Merge updates from master

8 files changed, 486 insertions, 0 deletions

diff --git a/dev-util/scap-driver/files/0.29.3-fix-kmod-build-on-6.4+.patch b/dev-util/scap-driver/files/0.29.3-fix-kmod-build-on-6.4+.patch
new file mode 100644
index 000000000000..ac0a4aeca285
--- /dev/null
+++ b/dev-util/scap-driver/files/0.29.3-fix-kmod-build-on-6.4+.patch
@@ -0,0 +1,33 @@
+
+From: https://github.com/falcosecurity/libs/pull/1110
+Bug: https://github.com/falcosecurity/libs/issues/1109
+
+From 394c9d84e64ad9828cdce6cdad5a76c352e252d2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Holger=20Hoffst=C3=A4tte?= <holger@applied-asynchrony.com>
+Date: Fri, 19 May 2023 03:54:40 +0200
+Subject: [PATCH] fix(driver): fixed 6.4 kernel build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+---
+ driver/main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/driver/main.c b/driver/main.c
+index 380f85c27c..668e45429a 100644
+--- a/driver/main.c
++++ b/driver/main.c
+@@ -2912,7 +2912,11 @@ int scap_init(void)
+ 		goto init_module_err;
+ 	}
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 4, 0)
+ 	g_ppm_class = class_create(THIS_MODULE, DRIVER_DEVICE_NAME);
++#else
++	g_ppm_class = class_create(DRIVER_DEVICE_NAME);
++#endif
+ 	if (IS_ERR(g_ppm_class)) {
+ 		pr_err("can't allocate device class\n");
+ 		ret = -EFAULT;
diff --git a/dev-util/scap-driver/scap-driver-0.29.3-r3.ebuild b/dev-util/scap-driver/scap-driver-0.29.3-r3.ebuild
new file mode 100644
index 000000000000..deb27234ee35
--- /dev/null
+++ b/dev-util/scap-driver/scap-driver-0.29.3-r3.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake linux-mod
+
+DESCRIPTION="Kernel module for dev-util/sysdig"
+HOMEPAGE="https://sysdig.com/"
+
+# The driver is part of falcosecurity/libs, but for versioning reasons we cannot (yet)
+# use semver-released packages; instead we pull in a commit that is used and known
+# to work with sysdig, see sysdig/cmake/modules/falcosecurity-libs.cmake for details.
+# For now the commit here and the one referenced in sysdig should be in sync.
+LIBS_COMMIT="e5c53d648f3c4694385bbe488e7d47eaa36c229a"
+SRC_URI="https://github.com/falcosecurity/libs/archive/${LIBS_COMMIT}.tar.gz -> falcosecurity-libs-${LIBS_COMMIT}.tar.gz"
+S="${WORKDIR}/libs-${LIBS_COMMIT}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~x86"
+
+RDEPEND="!<dev-util/sysdig-${PV}[modules]"
+
+CONFIG_CHECK="HAVE_SYSCALL_TRACEPOINTS ~TRACEPOINTS"
+
+PATCHES=(
+	"${FILESDIR}"/${PV}-fix-kmod-build-on-5.18+.patch
+	"${FILESDIR}"/${PV}-fix-kmod-build-on-6.2+.patch
+	"${FILESDIR}"/${PV}-fix-kmod-build-on-6.3+.patch
+	"${FILESDIR}"/${PV}-fix-kmod-build-on-6.4+.patch
+)
+
+src_configure() {
+	local mycmakeargs=(
+		# we will use linux-mod, so just pretend to use bundled deps
+		# in order to make it through the cmake setup.
+		-DUSE_BUNDLED_DEPS=ON
+		-DCREATE_TEST_TARGETS=OFF
+		-DDRIVER_VERSION=${LIBS_COMMIT}
+	)
+
+	cmake_src_configure
+
+	# setup linux-mod ugliness
+	MODULE_NAMES="scap(extra:${BUILD_DIR}/driver/src:)"
+	BUILD_PARAMS='KERNELDIR="${KERNEL_DIR}"'
+	# work with clang-built kernels (#816024)
+	if linux_chkconfig_present CC_IS_CLANG; then
+		BUILD_PARAMS+=' CC=${CHOST}-clang'
+		if linux_chkconfig_present LD_IS_LLD; then
+			BUILD_PARAMS+=' LD=ld.lld'
+			if linux_chkconfig_present LTO_CLANG_THIN; then
+				# kernel enables cache by default leading to sandbox violations
+				BUILD_PARAMS+=' ldflags-y=--thinlto-cache-dir= LDFLAGS_MODULE=--thinlto-cache-dir='
+			fi
+		fi
+	fi
+
+	BUILD_TARGETS="all"
+}
diff --git a/net-dns/c-ares/Manifest b/net-dns/c-ares/Manifest
index 799731cb27e2..ba56429843d7 100644
--- a/net-dns/c-ares/Manifest
+++ b/net-dns/c-ares/Manifest
@@ -1,2 +1,4 @@
 DIST c-ares-1.19.0.tar.gz 1572210 BLAKE2B d77be535dfa852bf3d91258ddf06b3c63a40123883adb83a4e5652d4b1b16801ddefefad70d83a7d6d9aa81c9c81956fef42bc778d7380d6b398ccfc9f8b82dc SHA512 a7f5988bef393afec08a225be92f6eee54a3e67170fb26cbe00dcc5c5a457b27037bbcfeccc39fb855ed72f100196958d6cbbe251bf1ccfbdd353be18f098359
 DIST c-ares-1.19.0.tar.gz.asc 488 BLAKE2B 1b8dc3ad7b916cb5ea1c95ffd12315d303f78880416836d11d2fa7d8ca93fa1ca30898e6a865af79a35e5dc4d0f4fccfcc9eae6f028d456d38ede9fe8b7edd71 SHA512 814aad5dbe2bb987035b53d977e03a73a90356200f671f36949a77e978cf8311ccc8375e63ade6fe2e1380f1f9c3b34c1ba7d48365fd5689cf5c24425ab8a129
+DIST c-ares-1.19.1.tar.gz 1579100 BLAKE2B 4b6c9593edb1a91ab76d54ddacb1cd5d67006d5e628ea1f3289f54e9360be32abeb5d8fc7d23e193feab3e7928e8efde82757eb12fe217dc92ed0d9132bedf5d SHA512 466a94efda626e815a6ef7a890637056339f883d549ea6055e289fd8cd2391130e5682c905c0fb3bd7e955af7f6deb793562c170eb0ee066a4a62085a82ba470
+DIST c-ares-1.19.1.tar.gz.asc 488 BLAKE2B 9c47d7b3e67d9a2bd1e332912d21d20ca591fc34f81707c18a4615ea14ba2da00146d1998250a5f4dd2a0b1c04f9bd2013d4940ac734674c0bdff6815985e19d SHA512 1b204ab1a667af1326be4b7c62c0919aacd447a2e00efea4b8ef2ec9f2b13ffb236a836ff8953b0b3359727faf3fb8cfcd71d0b06a0e533a09f9e9ea66024f4e
diff --git a/net-dns/c-ares/c-ares-1.19.1.ebuild b/net-dns/c-ares/c-ares-1.19.1.ebuild
new file mode 100644
index 000000000000..cb14551f0c7b
--- /dev/null
+++ b/net-dns/c-ares/c-ares-1.19.1.ebuild
@@ -0,0 +1,70 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/danielstenberg.asc
+inherit edo multilib-minimal verify-sig
+
+DESCRIPTION="C library that resolves names asynchronously"
+HOMEPAGE="https://c-ares.org/"
+SRC_URI="
+	https://c-ares.org/download/${P}.tar.gz
+	verify-sig? ( https://c-ares.org/download/${P}.tar.gz.asc )
+"
+
+LICENSE="MIT"
+# Subslot = SONAME of libcares.so.2
+SLOT="0/2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="static-libs test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-danielstenberg )"
+
+DOCS=( AUTHORS CHANGES NEWS README.md RELEASE-NOTES TODO )
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/ares_build.h
+)
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--enable-nonblocking
+		--enable-symbol-hiding
+		$(use_enable static-libs static)
+		$(use_enable test tests)
+	)
+
+	# Needed for running unit tests only
+	# Violates sandbox and tests pass fine without
+	export ax_cv_uts_namespace=no
+	export ax_cv_user_namespace=no
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_test() {
+	cd "${BUILD_DIR}"/test || die
+
+	# We're skipping the "real" network tests with the filter
+	# see https://github.com/c-ares/c-ares/tree/main/test
+	local network_tests=(
+		# Most live tests have Live in the name
+		*Live*
+		# These don't but are still in ares-test-live.cc => live
+		*GetTCPSock*
+		*TimeoutValue*
+		*GetSock*
+		*GetSock_virtualized*
+	)
+
+	# The format for disabling test1, test2, and test3 looks like:
+	# -test1:test2:test3
+	edo ./arestest --gtest_filter=-$(echo $(IFS=:; echo "${network_tests[*]}"))
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/net-misc/curl/curl-8.1.0.ebuild b/net-misc/curl/curl-8.1.0-r1.ebuild
index 12be62edfe30..bad759c48393 100644
--- a/net-misc/curl/curl-8.1.0.ebuild
+++ b/net-misc/curl/curl-8.1.0-r1.ebuild
@@ -108,6 +108,9 @@ QA_CONFIG_IMPL_DECL_SKIP=(
 PATCHES=(
 	"${FILESDIR}"/${PN}-7.30.0-prefix.patch
 	"${FILESDIR}"/${PN}-respect-cflags-3.patch
+	### Backports
+	"${FILESDIR}"/${P}-numeric-hostname.patch
+	"${FILESDIR}"/${P}-header-length.patch
 )
 
 src_prepare() {
diff --git a/net-misc/curl/files/curl-8.1.0-header-length.patch b/net-misc/curl/files/curl-8.1.0-header-length.patch
new file mode 100644
index 000000000000..6229fd817f2a
--- /dev/null
+++ b/net-misc/curl/files/curl-8.1.0-header-length.patch
@@ -0,0 +1,86 @@
+https://github.com/curl/curl/commit/77c9a9845bbee66f3aff158b8452dc8cd963cbd5.patch
+From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
+Date: Thu, 18 May 2023 18:22:57 +0200
+Subject: [PATCH] http2: double http request parser max line length
+
+This works around #11138, by doubling the limit, and should be a
+relatively safe fix.
+
+Ideally the buffer would grow as needed and there would be no need for a
+limit? But that might be follow-up material.
+
+Fixes #11138
+Closes #11139
+---
+ lib/http1.h             | 2 ++
+ lib/http2.c             | 2 +-
+ lib/vquic/curl_msh3.c   | 2 +-
+ lib/vquic/curl_ngtcp2.c | 2 +-
+ lib/vquic/curl_quiche.c | 2 +-
+ 5 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/lib/http1.h b/lib/http1.h
+index c2d107587a6f8..8acb9db401a95 100644
+--- a/lib/http1.h
++++ b/lib/http1.h
+@@ -33,6 +33,8 @@
+ #define H1_PARSE_OPT_NONE       (0)
+ #define H1_PARSE_OPT_STRICT     (1 << 0)
+ 
++#define H1_PARSE_DEFAULT_MAX_LINE_LEN (8 * 1024)
++
+ struct h1_req_parser {
+   struct http_req *req;
+   struct bufq scratch;
+diff --git a/lib/http2.c b/lib/http2.c
+index 47e6f71393156..4e3b182b8d815 100644
+--- a/lib/http2.c
++++ b/lib/http2.c
+@@ -1860,7 +1860,7 @@ static ssize_t h2_submit(struct stream_ctx **pstream,
+   nghttp2_priority_spec pri_spec;
+   ssize_t nwritten;
+ 
+-  Curl_h1_req_parse_init(&h1, (4*1024));
++  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
+   Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
+ 
+   *err = http2_data_setup(cf, data, &stream);
+diff --git a/lib/vquic/curl_msh3.c b/lib/vquic/curl_msh3.c
+index 40e89379fc402..173886739b6dc 100644
+--- a/lib/vquic/curl_msh3.c
++++ b/lib/vquic/curl_msh3.c
+@@ -575,7 +575,7 @@ static ssize_t cf_msh3_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+ 
+   CF_DATA_SAVE(save, cf, data);
+ 
+-  Curl_h1_req_parse_init(&h1, (4*1024));
++  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
+   Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
+ 
+   /* Sizes must match for cast below to work" */
+diff --git a/lib/vquic/curl_ngtcp2.c b/lib/vquic/curl_ngtcp2.c
+index 05f960afdffa1..7794f148c6ec9 100644
+--- a/lib/vquic/curl_ngtcp2.c
++++ b/lib/vquic/curl_ngtcp2.c
+@@ -1550,7 +1550,7 @@ static ssize_t h3_stream_open(struct Curl_cfilter *cf,
+   nghttp3_data_reader reader;
+   nghttp3_data_reader *preader = NULL;
+ 
+-  Curl_h1_req_parse_init(&h1, (4*1024));
++  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
+   Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
+ 
+   *err = h3_data_setup(cf, data);
+diff --git a/lib/vquic/curl_quiche.c b/lib/vquic/curl_quiche.c
+index 392b9beb83c59..c63e8e10a22e0 100644
+--- a/lib/vquic/curl_quiche.c
++++ b/lib/vquic/curl_quiche.c
+@@ -913,7 +913,7 @@ static ssize_t h3_open_stream(struct Curl_cfilter *cf,
+     DEBUGASSERT(stream);
+   }
+ 
+-  Curl_h1_req_parse_init(&h1, (4*1024));
++  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
+   Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
+ 
+   DEBUGASSERT(stream);
diff --git a/net-misc/curl/files/curl-8.1.0-numeric-hostname.patch b/net-misc/curl/files/curl-8.1.0-numeric-hostname.patch
new file mode 100644
index 000000000000..6a0dd1382d62
--- /dev/null
+++ b/net-misc/curl/files/curl-8.1.0-numeric-hostname.patch
@@ -0,0 +1,227 @@
+https://github.com/curl/curl/commit/92772e6d395bbdda0e7822d980caf86e8c4aa51c.patch
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 18 May 2023 00:31:17 +0200
+Subject: [PATCH] urlapi: allow numerical parts in the host name
+
+It can only be an IPv4 address if all parts are all digits and no more than
+four parts, otherwise it is a host name. Even slightly wrong IPv4 will now be
+passed through as a host name.
+
+Regression from 17a15d88467 shipped in 8.1.0
+
+Extended test 1560 accordingly.
+
+Reported-by: Pavel Kalyugin
+Fixes #11129
+Closes #11131
+--- a/lib/urlapi.c
++++ b/lib/urlapi.c
+@@ -34,6 +34,7 @@
+ #include "inet_ntop.h"
+ #include "strdup.h"
+ #include "idn.h"
++#include "curl_memrchr.h"
+ 
+ /* The last 3 #include files should be in this order */
+ #include "curl_printf.h"
+@@ -643,8 +644,8 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname,
+  * Handle partial IPv4 numerical addresses and different bases, like
+  * '16843009', '0x7f', '0x7f.1' '0177.1.1.1' etc.
+  *
+- * If the given input string is syntactically wrong or any part for example is
+- * too big, this function returns FALSE and doesn't create any output.
++ * If the given input string is syntactically wrong IPv4 or any part for
++ * example is too big, this function returns HOST_NAME.
+  *
+  * Output the "normalized" version of that input string in plain quad decimal
+  * integers.
+@@ -675,7 +676,7 @@ static int ipv4_normalize(struct dynbuf *host)
+     unsigned long l;
+     if(!ISDIGIT(*c))
+       /* most importantly this doesn't allow a leading plus or minus */
+-      return n ? HOST_BAD : HOST_NAME;
++      return HOST_NAME;
+     l = strtoul(c, &endp, 0);
+ 
+     parts[n] = l;
+@@ -684,7 +685,7 @@ static int ipv4_normalize(struct dynbuf *host)
+     switch(*c) {
+     case '.':
+       if(n == 3)
+-        return HOST_BAD;
++        return HOST_NAME;
+       n++;
+       c++;
+       break;
+@@ -694,39 +695,40 @@ static int ipv4_normalize(struct dynbuf *host)
+       break;
+ 
+     default:
+-      return n ? HOST_BAD : HOST_NAME;
++      return HOST_NAME;
+     }
+ 
+     /* overflow */
+     if((l == ULONG_MAX) && (errno == ERANGE))
+-      return HOST_BAD;
++      return HOST_NAME;
+ 
+ #if SIZEOF_LONG > 4
+     /* a value larger than 32 bits */
+     if(l > UINT_MAX)
+-      return HOST_BAD;
++      return HOST_NAME;
+ #endif
+   }
+ 
+-  /* this is a valid IPv4 numerical address */
+-  Curl_dyn_reset(host);
+-
+   switch(n) {
+   case 0: /* a -- 32 bits */
++    Curl_dyn_reset(host);
++
+     result = Curl_dyn_addf(host, "%u.%u.%u.%u",
+                            parts[0] >> 24, (parts[0] >> 16) & 0xff,
+                            (parts[0] >> 8) & 0xff, parts[0] & 0xff);
+     break;
+   case 1: /* a.b -- 8.24 bits */
+     if((parts[0] > 0xff) || (parts[1] > 0xffffff))
+-      return HOST_BAD;
++      return HOST_NAME;
++    Curl_dyn_reset(host);
+     result = Curl_dyn_addf(host, "%u.%u.%u.%u",
+                            parts[0], (parts[1] >> 16) & 0xff,
+                            (parts[1] >> 8) & 0xff, parts[1] & 0xff);
+     break;
+   case 2: /* a.b.c -- 8.8.16 bits */
+     if((parts[0] > 0xff) || (parts[1] > 0xff) || (parts[2] > 0xffff))
+-      return HOST_BAD;
++      return HOST_NAME;
++    Curl_dyn_reset(host);
+     result = Curl_dyn_addf(host, "%u.%u.%u.%u",
+                            parts[0], parts[1], (parts[2] >> 8) & 0xff,
+                            parts[2] & 0xff);
+@@ -734,7 +736,8 @@ static int ipv4_normalize(struct dynbuf *host)
+   case 3: /* a.b.c.d -- 8.8.8.8 bits */
+     if((parts[0] > 0xff) || (parts[1] > 0xff) || (parts[2] > 0xff) ||
+        (parts[3] > 0xff))
+-      return HOST_BAD;
++      return HOST_NAME;
++    Curl_dyn_reset(host);
+     result = Curl_dyn_addf(host, "%u.%u.%u.%u",
+                            parts[0], parts[1], parts[2], parts[3]);
+     break;
+@@ -796,6 +799,9 @@ static CURLUcode parse_authority(struct Curl_URL *u,
+   if(result)
+     goto out;
+ 
++  if(!Curl_dyn_len(host))
++    return CURLUE_NO_HOST;
++
+   switch(ipv4_normalize(host)) {
+   case HOST_IPV4:
+     break;
+--- a/tests/libtest/lib1560.c
++++ b/tests/libtest/lib1560.c
+@@ -474,6 +474,13 @@ static const struct testcase get_parts_list[] ={
+ };
+ 
+ static const struct urltestcase get_url_list[] = {
++  {"https://1.0x1000000", "https://1.0x1000000/", 0, 0, CURLUE_OK},
++  {"https://0x7f.1", "https://127.0.0.1/", 0, 0, CURLUE_OK},
++  {"https://1.2.3.256.com", "https://1.2.3.256.com/", 0, 0, CURLUE_OK},
++  {"https://10.com", "https://10.com/", 0, 0, CURLUE_OK},
++  {"https://1.2.com", "https://1.2.com/", 0, 0, CURLUE_OK},
++  {"https://1.2.3.com", "https://1.2.3.com/", 0, 0, CURLUE_OK},
++  {"https://1.2.com.99", "https://1.2.com.99/", 0, 0, CURLUE_OK},
+   {"https://[fe80::0000:20c:29ff:fe9c:409b]:80/moo",
+    "https://[fe80::20c:29ff:fe9c:409b]:80/moo",
+    0, 0, CURLUE_OK},
+@@ -522,22 +529,24 @@ static const struct urltestcase get_url_list[] = {
+ 
+   /* IPv4 trickeries */
+   {"https://16843009", "https://1.1.1.1/", 0, 0, CURLUE_OK},
+-  {"https://0x7f.1", "https://127.0.0.1/", 0, 0, CURLUE_OK},
+   {"https://0177.1", "https://127.0.0.1/", 0, 0, CURLUE_OK},
+   {"https://0111.02.0x3", "https://73.2.0.3/", 0, 0, CURLUE_OK},
++  {"https://0111.02.0x3.", "https://0111.02.0x3./", 0, 0, CURLUE_OK},
++  {"https://0111.02.030", "https://73.2.0.24/", 0, 0, CURLUE_OK},
++  {"https://0111.02.030.", "https://0111.02.030./", 0, 0, CURLUE_OK},
+   {"https://0xff.0xff.0377.255", "https://255.255.255.255/", 0, 0, CURLUE_OK},
+   {"https://1.0xffffff", "https://1.255.255.255/", 0, 0, CURLUE_OK},
+   /* IPv4 numerical overflows or syntax errors will not normalize */
+   {"https://a127.0.0.1", "https://a127.0.0.1/", 0, 0, CURLUE_OK},
+   {"https://\xff.127.0.0.1", "https://%FF.127.0.0.1/", 0, CURLU_URLENCODE,
+    CURLUE_OK},
+-  {"https://127.-0.0.1", "https://127.-0.0.1/", 0, 0, CURLUE_BAD_HOSTNAME},
++  {"https://127.-0.0.1", "https://127.-0.0.1/", 0, 0, CURLUE_OK},
+   {"https://127.0. 1", "https://127.0.0.1/", 0, 0, CURLUE_MALFORMED_INPUT},
+-  {"https://1.0x1000000", "https://1.0x1000000/", 0, 0, CURLUE_BAD_HOSTNAME},
+-  {"https://1.2.3.256", "https://1.2.3.256/", 0, 0, CURLUE_BAD_HOSTNAME},
+-  {"https://1.2.3.4.5", "https://1.2.3.4.5/", 0, 0, CURLUE_BAD_HOSTNAME},
+-  {"https://1.2.0x100.3", "https://1.2.0x100.3/", 0, 0, CURLUE_BAD_HOSTNAME},
+-  {"https://4294967296", "https://4294967296/", 0, 0, CURLUE_BAD_HOSTNAME},
++  {"https://1.2.3.256", "https://1.2.3.256/", 0, 0, CURLUE_OK},
++  {"https://1.2.3.256.", "https://1.2.3.256./", 0, 0, CURLUE_OK},
++  {"https://1.2.3.4.5", "https://1.2.3.4.5/", 0, 0, CURLUE_OK},
++  {"https://1.2.0x100.3", "https://1.2.0x100.3/", 0, 0, CURLUE_OK},
++  {"https://4294967296", "https://4294967296/", 0, 0, CURLUE_OK},
+   {"https://123host", "https://123host/", 0, 0, CURLUE_OK},
+   /* 40 bytes scheme is the max allowed */
+   {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA://hostname/path",
+@@ -599,20 +608,11 @@ static const struct urltestcase get_url_list[] = {
+    0, 0, CURLUE_OK},
+   /* here the password has the semicolon */
+   {"http://user:pass;word@host/file",
+-   "http://user:pass;word@host/file",
+-   0, 0, CURLUE_OK},
+-  {"file:///file.txt#moo",
+-   "file:///file.txt#moo",
+-   0, 0, CURLUE_OK},
+-  {"file:////file.txt",
+-   "file:////file.txt",
+-   0, 0, CURLUE_OK},
+-  {"file:///file.txt",
+-   "file:///file.txt",
+-   0, 0, CURLUE_OK},
+-  {"file:./",
+-   "file://",
+-   0, 0, CURLUE_BAD_SCHEME},
++   "http://user:pass;word@host/file", 0, 0, CURLUE_OK},
++  {"file:///file.txt#moo", "file:///file.txt#moo", 0, 0, CURLUE_OK},
++  {"file:////file.txt", "file:////file.txt", 0, 0, CURLUE_OK},
++  {"file:///file.txt", "file:///file.txt", 0, 0, CURLUE_OK},
++  {"file:./", "file://", 0, 0, CURLUE_OK},
+   {"http://example.com/hello/../here",
+    "http://example.com/hello/../here",
+    CURLU_PATH_AS_IS, 0, CURLUE_OK},
+@@ -1124,7 +1124,7 @@ static int get_url(void)
+       }
+       curl_free(url);
+     }
+-    else if(rc != get_url_list[i].ucode) {
++    if(rc != get_url_list[i].ucode) {
+       fprintf(stderr, "Get URL\nin: %s\nreturned %d (expected %d)\n",
+               get_url_list[i].in, (int)rc, get_url_list[i].ucode);
+       error++;
+@@ -1515,6 +1515,9 @@ int test(char *URL)
+ {
+   (void)URL; /* not used */
+ 
++  if(get_url())
++    return 3;
++
+   if(huge())
+     return 9;
+ 
+@@ -1533,9 +1536,6 @@ int test(char *URL)
+   if(set_parts())
+     return 2;
+ 
+-  if(get_url())
+-    return 3;
+-
+   if(get_parts())
+     return 4;
+ 
diff --git a/profiles/package.mask b/profiles/package.mask
index c02dfaf7d849..e696b07469ba 100644
--- a/profiles/package.mask
+++ b/profiles/package.mask
@@ -33,6 +33,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Sam James <sam@gentoo.org> (2023-05-23)
+# Argument splitting seems broken, see bug #906892 and https://github.com/ffi/ffi-compiler/issues/23.
+=dev-ruby/ffi-compiler-1.2.0
+
 # Sam James <sam@gentoo.org> (2023-05-20)
 # Various regressions, please upgrade to the latest libxml2 (>=2.11.4).
 =dev-libs/libxml2-2.11.1