox) failed to add renameat syscall, received "
-@@ -799,7 +788,7 @@ sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-     if (param != NULL && param->prot == 1 && param->syscall
-         == SCMP_SYS(openat)) {
-       rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
--          SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+          SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
-           SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
-           SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|
-               O_CLOEXEC));
--- 
-GitLab
-
-
-From 42034ae9da2866c67ce8cb8522d6a619d8b21170 Mon Sep 17 00:00:00 2001
-From: Pierre Bourdon <delroth@gmail.com>
-Date: Wed, 4 May 2022 07:31:06 +0200
-Subject: [PATCH 4/4] changes: add entry for MR !574
-
---- /dev/null
-+++ b/changes/aarch64_sandbox
-@@ -0,0 +1,5 @@
-+  o Minor bugfixes (sandbox):
-+    - Fix sandbox support on AArch64 systems. More "*at" variants of syscalls
-+      are now supported. Signed 32 bit syscall parameters are checked more
-+      precisely, which should lead to lower likelihood of breakages with future
-+      compiler and libc releases. Fixes bug 40599; bugfix on 0.4.4.3-alpha.
--- 
-GitLab
-
diff --git a/net-vpn/tor/tor-0.4.7.13-r1.ebuild b/net-vpn/tor/tor-0.4.7.13-r1.ebuild
deleted file mode 100644
index 8603bc87a710..000000000000
--- a/net-vpn/tor/tor-0.4.7.13-r1.ebuild
+++ /dev/null
@@ -1,149 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
-inherit autotools python-any-r1 readme.gentoo-r1 systemd verify-sig
-
-MY_PV="$(ver_rs 4 -)"
-MY_PF="${PN}-${MY_PV}"
-DESCRIPTION="Anonymizing overlay network for TCP"
-HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
-SRC_URI="
-	https://www.torproject.org/dist/${MY_PF}.tar.gz
-	https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
-	verify-sig? (
-		https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
-		https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
-	)
-"
-S="${WORKDIR}/${MY_PF}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
-	KEYWORDS="amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc x86 ~ppc-macos"
-fi
-IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
-RESTRICT="!test? ( test )"
-
-DEPEND="
-	>=dev-libs/libevent-2.1.12-r1:=[ssl]
-	sys-libs/zlib
-	caps? ( sys-libs/libcap )
-	man? ( app-text/asciidoc )
-	dev-libs/openssl:=[-bindist(-)]
-	lzma? ( app-arch/xz-utils )
-	scrypt? ( app-crypt/libscrypt )
-	seccomp? ( >=sys-libs/libseccomp-2.4.1 )
-	systemd? ( sys-apps/systemd )
-	zstd? ( app-arch/zstd )
-"
-RDEPEND="
-	acct-user/tor
-	acct-group/tor
-	${DEPEND}
-	selinux? ( sec-policy/selinux-tor )
-"
-DEPEND+="
-	test? (
-		${DEPEND}
-		${PYTHON_DEPS}
-	)
-"
-BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20221213 )"
-
-DOCS=()
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
-	"${FILESDIR}"/${PN}-0.4.7.13-libressl.patch
-)
-
-pkg_setup() {
-	use test && python-any-r1_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		cd "${DISTDIR}" || die
-		verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
-		verify-sig_verify_unsigned_checksums \
-			${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
-		cd "${WORKDIR}" || die
-	fi
-
-	default
-}
-
-src_prepare() {
-	default
-
-	# Running shellcheck automagically isn't useful for ebuild testing.
-	echo "exit 0" > scripts/maint/checkShellScripts.sh || die
-
-	# Only needed for libressl patch
-	eautoreconf
-}
-
-src_configure() {
-	use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
-
-	export ac_cv_lib_cap_cap_init=$(usex caps)
-	export tor_cv_PYTHON="${EPYTHON}"
-
-	local myeconfargs=(
-		--localstatedir="${EPREFIX}/var"
-		--disable-all-bugs-are-fatal
-		--enable-system-torrc
-		--disable-android
-		--disable-coverage
-		--disable-html-manual
-		--disable-libfuzzer
-		--enable-missing-doc-warnings
-		--disable-module-dirauth
-		--enable-pic
-		--disable-restart-debugging
-
-		# This option is enabled by default upstream w/ zstd, surprisingly.
-		# zstd upstream says this shouldn't be relied upon and it may
-		# break API & ABI at any point, so Tor tries to fake static-linking
-		# to make it work, but then requires a rebuild on any new zstd version
-		# even when its standard ABI hasn't changed.
-		# See bug #727406 and bug #905708.
-		--disable-zstd-advanced-apis
-
-		$(use_enable man asciidoc)
-		$(use_enable man manpage)
-		$(use_enable lzma)
-		$(use_enable scrypt libscrypt)
-		$(use_enable seccomp)
-		$(use_enable server module-relay)
-		$(use_enable systemd)
-		$(use_enable tor-hardening gcc-hardening)
-		$(use_enable tor-hardening linker-hardening)
-		$(use_enable test unittests)
-		$(use_enable zstd)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-	readme.gentoo_create_doc
-
-	newconfd "${FILESDIR}"/tor.confd tor
-	newinitd "${FILESDIR}"/tor.initd-r9 tor
-	systemd_dounit "${FILESDIR}"/tor.service
-
-	keepdir /var/lib/tor
-
-	fperms 750 /var/lib/tor
-	fowners tor:tor /var/lib/tor
-
-	insinto /etc/tor/
-	newins "${FILESDIR}"/torrc-r2 torrc
-}
diff --git a/net-vpn/tor/tor-0.4.7.16-r1.ebuild b/net-vpn/tor/tor-0.4.7.16-r1.ebuild
deleted file mode 100644
index 6837ebeb76ed..000000000000
--- a/net-vpn/tor/tor-0.4.7.16-r1.ebuild
+++ /dev/null
@@ -1,180 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
-inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
-
-MY_PV="$(ver_rs 4 -)"
-MY_PF="${PN}-${MY_PV}"
-DESCRIPTION="Anonymizing overlay network for TCP"
-HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.torproject.org/tpo/core/tor"
-	inherit autotools git-r3
-else
-	SRC_URI="
-		https://www.torproject.org/dist/${MY_PF}.tar.gz
-		https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
-		verify-sig? (
-			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
-			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
-		)
-	"
-
-	S="${WORKDIR}/${MY_PF}"
-
-	if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
-		KEYWORDS="~amd64 arm arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc x86 ~ppc-macos"
-	fi
-
-	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
-fi
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
-RESTRICT="!test? ( test )"
-
-DEPEND="
-	>=dev-libs/libevent-2.1.12-r1:=[ssl]
-	dev-libs/openssl:=[-bindist(-)]
-	sys-libs/zlib
-	caps? ( sys-libs/libcap )
-	man? ( app-text/asciidoc )
-	lzma? ( app-arch/xz-utils )
-	scrypt? ( app-crypt/libscrypt )
-	seccomp? ( >=sys-libs/libseccomp-2.4.1 )
-	systemd? ( sys-apps/systemd:= )
-	zstd? ( app-arch/zstd:= )
-"
-RDEPEND="
-	acct-user/tor
-	acct-group/tor
-	${DEPEND}
-	selinux? ( sec-policy/selinux-tor )
-"
-DEPEND+="
-	test? (
-		${DEPEND}
-		${PYTHON_DEPS}
-	)
-"
-
-DOCS=()
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
-	"${FILESDIR}"/${P}-arm64-sandbox.patch
-)
-
-pkg_setup() {
-	use test && python-any-r1_pkg_setup
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	else
-		if use verify-sig; then
-			cd "${DISTDIR}" || die
-			verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
-			verify-sig_verify_unsigned_checksums \
-				${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
-			cd "${WORKDIR}" || die
-		fi
-
-		default
-	fi
-}
-
-src_prepare() {
-	default
-
-	# Running shellcheck automagically isn't useful for ebuild testing.
-	echo "exit 0" > scripts/maint/checkShellScripts.sh || die
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
-
-	export ac_cv_lib_cap_cap_init=$(usex caps)
-	export tor_cv_PYTHON="${EPYTHON}"
-
-	local myeconfargs=(
-		--localstatedir="${EPREFIX}/var"
-		--disable-all-bugs-are-fatal
-		--enable-system-torrc
-		--disable-android
-		--disable-coverage
-		--disable-html-manual
-		--disable-libfuzzer
-		--enable-missing-doc-warnings
-		--disable-module-dirauth
-		--enable-pic
-		--disable-restart-debugging
-
-		$(use_enable man asciidoc)
-		$(use_enable man manpage)
-		$(use_enable lzma)
-		$(use_enable scrypt libscrypt)
-		$(use_enable seccomp)
-		$(use_enable server module-relay)
-		$(use_enable systemd)
-		$(use_enable tor-hardening gcc-hardening)
-		$(use_enable tor-hardening linker-hardening)
-		$(use_enable test unittests)
-		$(use_enable zstd)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	local skip_tests=(
-		# Fails in sandbox
-		:sandbox/open_filename
-		:sandbox/openat_filename
-	)
-
-	if use arm ; then
-		skip_tests+=(
-			# bug #920905
-			# https://gitlab.torproject.org/tpo/core/tor/-/issues/40912
-			:sandbox/opendir_dirname
-			:sandbox/openat_filename
-			:sandbox/chmod_filename
-			:sandbox/chown_filename
-			:sandbox/rename_filename
-		)
-	fi
-
-	# The makefile runs these by parallel by chunking them with a script
-	# but that means we lose verbosity and can't skip individual tests easily
-	# either.
-	edo ./src/test/test --verbose "${skip_tests[@]}"
-}
-
-src_install() {
-	default
-	readme.gentoo_create_doc
-
-	newconfd "${FILESDIR}"/tor.confd tor
-	newinitd "${FILESDIR}"/tor.initd-r9 tor
-	systemd_dounit "${FILESDIR}"/tor.service
-
-	keepdir /var/lib/tor
-
-	fperms 750 /var/lib/tor
-	fowners tor:tor /var/lib/tor
-
-	insinto /etc/tor/
-	newins "${FILESDIR}"/torrc-r2 torrc
-}
diff --git a/net-vpn/tor/tor-0.4.7.16.ebuild b/net-vpn/tor/tor-0.4.7.16.ebuild
deleted file mode 100644
index 5e354a9a9c39..000000000000
--- a/net-vpn/tor/tor-0.4.7.16.ebuild
+++ /dev/null
@@ -1,167 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
-inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
-
-MY_PV="$(ver_rs 4 -)"
-MY_PF="${PN}-${MY_PV}"
-DESCRIPTION="Anonymizing overlay network for TCP"
-HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.torproject.org/tpo/core/tor"
-	inherit autotools git-r3
-else
-	SRC_URI="
-		https://www.torproject.org/dist/${MY_PF}.tar.gz
-		https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
-		verify-sig? (
-			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
-			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
-		)
-	"
-
-	S="${WORKDIR}/${MY_PF}"
-
-	if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
-		KEYWORDS="amd64 ~arm ~arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc ~x86 ~ppc-macos"
-	fi
-
-	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
-fi
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
-RESTRICT="!test? ( test )"
-
-DEPEND="
-	>=dev-libs/libevent-2.1.12-r1:=[ssl]
-	dev-libs/openssl:=[-bindist(-)]
-	sys-libs/zlib
-	caps? ( sys-libs/libcap )
-	man? ( app-text/asciidoc )
-	lzma? ( app-arch/xz-utils )
-	scrypt? ( app-crypt/libscrypt )
-	seccomp? ( >=sys-libs/libseccomp-2.4.1 )
-	systemd? ( sys-apps/systemd:= )
-	zstd? ( app-arch/zstd:= )
-"
-RDEPEND="
-	acct-user/tor
-	acct-group/tor
-	${DEPEND}
-	selinux? ( sec-policy/selinux-tor )
-"
-DEPEND+="
-	test? (
-		${DEPEND}
-		${PYTHON_DEPS}
-	)
-"
-
-DOCS=()
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
-)
-
-pkg_setup() {
-	use test && python-any-r1_pkg_setup
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	else
-		if use verify-sig; then
-			cd "${DISTDIR}" || die
-			verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
-			verify-sig_verify_unsigned_checksums \
-				${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
-			cd "${WORKDIR}" || die
-		fi
-
-		default
-	fi
-}
-
-src_prepare() {
-	default
-
-	# Running shellcheck automagically isn't useful for ebuild testing.
-	echo "exit 0" > scripts/maint/checkShellScripts.sh || die
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
-
-	export ac_cv_lib_cap_cap_init=$(usex caps)
-	export tor_cv_PYTHON="${EPYTHON}"
-
-	local myeconfargs=(
-		--localstatedir="${EPREFIX}/var"
-		--disable-all-bugs-are-fatal
-		--enable-system-torrc
-		--disable-android
-		--disable-coverage
-		--disable-html-manual
-		--disable-libfuzzer
-		--enable-missing-doc-warnings
-		--disable-module-dirauth
-		--enable-pic
-		--disable-restart-debugging
-
-		$(use_enable man asciidoc)
-		$(use_enable man manpage)
-		$(use_enable lzma)
-		$(use_enable scrypt libscrypt)
-		$(use_enable seccomp)
-		$(use_enable server module-relay)
-		$(use_enable systemd)
-		$(use_enable tor-hardening gcc-hardening)
-		$(use_enable tor-hardening linker-hardening)
-		$(use_enable test unittests)
-		$(use_enable zstd)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	local skip_tests=(
-		# Fails in sandbox
-		:sandbox/open_filename
-		:sandbox/openat_filename
-	)
-
-	# The makefile runs these by parallel by chunking them with a script
-	# but that means we lose verbosity and can't skip individual tests easily
-	# either.
-	edo ./src/test/test --verbose "${skip_tests[@]}"
-}
-
-src_install() {
-	default
-	readme.gentoo_create_doc
-
-	newconfd "${FILESDIR}"/tor.confd tor
-	newinitd "${FILESDIR}"/tor.initd-r9 tor
-	systemd_dounit "${FILESDIR}"/tor.service
-
-	keepdir /var/lib/tor
-
-	fperms 750 /var/lib/tor
-	fowners tor:tor /var/lib/tor
-
-	insinto /etc/tor/
-	newins "${FILESDIR}"/torrc-r2 torrc
-}
diff --git a/net-vpn/tor/tor-0.4.8.10.ebuild b/net-vpn/tor/tor-0.4.8.10.ebuild
deleted file mode 100644
index 6ece856a4d65..000000000000
--- a/net-vpn/tor/tor-0.4.8.10.ebuild
+++ /dev/null
@@ -1,189 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
-inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
-
-MY_PV="$(ver_rs 4 -)"
-MY_PF="${PN}-${MY_PV}"
-DESCRIPTION="Anonymizing overlay network for TCP"
-HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://gitlab.torproject.org/tpo/core/tor"
-	inherit autotools git-r3
-else
-	SRC_URI="
-		https://www.torproject.org/dist/${MY_PF}.tar.gz
-		https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
-		verify-sig? (
-			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
-			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
-		)
-	"
-
-	S="${WORKDIR}/${MY_PF}"
-
-	if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
-		KEYWORDS="amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc x86 ~ppc-macos"
-	fi
-
-	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
-fi
-
-# BSD in general, but for PoW, needs --enable-gpl (GPL-3 per --version)
-# We also already had GPL-2 listed here for the init script, but obviously
-# that's different from the actual binary.
-LICENSE="BSD GPL-2 GPL-3"
-SLOT="0"
-IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
-RESTRICT="!test? ( test )"
-
-DEPEND="
-	>=dev-libs/libevent-2.1.12-r1:=[ssl]
-	dev-libs/openssl:=[-bindist(-)]
-	sys-libs/zlib
-	caps? ( sys-libs/libcap )
-	man? ( app-text/asciidoc )
-	lzma? ( app-arch/xz-utils )
-	scrypt? ( app-crypt/libscrypt )
-	seccomp? ( >=sys-libs/libseccomp-2.4.1 )
-	systemd? ( sys-apps/systemd:= )
-	zstd? ( app-arch/zstd:= )
-"
-RDEPEND="
-	acct-user/tor
-	acct-group/tor
-	${DEPEND}
-	selinux? ( sec-policy/selinux-tor )
-"
-DEPEND+="
-	test? (
-		${DEPEND}
-		${PYTHON_DEPS}
-	)
-"
-
-DOCS=()
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
-)
-
-pkg_setup() {
-	use test && python-any-r1_pkg_setup
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	else
-		if use verify-sig; then
-			cd "${DISTDIR}" || die
-			verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
-			verify-sig_verify_unsigned_checksums \
-				${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
-			cd "${WORKDIR}" || die
-		fi
-
-		default
-	fi
-}
-
-src_prepare() {
-	default
-
-	# Running shellcheck automagically isn't useful for ebuild testing.
-	echo "exit 0" > scripts/maint/checkShellScripts.sh || die
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
-
-	export ac_cv_lib_cap_cap_init=$(usex caps)
-	export tor_cv_PYTHON="${EPYTHON}"
-
-	local myeconfargs=(
-		--localstatedir="${EPREFIX}/var"
-		--disable-all-bugs-are-fatal
-		--enable-system-torrc
-		--disable-android
-		--disable-coverage
-		--disable-html-manual
-		--disable-libfuzzer
-		--enable-missing-doc-warnings
-		--disable-module-dirauth
-		--enable-pic
-		--disable-restart-debugging
-
-		# Unless someone asks & has a compelling reason, just always
-		# build in GPL mode for pow, given we don't want yet another USE
-		# flag combination to have to test just for the sake of it.
-		# (PoW requires GPL.)
-		--enable-gpl
-		--enable-module-pow
-
-		$(use_enable man asciidoc)
-		$(use_enable man manpage)
-		$(use_enable lzma)
-		$(use_enable scrypt libscrypt)
-		$(use_enable seccomp)
-		$(use_enable server module-relay)
-		$(use_enable systemd)
-		$(use_enable tor-hardening gcc-hardening)
-		$(use_enable tor-hardening linker-hardening)
-		$(use_enable test unittests)
-		$(use_enable zstd)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	local skip_tests=(
-		# Fails in sandbox
-		:sandbox/open_filename
-		:sandbox/openat_filename
-	)
-
-	if use arm ; then
-		skip_tests+=(
-			# bug #920905
-			# https://gitlab.torproject.org/tpo/core/tor/-/issues/40912
-			:sandbox/opendir_dirname
-			:sandbox/openat_filename
-			:sandbox/chmod_filename
-			:sandbox/chown_filename
-			:sandbox/rename_filename
-		)
-	fi
-
-	# The makefile runs these by parallel by chunking them with a script
-	# but that means we lose verbosity and can't skip individual tests easily
-	# either.
-	edo ./src/test/test --verbose "${skip_tests[@]}"
-}
-
-src_install() {
-	default
-	readme.gentoo_create_doc
-
-	newconfd "${FILESDIR}"/tor.confd tor
-	newinitd "${FILESDIR}"/tor.initd-r9 tor
-	systemd_dounit "${FILESDIR}"/tor.service
-
-	keepdir /var/lib/tor
-
-	fperms 750 /var/lib/tor
-	fowners tor:tor /var/lib/tor
-
-	insinto /etc/tor/
-	newins "${FILESDIR}"/torrc-r2 torrc
-}