initial commit

2026-05-26 02:08:47 -05:00
commit aac5d72fe4
60 changed files with 12096 additions and 0 deletions
@@ -0,0 +1,4 @@
 {
    "cmake.ignoreCMakeListsMissing": true,
    "git.ignoreLimitWarning": true
 }
@@ -0,0 +1,11 @@
 ## Agent Instructions
 - When asked to make patches for a codebase, ensure that the user provides a link or location of a tarball or git repository. If not, request the user to provide it.
 - Extract tarball using bsdtar to a temporary directory in /tmp to use diff for generating patches based on your modifications.
 - When generating patches, ensure that the output is in the correct format (e.g., unified diff format) and includes the necessary context for understanding the changes.
 - Make sure patches use the a/ and b/ prefixes to indicate the original and modified files, respectively.
 - if asked to 'posixify' a source, replace all /bin/bash with /bin/sh and ensure that the script is compatible with POSIX standards. (use dash to verify if available, otherwise use sh)
 - if just given a link, download to /tmp and then extract to a temporary directory for processing.
 - if asked to 'ungnuify' a source, look for hardcoded deps such as -lgcc and -lstdc++ and change the source to query the compiler (eg. compiler-rt from clang) for the correct flags to link against.
 - if it is a git repo, then use git diff to generate the patch
 - make sure you place it into the proper directory (eg. util-linux patches should be placed in the util-linux directory)
@@ -0,0 +1,59 @@
 # Vertex Linux Patches
 This directory is a working collection of old and current patch sets used for Vertex Linux packaging.
 It spans two broad eras of the distro:
 - The older `musl + mimalloc + LibreSSL` era.
 - The current `glibc + x86_64-v3` era.
 Some patches are clearly tied to one period, while others are carry patches that remained useful across both.
 ## What This Tree Contains
 The patches here are not a pristine historical archive of a single release. They are a maintained patch bucket for packages Vertex Linux has needed to adjust over time, including:
 - libc and toolchain integration fixes
 - `clang` and `compiler-rt` compatibility work
 - `x86_64-v3` policy and platform-specific changes
 - `LibreSSL` compatibility patches from the older stack
 - POSIX and `/bin/sh` cleanups for build scripts
 - packaging, portability, and local distro behavior changes
 ## Era Notes
 ### Older Era: `musl + mimalloc + LibreSSL + LLVM/Clang`
 This was the earlier Vertex Linux direction. Patches from that period generally reflect:
 - `musl`-oriented portability work
 - `LibreSSL` compatibility, especially for older Qt and network/crypto consumers
 - runtime and allocator decisions that matched the `mimalloc` period
 - build-system cleanup for a smaller, less GNU-specific base
 ### Current Era: `glibc + x86_64-v3 + LLVM/Clang`
 This is the current Vertex Linux direction. Patches from this period generally reflect:
 - `glibc`-based userland assumptions
 - `x86_64-v3` baseline policy
 - modern `LLVM/Clang`, `lld`, `compiler-rt`, and `libc++` integration
 - removing hardcoded GNU toolchain assumptions where they break modern Clang-based builds
 Examples in this tree include the kernel-side `x86_64-v3` enforcement patch in [linux/0001-x86-setup-enforce-x86_64-v3.patch](linux/0001-x86-setup-enforce-x86_64-v3.patch) and newer `glibc`/`valgrind` compiler-runtime fixes such as [glibc/glibc-2.43-use-compiler-reported-libgcc.patch](glibc/glibc-2.43-use-compiler-reported-libgcc.patch) and [valgrind/valgrind-3.26.0-ungnuify.patch](valgrind/valgrind-3.26.0-ungnuify.patch).
 ## Reading The Layout
 Directories are package-oriented. In general, each subdirectory holds local patches for one upstream project, for example:
 - [glibc patches](glibc)
 - [qt5 patches](qt5)
 - [util-linux](util-linux)
 - [valgrind](valgrind)
 ## Practical Note
 Not every patch maps cleanly to exactly one era. This tree should be read as "Vertex Linux patches that accumulated through the older `musl/mimalloc/LibreSSL` period and into the current `glibc/x86_64-v3` period", not as a strict release-by-release archive.
 ## PS:
 And yes I used ai for these, not because I don't know how to write patches/code, but because I PROMISE I dont have the time to do all of this by hand. I have to maintain the distro, do the packaging, code a bunch of more stuff, and also write the documentation. The patches are just a small part of the work, and using ai helps me get them done faster so I can focus on the other important tasks.
@@ -0,0 +1,34 @@
 diff --git a/absl/debugging/symbolize_elf.inc b/absl/debugging/symbolize_elf.inc
 index 0317bbc..e4a5060 100644
 --- a/absl/debugging/symbolize_elf.inc
 +++ b/absl/debugging/symbolize_elf.inc
@@ -1086,17 +1086,24 @@ static ABSL_ATTRIBUTE_NOINLINE bool ReadAddrMap(
     void *arg, void *tmp_buf, size_t tmp_buf_size) {
   // Use /proc/self/task/<pid>/maps instead of /proc/self/maps. The latter
   // requires kernel to stop all threads, and is significantly slower when there
 -  // are 1000s of threads.
 +  // are 1000s of threads. Some container procfs implementations do not expose
 +  // per-thread maps files, so fall back to /proc/self/maps when needed.
   char maps_path[80];
   snprintf(maps_path, sizeof(maps_path), "/proc/self/task/%d/maps", getpid());
   int maps_fd;
   NO_INTR(maps_fd = OpenReadOnlyWithHighFD(maps_path));
 -  FileDescriptor wrapped_maps_fd(maps_fd);
 -  if (wrapped_maps_fd.get() < 0) {
 -    ABSL_RAW_LOG(WARNING, "%s: errno=%d", maps_path, errno);
 -    return false;
 +  if (maps_fd < 0) {
 +    const int task_maps_errno = errno;
 +    NO_INTR(maps_fd = OpenReadOnlyWithHighFD("/proc/self/maps"));
 +    if (maps_fd < 0) {
 +      const int self_maps_errno = errno;
 +      ABSL_RAW_LOG(WARNING, "%s: errno=%d; /proc/self/maps: errno=%d",
 +                   maps_path, task_maps_errno, self_maps_errno);
 +      return false;
 +    }
   }
 +  FileDescriptor wrapped_maps_fd(maps_fd);
   // Iterate over maps and look for the map containing the pc.  Then
   // look into the symbol tables inside.
@@ -0,0 +1,49 @@
 diff -Naur orig/bsdsed-0.99.2/Makefile mod/bsdsed-0.99.2/Makefile
 --- a/Makefile	2021-06-27 13:43:27.000000000 -0500
 +++ b/Makefile	2026-05-26 02:06:54.688173361 -0500
@@ -4,7 +4,7 @@
 BINDIR  ?= $(PREFIX)/bin
 DATADIR ?= $(PREFIX)/share
 MANDIR  ?= $(DATADIR)/man/man1
 -EXTRA_CFLAGS = -Wall -Wextra -I. -Dlint
 +EXTRA_CFLAGS = -Wall -Wextra -I. -Dlint -D_XOPEN_SOURCE=700 -D_DEFAULT_SOURCE
 OBJS = compile.o main.o misc.o process.o errc.o
 diff -Naur orig/bsdsed-0.99.2/sys/cdefs.h mod/bsdsed-0.99.2/sys/cdefs.h
 --- a/sys/cdefs.h	2021-06-27 13:43:27.000000000 -0500
 +++ b/sys/cdefs.h	2026-05-26 02:06:33.401607906 -0500
@@ -1,17 +1,33 @@
 #ifndef CDEFS_H
 #define CDEFS_H
 +#if defined(__has_include_next)
 +#if __has_include_next(<sys/cdefs.h>)
 +#include_next <sys/cdefs.h>
 +#endif
 +#elif defined(__GNUC__)
 +#include_next <sys/cdefs.h>
 +#endif
 +
 #define __FBSDID(x)
 /* other compat bits */
 +#ifndef DEFFILEMODE
 #define	DEFFILEMODE	(S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH)
 +#endif
 +#ifndef ALLPERMS
 #define ALLPERMS (S_ISUID|S_ISGID|S_ISVTX|S_IRWXU|S_IRWXG|S_IRWXO)
 +#endif
 extern char *__progname;
 +#ifndef __unreachable
 #define __unreachable()
 +#endif
 +#ifndef getprogname
 #define getprogname() __progname
 +#endif
 void errc(int status, int code, const char *format, ...);
@@ -0,0 +1,133 @@
 diff --git a/Makefile b/Makefile
 index f8a1772..b3a442c 100644
 --- a/Makefile
 +++ b/Makefile
@@ -15,13 +15,13 @@
 SHELL=/bin/sh
 # To assist in cross-compiling
 -CC=gcc
 -AR=ar
 -RANLIB=ranlib
 +CC ?= gcc
 +AR ?= ar
 +RANLIB ?= ranlib
 LDFLAGS=
 BIGFILES=-D_FILE_OFFSET_BITS=64
 -CFLAGS=-Wall -Winline -O2 -g $(BIGFILES)
 +CFLAGS += -Wall -Winline -O2 $(BIGFILES)
 # Where you want it installed when you do 'make install'
 PREFIX=/usr/local
@@ -70,43 +70,43 @@ test: bzip2
 	@cat words3
 install: bzip2 bzip2recover
 -	if ( test ! -d $(PREFIX)/bin ) ; then mkdir -p $(PREFIX)/bin ; fi
 -	if ( test ! -d $(PREFIX)/lib ) ; then mkdir -p $(PREFIX)/lib ; fi
 -	if ( test ! -d $(PREFIX)/man ) ; then mkdir -p $(PREFIX)/man ; fi
 -	if ( test ! -d $(PREFIX)/man/man1 ) ; then mkdir -p $(PREFIX)/man/man1 ; fi
 -	if ( test ! -d $(PREFIX)/include ) ; then mkdir -p $(PREFIX)/include ; fi
 -	cp -f bzip2 $(PREFIX)/bin/bzip2
 -	cp -f bzip2 $(PREFIX)/bin/bunzip2
 -	cp -f bzip2 $(PREFIX)/bin/bzcat
 -	cp -f bzip2recover $(PREFIX)/bin/bzip2recover
 -	chmod a+x $(PREFIX)/bin/bzip2
 -	chmod a+x $(PREFIX)/bin/bunzip2
 -	chmod a+x $(PREFIX)/bin/bzcat
 -	chmod a+x $(PREFIX)/bin/bzip2recover
 -	cp -f bzip2.1 $(PREFIX)/man/man1
 -	chmod a+r $(PREFIX)/man/man1/bzip2.1
 -	cp -f bzlib.h $(PREFIX)/include
 -	chmod a+r $(PREFIX)/include/bzlib.h
 -	cp -f libbz2.a $(PREFIX)/lib
 -	chmod a+r $(PREFIX)/lib/libbz2.a
 -	cp -f bzgrep $(PREFIX)/bin/bzgrep
 -	ln -s -f $(PREFIX)/bin/bzgrep $(PREFIX)/bin/bzegrep
 -	ln -s -f $(PREFIX)/bin/bzgrep $(PREFIX)/bin/bzfgrep
 -	chmod a+x $(PREFIX)/bin/bzgrep
 -	cp -f bzmore $(PREFIX)/bin/bzmore
 -	ln -s -f $(PREFIX)/bin/bzmore $(PREFIX)/bin/bzless
 -	chmod a+x $(PREFIX)/bin/bzmore
 -	cp -f bzdiff $(PREFIX)/bin/bzdiff
 -	ln -s -f $(PREFIX)/bin/bzdiff $(PREFIX)/bin/bzcmp
 -	chmod a+x $(PREFIX)/bin/bzdiff
 -	cp -f bzgrep.1 bzmore.1 bzdiff.1 $(PREFIX)/man/man1
 -	chmod a+r $(PREFIX)/man/man1/bzgrep.1
 -	chmod a+r $(PREFIX)/man/man1/bzmore.1
 -	chmod a+r $(PREFIX)/man/man1/bzdiff.1
 -	echo ".so man1/bzgrep.1" > $(PREFIX)/man/man1/bzegrep.1
 -	echo ".so man1/bzgrep.1" > $(PREFIX)/man/man1/bzfgrep.1
 -	echo ".so man1/bzmore.1" > $(PREFIX)/man/man1/bzless.1
 -	echo ".so man1/bzdiff.1" > $(PREFIX)/man/man1/bzcmp.1
 +	if ( test ! -d $(DESTDIR)$(PREFIX)/bin ) ; then mkdir -p $(DESTDIR)$(PREFIX)/bin ; fi
 +	if ( test ! -d $(DESTDIR)$(PREFIX)/lib ) ; then mkdir -p $(DESTDIR)$(PREFIX)/lib ; fi
 +	if ( test ! -d $(DESTDIR)$(PREFIX)/man ) ; then mkdir -p $(DESTDIR)$(PREFIX)/man ; fi
 +	if ( test ! -d $(DESTDIR)$(PREFIX)/man/man1 ) ; then mkdir -p $(DESTDIR)$(PREFIX)/man/man1 ; fi
 +	if ( test ! -d $(DESTDIR)$(PREFIX)/include ) ; then mkdir -p $(DESTDIR)$(PREFIX)/include ; fi
 +	cp -f bzip2 $(DESTDIR)$(PREFIX)/bin/bzip2
 +	cp -f bzip2 $(DESTDIR)$(PREFIX)/bin/bunzip2
 +	cp -f bzip2 $(DESTDIR)$(PREFIX)/bin/bzcat
 +	cp -f bzip2recover $(DESTDIR)$(PREFIX)/bin/bzip2recover
 +	chmod a+x $(DESTDIR)$(PREFIX)/bin/bzip2
 +	chmod a+x $(DESTDIR)$(PREFIX)/bin/bunzip2
 +	chmod a+x $(DESTDIR)$(PREFIX)/bin/bzcat
 +	chmod a+x $(DESTDIR)$(PREFIX)/bin/bzip2recover
 +	cp -f bzip2.1 $(DESTDIR)$(PREFIX)/man/man1
 +	chmod a+r $(DESTDIR)$(PREFIX)/man/man1/bzip2.1
 +	cp -f bzlib.h $(DESTDIR)$(PREFIX)/include
 +	chmod a+r $(DESTDIR)$(PREFIX)/include/bzlib.h
 +	cp -f libbz2.a $(DESTDIR)$(PREFIX)/lib
 +	chmod a+r $(DESTDIR)$(PREFIX)/lib/libbz2.a
 +	cp -f bzgrep $(DESTDIR)$(PREFIX)/bin/bzgrep
 +	ln -s -f $(PREFIX)/bin/bzgrep $(DESTDIR)$(PREFIX)/bin/bzegrep
 +	ln -s -f $(PREFIX)/bin/bzgrep $(DESTDIR)$(PREFIX)/bin/bzfgrep
 +	chmod a+x $(DESTDIR)$(PREFIX)/bin/bzgrep
 +	cp -f bzmore $(DESTDIR)$(PREFIX)/bin/bzmore
 +	ln -s -f $(PREFIX)/bin/bzmore $(DESTDIR)$(PREFIX)/bin/bzless
 +	chmod a+x $(DESTDIR)$(PREFIX)/bin/bzmore
 +	cp -f bzdiff $(DESTDIR)$(PREFIX)/bin/bzdiff
 +	ln -s -f $(PREFIX)/bin/bzdiff $(DESTDIR)$(PREFIX)/bin/bzcmp
 +	chmod a+x $(DESTDIR)$(PREFIX)/bin/bzdiff
 +	cp -f bzgrep.1 bzmore.1 bzdiff.1 $(DESTDIR)$(PREFIX)/man/man1
 +	chmod a+r $(DESTDIR)$(PREFIX)/man/man1/bzgrep.1
 +	chmod a+r $(DESTDIR)$(PREFIX)/man/man1/bzmore.1
 +	chmod a+r $(DESTDIR)$(PREFIX)/man/man1/bzdiff.1
 +	echo ".so man1/bzgrep.1" > $(DESTDIR)$(PREFIX)/man/man1/bzegrep.1
 +	echo ".so man1/bzgrep.1" > $(DESTDIR)$(PREFIX)/man/man1/bzfgrep.1
 +	echo ".so man1/bzmore.1" > $(DESTDIR)$(PREFIX)/man/man1/bzless.1
 +	echo ".so man1/bzdiff.1" > $(DESTDIR)$(PREFIX)/man/man1/bzcmp.1
 clean: 
 	rm -f *.o libbz2.a bzip2 bzip2recover \
 diff --git a/Makefile-libbz2_so b/Makefile-libbz2_so
 index fb0f230..1b3a94d 100644
 --- a/Makefile-libbz2_so
 +++ b/Makefile-libbz2_so
@@ -22,9 +22,9 @@
 SHELL=/bin/sh
 -CC=gcc
 +CC ?= gcc
 BIGFILES=-D_FILE_OFFSET_BITS=64
 -CFLAGS=-fpic -fPIC -Wall -Winline -O2 -g $(BIGFILES)
 +CFLAGS += -fpic -fPIC -Wall -Winline $(BIGFILES)
 OBJS= blocksort.o  \
       huffman.o    \
@@ -35,10 +35,11 @@ OBJS= blocksort.o  \
       bzlib.o
 all: $(OBJS)
 -	$(CC) -shared -Wl,-soname -Wl,libbz2.so.1.0 -o libbz2.so.1.0.8 $(OBJS)
 -	$(CC) $(CFLAGS) -o bzip2-shared bzip2.c libbz2.so.1.0.8
 +	$(CC) $(CFLAGS) $(LDFLAGS) -shared -Wl,-soname -Wl,libbz2.so.1 -o libbz2.so.1.0.8 $(OBJS)
 +	$(CC) $(CFLAGS) $(LDFLAGS) -o bzip2-shared bzip2.c libbz2.so.1.0.8
 	rm -f libbz2.so.1.0
 	ln -s libbz2.so.1.0.8 libbz2.so.1.0
 +	ln -s libbz2.so.1.0.8 libbz2.so.1
 clean: 
 	rm -f $(OBJS) bzip2.o libbz2.so.1.0.8 libbz2.so.1.0 bzip2-shared
@@ -0,0 +1,46 @@
 diff --git a/meson.build b/meson.build
 index 966a9ba..cc9d8c2 100644
 --- a/meson.build
 +++ b/meson.build
@@ -121,9 +121,17 @@ gusb = dependency('gusb', version : '>= 0.2.7')
 gudev = dependency('gudev-1.0')
 libm = cc.find_library('m', required: false)
 libudev = dependency('libudev')
 +udev_rules_dir = ''
 if get_option('udev_rules')
 -  udev = dependency('udev')
 +  udev = dependency('udev', required : false)
 +  if udev.found()
 +    udev_rules_dir = join_paths(udev.get_pkgconfig_variable('udevdir'), 'rules.d')
 +  elif get_option('udev_rules_dir') != ''
 +    udev_rules_dir = get_option('udev_rules_dir')
 +  else
 +    udev_rules_dir = join_paths(libudev.get_pkgconfig_variable('libdir'), 'udev', 'rules.d')
 +  endif
 endif
 if get_option('systemd')
 diff --git a/meson_options.txt b/meson_options.txt
 index 88d0b7b..b1cfe42 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
@@ -2,6 +2,7 @@ option('daemon', type : 'boolean', value : true, description : 'build the daemon
 option('session_example', type : 'boolean', value : false, description : 'Enable session example')
 option('bash_completion', type : 'boolean', value : true, description : 'Enable bash completion')
 option('udev_rules', type: 'boolean', value: true, description: 'Install udev rules')
 +option('udev_rules_dir', type : 'string', value : '', description : 'Directory to install udev rules into when udev.pc is unavailable')
 option('systemd', type : 'boolean', value : true, description : 'Enable systemd integration')
 option('systemd_root_prefix', type: 'string', value: '', description: 'Directory to base systemd’s installation directories on')
 option('libcolordcompat', type : 'boolean', value : false, description : 'Enable libcolordcompat.so which is used by ArgyllCMS')
 diff --git a/rules/meson.build b/rules/meson.build
 index 7985e1d..4f328c9 100644
 --- a/rules/meson.build
 +++ b/rules/meson.build
@@ -9,5 +9,5 @@ install_data([
     sensor_rules_in,
     '95-cd-devices.rules',
   ],
 -  install_dir : join_paths(udev.get_pkgconfig_variable('udevdir'), 'rules.d')
 +  install_dir : udev_rules_dir
 )
@@ -0,0 +1,105 @@
 --- a/src/dbinc/db_cxx.in
 +++ b/src/dbinc/db_cxx.in
@@ -50,6 +50,23 @@
 #include <stdarg.h>
 +/*
 + * Berkeley DB's C API exposes atomic_init and store as macros, which
 + * collides with libc++ declarations when db.h is already included.
 + * Hide the macros while pulling in the C++ standard headers, then
 + * restore them for the Berkeley DB interfaces below.
 + */
 +#ifdef atomic_init
 +#pragma push_macro("atomic_init")
 +#undef atomic_init
 +#define	DB_CXX_RESTORE_ATOMIC_INIT
 +#endif
 +#ifdef store
 +#pragma push_macro("store")
 +#undef store
 +#define	DB_CXX_RESTORE_STORE
 +#endif
 +
 @cxx_have_stdheaders@
 #ifdef HAVE_CXX_STDHEADERS
 #include <iostream>
@@ -61,6 +78,15 @@
 #define	__DB_STD(x)	x
 #endif
 +#ifdef DB_CXX_RESTORE_STORE
 +#pragma pop_macro("store")
 +#undef DB_CXX_RESTORE_STORE
 +#endif
 +#ifdef DB_CXX_RESTORE_ATOMIC_INIT
 +#pragma pop_macro("atomic_init")
 +#undef DB_CXX_RESTORE_ATOMIC_INIT
 +#endif
 +
 #include "db.h"
 class Db;                                        // forward
 --- a/lang/cxx/stl/dbstl_exception.h
 +++ b/lang/cxx/stl/dbstl_exception.h
@@ -13,9 +13,29 @@
 #include <cstdlib>
 #include <cstdio>
 +#ifdef atomic_init
 +#pragma push_macro("atomic_init")
 +#undef atomic_init
 +#define	DB_STL_RESTORE_ATOMIC_INIT
 +#endif
 +#ifdef store
 +#pragma push_macro("store")
 +#undef store
 +#define	DB_STL_RESTORE_STORE
 +#endif
 +
 #include <iostream>
 #include <exception>
 +#ifdef DB_STL_RESTORE_STORE
 +#pragma pop_macro("store")
 +#undef DB_STL_RESTORE_STORE
 +#endif
 +#ifdef DB_STL_RESTORE_ATOMIC_INIT
 +#pragma pop_macro("atomic_init")
 +#undef DB_STL_RESTORE_ATOMIC_INIT
 +#endif
 +
 #include "dbstl_common.h"
 START_NS(dbstl)
 --- a/lang/cxx/stl/dbstl_element_ref.h
 +++ b/lang/cxx/stl/dbstl_element_ref.h
@@ -9,8 +9,28 @@
 #ifndef _DB_STL_KDPAIR_H
 #define _DB_STL_KDPAIR_H
 +#ifdef atomic_init
 +#pragma push_macro("atomic_init")
 +#undef atomic_init
 +#define	DB_STL_RESTORE_ATOMIC_INIT
 +#endif
 +#ifdef store
 +#pragma push_macro("store")
 +#undef store
 +#define	DB_STL_RESTORE_STORE
 +#endif
 +
 #include <iostream>
 +#ifdef DB_STL_RESTORE_STORE
 +#pragma pop_macro("store")
 +#undef DB_STL_RESTORE_STORE
 +#endif
 +#ifdef DB_STL_RESTORE_ATOMIC_INIT
 +#pragma pop_macro("atomic_init")
 +#undef DB_STL_RESTORE_ATOMIC_INIT
 +#endif
 +
 #include "dbstl_common.h"
 #include "dbstl_dbt.h"
 #include "dbstl_exception.h"
@@ -0,0 +1,125 @@
 diff --git a/Makefile b/Makefile
 index 5f1dc88..1ef6fcd 100644
 --- a/Makefile
 +++ b/Makefile
@@ -35,12 +35,12 @@ brick : all
 	done
 a :
 -	@if [ $${EUID} != 0 ]; then \
 +	@if [ "$$(id -u)" != 0 ]; then \
 		echo no 1>&2 ; \
 		exit 1 ; \
 	fi
 -GITTAG = $(shell bash -c "echo $$(($(VERSION) + 1))")
 +GITTAG = $(shell printf '%s\n' $$(( $(VERSION) + 1 )))
 efivar.spec : | Makefile src/include/version.mk
 diff --git a/src/include/defaults.mk b/src/include/defaults.mk
 index 4da0cde..40f4d51 100644
 --- a/src/include/defaults.mk
 +++ b/src/include/defaults.mk
@@ -11,13 +11,15 @@ PKGS	?=
 CROSS_COMPILE	?=
 COMPILER 	?= gcc
 -ifeq ($(origin CC),command line)
 -override COMPILER := $(CC)
 -override CC := $(CROSS_COMPILE)$(COMPILER)
 -endif
 +
 +tool-if-exists = $(strip $(shell command -v $(1) >/dev/null 2>&1 && printf '%s' '$(1)'))
 +cc-command = $(firstword $(filter-out ccache sccache distcc,$(foreach word,$(1),$(notdir $(word)))))
 +cc-name = $(patsubst $(CROSS_COMPILE)%,%,$(call cc-command,$(1)))
 +
 $(call set-if-undefined,CC,$(CROSS_COMPILE)$(COMPILER))
 +override COMPILER := $(or $(call cc-name,$(CC)),$(COMPILER))
 $(call set-if-undefined,CCLD,$(CC))
 -$(call set-if-undefined,HOSTCC,$(COMPILER))
 +$(call set-if-undefined,HOSTCC,$(call cc-name,$(CC)))
 $(call set-if-undefined,HOSTCCLD,$(HOSTCC))
 # temporary, see https://sourceware.org/bugzilla/show_bug.cgi?id=28264
@@ -107,11 +109,11 @@ override HOST_LDFLAGS = $(HOST_CFLAGS) -L. \
 			$(call pkg-config-ccldflags)
 override HOST_CCLDFLAGS = $(HOST_LDFLAGS)
 -PKG_CONFIG ?= $(shell if [ -e "$$(env $(CROSS_COMPILE)pkg-config 2>&1)" ]; then echo $(CROSS_COMPILE)pkg-config ; else echo pkg-config ; fi)
 +PKG_CONFIG ?= $(or $(call tool-if-exists,$(CROSS_COMPILE)pkg-config),pkg-config)
 INSTALL ?= install
 -AR	:= $(CROSS_COMPILE)$(COMPILER)-ar
 -NM	:= $(CROSS_COMPILE)$(COMPILER)-nm
 -RANLIB	:= $(CROSS_COMPILE)$(COMPILER)-ranlib
 +$(call set-if-undefined,AR,$(or $(call tool-if-exists,$(CROSS_COMPILE)$(call cc-name,$(CC))-ar),$(if $(findstring clang,$(call cc-name,$(CC))),$(call tool-if-exists,$(CROSS_COMPILE)llvm-ar),$(call tool-if-exists,$(CROSS_COMPILE)gcc-ar)),$(call tool-if-exists,$(CROSS_COMPILE)ar),ar))
 +$(call set-if-undefined,NM,$(or $(call tool-if-exists,$(CROSS_COMPILE)$(call cc-name,$(CC))-nm),$(if $(findstring clang,$(call cc-name,$(CC))),$(call tool-if-exists,$(CROSS_COMPILE)llvm-nm),$(call tool-if-exists,$(CROSS_COMPILE)gcc-nm)),$(call tool-if-exists,$(CROSS_COMPILE)nm),nm))
 +$(call set-if-undefined,RANLIB,$(or $(call tool-if-exists,$(CROSS_COMPILE)$(call cc-name,$(CC))-ranlib),$(if $(findstring clang,$(call cc-name,$(CC))),$(call tool-if-exists,$(CROSS_COMPILE)llvm-ranlib),$(call tool-if-exists,$(CROSS_COMPILE)gcc-ranlib)),$(call tool-if-exists,$(CROSS_COMPILE)ranlib),ranlib))
 ABIDW	:= abidw
 ABIDIFF := abidiff
 MANDOC	:= mandoc
 diff --git a/src/include/coverity.mk b/src/include/coverity.mk
 index 2e7024b..f852097 100644
 --- a/src/include/coverity.mk
 +++ b/src/include/coverity.mk
@@ -4,11 +4,11 @@ COV_URL=$(call get-config,coverity.url)
 COV_FILE=$(NAME)-coverity-$(VERSION)-$(COMMIT_ID).tar.bz2
 cov-int : clean
 -	cov-build --dir cov-int make all
 +	cov-build --dir cov-int $(MAKE) all
 cov-clean :
 	@rm -vf $(NAME)-coverity-*.tar.*
 -	@if [[ -d cov-int ]]; then rm -rf cov-int && echo "removed 'cov-int'"; fi
 +	@if [ -d cov-int ]; then rm -rf cov-int && echo "removed 'cov-int'"; fi
 cov-file : | $(COV_FILE)
@@ -16,9 +16,9 @@ $(COV_FILE) : cov-int
 	tar caf $@ cov-int
 cov-upload :
 -	@if [[ -n "$(COV_URL)" ]] &&					\
 -	    [[ -n "$(COV_TOKEN)" ]] &&					\
 -	    [[ -n "$(COV_EMAIL)" ]] ;					\
 +	@if [ -n "$(COV_URL)" ] &&					\
 +	    [ -n "$(COV_TOKEN)" ] &&					\
 +	    [ -n "$(COV_EMAIL)" ] ;					\
 	then								\
 		echo curl --form token=$(COV_TOKEN) --form email="$(COV_EMAIL)" --form file=@"$(COV_FILE)" --form version=$(VERSION).1 --form description="$(COMMIT_ID)" "$(COV_URL)" ; \
 		curl --form token=$(COV_TOKEN) --form email="$(COV_EMAIL)" --form file=@"$(COV_FILE)" --form version=$(VERSION).1 --form description="$(COMMIT_ID)" "$(COV_URL)" ; \
@@ -31,7 +31,7 @@ coverity : cov-file cov-upload
 clean : | cov-clean
 -COV_BUILD ?= $(shell x=$$(which --skip-alias --skip-functions cov-build 2>/dev/null) ; [ -n "$$x" ] && echo 1)
 +COV_BUILD ?= $(shell command -v cov-build >/dev/null 2>&1 && printf '%s' 1)
 ifeq ($(COV_BUILD),)
 	COV_BUILD_ERROR = $(error cov-build not found)
 endif
 diff --git a/src/include/scan-build.mk b/src/include/scan-build.mk
 index 19da90c..125c85c 100644
 --- a/src/include/scan-build.mk
 +++ b/src/include/scan-build.mk
@@ -1,4 +1,4 @@
 -SCAN_BUILD ?= $(shell x=$$(which --skip-alias --skip-functions scan-build 2>/dev/null) ; [ -n "$$x" ] && echo 1)
 +SCAN_BUILD ?= $(shell command -v scan-build >/dev/null 2>&1 && printf '%s' 1)
 ifeq ($(SCAN_BUILD),)
 	SCAN_BUILD_ERROR = $(error scan-build not found)
 endif
@@ -6,12 +6,12 @@ endif
 scan-test : ; $(SCAN_BUILD_ERROR)
 scan-clean : clean
 -	@if [[ -d scan-results ]]; then rm -rf scan-results && echo "removed 'scan-results'"; fi
 +	@if [ -d scan-results ]; then rm -rf scan-results && echo "removed 'scan-results'"; fi
 scan-build : | scan-test
 scan-build : clean
 	$(MAKE) -C src makeguids
 -	scan-build -o scan-results make $(DASHJ) CC=clang all
 +	scan-build -o scan-results $(MAKE) $(DASHJ) CC=clang all
 scan-build-all: | scan-build
 scan : | scan-build
@@ -0,0 +1,171 @@
 diff -urN a/src/basic/mountpoint-util.c b/src/basic/mountpoint-util.c
 --- a/src/basic/mountpoint-util.c	2025-11-18 01:14:12.000000000 -0600
 +++ b/src/basic/mountpoint-util.c	2026-03-29 15:01:10.720866440 -0500
@@ -127,7 +127,7 @@
         if (r < 0)
                 return r;
 -        p = find_line_startswith(fdinfo, "mnt_id:");
 +        p = (char*) find_line_startswith(fdinfo, "mnt_id:");
         if (!p) /* The mnt_id field is a relatively new addition */
                 return -EOPNOTSUPP;
@@ -554,7 +554,7 @@
 int dev_is_devtmpfs(void) {
         _cleanup_fclose_ FILE *proc_self_mountinfo = NULL;
         int mount_id, r;
 -        char *e;
 +        const char *e;
         r = path_get_mnt_id("/dev", &mount_id);
         if (r < 0)
 diff -urN a/src/basic/process-util.c b/src/basic/process-util.c
 --- a/src/basic/process-util.c	2025-11-18 01:14:12.000000000 -0600
 +++ b/src/basic/process-util.c	2026-03-29 15:01:10.721866471 -0500
@@ -1793,7 +1793,7 @@
         if (r < 0)
                 return r;
 -        p = find_line_startswith(fdinfo, "Pid:");
 +        p = (char*) find_line_startswith(fdinfo, "Pid:");
         if (!p)
                 return -ENOTTY; /* not a pidfd? */
 diff -urN a/src/basic/string-util.c b/src/basic/string-util.c
 --- a/src/basic/string-util.c	2025-11-18 01:14:12.000000000 -0600
 +++ b/src/basic/string-util.c	2026-03-29 15:01:10.720866440 -0500
@@ -1409,8 +1409,8 @@
         return strndup(a, strcspn(a, reject));
 }
 -char *find_line_startswith(const char *haystack, const char *needle) {
 -        char *p;
 +const char *find_line_startswith(const char *haystack, const char *needle) {
 +        const char *p;
         assert(haystack);
         assert(needle);
 diff -urN a/src/basic/string-util.h b/src/basic/string-util.h
 --- a/src/basic/string-util.h	2025-11-18 01:14:12.000000000 -0600
 +++ b/src/basic/string-util.h	2026-03-29 15:01:10.720866440 -0500
@@ -26,14 +26,14 @@
 #define URI_UNRESERVED      ALPHANUMERICAL "-._~"       /* [RFC3986] */
 #define URI_VALID           URI_RESERVED URI_UNRESERVED /* [RFC3986] */
 -static inline char* strstr_ptr(const char *haystack, const char *needle) {
 +static inline const char* strstr_ptr(const char *haystack, const char *needle) {
         if (!haystack || !needle)
                 return NULL;
         return strstr(haystack, needle);
 }
 -static inline char *strstrafter(const char *haystack, const char *needle) {
 -        char *p;
 +static inline const char *strstrafter(const char *haystack, const char *needle) {
 +        const char *p;
         /* Returns NULL if not found, or pointer to first character after needle if found */
@@ -308,7 +308,7 @@
 #endif // 0
 char *strdupcspn(const char *a, const char *reject);
 -char *find_line_startswith(const char *haystack, const char *needle);
 +const char *find_line_startswith(const char *haystack, const char *needle);
 char *startswith_strv(const char *string, char **strv);
 diff -urN a/src/libelogind/sd-bus/sd-bus.c b/src/libelogind/sd-bus/sd-bus.c
 --- a/src/libelogind/sd-bus/sd-bus.c	2025-11-18 01:14:12.000000000 -0600
 +++ b/src/libelogind/sd-bus/sd-bus.c	2026-03-29 14:55:42.302578511 -0500
@@ -1407,7 +1407,8 @@
 int bus_set_address_system_remote(sd_bus *b, const char *host) {
         _cleanup_free_ char *e = NULL;
 -        char *m = NULL, *c = NULL, *a, *rbracket = NULL, *p = NULL;
 +        const char *m = NULL, *at = NULL, *rbracket = NULL, *p = NULL;
 +        char *a = NULL, *c = NULL;
         assert(b);
         assert(host);
@@ -1423,29 +1424,29 @@
                 e = bus_address_escape(t);
                 if (!e)
                         return -ENOMEM;
 -        } else if ((a = strchr(host, '@'))) {
 -                if (*(a + 1) == '[') {
 +        } else if ((at = strchr(host, '@'))) {
 +                if (*(at + 1) == '[') {
                         _cleanup_free_ char *t = NULL;
 -                        rbracket = strchr(a + 1, ']');
 +                        rbracket = strchr(at + 1, ']');
                         if (!rbracket)
                                 return -EINVAL;
                         t = new0(char, strlen(host));
                         if (!t)
                                 return -ENOMEM;
 -                        strncat(t, host, a - host + 1);
 -                        strncat(t, a + 2, rbracket - a - 2);
 +                        strncat(t, host, at - host + 1);
 +                        strncat(t, at + 2, rbracket - at - 2);
                         e = bus_address_escape(t);
                         if (!e)
                                 return -ENOMEM;
 -                } else if (*(a + 1) == '\0' || strchr(a + 1, '@'))
 +                } else if (*(at + 1) == '\0' || strchr(at + 1, '@'))
                         return -EINVAL;
         }
         /* Let's see if a port was given */
         m = strchr(rbracket ? rbracket + 1 : host, ':');
         if (m) {
 -                char *t;
 +                const char *t;
                 bool got_forward_slash = false;
                 p = m + 1;
 diff -urN a/src/test/test-id128.c b/src/test/test-id128.c
 --- a/src/test/test-id128.c	2025-11-18 01:14:12.000000000 -0600
 +++ b/src/test/test-id128.c	2026-03-29 15:05:01.649650821 -0500
@@ -22,6 +22,18 @@
 #define UUID_WALDI "01020304-0506-0708-090a-0b0c0d0e0f10"
 #define STR_NULL "00000000000000000000000000000000"
 +static bool id128_in_0(sd_id128_t id) {
 +        return false;
 +}
 +
 +static bool id128_in_1(sd_id128_t id, sd_id128_t a) {
 +        return sd_id128_equal(id, a);
 +}
 +
 +static bool id128_in_2(sd_id128_t id, sd_id128_t a, sd_id128_t b) {
 +        return sd_id128_equal(id, a) || sd_id128_equal(id, b);
 +}
 +
 TEST(id128) {
         sd_id128_t id, id2;
         char t[SD_ID128_STRING_MAX], q[SD_ID128_UUID_STRING_MAX];
@@ -33,13 +45,14 @@
         assert_se(sd_id128_from_string(t, &id2) == 0);
         assert_se(sd_id128_equal(id, id2));
 -        assert_se(sd_id128_in_set(id, id));
 -        assert_se(sd_id128_in_set(id, id2));
 -        assert_se(sd_id128_in_set(id, id2, id));
 -        assert_se(sd_id128_in_set(id, ID128_WALDI, id));
 -        assert_se(!sd_id128_in_set(id));
 -        assert_se(!sd_id128_in_set(id, ID128_WALDI));
 -        assert_se(!sd_id128_in_set(id, ID128_WALDI, ID128_WALDI));
 +        /* Work around a Clang 22 frontend crash on sd_id128_in_set() with union varargs in this test. */
 +        assert_se(id128_in_1(id, id));
 +        assert_se(id128_in_1(id, id2));
 +        assert_se(id128_in_2(id, id2, id));
 +        assert_se(id128_in_2(id, ID128_WALDI, id));
 +        assert_se(!id128_in_0(id));
 +        assert_se(!id128_in_1(id, ID128_WALDI));
 +        assert_se(!id128_in_2(id, ID128_WALDI, ID128_WALDI));
         if (sd_booted() > 0 && sd_id128_get_machine(NULL) >= 0) {
                 assert_se(sd_id128_get_machine(&id) == 0);
@@ -0,0 +1,15 @@
 --- a/meson.build	2025-11-18 01:14:12.000000000 -0600
 +++ b/meson.build	2026-03-29 15:09:28.505104620 -0500
@@ -158,6 +158,12 @@
 #endif // 0
 pkglibdir = libdir / 'elogind'
 +# If libexecdir collapses to libdir, keep private executables under pkglibdir
 +# so they don't collide with the private library directory itself.
 +if libexecdir == libdir
 +        libexecdir = pkglibdir
 +endif
 +
 #if 0 /// UNNEEDED by elogind
 # install_sysconfdir = get_option('install-sysconfdir') != 'false'
 #endif // 0
@@ -0,0 +1,311 @@
 diff -urN a/configure b/configure
 --- a/configure	2025-11-18 01:14:12.000000000 -0600
 +++ b/configure	2026-03-29 14:49:52.741863535 -0500
@@ -1,10 +1,12 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
 cflags="CFLAGS=${CFLAGS-}"
 cxxflags="CXXFLAGS=${CXXFLAGS-}"
 -args=()
 +args_file="${TMPDIR:-/tmp}/elogind-configure-args.$$"
 +trap 'rm -f "$args_file"' EXIT HUP INT TERM
 +: >"$args_file"
 for arg in "$@"; do
     case "$arg" in
@@ -15,10 +17,15 @@
             cxxflags="$arg"
             ;;
         *)
 -            args+=("$arg")
 +            printf '%s\n' "$arg" >>"$args_file"
     esac
 done
 +set --
 +while IFS= read -r arg; do
 +    set -- "$@" "$arg"
 +done <"$args_file"
 +
 export "${cflags?}" "${cxxflags?}"
 set -x
 -exec meson setup build "${args[@]}"
 +exec meson setup build "$@"
 diff -urN a/meson_options.txt b/meson_options.txt
 --- a/meson_options.txt	2025-11-18 01:14:12.000000000 -0600
 +++ b/meson_options.txt	2026-03-29 14:50:19.141523091 -0500
@@ -297,7 +297,7 @@
 # option('clock-valid-range-usec-max', type : 'integer', value : 473364000000000, # 15 years
 #        description : 'maximum value in microseconds for the difference between RTC and epoch, exceeding which is considered an RTC error ["0" disables]')
 #endif // 0
 -option('default-user-shell', type : 'string', value : '/bin/bash',
 +option('default-user-shell', type : 'string', value : '/bin/sh',
        description : 'default interactive shell')
 option('system-alloc-uid-min', type : 'integer', value : 0,
 diff -urN a/src/basic/generate-cap-list.sh b/src/basic/generate-cap-list.sh
 --- a/src/basic/generate-cap-list.sh	2025-11-18 01:14:12.000000000 -0600
 +++ b/src/basic/generate-cap-list.sh	2026-03-29 14:51:05.674685004 -0500
@@ -1,8 +1,19 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -eu
 -set -o pipefail
 -${1:?} -dM -include linux/capability.h -include "${2:?}" -include "${3:?}" - </dev/null | \
 -       awk '/^#define[ \t]+CAP_[A-Z_]+[ \t]+/ { print $2; }' | \
 -       grep -v CAP_LAST_CAP
 +tmp="${TMPDIR:-/tmp}/generate-cap-list.$$"
 +trap 'rm -f "$tmp"' EXIT HUP INT TERM
 +
 +# Meson passes the preprocessor invocation as a single argument.
 +cpp="${1:?}"
 +config_h="${2:?}"
 +missing_capability_h="${3:?}"
 +set -- $cpp
 +"$@" -dM -include linux/capability.h -include "$config_h" -include "$missing_capability_h" - </dev/null >"$tmp"
 +
 +awk '
 +    /^#define[ \t]+CAP_[A-Z_]+[ \t]+/ && $2 != "CAP_LAST_CAP" {
 +        print $2
 +    }
 +' "$tmp"
 diff -urN a/src/basic/generate-errno-list.sh b/src/basic/generate-errno-list.sh
 --- a/src/basic/generate-errno-list.sh	2025-11-18 01:14:12.000000000 -0600
 +++ b/src/basic/generate-errno-list.sh	2026-03-29 14:50:58.129496657 -0500
@@ -1,11 +1,20 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -eu
 -set -o pipefail
 # In kernel's arch/parisc/include/uapi/asm/errno.h, ECANCELLED and EREFUSED are defined as aliases of
 # ECANCELED and ECONNREFUSED, respectively. Let's drop them.
 -${1:?} -dM -include errno.h - </dev/null | \
 -       grep -Ev '^#define[[:space:]]+(ECANCELLED|EREFUSED)' | \
 -       awk '/^#define[ \t]+E[^ _]+[ \t]+/ { print $2; }'
 +tmp="${TMPDIR:-/tmp}/generate-errno-list.$$"
 +trap 'rm -f "$tmp"' EXIT HUP INT TERM
 +
 +# Meson passes the preprocessor invocation as a single argument.
 +set -- ${1:?}
 +"$@" -dM -include errno.h - </dev/null >"$tmp"
 +
 +awk '
 +    !/^#define[[:space:]]+(ECANCELLED|EREFUSED)/ &&
 +    /^#define[ \t]+E[^ _]+[ \t]+/ {
 +        print $2
 +    }
 +' "$tmp"
 diff -urN a/src/basic/user-util.c b/src/basic/user-util.c
 --- a/src/basic/user-util.c	2025-11-18 01:14:12.000000000 -0600
 +++ b/src/basic/user-util.c	2026-03-29 14:50:19.142523116 -0500
@@ -160,7 +160,7 @@
 const char* default_root_shell_at(int rfd) {
         /* We want to use the preferred shell, i.e. DEFAULT_USER_SHELL, which usually
 -         * will be /bin/bash. Fall back to /bin/sh if DEFAULT_USER_SHELL is not found,
 +         * will be /bin/sh. Fall back to /bin/sh if DEFAULT_USER_SHELL is not found,
          * or any access errors. */
         assert(rfd >= 0 || rfd == AT_FDCWD);
 diff -urN a/tools/check-api-docs.sh b/tools/check-api-docs.sh
 --- a/tools/check-api-docs.sh	2025-11-18 01:14:12.000000000 -0600
 +++ b/tools/check-api-docs.sh	2026-03-29 14:50:58.129496657 -0500
@@ -1,44 +1,42 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -eu
 -set -o pipefail
 sd_good=0
 sd_total=0
 udev_good=0
 udev_total=0
 +nm_file="${TMPDIR:-/tmp}/check-api-docs.nm.$$"
 +symbols_file="${TMPDIR:-/tmp}/check-api-docs.symbols.$$"
 +trap 'rm -f "$nm_file" "$symbols_file"' EXIT HUP INT TERM
 -deprecated=(
 -    -e sd_bus_try_close
 -    -e sd_bus_process_priority
 -    -e sd_bus_message_get_priority
 -    -e sd_bus_message_set_priority
 -    -e sd_seat_can_multi_session
 -    -e sd_journal_open_container
 -)
 +nm -g --defined-only "$@" >"$nm_file"
 +awk '/ T / { print $3; }' "$nm_file" | \
 +    grep -E -v '^(sd_bus_try_close|sd_bus_process_priority|sd_bus_message_get_priority|sd_bus_message_set_priority|sd_seat_can_multi_session|sd_journal_open_container)$' | \
 +    sort -u >"$symbols_file"
 -for symbol in $(nm -g --defined-only "$@" | grep " T " | cut -d" " -f3 | grep -wv "${deprecated[@]}" | sort -u); do
 +while IFS= read -r symbol; do
     if test -f "${MESON_BUILD_ROOT:?}/man/$symbol.3"; then
         echo "✓ Symbol $symbol() is documented."
         good=1
     else
 -        echo -e "  \x1b[1;31mSymbol $symbol() lacks documentation.\x1b[0m"
 +        printf '  \033[1;31mSymbol %s() lacks documentation.\033[0m\n' "$symbol"
         good=0
     fi
     case "$symbol" in
         sd_*)
 -            ((sd_good+=good))
 -            ((sd_total+=1))
 +            sd_good=$((sd_good + good))
 +            sd_total=$((sd_total + 1))
             ;;
         udev_*)
 -            ((udev_good+=good))
 -            ((udev_total+=1))
 +            udev_good=$((udev_good + good))
 +            udev_total=$((udev_total + 1))
             ;;
         *)
             echo 'unknown symbol prefix'
             exit 1
     esac
 -done
 +done <"$symbols_file"
 echo "libsystemd: $sd_good/$sd_total libudev: $udev_good/$udev_total"
 diff -urN a/tools/check-help.sh b/tools/check-help.sh
 --- a/tools/check-help.sh	2025-11-18 01:14:12.000000000 -0600
 +++ b/tools/check-help.sh	2026-03-29 14:49:52.742863560 -0500
@@ -1,7 +1,6 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -eu
 -set -o pipefail
 # Note: 'grep ... >/dev/null' instead of just 'grep -q' is used intentionally
 #       here, since 'grep -q' exits on the first match causing SIGPIPE being
@@ -9,39 +8,48 @@
 BINARY="${1:?}"
 export SYSTEMD_LOG_LEVEL=info
 +help_out="${TMPDIR:-/tmp}/check-help.out.$$"
 +help_err="${TMPDIR:-/tmp}/check-help.err.$$"
 +short_out="${TMPDIR:-/tmp}/check-help-short.out.$$"
 +bad_err="${TMPDIR:-/tmp}/check-help-bad.err.$$"
 +trap 'rm -f "$help_out" "$help_err" "$short_out" "$bad_err"' EXIT HUP INT TERM
 -if [[ ! -x "$BINARY" ]]; then
 +if [ ! -x "$BINARY" ]; then
     echo "$BINARY is not an executable"
     exit 1
 fi
 +"$BINARY" --help >"$help_out" 2>"$help_err"
 +
 # output width
 -if "$BINARY" --help | grep -v 'default:' | grep -E '.{80}.' >/dev/null; then
 +if grep -v 'default:' "$help_out" | grep -E '.{80}.' >/dev/null; then
     echo "$(basename "$BINARY") --help output is too wide:"
 -    "$BINARY" --help | awk 'length > 80' | grep -E --color=yes '.{80}'
 +    awk 'length > 80' "$help_out" | grep -E --color=yes '.{80}'
     exit 1
 fi
 # --help prints something. Also catches case where args are ignored.
 -if ! "$BINARY" --help | grep . >/dev/null; then
 +if ! grep . "$help_out" >/dev/null; then
     echo "$(basename "$BINARY") --help output is empty"
     exit 2
 fi
 # no --help output to stderr
 -if "$BINARY" --help 2>&1 1>/dev/null | grep .; then
 +if grep . "$help_err" >/dev/null; then
     echo "$(basename "$BINARY") --help prints to stderr"
     exit 3
 fi
 # error output to stderr
 -if ! ("$BINARY" --no-such-parameter 2>&1 1>/dev/null || :) | grep . >/dev/null; then
 +("$BINARY" --no-such-parameter >/dev/null 2>"$bad_err" || :)
 +if ! grep . "$bad_err" >/dev/null; then
     echo "$(basename "$BINARY") with an unknown parameter does not print to stderr"
     exit 4
 fi
 # --help and -h are equivalent
 -if ! diff <("$BINARY" -h) <("$BINARY" --help); then
 +"$BINARY" -h >"$short_out" 2>/dev/null
 +if ! diff "$short_out" "$help_out"; then
     echo "$(basename "$BINARY") --help and -h are not identical"
     exit 5
 fi
 diff -urN a/tools/check-version.sh b/tools/check-version.sh
 --- a/tools/check-version.sh	2025-11-18 01:14:12.000000000 -0600
 +++ b/tools/check-version.sh	2026-03-29 14:49:52.742863560 -0500
@@ -1,7 +1,6 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -eu
 -set -o pipefail
 # Note: 'grep ... >/dev/null' instead of just 'grep -q' is used intentionally
 #       here, since 'grep -q' exits on the first match causing SIGPIPE being
@@ -10,27 +9,32 @@
 BINARY="${1:?}"
 VERSION="${2:?}"
 export SYSTEMD_LOG_LEVEL=info
 +version_out="${TMPDIR:-/tmp}/check-version.out.$$"
 +version_err="${TMPDIR:-/tmp}/check-version.err.$$"
 +trap 'rm -f "$version_out" "$version_err"' EXIT HUP INT TERM
 -if [[ ! -x "$BINARY" ]]; then
 +if [ ! -x "$BINARY" ]; then
     echo "$BINARY is not an executable"
     exit 1
 fi
 +"$BINARY" --version >"$version_out" 2>"$version_err"
 +
 # --version prints something. Also catches case where args are ignored.
 -if ! "$BINARY" --version | grep . >/dev/null; then
 +if ! grep . "$version_out" >/dev/null; then
     echo "$(basename "$BINARY") --version output is empty"
     exit 2
 fi
 # no --version output to stderr
 -if "$BINARY" --version 2>&1 1>/dev/null | grep .; then
 +if grep . "$version_err" >/dev/null; then
     echo "$(basename "$BINARY") --version prints to stderr"
     exit 3
 fi
 # project version appears in version output
 -out="$("$BINARY" --version)"
 -if ! grep -F "$VERSION" >/dev/null <<<"$out"; then
 +out=$(cat "$version_out")
 +if ! grep -F "$VERSION" "$version_out" >/dev/null; then
     echo "$(basename "$BINARY") --version output does not match '$VERSION': $out"
     exit 4
 fi
 diff -urN a/tools/meson-vcs-tag.sh b/tools/meson-vcs-tag.sh
 --- a/tools/meson-vcs-tag.sh	2025-11-18 01:14:12.000000000 -0600
 +++ b/tools/meson-vcs-tag.sh	2026-03-29 14:49:52.742863560 -0500
@@ -1,8 +1,7 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -u
 -set -o pipefail
 dir="${1:?}"
 fallback="${2:?}"
@@ -0,0 +1,10 @@
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -1,6 +1,6 @@
 AUTOMAKE_OPTIONS=foreign
 ACLOCAL_AMFLAGS = -I build-aux
 -SUBDIRS=doc scripts test
 +SUBDIRS=scripts test
 noinst_LTLIBRARIES = libcommunicate.la libmacosx.la libfakeroot_time64.la
 libcommunicate_la_SOURCES = communicate.c
@@ -0,0 +1,136 @@
 diff -ruN a/CMakeLists.txt b/CMakeLists.txt
 --- a/CMakeLists.txt	2026-02-13 10:15:11.000000000 -0600
 +++ b/CMakeLists.txt	2026-02-28 14:34:36.533430812 -0600
@@ -120,7 +120,7 @@
     message(FATAL_ERROR "BINARY_LINK_TYPE must be one of ${BINARY_LINK_TYPE_OPTIONS}")
 endif()
 -set(PACKAGE_MANAGERS AM APK BREW CHOCO DPKG EMERGE EOPKG FLATPAK GUIX LINGLONG LPKG LPKGBUILD MACPORTS NIX OPKG PACMAN PACSTALL PALUDIS PISI PKG PKGTOOL RPM SCOOP SNAP SOAR SORCERY WINGET XBPS)
 +set(PACKAGE_MANAGERS AM APK BREW CHOCO DEPOT DPKG EMERGE EOPKG FLATPAK GUIX LINGLONG LPKG LPKGBUILD MACPORTS NIX OPKG PACMAN PACSTALL PALUDIS PISI PKG PKGTOOL RPM SCOOP SNAP SOAR SORCERY WINGET XBPS)
 foreach(package_manager ${PACKAGE_MANAGERS})
     if(package_manager STREQUAL "WINGET")
         option(PACKAGES_DISABLE_${package_manager} "Disable ${package_manager} package manager detection by default" ON)
 diff -ruN a/src/detection/packages/packages.h b/src/detection/packages/packages.h
 --- a/src/detection/packages/packages.h	2026-02-13 10:15:11.000000000 -0600
 +++ b/src/detection/packages/packages.h	2026-02-28 14:34:43.270607662 -0600
@@ -11,6 +11,7 @@
     uint32_t brew;
     uint32_t brewCask;
     uint32_t choco;
 +    uint32_t depot;
     uint32_t dpkg;
     uint32_t emerge;
     uint32_t eopkg;
 diff -ruN a/src/detection/packages/packages_linux.c b/src/detection/packages/packages_linux.c
 --- a/src/detection/packages/packages_linux.c	2026-02-13 10:15:11.000000000 -0600
 +++ b/src/detection/packages/packages_linux.c	2026-02-28 14:34:54.446900065 -0600
@@ -455,6 +455,7 @@
 {
     if (!(options->disabled & FF_PACKAGES_FLAG_APK_BIT)) packageCounts->apk += getNumStrings(baseDir, "/lib/apk/db/installed", "C:Q", "apk");
     if (!(options->disabled & FF_PACKAGES_FLAG_DPKG_BIT)) packageCounts->dpkg += getNumStrings(baseDir, "/var/lib/dpkg/status", "Status: install ok installed", "dpkg");
 +    if (!(options->disabled & FF_PACKAGES_FLAG_DEPOT_BIT)) packageCounts->depot += getSQLite3Int(baseDir, "/var/lib/depot/packages.db", "SELECT COUNT(*) FROM packages", "depot-system");
     if (!(options->disabled & FF_PACKAGES_FLAG_LPKG_BIT)) packageCounts->lpkg += getNumStrings(baseDir, "/opt/Loc-OS-LPKG/installed-lpkg/Listinstalled-lpkg.list", "\n", "lpkg");
     if (!(options->disabled & FF_PACKAGES_FLAG_EMERGE_BIT)) packageCounts->emerge += countFilesRecursive(baseDir, "/var/db/pkg", "SIZE");
     if (!(options->disabled & FF_PACKAGES_FLAG_EOPKG_BIT)) packageCounts->eopkg += getNumElements(baseDir, "/var/lib/eopkg/package", true);
@@ -559,6 +560,9 @@
     #endif
     ffStrbufSet(&baseDir, &instance.state.platform.homeDir);
 +    if (!(options->disabled & FF_PACKAGES_FLAG_DEPOT_BIT))
 +        result->depot += getSQLite3Int(&baseDir, ".local/share/depot/packages.db", "SELECT COUNT(*) FROM packages", "depot-user");
 +
     if (!(options->disabled & FF_PACKAGES_FLAG_NIX_BIT))
     {
         // Count packages from $HOME/.nix-profile
 diff -ruN a/src/logo/ascii/vertex.txt b/src/logo/ascii/vertex.txt
 --- a/src/logo/ascii/vertex.txt	1969-12-31 18:00:00.000000000 -0600
 +++ b/src/logo/ascii/vertex.txt	2026-02-28 14:34:29.816254040 -0600
@@ -0,0 +1,6 @@
 +____   ____             __
 +\   \ /   /____________/  |_  ____ ___  ___
 + \   Y   // __ \_  __ \   __\/ __ \\  \/  /
 +  \     /\  ___/|  | \/|  | \  ___/ >    <
 +   \___/  \___  >__|   |__|  \___  >__/\_ \
 +              \/                 \/      \/
 diff -ruN a/src/logo/builtin.c b/src/logo/builtin.c
 --- a/src/logo/builtin.c	2026-02-13 10:15:11.000000000 -0600
 +++ b/src/logo/builtin.c	2026-02-28 14:35:07.169231466 -0600
@@ -5274,6 +5274,16 @@
             FF_COLOR_FG_BLUE,
         },
     },
 +    // Vertex Linux
 +    {
 +        .names = {"Vertex Linux", "Vertex", "vertex"},
 +        .lines = FASTFETCH_DATATEXT_LOGO_VERTEX,
 +        .colors = {
 +            FF_COLOR_FG_LIGHT_MAGENTA,
 +        },
 +        .colorKeys = FF_COLOR_FG_LIGHT_MAGENTA,
 +        .colorTitle = FF_COLOR_FG_LIGHT_MAGENTA,
 +    },
     // VincentOS
     {
         .names = {"VincentOS"},
 diff -ruN a/src/modules/packages/option.h b/src/modules/packages/option.h
 --- a/src/modules/packages/option.h	2026-02-13 10:15:11.000000000 -0600
 +++ b/src/modules/packages/option.h	2026-02-28 14:34:47.202710674 -0600
@@ -37,6 +37,7 @@
     FF_PACKAGES_FLAG_PISI_BIT = 1ULL << 29,
     FF_PACKAGES_FLAG_SOAR_BIT = 1ULL << 30,
     FF_PACKAGES_FLAG_KISS_BIT = 1ULL << 31,
 +    FF_PACKAGES_FLAG_DEPOT_BIT = 1ULL << 32,
     FF_PACKAGES_FLAG_FORCE_UNSIGNED = UINT64_MAX,
 } FFPackagesFlags;
 static_assert(sizeof(FFPackagesFlags) == sizeof(uint64_t), "");
 diff -ruN a/src/modules/packages/packages.c b/src/modules/packages/packages.c
 --- a/src/modules/packages/packages.c	2026-02-13 10:15:11.000000000 -0600
 +++ b/src/modules/packages/packages.c	2026-02-28 14:35:01.426082052 -0600
@@ -58,6 +58,7 @@
             if((all -= counts.pacman) > 0)
                 printf(", ");
         };
 +        FF_PRINT_PACKAGE(depot)
         FF_PRINT_PACKAGE(dpkg)
         FF_PRINT_PACKAGE(rpm)
         FF_PRINT_PACKAGE(emerge)
@@ -156,6 +157,7 @@
             FF_FORMAT_ARG(counts.all, "all"),
             FF_FORMAT_ARG(counts.pacman, "pacman"),
             FF_FORMAT_ARG(counts.pacmanBranch, "pacman-branch"),
 +            FF_FORMAT_ARG(counts.depot, "depot"),
             FF_FORMAT_ARG(counts.dpkg, "dpkg"),
             FF_FORMAT_ARG(counts.rpm, "rpm"),
             FF_FORMAT_ARG(counts.emerge, "emerge"),
@@ -255,6 +257,7 @@
                             FF_TEST_PACKAGE_NAME(CHOCO)
                             break;
                         case 'D': if (false);
 +                            FF_TEST_PACKAGE_NAME(DEPOT)
                             FF_TEST_PACKAGE_NAME(DPKG)
                             break;
                         case 'E': if (false);
@@ -345,6 +348,7 @@
     FF_TEST_PACKAGE_NAME(APK)
     FF_TEST_PACKAGE_NAME(BREW)
     FF_TEST_PACKAGE_NAME(CHOCO)
 +    FF_TEST_PACKAGE_NAME(DEPOT)
     FF_TEST_PACKAGE_NAME(DPKG)
     FF_TEST_PACKAGE_NAME(EMERGE)
     FF_TEST_PACKAGE_NAME(EOPKG)
@@ -402,6 +406,7 @@
     FF_APPEND_PACKAGE_COUNT(brew)
     FF_APPEND_PACKAGE_COUNT(brewCask)
     FF_APPEND_PACKAGE_COUNT(choco)
 +    FF_APPEND_PACKAGE_COUNT(depot)
     FF_APPEND_PACKAGE_COUNT(dpkg)
     FF_APPEND_PACKAGE_COUNT(emerge)
     FF_APPEND_PACKAGE_COUNT(eopkg)
@@ -466,6 +471,7 @@
         {"Number of all packages", "all"},
         {"Number of pacman packages", "pacman"},
         {"Pacman branch on manjaro", "pacman-branch"},
 +        {"Number of depot packages", "depot"},
         {"Number of dpkg packages", "dpkg"},
         {"Number of rpm packages", "rpm"},
         {"Number of emerge packages", "emerge"},
@@ -0,0 +1,149 @@
 --- a/configure
 +++ b/configure
@@ -1289,12 +1289,27 @@
     log test_ld "$@"
     type=$1
     shift 1
 +    linker=$ld
 +    linkerflags=$LDFLAGS
 +    use_cxx_linker=false
 +    test "$type" = cxx && use_cxx_linker=true
 +    for opt; do
 +        test "$opt" = "$cxx_linker_flag" && use_cxx_linker=true
 +    done
     flags=$(filter_out '-l*|*.so' $@)
     libs=$(filter '-l*|*.so' $@)
 +    flags=$(filter_out "$cxx_linker_flag" $flags)
 +    libs=$(filter_out "$cxx_linker_flag" $libs)
     test_$type $($cflags_filter $flags) || return
     flags=$($ldflags_filter $flags)
     libs=$($ldflags_filter $libs)
 -    test_cmd $ld $LDFLAGS $LDEXEFLAGS $flags $(ld_o $TMPE) $TMPO $libs $extralibs
 +    if $use_cxx_linker; then
 +        linker=$cxx
 +        linkerflags="$CXXFLAGS $LDFLAGS"
 +        test_cmd $linker $linkerflags $LDEXEFLAGS $flags $(cxx_o $TMPE) $TMPO $libs $extralibs
 +    else
 +        test_cmd $linker $linkerflags $LDEXEFLAGS $flags $(ld_o $TMPE) $TMPO $libs $extralibs
 +    fi
 }
 check_ld(){
@@ -1647,11 +1662,11 @@
     pkg_cflags=$($pkg_config --cflags $pkg_config_flags $pkg)
     pkg_libs=$($pkg_config --libs $pkg_config_flags $pkg)
     pkg_incdir=$($pkg_config --variable=includedir $pkg_config_flags $pkg)
 -    check_class_headers_cxx "$headers" "$classes" $pkg_cflags $pkg_libs "-lstdc++" "$@" &&
 +    check_class_headers_cxx "$headers" "$classes" $pkg_cflags $pkg_libs "$cxx_linker_flag" "$@" &&
         enable $name &&
         set_sanitized "${name}_cflags"    $pkg_cflags &&
         set_sanitized "${name}_incdir"    $pkg_incdir &&
 -        set_sanitized "${name}_extralibs" $pkg_libs "-lstdc++"
 +        set_sanitized "${name}_extralibs" $pkg_libs "$cxx_linker_flag"
 }
 check_pkg_config(){
@@ -3531,7 +3546,7 @@
 ddagrab_filter_deps="d3d11va IDXGIOutput1 DXGI_OUTDUPL_FRAME_INFO"
 gfxcapture_filter_deps="cxx17 threads d3d11va IGraphicsCaptureItemInterop __x_ABI_CWindows_CGraphics_CCapture_CIGraphicsCaptureSession3"
 -gfxcapture_filter_extralibs="-lstdc++"
 +gfxcapture_filter_extralibs="$cxx_linker_flag"
 scale_d3d11_filter_deps="d3d11va"
 scale_d3d12_filter_deps="d3d12va ID3D12VideoProcessor"
 deinterlace_d3d12_filter_deps="d3d12va ID3D12VideoProcessor"
@@ -3971,11 +3986,11 @@
 caca_outdev_deps="libcaca"
 decklink_deps_any="libdl LoadLibrary"
 decklink_indev_deps="decklink threads"
 -decklink_indev_extralibs="-lstdc++"
 +decklink_indev_extralibs="$cxx_linker_flag"
 decklink_indev_suggest="libzvbi"
 decklink_outdev_deps="decklink threads"
 decklink_outdev_suggest="libklvanc"
 -decklink_outdev_extralibs="-lstdc++"
 +decklink_outdev_extralibs="$cxx_linker_flag"
 dshow_indev_deps="IBaseFilter"
 dshow_indev_extralibs="-lpsapi -lole32 -lstrmiids -luuid -loleaut32 -lshlwapi"
 fbdev_indev_deps="linux_fb_h"
@@ -4464,6 +4479,9 @@
 host_extralibs='-lm'
 host_cflags_filter=echo
 host_ldflags_filter=echo
 +# Internal marker for configure tests and generated makefiles to use CXX
 +# as the linker driver without hardcoding a specific C++ runtime library.
 +cxx_linker_flag='--ffmpeg-cxx-linker'
 target_path='$(CURDIR)'
@@ -7269,13 +7287,13 @@
     require_headers "glslang/build_info.h" && { test_cpp_condition glslang/build_info.h "GLSLANG_VERSION_MAJOR >= 16" && spvremap="" ; }
     check_lib spirv_library glslang/Include/glslang_c_interface.h glslang_initialize_process \
                             -lglslang -lMachineIndependent -lGenericCodeGen \
 -                            ${spvremap} -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lstdc++ $libm_extralibs $pthreads_extralibs ||
 +                            ${spvremap} -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools $cxx_linker_flag $libm_extralibs $pthreads_extralibs ||
                         require spirv_library glslang/Include/glslang_c_interface.h glslang_initialize_process \
                             -lglslang -lMachineIndependent -lOSDependent -lHLSL -lOGLCompiler -lGenericCodeGen \
 -                            ${spvremap} -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lstdc++ $libm_extralibs $pthreads_extralibs ;
 +                            ${spvremap} -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools $cxx_linker_flag $libm_extralibs $pthreads_extralibs ;
 fi
 enabled libgme            && { check_pkg_config libgme libgme gme/gme.h gme_new_emu ||
 -                               require libgme gme/gme.h gme_new_emu -lgme -lstdc++; }
 +                               require libgme gme/gme.h gme_new_emu -lgme $cxx_linker_flag; }
 enabled libgsm            && { for gsm_hdr in "gsm.h" "gsm/gsm.h"; do
                                    check_lib libgsm "${gsm_hdr}" gsm_create -lgsm && break;
                                done || die "ERROR: libgsm not found"; }
@@ -7343,7 +7361,7 @@
 enabled libopenh264       && require_pkg_config libopenh264 "openh264 >= 1.3.0" wels/codec_api.h WelsGetCodecVersion
 enabled libopenjpeg       && { check_pkg_config libopenjpeg "libopenjp2 >= 2.1.0" openjpeg.h opj_version ||
                                { require_pkg_config libopenjpeg "libopenjp2 >= 2.1.0" openjpeg.h opj_version -DOPJ_STATIC && add_cppflags -DOPJ_STATIC; } }
 -enabled libopenmpt        && require_pkg_config libopenmpt "libopenmpt >= 0.2.6557" libopenmpt/libopenmpt.h openmpt_module_create -lstdc++ && append libopenmpt_extralibs "-lstdc++"
 +enabled libopenmpt        && require_pkg_config libopenmpt "libopenmpt >= 0.2.6557" libopenmpt/libopenmpt.h openmpt_module_create $cxx_linker_flag && append libopenmpt_extralibs "$cxx_linker_flag"
 enabled libopenvino       && { { check_pkg_config libopenvino openvino openvino/c/openvino.h ov_core_create && enable openvino2; } ||
                                 { check_pkg_config libopenvino openvino c_api/ie_c_api.h ie_c_api_version ||
                                   require libopenvino c_api/ie_c_api.h ie_c_api_version -linference_engine_c_api; } }
@@ -7364,12 +7382,12 @@
 enabled librist           && require_pkg_config librist "librist >= 0.2.7" librist/librist.h rist_receiver_create
 enabled librsvg           && require_pkg_config librsvg librsvg-2.0 librsvg-2.0/librsvg/rsvg.h rsvg_handle_new_from_data
 enabled librtmp           && require_pkg_config librtmp librtmp librtmp/rtmp.h RTMP_Socket
 -enabled librubberband     && require_pkg_config librubberband "rubberband >= 1.8.1" rubberband/rubberband-c.h rubberband_new -lstdc++ && append librubberband_extralibs "-lstdc++"
 +enabled librubberband     && require_pkg_config librubberband "rubberband >= 1.8.1" rubberband/rubberband-c.h rubberband_new $cxx_linker_flag && append librubberband_extralibs "$cxx_linker_flag"
 enabled libshaderc        && require_pkg_config spirv_library "shaderc >= 2019.1" shaderc/shaderc.h shaderc_compiler_initialize
 enabled libshine          && require_pkg_config libshine shine shine/layer3.h shine_encode_buffer
 enabled libsmbclient      && { check_pkg_config libsmbclient smbclient libsmbclient.h smbc_init ||
                                require libsmbclient libsmbclient.h smbc_init -lsmbclient; }
 -enabled libsnappy         && require libsnappy snappy-c.h snappy_compress -lsnappy -lstdc++
 +enabled libsnappy         && require libsnappy snappy-c.h snappy_compress -lsnappy $cxx_linker_flag
 enabled libsoxr           && require libsoxr soxr.h soxr_create -lsoxr
 enabled libssh            && require_pkg_config libssh "libssh >= 0.6.0" libssh/sftp.h sftp_init
 enabled libspeex          && require_pkg_config libspeex speex speex/speex.h speex_decoder_init
@@ -7381,7 +7399,7 @@
 enabled libtheora         && require libtheora theora/theoraenc.h th_info_init -ltheoraenc -ltheoradec -logg
 enabled libtls            && require_pkg_config libtls libtls tls.h tls_configure &&
                              { enabled gpl && ! enabled nonfree && die "ERROR: LibreSSL is incompatible with the gpl"; }
 -enabled libtorch          && check_cxxflags -std=c++17 && require_cxx libtorch torch/torch.h "torch::Tensor" -ltorch -lc10 -ltorch_cpu -lstdc++ -lpthread
 +enabled libtorch          && check_cxxflags -std=c++17 && require_cxx libtorch torch/torch.h "torch::Tensor" -ltorch -lc10 -ltorch_cpu $cxx_linker_flag -lpthread
 enabled libtwolame        && require libtwolame twolame.h twolame_init -ltwolame &&
                              { check_lib libtwolame twolame.h twolame_encode_buffer_float32_interleaved -ltwolame ||
                                die "ERROR: libtwolame must be installed and version must be >= 0.3.10"; }
@@ -8588,6 +8606,7 @@
 CC_O=$CC_O
 CXX_C=$CXX_C
 CXX_O=$CXX_O
 +CXXLINKERFLAG=$cxx_linker_flag
 GLSLC_O=$GLSLC_O
 NVCC_C=$NVCC_C
 NVCC_O=$NVCC_O
 --- a/ffbuild/common.mak
 +++ b/ffbuild/common.mak
@@ -17,7 +17,9 @@
 ifeq ($(LD),$(CC))
 ifneq ($(CXX),)
 LDXX := $(CXX)
 -LINK = $(if $(filter -lstdc++,$(1)),$(LDXX) $(filter-out -lstdc++,$(1)),$(LD) $(1))
 +# Link C++-dependent targets with the C++ driver so it can select the
 +# appropriate runtime library for the active toolchain.
 +LINK = $(if $(filter $(CXXLINKERFLAG),$(1)),$(LDXX) $(filter-out $(CXXLINKERFLAG),$(1)),$(LD) $(1))
 endif
 endif
@@ -0,0 +1,47 @@
 --- a/share/functions/fish_command_not_found.fish
 +++ b/share/functions/fish_command_not_found.fish
@@ -49,6 +49,44 @@
     function fish_command_not_found
         command-not-found -- $argv[1]
     end
 +    # depot can query binary repo metadata for path ownership, which lets us
 +    # suggest packages for missing commands in a pkgfile-like format.
 +else if type -q depot
 +    function fish_command_not_found
 +        set -l __depot_seen_dirs
 +        set -l __depot_paths
 +        set -l __depot_packages
 +
 +        for __dir in $PATH
 +            string match -q '/*' -- $__dir; or continue
 +            contains -- $__dir $__depot_seen_dirs; and continue
 +            set -a __depot_seen_dirs $__dir
 +            set -a __depot_paths $__dir/$argv[1]
 +        end
 +
 +        if test (count $__depot_paths) -eq 0
 +            set __depot_paths /usr/bin/$argv[1] /bin/$argv[1]
 +        end
 +
 +        for __path in $__depot_paths
 +            set -l __hits (
 +                depot repo owns $__path 2>/dev/null |
 +                string match -r '^\[INFO\] [^ ]+ \[binary:[^]]+\] [^ ]+ size=[^ ]+ owns=.*$' |
 +                string replace -r '^\[INFO\] ([^ ]+) \[binary:([^]]+)\] ([^ ]+) size=[^ ]+ owns=(.+)$' '$2/$1 $3\t$4'
 +            )
 +
 +            for __hit in $__hits
 +                contains -- $__hit $__depot_packages; or set -a __depot_packages $__hit
 +            end
 +        end
 +
 +        if test (count $__depot_packages) -gt 0
 +            printf "%s may be found in the following packages:\n" "$argv[1]"
 +            printf "  %s\n" $__depot_packages
 +        else
 +            __fish_default_command_not_found_handler $argv[1]
 +        end
 +    end
     # pkgfile is an optional, but official, package on Arch Linux
     # it ships with example handlers for bash and zsh, so we'll follow that format
 else if type -q pkgfile
@@ -0,0 +1,84 @@
 diff --git a/test/run-test.sh b/test/run-test.sh
 index 9b3c91c..73c0d3e 100644
 --- a/test/run-test.sh
 +++ b/test/run-test.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 # fontconfig/test/run-test.sh
 #
 # Copyright © 2000 Keith Packard
@@ -84,11 +84,11 @@ fstat() {
         ret=$(stat -c "$fmt" "$fn")
     else
         # BSD
 -        if [ "x$fmt" == "x%Y" ]; then
 +        if [ "x$fmt" = "x%Y" ]; then
             ret=$(stat -f "%m" "$fn")
 -        elif [ "x$fmt" == "x%y" ]; then
 +        elif [ "x$fmt" = "x%y" ]; then
             ret=$(stat -f "%Sm" -t "%F %T %z" "$fn")
 -        elif [ "x$fmt" == "x%n %s %y %z" ]; then
 +        elif [ "x$fmt" = "x%n %s %y %z" ]; then
             ret=$(stat -f "%SN %z %Sm %Sc" -t "%F %T %z" "$fn")
         else
             echo "E: Unknown format"
 diff --git a/test/run-test-map.sh b/test/run-test-map.sh
 index 869d7b2..c634bb8 100755
 --- a/test/run-test-map.sh
 +++ b/test/run-test-map.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 # fontconfig/test/run-test-cache-map.sh
 #
 # Copyright © 2018 Keith Packard
@@ -41,9 +41,8 @@ EXPECTED="out-map.expected"
 FCLIST=../fc-list/fc-list$EXEEXT
 FCCACHE=../fc-cache/fc-cache$EXEEXT
 -which bwrap > /dev/null 2>&1
 -if [ $? -eq 0 ]; then
 -    BWRAP=`which bwrap`
 +if command -v bwrap > /dev/null 2>&1; then
 +    BWRAP=$(command -v bwrap)
 fi
 FONT1=$TESTDIR/4x6.pcf
 diff --git a/test/wrapper-script.sh b/test/wrapper-script.sh
 index 94dcb85..ae68c6d 100755
 --- a/test/wrapper-script.sh
 +++ b/test/wrapper-script.sh
@@ -1,20 +1,24 @@
 -#! /bin/bash
 +#! /bin/sh
 CC=${CC:-gcc}
 case "$1" in
   *.exe)
     export WINEPATH=$(${CC} -print-sysroot)/mingw/bin
 -    fccwd=`pwd`
 -    cd $(IFS=:;for i in $PATH; do echo $i|grep mingw> /dev/null; [ $? -eq 0 ] && echo $i; done)
 -    if [ "x$(dirname $@)" = "x." ]; then
 -        /usr/bin/env wine $fccwd/$@
 +    fccwd=$(pwd)
 +    mingw_path=$(IFS=:; for i in $PATH; do
 +        case "$i" in
 +            *mingw*) printf '%s\n' "$i"; break ;;
 +        esac
 +    done)
 +    cd "$mingw_path" || exit 1
 +    if [ "$(dirname -- "$1")" = "." ]; then
 +        /usr/bin/env wine "$fccwd/$1"
     else
 -        /usr/bin/env wine $@
 +        /usr/bin/env wine "$@"
     fi
     ;;
   *)
 -    $@
 +    "$@"
     ;;
 esac
 -
@@ -0,0 +1,178 @@
 --- a/Makefile
 +++ b/Makefile
@@ -1,93 +1,103 @@
 prefix=/usr/local
 -bindir=$(prefix)/bin
 -includedir=$(prefix)/include
 -libdir=$(prefix)/lib
 -sysconfdir=$(prefix)/etc
 -datarootdir=$(prefix)/share
 -datadir=$(datarootdir)/gettext-tiny
 -acdir=$(datarootdir)/aclocal
 -
 -ifeq ($(LIBINTL), MUSL)
 -	LIBSRC = libintl/libintl-musl.c
 -	HEADERS =
 -else ifeq ($(LIBINTL), NONE)
 -	LIBSRC =
 -	HEADERS =
 -else
 -	LIBSRC = libintl/libintl.c
 -	HEADERS = libintl.h
 -endif
 -PROGSRC = $(sort $(wildcard src/*.c))
 -
 -PARSEROBJS = src/poparser.o src/poparser_sysdep.o src/StringEscape.o
 -PROGOBJS = $(PROGSRC:.c=.o)
 -LIBOBJS = $(LIBSRC:.c=.o)
 -OBJS = $(PROGOBJS) $(LIBOBJS)
 +bindir=${prefix}/bin
 +includedir=${prefix}/include
 +libdir=${prefix}/lib
 +sysconfdir=${prefix}/etc
 +datarootdir=${prefix}/share
 +datadir=${datarootdir}/gettext-tiny
 +acdir=${datarootdir}/aclocal
 +
 +LIBINTL ?= default
 +LIBINTL_MODE=${LIBINTL:tl}
 +
 +.if ${LIBINTL_MODE} == "musl"
 +LIBSRC=libintl/libintl-musl.c
 +HEADERS=
 +.elif ${LIBINTL_MODE} == "none"
 +LIBSRC=
 +HEADERS=
 +.else
 +LIBSRC=libintl/libintl.c
 +HEADERS=libintl.h
 +.endif
 +
 +PARSEROBJS=src/poparser.o src/poparser_sysdep.o src/StringEscape.o
 +PROGOBJS=src/msgfmt.o src/msgmerge.o src/poparser.o src/poparser_sysdep.o src/StringEscape.o
 +LIBOBJS=${LIBSRC:.c=.o}
 +OBJS=${PROGOBJS} ${LIBOBJS}
 -ALL_INCLUDES = $(HEADERS)
 -ifneq ($(LIBINTL), NONE)
 +ALL_INCLUDES=${HEADERS}
 +.if ${LIBINTL_MODE} != "none"
 ALL_LIBS=libintl.a
 -endif
 +.else
 +ALL_LIBS=
 +.endif
 ALL_TOOLS=msgfmt msgmerge xgettext autopoint
 -ALL_M4S=$(sort $(wildcard m4/*.m4))
 -ALL_DATA=$(sort $(wildcard data/*))
 +AC_DATADIR_REL=${datadir:S,${datarootdir}/,,}
 CFLAGS  ?= -O0 -fPIC
 -AR      ?= $(CROSS_COMPILE)ar
 -RANLIB  ?= $(CROSS_COMPILE)ranlib
 -CC      ?= $(CROSS_COMPILE)cc
 +AR      ?= ${CROSS_COMPILE}ar
 +RANLIB  ?= ${CROSS_COMPILE}ranlib
 +CC      ?= ${CROSS_COMPILE}cc
 INSTALL ?= ./install.sh
 --include config.mak
 -
 -LDLIBS:=$(shell echo "int main(){}" | $(CC) $(CFLAGS) $(LDFLAGS) -liconv -x c - >/dev/null 2>&1 && printf %s -liconv)
 -
 -BUILDCFLAGS=$(CFLAGS)
 -
 -all: $(ALL_LIBS) $(ALL_TOOLS)
 -
 -install: $(ALL_LIBS:lib%=$(DESTDIR)$(libdir)/lib%) $(ALL_INCLUDES:%=$(DESTDIR)$(includedir)/%) $(ALL_TOOLS:%=$(DESTDIR)$(bindir)/%) $(ALL_M4S:%=$(DESTDIR)$(datadir)/%) $(ALL_M4S:%=$(DESTDIR)$(acdir)/%) $(ALL_DATA:%=$(DESTDIR)$(datadir)/%)
 +.if exists(config.mak)
 +.include "config.mak"
 +.endif
 +
 +LDLIBS!=echo 'int main(){}' | ${CC} ${CFLAGS} ${LDFLAGS} -liconv -x c - >/dev/null 2>&1 && printf '%s' -liconv || true
 +
 +BUILDCFLAGS=${CFLAGS}
 +
 +all: ${ALL_LIBS} ${ALL_TOOLS}
 +
 +install: ${ALL_LIBS} ${ALL_TOOLS}
 +.for lib in ${ALL_LIBS}
 +	${INSTALL} -D -m 755 ${lib} ${DESTDIR}${libdir}/${lib}
 +.endfor
 +.for hdr in ${ALL_INCLUDES}
 +	${INSTALL} -D -m 644 include/${hdr} ${DESTDIR}${includedir}/${hdr}
 +.endfor
 +.for tool in ${ALL_TOOLS}
 +	${INSTALL} -D -m 755 ${tool} ${DESTDIR}${bindir}/${tool}
 +.endfor
 +	@set -e; \
 +	for m4f in m4/*.m4; do \
 +		[ -f "$$m4f" ] || continue; \
 +		${INSTALL} -D -m 644 "$$m4f" "${DESTDIR}${datadir}/$${m4f##*/}"; \
 +		${INSTALL} -D -l "../${AC_DATADIR_REL}/$${m4f##*/}" "${DESTDIR}${acdir}/$${m4f##*/}"; \
 +	done
 +	@set -e; \
 +	for dataf in data/*; do \
 +		[ -f "$$dataf" ] || continue; \
 +		${INSTALL} -D -m 644 "$$dataf" "${DESTDIR}${datadir}/$${dataf##*/}"; \
 +	done
 clean:
 -	rm -f $(ALL_LIBS)
 -	rm -f $(OBJS)
 -	rm -f $(ALL_TOOLS)
 -
 -%.o: %.c
 -	$(CC) $(BUILDCFLAGS) -c -o $@ $<
 -
 -libintl.a: $(LIBOBJS)
 -	rm -f $@
 -	$(AR) rc $@ $(LIBOBJS)
 -	$(RANLIB) $@
 +	rm -f ${ALL_LIBS}
 +	rm -f ${OBJS}
 +	rm -f ${ALL_TOOLS}
 +
 +.c.o:
 +	${CC} ${BUILDCFLAGS} -c -o ${.TARGET} ${.IMPSRC}
 +
 +libintl.a: ${LIBOBJS}
 +	rm -f ${.TARGET}
 +	${AR} rc ${.TARGET} ${LIBOBJS}
 +	${RANLIB} ${.TARGET}
 -msgmerge: $(OBJS)
 -	$(CC) -o $@ src/msgmerge.o $(PARSEROBJS) $(LDFLAGS) $(LDLIBS)
 +msgmerge: ${OBJS}
 +	${CC} -o ${.TARGET} src/msgmerge.o ${PARSEROBJS} ${LDFLAGS} ${LDLIBS}
 -msgfmt: $(OBJS)
 -	$(CC) -o $@ src/msgfmt.o $(PARSEROBJS) $(LDFLAGS) $(LDLIBS)
 +msgfmt: ${OBJS}
 +	${CC} -o ${.TARGET} src/msgfmt.o ${PARSEROBJS} ${LDFLAGS} ${LDLIBS}
 xgettext:
 	cp src/xgettext.sh ./xgettext
 autopoint: src/autopoint.in
 -	cat $< | sed 's,@datadir@,$(datadir),' > $@
 -
 -$(DESTDIR)$(libdir)/%.a: %.a
 -	$(INSTALL) -D -m 755 $< $@
 -
 -$(DESTDIR)$(includedir)/%.h: include/%.h
 -	$(INSTALL) -D -m 644 $< $@
 -
 -$(DESTDIR)$(bindir)/%: %
 -	$(INSTALL) -D -m 755 $< $@
 -
 -$(DESTDIR)$(datadir)/%: %
 -	$(INSTALL) -D -m 644 $< $@
 -
 -$(DESTDIR)$(acdir)/%: %
 -	$(INSTALL) -D -l ../$(subst $(datarootdir)/,,$(datadir))/$< $(patsubst %m4/,%,$(dir $@))/$(notdir $@)
 +	sed 's,@datadir@,${datadir},' < src/autopoint.in > ${.TARGET}
 .PHONY: all clean install
@@ -0,0 +1,11 @@
 --- a/sysdeps/x86/fpu/math-barriers.h
 +++ b/sysdeps/x86/fpu/math-barriers.h
@@ -19,7 +19,7 @@
 #ifndef X86_MATH_BARRIERS_H
 #define X86_MATH_BARRIERS_H 1
 -#ifdef __SSE2_MATH__
 +#if defined __SSE2_MATH__ && !defined __clang__
 # define math_opt_barrier(x)						\
   ({ __typeof(x) __x;							\
      if (sizeof (x) <= sizeof (double)					\
@@ -0,0 +1,315 @@
 diff -ruN a/Makeconfig b/Makeconfig
 --- a/Makeconfig	2026-01-23 14:54:00.000000000 -0600
 +++ b/Makeconfig	2026-03-15 19:54:42.332792487 -0500
@@ -714,33 +714,109 @@
 else
   libunwind = -lunwind
 endif
 -libgcc_eh := -Wl,--as-needed -lgcc_s $(libunwind) -Wl,--no-as-needed
 +# Preserve the configured target selection when asking the compiler for
 +# support libraries and CRT objects.  For Clang, prefer
 +# compiler-rt builtins if available because libgcc lookups may resolve to a
 +# host archive.
 +cc-runtime-flags := $(filter-out -I%,$(CFLAGS)) $(sysdep-LDFLAGS) $(LDFLAGS)
 +cc-runtime-target := $(shell $(CC) $(cc-runtime-flags) -print-target-triple 2>/dev/null)
 +cc-clang-resource-dir := $(shell $(CC) $(cc-runtime-flags) --print-resource-dir 2>/dev/null)
 +cc-clang-rtlib-flags := $(shell \
 +  if test "$(have-test-clang)" = yes; then \
 +    for candidate in i686-linux-gnu i686-unknown-linux-gnu i386-unknown-linux-gnu "$(cc-runtime-target)"; do \
 +      if test -n "$$candidate"; then \
 +        rtlib=$$($(CC) $(cc-runtime-flags) --target=$$candidate \
 +          --rtlib=compiler-rt --print-libgcc-file-name 2>/dev/null); \
 +        if test "x$$rtlib" != x && test "x$$rtlib" != xlibgcc.a && test -r "$$rtlib"; then \
 +          printf '%s' "--target=$$candidate --rtlib=compiler-rt"; \
 +          exit 0; \
 +        fi; \
 +      fi; \
 +    done; \
 +  fi)
 +cc-clang-crtbegin := $(shell \
 +  if test "$(have-test-clang)" = yes; then \
 +    for path in \
 +      "$(cc-clang-resource-dir)/lib/i686-linux-gnu/clang_rt.crtbegin-i386.o" \
 +      "$(cc-clang-resource-dir)/lib/i686-unknown-linux-gnu/clang_rt.crtbegin-i386.o" \
 +      "$(cc-clang-resource-dir)/lib/i386-unknown-linux-gnu/clang_rt.crtbegin-i386.o" \
 +      "$(cc-clang-resource-dir)/lib/$(cc-runtime-target)/clang_rt.crtbegin-i386.o" \
 +      "$(cc-clang-resource-dir)/lib/linux/clang_rt.crtbegin-i386.o"; do \
 +      if test -r "$$path"; then \
 +        printf '%s' "$$path"; \
 +        exit 0; \
 +      fi; \
 +    done; \
 +  fi)
 +cc-clang-crtend := $(shell \
 +  if test "$(have-test-clang)" = yes; then \
 +    for path in \
 +      "$(cc-clang-resource-dir)/lib/i686-linux-gnu/clang_rt.crtend-i386.o" \
 +      "$(cc-clang-resource-dir)/lib/i686-unknown-linux-gnu/clang_rt.crtend-i386.o" \
 +      "$(cc-clang-resource-dir)/lib/i386-unknown-linux-gnu/clang_rt.crtend-i386.o" \
 +      "$(cc-clang-resource-dir)/lib/$(cc-runtime-target)/clang_rt.crtend-i386.o" \
 +      "$(cc-clang-resource-dir)/lib/linux/clang_rt.crtend-i386.o"; do \
 +      if test -r "$$path"; then \
 +        printf '%s' "$$path"; \
 +        exit 0; \
 +      fi; \
 +    done; \
 +  fi)
 +libgcc := $(shell \
 +  lib=$$($(CC) $(cc-runtime-flags) --print-libgcc-file-name 2>/dev/null); \
 +  if test "$(have-test-clang)" = yes; then \
 +    rtlib=$$($(CC) $(cc-runtime-flags) $(cc-clang-rtlib-flags) \
 +      --print-libgcc-file-name 2>/dev/null); \
 +    if test "x$$rtlib" != x && test "x$$rtlib" != xlibgcc.a && test -r "$$rtlib"; then \
 +      lib=$$rtlib; \
 +    else \
 +      for path in \
 +        "$(cc-clang-resource-dir)/lib/i686-linux-gnu/libclang_rt.builtins.a" \
 +        "$(cc-clang-resource-dir)/lib/i686-unknown-linux-gnu/libclang_rt.builtins.a" \
 +        "$(cc-clang-resource-dir)/lib/i386-unknown-linux-gnu/libclang_rt.builtins.a" \
 +        "$(cc-clang-resource-dir)/lib/$(cc-runtime-target)/libclang_rt.builtins.a" \
 +        "$(cc-clang-resource-dir)/lib/linux/libclang_rt.builtins-i386.a"; do \
 +        if test -r "$$path"; then \
 +          lib=$$path; \
 +          break; \
 +        fi; \
 +      done; \
 +    fi; \
 +  fi; \
 +  printf '%s' "$$lib")
 +# Do not mix Clang's compiler-rt builtins with GCC crtbegin/crtend
 +# objects.  If compiler-rt CRT objects are unavailable, leave these
 +# empty and let the link proceed without the GCC startup fragments.
 +cc-clang-use-rt := $(and $(filter yes,$(have-test-clang)),$(cc-clang-rtlib-flags))
 +libgcc_eh_archive := $(shell $(CC) $(cc-runtime-flags) --print-file-name=libgcc_eh.a)
 +libgcc_s := $(shell $(CC) $(cc-runtime-flags) --print-file-name=libgcc_s.so$(libgcc_s.so-version))
 +libgcc_eh := -Wl,--as-needed $(libgcc_s) $(libunwind) -Wl,--no-as-needed
 gnulib-arch =
 -gnulib = -lgcc $(gnulib-arch)
 -gnulib-tests := -lgcc $(libgcc_eh)
 -gnulib-extralibdir = $(dir $(shell $(CC) -print-file-name=libgcc_s.so$(libgcc_s.so-version)))
 +gnulib = $(libgcc) $(gnulib-arch)
 +gnulib-tests := $(libgcc) $(libgcc_eh)
 +gnulib-extralibdir = $(patsubst ./,,$(dir $(libgcc_s)))
 static-gnulib-arch =
 # By default, elf/static-stubs.o, instead of -lgcc_eh, is used to
 # statically link programs.  When --disable-shared is used, we use
 # -lgcc_eh since elf/static-stubs.o isn't sufficient.
 ifeq (yes,$(build-shared))
 -static-gnulib = -lgcc $(static-gnulib-arch)
 +static-gnulib = $(libgcc) $(static-gnulib-arch)
 else
 -static-gnulib = -lgcc -lgcc_eh $(static-gnulib-arch)
 +static-gnulib = $(libgcc) $(libgcc_eh_archive) $(static-gnulib-arch)
 endif
 -static-gnulib-tests := -lgcc -lgcc_eh $(libunwind)
 -libc.so-gnulib := -lgcc
 +static-gnulib-tests := $(libgcc) $(libgcc_eh_archive) $(libunwind)
 +libc.so-gnulib := $(libgcc)
 endif
 +preinit = $(addprefix $(csu-objpfx),crti.o)
 +postinit = $(addprefix $(csu-objpfx),crtn.o)
 -+prector = `$(CC) $(sysdep-LDFLAGS) --print-file-name=crtbegin.o`
 -+postctor = `$(CC) $(sysdep-LDFLAGS) --print-file-name=crtend.o`
 ++prector = $(if $(cc-clang-use-rt),$(cc-clang-crtbegin),`$(CC) $(cc-runtime-flags) --print-file-name=crtbegin.o`)
 ++postctor = $(if $(cc-clang-use-rt),$(cc-clang-crtend),`$(CC) $(cc-runtime-flags) --print-file-name=crtend.o`)
 # Variants of the two previous definitions for linking PIE programs.
 -+prectorS = `$(CC) $(sysdep-LDFLAGS) --print-file-name=crtbeginS.o`
 -+postctorS = `$(CC) $(sysdep-LDFLAGS) --print-file-name=crtendS.o`
 ++prectorS = $(if $(cc-clang-use-rt),$(cc-clang-crtbegin),`$(CC) $(cc-runtime-flags) --print-file-name=crtbeginS.o`)
 ++postctorS = $(if $(cc-clang-use-rt),$(cc-clang-crtend),`$(CC) $(cc-runtime-flags) --print-file-name=crtendS.o`)
 # Variants of the two previous definitions for statically linking programs.
 -static-prector = `$(CC) $(sysdep-LDFLAGS) --print-file-name=crtbeginT.o`
 -static-postctor = `$(CC) $(sysdep-LDFLAGS) --print-file-name=crtend.o`
 +static-prector = $(if $(cc-clang-use-rt),$(cc-clang-crtbegin),`$(CC) $(cc-runtime-flags) --print-file-name=crtbeginT.o`)
 +static-postctor = $(if $(cc-clang-use-rt),$(cc-clang-crtend),`$(CC) $(cc-runtime-flags) --print-file-name=crtend.o`)
 ifeq (yes,$(enable-static-pie))
 # Static PIE must use PIE variants.
 +prectorT = $(if $($(@F)-no-pie),$(static-prector),$(+prectorS))
 diff -ruN a/Makerules b/Makerules
 --- a/Makerules	2026-01-23 14:54:00.000000000 -0600
 +++ b/Makerules	2026-03-15 19:54:16.435354197 -0500
@@ -543,7 +543,7 @@
 	$(call after-link,$@)
 define build-shlib-helper
 -$(LINK.o) -shared -static-libgcc -Wl,-O1 $(sysdep-LDFLAGS) \
 +$(LINK.o) -shared $(if $(and $(filter yes,$(have-test-clang)),$(cc-clang-rtlib-flags)),-nostartfiles $(cc-clang-rtlib-flags),-static-libgcc) -Wl,-O1 $(sysdep-LDFLAGS) \
 	  $(if $($(@F)-no-z-defs)$(no-z-defs),,-Wl,-z,defs) $(rtld-LDFLAGS) \
 	  $(if $($(@F)-no-dt-relr),$(no-dt-relr-ldflag),$(dt-relr-ldflag)) \
 	  $(extra-B-$(@F:lib%.so=%).so) -B$(csu-objpfx) \
@@ -555,11 +555,13 @@
 define build-shlib
 $(build-shlib-helper) -o $@ \
 -	  $(csu-objpfx)abi-note.o $(build-shlib-objlist)
 +	  $(if $(and $(filter yes,$(have-test-clang)),$(cc-clang-crtbegin)),$(if $(filter c.so,$(@F)),,$(+preinit)) $(+prectorS)) \
 +	  $(csu-objpfx)abi-note.o $(build-shlib-objlist) \
 +	  $(if $(and $(filter yes,$(have-test-clang)),$(cc-clang-crtend)),$(+postctorS) $(if $(filter c.so,$(@F)),,$(+postinit)))
 endef
 define build-module-helper
 -$(LINK.o) -shared -static-libgcc $(sysdep-LDFLAGS) $(rtld-LDFLAGS) \
 +$(LINK.o) -shared $(if $(and $(filter yes,$(have-test-clang)),$(cc-clang-rtlib-flags)),-nostartfiles $(cc-clang-rtlib-flags),-static-libgcc) $(sysdep-LDFLAGS) $(rtld-LDFLAGS) \
 	  $(if $($(@F)-no-z-defs)$(no-z-defs),,-Wl,-z,defs) \
 	  $(if $($(@F)-no-dt-relr),$(no-dt-relr-ldflag),$(dt-relr-ldflag)) \
 	  -B$(csu-objpfx) $(load-map-file) \
@@ -574,14 +576,18 @@
 # not for shared objects
 define build-module
 $(build-module-helper) -o $@ \
 -	  $(csu-objpfx)abi-note.o $(build-module-objlist) $(link-libc-args)
 +	  $(if $(and $(filter yes,$(have-test-clang)),$(cc-clang-crtbegin)),$(+preinit) $(+prectorS)) \
 +	  $(csu-objpfx)abi-note.o $(build-module-objlist) $(link-libc-args) \
 +	  $(if $(and $(filter yes,$(have-test-clang)),$(cc-clang-crtend)),$(+postctorS) $(+postinit))
 $(call after-link,$@)
 endef
 define build-module-asneeded
 $(build-module-helper) -o $@ \
 +	  $(if $(and $(filter yes,$(have-test-clang)),$(cc-clang-crtbegin)),$(+preinit) $(+prectorS)) \
 	  $(csu-objpfx)abi-note.o \
 	  -Wl,--as-needed $(build-module-objlist) -Wl,--no-as-needed \
 -	  $(link-libc-args)
 +	  $(link-libc-args) \
 +	  $(if $(and $(filter yes,$(have-test-clang)),$(cc-clang-crtend)),$(+postctorS) $(+postinit))
 $(call after-link,$@)
 endef
 diff -ruN a/configure b/configure
 --- a/configure	2026-01-23 14:54:00.000000000 -0600
 +++ b/configure	2026-03-15 19:54:16.436079577 -0500
@@ -9328,18 +9328,28 @@
 config_vars="$config_vars
 enable-static-pie = $libc_cv_static_pie"
 -# Check if we can link support functionality against libgcc_s.
 +# Check if the compiler reports usable support functionality from libgcc_s.
 # Must not be used for linking installed binaries, to produce the
 # same binaries for bootstrapped and bootstrapping builds (the latter
 # with a GCC that does not build libgcc_s).
 -{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC can link against -lgcc_s" >&5
 -printf %s "checking whether $CC can link against -lgcc_s... " >&6; }
 +#
 +# The compiler-reported runtime may be an absolute path rather than a bare
 +# library name, for example when using llvm-libgcc.  Include the configured
 +# target-selection flags so multilib and compiler-rt builds query the
 +# matching runtime.
 +{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC reports a usable libgcc_s" >&5
 +printf %s "checking whether $CC reports a usable libgcc_s... " >&6; }
 if test ${libc_cv_have_libgcc_s+y}
 then :
   printf %s "(cached) " >&6
 else case e in #(
   e)   old_LIBS="$LIBS"
 -  LIBS="$LIBS -lgcc_s"
 +  libc_cv_libgcc_s=`$CC $CFLAGS $LDFLAGS -print-file-name=libgcc_s.so 2>/dev/null`
 +  if test "x$libc_cv_libgcc_s" = "xlibgcc_s.so"
 +  then :
 +    libc_cv_have_libgcc_s=no
 +  else case e in #(
 +  e)   LIBS="$LIBS $libc_cv_libgcc_s"
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -9360,6 +9370,9 @@
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.beam \
     conftest$ac_exeext conftest.$ac_ext
 +   ;;
 +esac
 +  fi
   LIBS="$old_LIBS" ;;
 esac
 fi
@@ -11002,5 +11015,3 @@
   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
 printf "%s\n" "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
 fi
 -
 -
 diff -ruN a/configure.ac b/configure.ac
 --- a/configure.ac	2026-01-23 14:54:00.000000000 -0600
 +++ b/configure.ac	2026-03-15 19:54:16.436525491 -0500
@@ -2122,15 +2122,24 @@
 fi
 LIBC_CONFIG_VAR([enable-static-pie], [$libc_cv_static_pie])
 -# Check if we can link support functionality against libgcc_s.
 +# Check if the compiler reports usable support functionality from libgcc_s.
 # Must not be used for linking installed binaries, to produce the
 # same binaries for bootstrapped and bootstrapping builds (the latter
 # with a GCC that does not build libgcc_s).
 -AC_CACHE_CHECK([whether $CC can link against -lgcc_s], libc_cv_have_libgcc_s, [dnl
 +# The compiler-reported runtime may be an absolute path rather than a bare
 +# library name, for example when using llvm-libgcc.  Include the configured
 +# target-selection flags so multilib and compiler-rt builds query the
 +# matching runtime.
 +AC_CACHE_CHECK([whether $CC reports a usable libgcc_s], libc_cv_have_libgcc_s, [dnl
   old_LIBS="$LIBS"
 -  LIBS="$LIBS -lgcc_s"
 -  AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[]])],
 -		 [libc_cv_have_libgcc_s=yes], [libc_cv_have_libgcc_s=no])
 +  libc_cv_libgcc_s=`$CC $CFLAGS $LDFLAGS -print-file-name=libgcc_s.so 2>/dev/null`
 +  if test "x$libc_cv_libgcc_s" = "xlibgcc_s.so"; then
 +    libc_cv_have_libgcc_s=no
 +  else
 +    LIBS="$LIBS $libc_cv_libgcc_s"
 +    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[]])],
 +		   [libc_cv_have_libgcc_s=yes], [libc_cv_have_libgcc_s=no])
 +  fi
   LIBS="$old_LIBS"])
 LIBC_CONFIG_VAR([have-libgcc_s], [$libc_cv_have_libgcc_s])
 diff -ruN a/dlfcn/Makefile b/dlfcn/Makefile
 --- a/dlfcn/Makefile	2026-01-23 14:54:00.000000000 -0600
 +++ b/dlfcn/Makefile	2026-03-15 19:54:16.436660818 -0500
@@ -187,7 +187,7 @@
 $(objpfx)bug-atexit2.out: $(objpfx)bug-atexit2-lib.so
 ifneq (,$(CXX))
 -LDLIBS-bug-atexit3-lib.so = -lstdc++ -lgcc_eh
 +LDLIBS-bug-atexit3-lib.so = -lstdc++ $(libgcc_eh_archive)
 $(objpfx)bug-atexit3-lib.so: $(libsupport)
 $(objpfx)bug-atexit3.out: $(objpfx)bug-atexit3-lib.so
 endif
 diff -ruN a/elf/Makefile b/elf/Makefile
 --- a/elf/Makefile	2026-01-23 14:54:00.000000000 -0600
 +++ b/elf/Makefile	2026-03-15 19:54:16.436784483 -0500
@@ -1514,7 +1514,7 @@
 		echo ".globl $$symbol"; \
 		echo "$$symbol:"; \
 	done | $(CC) -o $@T.o $(ASFLAGS) -c -x assembler -
 -	$(reloc-link) -o $@.o $@T.o '-Wl,-(' $^ -lgcc '-Wl,-)' -Wl,-Map,$@T
 +	$(reloc-link) -o $@.o $@T.o '-Wl,-(' $^ $(libgcc) '-Wl,-)' -Wl,-Map,$@T
 	rm -f %@T.o $@.o
 	mv -f $@T $@
@@ -1544,7 +1544,7 @@
 	$(MAKE) -f $< -f rtld-Rules
 $(objpfx)librtld.os: $(objpfx)dl-allobjs.os $(objpfx)rtld-libc.a
 -	$(LINK.o) -nostdlib -nostartfiles -r -o $@ '-Wl,-(' $^ -lgcc '-Wl,-)' \
 +	$(LINK.o) -nostdlib -nostartfiles -r -o $@ '-Wl,-(' $^ $(libgcc) '-Wl,-)' \
 		  -Wl,-Map,$@.map
 generated += librtld.map librtld.mk rtld-libc.a librtld.os.map
 diff -ruN a/support/Makefile b/support/Makefile
 --- a/support/Makefile	2026-01-23 14:54:00.000000000 -0600
 +++ b/support/Makefile	2026-03-15 19:54:16.436940579 -0500
@@ -284,14 +284,14 @@
 ifeq (,$(CXX))
 LINKS_DSO_PROGRAM = links-dso-program-c
 -LDLIBS-links-dso-program-c = -lgcc
 +LDLIBS-links-dso-program-c = $(libgcc)
 ifeq ($(have-libgcc_s),yes)
 CFLAGS-links-dso-program-c.c += -fexceptions
 -LDLIBS-links-dso-program-c += -lgcc_s $(libunwind)
 +LDLIBS-links-dso-program-c += $(libgcc_s) $(libunwind)
 endif
 else
 LINKS_DSO_PROGRAM = links-dso-program
 -LDLIBS-links-dso-program = -lstdc++ -lgcc -lgcc_s $(libunwind)
 +LDLIBS-links-dso-program = -lstdc++ $(libgcc) $(libgcc_s) $(libunwind)
 endif
 ifeq (yes,$(have-selinux))
@@ -0,0 +1,15 @@
 --- a/sysdeps/unix/sysv/linux/x86/longjmp.c
 +++ b/sysdeps/unix/sysv/linux/x86/longjmp.c
@@ -29,6 +29,7 @@
 /* Assert that the priv field in struct pthread_unwind_buf has space
    to store shadow stack pointer.  */
 +#if defined SHADOW_STACK_POINTER_OFFSET && SHADOW_STACK_POINTER_OFFSET > 0
 _Static_assert ((offsetof (struct pthread_unwind_buf, priv)
                 <= SHADOW_STACK_POINTER_OFFSET)
                && ((offsetof (struct pthread_unwind_buf, priv)
@@ -37,3 +38,4 @@
                        + SHADOW_STACK_POINTER_SIZE)),
                "Shadow stack pointer is not within private storage "
                "of pthread_unwind_buf.");
 +#endif
@@ -0,0 +1,154 @@
 --- a/sysdeps/x86/fpu/sfp-machine.h
 +++ b/sysdeps/x86/fpu/sfp-machine.h
@@ -2,6 +2,7 @@
    libgcc, with soft-float and other irrelevant parts removed.  */
 #include <math-inline-asm.h>
 +#include <fenv.h>
 #if HAVE_X86_LIBGCC_CMP_RETURN_ATTR
 /* The type of the result of a floating point comparison.  This must
@@ -65,76 +66,82 @@
 # define _FP_WS_TYPE		signed long int
 # define _FP_I_TYPE		long int
 +# ifdef __clang__
 +#  define __SFP_REG(x) (x)
 +# else
 +#  define __SFP_REG(x) ((USItype) (x))
 +# endif
 +
 # define __FP_FRAC_ADD_4(r3,r2,r1,r0,x3,x2,x1,x0,y3,y2,y1,y0)	\
   __asm__ ("add{l} {%11,%3|%3,%11}\n\t"				\
 	   "adc{l} {%9,%2|%2,%9}\n\t"				\
 	   "adc{l} {%7,%1|%1,%7}\n\t"				\
 	   "adc{l} {%5,%0|%0,%5}"				\
 -	   : "=r" ((USItype) (r3)),				\
 -	     "=&r" ((USItype) (r2)),				\
 -	     "=&r" ((USItype) (r1)),				\
 -	     "=&r" ((USItype) (r0))				\
 -	   : "%0" ((USItype) (x3)),				\
 -	     "g" ((USItype) (y3)),				\
 -	     "%1" ((USItype) (x2)),				\
 -	     "g" ((USItype) (y2)),				\
 -	     "%2" ((USItype) (x1)),				\
 -	     "g" ((USItype) (y1)),				\
 -	     "%3" ((USItype) (x0)),				\
 -	     "g" ((USItype) (y0)))
 +	   : "=r" (__SFP_REG (r3)),				\
 +	     "=&r" (__SFP_REG (r2)),				\
 +	     "=&r" (__SFP_REG (r1)),				\
 +	     "=&r" (__SFP_REG (r0))				\
 +	   : "%0" (__SFP_REG (x3)),				\
 +	     "g" (__SFP_REG (y3)),				\
 +	     "%1" (__SFP_REG (x2)),				\
 +	     "g" (__SFP_REG (y2)),				\
 +	     "%2" (__SFP_REG (x1)),				\
 +	     "g" (__SFP_REG (y1)),				\
 +	     "%3" (__SFP_REG (x0)),				\
 +	     "g" (__SFP_REG (y0)))
 # define __FP_FRAC_ADD_3(r2,r1,r0,x2,x1,x0,y2,y1,y0)		\
   __asm__ ("add{l} {%8,%2|%2,%8}\n\t"				\
 	   "adc{l} {%6,%1|%1,%6}\n\t"				\
 	   "adc{l} {%4,%0|%0,%4}"				\
 -	   : "=r" ((USItype) (r2)),				\
 -	     "=&r" ((USItype) (r1)),				\
 -	     "=&r" ((USItype) (r0))				\
 -	   : "%0" ((USItype) (x2)),				\
 -	     "g" ((USItype) (y2)),				\
 -	     "%1" ((USItype) (x1)),				\
 -	     "g" ((USItype) (y1)),				\
 -	     "%2" ((USItype) (x0)),				\
 -	     "g" ((USItype) (y0)))
 +	   : "=r" (__SFP_REG (r2)),				\
 +	     "=&r" (__SFP_REG (r1)),				\
 +	     "=&r" (__SFP_REG (r0))				\
 +	   : "%0" (__SFP_REG (x2)),				\
 +	     "g" (__SFP_REG (y2)),				\
 +	     "%1" (__SFP_REG (x1)),				\
 +	     "g" (__SFP_REG (y1)),				\
 +	     "%2" (__SFP_REG (x0)),				\
 +	     "g" (__SFP_REG (y0)))
 # define __FP_FRAC_SUB_4(r3,r2,r1,r0,x3,x2,x1,x0,y3,y2,y1,y0)	\
   __asm__ ("sub{l} {%11,%3|%3,%11}\n\t"				\
 	   "sbb{l} {%9,%2|%2,%9}\n\t"				\
 	   "sbb{l} {%7,%1|%1,%7}\n\t"				\
 	   "sbb{l} {%5,%0|%0,%5}"				\
 -	   : "=r" ((USItype) (r3)),				\
 -	     "=&r" ((USItype) (r2)),				\
 -	     "=&r" ((USItype) (r1)),				\
 -	     "=&r" ((USItype) (r0))				\
 -	   : "0" ((USItype) (x3)),				\
 -	     "g" ((USItype) (y3)),				\
 -	     "1" ((USItype) (x2)),				\
 -	     "g" ((USItype) (y2)),				\
 -	     "2" ((USItype) (x1)),				\
 -	     "g" ((USItype) (y1)),				\
 -	     "3" ((USItype) (x0)),				\
 -	     "g" ((USItype) (y0)))
 +	   : "=r" (__SFP_REG (r3)),				\
 +	     "=&r" (__SFP_REG (r2)),				\
 +	     "=&r" (__SFP_REG (r1)),				\
 +	     "=&r" (__SFP_REG (r0))				\
 +	   : "0" (__SFP_REG (x3)),				\
 +	     "g" (__SFP_REG (y3)),				\
 +	     "1" (__SFP_REG (x2)),				\
 +	     "g" (__SFP_REG (y2)),				\
 +	     "2" (__SFP_REG (x1)),				\
 +	     "g" (__SFP_REG (y1)),				\
 +	     "3" (__SFP_REG (x0)),				\
 +	     "g" (__SFP_REG (y0)))
 # define __FP_FRAC_SUB_3(r2,r1,r0,x2,x1,x0,y2,y1,y0)		\
   __asm__ ("sub{l} {%8,%2|%2,%8}\n\t"				\
 	   "sbb{l} {%6,%1|%1,%6}\n\t"				\
 	   "sbb{l} {%4,%0|%0,%4}"				\
 -	   : "=r" ((USItype) (r2)),				\
 -	     "=&r" ((USItype) (r1)),				\
 -	     "=&r" ((USItype) (r0))				\
 -	   : "0" ((USItype) (x2)),				\
 -	     "g" ((USItype) (y2)),				\
 -	     "1" ((USItype) (x1)),				\
 -	     "g" ((USItype) (y1)),				\
 -	     "2" ((USItype) (x0)),				\
 -	     "g" ((USItype) (y0)))
 +	   : "=r" (__SFP_REG (r2)),				\
 +	     "=&r" (__SFP_REG (r1)),				\
 +	     "=&r" (__SFP_REG (r0))				\
 +	   : "0" (__SFP_REG (x2)),				\
 +	     "g" (__SFP_REG (y2)),				\
 +	     "1" (__SFP_REG (x1)),				\
 +	     "g" (__SFP_REG (y1)),				\
 +	     "2" (__SFP_REG (x0)),				\
 +	     "g" (__SFP_REG (y0)))
 # define __FP_FRAC_ADDI_4(x3,x2,x1,x0,i)			\
   __asm__ ("add{l} {%4,%3|%3,%4}\n\t"				\
 	   "adc{l} {$0,%2|%2,0}\n\t"				\
 	   "adc{l} {$0,%1|%1,0}\n\t"				\
 	   "adc{l} {$0,%0|%0,0}"				\
 -	   : "+r" ((USItype) (x3)),				\
 -	     "+&r" ((USItype) (x2)),				\
 -	     "+&r" ((USItype) (x1)),				\
 -	     "+&r" ((USItype) (x0))				\
 -	   : "g" ((USItype) (i)))
 +	   : "+r" (__SFP_REG (x3)),				\
 +	     "+&r" (__SFP_REG (x2)),				\
 +	     "+&r" (__SFP_REG (x1)),				\
 +	     "+&r" (__SFP_REG (x0))				\
 +	   : "g" (__SFP_REG (i)))
 # define _FP_MUL_MEAT_S(R,X,Y)				\
@@ -210,12 +217,10 @@
 	(FP_EX_INVALID | FP_EX_DENORM | FP_EX_DIVZERO | FP_EX_OVERFLOW \
 	 | FP_EX_UNDERFLOW | FP_EX_INEXACT)
 -void __sfp_handle_exceptions (int);
 -
 #define FP_HANDLE_EXCEPTIONS			\
   do {						\
     if (__builtin_expect (_fex, 0))		\
 -      __sfp_handle_exceptions (_fex);		\
 +      __feraiseexcept (_fex & FE_ALL_EXCEPT);	\
   } while (0);
 #define FP_TRAPPING_EXCEPTIONS ((~_fcw >> FP_EX_SHIFT) & FP_EX_ALL)
@@ -0,0 +1,61 @@
 diff --git a/googletest/test/googletest-port-test.cc
 index 9f05a01..9ee4061 100644
 --- a/googletest/test/googletest-port-test.cc
 +++ b/googletest/test/googletest-port-test.cc
@@ -304,7 +304,12 @@ TEST(GetThreadCountTest, ReturnsCorrectValue) {
   // some point.
   for (int attempt = 0; attempt < 20; ++attempt) {
     starting_count = GetThreadCount();
 +    if (starting_count == 0) {
 +      GTEST_SKIP() << "GetThreadCount() is unavailable on this system.";
 +    }
 +
     pthread_t thread_id;
 +    bool thread_count_matches = false;
     internal::Mutex mutex;
     {
@@ -317,7 +322,22 @@ TEST(GetThreadCountTest, ReturnsCorrectValue) {
       ASSERT_EQ(0, pthread_attr_destroy(&attr));
       ASSERT_EQ(0, status);
 -      thread_count_after_create = GetThreadCount();
 +      // The OS may not immediately report the updated thread count after
 +      // creating a thread, causing flakiness in this test. To counter that,
 +      // wait for up to .5 seconds for the OS to report the correct value
 +      // while keeping the worker thread blocked on the mutex.
 +      for (int i = 0; i < 5; ++i) {
 +        thread_count_after_create = GetThreadCount();
 +        if (thread_count_after_create == 0) {
 +          GTEST_SKIP() << "GetThreadCount() is unavailable on this system.";
 +        }
 +        if (thread_count_after_create == starting_count + 1) {
 +          thread_count_matches = true;
 +          break;
 +        }
 +
 +        std::this_thread::sleep_for(std::chrono::milliseconds(100));
 +      }
     }
     void* dummy;
@@ -325,14 +345,17 @@ TEST(GetThreadCountTest, ReturnsCorrectValue) {
     // Join before we decide whether we need to retry the test. Retry if an
     // arbitrary other thread was created or destroyed in the meantime.
 -    if (thread_count_after_create != starting_count + 1) continue;
 +    if (!thread_count_matches) continue;
     // The OS may not immediately report the updated thread count after
     // joining a thread, causing flakiness in this test. To counter that, we
     // wait for up to .5 seconds for the OS to report the correct value.
 -    bool thread_count_matches = false;
 +    thread_count_matches = false;
     for (int i = 0; i < 5; ++i) {
       thread_count_after_join = GetThreadCount();
 +      if (thread_count_after_join == 0) {
 +        GTEST_SKIP() << "GetThreadCount() is unavailable on this system.";
 +      }
       if (thread_count_after_join == starting_count) {
         thread_count_matches = true;
         break;
@@ -0,0 +1,62 @@
 diff --git a/icu/source/test/intltest/ssearch.cpp b/icu/source/test/intltest/ssearch.cpp
 index a13df7f..615ea53 100644
 --- a/icu/source/test/intltest/ssearch.cpp
 +++ b/icu/source/test/intltest/ssearch.cpp
@@ -531,12 +531,26 @@ static char *printOffsets(char *buffer, size_t n, OrderList &list)
     for(int32_t i = 0; i < size; i += 1) {
         const Order *order = list.get(i);
 +        size_t remaining = n - static_cast<size_t>(s - buffer);
 +
 +        if (remaining == 0) {
 +            break;
 +        }
         if (i != 0) {
 -            s += snprintf(s, n, ", ");
 +            int32_t written = snprintf(s, remaining, ", ");
 +            if (written < 0 || static_cast<size_t>(written) >= remaining) {
 +                break;
 +            }
 +            s += written;
 +            remaining -= written;
         }
 -        s += snprintf(s, n, "(%d, %d)", order->lowOffset, order->highOffset);
 +        int32_t written = snprintf(s, remaining, "(%d, %d)", order->lowOffset, order->highOffset);
 +        if (written < 0 || static_cast<size_t>(written) >= remaining) {
 +            break;
 +        }
 +        s += written;
     }
     return buffer;
@@ -549,12 +563,26 @@ static char *printOrders(char *buffer, size_t n, OrderList &list)
     for(int32_t i = 0; i < size; i += 1) {
         const Order *order = list.get(i);
 +        size_t remaining = n - static_cast<size_t>(s - buffer);
 +
 +        if (remaining == 0) {
 +            break;
 +        }
         if (i != 0) {
 -            s += snprintf(s, n, ", ");
 +            int32_t written = snprintf(s, remaining, ", ");
 +            if (written < 0 || static_cast<size_t>(written) >= remaining) {
 +                break;
 +            }
 +            s += written;
 +            remaining -= written;
         }
 -        s += snprintf(s, n, "%8.8X", order->order);
 +        int32_t written = snprintf(s, remaining, "%8.8X", order->order);
 +        if (written < 0 || static_cast<size_t>(written) >= remaining) {
 +            break;
 +        }
 +        s += written;
     }
     return buffer;
@@ -0,0 +1,288 @@
 diff --git a/addon/clang-format-helper.sh b/addon/clang-format-helper.sh
 index 0f7c352..f2708f2 100755
 --- a/addon/clang-format-helper.sh
 +++ b/addon/clang-format-helper.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # Helper script to invoke clang-format to re-format all files allowed to be
 diff --git a/addon/fips_integrity_checker_elf_generator.sh b/addon/fips_integrity_checker_elf_generator.sh
 index 10628f5..2529603 100755
 --- a/addon/fips_integrity_checker_elf_generator.sh
 +++ b/addon/fips_integrity_checker_elf_generator.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 SOFILE="$1"
 HASHER="$2"
@@ -15,13 +15,13 @@ CUT="cut"
 ################################################################################
 -if [ -z "$SOFILE" -o ! -f "$SOFILE" ]
 +if [ -z "$SOFILE" ] || [ ! -f "$SOFILE" ]
 then
 	echo "ERROR: shared library file $SOFILE not found"
 	exit 1
 fi
 -if [ -z "$HASHER" -o ! -x "$HASHER" ]
 +if [ -z "$HASHER" ] || [ ! -x "$HASHER" ]
 then
 	echo "ERROR: hasher executable $HASHER not found"
 	exit 1
 diff --git a/addon/fips_integrity_digest.sh b/addon/fips_integrity_digest.sh
 index c2a6475..b48f09b 100755
 --- a/addon/fips_integrity_digest.sh
 +++ b/addon/fips_integrity_digest.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # Tool to extract the message digest of the FIPS library. This digest provides
@@ -22,7 +22,7 @@ XXD="xxd"
 ################################################################################
 -if [ -z "$SOFILE" -o ! -f "$SOFILE" ]
 +if [ -z "$SOFILE" ] || [ ! -f "$SOFILE" ]
 then
 	echo "ERROR: shared library file $SOFILE not found"
 	exit 1
 diff --git a/addon/generate_header.sh b/addon/generate_header.sh
 index c150391..9bb30b3 100755
 --- a/addon/generate_header.sh
 +++ b/addon/generate_header.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 OUTFILE=$1
 shift
 diff --git a/addon/sanity_checks.sh b/addon/sanity_checks.sh
 index fc988b7..8595de7 100755
 --- a/addon/sanity_checks.sh
 +++ b/addon/sanity_checks.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 CHANGESFILE="CHANGES.md"
@@ -102,7 +102,14 @@ check_copyright_date() {
 		newyear="$year"
 	fi
 -	sed -i "/Copyright/s/$searchyear/$newyear/" $file
 +	tmpfile=$(mktemp "${TMPDIR:-/tmp}/leancrypto-copyright.XXXXXX") || exit 1
 +	if sed "/Copyright/s/$searchyear/$newyear/" "$file" > "$tmpfile"
 +	then
 +		mv "$tmpfile" "$file"
 +	else
 +		rm -f "$tmpfile"
 +		exit 1
 +	fi
 }
 # Cleanup code base
@@ -119,7 +126,7 @@ code_cleanup() {
 		for j in $@
 		do
 -			if (echo $i | grep -q $j)
 +			if printf '%s\n' "$i" | grep -q -- "$j"
 			then
 				skip=1
 				break
@@ -162,7 +169,7 @@ check_reposanity() {
 	check_existence ${CHANGESFILE}
 	check_existence README.md
 -	if ! $(head -n1 ${CHANGESFILE} | grep -q "$version" )
 +	if ! head -n1 "${CHANGESFILE}" | grep -q -- "$version"
 	then
 		#git log --pretty=format"%h %an %s" ${OLDVER}..HEAD
 		echo "Forgot to add $version changes to ${CHANGESFILE}" >&2
@@ -172,7 +179,7 @@ check_reposanity() {
 # Check whether we have a preliminary code drop
 check_preliminary() {
 -	if $(head -n1 ${CHANGESFILE} | grep -q "prerelease" )
 +	if head -n1 "${CHANGESFILE}" | grep -q "prerelease"
 	then
 		echo "Preliminary release - skipping full release validation" >&2
 		exit 0
 diff --git a/apps/tests/hasher-test.sh b/apps/tests/hasher-test.sh
 index cae5be8..01f2f51 100755
 --- a/apps/tests/hasher-test.sh
 +++ b/apps/tests/hasher-test.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # Copyright (C) 2017 - 2025, Stephan Mueller <smueller@chronox.de>
 #
@@ -106,7 +106,7 @@ then
 	echo_fail "Generation of checker file $CHKFILE with hasher $LC_HASHER failed"
 fi
 -opensslcmd=$(type -p openssl)
 +opensslcmd=$(command -v openssl 2>/dev/null)
 if [ -x "$opensslcmd" ]
 then
 diff --git a/apps/tests/leancrypto_check_with_ietf.sh b/apps/tests/leancrypto_check_with_ietf.sh
 index 9e3f88a..b1c9ac6 100755
 --- a/apps/tests/leancrypto_check_with_ietf.sh
 +++ b/apps/tests/leancrypto_check_with_ietf.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # Written by Stephan Mueller <smueller@chronox.de>
 #
@@ -52,8 +52,8 @@ trap "rm -rf $TMPDIR" 0 1 2 3 15
 color()
 {
 	bg=0
 -	echo -ne "\033[0m"
 -	while [[ $# -gt 0 ]]; do
 +	printf '\033[0m'
 +	while [ "$#" -gt 0 ]; do
 		code=0
 		case $1 in
 			black) code=30 ;;
@@ -69,7 +69,10 @@ color()
 			reset|off|default) code=0 ;;
 			bold|bright) code=1 ;;
 		esac
 -		[[ $code == 0 ]] || echo -ne "\033[$(printf "%02d" $((code+bg)))m"
 +		if [ "$code" -ne 0 ]
 +		then
 +			printf '\033[%02dm' "$((code + bg))"
 +		fi
 		shift
 	done
 }
 diff --git a/apps/tests/libtest.sh b/apps/tests/libtest.sh
 index 46f950b..ab7e36e 100644
 --- a/apps/tests/libtest.sh
 +++ b/apps/tests/libtest.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # Copyright (C) 2017 - 2025, Stephan Mueller <smueller@chronox.de>
 #
@@ -34,8 +34,8 @@ KERNVER=$(uname -r)
 color()
 {
 	bg=0
 -	echo -ne "\033[0m"
 -	while [[ $# -gt 0 ]]; do
 +	printf '\033[0m'
 +	while [ "$#" -gt 0 ]; do
 		code=0
 		case $1 in
 			black) code=30 ;;
@@ -51,7 +51,10 @@ color()
 			reset|off|default) code=0 ;;
 			bold|bright) code=1 ;;
 		esac
 -		[[ $code == 0 ]] || echo -ne "\033[$(printf "%02d" $((code+bg)))m"
 +		if [ "$code" -ne 0 ]
 +		then
 +			printf '\033[%02dm' "$((code + bg))"
 +		fi
 		shift
 	done
 }
 diff --git a/asn1/tests/testcerts/lc_gen_4way_cert_chain.sh b/asn1/tests/testcerts/lc_gen_4way_cert_chain.sh
 index d0f8a72..0a10677 100755
 --- a/asn1/tests/testcerts/lc_gen_4way_cert_chain.sh
 +++ b/asn1/tests/testcerts/lc_gen_4way_cert_chain.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # Generate a 4-way certificate chain using leancrypto
 #
 diff --git a/build-scripts/aesgcm-only.sh b/build-scripts/aesgcm-only.sh
 index 39bb0a3..739cf4f 100755
 --- a/build-scripts/aesgcm-only.sh
 +++ b/build-scripts/aesgcm-only.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # This script defines the option set required for building leancrypto to only
@@ -108,4 +108,3 @@ meson setup build-aesgcm-only \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE $@
 -
 diff --git a/build-scripts/mlkem1024-only.sh b/build-scripts/mlkem1024-only.sh
 index 1b2ff3e..e4ee316 100755
 --- a/build-scripts/mlkem1024-only.sh
 +++ b/build-scripts/mlkem1024-only.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # This script defines the option set required for building leancrypto to only
@@ -107,4 +107,3 @@ meson setup build-mlkem1024-only \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE $@
 -
 diff --git a/build-scripts/pqc-only.sh b/build-scripts/pqc-only.sh
 index e1b70da..10534d0 100755
 --- a/build-scripts/pqc-only.sh
 +++ b/build-scripts/pqc-only.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # This script defines the option set required for building leancrypto to only
@@ -94,4 +94,3 @@ meson setup build-pqc-only \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE $@
 -
 diff --git a/build-scripts/sha256_only.sh b/build-scripts/sha256_only.sh
 index fbe228a..6d43a4f 100755
 --- a/build-scripts/sha256_only.sh
 +++ b/build-scripts/sha256_only.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # This script defines the option set required for building leancrypto to only
@@ -103,4 +103,3 @@ meson setup build-sha256-only \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE $@
 -
 diff --git a/build-scripts/shim_support.sh b/build-scripts/shim_support.sh
 index c97a002..f127423 100755
 --- a/build-scripts/shim_support.sh
 +++ b/build-scripts/shim_support.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # This script defines the option set required for building leancrypto to work
@@ -106,4 +106,3 @@ meson setup build-shim \
  $DISABLE_ASN1 \
  $DISABLE_MISC \
  $FORCE_SEEDSOURCE
 -
@@ -0,0 +1,11 @@
 --- a/Make.Rules	2025-10-26 13:29:03.000000000 -0500
 +++ b/Make.Rules	2026-03-15 23:30:24.030620424 -0500
@@ -85,7 +85,7 @@
 CPPFLAGS += -Dlinux $(DEFINES) $(LIBCAP_INCLUDES)
 LDFLAGS ?= # -g
 -BUILD_CC ?= $(CC)
 +BUILD_CC ?= cc
 BUILD_LD ?= $(BUILD_CC) -Wl,-x -shared
 BUILD_COPTS ?= $(COPTS)
 BUILD_CFLAGS ?= $(BUILD_COPTS)
@@ -0,0 +1,25 @@
 diff --git a/Makefile.in b/Makefile.in
 index 5f5b496..5865660 100644
 --- a/Makefile.in
 +++ b/Makefile.in
@@ -233,3 +233,7 @@ dist : force
 force :
 +# This Makefile contains rules which don't work with parallel make.
 +# See <https://savannah.gnu.org/bugs/?66220>.
 +# So, turn off parallel execution in this Makefile.
 +.NOTPARALLEL:
 diff --git a/callback/Makefile.in b/callback/Makefile.in
 index d453d6b..64908e8 100644
 --- a/callback/Makefile.in
 +++ b/callback/Makefile.in
@@ -234,3 +234,8 @@ distdir : $(DISTFILES)
 force :
 +
 +# This Makefile contains rules which don't work with parallel make.
 +# See <https://savannah.gnu.org/bugs/?66220>.
 +# So, turn off parallel execution in this Makefile.
 +.NOTPARALLEL:
@@ -0,0 +1,13 @@
 diff --git a/src/tpm_library.c b/src/tpm_library.c
 index f48f4fd..7b2ea68 100644
 --- a/src/tpm_library.c
 +++ b/src/tpm_library.c
@@ -435,7 +435,7 @@ static unsigned char *TPMLIB_GetPlaintext(const char *stream,
                                           const char *endtag,
                                           size_t *length)
 {
 -    char *start, *end;
 +    const char *start, *end;
     unsigned char *plaintext = NULL;
     start = strstr(stream, starttag);
@@ -0,0 +1,325 @@
 diff --git a/tests/base64decode.sh b/tests/base64decode.sh
 index eef96fe..a0c656c 100755
 --- a/tests/base64decode.sh
 +++ b/tests/base64decode.sh
@@ -1,23 +1,26 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 input=$(mktemp)
 binary=$(mktemp)
 -trap "rm -f $input $binary" EXIT
 +trap 'rm -f "$input" "$binary"' 0
 -function sseq()
 +sseq()
 {
 -	for ((i = $1; i < $2; i=i<<1)); do
 -		echo $i
 +	i=$1
 +	limit=$2
 +	while [ "$i" -lt "$limit" ]; do
 +		echo "$i"
 +		i=$((i << 1))
 	done
 }
 -function do_base64()
 +do_base64()
 {
 -	if [ -n "$(type -p base64)" ]; then
 -		base64 $1
 -	elif [ -n "$(type -p uuencode)" ]; then
 -		uuencode -m $1 data | sed 1d | sed '$d'
 +	if command -v base64 >/dev/null 2>&1; then
 +		base64 "$1"
 +	elif command -v uuencode >/dev/null 2>&1; then
 +		uuencode -m "$1" data | sed 1d | sed '$d'
 	else
 		echo "No tool found for base64 encoding." >&2
 		exit 1
@@ -26,13 +29,10 @@ function do_base64()
 for i in $(sseq 1 1024) 2048 10240;
 do
 -	echo $i
 -	dd if=/dev/urandom of=$binary bs=1 count=$i &>/dev/null
 -	echo "-----BEGIN INITSTATE-----" > $input
 -	do_base64 $binary >> $input
 -	echo "-----END INITSTATE-----" >> $input
 -	./base64decode $input $binary
 -	if [ $? -ne 0 ]; then
 -		exit 1
 -	fi
 +	echo "$i"
 +	dd if=/dev/urandom of="$binary" bs=1 count="$i" >/dev/null 2>&1
 +	echo "-----BEGIN INITSTATE-----" > "$input"
 +	do_base64 "$binary" >> "$input"
 +	echo "-----END INITSTATE-----" >> "$input"
 +	./base64decode "$input" "$binary" || exit 1
 done
 diff --git a/tests/common b/tests/common
 index 11e2548..c03f822 100644
 --- a/tests/common
 +++ b/tests/common
@@ -3,12 +3,15 @@
 # Get the size of a file in bytes
 #
 # @1: filename
 -function get_filesize()
 +get_filesize()
 {
 -	if [[ "$(uname -s)" =~ (Linux|CYGWIN_NT-|GNU) ]]; then
 -		stat -c%s "$1"
 -	else
 -		# OpenBSD
 -		stat -f%z "$1"
 -	fi
 +	case "$(uname -s)" in
 +		Linux|CYGWIN_NT-*|GNU)
 +			stat -c%s "$1"
 +			;;
 +		*)
 +			# OpenBSD
 +			stat -f%z "$1"
 +			;;
 +	esac
 }
 diff --git a/tests/fuzz.sh b/tests/fuzz.sh
 index 5e21c37..ebe1b80 100755
 --- a/tests/fuzz.sh
 +++ b/tests/fuzz.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 TESTDIR=${abs_top_testdir:-$(dirname "$0")}
 DIR=${PWD}
@@ -12,8 +12,8 @@ while :; do
   echo "Passing test cases $l to $((l + MAXLINES))"
   tmp=$(echo "${corpus}" | sed -n "${l},$((l + MAXLINES))p")
   [ -z "${tmp}" ] && exit 0
 -  ${DIR}/fuzz ${tmp}
 +  "${DIR}/fuzz" ${tmp}
   rc=$?
 -  [ $rc -ne 0 ] && exit $rc
 +  [ "$rc" -ne 0 ] && exit "$rc"
   l=$((l + MAXLINES))
 done
 diff --git a/tests/oss-fuzz.sh b/tests/oss-fuzz.sh
 index ba65c8c..b00eed0 100755
 --- a/tests/oss-fuzz.sh
 +++ b/tests/oss-fuzz.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 set -ex
@@ -8,20 +8,21 @@ export WORK=${WORK:-$(pwd)}
 export OUT=${OUT:-$(pwd)/out}
 CFLAGS="${CFLAGS} -fno-sanitize=bounds"  # due to casts to Crypt_Int*
 -mkdir -p $OUT
 +mkdir -p "$OUT"
 build=$WORK/build
 -rm -rf $build
 -mkdir -p $build
 +rm -rf "$build"
 +mkdir -p "$build"
 export LIBTPMS=$(pwd)
 autoreconf -vfi
 -cd $build
 -$LIBTPMS/configure --disable-shared --enable-static --with-openssl --with-tpm2
 -make -j$(nproc) && make -C tests fuzz
 +cd "$build"
 +"$LIBTPMS"/configure --disable-shared --enable-static --with-openssl --with-tpm2
 +jobs=$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)
 +make -j"$jobs" && make -C tests fuzz
 zip -jqr $OUT/fuzz_seed_corpus.zip "$LIBTPMS/tests/corpus-execute-command"
 -find $build -type f -executable -name "fuzz*" -exec mv {} $OUT \;
 -find $build -type f -name "*.options" -exec mv {} $OUT \;
 +find "$build" -type f -executable -name "fuzz*" -exec mv {} "$OUT" \;
 +find "$build" -type f -name "*.options" -exec mv {} "$OUT" \;
 diff --git a/tests/run-fuzzer.sh b/tests/run-fuzzer.sh
 index 0a86c63..2d47f46 100755
 --- a/tests/run-fuzzer.sh
 +++ b/tests/run-fuzzer.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # For the license, see the LICENSE file in the root directory.
@@ -6,18 +6,19 @@ DIR=${PWD}/$(dirname "$0")
 ROOT=${DIR}/..
 WORKDIR=$(mktemp -d)
 -function cleanup()
 +cleanup()
 {
 -	rm -rf ${WORKDIR}
 +	rm -rf "${WORKDIR}"
 }
 -trap "cleanup" QUIT EXIT
 +trap 'cleanup' 0 3
 -pushd $WORKDIR
 +oldpwd=$(pwd)
 +cd "$WORKDIR" || exit 1
 -${DIR}/fuzz $@ ${DIR}/corpus-execute-command
 +"${DIR}/fuzz" "$@" "${DIR}/corpus-execute-command"
 rc=$?
 -popd
 +cd "$oldpwd" || exit 1
 exit $rc
 diff --git a/tests/tpm2_createprimary.sh b/tests/tpm2_createprimary.sh
 index 9b24848..7796d59 100755
 --- a/tests/tpm2_createprimary.sh
 +++ b/tests/tpm2_createprimary.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # For the license, see the LICENSE file in the root directory.
 diff --git a/tests/tpm2_cve-2023-1017.sh b/tests/tpm2_cve-2023-1017.sh
 index 662b090..86dd001 100755
 --- a/tests/tpm2_cve-2023-1017.sh
 +++ b/tests/tpm2_cve-2023-1017.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # For the license, see the LICENSE file in the root directory.
 diff --git a/tests/tpm2_cve-2023-1018.sh b/tests/tpm2_cve-2023-1018.sh
 index debe2e7..69abcfb 100755
 --- a/tests/tpm2_cve-2023-1018.sh
 +++ b/tests/tpm2_cve-2023-1018.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # For the license, see the LICENSE file in the root directory.
 diff --git a/tests/tpm2_pcr_read.sh b/tests/tpm2_pcr_read.sh
 index fcd8858..24c9281 100755
 --- a/tests/tpm2_pcr_read.sh
 +++ b/tests/tpm2_pcr_read.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # For the license, see the LICENSE file in the root directory.
 diff --git a/tests/tpm2_run_test.sh b/tests/tpm2_run_test.sh
 index 2f5437a..f0b3732 100755
 --- a/tests/tpm2_run_test.sh
 +++ b/tests/tpm2_run_test.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # For the license, see the LICENSE file in the root directory.
@@ -10,20 +10,22 @@ WORKDIR=$(mktemp -d)
 . "${TESTDIR}/common"
 -function cleanup()
 +cleanup()
 {
 	rm -rf "${WORKDIR}"
 }
 -trap "cleanup" QUIT EXIT
 +trap 'cleanup' 0 3
 -pushd "$WORKDIR" &>/dev/null || exit 1
 +oldpwd=$(pwd)
 +cd "$WORKDIR" || exit 1
 "${DIR}/${1}"
 rc=$?
 if ! fs=$(get_filesize NVChip); then
 -	exit 1
 +		cd "$oldpwd" || exit 1
 +		exit 1
 fi
 exp=176832
 if [ "$fs" -ne "$exp" ]; then
@@ -33,6 +35,6 @@ if [ "$fs" -ne "$exp" ]; then
 	rc=1
 fi
 -popd &>/dev/null || exit 1
 +cd "$oldpwd" || exit 1
 exit $rc
 diff --git a/tests/tpm2_selftest.sh b/tests/tpm2_selftest.sh
 index d06e2ee..22504e5 100755
 --- a/tests/tpm2_selftest.sh
 +++ b/tests/tpm2_selftest.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # For the license, see the LICENSE file in the root directory.
 diff --git a/tests/tpm2_setprofile.sh b/tests/tpm2_setprofile.sh
 index 88c6f52..8e77618 100755
 --- a/tests/tpm2_setprofile.sh
 +++ b/tests/tpm2_setprofile.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # For the license, see the LICENSE file in the root directory.
@@ -10,20 +10,22 @@ WORKDIR=$(mktemp -d)
 . "${TESTDIR}/common"
 -function cleanup()
 +cleanup()
 {
 	rm -rf "${WORKDIR}"
 }
 -trap "cleanup" QUIT EXIT
 +trap 'cleanup' 0 3
 -pushd "$WORKDIR" &>/dev/null || exit 1
 +oldpwd=$(pwd)
 +cd "$WORKDIR" || exit 1
 "${DIR}/tpm2_setprofile"
 rc=$?
 if ! fs=$(get_filesize NVChip); then
 -	exit 1
 +		cd "$oldpwd" || exit 1
 +		exit 1
 fi
 exp=176832
 if [ "$fs" -ne "$exp" ]; then
@@ -33,6 +35,6 @@ if [ "$fs" -ne "$exp" ]; then
 	rc=1
 fi
 -popd &>/dev/null || exit 1
 +cd "$oldpwd" || exit 1
 exit "$rc"
@@ -0,0 +1,37 @@
 diff --git a/CM_linux_packages.cmake b/CM_linux_packages.cmake
 index a073edfa..f047f048 100644
 --- a/CM_linux_packages.cmake
 +++ b/CM_linux_packages.cmake
@@ -1,9 +1,8 @@
 # determine the version number from the #define in libyuv/version.h
 -EXECUTE_PROCESS (
 -	COMMAND grep --perl-regex --only-matching "(?<=LIBYUV_VERSION )[0-9]+" include/libyuv/version.h
 -	WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}
 -	OUTPUT_VARIABLE YUV_VERSION_NUMBER
 -	OUTPUT_STRIP_TRAILING_WHITESPACE )
 +FILE(STRINGS "${PROJECT_SOURCE_DIR}/include/libyuv/version.h" YUV_VERSION_LINE
 +	REGEX "^#define LIBYUV_VERSION [0-9]+$")
 +STRING(REGEX REPLACE "^#define LIBYUV_VERSION ([0-9]+)$" "\\1"
 +	YUV_VERSION_NUMBER "${YUV_VERSION_LINE}")
 SET ( YUV_VER_MAJOR 0 )
 SET ( YUV_VER_MINOR 0 )
 SET ( YUV_VER_PATCH ${YUV_VERSION_NUMBER} )
@@ -66,4 +65,3 @@ SET ( CPACK_GENERATOR						"DEB;RPM" )
 # create the .deb and .rpm files (you'll need build-essential and rpm tools)
 INCLUDE( CPack )
 -
 diff --git a/source/test.sh b/source/test.sh
 index 7f12c3c1..95fcce3f 100755
 --- a/source/test.sh
 +++ b/source/test.sh
@@ -1,7 +1,7 @@
 -#!/bin/bash
 +#!/bin/sh
 set -x
 -function runbenchmark1 {
 +runbenchmark1() {
   perf record /google/src/cloud/fbarchard/clean/google3/blaze-bin/third_party/libyuv/libyuv_test --gunit_filter=*$1 --libyuv_width=1280 --libyuv_height=720 --libyuv_repeat=1000 --libyuv_flags=-1 --libyuv_cpu_info=-1
   perf report | grep AVX
 }
@@ -0,0 +1,18 @@
 diff --git a/copy-firmware.sh b/copy-firmware.sh
 index 6a32127..7c1821e 100755
 --- a/copy-firmware.sh
 +++ b/copy-firmware.sh
@@ -164,9 +164,10 @@ if [ "$num_jobs" -gt 1 ]; then
     parallel -j"$num_jobs" -a "$parallel_args_file"
 fi
 -# Verify no broken symlinks
 -if test "$(find "$destdir" -xtype l | wc -l)" -ne 0 ; then
 -    err "Broken symlinks found:\n$(find "$destdir" -xtype l)"
 +# Verify no broken symlinks without relying on non-portable find -xtype.
 +broken_links=$(find "$destdir" -type l ! -exec test -e {} \; -print)
 +if test -n "$broken_links"; then
 +    err "Broken symlinks found:\n$broken_links"
 fi
 exit 0
@@ -0,0 +1,41 @@
 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
@@ -864,6 +864,27 @@
 	}
 }
 +#ifdef CONFIG_X86_64
 +static bool __init x86_has_x86_64_v3(void)
 +{
 +	return boot_cpu_has(X86_FEATURE_CX16) &&
 +	       boot_cpu_has(X86_FEATURE_LAHF_LM) &&
 +	       boot_cpu_has(X86_FEATURE_POPCNT) &&
 +	       boot_cpu_has(X86_FEATURE_XMM3) &&
 +	       boot_cpu_has(X86_FEATURE_SSSE3) &&
 +	       boot_cpu_has(X86_FEATURE_XMM4_1) &&
 +	       boot_cpu_has(X86_FEATURE_XMM4_2) &&
 +	       boot_cpu_has(X86_FEATURE_AVX) &&
 +	       boot_cpu_has(X86_FEATURE_AVX2) &&
 +	       boot_cpu_has(X86_FEATURE_BMI1) &&
 +	       boot_cpu_has(X86_FEATURE_BMI2) &&
 +	       boot_cpu_has(X86_FEATURE_F16C) &&
 +	       boot_cpu_has(X86_FEATURE_FMA) &&
 +	       boot_cpu_has(X86_FEATURE_MOVBE) &&
 +	       boot_cpu_has(X86_FEATURE_ABM);
 +}
 +#endif
 +
 /*
  * Determine if we were loaded by an EFI loader.  If so, then we have also been
  * passed the efi memmap, systab, etc., so we should use these data structures
@@ -931,6 +952,10 @@
 	idt_setup_early_traps();
 	early_cpu_init();
 +#ifdef CONFIG_X86_64
 +	if (!x86_has_x86_64_v3())
 +		panic("This kernel requires an x86_64-v3 CPU\n");
 +#endif
 	jump_label_init();
 	static_call_init();
 	early_ioremap_init();
@@ -0,0 +1,63 @@
 --- a/compiler-rt/lib/builtins/CMakeLists.txt
 +++ b/compiler-rt/lib/builtins/CMakeLists.txt
@@ -362,6 +362,7 @@
   set(i386_SOURCES
     ${GENERIC_SOURCES}
 +    ${GENERIC_TF_SOURCES}
     ${x86_ARCH_SOURCES}
     i386/ashldi3.S
     i386/ashrdi3.S
@@ -1012,9 +1013,9 @@
         list(APPEND BUILTIN_CFLAGS_${arch} -fomit-frame-pointer -DCOMPILER_RT_ARMHF_TARGET)
       endif()
 -      # For RISCV32 and 32-bit SPARC, we must force enable int128 for compiling long
 -      # double routines.
 -      if (COMPILER_RT_ENABLE_SOFTWARE_INT128 OR ("${arch}" MATCHES "riscv32|sparc$"
 +      # For i386, RISCV32 and 32-bit SPARC, we must force enable int128 for
 +      # compiling long double routines.
 +      if (COMPILER_RT_ENABLE_SOFTWARE_INT128 OR ("${arch}" MATCHES "i386|riscv32|sparc$"
         AND NOT CMAKE_COMPILER_IS_GNUCC))
         list(APPEND BUILTIN_CFLAGS_${arch} -fforce-enable-int128)
       endif()
 --- a/compiler-rt/lib/builtins/extendxftf2.c
 +++ b/compiler-rt/lib/builtins/extendxftf2.c
@@ -12,7 +12,8 @@
 #define QUAD_PRECISION
 #include "fp_lib.h"
 -#if defined(CRT_HAS_TF_MODE) && __LDBL_MANT_DIG__ == 64 && defined(__x86_64__)
 +#if defined(CRT_HAS_TF_MODE) && __LDBL_MANT_DIG__ == 64 &&                    \
 +    (defined(__x86_64__) || defined(__i386__))
 #define SRC_80
 #define DST_QUAD
 #include "fp_extend_impl.inc"
 --- a/compiler-rt/lib/builtins/trunctfxf2.c
 +++ b/compiler-rt/lib/builtins/trunctfxf2.c
@@ -12,7 +12,8 @@
 #define QUAD_PRECISION
 #include "fp_lib.h"
 -#if defined(CRT_HAS_TF_MODE) && __LDBL_MANT_DIG__ == 64 && defined(__x86_64__)
 +#if defined(CRT_HAS_TF_MODE) && __LDBL_MANT_DIG__ == 64 &&                    \
 +    (defined(__x86_64__) || defined(__i386__))
 #define SRC_QUAD
 #define DST_80
 --- a/compiler-rt/lib/builtins/truncxfbf2.c
 +++ b/compiler-rt/lib/builtins/truncxfbf2.c
@@ -6,7 +6,8 @@
 //
 //===----------------------------------------------------------------------===//
 -#if defined(CRT_HAS_TF_MODE) && __LDBL_MANT_DIG__ == 64 && defined(__x86_64__)
 +#if defined(CRT_HAS_TF_MODE) && __LDBL_MANT_DIG__ == 64 &&                    \
 +    (defined(__x86_64__) || defined(__i386__))
 #define SRC_80
 #define DST_BFLOAT
 #include "fp_trunc_impl.inc"
@@ -0,0 +1,186 @@
 diff -urN a/Makefile b/Makefile
 --- a/Makefile	2025-06-26 08:04:37.000000000 -0500
 +++ b/Makefile	2026-03-23 21:17:07.502287273 -0500
@@ -18,9 +18,9 @@
 INSTALL_LMOD= $(INSTALL_TOP)/share/lua/$V
 INSTALL_CMOD= $(INSTALL_TOP)/lib/lua/$V
 -# How to install. If your install program does not support "-p", then
 +# How to install. If your install program does not preserve timestamps, then
 # you may have to run ranlib on the installed liblua.a.
 -INSTALL= install -p
 +INSTALL?= install
 INSTALL_EXEC= $(INSTALL) -m 0755
 INSTALL_DATA= $(INSTALL) -m 0644
 #
@@ -30,8 +30,8 @@
 # INSTALL_DATA= $(INSTALL)
 # Other utilities.
 -MKDIR= mkdir -p
 -RM= rm -f
 +MKDIR?= mkdir -p
 +RM?= rm -f
 # == END OF USER SETTINGS -- NO NEED TO CHANGE ANYTHING BELOW THIS LINE =======
@@ -52,7 +52,7 @@
 all:	$(PLAT)
 $(PLATS) help test clean:
 -	@cd src && $(MAKE) $@
 +	@cd src && $(MAKE) $@ V=$(V) R=$(R)
 install: dummy
 	cd src && $(MKDIR) $(INSTALL_BIN) $(INSTALL_INC) $(INSTALL_LIB) $(INSTALL_MAN) $(INSTALL_LMOD) $(INSTALL_CMOD)
 diff -urN a/src/Makefile b/src/Makefile
 --- a/src/Makefile	2025-07-06 19:19:14.000000000 -0500
 +++ b/src/Makefile	2026-03-23 21:17:07.502287273 -0500
@@ -6,15 +6,21 @@
 # Your platform. See PLATS for possible values.
 PLAT= guess
 -CC= gcc -std=gnu99
 -CFLAGS= -O2 -Wall -Wextra $(SYSCFLAGS) $(MYCFLAGS)
 -LDFLAGS= $(SYSLDFLAGS) $(MYLDFLAGS)
 -LIBS= -lm $(SYSLIBS) $(MYLIBS)
 -
 -AR= ar rcu
 -RANLIB= ranlib
 -RM= rm -f
 -UNAME= uname
 +CC?= cc
 +CXX?= c++
 +CCSTD?= -std=gnu99
 +CFLAGS?= $(CCSTD) -O2 -Wall -Wextra
 +ALLCFLAGS= $(CFLAGS) $(SYSCFLAGS) $(MYCFLAGS)
 +LDFLAGS?=
 +ALLLDFLAGS= $(LDFLAGS) $(SYSLDFLAGS) $(MYLDFLAGS)
 +LIBS?= -lm
 +ALLLIBS= $(LIBS) $(SYSLIBS) $(MYLIBS)
 +
 +AR?= ar
 +ARFLAGS?= rcu
 +RANLIB?= ranlib
 +RM?= rm -f
 +UNAME?= uname
 SYSCFLAGS=
 SYSLDFLAGS=
@@ -28,11 +34,20 @@
 # Special flags for compiler modules; -Os reduces code size.
 CMCFLAGS= 
 +# Use C mode when a C++ driver is selected for compiling Lua's C sources.
 +CCMODE=
 +CCLINK= $(CC)
 +ifneq ($(filter %++ c++,$(notdir $(firstword $(CC)))),)
 +CCMODE= -x c
 +endif
 +CCCOMPILE= $(CC) $(CCMODE)
 +
 # == END OF USER SETTINGS -- NO NEED TO CHANGE ANYTHING BELOW THIS LINE =======
 PLATS= guess aix bsd c89 freebsd generic ios linux macosx mingw posix solaris
 LUA_A=	liblua.a
 +LUA_SO= liblua.so
 CORE_O=	lapi.o lcode.o lctype.o ldebug.o ldo.o ldump.o lfunc.o lgc.o llex.o lmem.o lobject.o lopcodes.o lparser.o lstate.o lstring.o ltable.o ltm.o lundump.o lvm.o lzio.o
 LIB_O=	lauxlib.o lbaselib.o lcorolib.o ldblib.o liolib.o lmathlib.o loadlib.o loslib.o lstrlib.o ltablib.o lutf8lib.o linit.o
 BASE_O= $(CORE_O) $(LIB_O) $(MYOBJS)
@@ -44,7 +59,7 @@
 LUAC_O=	luac.o
 ALL_O= $(BASE_O) $(LUA_O) $(LUAC_O)
 -ALL_T= $(LUA_A) $(LUA_T) $(LUAC_T)
 +ALL_T= $(LUA_A) $(LUA_T) $(LUAC_T) $(LUA_SO)
 ALL_A= $(LUA_A)
 # Targets start here.
@@ -57,14 +72,19 @@
 a:	$(ALL_A)
 $(LUA_A): $(BASE_O)
 -	$(AR) $@ $(BASE_O)
 +	$(AR) $(ARFLAGS) $@ $(BASE_O)
 	$(RANLIB) $@
 +$(LUA_SO): $(CORE_O) $(LIB_O)
 +	$(CCLINK) -shared $(ALLLDFLAGS) -Wl,-soname,$(LUA_SO).$(V) -o $@.$(R) $? $(ALLLIBS)
 +	ln -sf $(LUA_SO).$(R) $(LUA_SO).$(V)
 +	ln -sf $(LUA_SO).$(R) $(LUA_SO)
 +
 $(LUA_T): $(LUA_O) $(LUA_A)
 -	$(CC) -o $@ $(LDFLAGS) $(LUA_O) $(LUA_A) $(LIBS)
 +	$(CCLINK) -o $@ $(ALLLDFLAGS) $(LUA_O) $(LUA_A) $(ALLLIBS)
 $(LUAC_T): $(LUAC_O) $(LUA_A)
 -	$(CC) -o $@ $(LDFLAGS) $(LUAC_O) $(LUA_A) $(LIBS)
 +	$(CCLINK) -o $@ $(ALLLDFLAGS) $(LUAC_O) $(LUA_A) $(ALLLIBS)
 test:
 	./$(LUA_T) -v
@@ -73,15 +93,22 @@
 	$(RM) $(ALL_T) $(ALL_O)
 depend:
 -	@$(CC) $(CFLAGS) -MM l*.c
 +	@$(CCCOMPILE) $(ALLCFLAGS) -MM l*.c
 echo:
 	@echo "PLAT= $(PLAT)"
 	@echo "CC= $(CC)"
 +	@echo "CXX= $(CXX)"
 +	@echo "CCSTD= $(CCSTD)"
 +	@echo "CCMODE= $(CCMODE)"
 	@echo "CFLAGS= $(CFLAGS)"
 +	@echo "ALLCFLAGS= $(ALLCFLAGS)"
 	@echo "LDFLAGS= $(LDFLAGS)"
 +	@echo "ALLLDFLAGS= $(ALLLDFLAGS)"
 	@echo "LIBS= $(LIBS)"
 +	@echo "ALLLIBS= $(ALLLIBS)"
 	@echo "AR= $(AR)"
 +	@echo "ARFLAGS= $(ARFLAGS)"
 	@echo "RANLIB= $(RANLIB)"
 	@echo "RM= $(RM)"
 	@echo "UNAME= $(UNAME)"
@@ -105,7 +132,7 @@
 	$(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_POSIX -DLUA_USE_DLOPEN" SYSLIBS="-Wl,-E"
 c89:
 -	$(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_C89" CC="gcc -std=c89"
 +	$(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_C89" CCSTD="-std=c89"
 	@echo ''
 	@echo '*** C89 does not guarantee 64-bit integers for Lua.'
 	@echo '*** Make sure to compile all external Lua libraries'
@@ -113,7 +140,7 @@
 	@echo ''
 FreeBSD NetBSD OpenBSD freebsd:
 -	$(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX -DLUA_USE_READLINE -I/usr/include/edit" SYSLIBS="-Wl,-E -ledit" CC="cc"
 +	$(MAKE) $(ALL) SYSCFLAGS="-DLUA_USE_LINUX -DLUA_USE_READLINE -I/usr/include/edit" SYSLIBS="-Wl,-E -ledit"
 generic: $(ALL)
@@ -141,15 +168,18 @@
 # Targets that do not create files (not all makes understand .PHONY).
 .PHONY: all $(PLATS) help test clean default o a depend echo
 +%.o: %.c
 +	$(CCCOMPILE) $(ALLCFLAGS) -c -o $@ $<
 +
 # Compiler modules may use special flags.
 llex.o:
 -	$(CC) $(CFLAGS) $(CMCFLAGS) -c llex.c
 +	$(CCCOMPILE) $(ALLCFLAGS) $(CMCFLAGS) -c -o $@ llex.c
 lparser.o:
 -	$(CC) $(CFLAGS) $(CMCFLAGS) -c lparser.c
 +	$(CCCOMPILE) $(ALLCFLAGS) $(CMCFLAGS) -c -o $@ lparser.c
 lcode.o:
 -	$(CC) $(CFLAGS) $(CMCFLAGS) -c lcode.c
 +	$(CCCOMPILE) $(ALLCFLAGS) $(CMCFLAGS) -c -o $@ lcode.c
 # DO NOT DELETE
@@ -0,0 +1,46 @@
 --- a/mallard-ducktype-1.0.2/tests/runtests
 +++ b/mallard-ducktype-1.0.2/tests/runtests
@@ -8,19 +8,20 @@
 silent=0
 glob=""
 -for arg in $@; do
 -    if [ "x$arg" = "x-s" ]; then
 +for arg do
 +    if [ "$arg" = "-s" ]; then
         silent=1
 -    elif [ "x$arg" != "x" ]; then
 +    elif [ -n "$arg" ]; then
         glob="$arg"
     fi
 done
 for duck in *$glob*.duck; do
 +    [ -f "$duck" ] || continue
     count=$(( count + 1 ))
 -    out=$(echo $duck | sed -e 's/\.duck$/.out/')
 -    page=$(echo $duck | sed -e 's/\.duck$/.page/')
 -    error=$(echo $duck | sed -e 's/\.duck$/.error/')
 +    out=${duck%.duck}.out
 +    page=${duck%.duck}.page
 +    error=${duck%.duck}.error
     fail=""
     if [ -f "$page" ]; then
         python3 runtest.py "$duck" > "$out" || fail="exit status $?"
@@ -29,7 +30,6 @@
             diff -u "$out" "$page" >&2 || :
         fi
     elif [ -f "$error" ]; then
 -        status=0
         python3 runtest.py "$duck" > "$out" || :
         if ! cmp "$out" "$error" >&2; then
             fail="unexpected error message"
@@ -39,7 +39,7 @@
         fail="neither $page nor $error exists"
     fi
     if [ -z "$fail" ]; then
 -        if [ $silent = 0 ]; then
 +        if [ "$silent" = 0 ]; then
             echo "ok $count - $duck"
         fi
     else
@@ -0,0 +1,440 @@
 diff --git a/autogen.sh b/autogen.sh
 index 3f0fcd4..5e586d7 100755
 --- a/autogen.sh
 +++ b/autogen.sh
@@ -1,21 +1,21 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # Run this to generate all the initial makefiles, etc.
 # Ripped off from GNOME macros version
 DIE=0
 -srcdir=`dirname $0`
 +srcdir=`dirname "$0"`
 test -z "$srcdir" && srcdir=.
 if [ -n "$MONO_PATH" ]; then
 	# from -> /mono/lib:/another/mono/lib
 	# to -> /mono /another/mono
 -	for i in `echo ${MONO_PATH} | tr ":" " "`; do
 -		i=`dirname ${i}`
 -		if [ -n "{i}" -a -d "${i}/share/aclocal" ]; then
 +	for i in `echo "${MONO_PATH}" | tr ":" " "`; do
 +		i=`dirname "${i}"`
 +		if [ -n "${i}" ] && [ -d "${i}/share/aclocal" ]; then
 			ACLOCAL_FLAGS="-I ${i}/share/aclocal $ACLOCAL_FLAGS"
 		fi
 -		if [ -n "{i}" -a -d "${i}/bin" ]; then
 +		if [ -n "${i}" ] && [ -d "${i}/bin" ]; then
 			PATH="${i}/bin:$PATH"
 		fi
 	done
@@ -31,9 +31,9 @@ fi
 }
 if [ -z "$LIBTOOLIZE" ]; then
 -  LIBTOOLIZE=`which glibtoolize 2>/dev/null`
 +  LIBTOOLIZE=`command -v glibtoolize 2>/dev/null`
   if [ ! -x "$LIBTOOLIZE" ]; then
 -    LIBTOOLIZE=`which libtoolize`
 +    LIBTOOLIZE=`command -v libtoolize 2>/dev/null`
   fi
 fi
@@ -109,24 +109,28 @@ has_ext_mod=false
 ext_mod_args=''
 has_disable_boehm=false
 for PARAM; do
 -    if [[ $PARAM =~ "--enable-extension-module" ]] ; then
 -        has_ext_mod=true
 -        if [[ $PARAM =~ "=" ]] ; then
 -            ext_mod_args=`echo $PARAM | cut -d= -f2`
 -        fi
 -    fi
 -    if [[ $PARAM =~ "--disable-boehm" ]] ; then
 -      has_disable_boehm=true
 -    fi
 +    case "$PARAM" in
 +        --enable-extension-module)
 +            has_ext_mod=true
 +            ;;
 +        --enable-extension-module=*)
 +            has_ext_mod=true
 +            ext_mod_args=${PARAM#*=}
 +            ;;
 +        --disable-boehm)
 +            has_disable_boehm=true
 +            ;;
 +    esac
 done
 #
 # Plug in the extension module
 #
 -if test x$has_ext_mod = xtrue; then
 -	pushd $top_srcdir../mono-extensions/scripts
 -	sh ./prepare-repo.sh $ext_mod_args || exit 1
 -	popd
 +if test "x$has_ext_mod" = xtrue; then
 +	(
 +		cd "$srcdir/../mono-extensions/scripts" &&
 +		sh ./prepare-repo.sh "$ext_mod_args"
 +	) || exit 1
 else
 	cat mono/mini/Makefile.am.in > mono/mini/Makefile.am
 fi
@@ -156,12 +160,12 @@ autoconf || { echo "**Error**: autoconf failed."; exit 1; }
 # Update all submodules recursively to ensure everything is checked out
 if test -e $srcdir/scripts/update_submodules.sh; then
 -  (cd $srcdir && scripts/update_submodules.sh)
 +  (cd "$srcdir" && sh scripts/update_submodules.sh)
 fi
 -if test x$has_disable_boehm = xfalse -a -d $srcdir/external/bdwgc; then
 +if test "x$has_disable_boehm" = xfalse -a -d "$srcdir/external/bdwgc"; then
   echo Running external/bdwgc/autogen.sh ...
 -  (cd $srcdir/external/bdwgc ; NOCONFIGURE=1 ./autogen.sh "$@")
 +  (cd "$srcdir/external/bdwgc" ; NOCONFIGURE=1 ./autogen.sh "$@")
   echo Done running external/bdwgc/autogen.sh ...
 fi
@@ -173,7 +177,15 @@ host_conf_flag=
 build_uname_all=`(uname -a) 2>/dev/null`
 case "$build_uname_all" in
 CYGWIN*)
 -  if [[ "$@" != *"--host="* ]]; then
 +  has_host_flag=false
 +  for arg do
 +    case "$arg" in
 +      --host=*)
 +        has_host_flag=true
 +        ;;
 +    esac
 +  done
 +  if test "$has_host_flag" != true; then
 	  echo "Missing --host parameter, configure using ./configure --host=i686-w64-mingw32 or --host=x86_64-w64-mingw32"
 	  echo "Falling back using --host=x86_64-w64-mingw32 as default."
     host_conf_flag="--host=x86_64-w64-mingw32"
 diff --git a/configure b/configure
 index a465a2f..328ca8f 100755
 --- a/configure
 +++ b/configure
@@ -18865,7 +18865,7 @@ fi
 # end dolt
 -export_ldflags=`(./libtool --config; echo eval echo \\$export_dynamic_flag_spec) | sh`
 +export_ldflags=`eval echo \\$export_dynamic_flag_spec`
 # Test whenever ld supports -version-script
 diff --git a/configure.ac b/configure.ac
 index ed6b6db..2629b10 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -678,7 +678,7 @@ AM_PROG_LIBTOOL
 # Use dolt (http://dolt.freedesktop.org/) instead of libtool for building.
 DOLT
 -export_ldflags=`(./libtool --config; echo eval echo \\$export_dynamic_flag_spec) | sh`
 +export_ldflags=`eval echo \\$export_dynamic_flag_spec`
 AC_SUBST(export_ldflags)
 # Test whenever ld supports -version-script
 diff --git a/llvm/build_llvm_config.sh b/llvm/build_llvm_config.sh
 index 7880d84..de1d368 100755
 --- a/llvm/build_llvm_config.sh
 +++ b/llvm/build_llvm_config.sh
@@ -1,27 +1,38 @@
 -#!/bin/bash
 +#!/bin/sh
 llvm_config=$1
 llvm_codegen_libs="$2"
 -llvm_extra_libs="${@:3}"
 +shift 2
 +llvm_extra_libs="$*"
 use_llvm_config=1
 llvm_host_win32=0
 llvm_host_win32_wsl=0
 llvm_host_win32_cygwin=0
 -function win32_format_path {
 -	local formatted_path=$1
 -	if  [[ $llvm_host_win32_wsl = 1 ]] && [[ $1 != "/mnt/"* ]]; then
 -		# if path is not starting with /mnt under WSL it could be a windows path, convert using wslpath.
 -		formatted_path="$(wslpath -a "$1")"
 -	elif [[ $llvm_host_win32_cygwin = 1 ]] && [[ $1 != "/cygdrive/"* ]]; then
 -		# if path is not starting with /cygdrive under CygWin it could be a windows path, convert using cygpath.
 -		formatted_path="$(cygpath -a "$1")"
 -	fi
 +win32_format_path() {
 +	formatted_path=$1
 +	case "$llvm_host_win32_wsl:$1" in
 +		1:/mnt/*)
 +			;;
 +		1:*)
 +			# If the path is not under /mnt on WSL it could already be a Windows path.
 +			formatted_path="$(wslpath -a "$1")"
 +			;;
 +	esac
 +	case "$llvm_host_win32_cygwin:$formatted_path" in
 +		1:/cygdrive/*)
 +			;;
 +		1:*)
 +			# If the path is not under /cygdrive on Cygwin it could already be a Windows path.
 +			formatted_path="$(cygpath -a "$formatted_path")"
 +			;;
 +	esac
 	echo "$formatted_path"
 }
 -if [[ $llvm_config = *".exe" ]]; then
 +case "$llvm_config" in
 +*.exe)
 	llvm_host_win32=1
 	# llvm-config is a windows binary. Check if we are running CygWin or WSL since then we might still be able to run llvm-config.exe
 	host_uname="$(uname -a)"
@@ -37,66 +48,67 @@ if [[ $llvm_config = *".exe" ]]; then
 		*)
 			use_llvm_config=0
 	esac
 -fi
 +	;;
 +esac
 -if [[ $llvm_host_win32 = 1 ]]; then
 +if [ "$llvm_host_win32" = 1 ]; then
 	llvm_config=$(win32_format_path "$llvm_config")
 fi
 -if [[ $use_llvm_config = 1 ]]; then
 -	llvm_api_version=`$llvm_config --mono-api-version` || "0"
 -	with_llvm=`$llvm_config --prefix`
 -	llvm_config_cflags=`$llvm_config --cflags`
 -	llvm_system=`$llvm_config --system-libs`
 -	llvm_core_components=`$llvm_config --libs analysis core bitwriter`
 -	if [[ $llvm_api_version -lt 600 ]]; then
 -		llvm_old_jit=`$llvm_config --libs mcjit jit 2>>/dev/null`
 +if [ "$use_llvm_config" = 1 ]; then
 +	llvm_api_version=$("$llvm_config" --mono-api-version 2>/dev/null || printf '%s\n' 0)
 +	with_llvm=$("$llvm_config" --prefix)
 +	llvm_config_cflags=$("$llvm_config" --cflags)
 +	llvm_system=$("$llvm_config" --system-libs)
 +	llvm_core_components=$("$llvm_config" --libs analysis core bitwriter)
 +	if [ "$llvm_api_version" -lt 600 ]; then
 +		llvm_old_jit=$("$llvm_config" --libs mcjit jit 2>>/dev/null)
 	else
 -		llvm_old_jit=`$llvm_config --libs mcjit 2>>/dev/null`
 +		llvm_old_jit=$("$llvm_config" --libs mcjit 2>>/dev/null)
 	fi
 -	llvm_new_jit=`$llvm_config --libs orcjit 2>>/dev/null`
 +	llvm_new_jit=$("$llvm_config" --libs orcjit 2>>/dev/null)
 -	if [[ ! -z $llvm_codegen_libs ]]; then
 -		llvm_extra=`$llvm_config --libs $llvm_codegen_libs`
 +	if [ -n "$llvm_codegen_libs" ]; then
 +		llvm_extra=$("$llvm_config" --libs "$llvm_codegen_libs")
 	fi
 	# When building for Windows subsystem using WSL or CygWin the path returned from llvm-config.exe
 	# could be a Windows style path, make sure to format it into a path usable for WSL/CygWin.
 -	if [[ $llvm_host_win32 = 1 ]]; then
 +	if [ "$llvm_host_win32" = 1 ]; then
 		with_llvm=$(win32_format_path "$with_llvm")
 	fi
 fi
 # When cross compiling for Windows on system not capable of running Windows binaries, llvm-config.exe can't be used to query for
 # LLVM parameters. In that scenario we will need to fallback to default values.
 -if [[ $llvm_host_win32 = 1 ]] && [[ $use_llvm_config = 0 ]]; then
 +if [ "$llvm_host_win32" = 1 ] && [ "$use_llvm_config" = 0 ]; then
 	# Assume we have llvm-config sitting in llvm-install-root/bin directory, get llvm-install-root directory.
 	with_llvm="$(dirname $llvm_config)"
 	with_llvm="$(dirname $with_llvm)"
 	llvm_config_path=$with_llvm/include/llvm/Config/llvm-config.h
 	# llvm-config.exe --mono-api-version
 -	llvm_api_version=`awk '/MONO_API_VERSION/ { print $3 }' $llvm_config_path`
 +	llvm_api_version=$(awk '/MONO_API_VERSION/ { print $3 }' "$llvm_config_path")
 	# llvm-config.exe --cflags, returned information currently not used.
 	llvm_config_cflags=
 	# llvm-config.exe --system-libs
 -	if [[ $llvm_api_version -lt 600 ]]; then
 +	if [ "$llvm_api_version" -lt 600 ]; then
 		llvm_system="-limagehlp -lpsapi -lshell32"
 	else
 		llvm_system="-lpsapi -lshell32 -lole32 -luuid -ladvapi32"
 	fi
 	# llvm-config.exe --libs analysis core bitwriter
 -	if [[ $llvm_api_version -lt 600 ]]; then
 +	if [ "$llvm_api_version" -lt 600 ]; then
 		llvm_core_components="-lLLVMBitWriter -lLLVMAnalysis -lLLVMTarget -lLLVMMC -lLLVMCore -lLLVMSupport"
 	else
 		llvm_core_components="-lLLVMBitWriter -lLLVMAnalysis -lLLVMProfileData -lLLVMObject -lLLVMMCParser -lLLVMMC -lLLVMBitReader -lLLVMCore -lLLVMBinaryFormat -lLLVMSupport -lLLVMDemangle"
 	fi
 	# llvm-config.exe --libs mcjit jit
 -	if [[ $llvm_api_version -lt 600 ]]; then
 +	if [ "$llvm_api_version" -lt 600 ]; then
 		llvm_old_jit="-lLLVMJIT -lLLVMCodeGen -lLLVMScalarOpts -lLLVMInstCombine -lLLVMTransformUtils -lLLVMipa -lLLVMAnalysis -lLLVMMCJIT -lLLVMTarget -lLLVMRuntimeDyld -lLLVMObject -lLLVMMCParser -lLLVMBitReader -lLLVMExecutionEngine -lLLVMMC -lLLVMCore -lLLVMSupport"
 	else
 		# Current build of LLVM 60 for cross Windows builds doesn't support LLVM JIT.
@@ -110,7 +122,7 @@ if [[ $llvm_host_win32 = 1 ]] && [[ $use_llvm_config = 0 ]]; then
 	case "$llvm_codegen_libs" in
 		*x86codegen*)
 			# llvm-config.exe --libs x86codegen
 -			if [[ $llvm_api_version -lt 600 ]]; then
 +			if [ "$llvm_api_version" -lt 600 ]; then
 				llvm_extra="-lLLVMX86CodeGen -lLLVMX86Desc -lLLVMX86Info -lLLVMObject -lLLVMBitReader -lLLVMMCDisassembler -lLLVMX86AsmPrinter -lLLVMX86Utils -lLLVMSelectionDAG -lLLVMAsmPrinter -lLLVMMCParser -lLLVMCodeGen -lLLVMScalarOpts -lLLVMInstCombine -lLLVMTransformUtils -lLLVMipa -lLLVMAnalysis -lLLVMTarget -lLLVMMC -lLLVMCore -lLLVMSupport"
 			else
 				llvm_extra="-lLLVMX86CodeGen -lLLVMGlobalISel -lLLVMX86Desc -lLLVMX86Info -lLLVMMCDisassembler -lLLVMX86AsmPrinter -lLLVMX86Utils -lLLVMSelectionDAG -lLLVMAsmPrinter -lLLVMDebugInfoCodeView -lLLVMDebugInfoMSF -lLLVMCodeGen -lLLVMTarget -lLLVMScalarOpts -lLLVMInstCombine -lLLVMTransformUtils -lLLVMBitWriter -lLLVMAnalysis -lLLVMProfileData -lLLVMObject -lLLVMMCParser -lLLVMMC -lLLVMBitReader -lLLVMCore -lLLVMBinaryFormat -lLLVMSupport -lLLVMDemangle"
@@ -118,7 +130,7 @@ if [[ $llvm_host_win32 = 1 ]] && [[ $use_llvm_config = 0 ]]; then
 			;;
 		*armcodegen*)
 			# llvm-config.exe --libs armcodegen
 -			if [[ $llvm_api_version -lt 600 ]]; then
 +			if [ "$llvm_api_version" -lt 600 ]; then
 				llvm_extra="-lLLVMARMCodeGen -lLLVMSelectionDAG -lLLVMAsmPrinter -lLLVMMCParser -lLLVMCodeGen -lLLVMScalarOpts -lLLVMInstCombine -lLLVMTransformUtils -lLLVMipa -lLLVMAnalysis -lLLVMTarget -lLLVMCore -lLLVMARMDesc -lLLVMMCDisassembler -lLLVMARMInfo -lLLVMARMAsmPrinter -lLLVMMC -lLLVMSupport"
 			else
 				llvm_extra="-lLLVMARMCodeGen -lLLVMGlobalISel -lLLVMSelectionDAG -lLLVMAsmPrinter -lLLVMDebugInfoCodeView -lLLVMDebugInfoMSF -lLLVMCodeGen -lLLVMTarget -lLLVMScalarOpts -lLLVMInstCombine -lLLVMTransformUtils -lLLVMBitWriter -lLLVMAnalysis -lLLVMProfileData -lLLVMObject -lLLVMMCParser -lLLVMBitReader -lLLVMCore -lLLVMBinaryFormat -lLLVMARMDesc -lLLVMMCDisassembler -lLLVMARMInfo -lLLVMARMAsmPrinter -lLLVMARMUtils -lLLVMMC -lLLVMSupport -lLLVMDemangle"
@@ -126,7 +138,7 @@ if [[ $llvm_host_win32 = 1 ]] && [[ $use_llvm_config = 0 ]]; then
 			;;
 		*aarch64codegen*)
 			# llvm-config.exe --libs aarch64codegen
 -			if [[ $llvm_api_version -lt 600 ]]; then
 +			if [ "$llvm_api_version" -lt 600 ]; then
 				llvm_extra="-lLLVMAArch64CodeGen -lLLVMSelectionDAG -lLLVMAsmPrinter -lLLVMMCParser -lLLVMCodeGen -lLLVMScalarOpts -lLLVMInstCombine -lLLVMTransformUtils -lLLVMipa -lLLVMAnalysis -lLLVMTarget -lLLVMCore -lLLVMAArch64Desc -lLLVMAArch64Info -lLLVMAArch64AsmPrinter -lLLVMMC -lLLVMAArch64Utils -lLLVMSupport"
 			else
 				llvm_extra="-lLLVMAArch64CodeGen -lLLVMGlobalISel -lLLVMSelectionDAG -lLLVMAsmPrinter -lLLVMDebugInfoCodeView -lLLVMDebugInfoMSF -lLLVMCodeGen -lLLVMTarget -lLLVMScalarOpts -lLLVMInstCombine -lLLVMTransformUtils -lLLVMBitWriter -lLLVMAnalysis -lLLVMProfileData -lLLVMObject -lLLVMMCParser -lLLVMBitReader -lLLVMCore -lLLVMBinaryFormat -lLLVMAArch64Desc -lLLVMAArch64Info -lLLVMAArch64AsmPrinter -lLLVMMC -lLLVMAArch64Utils -lLLVMSupport -lLLVMDemangle"
@@ -137,15 +149,19 @@ if [[ $llvm_host_win32 = 1 ]] && [[ $use_llvm_config = 0 ]]; then
 	esac
 fi
 -if [[ $llvm_config_cflags = *"stdlib=libc++"* ]]; then
 +llvm_libc_link=""
 +case "$llvm_config_cflags" in
 +	*stdlib=libc++*)
 	llvm_libc_c="-stdlib=libc++"
 	# llvm_libc_link="-lc++"
 -else
 +	;;
 +*)
 	llvm_libc_c=""
 	# llvm_libc_link="-lstdc++"
 -fi
 +	;;
 +esac
 -if [[ $llvm_host_win32 = 1 ]]; then
 +if [ "$llvm_host_win32" = 1 ]; then
 	host_cxxflag_additions="-std=gnu++11"
 	host_cflag_additions="-DNDEBUG"
 else
@@ -153,7 +169,7 @@ else
 	host_cflag_additions=""
 fi
 -if [[ ! -z $llvm_extra_libs ]]; then
 +if [ -n "$llvm_extra_libs" ]; then
 	llvm_extra="$llvm_extra $llvm_extra_libs"
 fi
 diff --git a/mcs/build/start-compiler-server.sh b/mcs/build/start-compiler-server.sh
 index 8c74d4c..16bc874 100755
 --- a/mcs/build/start-compiler-server.sh
 +++ b/mcs/build/start-compiler-server.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # usage: start-compiler-server.sh <working directory> <log path> <pipename>
 # ensure that VBCS_RUNTIME and VBCS_LOCATION environment variables are set.
@@ -6,20 +6,19 @@ set -u
 set -e
 if [ -s "$VBCS_LOCATION" ]; then
 -    CMD="RoslynCommandLineLogFile=$2 $VBCS_RUNTIME --gc-params=nursery-size=64m \"$VBCS_LOCATION\" -pipename:$3 &"
     echo "Log location set to $2"
     touch "$2"
 -    echo "cd $1; bash -c \"$CMD\""
 +    echo "cd $1; RoslynCommandLineLogFile=$2 $VBCS_RUNTIME --gc-params=nursery-size=64m \"$VBCS_LOCATION\" -pipename:$3 &"
     cd "$1"
 -    bash -c "$CMD"
 +    RoslynCommandLineLogFile=$2 "$VBCS_RUNTIME" --gc-params=nursery-size=64m "$VBCS_LOCATION" -pipename:"$3" &
     RESULT=$?
 -    if [ $RESULT -eq 0 ]; then
 +    if [ "$RESULT" -eq 0 ]; then
         echo Compiler server started.
     else
         echo Failed to start compiler server.
 -    fi;
 +    fi
 else
     echo No compiler server found at path "$VBCS_LOCATION". Ensure that VBCS_LOCATION is set in config.make or passed as a parameter to make.
     echo Use ENABLE_COMPILER_SERVER=0 to disable the use of the compiler server and continue to build.
     exit 1
 -fi;
 +fi
 diff --git a/mono/tests/Makefile.am b/mono/tests/Makefile.am
 index 85a5664..95286b8 100755
 --- a/mono/tests/Makefile.am
 +++ b/mono/tests/Makefile.am
@@ -3030,7 +3030,7 @@ modules.exe: modules.cs modules-m1.netmodule $(TEST_DRIVER_DEPEND)
 patch-libtool:
 	cp "../../libtool" .
 	sed -e 's,build_libtool_libs=no,build_libtool_libs=yes,g' libtool > 2; mv 2 libtool
 -	sed -e 's,LIBTOOL =,LIBTOOL2 =,g' Makefile > 2 && echo "LIBTOOL = bash ./libtool" > 1 && cat 1 2 > Makefile
 +	sed -e 's,LIBTOOL =,LIBTOOL2 =,g' Makefile > 2 && echo "LIBTOOL = $(SHELL) ./libtool" > 1 && cat 1 2 > Makefile
 	touch libtest.c
 diff --git a/mono/tests/Makefile.in b/mono/tests/Makefile.in
 index 3d5eebd..f245b27 100644
 --- a/mono/tests/Makefile.in
 +++ b/mono/tests/Makefile.in
@@ -3444,7 +3444,7 @@ modules.exe: modules.cs modules-m1.netmodule $(TEST_DRIVER_DEPEND)
 patch-libtool:
 	cp "../../libtool" .
 	sed -e 's,build_libtool_libs=no,build_libtool_libs=yes,g' libtool > 2; mv 2 libtool
 -	sed -e 's,LIBTOOL =,LIBTOOL2 =,g' Makefile > 2 && echo "LIBTOOL = bash ./libtool" > 1 && cat 1 2 > Makefile
 +	sed -e 's,LIBTOOL =,LIBTOOL2 =,g' Makefile > 2 && echo "LIBTOOL = $(SHELL) ./libtool" > 1 && cat 1 2 > Makefile
 	touch libtest.c
 test-process-exit:
 	@$(MCS) $(srcdir)/threadpool-in-processexit.cs -out:threadpool-in-processexit.exe
 diff --git a/support/Makefile.am b/support/Makefile.am
 index d660025..2c0e425 100644
 --- a/support/Makefile.am
 +++ b/support/Makefile.am
@@ -163,8 +163,8 @@ refresh:
 patch-libtool:
 	cp "../libtool" .
 	sed -e 's,build_libtool_libs=no,build_libtool_libs=yes,g' libtool > 2; mv 2 libtool
 -	echo "LIBTOOL = bash ./libtool" > 1
 -	echo "LTCOMPILE = bash ./libtool --mode=compile $(COMPILE)" >> 1
 +	echo "LIBTOOL = $(SHELL) ./libtool" > 1
 +	echo "LTCOMPILE = $(SHELL) ./libtool --mode=compile $(COMPILE)" >> 1
 	sed -e 's,LIBTOOL =,LIBTOOL2 =,g' Makefile > 2
 	sed -e 's,LTCOMPILE =,LTCOMPILE2 =,g' 2 > 3
 	cat 1 3 > Makefile
 diff --git a/support/Makefile.in b/support/Makefile.in
 index a5c760c..23916c8 100644
 --- a/support/Makefile.in
 +++ b/support/Makefile.in
@@ -1080,8 +1080,8 @@ uninstall-am: uninstall-libLTLIBRARIES
 @ENABLE_MSVC_ONLY_FALSE@patch-libtool:
 @ENABLE_MSVC_ONLY_FALSE@	cp "../libtool" .
 @ENABLE_MSVC_ONLY_FALSE@	sed -e 's,build_libtool_libs=no,build_libtool_libs=yes,g' libtool > 2; mv 2 libtool
 -@ENABLE_MSVC_ONLY_FALSE@	echo "LIBTOOL = bash ./libtool" > 1
 -@ENABLE_MSVC_ONLY_FALSE@	echo "LTCOMPILE = bash ./libtool --mode=compile $(COMPILE)" >> 1
 +@ENABLE_MSVC_ONLY_FALSE@	echo "LIBTOOL = $(SHELL) ./libtool" > 1
 +@ENABLE_MSVC_ONLY_FALSE@	echo "LTCOMPILE = $(SHELL) ./libtool --mode=compile $(COMPILE)" >> 1
 @ENABLE_MSVC_ONLY_FALSE@	sed -e 's,LIBTOOL =,LIBTOOL2 =,g' Makefile > 2
 @ENABLE_MSVC_ONLY_FALSE@	sed -e 's,LTCOMPILE =,LTCOMPILE2 =,g' 2 > 3
 @ENABLE_MSVC_ONLY_FALSE@	cat 1 3 > Makefile
@@ -0,0 +1,558 @@
 --- a/Makefile
 +++ b/Makefile
@@ -16,6 +16,12 @@
 include Makethird
 +LINKER = $(CC)
 +ifeq ($(THIRD_NEEDS_CXX_LINKER),yes)
 +  LINKER = $(CXX)
 +endif
 +THIRD_LINK_LIBS := $(filter-out $(CXX_LINKER_FLAG),$(THIRD_LIBS))
 +
 # --- Configuration ---
 # Do not specify CFLAGS, LDFLAGS, LIB_LDFLAGS, EXE_LDFLAGS or LIBS on the make
@@ -81,20 +87,20 @@
 ifdef RANLIB
   RANLIB_CMD = $(QUIET_RANLIB) $(RANLIB) $@
 endif
 -LINK_CMD = $(QUIET_LINK) $(MKTGTDIR) ; $(CC) $(EXE_LDFLAGS) $(LDFLAGS) -o $@ $^ $(LIBS)
 +LINK_CMD = $(QUIET_LINK) $(MKTGTDIR) ; $(LINKER) $(EXE_LDFLAGS) $(LDFLAGS) -o $@ $^ $(LIBS)
 TAGS_CMD = $(QUIET_TAGS) ctags
 OBJCOPY_CMD = $(QUIET_OBJCOPY) $(MKTGTDIR) ; $(LD) -r -b binary -z noexecstack -o $@ $<
 SYMLINK_CMD = $(QUIET_SYMLINK) $(MKTGTDIR) ; ln -sf
 ifeq ($(shared),yes)
   ifeq ($(USE_ARGUMENT_FILE),yes)
 -    LINK_SO_CMD = $(QUIET_LINK_SO) $(MKTGTDIR) ; $(CC) $(LIB_LDFLAGS) $(LDFLAGS) -o $@ $(file > $@.in,$^) @$@.in
 +    LINK_SO_CMD = $(QUIET_LINK_SO) $(MKTGTDIR) ; $(LINKER) $(LIB_LDFLAGS) $(LDFLAGS) -o $@ $(file > $@.in,$^) @$@.in
   else
 -    LINK_SO_CMD = $(QUIET_LINK_SO) $(MKTGTDIR) ; $(CC) $(LIB_LDFLAGS) $(LDFLAGS) -o $@ $^
 +    LINK_SO_CMD = $(QUIET_LINK_SO) $(MKTGTDIR) ; $(LINKER) $(LIB_LDFLAGS) $(LDFLAGS) -o $@ $^
   endif
   ifeq ($(OS),OpenBSD)
     # OpenBSD linker magic doesn't use soname; so fake it by using -L$(OUT) and -lmupdf.
 -    LINK_CMD = $(QUIET_LINK) $(MKTGTDIR) ; $(CC) $(EXE_LDFLAGS) $(LDFLAGS) -o $@ -L$(OUT) \
 +    LINK_CMD = $(QUIET_LINK) $(MKTGTDIR) ; $(LINKER) $(EXE_LDFLAGS) $(LDFLAGS) -o $@ -L$(OUT) \
 	$(subst $(OUT)/libmupdf.$(SO)$(SO_VERSION),-lmupdf,$^) \
 	$(LIBS)
   endif
@@ -244,10 +250,10 @@
 FONT_GEN := $(FONT_BIN:%=generated/%.c)
 -generated/%.cff.c : %.cff $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; bash $(HEXDUMP_SH) > $@ $<
 -generated/%.otf.c : %.otf $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; bash $(HEXDUMP_SH) > $@ $<
 -generated/%.ttf.c : %.ttf $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; bash $(HEXDUMP_SH) > $@ $<
 -generated/%.ttc.c : %.ttc $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; bash $(HEXDUMP_SH) > $@ $<
 +generated/%.cff.c : %.cff $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; sh $(HEXDUMP_SH) > $@ $<
 +generated/%.otf.c : %.otf $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; sh $(HEXDUMP_SH) > $@ $<
 +generated/%.ttf.c : %.ttf $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; sh $(HEXDUMP_SH) > $@ $<
 +generated/%.ttc.c : %.ttc $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; sh $(HEXDUMP_SH) > $@ $<
 ifeq ($(HAVE_OBJCOPY),yes)
   MUPDF_OBJ += $(FONT_BIN:%=$(OUT)/%.o)
@@ -273,7 +279,7 @@
 HYPH_GEN := $(HYPH_BIN:%=generated/%.c)
 -generated/%.zip.c : %.zip $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; bash $(HEXDUMP_SH) > $@ $<
 +generated/%.zip.c : %.zip $(HEXDUMP_SH) ; $(QUIET_GEN) $(MKTGTDIR) ; sh $(HEXDUMP_SH) > $@ $<
 ifeq ($(HAVE_OBJCOPY),yes)
   MUPDF_OBJ += $(HYPH_BIN:%.zip=$(OUT)/%.zip.o)
@@ -329,7 +335,7 @@
 ifeq ($(shared),yes)
   $(OUT)/libmupdf.$(SO)$(SO_VERSION): $(MUPDF_OBJ) $(THIRD_OBJ)
 -	$(LINK_SO_CMD) $(THIRD_LIBS) $(LIBCRYPTO_LIBS) $(LIBS)
 +	$(LINK_SO_CMD) $(THIRD_LINK_LIBS) $(LIBCRYPTO_LIBS) $(LIBS)
   ifeq ($(OS),OpenBSD)
     # should never create symlink
     MUPDF_LIB = $(OUT)/libmupdf.$(SO)$(SO_VERSION)
@@ -376,13 +382,13 @@
 MUTOOL_OBJ := $(MUTOOL_SRC:%.c=$(OUT)/%.o)
 MUTOOL_EXE := $(OUT)/mutool
 $(MUTOOL_EXE) : $(MUTOOL_OBJ) $(MUPDF_LIB) $(THIRD_LIB) $(PKCS7_LIB) $(THREAD_LIB)
 -	$(LINK_CMD) $(THIRD_LIBS) $(THREADING_LIBS) $(LIBCRYPTO_LIBS)
 +	$(LINK_CMD) $(THIRD_LINK_LIBS) $(THREADING_LIBS) $(LIBCRYPTO_LIBS)
 TOOL_APPS += $(MUTOOL_EXE)
 MURASTER_OBJ := $(OUT)/source/tools/muraster.o
 MURASTER_EXE := $(OUT)/muraster
 $(MURASTER_EXE) : $(MURASTER_OBJ) $(MUPDF_LIB) $(THIRD_LIB) $(PKCS7_LIB) $(THREAD_LIB)
 -	$(LINK_CMD) $(THIRD_LIBS) $(THREADING_LIBS) $(LIBCRYPTO_LIBS)
 +	$(LINK_CMD) $(THIRD_LINK_LIBS) $(THREADING_LIBS) $(LIBCRYPTO_LIBS)
 EXTRA_TOOL_APPS += $(MURASTER_EXE)
 ifeq ($(HAVE_GLUT),yes)
@@ -390,7 +396,7 @@
   MUVIEW_GLUT_OBJ := $(MUVIEW_GLUT_SRC:%.c=$(OUT)/%.o)
   MUVIEW_GLUT_EXE := $(OUT)/mupdf-gl
   $(MUVIEW_GLUT_EXE) : $(MUVIEW_GLUT_OBJ) $(MUPDF_LIB) $(THIRD_LIB) $(THIRD_GLUT_LIB) $(PKCS7_LIB)
 -	$(LINK_CMD) $(THIRD_LIBS) $(LIBCRYPTO_LIBS) $(THIRD_GLUT_LIBS)
 +	$(LINK_CMD) $(THIRD_LINK_LIBS) $(LIBCRYPTO_LIBS) $(THIRD_GLUT_LIBS)
   VIEW_APPS += $(MUVIEW_GLUT_EXE)
 endif
@@ -400,7 +406,7 @@
   MUVIEW_X11_OBJ += $(OUT)/platform/x11/x11_main.o
   MUVIEW_X11_OBJ += $(OUT)/platform/x11/x11_image.o
   $(MUVIEW_X11_EXE) : $(MUVIEW_X11_OBJ) $(MUPDF_LIB) $(THIRD_LIB) $(PKCS7_LIB)
 -	$(LINK_CMD) $(THIRD_LIBS) $(X11_LIBS) $(LIBCRYPTO_LIBS)
 +	$(LINK_CMD) $(THIRD_LINK_LIBS) $(X11_LIBS) $(LIBCRYPTO_LIBS)
   VIEW_APPS += $(MUVIEW_X11_EXE)
 endif
@@ -414,7 +420,7 @@
   MUVIEW_X11_CURL_OBJ += $(OUT)/platform/x11/curl/curl_stream.o
   MUVIEW_X11_CURL_OBJ += $(OUT)/platform/x11/curl/prog_stream.o
   $(MUVIEW_X11_CURL_EXE) : $(MUVIEW_X11_CURL_OBJ) $(MUPDF_LIB) $(THIRD_LIB) $(PKCS7_LIB) $(CURL_LIB)
 -	$(LINK_CMD) $(THIRD_LIBS) $(X11_LIBS) $(LIBCRYPTO_LIBS) $(CURL_LIBS) $(PTHREAD_LIBS)
 +	$(LINK_CMD) $(THIRD_LINK_LIBS) $(X11_LIBS) $(LIBCRYPTO_LIBS) $(CURL_LIBS) $(PTHREAD_LIBS)
   EXTRA_VIEW_APPS += $(MUVIEW_X11_CURL_EXE)
 endif
 endif
@@ -440,13 +446,13 @@
 examples: $(OUT)/example $(OUT)/multi-threaded $(OUT)/storytest $(OUT)/searchtest
 $(OUT)/example: docs/examples/example.c $(MUPDF_LIB) $(THIRD_LIB)
 -	$(LINK_CMD) $(CFLAGS) $(THIRD_LIBS)
 +	$(LINK_CMD) $(CFLAGS) $(THIRD_LINK_LIBS)
 $(OUT)/multi-threaded: docs/examples/multi-threaded.c $(MUPDF_LIB) $(THIRD_LIB)
 -	$(LINK_CMD) $(CFLAGS) $(THIRD_LIBS) -lpthread
 +	$(LINK_CMD) $(CFLAGS) $(THIRD_LINK_LIBS) -lpthread
 $(OUT)/storytest: docs/examples/storytest.c $(MUPDF_LIB) $(THIRD_LIB)
 -	$(LINK_CMD) $(CFLAGS) $(THIRD_LIBS)
 +	$(LINK_CMD) $(CFLAGS) $(THIRD_LINK_LIBS)
 $(OUT)/searchtest: docs/examples/searchtest.c $(MUPDF_LIB) $(THIRD_LIB)
 -	$(LINK_CMD) $(CFLAGS) $(THIRD_LIBS)
 +	$(LINK_CMD) $(CFLAGS) $(THIRD_LINK_LIBS)
 # --- Format man pages ---
@@ -523,13 +529,13 @@
 install: install-libs install-apps install-docs
 docs:
 -	bash scripts/build-docs.sh
 +	sh scripts/build-docs.sh
 docs-live:
 -	bash scripts/build-docs-live.sh
 +	sh scripts/build-docs-live.sh
 docs-markdown:
 -	bash scripts/build-docs-markdown.sh
 +	sh scripts/build-docs-markdown.sh
 docs-clean:
 	rm -rf build/docs
@@ -541,7 +547,7 @@
 	cp -r build/docs/* $(DESTDIR)$(docdir)
 tarball:
 -	bash scripts/archive.sh
 +	sh scripts/archive.sh
 # --- Clean and Default ---
@@ -577,7 +583,7 @@
 	$(TAGS_CMD) -a --sort=no --c-kinds=t $(TAG_SRC_FILES) $(TAG_HDR_FILES)
 find-try-return:
 -	@ bash scripts/find-try-return.sh
 +	@ sh scripts/find-try-return.sh
 cscope.files: $(shell find include source platform -name '*.[ch]')
 	@ echo $^ | tr ' ' '\n' > $@
 --- a/Makerules
 +++ b/Makerules
@@ -207,6 +207,7 @@
 SYS_LEPTONICA_LIBS := -llept
 SYS_LIBARCHIVE_LIBS := -larchive
 SYS_ZXINGCPP_LIBS := -lzxing-cpp -lzint
 +CXX_LINKER_FLAG := --mupdf-cxx-linker
 ifneq "$(CLUSTER)" ""
   CFLAGS += -DCLUSTER
@@ -217,6 +218,7 @@
   SYS_GLUT_CFLAGS := -Wno-deprecated-declarations
   SYS_GLUT_LIBS := -framework GLUT -framework OpenGL
   CC = xcrun cc
 +  CXX = xcrun c++
   AR = xcrun ar
   LD = xcrun ld
   RANLIB = xcrun ranlib
@@ -236,8 +238,15 @@
 else
 +  LD_SUPPORTS_BINARY_OBJECTS := $(shell tmp=$$(mktemp -d 2>/dev/null || mktemp -d -t mupdf); \
 +    trap 'rm -rf "$$tmp"' EXIT HUP INT TERM; \
 +    : > "$$tmp/empty"; \
 +    if $(LD) -r -b binary -z noexecstack -o "$$tmp/empty.o" "$$tmp/empty" >/dev/null 2>&1; then \
 +      echo yes; \
 +    fi)
 +
   ifeq ($(OS),Linux)
 -    HAVE_OBJCOPY := yes
 +    HAVE_OBJCOPY := $(LD_SUPPORTS_BINARY_OBJECTS)
   endif
   ifeq ($(OS),OpenBSD)
 --- a/Makelists
 +++ b/Makelists
@@ -612,7 +612,7 @@
 TESSERACT_BUILD_CFLAGS += $(LEPTONICA_CFLAGS)
 TESSERACT_LIBS += -lpthread
 -TESSERACT_LIBS += -lstdc++
 +TESSERACT_LIBS += $(CXX_LINKER_FLAG)
 TESSERACT_SRC += thirdparty/tesseract/src/api/altorenderer.cpp
 TESSERACT_SRC += thirdparty/tesseract/src/api/baseapi.cpp
@@ -817,7 +817,7 @@
 ZXINGCPP_BUILD_CFLAGS += -Ithirdparty/zint/backend
 ZXINGCPP_BUILD_CFLAGS += -Iscripts/zxing-cpp
 -ZXINGCPP_LIBS += -lstdc++
 +ZXINGCPP_LIBS += $(CXX_LINKER_FLAG)
 ZXINGCPP_SRC += thirdparty/zxing-cpp/core/src/aztec/AZDecoder.cpp
 ZXINGCPP_SRC += thirdparty/zxing-cpp/core/src/aztec/AZDetector.cpp
 --- a/Makethird
 +++ b/Makethird
@@ -141,6 +141,7 @@
   THIRD_CFLAGS += $(SYS_HARFBUZZ_CFLAGS)
   THIRD_LIBS += $(SYS_HARFBUZZ_LIBS)
 else
 +  THIRD_NEEDS_CXX_LINKER := yes
   THIRD_CFLAGS += $(HARFBUZZ_CFLAGS)
   THIRD_LIBS += $(HARFBUZZ_LIBS)
   THIRD_SRC += $(HARFBUZZ_SRC)
@@ -287,8 +288,9 @@
 ifeq ($(HAVE_TESSERACT),yes)
   THIRD_CFLAGS += -DHAVE_TESSERACT
 +  THIRD_NEEDS_CXX_LINKER := yes
 ifeq ($(USE_SYSTEM_TESSERACT),yes)
 -  THIRD_LIBS += $(SYS_TESSERACT_LIBS) -lstdc++
 +  THIRD_LIBS += $(SYS_TESSERACT_LIBS) $(CXX_LINKER_FLAG)
   TESSERACT_CFLAGS = $(SYS_TESSERACT_CFLAGS)
   TESSERACT_LANGFLAGS =
 else
@@ -303,8 +305,9 @@
 ifeq ($(HAVE_ZXINGCPP),yes)
   THIRD_CFLAGS += -DHAVE_ZXINGCPP
 +  THIRD_NEEDS_CXX_LINKER := yes
 ifeq ($(USE_SYSTEM_ZXINGCPP),yes)
 -  THIRD_LIBS += $(SYS_ZXINGCPP_LIBS) -lstdc++
 +  THIRD_LIBS += $(SYS_ZXINGCPP_LIBS) $(CXX_LINKER_FLAG)
   ZXINGCPP_CFLAGS = $(SYS_ZXINGCPP_CFLAGS) -DUSE_SYSTEM_ZXINGCPP
   ZXINGCPP_LANGFLAGS =
 else
@@ -373,7 +376,8 @@
 ifeq ($(HAVE_LIBARCHIVE),yes)
   THIRD_CFLAGS += -DHAVE_LIBARCHIVE
   THIRD_CFLAGS += $(SYS_LIBARCHIVE_CFLAGS)
 -  THIRD_LIBS += $(SYS_LIBARCHIVE_LIBS) -lstdc++
 +  THIRD_LIBS += $(SYS_LIBARCHIVE_LIBS) $(CXX_LINKER_FLAG)
 +  THIRD_NEEDS_CXX_LINKER := yes
 endif
 # --- HAVE_SMARTOFFICE ---
 --- a/platform/java/Makefile
 +++ b/platform/java/Makefile
@@ -6,6 +6,7 @@
 JAVA := java
 JAVAC := javac
 +JAVA_LINK = $(CXX)
 ifndef build
   build := release
@@ -25,12 +26,14 @@
 endif
 ifeq ($(OS),Darwin)
 +CC = xcrun cc
 +CXX = xcrun c++
 MUPDF_JAVA := ../../$(OUT)/libmupdf_java64.jnilib
 JAVA_VM := $(shell /usr/libexec/java_home)
 JAVA_CFLAGS := \
 	-I $(JAVA_VM)/include \
 	-I $(JAVA_VM)/include/darwin
 -JAVA_LDFLAGS := -lstdc++
 +JAVA_LDFLAGS :=
 else
@@ -108,7 +111,7 @@
 		$(JAVA_CFLAGS) $(BUILD_FLAGS)
 $(MUPDF_JAVA) : ../../$(OUT)/mupdf_native.o $(MUPDF_CORE)
 -	$(CC) -shared $(JAVA_LDFLAGS) -o $(MUPDF_JAVA) $^ $(JAVA_LIBS) $(BUILD_FLAGS)
 +	$(JAVA_LINK) -shared $(JAVA_LDFLAGS) -o $(MUPDF_JAVA) $^ $(JAVA_LIBS) $(BUILD_FLAGS)
 jshell: $(MUPDF_JAVA) $(EXAMPLE_JAVA_OBJECTS) $(MUPDF_JAR)
 	jshell --class-path ../../$(OUT)/ -R-Djava.library.path="../../$(OUT)" init.jshell $$MUPDF_ARGS
 --- a/platform/wasm/Makefile
 +++ b/platform/wasm/Makefile
@@ -1,10 +1,10 @@
 default:
 	@npm install -s
 -	bash tools/build.sh
 +	sh tools/build.sh
 memento:
 	BUILD=memento \
 -	bash tools/build.sh
 +	sh tools/build.sh
 clean:
 	rm -f LICENSE
 --- a/platform/wasm/package.json
 +++ b/platform/wasm/package.json
@@ -24,7 +24,7 @@
 		"dist/*"
 	],
 	"scripts": {
 -		"prepack": "bash tools/build.sh && bash tools/compress.sh",
 +		"prepack": "sh tools/build.sh && sh tools/compress.sh",
 		"simple-viewer": "npx http-server -c -1 -b -o examples/simple-viewer",
 		"super-simple-viewer": "npx http-server -c -1 -b -o examples/super-simple-viewer"
 	},
 --- a/platform/wasm/tools/build.sh
 +++ b/platform/wasm/tools/build.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # Script to build the WASM binary.
 #
@@ -23,7 +23,7 @@
 fi
 export EMSDK_QUIET=1
 -source $EMSDK/emsdk_env.sh
 +. "$EMSDK/emsdk_env.sh"
 emsdk install 4.0.8 >/dev/null || exit
 emsdk activate 4.0.8 >/dev/null || exit
 --- a/platform/wasm/tools/compress.sh
 +++ b/platform/wasm/tools/compress.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 echo BROTLI
 test -f dist/mupdf.js.br || brotli dist/mupdf.js
 --- a/resources/fonts/sil/tocff.sh
 +++ b/resources/fonts/sil/tocff.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 # python3 scripts/makesubset.py -lig scripts/MES-2.TXT > resources/fonts/sil/subset.mes
 # python3 scripts/makesubset.py -sc -lig scripts/MES-2.TXT > resources/fonts/sil/subset.mes.sc
 --- a/resources/fonts/urw/tocff.sh
 +++ b/resources/fonts/urw/tocff.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 # python3 scripts/makesubset.py -lig scripts/MES-2.TXT > resources/fonts/urw/subset.mes
 # python3 scripts/makesubset.py -lig scripts/SECS.TXT > resources/fonts/urw/subset.secs
 --- a/scripts/archive.sh
 +++ b/scripts/archive.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 REV=$(git describe --tags)
 STEM=mupdf-$REV-source
@@ -7,7 +7,7 @@
 echo git archive $STEM.tar
 git archive --format=tar --prefix=$STEM/ -o $STEM.tar HEAD
 -function make_submodule_archive {
 +make_submodule_archive() {
 	# Make tarballs for submodules, stripped of unnecessary files.
 	M=$1
 	shift
 --- a/scripts/build-docs-live.sh
 +++ b/scripts/build-docs-live.sh
@@ -1,8 +1,8 @@
 -#!/bin/bash
 +#!/bin/sh
 # Set up a 'venv' and run sphinx to build the docs!
 python -m venv build/venv-docs
 -source build/venv-docs/bin/activate
 +. build/venv-docs/bin/activate
 pip install -r docs/requirements.txt
 --- a/scripts/build-docs-markdown.sh
 +++ b/scripts/build-docs-markdown.sh
@@ -1,8 +1,8 @@
 -#!/bin/bash
 +#!/bin/sh
 # Set up a 'venv' and run sphinx to build the docs!
 python -m venv build/venv-docs
 -source build/venv-docs/bin/activate
 +. build/venv-docs/bin/activate
 pip install -r docs/requirements.txt
 --- a/scripts/build-docs.sh
 +++ b/scripts/build-docs.sh
@@ -1,8 +1,8 @@
 -#!/bin/bash
 +#!/bin/sh
 # Set up a 'venv' and run sphinx to build the docs!
 python -m venv build/venv-docs
 -source build/venv-docs/bin/activate
 +. build/venv-docs/bin/activate
 pip install -r docs/requirements.txt
 --- a/scripts/copyblob.sh
 +++ b/scripts/copyblob.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 cat > copyblob.txt <<EOF
 // Copyright (C) 2004-2021 Artifex Software, Inc.
 --- a/scripts/find-try-return.sh
 +++ b/scripts/find-try-return.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 for F in $(find source platform -name '*.c')
 do
 	awk -f scripts/find-try-return.awk $F
 --- a/scripts/findunused.sh
 +++ b/scripts/findunused.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 make build=debug -j4
 rm -f build/debug/mutool build/debug/mupdf-gl
 make build=debug XLIBS=-Wl,--print-gc-sections build/debug/mutool 2>&1 | grep 'libmupdf\.' | sort > build/debug/mutool.gc
 --- a/scripts/githooks/pre-commit
 +++ b/scripts/githooks/pre-commit
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # pre-commit hook to fix whitespace errors
 #
 --- a/scripts/gitsetup.sh
 +++ b/scripts/gitsetup.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 # Tell git to fix whitespace errors automatically
 git config apply.whitespace fix
 --- a/scripts/hexdump.sh
 +++ b/scripts/hexdump.sh
@@ -1,9 +1,9 @@
 -#!/bin/bash
 +#!/bin/sh
 FILE=$1
 if [ ! -f "$FILE" ]
 then
 -	echo usage: bash scripts/hexdump.sh input.ttf
 +	echo usage: sh scripts/hexdump.sh input.ttf
 	exit 1
 fi
 --- a/scripts/jshell.sh
 +++ b/scripts/jshell.sh
@@ -1,3 +1,3 @@
 -#!/bin/bash
 +#!/bin/sh
 make -s -C platform/java
 jshell -q --class-path build/java/debug -R-Djava.library.path="build/java/debug" platform/java/init.jshell "$@"
 --- a/scripts/pdftohtml.sh
 +++ b/scripts/pdftohtml.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # Convert PDF to hybrid HTML output with images and line art rendered to a
 # background image, and text overlaid on top as absolutely positioned HTML
 --- a/scripts/runcmapdump.sh
 +++ b/scripts/runcmapdump.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 LIST=$(echo resources/cmaps/* | sort)
 --- a/scripts/runcmapshare.sh
 +++ b/scripts/runcmapshare.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # This script expects to find the original CMap resources in thirdparty/cmap-resources.
 #
@@ -6,7 +6,7 @@
 rm -f build/cmaps/*
 mkdir -p build/cmaps
 -function flatten {
 +flatten() {
 	for DIR in $(echo thirdparty/cmap-resources/Adobe-*)
 	do
 		if [ -f $DIR/CMap/$1 ]
 --- a/scripts/runfontdump.sh
 +++ b/scripts/runfontdump.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 # Generate fontdump resources and update visual studio project files.
 FONTS="resources/fonts/urw/*.cff resources/fonts/han/*.ttc resources/fonts/droid/*.ttf resources/fonts/noto/*.ttf resources/fonts/noto/*.otf resources/fonts/sil/*.cff"
 --- a/scripts/runhyphen.sh
 +++ b/scripts/runhyphen.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 #
 # Generate hyphenation data zip archive.
 #
@@ -14,5 +14,5 @@
 advzip -4 -z resources/hyphen/hyph-std.zip
 advzip -4 -z resources/hyphen/hyph-all.zip
 -bash scripts/hexdump.sh > generated/resources/hyphen/hyph-std.zip.c resources/hyphen/hyph-std.zip
 -bash scripts/hexdump.sh > generated/resources/hyphen/hyph-all.zip.c resources/hyphen/hyph-all.zip
 +sh scripts/hexdump.sh > generated/resources/hyphen/hyph-std.zip.c resources/hyphen/hyph-std.zip
 +sh scripts/hexdump.sh > generated/resources/hyphen/hyph-all.zip.c resources/hyphen/hyph-all.zip
 --- a/scripts/runiccdump.sh
 +++ b/scripts/runiccdump.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 rm -f source/fitz/icc/*.h
 for f in resources/icc/*.icc
 do
 --- a/scripts/runjsdump.sh
 +++ b/scripts/runjsdump.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 for f in source/pdf/js/*.js
 do
 	echo Dumping $f
@@ -0,0 +1,202 @@
 --- a/configure.sh
 +++ b/configure.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 #
 # configure.sh	Generates interactively a config.h from config.in
 #
@@ -25,20 +25,9 @@
 #		Foundation;  either  version 2 of the License, or  (at
 #		your option) any later version.
 #
 -#
 -# Make sure we're really running bash.
 -#
 -# I would really have preferred to write this script in a language with
 -# better string handling, but alas, bash is the only scripting language
 -# that I can be reasonable sure everybody has on their Linux machine.
 -#
 -
 CONFIG=config.h
 MAKECONFIG=config.make
 -
 -[ -z "$BASH" ] && { echo "configure.sh requires bash" 1>&2; exit 1; }
 -
 cat <<EOF
 ######################################################
@@ -48,26 +37,24 @@
 EOF
 # Disable filename globbing once and for all.
 -# Enable function cacheing.
 -set -f -h
 +set -f
 # set up reading of config file
 if [ "$#" != "1" ] || [ ! -f "$1" ]; then
 	echo "usage: $0 configfile" 1>&2
 	exit 1
 fi
 -exec 7<$1
 -config_fd_redir='<&7'
 +exec 7<"$1"
 #
 # readln reads a line into $ans.
 #
 #	readln prompt default
 #
 -function readln()
 +readln()
 {
 -  echo -n "$1"
 -  IFS='@' read ans || exit 1
 +  printf '%s' "$1"
 +  IFS='@' read -r ans || exit 1
   [ -z "$ans" ] && ans=$2
 }
@@ -75,21 +62,21 @@
 #
 #	bool tail
 #
 -function bool()
 +bool()
 {
 -  # Slimier hack to get bash to rescan a line.
 +  # Re-scan the line so shell quoting from config.in is preserved.
   eval "set -- $1"
   ans=""
 -  while [ "$ans" != "y" -a "$ans" != "n" ]
 +  while [ "$ans" != "y" ] && [ "$ans" != "n" ]
   do
 	readln "$1 ($2) [$3] " "$3"
   done
   if [ "$ans" = "y" ]; then
 -	echo "#define $2 1" >>${CONFIG}
 -	echo "$2=1" >>${MAKECONFIG}
 +	echo "#define $2 1" >>"${CONFIG}"
 +	echo "$2=1" >>"${MAKECONFIG}"
     else
 -	echo "#define $2 0" >>${CONFIG}
 -	echo "# $2=0" >> ${MAKECONFIG}
 +	echo "#define $2 0" >>"${CONFIG}"
 +	echo "# $2=0" >>"${MAKECONFIG}"
   fi
   raw_input_line="bool '$1' $2 $ans"
   eval "$2=$ans"
@@ -99,16 +86,42 @@
 #
 #	int tail
 #
 -function int()
 +is_integer()
 {
 -  # Slimier hack to get bash to rescan a line.
 +  case $1 in
 +    ''|*[!0123456789+-]*|*[-+]*[-+]*)
 +      return 1
 +      ;;
 +    [+-])
 +      return 1
 +      ;;
 +  esac
 +
 +  case $1 in
 +    [+-]*)
 +      set -- "${1#?}"
 +      ;;
 +  esac
 +
 +  case $1 in
 +    ''|*[!0123456789]*)
 +      return 1
 +      ;;
 +  esac
 +
 +  return 0
 +}
 +
 +int()
 +{
 +  # Re-scan the line so shell quoting from config.in is preserved.
   eval "set -- $1"
   ans="x"
 -  while [ $[$ans+0] != "$ans" ];
 +  while ! is_integer "$ans"
   do
 	readln "$1 ($2) [$3] " "$3"
   done
 -  echo "#define $2 ($ans)" >>${CONFIG}
 +  echo "#define $2 ($ans)" >>"${CONFIG}"
   raw_input_line="int '$1' $2 $ans"
   eval "$2=$ans"
 }
@@ -123,10 +136,10 @@
   stack=''
   branch='t'
 -  while IFS='@' eval read raw_input_line ${config_fd_redir}
 +  while IFS='@' read -r raw_input_line <&7
   do
 -	# Slimy hack to get bash to rescan a line.
 -	read cmd rest <<-END_OF_COMMAND
 +	# Re-scan the line so shell quoting from config.in is preserved.
 +	IFS=' ' read -r cmd rest <<-END_OF_COMMAND
 		$raw_input_line
 	END_OF_COMMAND
@@ -135,18 +148,18 @@
 			echo "$raw_input_line"
 			# echo "# $rest" >>$CONFIG
 			if [ "$prevcmd" != "*" ]; then
 -				echo >>${CONFIG}
 -				echo "/* $rest" >>${CONFIG}
 +				echo >>"${CONFIG}"
 +				echo "/* $rest" >>"${CONFIG}"
 			else
 -				echo " * $rest" >>${CONFIG}
 +				echo " * $rest" >>"${CONFIG}"
 			fi
 			prevcmd="*"
 		fi
 	else
 -		[ "$prevcmd" = "*" ] && echo " */" >>${CONFIG}
 +		[ "$prevcmd" = "*" ] && echo " */" >>"${CONFIG}"
 		prevcmd=""
 		case "$cmd" in
 -		=)	[ "$branch" = "t" ] && echo "$rest" >>${CONFIG};;
 +		=)	[ "$branch" = "t" ] && echo "$rest" >>"${CONFIG}";;
 		:)	[ "$branch" = "t" ] && echo "$raw_input_line" ;;
 		int)	[ "$branch" = "t" ] && int "$rest" ;;
 		bool)	[ "$branch" = "t" ] && bool "$rest" ;;
@@ -160,12 +173,12 @@
 		else)	if [ "$branch" = "t" ]; then
 				branch=f
 			else
 -				read branch rest <<-END_OF_STACK
 -					$stack
 -				END_OF_STACK
 -			fi ;;
 +					IFS=' ' read -r branch rest <<-END_OF_STACK
 +						$stack
 +					END_OF_STACK
 +				fi ;;
 		fi)	[ -z "$stack" ] && echo "Error!  Extra fi." 1>&2
 -			read branch stack <<-END_OF_STACK
 +			IFS=' ' read -r branch stack <<-END_OF_STACK
 				$stack
 			END_OF_STACK
 			;;
@@ -173,7 +186,7 @@
 	fi
 	echo "$raw_input_line" >>config.new
   done
 -  [ "$prevcmd" = "*" ] && echo " */" >>${CONFIG}
 +  [ "$prevcmd" = "*" ] && echo " */" >>"${CONFIG}"
   [ -z "$stack" ] || echo "Error!  Unterminated if." 1>&2
@@ -0,0 +1,27 @@
 diff --git a/deps/LIEF/third-party/spdlog/include/spdlog/fmt/bundled/format.h b/deps/LIEF/third-party/spdlog/include/spdlog/fmt/bundled/format.h
 index 50e5714..36268ce 100644
 --- a/deps/LIEF/third-party/spdlog/include/spdlog/fmt/bundled/format.h
 +++ b/deps/LIEF/third-party/spdlog/include/spdlog/fmt/bundled/format.h
@@ -42,6 +42,7 @@
 #ifndef FMT_MODULE
 #  include <cmath>    // std::signbit
 +#  include <cstdlib>  // std::malloc, std::free
 #  include <cstddef>  // std::byte
 #  include <cstdint>  // uint32_t
 #  include <cstring>  // std::memcpy
@@ -744,12 +745,12 @@ template <typename T> struct allocator {
   T* allocate(size_t n) {
     FMT_ASSERT(n <= max_value<size_t>() / sizeof(T), "");
 -    T* p = static_cast<T*>(malloc(n * sizeof(T)));
 +    T* p = static_cast<T*>(std::malloc(n * sizeof(T)));
     if (!p) FMT_THROW(std::bad_alloc());
     return p;
   }
 -  void deallocate(T* p, size_t) { free(p); }
 +  void deallocate(T* p, size_t) { std::free(p); }
 };
 }  // namespace detail
@@ -0,0 +1,773 @@
 diff --git a/nss/meson.build b/nss/meson.build
 new file mode 100644
 --- /dev/null
 +++ b/nss/meson.build
@@ -0,0 +1,147 @@
 +project('nss', 'c')
 +
 +py = import('python').find_installation('python3')
 +sh = find_program('sh')
 +
 +buildtype = get_option('buildtype')
 +if buildtype == 'debug'
 +  nss_target = 'Debug'
 +else
 +  nss_target = 'Release'
 +endif
 +
 +build_args = []
 +if buildtype != 'debug'
 +  build_args += ['--opt']
 +endif
 +if not get_option('build_tests')
 +  build_args += ['--disable-tests']
 +endif
 +if get_option('enable_fips')
 +  build_args += ['--enable-fips']
 +endif
 +if get_option('enable_libpkix')
 +  build_args += ['--enable-libpkix']
 +endif
 +if get_option('enable_legacy_db')
 +  build_args += ['--enable-legacy-db']
 +endif
 +if get_option('system_sqlite')
 +  build_args += ['--system-sqlite']
 +endif
 +
 +nspr_version = get_option('nspr_version')
 +if nspr_version == 'auto'
 +  nspr_dep = dependency('nspr', required : false)
 +  if not nspr_dep.found()
 +    nspr_dep = dependency('nspr4', required : false)
 +  endif
 +  if not nspr_dep.found()
 +    error('Unable to determine the NSPR version. Install pkg-config metadata for NSPR or configure with -Dnspr_version=...')
 +  endif
 +  nspr_version = nspr_dep.version()
 +endif
 +
 +version_cmd = [
 +  '-c',
 +  '''import pathlib,re,sys
 +text = pathlib.Path(sys.argv[1]).read_text()
 +match = re.search(r'#define\s+NSS_VERSION\s+"([^"]+)"', text)
 +if not match:
 +    raise SystemExit('unable to parse NSS_VERSION')
 +version = match.group(1)
 +parts = (version.split('.') + ['0', '0'])[:3]
 +print(version)
 +print(parts[0])
 +print(parts[1])
 +print(parts[2])
 +''',
 +  join_paths(meson.current_source_dir(), 'lib', 'nss', 'nss.h'),
 +]
 +version_info = run_command(py, version_cmd, check : true).stdout().strip().split('\n')
 +nss_version = version_info[0]
 +nss_major_version = version_info[1]
 +nss_minor_version = version_info[2]
 +nss_patch_version = version_info[3]
 +
 +prefix = get_option('prefix')
 +exec_prefix = prefix
 +libdir = join_paths(prefix, get_option('libdir'))
 +includedir = join_paths(prefix, get_option('includedir'), 'nss')
 +
 +pkgconf = configuration_data()
 +pkgconf.set('prefix', prefix)
 +pkgconf.set('exec_prefix', exec_prefix)
 +pkgconf.set('libdir', libdir)
 +pkgconf.set('includedir', includedir)
 +pkgconf.set('NSS_VERSION', nss_version)
 +pkgconf.set('NSPR_VERSION', nspr_version)
 +
 +scriptconf = configuration_data()
 +scriptconf.set('prefix', prefix)
 +scriptconf.set('MOD_MAJOR_VERSION', nss_major_version)
 +scriptconf.set('MOD_MINOR_VERSION', nss_minor_version)
 +scriptconf.set('MOD_PATCH_VERSION', nss_patch_version)
 +
 +configure_file(
 +  input : 'meson/nss.pc.in',
 +  output : 'nss.pc',
 +  configuration : pkgconf,
 +  install : true,
 +  install_dir : join_paths(get_option('libdir'), 'pkgconfig'),
 +)
 +
 +configure_file(
 +  input : 'meson/nss-config.in',
 +  output : 'nss-config',
 +  configuration : scriptconf,
 +  install : true,
 +  install_dir : get_option('bindir'),
 +  install_mode : 'rwxr-xr-x',
 +)
 +
 +nss_build_root = join_paths(meson.current_build_dir(), 'nss-build')
 +
 +custom_target(
 +  'nss-build',
 +  output : 'nss-build.stamp',
 +  command : [
 +    sh,
 +    files('meson/build_nss.sh'),
 +    '--source-dir',
 +    meson.current_source_dir(),
 +    '--build-root',
 +    nss_build_root,
 +    '--gyp',
 +    get_option('gyp'),
 +    '--nspr',
 +    get_option('nspr'),
 +    '--stamp',
 +    '@OUTPUT@',
 +    '--',
 +  ] + build_args,
 +  build_by_default : true,
 +  build_always_stale : true,
 +  console : true,
 +)
 +
 +meson.add_install_script(
 +  py,
 +  files('meson/install_nss.py'),
 +  '--build-root',
 +  nss_build_root,
 +  '--target',
 +  nss_target,
 +  '--libdir',
 +  get_option('libdir'),
 +  '--bindir',
 +  get_option('bindir'),
 +  '--includedir',
 +  get_option('includedir'),
 +  '--install-private-headers',
 +  get_option('install_private_headers') ? 'true' : 'false',
 +  '--install-tools',
 +  get_option('install_tools') ? 'true' : 'false',
 +  '--install-ckbi',
 +  get_option('install_ckbi') ? 'true' : 'false',
 +)
 diff --git a/nss/meson_options.txt b/nss/meson_options.txt
 new file mode 100644
 --- /dev/null
 +++ b/nss/meson_options.txt
@@ -0,0 +1,66 @@
 +option(
 +  'build_tests',
 +  type : 'boolean',
 +  value : false,
 +  description : 'Build NSS tests and the extra test-only helper binaries'
 +)
 +option(
 +  'enable_fips',
 +  type : 'boolean',
 +  value : false,
 +  description : 'Enable FIPS checks in the GYP build'
 +)
 +option(
 +  'enable_libpkix',
 +  type : 'boolean',
 +  value : false,
 +  description : 'Build libpkix support'
 +)
 +option(
 +  'enable_legacy_db',
 +  type : 'boolean',
 +  value : false,
 +  description : 'Build the legacy DB module'
 +)
 +option(
 +  'system_sqlite',
 +  type : 'boolean',
 +  value : false,
 +  description : 'Link against the system sqlite library'
 +)
 +option(
 +  'install_private_headers',
 +  type : 'boolean',
 +  value : false,
 +  description : 'Install headers from dist/private/nss in addition to the public API'
 +)
 +option(
 +  'install_tools',
 +  type : 'boolean',
 +  value : true,
 +  description : 'Install the NSS command-line tools from dist/<cfg>/bin'
 +)
 +option(
 +  'install_ckbi',
 +  type : 'boolean',
 +  value : false,
 +  description : 'Install libnssckbi.so; disable by default to avoid conflicts with p11-kit trust modules'
 +)
 +option(
 +  'gyp',
 +  type : 'string',
 +  value : 'auto',
 +  description : 'Path to the gyp executable, or auto to resolve gyp/gyp-next from PATH'
 +)
 +option(
 +  'nspr',
 +  type : 'string',
 +  value : 'auto',
 +  description : 'NSPR include:lib pair for build.sh, or auto to resolve it with pkg-config'
 +)
 +option(
 +  'nspr_version',
 +  type : 'string',
 +  value : 'auto',
 +  description : 'NSPR version string to embed in nss.pc when pkg-config metadata is unavailable'
 +)
 diff --git a/nss/meson/build_nss.sh b/nss/meson/build_nss.sh
 new file mode 100644
 --- /dev/null
 +++ b/nss/meson/build_nss.sh
@@ -0,0 +1,243 @@
 +#!/bin/sh
 +
 +set -eu
 +
 +source_dir=
 +build_root=
 +gyp_bin=auto
 +nspr=auto
 +stamp=
 +build_args=
 +
 +append_arg() {
 +    if [ -n "$build_args" ]; then
 +        build_args="$build_args
 +$1"
 +    else
 +        build_args=$1
 +    fi
 +}
 +
 +while [ $# -gt 0 ]; do
 +    case "$1" in
 +        --source-dir)
 +            source_dir=$2
 +            shift 2
 +            ;;
 +        --build-root)
 +            build_root=$2
 +            shift 2
 +            ;;
 +        --gyp)
 +            gyp_bin=$2
 +            shift 2
 +            ;;
 +        --nspr)
 +            nspr=$2
 +            shift 2
 +            ;;
 +        --stamp)
 +            stamp=$2
 +            shift 2
 +            ;;
 +        --)
 +            shift
 +            break
 +            ;;
 +        *)
 +            echo "Unknown option: $1" >&2
 +            exit 2
 +            ;;
 +    esac
 +done
 +
 +while [ $# -gt 0 ]; do
 +    append_arg "$1"
 +    shift
 +done
 +
 +if [ -z "$source_dir" ] || [ -z "$build_root" ] || [ -z "$stamp" ]; then
 +    echo "Missing required arguments" >&2
 +    exit 2
 +fi
 +
 +resolve_gyp() {
 +    if [ "$gyp_bin" != "auto" ]; then
 +        echo "$gyp_bin"
 +        return 0
 +    fi
 +
 +    if [ -n "${GYP:-}" ]; then
 +        echo "$GYP"
 +        return 0
 +    fi
 +
 +    if command -v gyp >/dev/null 2>&1; then
 +        command -v gyp
 +        return 0
 +    fi
 +
 +    if command -v gyp-next >/dev/null 2>&1; then
 +        command -v gyp-next
 +        return 0
 +    fi
 +
 +    echo "Unable to find gyp. Configure Meson with -Dgyp=/path/to/gyp." >&2
 +    exit 1
 +}
 +
 +pkg_config_var() {
 +    package=$1
 +    variable=$2
 +    if pkg-config --exists "$package" 2>/dev/null; then
 +        pkg-config --variable="$variable" "$package"
 +        return 0
 +    fi
 +    return 1
 +}
 +
 +resolve_nspr() {
 +    if [ "$nspr" != "auto" ]; then
 +        case "$nspr" in
 +            *:*)
 +                echo "$nspr"
 +                return 0
 +                ;;
 +            *)
 +                echo "The -Dnspr option must use the form <include>:<lib>." >&2
 +                exit 1
 +                ;;
 +        esac
 +    fi
 +
 +    for package in nspr nspr4; do
 +        include_dir=$(pkg_config_var "$package" includedir || true)
 +        lib_dir=$(pkg_config_var "$package" libdir || true)
 +        if [ -n "$include_dir" ] && [ -n "$lib_dir" ]; then
 +            echo "$include_dir:$lib_dir"
 +            return 0
 +        fi
 +    done
 +
 +    echo "Unable to resolve NSPR. Configure Meson with -Dnspr=<include>:<lib>." >&2
 +    exit 1
 +}
 +
 +detect_jobs() {
 +    if [ -n "${MESON_NUM_PROCESSES:-}" ]; then
 +        echo "$MESON_NUM_PROCESSES"
 +        return 0
 +    fi
 +
 +    if command -v getconf >/dev/null 2>&1; then
 +        jobs=$(getconf _NPROCESSORS_ONLN 2>/dev/null || true)
 +        if [ -n "$jobs" ]; then
 +            echo "$jobs"
 +            return 0
 +        fi
 +    fi
 +
 +    echo 1
 +}
 +
 +detect_target_arch() {
 +    "${PYTHON:-python3}" "$source_dir/coreconf/detect_host_arch.py"
 +}
 +
 +gyp_bin=$(resolve_gyp)
 +nspr=$(resolve_nspr)
 +jobs=$(detect_jobs)
 +target_arch=$(detect_target_arch)
 +target=Debug
 +disable_tests=0
 +enable_fips=0
 +enable_libpkix=0
 +enable_legacy_db=0
 +system_sqlite=0
 +
 +if [ -n "$build_args" ]; then
 +    old_ifs=$IFS
 +    IFS='
 +'
 +    for arg in $build_args; do
 +        case "$arg" in
 +            --opt)
 +                target=Release
 +                ;;
 +            --disable-tests)
 +                disable_tests=1
 +                ;;
 +            --enable-fips)
 +                enable_fips=1
 +                ;;
 +            --enable-libpkix)
 +                enable_libpkix=1
 +                ;;
 +            --enable-legacy-db)
 +                enable_legacy_db=1
 +                ;;
 +            --system-sqlite)
 +                system_sqlite=1
 +                ;;
 +            *)
 +                echo "Unsupported build option: $arg" >&2
 +                exit 1
 +                ;;
 +        esac
 +    done
 +    IFS=$old_ifs
 +fi
 +
 +dist_dir=$build_root/dist
 +out_dir=$build_root/out
 +target_dir=$out_dir/$target
 +mkdir -p "$dist_dir" "$target_dir"
 +
 +nspr_include_dir=${nspr%%:*}
 +nspr_lib_dir=${nspr#*:}
 +
 +set -- \
 +    --depth="$source_dir" \
 +    --generator-output="$build_root" \
 +    -Dtarget_arch="$target_arch" \
 +    -Dnss_dist_dir="$dist_dir" \
 +    -Dnss_dist_obj_dir="$dist_dir/$target" \
 +    -Dnspr_include_dir="$nspr_include_dir" \
 +    -Dnspr_lib_dir="$nspr_lib_dir" \
 +    -Denable_sslkeylogfile=1
 +
 +if [ "$disable_tests" = 1 ]; then
 +    set -- "$@" -Ddisable_tests=1
 +fi
 +if [ "$enable_fips" = 1 ]; then
 +    set -- "$@" -Ddisable_fips=0
 +fi
 +if [ "$enable_libpkix" = 1 ]; then
 +    set -- "$@" -Ddisable_libpkix=0
 +fi
 +if [ "$enable_legacy_db" = 1 ]; then
 +    set -- "$@" -Ddisable_dbm=0
 +fi
 +if [ "$system_sqlite" = 1 ]; then
 +    set -- "$@" -Duse_system_sqlite=1
 +fi
 +
 +(
 +    cd "$source_dir"
 +    "$gyp_bin" -f ninja "$@" "$source_dir/nss.gyp"
 +)
 +if command -v ninja-build >/dev/null 2>&1; then
 +    ninja_bin=$(command -v ninja-build)
 +elif command -v ninja >/dev/null 2>&1; then
 +    ninja_bin=$(command -v ninja)
 +else
 +    echo "Unable to find ninja." >&2
 +    exit 1
 +fi
 +
 +(
 +    cd "$source_dir"
 +    "$ninja_bin" -C "$target_dir" -j "$jobs"
 +)
 +
 +printf '%s\n' "$build_root" >"$stamp"
 diff --git a/nss/meson/install_nss.py b/nss/meson/install_nss.py
 new file mode 100644
 --- /dev/null
 +++ b/nss/meson/install_nss.py
@@ -0,0 +1,105 @@
 +#!/usr/bin/env python3
 +
 +import argparse
 +import os
 +import pathlib
 +import shutil
 +
 +
 +def bool_arg(value: str) -> bool:
 +    return value.lower() in {'1', 'true', 'yes', 'on'}
 +
 +
 +def install_root(prefix: pathlib.Path, path: str) -> pathlib.Path:
 +    candidate = pathlib.Path(path)
 +    if candidate.is_absolute():
 +        return candidate
 +    return prefix / candidate
 +
 +
 +def install_entry(src: pathlib.Path, dst: pathlib.Path) -> None:
 +    dst.parent.mkdir(parents=True, exist_ok=True)
 +    if dst.exists() or dst.is_symlink():
 +        if dst.is_dir() and not dst.is_symlink():
 +            shutil.rmtree(dst)
 +        else:
 +            dst.unlink()
 +
 +    if src.is_symlink():
 +        dst.symlink_to(os.readlink(src))
 +    elif src.is_dir():
 +        shutil.copytree(src, dst, symlinks=True)
 +    else:
 +        shutil.copy2(src, dst)
 +
 +
 +def install_tree(src: pathlib.Path, dst: pathlib.Path) -> None:
 +    if not src.exists():
 +        return
 +
 +    for entry in sorted(src.iterdir()):
 +        install_entry(entry, dst / entry.name)
 +
 +
 +def install_filtered_libs(src: pathlib.Path, dst: pathlib.Path, install_ckbi: bool) -> None:
 +    if not src.exists():
 +        return
 +
 +    for entry in sorted(src.iterdir()):
 +        if entry.name.endswith('.TOC'):
 +            continue
 +        if not install_ckbi and entry.name.startswith('libnssckbi.so'):
 +            continue
 +        if entry.suffix in {'.a', '.chk', '.so'} or '.so.' in entry.name:
 +            install_entry(entry, dst / entry.name)
 +
 +
 +def install_tools(src: pathlib.Path, dst: pathlib.Path) -> None:
 +    if not src.exists():
 +        return
 +
 +    for entry in sorted(src.iterdir()):
 +        if entry.is_dir():
 +            continue
 +        if os.access(entry, os.X_OK):
 +            install_entry(entry, dst / entry.name)
 +
 +
 +def main() -> int:
 +    parser = argparse.ArgumentParser()
 +    parser.add_argument('--build-root', required=True)
 +    parser.add_argument('--target', required=True)
 +    parser.add_argument('--libdir', required=True)
 +    parser.add_argument('--bindir', required=True)
 +    parser.add_argument('--includedir', required=True)
 +    parser.add_argument('--install-private-headers', required=True)
 +    parser.add_argument('--install-tools', required=True)
 +    parser.add_argument('--install-ckbi', required=True)
 +    args = parser.parse_args()
 +
 +    install_prefix = pathlib.Path(
 +        os.environ.get('MESON_INSTALL_DESTDIR_PREFIX', os.environ['MESON_INSTALL_PREFIX'])
 +    )
 +    libdir = install_root(install_prefix, args.libdir)
 +    bindir = install_root(install_prefix, args.bindir)
 +    includedir = install_root(install_prefix, args.includedir)
 +
 +    build_root = pathlib.Path(args.build_root)
 +    dist_root = build_root / 'dist'
 +    public_headers = dist_root / 'public' / 'nss'
 +    private_headers = dist_root / 'private' / 'nss'
 +    target_root = dist_root / args.target
 +
 +    install_tree(public_headers, includedir / 'nss')
 +    if bool_arg(args.install_private_headers):
 +        install_tree(private_headers, includedir / 'nss-private')
 +
 +    install_filtered_libs(target_root / 'lib', libdir, bool_arg(args.install_ckbi))
 +    if bool_arg(args.install_tools):
 +        install_tools(target_root / 'bin', bindir)
 +
 +    return 0
 +
 +
 +if __name__ == '__main__':
 +    raise SystemExit(main())
 diff --git a/nss/meson/nss-config.in b/nss/meson/nss-config.in
 new file mode 100644
 --- /dev/null
 +++ b/nss/meson/nss-config.in
@@ -0,0 +1,144 @@
 +#!/bin/sh
 +
 +prefix=@prefix@
 +
 +major_version=@MOD_MAJOR_VERSION@
 +minor_version=@MOD_MINOR_VERSION@
 +patch_version=@MOD_PATCH_VERSION@
 +
 +usage()
 +{
 +	cat <<EOF
 +Usage: nss-config [OPTIONS] [LIBRARIES]
 +Options:
 +	[--prefix[=DIR]]
 +	[--exec-prefix[=DIR]]
 +	[--includedir[=DIR]]
 +	[--libdir[=DIR]]
 +	[--version]
 +	[--libs]
 +	[--cflags]
 +Dynamic Libraries:
 +	nss
 +	nssutil
 +	ssl
 +	smime
 +EOF
 +	exit $1
 +}
 +
 +if test $# -eq 0; then
 +	usage 1 1>&2
 +fi
 +
 +lib_ssl=yes
 +lib_smime=yes
 +lib_nss=yes
 +lib_nssutil=yes
 +
 +while test $# -gt 0; do
 +  case "$1" in
 +  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
 +  *) optarg= ;;
 +  esac
 +
 +  case $1 in
 +    --prefix=*)
 +      prefix=$optarg
 +      ;;
 +    --prefix)
 +      echo_prefix=yes
 +      ;;
 +    --exec-prefix=*)
 +      exec_prefix=$optarg
 +      ;;
 +    --exec-prefix)
 +      echo_exec_prefix=yes
 +      ;;
 +    --includedir=*)
 +      includedir=$optarg
 +      ;;
 +    --includedir)
 +      echo_includedir=yes
 +      ;;
 +    --libdir=*)
 +      libdir=$optarg
 +      ;;
 +    --libdir)
 +      echo_libdir=yes
 +      ;;
 +    --version)
 +      echo ${major_version}.${minor_version}.${patch_version}
 +      ;;
 +    --cflags)
 +      echo_cflags=yes
 +      ;;
 +    --libs)
 +      echo_libs=yes
 +      ;;
 +    ssl)
 +      lib_ssl=yes
 +      ;;
 +    smime)
 +      lib_smime=yes
 +      ;;
 +    nss)
 +      lib_nss=yes
 +      ;;
 +    nssutil)
 +      lib_nssutil=yes
 +      ;;
 +    *)
 +      usage 1 1>&2
 +      ;;
 +  esac
 +  shift
 +done
 +
 +# Set variables that may be dependent upon other variables
 +if test -z "$exec_prefix"; then
 +    exec_prefix=`pkg-config --variable=exec_prefix nss`
 +fi
 +if test -z "$includedir"; then
 +    includedir=`pkg-config --variable=includedir nss`
 +fi
 +if test -z "$libdir"; then
 +    libdir=`pkg-config --variable=libdir nss`
 +fi
 +
 +if test "$echo_prefix" = "yes"; then
 +    echo $prefix
 +fi
 +
 +if test "$echo_exec_prefix" = "yes"; then
 +    echo $exec_prefix
 +fi
 +
 +if test "$echo_includedir" = "yes"; then
 +    echo $includedir
 +fi
 +
 +if test "$echo_libdir" = "yes"; then
 +    echo $libdir
 +fi
 +
 +if test "$echo_cflags" = "yes"; then
 +    echo -I$includedir
 +fi
 +
 +if test "$echo_libs" = "yes"; then
 +      libdirs="-Wl,-rpath-link,$libdir -L$libdir"
 +      if test -n "$lib_ssl"; then
 +	libdirs="$libdirs -lssl${major_version}"
 +      fi
 +      if test -n "$lib_smime"; then
 +	libdirs="$libdirs -lsmime${major_version}"
 +      fi
 +      if test -n "$lib_nss"; then
 +	libdirs="$libdirs -lnss${major_version}"
 +      fi
 +      if test -n "$lib_nssutil"; then
 +	libdirs="$libdirs -lnssutil${major_version}"
 +      fi
 +      echo $libdirs
 +fi
 diff --git a/nss/meson/nss.pc.in b/nss/meson/nss.pc.in
 new file mode 100644
 --- /dev/null
 +++ b/nss/meson/nss.pc.in
@@ -0,0 +1,11 @@
 +prefix=@prefix@
 +exec_prefix=@exec_prefix@
 +libdir=@libdir@
 +includedir=@includedir@
 +
 +Name: NSS
 +Description: Network Security Services
 +Version: @NSS_VERSION@
 +Requires: nspr >= @NSPR_VERSION@
 +Libs: -L${libdir} -lssl3 -lsmime3 -lnss3 -lnssutil3
 +Cflags: -I${includedir}
 diff --git a/nss/readme.md b/nss/readme.md
 --- a/nss/readme.md
 +++ b/nss/readme.md
@@ -44,6 +44,23 @@
 See [help.txt](https://hg.mozilla.org/projects/nss/raw-file/tip/help.txt) for
 more information on using build.sh.
 +## Building and Installing with Meson
 +
 +NSS also ships a Meson wrapper that drives the existing `build.sh`/GYP build
 +and installs the resulting headers, libraries, tools, `nss.pc`, and
 +`nss-config`.
 +
 +    meson setup build -Dgyp=/path/to/gyp
 +    meson compile -C build
 +    meson install -C build
 +
 +If NSPR is not available via `pkg-config`, pass it explicitly as
 +`-Dnspr=/path/to/include:/path/to/lib`. Meson keeps the GYP output inside the
 +Meson build tree and installs public headers to `${includedir}/nss`. The
 +Meson install defaults to skipping `libnssckbi.so` to avoid file conflicts
 +with `p11-kit` trust module packages; enable `-Dinstall_ckbi=true` if you
 +explicitly want NSS to install that module.
 +
 ## Building NSS (legacy build system)
 After changing into the NSS directory a typical build of 32-bit NSS is done as
@@ -0,0 +1,188 @@
 --- a/Makefile.SH
 +++ b/Makefile.SH
@@ -373,16 +373,64 @@
 	$spitshell >>$Makefile <<!GROK!THIS!
 # Macros to invoke a copy of our fully operational perl during the build.
 PERL_EXE = perl\$(EXE_EXT)
 -RUN_PERL = \$(LDLIBPTH) \$(RUN) $perl\$(EXE_EXT)
 +BUILD_PERL_INC = -Ilib -I. \
 +	-Icpan/AutoLoader/lib \
 +	-Idist/Carp/lib \
 +	-Idist/PathTools \
 +	-Idist/PathTools/lib \
 +	-Icpan/ExtUtils-Install/lib \
 +	-Icpan/ExtUtils-MakeMaker/lib \
 +	-Icpan/ExtUtils-Manifest/lib \
 +	-Icpan/File-Path/lib \
 +	-Iext/re \
 +	-Idist/Term-ReadLine/lib \
 +	-Idist/Exporter/lib \
 +	-Iext/File-Find/lib \
 +	-Icpan/Text-Tabs/lib \
 +	-Idist/constant/lib \
 +	-Icpan/version/lib \
 +	-Icpan/Getopt-Long/lib \
 +	-Icpan/Text-ParseWords/lib \
 +	-Icpan/ExtUtils-PL2Bat/lib \
 +	-Icpan/parent/lib \
 +	-Idist/ExtUtils-ParseXS/lib \
 +	-Idist/base/lib \
 +	-Idist/XSLoader
 +RUN_PERL = \$(LDLIBPTH) \$(RUN) $perl\$(EXE_EXT) \$(BUILD_PERL_INC)
 +RUN_MINIPERL = \$(LDLIBPTH) ./miniperl\$(EXE_EXT) \$(BUILD_PERL_INC)
 !GROK!THIS!
 	;;
 *)
 	$spitshell >>$Makefile <<!GROK!THIS!
 # Macros to invoke a copy of our fully operational perl during the build.
 PERL_EXE = perl\$(EXE_EXT)
 -RUN_PERL = \$(LDLIBPTH) \$(RUN) ./perl\$(EXE_EXT) -Ilib -I.
 -!GROK!THIS!
 -	;;
 +BUILD_PERL_INC = -Ilib -I. \
 +	-Icpan/AutoLoader/lib \
 +	-Idist/Carp/lib \
 +	-Idist/PathTools \
 +	-Idist/PathTools/lib \
 +	-Icpan/ExtUtils-Install/lib \
 +	-Icpan/ExtUtils-MakeMaker/lib \
 +	-Icpan/ExtUtils-Manifest/lib \
 +	-Icpan/File-Path/lib \
 +	-Iext/re \
 +	-Idist/Term-ReadLine/lib \
 +	-Idist/Exporter/lib \
 +	-Iext/File-Find/lib \
 +	-Icpan/Text-Tabs/lib \
 +	-Idist/constant/lib \
 +	-Icpan/version/lib \
 +	-Icpan/Getopt-Long/lib \
 +	-Icpan/Text-ParseWords/lib \
 +	-Icpan/ExtUtils-PL2Bat/lib \
 +	-Icpan/parent/lib \
 +	-Idist/ExtUtils-ParseXS/lib \
 +	-Idist/base/lib \
 +	-Idist/XSLoader
 +RUN_PERL = \$(LDLIBPTH) \$(RUN) ./perl\$(EXE_EXT) \$(BUILD_PERL_INC)
 +RUN_MINIPERL = \$(LDLIBPTH) ./miniperl\$(EXE_EXT) \$(BUILD_PERL_INC)
 +!GROK!THIS!
 +		;;
 esac
 $spitshell >>$Makefile <<!GROK!THIS!
@@ -706,12 +754,20 @@
 !NO!SUBS!
 -# Making utilities requires Cwd.  If we have dynamic
 -# loading, we only need miniperl and Cwd.$dlext.  If we have static
 -# loading, we need to build perl first.
 +# Making utilities requires Cwd.  If we have dynamic loading, we only need
 +# miniperl and the Cwd extension.  If we have static loading, we need to
 +# build perl first.  Use an explicit helper target for the dynamic case so
 +# makes that do not know how to drive the lib/auto/Cwd output directly still
 +# have a concrete dependency to build.
 case "$usedl$static_cwd" in
 defineundef)
 -    util_deps='$(MINIPERL_EXE) $(CONFIGPM) lib/auto/Cwd/Cwd$(DLSUFFIX) FORCE'
 +	util_deps='$(MINIPERL_EXE) $(CONFIGPM) buildext-Cwd FORCE'
 +	$spitshell >>$Makefile <<'!NO!SUBS!'
 +.PHONY: buildext-Cwd
 +buildext-Cwd: $(MINIPERL_EXE) lib/buildcustomize.pl preplibrary makeppport $(DYNALOADER) FORCE $(PERLEXPORT) $(LIBPERL)
 +	$(MINIPERL) make_ext.pl lib/auto/Cwd/Cwd$(DLSUFFIX) $(MAKE_EXT_ARGS) MAKE="$(MAKE)" LIBPERL_A=$(LIBPERL) LINKTYPE=dynamic
 +
 +!NO!SUBS!
     ;;
 definedefine)
     util_deps='$(PERL_EXE) $(CONFIGPM) FORCE'
@@ -820,8 +876,8 @@
 case "$osname" in
 amigaos*)
 $spitshell >>$Makefile <<'!NO!SUBS!'
 -perlmain.c: $(MINIPERL_EXE) ext/ExtUtils-Miniperl/pm_to_blib
 -	$(MINIPERL) -MExtUtils::Miniperl -e 'writemain(\\"perlmain.c", @ARGV)' DynaLoader $(static_ext)
 +perlmain.c: $(MINIPERL_EXE) $(CONFIGPM) ext/ExtUtils-Miniperl/lib/ExtUtils/Miniperl.pm
 +	$(MINIPERL) -Iext/ExtUtils-Miniperl/lib -MExtUtils::Miniperl -e 'writemain(\\"perlmain.c", @ARGV)' DynaLoader $(static_ext)
 # The file ext.libs is a list of libraries that must be linked in
 # for static extensions, e.g. -lm -lgdbm, etc.  The individual
@@ -829,18 +885,24 @@
 ext.libs: $(static_ext)
 	-@test -f ext.libs || touch ext.libs
 +dist/XSLoader/XSLoader.pm: $(MINIPERL_EXE) $(CONFIGPM) dist/XSLoader/XSLoader_pm.PL
 +	cd dist/XSLoader && ../../$(MINIPERL_EXE) -I../../lib XSLoader_pm.PL
 +
 !NO!SUBS!
 ;;
 *)
 $spitshell >>$Makefile <<'!NO!SUBS!'
 -perlmain.c: $(MINIPERL_EXE) ext/ExtUtils-Miniperl/pm_to_blib
 -	$(MINIPERL) -MExtUtils::Miniperl -e 'writemain(\"perlmain.c", @ARGV)' DynaLoader $(static_ext)
 +perlmain.c: $(MINIPERL_EXE) $(CONFIGPM) ext/ExtUtils-Miniperl/lib/ExtUtils/Miniperl.pm
 +	$(MINIPERL) -Iext/ExtUtils-Miniperl/lib -MExtUtils::Miniperl -e 'writemain(\"perlmain.c", @ARGV)' DynaLoader $(static_ext)
 # The file ext.libs is a list of libraries that must be linked in
 # for static extensions, e.g. -lm -lgdbm, etc.  The individual
 # static extension Makefile's add to it.
 ext.libs: $(static_ext)
 	-@test -f ext.libs || touch ext.libs
 +
 +dist/XSLoader/XSLoader.pm: $(MINIPERL_EXE) $(CONFIGPM) dist/XSLoader/XSLoader_pm.PL
 +	cd dist/XSLoader && ../../$(MINIPERL_EXE) -I../../lib XSLoader_pm.PL
 !NO!SUBS!
 ;;
@@ -1130,11 +1192,12 @@
 #	can in this makefile to decide if needs to run or not
 #	touch uni.data
 -# $(PERL_EXE) and ext because pod_lib.pl needs Digest::MD5
 -# But also this ensures that all extensions are built before we try to scan
 +# Build this with miniperl plus the same expanded \@INC as RUN_PERL so
 +# File::Spec can load PathTools without needing the XS Cwd extension.
 +# $(ext) still ensures that all extensions are built before we try to scan
 # them, which picks up Devel::PPPort's documentation.
 -pod/perltoc.pod: $(perltoc_pod_prereqs) $(PERL_EXE) $(ext) pod/buildtoc
 -	$(RUN_PERL) -f pod/buildtoc -q
 +pod/perltoc.pod: $(perltoc_pod_prereqs) $(MINIPERL_EXE) $(ext) pod/buildtoc
 +	$(RUN_MINIPERL) -f pod/buildtoc -q
 pod/perlapi.pod: pod/perlintern.pod
@@ -1300,11 +1363,11 @@
 .PHONY:	manisort manicheck
 manisort:	FORCE
 -	@perl Porting/manisort -q || (echo "WARNING: re-sorting MANIFEST"; \
 -		perl Porting/manisort -q -o MANIFEST; sh -c true)
 +	@$(RUN_PERL) Porting/manisort -q || (echo "WARNING: re-sorting MANIFEST"; \
 +		$(RUN_PERL) Porting/manisort -q -o MANIFEST; sh -c true)
 manicheck:	FORCE
 -	perl Porting/manicheck
 +	$(RUN_PERL) Porting/manicheck
 # Extensions:
 # Names added to $(dynamic_ext) or $(static_ext) or $(nonxs_ext) will
 --- a/write_buildcustomize.pl
 +++ b/write_buildcustomize.pl
@@ -47,15 +47,16 @@
     cpan/Getopt-Long/lib
     cpan/Text-ParseWords/lib
     cpan/ExtUtils-PL2Bat/lib
 +    cpan/parent/lib
 +    dist/ExtUtils-ParseXS/lib
 +    dist/base/lib
 +    dist/XSLoader
 );
 # These are for XS building on Win32, since nonxs and xs build simultaneously
 # on Win32 if parallel building
 push @toolchain, qw(
 -    dist/ExtUtils-ParseXS/lib
 -    cpan/parent/lib
     cpan/ExtUtils-Constant/lib
 -    dist/base/lib
 ) if $^O eq 'MSWin32';
 push @toolchain, 'ext/VMS-Filespec/lib' if $^O eq 'VMS';
@@ -0,0 +1,32 @@
 diff -Naur a/Modules/_ssl.c b/Modules/_ssl.c
 --- a/Modules/_ssl.c	2026-04-07 08:13:20.000000000 -0500
 +++ b/Modules/_ssl.c	2026-04-19 17:40:55.497794723 -0500
@@ -909,6 +909,7 @@
 #undef SID_CTX
     }
 +#ifndef LIBRESSL_VERSION_NUMBER
     /* bpo43522 and OpenSSL < 1.1.1l: copy hostflags manually */
 #if OPENSSL_VERSION_NUMBER < 0x101010cf
     X509_VERIFY_PARAM *ssl_verification_params = SSL_get0_param(self->ssl);
@@ -917,6 +918,7 @@
     unsigned int ssl_ctx_host_flags = X509_VERIFY_PARAM_get_hostflags(ssl_ctx_verification_params);
     X509_VERIFY_PARAM_set_hostflags(ssl_verification_params, ssl_ctx_host_flags);
 #endif
 +#endif
     SSL_set_app_data(self->ssl, self);
     if (sock) {
         SSL_set_fd(self->ssl, Py_SAFE_DOWNCAST(sock->sock_fd, SOCKET_T, int));
@@ -3875,7 +3877,11 @@
     unsigned int host_flags;
     ssl_verification_params = SSL_CTX_get0_param(self->ctx);
 -    host_flags = X509_VERIFY_PARAM_get_hostflags(ssl_verification_params);
 +#ifdef LIBRESSL_VERSION_NUMBER
 +    host_flags = 0;
 +#else
 +        host_flags = X509_VERIFY_PARAM_get_hostflags(ssl_verification_params);
 +#endif
     return PyLong_FromUnsignedLong(host_flags);
 }
@@ -0,0 +1,682 @@
 diff --git a/src/network/ssl/qdtls_openssl.cpp b/src/network/ssl/qdtls_openssl.cpp
 index ede9595f197..e8af73acfb9 100644
 --- a/src/network/ssl/qdtls_openssl.cpp
 +++ b/src/network/ssl/qdtls_openssl.cpp
@@ -267,6 +267,7 @@ extern "C" int q_X509DtlsCallback(int ok, X509_STORE_CTX *ctx)
     return 1;
 }
 +#ifndef OPENSSL_NO_PSK
 extern "C" unsigned q_PSK_client_callback(SSL *ssl, const char *hint, char *identity,
                                           unsigned max_identity_len, unsigned char *psk,
                                           unsigned max_psk_len)
@@ -291,6 +292,7 @@ extern "C" unsigned q_PSK_server_callback(SSL *ssl, const char *identity, unsign
     Q_ASSERT(dtls->dtlsPrivate);
     return dtls->dtlsPrivate->pskServerCallback(identity, psk, max_psk_len);
 }
 +#endif // OPENSSL_NO_PSK
 } // namespace dtlscallbacks
@@ -551,18 +553,24 @@ extern "C" long q_dgram_ctrl(BIO *bio, int cmd, long num, void *ptr)
     case BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT:
         // DTLSTODO: I'm not sure yet, how it's used by OpenSSL.
         return 1;
 +#ifdef BIO_CTRL_DGRAM_SET_DONT_FRAG
     case BIO_CTRL_DGRAM_SET_DONT_FRAG:
         qDtlsDebug("BIO_CTRL_DGRAM_SET_DONT_FRAG");
         // To be done in QUdpSocket, it's about IP_DONTFRAG etc.
         return 1;
 +#endif // BIO_CTRL_DGRAM_SET_DONT_FRAG
 +#ifdef BIO_CTRL_DGRAM_GET_MTU_OVERHEAD
     case BIO_CTRL_DGRAM_GET_MTU_OVERHEAD:
         // AFAIK it's 28 for IPv4 and 48 for IPv6, but let's pretend it's 0
         // so that OpenSSL does not start suddenly fragmenting the first
         // client hello (which will result in DTLSv1_listen rejecting it).
         return 0;
 +#endif // BIO_CTRL_DGRAM_GET_MTU_OVERHEAD
 +#ifdef BIO_CTRL_DGRAM_SET_PEEK_MODE
     case BIO_CTRL_DGRAM_SET_PEEK_MODE:
         dtls->peeking = num;
         return 1;
 +#endif // BIO_CTRL_DGRAM_SET_PEEK_MODE
     default:;
 #if QT_DTLS_VERBOSE
         qWarning() << "Unexpected cmd (" << cmd << ")";
@@ -702,12 +710,16 @@ bool DtlsState::initCtxAndConnection(QDtlsBasePrivate *dtlsBase)
     }
     if (dtlsBase->mode == QSslSocket::SslServerMode) {
 -        if (dtlsBase->dtlsConfiguration.dtlsCookieEnabled)
 -            q_SSL_set_options(newConnection.data(), SSL_OP_COOKIE_EXCHANGE);
 -        q_SSL_set_psk_server_callback(newConnection.data(), dtlscallbacks::q_PSK_server_callback);
 -    } else {
 -        q_SSL_set_psk_client_callback(newConnection.data(), dtlscallbacks::q_PSK_client_callback);
 -    }
 +    if (dtlsBase->dtlsConfiguration.dtlsCookieEnabled)
 +        q_SSL_set_options(newConnection.data(), SSL_OP_COOKIE_EXCHANGE);
 +#ifndef OPENSSL_NO_PSK
 +    q_SSL_set_psk_server_callback(newConnection.data(), dtlscallbacks::q_PSK_server_callback);
 +#endif // OPENSSL_NO_PSK
 +} else {
 +#ifndef OPENSSL_NO_PSK
 +    q_SSL_set_psk_client_callback(newConnection.data(), dtlscallbacks::q_PSK_client_callback);
 +#endif // OPENSSL_NO_PSK
 +}
     tlsContext.swap(newContext);
     tlsConnection.swap(newConnection);
 diff --git a/src/network/ssl/qsslcertificate_openssl.cpp b/src/network/ssl/qsslcertificate_openssl.cpp
 index d1794d4dbd7..1f1aa5edb36 100644
 --- a/src/network/ssl/qsslcertificate_openssl.cpp
 +++ b/src/network/ssl/qsslcertificate_openssl.cpp
@@ -727,7 +727,7 @@ static QMultiMap<QByteArray, QString> _q_mapFromX509Name(X509_NAME *name)
         unsigned char *data = nullptr;
         int size = q_ASN1_STRING_to_UTF8(&data, q_X509_NAME_ENTRY_get_data(e));
         info.insert(name, QString::fromUtf8((char*)data, size));
 -#if QT_CONFIG(opensslv11)
 +#if QT_CONFIG(opensslv11) && !defined(LIBRESSL_VERSION_NUMBER)
         q_CRYPTO_free(data, nullptr, 0);
 #else
         q_CRYPTO_free(data);
 diff --git a/src/network/ssl/qsslcontext_openssl.cpp b/src/network/ssl/qsslcontext_openssl.cpp
 index e4bb61ecb57..325ea3b58f8 100644
 --- a/src/network/ssl/qsslcontext_openssl.cpp
 +++ b/src/network/ssl/qsslcontext_openssl.cpp
@@ -54,12 +54,14 @@
 QT_BEGIN_NAMESPACE
 +#ifdef SSL_SECOP_PEER
 Q_GLOBAL_STATIC(bool, forceSecurityLevel)
 Q_NETWORK_EXPORT void qt_ForceTlsSecurityLevel()
 {
     *forceSecurityLevel() = true;
 }
 +#endif //SSL_SECOP_PEER
 // defined in qsslsocket_openssl.cpp:
 extern int q_X509Callback(int ok, X509_STORE_CTX *ctx);
@@ -351,9 +353,11 @@ init_context:
         return;
     }
 +#ifdef SSL_SECOP_PEER
     // A nasty hacked OpenSSL using a level that will make our auto-tests fail:
     if (q_SSL_CTX_get_security_level(sslContext->ctx) > 1 && *forceSecurityLevel())
         q_SSL_CTX_set_security_level(sslContext->ctx, 1);
 +#endif //SSL_SECOP_PEER
     const long anyVersion =
 #if QT_CONFIG(dtls)
@@ -408,16 +412,28 @@ init_context:
         maxVersion = DTLS1_VERSION;
         break;
     case QSsl::DtlsV1_0OrLater:
 +#ifdef DTLS_MAX_VERSION
         minVersion = DTLS1_VERSION;
         maxVersion = 0;
 +#else
 +        Q_UNREACHABLE();
 +#endif // DTLS_MAX_VERSION
         break;
     case QSsl::DtlsV1_2:
 +#ifdef DTLS1_2_VERSION
         minVersion = DTLS1_2_VERSION;
         maxVersion = DTLS1_2_VERSION;
 +#else
 +        Q_UNREACHABLE();
 +#endif // DTLS1_2_VERSION
         break;
     case QSsl::DtlsV1_2OrLater:
 +#if defined(DTLS1_2_VERSION)
         minVersion = DTLS1_2_VERSION;
         maxVersion = 0;
 +#else
 +        Q_UNREACHABLE();
 +#endif // DTLS1_2_VERSION
         break;
     case QSsl::TlsV1_3OrLater:
 #ifdef TLS1_3_VERSION
@@ -722,6 +738,7 @@ void QSslContext::applyBackendConfig(QSslContext *sslContext)
     }
 #endif // ocsp
 +#ifndef LIBRESSL_VERSION_NUMBER
     QSharedPointer<SSL_CONF_CTX> cctx(q_SSL_CONF_CTX_new(), &q_SSL_CONF_CTX_free);
     if (cctx) {
         q_SSL_CONF_CTX_set_ssl_ctx(cctx.data(), sslContext->ctx);
@@ -768,7 +785,9 @@ void QSslContext::applyBackendConfig(QSslContext *sslContext)
             sslContext->errorStr = msgErrorSettingBackendConfig(QSslSocket::tr("SSL_CONF_finish() failed"));
             sslContext->errorCode = QSslError::UnspecifiedError;
         }
 -    } else {
 +    } else
 +#endif // LIBRESSL_VERSION_NUMBER
 +    {
         sslContext->errorStr = msgErrorSettingBackendConfig(QSslSocket::tr("SSL_CONF_CTX_new() failed"));
         sslContext->errorCode = QSslError::UnspecifiedError;
     }
 diff --git a/src/network/ssl/qsslcontext_openssl_p.h b/src/network/ssl/qsslcontext_openssl_p.h
 index 70cb97aad82..01a61cf5352 100644
 --- a/src/network/ssl/qsslcontext_openssl_p.h
 +++ b/src/network/ssl/qsslcontext_openssl_p.h
@@ -61,6 +61,13 @@
 QT_BEGIN_NAMESPACE
 +#ifndef DTLS_ANY_VERSION
 +#define DTLS_ANY_VERSION 0x1FFFF
 +#endif
 +#ifndef TLS_ANY_VERSION
 +#define TLS_ANY_VERSION 0x10000
 +#endif
 +
 #ifndef QT_NO_SSL
 class QSslContextPrivate;
 diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp
 index 8f6858c867a..8292cec8b3c 100644
 --- a/src/network/ssl/qsslsocket_openssl.cpp
 +++ b/src/network/ssl/qsslsocket_openssl.cpp
@@ -246,6 +246,12 @@ static int q_ssl_psk_use_session_callback(SSL *ssl, const EVP_MD *md, const unsi
     return 1; // need to return 1 or else "the connection setup fails."
 }
 +#endif // TLS1_3_VERSION
 +
 +#endif // !OPENSSL_NO_PSK
 +
 +#if (!defined(OPENSSL_NO_PSK) || defined(LIBRESSL_VERSION_NUMBER)) \
 +&& defined(TLS1_3_VERSION)
 int q_ssl_sess_set_new_cb(SSL *ssl, SSL_SESSION *session)
 {
     if (!ssl) {
@@ -261,9 +267,7 @@ int q_ssl_sess_set_new_cb(SSL *ssl, SSL_SESSION *session)
                                                                  QSslSocketBackendPrivate::s_indexForSSLExtraData));
     return socketPrivate->handleNewSessionTicket(ssl);
 }
 -#endif // TLS1_3_VERSION
 -
 -#endif // !OPENSSL_NO_PSK
 +#endif
 #if QT_CONFIG(ocsp)
@@ -675,7 +679,7 @@ bool QSslSocketBackendPrivate::initSslContext()
     else if (mode == QSslSocket::SslServerMode)
         q_SSL_set_psk_server_callback(ssl, &q_ssl_psk_server_callback);
 -#if OPENSSL_VERSION_NUMBER >= 0x10101006L
 +#if OPENSSL_VERSION_NUMBER >= 0x10101006L && !defined(LIBRESSL_VERSION_NUMBER)
     // Set the client callback for TLSv1.3 PSK
     if (mode == QSslSocket::SslClientMode
         && QSslSocket::sslLibraryBuildVersionNumber() >= 0x10101006L) {
 diff --git a/src/network/ssl/qsslsocket_openssl_symbols.cpp b/src/network/ssl/qsslsocket_openssl_symbols.cpp
 index 6a9a3ef3b3f..a7c112c367e 100644
 --- a/src/network/ssl/qsslsocket_openssl_symbols.cpp
 +++ b/src/network/ssl/qsslsocket_openssl_symbols.cpp
@@ -142,14 +142,21 @@ DEFINEFUNC2(int, OPENSSL_init_ssl, uint64_t opts, opts, const OPENSSL_INIT_SETTI
 DEFINEFUNC2(int, OPENSSL_init_crypto, uint64_t opts, opts, const OPENSSL_INIT_SETTINGS *settings, settings, return 0, return)
 DEFINEFUNC(BIO *, BIO_new, const BIO_METHOD *a, a, return nullptr, return)
 DEFINEFUNC(const BIO_METHOD *, BIO_s_mem, void, DUMMYARG, return nullptr, return)
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
 DEFINEFUNC2(int, BN_is_word, BIGNUM *a, a, BN_ULONG w, w, return 0, return)
 +#endif
 DEFINEFUNC(int, EVP_CIPHER_CTX_reset, EVP_CIPHER_CTX *c, c, return 0, return)
 DEFINEFUNC(int, EVP_PKEY_up_ref, EVP_PKEY *a, a, return 0, return)
 +#ifdef OPENSSL_NO_DEPRECATED_3_0
 DEFINEFUNC2(EVP_PKEY_CTX *, EVP_PKEY_CTX_new, EVP_PKEY *pkey, pkey, ENGINE *e, e, return nullptr, return)
 DEFINEFUNC(int, EVP_PKEY_param_check, EVP_PKEY_CTX *ctx, ctx, return 0, return)
 DEFINEFUNC(void, EVP_PKEY_CTX_free, EVP_PKEY_CTX *ctx, ctx, return, return)
 +#endif // OPENSSL_NO_DEPRECATED_3_0
 DEFINEFUNC(int, RSA_bits, RSA *a, a, return 0, return)
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
 DEFINEFUNC(int, DSA_bits, DSA *a, a, return 0, return)
 +#endif
 +#if !defined(LIBRESSL_VERSION_NUMBER)
 DEFINEFUNC(int, OPENSSL_sk_num, OPENSSL_STACK *a, a, return -1, return)
 DEFINEFUNC2(void, OPENSSL_sk_pop_free, OPENSSL_STACK *a, a, void (*b)(void*), b, return, DUMMYARG)
 DEFINEFUNC(OPENSSL_STACK *, OPENSSL_sk_new_null, DUMMYARG, DUMMYARG, return nullptr, return)
@@ -158,8 +165,18 @@ DEFINEFUNC(void, OPENSSL_sk_free, OPENSSL_STACK *a, a, return, DUMMYARG)
 DEFINEFUNC2(void *, OPENSSL_sk_value, OPENSSL_STACK *a, a, int b, b, return nullptr, return)
 DEFINEFUNC(int, SSL_session_reused, SSL *a, a, return 0, return)
 DEFINEFUNC2(qssloptions, SSL_CTX_set_options, SSL_CTX *ctx, ctx, qssloptions op, op, return 0, return)
 +#else
 +DEFINEFUNC(int, sk_num, STACK *a, a, return -1, return)
 +DEFINEFUNC2(void, sk_pop_free, STACK *a, a, void (*b)(void*), b, return, DUMMYARG)
 +DEFINEFUNC(_STACK *, sk_new_null, DUMMYARG, DUMMYARG, return nullptr, return)
 +DEFINEFUNC2(void, sk_push, _STACK *a, a, void *b, b, return, DUMMYARG)
 +DEFINEFUNC(void, sk_free, _STACK *a, a, return, DUMMYARG)
 +DEFINEFUNC2(void *, sk_value, STACK *a, a, int b, b, return nullptr, return)
 +#endif // LIBRESSL_VERSION_NUMBER
 +#ifdef SSL_SECOP_PEER
 DEFINEFUNC(int, SSL_CTX_get_security_level, const SSL_CTX *ctx, ctx, return -1, return)
 DEFINEFUNC2(void, SSL_CTX_set_security_level, SSL_CTX *ctx, ctx, int level, level, return, return)
 +#endif //SSL_SECOP_PEER
 #ifdef TLS1_3_VERSION
 DEFINEFUNC2(int, SSL_CTX_set_ciphersuites, SSL_CTX *ctx, ctx, const char *str, str, return 0, return)
 DEFINEFUNC2(void, SSL_set_psk_use_session_callback, SSL *ssl, ssl, q_SSL_psk_use_session_cb_func_t callback, callback, return, DUMMYARG)
@@ -169,7 +186,9 @@ DEFINEFUNC(int, SSL_SESSION_is_resumable, const SSL_SESSION *s, s, return 0, ret
 DEFINEFUNC3(size_t, SSL_get_client_random, SSL *a, a, unsigned char *out, out, size_t outlen, outlen, return 0, return)
 DEFINEFUNC3(size_t, SSL_SESSION_get_master_key, const SSL_SESSION *ses, ses, unsigned char *out, out, size_t outlen, outlen, return 0, return)
 DEFINEFUNC6(int, CRYPTO_get_ex_new_index, int class_index, class_index, long argl, argl, void *argp, argp, CRYPTO_EX_new *new_func, new_func, CRYPTO_EX_dup *dup_func, dup_func, CRYPTO_EX_free *free_func, free_func, return -1, return)
 +#ifndef LIBRESSL_VERSION_NUMBER
 DEFINEFUNC2(unsigned long, SSL_set_options, SSL *ssl, ssl, unsigned long op, op, return 0, return)
 +#endif
 DEFINEFUNC(const SSL_METHOD *, TLS_method, DUMMYARG, DUMMYARG, return nullptr, return)
 DEFINEFUNC(const SSL_METHOD *, TLS_client_method, DUMMYARG, DUMMYARG, return nullptr, return)
@@ -185,7 +204,23 @@ DEFINEFUNC2(void, X509_STORE_set_verify_cb, X509_STORE *a, a, X509_STORE_CTX_ver
 DEFINEFUNC3(int, X509_STORE_set_ex_data, X509_STORE *a, a, int idx, idx, void *data, data, return 0, return)
 DEFINEFUNC2(void *, X509_STORE_get_ex_data, X509_STORE *r, r, int idx, idx, return nullptr, return)
 DEFINEFUNC(STACK_OF(X509) *, X509_STORE_CTX_get0_chain, X509_STORE_CTX *a, a, return nullptr, return)
 -DEFINEFUNC3(void, CRYPTO_free, void *str, str, const char *file, file, int line, line, return, DUMMYARG)
 +#if defined(QT_LINKED_OPENSSL)
 +void q_CRYPTO_free(void *str, const char *, int)
 +{
 +    OPENSSL_free(str);
 +}
 +#else
 +typedef void (*_q_PTR_CRYPTO_free)(void *str, const char *file, int line);
 +static _q_PTR_CRYPTO_free _q_CRYPTO_free = nullptr;
 +void q_CRYPTO_free(void *str, const char *file, int line)
 +{
 +    if (Q_UNLIKELY(!_q_CRYPTO_free)) {
 +        qsslSocketUnresolvedSymbolWarning("CRYPTO_free");
 +        return;
 +    }
 +    _q_CRYPTO_free(str, file, line);
 +}
 +#endif // QT_LINKED_OPENSSL
 DEFINEFUNC(long, OpenSSL_version_num, void, DUMMYARG, return 0, return)
 DEFINEFUNC(const char *, OpenSSL_version, int a, a, return nullptr, return)
 DEFINEFUNC(unsigned long, SSL_SESSION_get_ticket_lifetime_hint, const SSL_SESSION *session, session, return 0, return)
@@ -193,9 +228,25 @@ DEFINEFUNC4(void, DH_get0_pqg, const DH *dh, dh, const BIGNUM **p, p, const BIGN
 DEFINEFUNC(int, DH_bits, DH *dh, dh, return 0, return)
 #if QT_CONFIG(dtls)
 +#if !defined(LIBRESSL_VERSION_NUMBER) || defined(BIO_F_BIO_ADDR_NEW)
 DEFINEFUNC2(int, DTLSv1_listen, SSL *s, s, BIO_ADDR *c, c, return -1, return)
 DEFINEFUNC(BIO_ADDR *, BIO_ADDR_new, DUMMYARG, DUMMYARG, return nullptr, return)
 DEFINEFUNC(void, BIO_ADDR_free, BIO_ADDR *ap, ap, return, DUMMYARG)
 +#else
 +int q_DTLSv1_listen(SSL *, BIO_ADDR *)
 +{
 +    return -1;
 +}
 +
 +BIO_ADDR *q_BIO_ADDR_new()
 +{
 +    return nullptr;
 +}
 +
 +void q_BIO_ADDR_free(BIO_ADDR *)
 +{
 +}
 +#endif // !LIBRESSL_VERSION_NUMBER || BIO_F_BIO_ADDR_NEW
 DEFINEFUNC2(BIO_METHOD *, BIO_meth_new, int type, type, const char *name, name, return nullptr, return)
 DEFINEFUNC(void, BIO_meth_free, BIO_METHOD *biom, biom, return, DUMMYARG)
 DEFINEFUNC2(int, BIO_meth_set_write, BIO_METHOD *biom, biom, DgramWriteCallback write, write, return 0, return)
@@ -225,7 +276,9 @@ DEFINEFUNC5(int, OCSP_id_get0_info, ASN1_OCTET_STRING **piNameHash, piNameHash,
             ASN1_OCTET_STRING **piKeyHash, piKeyHash, ASN1_INTEGER **pserial, pserial, OCSP_CERTID *cid, cid,
             return 0, return)
 DEFINEFUNC2(OCSP_RESPONSE *, OCSP_response_create, int status, status, OCSP_BASICRESP *bs, bs, return nullptr, return)
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
 DEFINEFUNC(const STACK_OF(X509) *, OCSP_resp_get0_certs, const OCSP_BASICRESP *bs, bs, return nullptr, return)
 +#endif
 DEFINEFUNC2(int, OCSP_id_cmp, OCSP_CERTID *a, a, OCSP_CERTID *b, b, return -1, return)
 DEFINEFUNC7(OCSP_SINGLERESP *, OCSP_basic_add1_status, OCSP_BASICRESP *r, r, OCSP_CERTID *c, c, int s, s,
             int re, re, ASN1_TIME *rt, rt, ASN1_TIME *t, t, ASN1_TIME *n, n, return nullptr, return)
@@ -358,12 +411,14 @@ DEFINEFUNC2(int, SSL_CTX_use_PrivateKey, SSL_CTX *a, a, EVP_PKEY *b, b, return -
 DEFINEFUNC2(int, SSL_CTX_use_RSAPrivateKey, SSL_CTX *a, a, RSA *b, b, return -1, return)
 DEFINEFUNC3(int, SSL_CTX_use_PrivateKey_file, SSL_CTX *a, a, const char *b, b, int c, c, return -1, return)
 DEFINEFUNC(X509_STORE *, SSL_CTX_get_cert_store, const SSL_CTX *a, a, return nullptr, return)
 +#ifndef LIBRESSL_VERSION_NUMBER
 DEFINEFUNC(SSL_CONF_CTX *, SSL_CONF_CTX_new, DUMMYARG, DUMMYARG, return nullptr, return);
 DEFINEFUNC(void, SSL_CONF_CTX_free, SSL_CONF_CTX *a, a, return ,return);
 DEFINEFUNC2(void, SSL_CONF_CTX_set_ssl_ctx, SSL_CONF_CTX *a, a, SSL_CTX *b, b, return, return);
 DEFINEFUNC2(unsigned int, SSL_CONF_CTX_set_flags, SSL_CONF_CTX *a, a, unsigned int b, b, return 0, return);
 DEFINEFUNC(int, SSL_CONF_CTX_finish, SSL_CONF_CTX *a, a, return 0, return);
 DEFINEFUNC3(int, SSL_CONF_cmd, SSL_CONF_CTX *a, a, const char *b, b, const char *c, c, return 0, return);
 +#endif
 DEFINEFUNC(void, SSL_free, SSL *a, a, return, DUMMYARG)
 DEFINEFUNC(STACK_OF(SSL_CIPHER) *, SSL_get_ciphers, const SSL *a, a, return nullptr, return)
 DEFINEFUNC(const SSL_CIPHER *, SSL_get_current_cipher, SSL *a, a, return nullptr, return)
@@ -388,7 +443,11 @@ DEFINEFUNC3(void, SSL_set_bio, SSL *a, a, BIO *b, b, BIO *c, c, return, DUMMYARG
 DEFINEFUNC(void, SSL_set_accept_state, SSL *a, a, return, DUMMYARG)
 DEFINEFUNC(void, SSL_set_connect_state, SSL *a, a, return, DUMMYARG)
 DEFINEFUNC(int, SSL_shutdown, SSL *a, a, return -1, return)
 +#ifndef LIBRESSL_VERSION_NUMBER
 DEFINEFUNC(int, SSL_in_init, const SSL *a, a, return 0, return)
 +#else
 +DEFINEFUNC(int, SSL_state, const SSL *a, a, return 0, return)
 +#endif
 DEFINEFUNC(int, SSL_get_shutdown, const SSL *ssl, ssl, return 0, return)
 DEFINEFUNC2(int, SSL_set_session, SSL* to, to, SSL_SESSION *session, session, return -1, return)
 DEFINEFUNC(void, SSL_SESSION_free, SSL_SESSION *ses, ses, return, DUMMYARG)
@@ -870,20 +929,35 @@ bool q_resolveOpenSslSymbols()
     RESOLVEFUNC(EVP_CIPHER_CTX_reset)
     RESOLVEFUNC(AUTHORITY_INFO_ACCESS_free)
     RESOLVEFUNC(EVP_PKEY_up_ref)
 +#ifdef OPENSSL_NO_DEPRECATED_3_0
     RESOLVEFUNC(EVP_PKEY_CTX_new)
     RESOLVEFUNC(EVP_PKEY_param_check)
     RESOLVEFUNC(EVP_PKEY_CTX_free)
 +#endif // OPENSSL_NO_DEPRECATED_3_0
     RESOLVEFUNC(RSA_bits)
 +#if !defined(LIBRESSL_VERSION_NUMBER)
     RESOLVEFUNC(OPENSSL_sk_new_null)
     RESOLVEFUNC(OPENSSL_sk_push)
     RESOLVEFUNC(OPENSSL_sk_free)
     RESOLVEFUNC(OPENSSL_sk_num)
     RESOLVEFUNC(OPENSSL_sk_pop_free)
     RESOLVEFUNC(OPENSSL_sk_value)
 +#else
 +    RESOLVEFUNC(sk_new_null)
 +    RESOLVEFUNC(sk_push)
 +    RESOLVEFUNC(sk_free)
 +    RESOLVEFUNC(sk_num)
 +    RESOLVEFUNC(sk_pop_free)
 +    RESOLVEFUNC(sk_value)
 +#endif
     RESOLVEFUNC(DH_get0_pqg)
 +#ifndef LIBRESSL_VERSION_NUMBER
     RESOLVEFUNC(SSL_CTX_set_options)
 +#endif
 +#ifdef SSL_SECOP_PEER
     RESOLVEFUNC(SSL_CTX_get_security_level)
     RESOLVEFUNC(SSL_CTX_set_security_level)
 +#endif //SSL_SECOP_PEER
 #ifdef TLS1_3_VERSION
     RESOLVEFUNC(SSL_CTX_set_ciphersuites)
     RESOLVEFUNC(SSL_set_psk_use_session_callback)
@@ -893,9 +967,13 @@ bool q_resolveOpenSslSymbols()
     RESOLVEFUNC(SSL_get_client_random)
     RESOLVEFUNC(SSL_SESSION_get_master_key)
 +#ifndef LIBRESSL_VERSION_NUMBER
     RESOLVEFUNC(SSL_session_reused)
 +#endif
     RESOLVEFUNC(SSL_get_session)
 +#ifndef LIBRESSL_VERSION_NUMBER
     RESOLVEFUNC(SSL_set_options)
 +#endif
     RESOLVEFUNC(CRYPTO_get_ex_new_index)
     RESOLVEFUNC(TLS_method)
     RESOLVEFUNC(TLS_client_method)
@@ -936,12 +1014,16 @@ bool q_resolveOpenSslSymbols()
     RESOLVEFUNC(SSL_SESSION_get_ticket_lifetime_hint)
     RESOLVEFUNC(DH_bits)
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
     RESOLVEFUNC(DSA_bits)
 +#endif
 #if QT_CONFIG(dtls)
 +#if !defined(LIBRESSL_VERSION_NUMBER) || defined(BIO_F_BIO_ADDR_NEW)
     RESOLVEFUNC(DTLSv1_listen)
     RESOLVEFUNC(BIO_ADDR_new)
     RESOLVEFUNC(BIO_ADDR_free)
 +#endif // !LIBRESSL_VERSION_NUMBER || BIO_F_BIO_ADDR_NEW
     RESOLVEFUNC(BIO_meth_new)
     RESOLVEFUNC(BIO_meth_free)
     RESOLVEFUNC(BIO_meth_set_write)
@@ -966,7 +1048,9 @@ bool q_resolveOpenSslSymbols()
     RESOLVEFUNC(OCSP_check_validity)
     RESOLVEFUNC(OCSP_cert_to_id)
     RESOLVEFUNC(OCSP_id_get0_info)
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
     RESOLVEFUNC(OCSP_resp_get0_certs)
 +#endif
     RESOLVEFUNC(OCSP_basic_sign)
     RESOLVEFUNC(OCSP_response_create)
     RESOLVEFUNC(i2d_OCSP_RESPONSE)
@@ -1003,7 +1087,9 @@ bool q_resolveOpenSslSymbols()
     RESOLVEFUNC(EC_GROUP_get_degree)
 #endif
     RESOLVEFUNC(BN_num_bits)
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
     RESOLVEFUNC(BN_is_word)
 +#endif
     RESOLVEFUNC(BN_mod_word)
     RESOLVEFUNC(DSA_new)
     RESOLVEFUNC(DSA_free)
@@ -1096,12 +1182,14 @@ bool q_resolveOpenSslSymbols()
     RESOLVEFUNC(SSL_CTX_use_RSAPrivateKey)
     RESOLVEFUNC(SSL_CTX_use_PrivateKey_file)
     RESOLVEFUNC(SSL_CTX_get_cert_store);
 +#ifndef LIBRESSL_VERSION_NUMBER
     RESOLVEFUNC(SSL_CONF_CTX_new);
     RESOLVEFUNC(SSL_CONF_CTX_free);
     RESOLVEFUNC(SSL_CONF_CTX_set_ssl_ctx);
     RESOLVEFUNC(SSL_CONF_CTX_set_flags);
     RESOLVEFUNC(SSL_CONF_CTX_finish);
     RESOLVEFUNC(SSL_CONF_cmd);
 +#endif
     RESOLVEFUNC(SSL_accept)
     RESOLVEFUNC(SSL_clear)
     RESOLVEFUNC(SSL_connect)
@@ -1129,7 +1217,11 @@ bool q_resolveOpenSslSymbols()
     RESOLVEFUNC(SSL_set_bio)
     RESOLVEFUNC(SSL_set_connect_state)
     RESOLVEFUNC(SSL_shutdown)
 +#ifndef LIBRESSL_VERSION_NUMBER
     RESOLVEFUNC(SSL_in_init)
 +#else
 +    RESOLVEFUNC(SSL_state)
 +#endif
     RESOLVEFUNC(SSL_get_shutdown)
     RESOLVEFUNC(SSL_set_session)
     RESOLVEFUNC(SSL_SESSION_free)
 diff --git a/src/network/ssl/qsslsocket_openssl_symbols_p.h b/src/network/ssl/qsslsocket_openssl_symbols_p.h
 index bf165f67ad0..08caa050b2e 100644
 --- a/src/network/ssl/qsslsocket_openssl_symbols_p.h
 +++ b/src/network/ssl/qsslsocket_openssl_symbols_p.h
@@ -72,6 +72,8 @@
 #include "qsslsocket_openssl_p.h"
 #include <QtCore/qglobal.h>
 +#include <openssl/bio.h>
 +
 #if QT_CONFIG(ocsp)
 #include "qocsp_p.h"
 #endif
@@ -80,6 +82,16 @@ QT_BEGIN_NAMESPACE
 #define DUMMYARG
 +#ifdef LIBRESSL_VERSION_NUMBER
 +typedef _STACK STACK;
 +typedef STACK OPENSSL_STACK;
 +typedef void OPENSSL_INIT_SETTINGS;
 +typedef int (*X509_STORE_CTX_verify_cb)(int ok,X509_STORE_CTX *ctx);
 +#ifndef BIO_F_BIO_ADDR_NEW
 +typedef struct bio_addr_st BIO_ADDR;
 +#endif
 +#endif
 +
 #if !defined QT_LINKED_OPENSSL
 // **************** Shared declarations ******************
 // ret func(arg)
@@ -230,21 +242,20 @@ const unsigned char * q_ASN1_STRING_get0_data(const ASN1_STRING *x);
 Q_AUTOTEST_EXPORT BIO *q_BIO_new(const BIO_METHOD *a);
 Q_AUTOTEST_EXPORT const BIO_METHOD *q_BIO_s_mem();
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
 int q_DSA_bits(DSA *a);
 +#else
 +#define q_DSA_bits(dsa) q_BN_num_bits((dsa)->p)
 +#endif
 void q_AUTHORITY_INFO_ACCESS_free(AUTHORITY_INFO_ACCESS *a);
 int q_EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c);
 Q_AUTOTEST_EXPORT int q_EVP_PKEY_up_ref(EVP_PKEY *a);
 +#ifdef OPENSSL_NO_DEPRECATED_3_0
 EVP_PKEY_CTX *q_EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e);
 void q_EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx);
 int q_EVP_PKEY_param_check(EVP_PKEY_CTX *ctx);
 +#endif // OPENSSL_NO_DEPRECATED_3_0
 int q_RSA_bits(RSA *a);
 -Q_AUTOTEST_EXPORT int q_OPENSSL_sk_num(OPENSSL_STACK *a);
 -Q_AUTOTEST_EXPORT void q_OPENSSL_sk_pop_free(OPENSSL_STACK *a, void (*b)(void *));
 -Q_AUTOTEST_EXPORT OPENSSL_STACK *q_OPENSSL_sk_new_null();
 -Q_AUTOTEST_EXPORT void q_OPENSSL_sk_push(OPENSSL_STACK *st, void *data);
 -Q_AUTOTEST_EXPORT void q_OPENSSL_sk_free(OPENSSL_STACK *a);
 -Q_AUTOTEST_EXPORT void * q_OPENSSL_sk_value(OPENSSL_STACK *a, int b);
 -int q_SSL_session_reused(SSL *a);
 #if OPENSSL_VERSION_MAJOR < 3
 using qssloptions = unsigned long;
@@ -252,7 +263,33 @@ using qssloptions = unsigned long;
 using qssloptions = uint64_t;
 #endif // OPENSSL_VERSION_MAJOR
 +#if !defined(LIBRESSL_VERSION_NUMBER)
 +Q_AUTOTEST_EXPORT int q_OPENSSL_sk_num(OPENSSL_STACK *a);
 +Q_AUTOTEST_EXPORT void q_OPENSSL_sk_pop_free(OPENSSL_STACK *a, void (*b)(void *));
 +Q_AUTOTEST_EXPORT OPENSSL_STACK *q_OPENSSL_sk_new_null();
 +Q_AUTOTEST_EXPORT void q_OPENSSL_sk_push(OPENSSL_STACK *st, void *data);
 +Q_AUTOTEST_EXPORT void q_OPENSSL_sk_free(OPENSSL_STACK *a);
 +Q_AUTOTEST_EXPORT void * q_OPENSSL_sk_value(OPENSSL_STACK *a, int b);
 +int q_SSL_session_reused(SSL *a);
 qssloptions q_SSL_CTX_set_options(SSL_CTX *ctx, qssloptions op);
 +#else // LIBRESSL_VERSION_NUMBER
 +int q_sk_num(STACK *a);
 +#define q_OPENSSL_sk_num(a) q_sk_num(a)
 +void q_sk_pop_free(STACK *a, void (*b)(void *));
 +#define q_OPENSSL_sk_pop_free(a, b) q_sk_pop_free(a, b)
 +STACK *q_sk_new_null();
 +#define q_OPENSSL_sk_new_null() q_sk_new_null()
 +void q_sk_push(STACK *st, void *data);
 +#define q_OPENSSL_sk_push(st, data) q_sk_push(st, data)
 +void q_sk_free(STACK *a);
 +#define q_OPENSSL_sk_free q_sk_free
 +void *q_sk_value(STACK *a, int b);
 +#define q_OPENSSL_sk_value(a, b) q_sk_value(a, b)
 +#define q_SSL_session_reused(ssl) \
 +q_SSL_ctrl((ssl), SSL_CTRL_GET_SESSION_REUSED, 0, NULL)
 +#define q_SSL_CTX_set_options(ctx, op) \
 +q_SSL_CTX_ctrl((ctx), SSL_CTRL_OPTIONS, (op), NULL)
 +#endif // LIBRESSL_VERSION_NUMBER
 int q_OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings);
 size_t q_SSL_get_client_random(SSL *a, unsigned char *out, size_t outlen);
 size_t q_SSL_SESSION_get_master_key(const SSL_SESSION *session, unsigned char *out, size_t outlen);
@@ -278,8 +315,13 @@ int q_DH_bits(DH *dh);
 # define q_SSL_load_error_strings() q_OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS \
                                                        | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL)
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
 #define q_SKM_sk_num(st) q_OPENSSL_sk_num((OPENSSL_STACK *)st)
 #define q_SKM_sk_value(type, st,i) (type *)q_OPENSSL_sk_value((OPENSSL_STACK *)st, i)
 +#else
 +#define q_SKM_sk_num(st) q_sk_num((OPENSSL_STACK *)st)
 +#define q_SKM_sk_value(type, st,i) (type *)q_sk_value((OPENSSL_STACK *)st, i)
 +#endif // LIBRESSL_VERSION_NUMBER
 #define q_OPENSSL_add_all_algorithms_conf()  q_OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS \
                                                                    | OPENSSL_INIT_ADD_ALL_DIGESTS \
@@ -292,7 +334,12 @@ long q_OpenSSL_version_num();
 const char *q_OpenSSL_version(int type);
 unsigned long q_SSL_SESSION_get_ticket_lifetime_hint(const SSL_SESSION *session);
 +#ifndef LIBRESSL_VERSION_NUMBER
 unsigned long q_SSL_set_options(SSL *s, unsigned long op);
 +#else
 +#define q_SSL_set_options(ssl, op) \
 +q_SSL_ctrl((ssl), SSL_CTRL_OPTIONS, (op), NULL)
 +#endif
 #ifdef TLS1_3_VERSION
 int q_SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str);
@@ -381,7 +428,12 @@ BIO *q_BIO_new_mem_buf(void *a, int b);
 int q_BIO_read(BIO *a, void *b, int c);
 Q_AUTOTEST_EXPORT int q_BIO_write(BIO *a, const void *b, int c);
 int q_BN_num_bits(const BIGNUM *a);
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
 int q_BN_is_word(BIGNUM *a, BN_ULONG w);
 +#else
 +#define q_BN_is_word(a, w) (((((a)->top == 1) && ((a)->d[0] == (BN_ULONG)(w))) \
 +|| (((w) == 0) && ((a)->top == 0))) && (!(w) || !(a)->neg))
 +#endif
 BN_ULONG q_BN_mod_word(const BIGNUM *a, BN_ULONG w);
 #ifndef OPENSSL_NO_EC
@@ -515,12 +567,14 @@ int q_SSL_CTX_use_PrivateKey(SSL_CTX *a, EVP_PKEY *b);
 int q_SSL_CTX_use_RSAPrivateKey(SSL_CTX *a, RSA *b);
 int q_SSL_CTX_use_PrivateKey_file(SSL_CTX *a, const char *b, int c);
 X509_STORE *q_SSL_CTX_get_cert_store(const SSL_CTX *a);
 +#ifndef LIBRESSL_VERSION_NUMBER
 SSL_CONF_CTX *q_SSL_CONF_CTX_new();
 void q_SSL_CONF_CTX_free(SSL_CONF_CTX *a);
 void q_SSL_CONF_CTX_set_ssl_ctx(SSL_CONF_CTX *a, SSL_CTX *b);
 unsigned int q_SSL_CONF_CTX_set_flags(SSL_CONF_CTX *a, unsigned int b);
 int q_SSL_CONF_CTX_finish(SSL_CONF_CTX *a);
 int q_SSL_CONF_cmd(SSL_CONF_CTX *a, const char *b, const char *c);
 +#endif
 void q_SSL_free(SSL *a);
 STACK_OF(SSL_CIPHER) *q_SSL_get_ciphers(const SSL *a);
 const SSL_CIPHER *q_SSL_get_current_cipher(SSL *a);
@@ -536,7 +590,12 @@ void q_SSL_set_bio(SSL *a, BIO *b, BIO *c);
 void q_SSL_set_accept_state(SSL *a);
 void q_SSL_set_connect_state(SSL *a);
 int q_SSL_shutdown(SSL *a);
 +#ifndef LIBRESSL_VERSION_NUMBER
 int q_SSL_in_init(const SSL *s);
 +#else
 +int q_SSL_state(const SSL *s);
 +#define q_SSL_in_init(s) (q_SSL_state((s))&SSL_ST_INIT)
 +#endif
 int q_SSL_get_shutdown(const SSL *ssl);
 int q_SSL_set_session(SSL *to, SSL_SESSION *session);
 void q_SSL_SESSION_free(SSL_SESSION *ses);
@@ -695,9 +754,23 @@ void *q_X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx, int idx);
 int q_SSL_get_ex_data_X509_STORE_CTX_idx();
 #if QT_CONFIG(dtls)
 +#ifdef DTLS_CTRL_SET_LINK_MTU
 #define q_DTLS_set_link_mtu(ssl, mtu) q_SSL_ctrl((ssl), DTLS_CTRL_SET_LINK_MTU, (mtu), nullptr)
 +#else
 +#define q_DTLS_set_link_mtu(ssl, mtu) 0
 +#endif // DTLS_CTRL_SET_LINK_MTU
 +
 +#ifdef DTLS_CTRL_GET_TIMEOUT
 #define q_DTLSv1_get_timeout(ssl, arg) q_SSL_ctrl(ssl, DTLS_CTRL_GET_TIMEOUT, 0, arg)
 +#else
 +#define q_DTLSv1_get_timeout(ssl, arg) 0
 +#endif // DTLS_CTRL_GET_TIMEOUT
 +
 +#ifdef DTLS_CTRL_HANDLE_TIMEOUT
 #define q_DTLSv1_handle_timeout(ssl) q_SSL_ctrl(ssl, DTLS_CTRL_HANDLE_TIMEOUT, 0, nullptr)
 +#else
 +#define q_DTLSv1_handle_timeout(ssl) 0
 +#endif // DTLS_CTRL_HANDLE_TIMEOUT
 #endif // dtls
 void q_BIO_set_flags(BIO *b, int flags);
@@ -742,7 +815,11 @@ int q_OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, ASN1_GENERALIZEDTIME *n
 int q_OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd, ASN1_OCTET_STRING **pikeyHash,
                         ASN1_INTEGER **pserial, OCSP_CERTID *cid);
 +#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x03050000fL
 const STACK_OF(X509) *q_OCSP_resp_get0_certs(const OCSP_BASICRESP *bs);
 +#else
 +#define q_OCSP_resp_get0_certs(bs) ((bs)->certs)
 +#endif
 Q_AUTOTEST_EXPORT OCSP_CERTID *q_OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer);
 Q_AUTOTEST_EXPORT void q_OCSP_CERTID_free(OCSP_CERTID *cid);
 int q_OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
@@ -762,10 +839,13 @@ int q_OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b);
 void *q_CRYPTO_malloc(size_t num, const char *file, int line);
 #define q_OPENSSL_malloc(num) q_CRYPTO_malloc(num, "", 0)
 void q_CRYPTO_free(void *str, const char *file, int line);
 +inline void q_CRYPTO_free(void *str) { q_CRYPTO_free(str, "", 0); }
 #define q_OPENSSL_free(addr) q_CRYPTO_free(addr, "", 0)
 +#ifdef SSL_SECOP_PEER
 int q_SSL_CTX_get_security_level(const SSL_CTX *ctx);
 void q_SSL_CTX_set_security_level(SSL_CTX *ctx, int level);
 +#endif //SSL_SECOP_PEER
 QT_END_NAMESPACE
@@ -0,0 +1,74 @@
 --- a/src/bootstrap/src/core/config/config.rs
 +++ b/src/bootstrap/src/core/config/config.rs
@@ -628,7 +628,7 @@
             );
         }
 -        let bootstrap_override_lld =
 +        let mut bootstrap_override_lld =
             rust_bootstrap_override_lld.or(rust_bootstrap_override_lld_legacy).unwrap_or_default();
         if rust_optimize.as_ref().is_some_and(|v| matches!(v, RustOptimize::Bool(false))) {
@@ -978,6 +978,20 @@
         let is_host_system_llvm =
             is_system_llvm(&target_config, llvm_from_ci, host_target, host_target);
 +        // Self-contained bootstrap LLD comes from the stage0 sysroot (`rust-lld`), whose LLVM
 +        // version may differ from an externally configured host LLVM. In that case, linking LLVM
 +        // bitcode objects can fail with "Unknown attribute kind".
 +        if is_host_system_llvm
 +            && matches!(bootstrap_override_lld, BootstrapOverrideLld::SelfContained)
 +        {
 +            eprintln!(
 +                "WARNING: `rust.bootstrap-override-lld = \"self-contained\"` with external host \
 +                 `llvm-config` can cause LLVM bitcode version mismatches; falling back to \
 +                 `rust.bootstrap-override-lld = \"external\"` for bootstrap linking."
 +            );
 +            bootstrap_override_lld = BootstrapOverrideLld::External;
 +        }
 +
         if llvm_from_ci {
             let warn = |option: &str| {
                 println!(
@@ -1042,21 +1056,27 @@
             let default_linux_linker_override = match linker_override {
                 DefaultLinuxLinkerOverride::Off => continue,
                 DefaultLinuxLinkerOverride::SelfContainedLldCc => {
 -                    // If we automatically default to the self-contained LLD linker,
 -                    // we also need to handle the rust.lld option.
 -                    match rust_lld_enabled {
 -                        // If LLD was not enabled explicitly, we enable it, unless LLVM config has
 -                        // been set
 -                        None if !is_host_system_llvm => {
 -                            lld_enabled = true;
 -                            Some(DefaultLinuxLinkerOverride::SelfContainedLldCc)
 +                    // If bootstrap is explicitly using an external `lld` binary, do not also
 +                    // embed a self-contained rust-lld default into rustc's Linux target spec.
 +                    if matches!(bootstrap_override_lld, BootstrapOverrideLld::External) {
 +                        None
 +                    } else {
 +                        // If we automatically default to the self-contained LLD linker,
 +                        // we also need to handle the rust.lld option.
 +                        match rust_lld_enabled {
 +                            // If LLD was not enabled explicitly, we enable it, unless LLVM config has
 +                            // been set
 +                            None if !is_host_system_llvm => {
 +                                lld_enabled = true;
 +                                Some(DefaultLinuxLinkerOverride::SelfContainedLldCc)
 +                            }
 +                            None => None,
 +                            // If it was enabled already, we don't need to do anything
 +                            Some(true) => Some(DefaultLinuxLinkerOverride::SelfContainedLldCc),
 +                            // If it was explicitly disabled, we do not apply the
 +                            // linker override
 +                            Some(false) => None,
                         }
 -                        None => None,
 -                        // If it was enabled already, we don't need to do anything
 -                        Some(true) => Some(DefaultLinuxLinkerOverride::SelfContainedLldCc),
 -                        // If it was explicitly disabled, we do not apply the
 -                        // linker override
 -                        Some(false) => None,
                     }
                 }
             };
@@ -0,0 +1,14 @@
 --- a/compiler/rustc_llvm/llvm-wrapper/PassWrapper.cpp
 +++ b/compiler/rustc_llvm/llvm-wrapper/PassWrapper.cpp
@@ -23,7 +23,11 @@
 #include "llvm/MC/TargetRegistry.h"
 #include "llvm/Object/ObjectFile.h"
 #include "llvm/Passes/PassBuilder.h"
 +#if LLVM_VERSION_GE(22, 0)
 +#include "llvm/Plugins/PassPlugin.h"
 +#else
 #include "llvm/Passes/PassPlugin.h"
 +#endif
 #include "llvm/Passes/StandardInstrumentations.h"
 #include "llvm/Support/CBindingWrapping.h"
 #include "llvm/Support/FileSystem.h"
@@ -0,0 +1,13 @@
 --- a/compiler/rustc_target/src/spec/base/uefi_msvc.rs
 +++ b/compiler/rustc_target/src/spec/base/uefi_msvc.rs
@@ -45,7 +45,9 @@
         // "Windows".
         stack_probes: StackProbeType::Call,
         singlethread: true,
 -        linker: Some("rust-lld".into()),
 +        // Use the system LLD frontend name. Distro/toolchain builds that use an external LLVM
 +        // often do not ship a `rust-lld` wrapper binary.
 +        linker: Some("lld-link".into()),
         entry_name: "efi_main".into(),
         ..base
     }
@@ -0,0 +1,71 @@
 diff --git a/po/check_translations.sh b/po/check_translations.sh
 index 76562cb..146b810 100755
 --- a/po/check_translations.sh
 +++ b/po/check_translations.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # Go to po directory
 cd "$(dirname "${0}")" || exit 1
 diff --git a/tests/test_duplicate_mime_types.sh b/tests/test_duplicate_mime_types.sh
 index e7dfb15..1b1245b 100755
 --- a/tests/test_duplicate_mime_types.sh
 +++ b/tests/test_duplicate_mime_types.sh
@@ -1,20 +1,20 @@
 -#!/usr/bin/env bash
 -set -euo pipefail
 +#!/bin/sh
 +set -eu
 : ${1:?filename argument missing}
 xml_db_file="${1}"
 -test -f ${xml_db_file} || {
 -    printf "%s: no such file\n" ${xml_db_file} >&2
 +test -f "${xml_db_file}" || {
 +    printf '%s: no such file\n' "${xml_db_file}" >&2
     exit 1
 }
 duplicated=$(
     xmllint --xpath \
             "//*[local-name()='mime-type' or local-name()='alias']/@type" \
 -            ${xml_db_file} | tr ' ' '\n' | sort | uniq -d
 +            "${xml_db_file}" | tr ' ' '\n' | sort | uniq -d
 )
 -if [[ -n "${duplicated}" ]]; then
 +if [ -n "${duplicated}" ]; then
     echo "*************************************************************"
     echo "** Some mime-types are duplicated, fix before committing:  **"
     echo "${duplicated}"
 diff --git a/tests/test_generic_icons.sh b/tests/test_generic_icons.sh
 index de6c56f..41877f6 100755
 --- a/tests/test_generic_icons.sh
 +++ b/tests/test_generic_icons.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 xml_db_file="${1}"
 diff --git a/tests/test_mime.sh b/tests/test_mime.sh
 index 49c531b..b3e9fef 100755
 --- a/tests/test_mime.sh
 +++ b/tests/test_mime.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 set -e
 source_root="${1}"
 diff --git a/tests/test_staging.sh b/tests/test_staging.sh
 index a993dce..b62878c 100755
 --- a/tests/test_staging.sh
 +++ b/tests/test_staging.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 set -e
 source_root="${1}"
@@ -0,0 +1,19 @@
 --- a/Makefile	2025-10-14 11:45:35.000000000 -0500
 +++ b/Makefile	2026-04-19 19:05:43.860155683 -0500
@@ -7,7 +7,15 @@
 HOSTCC?=cc
 -export CROSS_COMPILE CFLAGS OPTIMIZE LDOPTIMIZE CC HOSTCC V STRIP ASAN
 +export CROSS_COMPILE?=
 +export CFLAGS?=
 +export OPTIMIZE?=
 +export LDOPTIMIZE?=
 +export CC?=
 +export HOSTCC?=
 +export V?=
 +export STRIP?=
 +export ASAN?=
 all: toybox
@@ -0,0 +1,468 @@
 --- a/configure
 +++ b/configure
@@ -1,10 +1,10 @@
 -#!/bin/bash
 +#!/bin/sh
 # set environment variables used by scripts/make.sh
 # People run ./configure out of habit, so do "defconfig" for them.
 -if [ "$(basename "$0")" == configure ]
 +if [ "$(basename "$0")" = configure ]
 then
   echo "Assuming you want 'make defconfig', but you should probably check the README."
   make defconfig
@@ -12,8 +12,12 @@
 fi
 # Warn about stuff, disable stupid warnings, be 8-bit clean for utf8.
 -[ "${CFLAGS/-funsigned-char//}" == "$CFLAGS" ] &&
 -  CFLAGS+=" -Wall -Wundef -Werror=implicit-function-declaration -Wno-char-subscripts -Wno-pointer-sign -funsigned-char"
 +case " ${CFLAGS-} " in
 +  *" -funsigned-char "*) ;;
 +  *)
 +    CFLAGS="${CFLAGS-} -Wall -Wundef -Werror=implicit-function-declaration -Wno-char-subscripts -Wno-pointer-sign -funsigned-char"
 +    ;;
 +esac
 # Set default values if variable not already set
 : ${CC:=cc} ${HOSTCC:=cc} ${GENDIR:=generated} ${KCONFIG_CONFIG:=.config}
 --- a/scripts/portability.sh
 +++ b/scripts/portability.sh
@@ -1,6 +1,6 @@
 # sourced to find alternate names for things
 -source ./configure
 +. ./configure
 if [ -z "$(command -v "$CROSS_COMPILE$CC")" ]
 then
@@ -8,15 +8,20 @@
   exit 1
 fi
 -if [ -z "$SED" ]
 +if [ -z "${SED:-}" ]
 then
 -  [ ! -z "$(command -v gsed 2>/dev/null)" ] && SED=gsed || SED=sed
 +  if command -v gsed >/dev/null 2>&1
 +  then
 +    SED=gsed
 +  else
 +    SED=sed
 +  fi
 fi
 # Tell linker to do dead code elimination at function level
 -if [ "$(uname)" == "Darwin" ]
 +if [ "$(uname)" = "Darwin" ]
 then
 -  CFLAGS+=" -Wno-deprecated-declarations"
 +  CFLAGS="${CFLAGS} -Wno-deprecated-declarations"
   : ${LDOPTIMIZE:=-Wl,-dead_strip} ${STRIP:=strip}
 else
   : ${LDOPTIMIZE:=-Wl,--gc-sections -Wl,--as-needed} ${STRIP:=strip -s -R .note* -R .comment}
@@ -24,9 +29,9 @@
 # Disable pointless warnings only clang produces
 [ -n "$("$CROSS_COMPILE$CC" --version | grep -w clang)" ] &&
 -  CFLAGS+=" -Wno-string-plus-int -Wno-invalid-source-encoding" ||
 +  CFLAGS="${CFLAGS} -Wno-string-plus-int -Wno-invalid-source-encoding" ||
 # And ones only gcc produces
 -  CFLAGS+=" -Wno-restrict -Wno-format-overflow"
 +  CFLAGS="${CFLAGS} -Wno-restrict -Wno-format-overflow"
 # Address Sanitizer
 if [ -n "$ASAN" ]; then
@@ -55,9 +60,10 @@
 # Run a C file from scripts/*.c using $HOSTCC as necessary
 brun() {
 -  [ ! -e "$UNSTRIPPED"/$1 -o "$UNSTRIPPED"/$1 -ot scripts/$1.c ] &&
 +  tool=$1
 +  shift
 +  [ ! -e "$UNSTRIPPED"/$tool -o "$UNSTRIPPED"/$tool -ot scripts/$tool.c ] &&
     { mkdir -p "$UNSTRIPPED" &&
 -      do_loudly $HOSTCC scripts/$1.c -o "$UNSTRIPPED"/$1 || exit 1; }
 -  do_loudly "$UNSTRIPPED"/$1 "${@:2}"
 +      do_loudly $HOSTCC scripts/$tool.c -o "$UNSTRIPPED"/$tool || exit 1; }
 +  do_loudly "$UNSTRIPPED"/$tool "$@"
 }
 -
 --- a/scripts/genconfig.sh
 +++ b/scripts/genconfig.sh
@@ -1,9 +1,9 @@
 -#!/bin/bash
 +#!/bin/sh
 # This has to be a separate file from scripts/make.sh so it can be called
 # before menuconfig. (It's called again from scripts/make.sh just to be sure.)
 -source scripts/portability.sh
 +. scripts/portability.sh
 mkdir -p "$GENDIR"
@@ -16,9 +16,11 @@
 # Symbol name is first argument, flags second, feed C file to stdin
 probesymbol()
 {
 -  probecc "${@:2}" 2>/dev/null && DEFAULT=y || DEFAULT=n
 +  symbol=$1
 +  shift
 +  probecc "$@" 2>/dev/null && DEFAULT=y || DEFAULT=n
   rm a.out 2>/dev/null
 -  echo -e "config $1\n\tbool\n\tdefault $DEFAULT\n" || exit 1
 +  printf 'config %s\n\tbool\n\tdefault %s\n\n' "$symbol" "$DEFAULT" || exit 1
 }
 probeconfig()
@@ -35,7 +37,7 @@
     #include <unistd.h>
     int main(int argc, char *argv[]) { return fork(); }
 EOF
 -  echo -e '\tdepends on !TOYBOX_FORCE_NOMMU'
 +  printf '\tdepends on !TOYBOX_FORCE_NOMMU\n'
 }
 genconfig()
@@ -77,20 +79,22 @@
 toys toys/*/*.c | (
 while IFS=":" read FILE NAME
 do
 -  echo -e "test_$NAME:\n\tscripts/test.sh $NAME\n"
 -  [ "$NAME" == help ] && continue
 -  [ "$NAME" == install ] && continue
 -  [ "$NAME" == sh ] && FILE="toys/*/*.c"
 -  echo -e "$NAME: $FILE *.[ch] lib/*.[ch]\n\tscripts/single.sh $NAME\n"
 -  [ "${FILE/example//}" != "$FILE" ] && EXAMPLE="$EXAMPLE $NAME" ||
 -  [ "${FILE/pending//}" != "$FILE" ] && PENDING="$PENDING $NAME" ||
 -    WORKING="$WORKING $NAME"
 +  printf 'test_%s:\n\tscripts/test.sh %s\n\n' "$NAME" "$NAME"
 +  [ "$NAME" = help ] && continue
 +  [ "$NAME" = install ] && continue
 +  [ "$NAME" = sh ] && FILE="toys/*/*.c"
 +  printf '%s: %s *.[ch] lib/*.[ch]\n\tscripts/single.sh %s\n\n' "$NAME" "$FILE" "$NAME"
 +  case $FILE in
 +    *example*) EXAMPLE="$EXAMPLE $NAME" ;;
 +    *pending*) PENDING="$PENDING $NAME" ;;
 +    *) WORKING="$WORKING $NAME" ;;
 +  esac
 done &&
 -echo -e "clean::\n\t@rm -f $WORKING $PENDING" &&
 -echo -e "list:\n\t@echo $(echo $WORKING | tr ' ' '\n' | sort | xargs)" &&
 -echo -e "list_example:\n\t@echo $(echo $EXAMPLE | tr ' ' '\n' | sort | xargs)"&&
 -echo -e "list_pending:\n\t@echo $(echo $PENDING | tr ' ' '\n' | sort | xargs)"&&
 -echo -e ".PHONY: $WORKING $PENDING" | $SED 's/ \([^ ]\)/ test_\1/g'
 +printf 'clean::\n\t@rm -f%s%s\n' "$WORKING" "$PENDING" &&
 +printf 'list:\n\t@echo %s\n' "$(echo "$WORKING" | tr ' ' '\n' | sort | xargs)" &&
 +printf 'list_example:\n\t@echo %s\n' "$(echo "$EXAMPLE" | tr ' ' '\n' | sort | xargs)" &&
 +printf 'list_pending:\n\t@echo %s\n' "$(echo "$PENDING" | tr ' ' '\n' | sort | xargs)" &&
 +printf '.PHONY:%s%s\n' "$WORKING" "$PENDING" | $SED 's/ \([^ ]\)/ test_\1/g'
 ) > .singlemake
 brun kconfig -h > "$GENDIR"/help.h || exit 1
 --- a/scripts/make.sh
 +++ b/scripts/make.sh
@@ -1,50 +1,16 @@
 -#!/bin/bash
 +#!/bin/sh
 # Grab default values for $CFLAGS and such.
 -set -o pipefail
 -source scripts/portability.sh
 -
 -# Shell functions called by the build
 -
 -DASHN=-n
 -true & wait -n 2>/dev/null || { wait; unset DASHN; }
 -ratelimit()
 -{
 -  if [ "$#" -eq 0 ]
 -  then
 -    [ -z "$DASHN" ] && PIDS="$PIDS$! "
 -    [ $((++COUNT)) -lt $CPUS ] && return 0
 -  fi
 -  ((--COUNT))
 -  if [ -n "$DASHN" ]
 -  then
 -    wait -n
 -    DONE=$(($DONE+$?))
 -  else
 -    # MacOS uses an ancient version of bash which hasn't got "wait -n", and
 -    # wait without arguments always returns 0 instead of process exit code.
 -    # This keeps $CPUS less busy when jobs finish out of order.
 -    wait ${PIDS%% *}
 -    DONE=$(($DONE+$?))
 -    PIDS=${PIDS#* }
 -  fi
 -
 -  return $DONE
 -}
 -
 -# Respond to V= by echoing command lines as well as running them
 -do_loudly()
 -{
 -  { [ -n "$V" ] && echo "$@" || echo -n "$DOTPROG" ; } >&2
 -  "$@"
 -}
 +. scripts/portability.sh
 # Is anything under directory $2 newer than generated/$1 (or does it not exist)?
 isnewer()
 {
 -  [ -e "$GENDIR/$1" ] && [ -z "$(find "${@:2}" -newer "$GENDIR/$1")" ] &&
 +  target=$1
 +  shift
 +  [ -e "$GENDIR/$target" ] && [ -z "$(find "$@" -newer "$GENDIR/$target")" ] &&
     return 1
 -  echo -n "${DIDNEWER:-$GENDIR/{}$1"
 +  printf '%s' "${DIDNEWER:-$GENDIR/{}}$target"
   DIDNEWER=,
 }
@@ -64,16 +30,18 @@
   [ -z "$V" ] && X=/dev/null || X=/dev/stderr
   for i in util crypt m resolv selinux smack attr crypto z log iconv tls ssl
   do
 -    do_loudly ${CROSS_COMPILE}${CC} $CFLAGS $LDFLAGS -xc - -l$i >>$X 2>&1 \
 -      -o /dev/null <<<"int main(int argc,char*argv[]){return 0;}" &&
 -      echo -l$i &
 +    printf '%s\n' 'int main(int argc,char*argv[]){return 0;}' |
 +      do_loudly ${CROSS_COMPILE}${CC} $CFLAGS $LDFLAGS -xc - -l$i >>$X 2>&1 \
 +      -o /dev/null && echo -l$i &
   done | sort | xargs
 )
 # Actually resolve dangling dependencies in extra libraries when static linking
 -[ -n "$LIBRARIES" ] && [ "$LDFLAGS" != "${LDFLAGS/-static/}" ] &&
 -  LIBRARIES="-Wl,--start-group $LIBRARIES -Wl,--end-group"
 +[ -n "$LIBRARIES" ] &&
 +case $LDFLAGS in
 +  *-static*) LIBRARIES="-Wl,--start-group $LIBRARIES -Wl,--end-group" ;;
 +esac
 -[ -z "$VERSION" ] && [ -d ".git" ] && [ -n "$(which git 2>/dev/null)" ] &&
 +[ -z "$VERSION" ] && [ -d ".git" ] && command -v git >/dev/null 2>&1 &&
   VERSION="$(git describe --tags --abbrev=12 2>/dev/null)"
 # Set/record build environment information
@@ -93,33 +61,42 @@
 # Make sure rm -rf isn't gonna go funny
 B="$(readlink -f "$PWD")/" A="$(readlink -f "$GENDIR")" A="${A%/}"/
 -[ "$A" == "${B::${#A}}" ] &&
 -  { echo "\$GENDIR=$GENDIR cannot include \$PWD=$PWD"; exit 1; }
 +case $B in
 +  "$A"*)
 +    echo "\$GENDIR=$GENDIR cannot include \$PWD=$PWD"
 +    exit 1
 +    ;;
 +esac
 unset A B DOTPROG DIDNEWER
 # Force full rebuild if our compiler/linker options changed
 -cmp -s <(compflags | grep '#d') <(grep '%d' "$GENDIR"/build.sh 2>/dev/null) ||
 -  rm -rf "$GENDIR"/* # Keep symlink, delete contents
 +new_build=$(mktemp)
 +old_build=$(mktemp)
 +compflags | grep '#d' > "$new_build"
 +grep '#d' "$GENDIR"/build.sh 2>/dev/null > "$old_build" || :
 +cmp -s "$new_build" "$old_build" || rm -rf "$GENDIR"/* # Keep symlink, delete contents
 +rm -f "$new_build" "$old_build"
 mkdir -p "$UNSTRIPPED"  "$(dirname $OUTNAME)" || exit 1
 # Extract a list of toys/*/*.c files to compile from the data in $KCONFIG_CONFIG
 # (First command names, then filenames with relevant {NEW,OLD}TOY() macro.)
 -[ -n "$V" ] && echo -e "\nWhich C files to build..."
 +[ -n "$V" ] && printf '\nWhich C files to build...\n'
 TOYFILES="$($SED -n 's/^CONFIG_\([^=]*\)=.*/\1/p' "$KCONFIG_CONFIG" | xargs | tr ' ' '|')"
 TOYFILES="main.c $(egrep -l "^USE_($TOYFILES)[(]...TOY[(]" toys/*/*.c | xargs)"
 -if [ "${TOYFILES/pending//}" != "$TOYFILES" ]
 -then
 -  echo -e "\n\033[1;31mwarning: using unfinished code from toys/pending\033[0m"
 -fi
 +case $TOYFILES in
 +  *pending*)
 +    printf '\n\033[1;31mwarning: using unfinished code from toys/pending\033[0m\n'
 +    ;;
 +esac
 # Write build variables (and set them locally), then append build invocation.
 -compflags > "$GENDIR"/build.sh && source "$GENDIR/build.sh" &&
 +compflags > "$GENDIR"/build.sh && . "$GENDIR"/build.sh &&
   {
 -    echo FILES=$'"\n'"$(fold -s <<<"$TOYFILES")"$'\n"' &&
 +    printf 'FILES="\n%s\n"\n' "$(printf '%s\n' "$TOYFILES" | fold -s)" &&
     echo &&
 -    echo -e "\$BUILD lib/*.c \$FILES \$LINK -o $OUTNAME"
 +    printf '%s\n' "\$BUILD lib/*.c \$FILES \$LINK -o $OUTNAME"
   } >> "$GENDIR"/build.sh &&
   chmod +x "$GENDIR"/build.sh || exit 1
@@ -133,7 +110,7 @@
 B="$(egrep "^CONFIG_($(echo "$A" | sed 's/=[yn]//' | xargs | tr ' ' '|'))=" "$KCONFIG_CONFIG" | $SED 's/^CONFIG_//' | sort)"
 A="$(echo "$A" | grep -v =n)"
 [ "$A" != "$B" ] &&
 -  { echo -e "\nWarning: Config.probed changed, run 'make oldconfig'" >&2; }
 +  { printf "\nWarning: Config.probed changed, run 'make oldconfig'\n" >&2; }
 unset A B
 # Create a list of all the commands toybox can provide.
@@ -171,7 +148,7 @@
     echo "#define NEWTOY(aa,bb,cc) aa $I bb"
     echo '#define OLDTOY(...)'
 -    if [ "$I" == A ]
 +    if [ "$I" = A ]
     then
       cat "$GENDIR"/config.h
     else
@@ -207,8 +184,8 @@
   $TOYFILES)"
   echo "$STRUX" &&
   echo "extern union global_union {" &&
 -  $SED -n 's/^struct \(.*\)_data .*/\1/;T;s/.*/\tstruct &_data &;/p' \
 -    <<<"$STRUX" &&
 +  printf '%s\n' "$STRUX" | \
 +    $SED -n 's/^struct \(.*\)_data .*/\1/;T;s/.*/\tstruct &_data &;/p' &&
   echo "} this;"
 } > "$GENDIR"/globals.h || exit 1
@@ -220,8 +197,10 @@
   for j in $i; do
     [ $X -eq 31 ] && LL=LL
     NAME="$HEAD$j"
 +    VALUE="(1$LL<<$X)"
     printf "#define $NAME %*s%s\n#define _$NAME %*s%s\n" \
 -      $((32-${#NAME})) "" "$X" $((31-${#NAME})) "" "(1$LL<<$((X++)))" || exit 1
 +      $((32-${#NAME})) "" "$X" $((31-${#NAME})) "" "$VALUE" || exit 1
 +    X=$((X+1))
   done
 done > "$GENDIR"/tags.h || exit 1
@@ -240,7 +219,7 @@
   rm -f "$GENDIR"/zhelp.h
 fi
 -[ -z "$DIDNEWER" ] || echo }
 +[ -z "$DIDNEWER" ] || echo '}'
 [ -n "$NOBUILD" ] && exit 0
 echo "Compile $OUTNAME"
@@ -260,12 +239,16 @@
 # build each generated/obj/*.o file in parallel
 -PENDING= LNKFILES= CLICK= DONE=0 COUNT=0
 +LNKFILES=
 +CLICK=
 for i in lib/*.c click $TOYFILES
 do
 -  [ "$i" == click ] && CLICK=1 && continue
 +  [ "$i" = click ] && CLICK=1 && continue
 -  X=${i/lib\//lib_}
 +  X=$i
 +  case $X in
 +    lib/*) X=lib_${X#lib/} ;;
 +  esac
   X=${X##*/}
   OUT="$GENDIR/obj/${X%%.c}.o"
   LNKFILES="$LNKFILES $OUT"
@@ -274,19 +257,10 @@
   [ "$OUT" -nt "$i" ] && [ -z "$CLICK" -o "$OUT" -nt "$KCONFIG_CONFIG" ] &&
     continue
 -  do_loudly $BUILD -c $i -o $OUT &
 -
 -  ratelimit || break
 -done
 -
 -# wait for all background jobs, detecting errors
 -while [ "$COUNT" -gt 0 ]
 -do
 -  ratelimit done
 +  do_loudly $BUILD -c $i -o $OUT || exit 1
 done
 -[ $DONE -ne 0 ] && exit 1
 -UNSTRIPPED="$UNSTRIPPED/${OUTNAME/*\//}"
 +UNSTRIPPED="$UNSTRIPPED/${OUTNAME##*/}"
 do_loudly $BUILD $LNKFILES $LINK -o "$UNSTRIPPED" || exit 1
 if [ -n "$NOSTRIP" ] ||
   ! do_loudly ${CROSS_COMPILE}${STRIP} "$UNSTRIPPED" -o "$OUTNAME"
 --- a/scripts/install.sh
 +++ b/scripts/install.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 # usage: PREFIX=/target/path scripts/install.sh [--options]
@@ -12,29 +12,29 @@
 # Grab default values for $CFLAGS and such (to build scripts/install.c)
 -source scripts/portability.sh
 +. scripts/portability.sh
 [ -z "$PREFIX" ] && PREFIX="$PWD/install"
 # Parse command line arguments.
 LONG_PATH=""
 -while [ ! -z "$1" ]
 +while [ -n "${1:-}" ]
 do
   # Create symlinks instead of hardlinks?
 -  [ "$1" == "--symlink" ] && TYPE="-s"
 +  [ "$1" = "--symlink" ] && TYPE="-s"
   # Uninstall?
 -  [ "$1" == "--uninstall" ] && UNINSTALL=Uninstall
 +  [ "$1" = "--uninstall" ] && UNINSTALL=Uninstall
   # Delete destination command if it exists?
 -  [ "$1" == "--force" ] && FORCE="-f"
 +  [ "$1" = "--force" ] && FORCE="-f"
   # Use {,usr}/{bin,sbin} paths instead of all files in one directory?
 -  [ "$1" == "--long" ] && LONG_PATH="bin/"
 +  [ "$1" = "--long" ] && LONG_PATH="bin/"
   # Symlink host toolchain binaries to destination to create cross compile $PATH
 -  [ "$1" == "--airlock" ] && AIRLOCK=1
 +  [ "$1" = "--airlock" ] && AIRLOCK=1
   shift
 done
@@ -52,7 +52,7 @@
 then
   mkdir -p "${PREFIX}/${LONG_PATH}" &&
   rm -f "${PREFIX}/${LONG_PATH}/toybox" &&
 -  cp toybox"${TARGET:+-$TARGET}" ${PREFIX}/${LONG_PATH} || exit 1
 +  cp toybox"${TARGET:+-$TARGET}" "${PREFIX}/${LONG_PATH}/" || exit 1
 else
   rm -f "${PREFIX}/${LONG_PATH}/toybox" 2>/dev/null
 fi
@@ -107,7 +107,7 @@
 # python and deciding to #include Python.h).
 # mkroot has patches to remove the need for "bc" and "gcc"
 -TOOLCHAIN="${TOOLCHAIN//,/ } as cc ld objdump   bc gcc"
 +TOOLCHAIN="$(printf '%s' "${TOOLCHAIN:-}" | tr ',' ' ') as cc ld objdump   bc gcc"
 # The following are commands toybox should provide, but doesn't yet.
 # For now symlink the host version. This list must go away by 1.0.
@@ -134,7 +134,7 @@
         ln -sf "$j" "$FALLBACK/$i" || exit 1
       fi
 -      X=$[$X+1]
 +      X=$((X+1))
       FALLBACK="$PREFIX/fallback-$X"
     done
@@ -0,0 +1,32 @@
 --- a/tools/all_errnos	2025-12-15 05:51:15.366671264 -0600
 +++ b/tools/all_errnos	2026-02-20 21:39:20.242109706 -0600
@@ -1,9 +1,8 @@
 -#!/bin/bash
 +#!/bin/sh
 # Derived from all_syscalls.
 set -e
 -set -o pipefail
 SED="$1"
 shift
@@ -13,9 +12,16 @@
 #include <sys/errno.h>
 "
 -trap 'rm -f $OUTPUT $OUTPUT.deps' ERR
 +cleanup() {
 +	status=$?
 +	if [ "$status" -ne 0 ]; then
 +		rm -f "$OUTPUT" "$OUTPUT.deps"
 +	fi
 +}
 -"$@" -MD -MF "$OUTPUT.deps" <<< "$ERRNO_INCLUDES" -dM -E - \
 +trap cleanup EXIT HUP INT TERM
 +
 +printf '%s\n' "$ERRNO_INCLUDES" | "$@" -MD -MF "$OUTPUT.deps" -dM -E - \
 	| "$SED" -n -e 's/^[ \t]*#define[ \t]*E\([^ ]*\).*$/UL_ERRNO("E\1", E\1)/p' \
 	| sort \
 	> "$OUTPUT"
@@ -0,0 +1,30 @@
 --- a/tools/all_syscalls	2025-12-15 05:51:15.366671264 -0600
 +++ b/tools/all_syscalls	2026-02-20 21:41:57.730328949 -0600
@@ -1,7 +1,6 @@
 -#!/bin/bash
 +#!/bin/sh
 set -e
 -set -o pipefail
 SED="$1"
 shift
@@ -11,9 +10,16 @@
 #include <sys/syscall.h>
 "
 -trap 'rm -f $OUTPUT $OUTPUT.deps' ERR
 +cleanup() {
 +	status=$?
 +	if [ "$status" -ne 0 ]; then
 +		rm -f "$OUTPUT" "$OUTPUT.deps"
 +	fi
 +}
 -"$@" -MD -MF "$OUTPUT.deps" <<< "$SYSCALL_INCLUDES" -dM -E - \
 +trap cleanup EXIT HUP INT TERM
 +
 +printf '%s\n' "$SYSCALL_INCLUDES" | "$@" -MD -MF "$OUTPUT.deps" -dM -E - \
 	| "$SED" -n -e 's/^#define __NR_\([^ ]*\).*$/UL_SYSCALL("\1", __NR_\1)/p' \
 	| sort \
 	> "$OUTPUT"
@@ -0,0 +1,245 @@
 --- a/build-aux/testrunner.sh
 +++ b/build-aux/testrunner.sh
@@ -1,4 +1,4 @@
 -#!/usr/bin/env bash
 +#!/bin/sh
 # testrunner.sh
 #
 # Copyright (C) 2006-2008  Jürg Billeter
@@ -26,14 +26,22 @@
 EXTRA_ENVIRONMENT_FILE=tests-extra-environment.sh
 +sanitize_name() {
 +	printf '%s\n' "$1" | tr '/-' '__'
 +}
 +
 +package_flags() {
 +	for package in $PACKAGES; do
 +		printf ' --pkg %s' "$package"
 +	done
 +}
 +
 testfile=$1
 -testdirname="$(dirname $testfile)"
 +testdirname=$(dirname "$testfile")
 testfile=${testfile#$srcdir/}
 -testpath=${testfile/.*/}
 -testpath=${testpath//\//_}
 -testpath=${testpath//-/_}
 -if test -f $testdirname/$EXTRA_ENVIRONMENT_FILE; then
 -	source $testdirname/$EXTRA_ENVIRONMENT_FILE
 +testpath=$(sanitize_name "${testfile%.*}")
 +if test -f "$testdirname/$EXTRA_ENVIRONMENT_FILE"; then
 +	. "$testdirname/$EXTRA_ENVIRONMENT_FILE"
 fi
 vapidir=$abs_top_srcdir/vapi
@@ -57,21 +65,25 @@
 # Incorporate the TEST_CFLAGS.
 for cflag in ${TEST_CFLAGS}; do
 -    VALAFLAGS="${VALAFLAGS} -X ${cflag}"
 +	VALAFLAGS="${VALAFLAGS} -X ${cflag}"
 done
 # Incorporate the user's CFLAGS. Matters if the user decided to insert
 # -m32 in CFLAGS, for example.
 for cflag in ${CFLAGS} ${CPPFLAGS} ${LDFLAGS}; do
 -	if [[ ! $cflag =~ ^\-O[0-9]$ ]]; then
 -		VALAFLAGS="${VALAFLAGS} -X ${cflag}"
 -	fi
 +	case $cflag in
 +		-O[0-9])
 +			;;
 +		*)
 +			VALAFLAGS="${VALAFLAGS} -X ${cflag}"
 +			;;
 +	esac
 done
 -function testheader() {
 +testheader() {
 	if [ "$1" = "Packages:" ]; then
 		shift
 -		PACKAGES="$PACKAGES $@"
 +		PACKAGES="$PACKAGES $*"
 	elif [ "$*" = "Invalid Code" ]; then
 		INVALIDCODE=1
 		INHEADER=0
@@ -84,21 +96,19 @@
 	fi
 }
 -function sourceheader() {
 +sourceheader() {
 	if [ "$1" = "Program:" ]; then
 		if [ "$2" = "server" ]; then
 			ISSERVER=1
 		fi
 -		ns=$testpath/$2
 -		ns=${ns//\//_}
 -		ns=${ns//-/_}
 +		ns=$(sanitize_name "$testpath/$2")
 		SOURCEFILE=$ns.vala
 		SOURCEFILES="$SOURCEFILES $SOURCEFILE"
 -	elif [ $GIRWRITERTEST -eq 1 ]; then
 +	elif [ "$GIRWRITERTEST" -eq 1 ]; then
 		if [ "$1" = "Input:" ]; then
 			ns=$testpath
 			SOURCEFILE=$testpath.vala
 -			cat <<EOF > $SOURCEFILE
 +			cat <<EOF > "$SOURCEFILE"
 [CCode (cprefix = "Test", gir_namespace = "Test", gir_version = "1.2", lower_case_cprefix = "test_")]
 namespace Test {
 EOF
@@ -108,26 +118,26 @@
 	fi
 }
 -function sourceend() {
 -	if [ $INVALIDCODE -eq 1 ]; then
 -		PACKAGEFLAGS=$([ -z "$PACKAGES" ] || echo $PACKAGES | xargs -n 1 echo -n " --pkg")
 +sourceend() {
 +	if [ "$INVALIDCODE" -eq 1 ]; then
 +		PACKAGEFLAGS=$(package_flags)
 		echo '' > prepare
 		echo "$VALAC $VALAFLAGS $PACKAGEFLAGS -C $SOURCEFILE" > check
 		echo "RET=\$?" >> check
 		echo "if [ \$RET -ne 1 ]; then exit 1; fi" >> check
 		echo "exit 0" >> check
 -	elif [ $GIRWRITERTEST -eq 1 ]; then
 -		if [ $PART -eq 1 ]; then
 -			echo "}" >> $SOURCEFILE
 +	elif [ "$GIRWRITERTEST" -eq 1 ]; then
 +		if [ "$PART" -eq 1 ]; then
 +			echo "}" >> "$SOURCEFILE"
 		fi
 -		PACKAGEFLAGS=$([ -z "$PACKAGES" ] || echo $PACKAGES | xargs -n 1 echo -n " --pkg")
 +		PACKAGEFLAGS=$(package_flags)
 		echo "$VALAC $VALAFLAGS $PACKAGEFLAGS -C --library test -H test.h --gir Test-1.2.gir $ns.vala && tail -n +4 Test-1.2.gir|sed '\$d'|diff -wu Test-1.2.gir.ref -" > check
 	else
 -		PACKAGEFLAGS=$([ -z "$PACKAGES" ] || echo $PACKAGES | xargs -n 1 echo -n " --pkg")
 +		PACKAGEFLAGS=$(package_flags)
 		echo "$VALAC $VALAFLAGS $PACKAGEFLAGS -o $ns$EXEEXT $SOURCEFILE" >> prepare
 -		if [ $DBUSTEST -eq 1 ]; then
 +		if [ "$DBUSTEST" -eq 1 ]; then
 			echo "UPDATE_EXPECTED=$UPDATE_EXPECTED" >> prepare
 -			if [ $ISSERVER -eq 1 ]; then
 +			if [ "$ISSERVER" -eq 1 ]; then
 				echo "if [ -n \"$UPDATE_EXPECTED\" ]; then" >> prepare
 				echo "	cp -p ${SOURCEFILE%.*}.c $abs_srcdir/${testfile%.*}_server.c-expected" >> prepare
 				echo "elif [ -f $abs_srcdir/${testfile%.*}_server.c-expected ]; then" >> prepare
@@ -152,38 +162,40 @@
 unset SOURCEFILE
 testdir=_test.$$
 -rm -rf ./$testdir
 -mkdir $testdir
 -cd $testdir
 +rm -rf "./$testdir"
 +mkdir "$testdir"
 +cd "$testdir"
 case "$testfile" in
 -*.gs)
 -	SOURCEFILE=$testpath.gs
 -	;&
 -*.vala)
 +*.gs|*.vala)
 +	case "$testfile" in
 +	*.gs)
 +		SOURCEFILE=$testpath.gs
 +		;;
 +	esac
 	SOURCEFILE=${SOURCEFILE:-$testpath.vala}
 -	cat "$abs_srcdir/$testfile" > ./$SOURCEFILE
 -	PACKAGEFLAGS=$([ -z "$PACKAGES" ] || echo $PACKAGES | xargs -n 1 echo -n " --pkg")
 -	$VALAC $VALAFLAGS $PACKAGEFLAGS -o $testpath$EXEEXT $SOURCEFILE
 +	cat "$abs_srcdir/$testfile" > "./$SOURCEFILE"
 +	PACKAGEFLAGS=$(package_flags)
 +	$VALAC $VALAFLAGS $PACKAGEFLAGS -o "$testpath$EXEEXT" "$SOURCEFILE"
 	if [ -n "$UPDATE_EXPECTED" ]; then
 -		cp -p ${SOURCEFILE%.*}.c $abs_srcdir/${testfile%.*}.c-expected
 +		cp -p "${SOURCEFILE%.*}.c" "$abs_srcdir/${testfile%.*}.c-expected"
 		if [ -f test.h ]; then
 -			cp -p test.h $abs_srcdir/${testfile%.*}.h-expected || exit 1
 +			cp -p test.h "$abs_srcdir/${testfile%.*}.h-expected" || exit 1
 		fi
 -	elif [ -f $abs_srcdir/${testfile%.*}.c-expected ]; then
 -		diff -wu $abs_srcdir/${testfile%.*}.c-expected ${SOURCEFILE%.*}.c || exit 1
 -		if [ -f $abs_srcdir/${testfile%.*}.h-expected ]; then
 -			diff -wu $abs_srcdir/${testfile%.*}.h-expected test.h || exit 1
 +	elif [ -f "$abs_srcdir/${testfile%.*}.c-expected" ]; then
 +		diff -wu "$abs_srcdir/${testfile%.*}.c-expected" "${SOURCEFILE%.*}.c" || exit 1
 +		if [ -f "$abs_srcdir/${testfile%.*}.h-expected" ]; then
 +			diff -wu "$abs_srcdir/${testfile%.*}.h-expected" test.h || exit 1
 		fi
 	fi
 -	./$testpath$EXEEXT
 +	"./$testpath$EXEEXT"
 	;;
 *.gir)
 	SOURCEFILE=$testpath.gir
 -	cat "$abs_srcdir/$testfile" > ./$SOURCEFILE
 -	PACKAGEFLAGS=$([ -z "$PACKAGES" ] || echo $PACKAGES | xargs -n 1 echo -n " --pkg")
 -	$VAPIGEN $VAPIGENFLAGS $PACKAGEFLAGS --library $testpath $SOURCEFILE || exit 1
 -	tail -n +3 ${SOURCEFILE%.*}.vapi | diff -wu $abs_srcdir/${testfile%.*}.vapi-expected - || exit 1
 +	cat "$abs_srcdir/$testfile" > "./$SOURCEFILE"
 +	PACKAGEFLAGS=$(package_flags)
 +	$VAPIGEN $VAPIGENFLAGS $PACKAGEFLAGS --library "$testpath" "$SOURCEFILE" || exit 1
 +	tail -n +3 "${SOURCEFILE%.*}.vapi" | diff -wu "$abs_srcdir/${testfile%.*}.vapi-expected" - || exit 1
 	;;
 *.test)
 	rm -f prepare check
@@ -195,37 +207,41 @@
 	GIRWRITERTEST=0
 	DBUSTEST=0
 	ISSERVER=0
 -	while IFS="" read -r line; do
 -		if [ $PART -eq 0 ]; then
 +	while IFS= read -r line; do
 +		if [ "$PART" -eq 0 ]; then
 			if [ -n "$line" ]; then
 				testheader $line
 			else
 				PART=1
 			fi
 		else
 -			if [ $INHEADER -eq 1 ]; then
 +			if [ "$INHEADER" -eq 1 ]; then
 				if [ -n "$line" ]; then
 					sourceheader $line
 				else
 					INHEADER=0
 				fi
 			else
 -				if echo "$line" | grep -q "^[A-Za-z]\+:"; then
 +				if printf '%s\n' "$line" | grep -q '^[A-Za-z][A-Za-z]*:'; then
 					sourceend
 -					PART=$(($PART + 1))
 +					PART=$((PART + 1))
 					INHEADER=1
 					sourceheader $line
 				else
 -					echo "$line" >> $SOURCEFILE
 +					echo "$line" >> "$SOURCEFILE"
 				fi
 			fi
 		fi
 	done < "$abs_srcdir/$testfile"
 	sourceend
 -	cat prepare check > $ns.check
 -	$run_prefix bash $ns.check
 +	cat prepare check > "$ns.check"
 +	if [ -n "$run_prefix" ]; then
 +		$run_prefix sh "$ns.check"
 +	else
 +		sh "$ns.check"
 +	fi
 	;;
 esac
 cd ..
 -rm -rf ./$testdir
 +rm -rf "./$testdir"
@@ -0,0 +1,482 @@
 diff -urN a/Makefile.tool.am b/Makefile.tool.am
 --- a/Makefile.tool.am	2025-10-24 13:43:21.000000000 -0500
 +++ b/Makefile.tool.am	2026-03-22 13:02:33.492002899 -0500
@@ -16,7 +16,9 @@
 	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 endif
 -TOOL_LDADD_COMMON = -lgcc
 +# Ask the compiler driver for its runtime support archive at link time so
 +# clang can use compiler-rt instead of a hardcoded GNU libgcc.
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ = \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) $(TOOL_LDADD_COMMON)
 if VGCONF_HAVE_PLATFORM_SEC
@@ -290,4 +292,3 @@
 install-exec-local: install-noinst_PROGRAMS install-noinst_DSYMS
 uninstall-local: uninstall-noinst_PROGRAMS uninstall-noinst_DSYMS
 -
 diff -urN a/cachegrind/Makefile.in b/cachegrind/Makefile.in
 --- a/cachegrind/Makefile.in	2025-10-24 13:43:44.000000000 -0500
 +++ b/cachegrind/Makefile.in	2026-03-22 12:59:22.464512205 -0500
@@ -742,7 +742,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/callgrind/Makefile.in b/callgrind/Makefile.in
 --- a/callgrind/Makefile.in	2025-10-24 13:43:45.000000000 -0500
 +++ b/callgrind/Makefile.in	2026-03-22 12:59:22.464050754 -0500
@@ -789,7 +789,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/coregrind/link_tool_exe_freebsd.in b/coregrind/link_tool_exe_freebsd.in
 --- a/coregrind/link_tool_exe_freebsd.in	2025-10-24 13:43:21.000000000 -0500
 +++ b/coregrind/link_tool_exe_freebsd.in	2026-03-22 12:59:22.464512205 -0500
@@ -56,6 +56,84 @@
 use warnings;
 use strict;
 +sub capture_command_output {
 +    my (@cmd) = @_;
 +    my $pid = open(my $fh, "-|");
 +    die "Can't fork: $!" if !defined $pid;
 +
 +    if ($pid == 0) {
 +        open(STDERR, ">", "/dev/null")
 +            or die "Can't redirect stderr: $!";
 +        exec @cmd or die "Can't exec @cmd: $!";
 +    }
 +
 +    local $/ = undef;
 +    my $output = <$fh>;
 +    close($fh);
 +
 +    return defined $output ? $output : "";
 +}
 +
 +sub compiler_cmd_prefix {
 +    my (@args) = @_;
 +    my @prefix = ();
 +
 +    foreach my $arg (@args) {
 +        last if $arg =~ /^-/;
 +        last if $arg =~ /\.(?:a|o|c|cc|cpp|cxx|s|S)$/;
 +        push @prefix, $arg;
 +    }
 +
 +    die "Can't determine compiler command"
 +        if scalar(@prefix) == 0;
 +
 +    return @prefix;
 +}
 +
 +sub compiler_runtime_probe_args {
 +    my (@args) = @_;
 +    my @probe_args = ();
 +
 +    for (my $n = 0; $n <= $#args; $n++) {
 +        my $arg = $args[$n];
 +
 +        if ($arg eq "-m32" || $arg eq "-m64") {
 +            push @probe_args, $arg;
 +            next;
 +        }
 +
 +        if ($arg eq "-B" || $arg eq "--sysroot" || $arg eq "-resource-dir"
 +            || $arg eq "-target" || $arg eq "--target"
 +            || $arg eq "--gcc-toolchain") {
 +            last if $n == $#args;
 +            push @probe_args, $arg, $args[++$n];
 +            next;
 +        }
 +
 +        if ($arg =~ /^(-B|--sysroot=|-resource-dir=|-target=|--target=|--gcc-toolchain=|--rtlib=|-rtlib=|-stdlib=|-fuse-ld=)/) {
 +            push @probe_args, $arg;
 +            next;
 +        }
 +    }
 +
 +    return @probe_args;
 +}
 +
 +sub compiler_runtime_archive {
 +    my (@args) = @_;
 +    my @compiler = compiler_cmd_prefix(@args);
 +    my @probe_args = compiler_runtime_probe_args(@args);
 +
 +    foreach my $probe ("-print-libgcc-file-name", "-print-file-name=libgcc.a") {
 +        my $path = capture_command_output(@compiler, @probe_args, $probe);
 +        chomp $path;
 +        next if $path eq "" || $path eq "libgcc.a";
 +        return $path if -f $path;
 +    }
 +
 +    return "-lgcc";
 +}
 +
 # expect at least: alt-load-address gcc -o foo bar.o
 die "Not enough arguments"
     if (($#ARGV + 1) < 5);
@@ -67,7 +145,9 @@
 die "Bogus alt-load address"
     if (length($ala) < 3 || index($ala, "0x") != 0);
 -my $cmd = join(" ", @ARGV, "-static -Wl,@FLAG_T_TEXT@=$ala");
 +my $compiler_runtime = compiler_runtime_archive(@ARGV);
 +
 +my $cmd = join(" ", @ARGV, $compiler_runtime, "-static -Wl,@FLAG_T_TEXT@=$ala");
 #print "link_tool_exe_freebsd: $cmd\n";
 diff -urN a/coregrind/link_tool_exe_linux.in b/coregrind/link_tool_exe_linux.in
 --- a/coregrind/link_tool_exe_linux.in	2025-10-24 13:43:21.000000000 -0500
 +++ b/coregrind/link_tool_exe_linux.in	2026-03-22 12:59:22.464512205 -0500
@@ -58,6 +58,84 @@
 use warnings;
 use strict;
 +sub capture_command_output {
 +    my (@cmd) = @_;
 +    my $pid = open(my $fh, "-|");
 +    die "Can't fork: $!" if !defined $pid;
 +
 +    if ($pid == 0) {
 +        open(STDERR, ">", "/dev/null")
 +            or die "Can't redirect stderr: $!";
 +        exec @cmd or die "Can't exec @cmd: $!";
 +    }
 +
 +    local $/ = undef;
 +    my $output = <$fh>;
 +    close($fh);
 +
 +    return defined $output ? $output : "";
 +}
 +
 +sub compiler_cmd_prefix {
 +    my (@args) = @_;
 +    my @prefix = ();
 +
 +    foreach my $arg (@args) {
 +        last if $arg =~ /^-/;
 +        last if $arg =~ /\.(?:a|o|c|cc|cpp|cxx|s|S)$/;
 +        push @prefix, $arg;
 +    }
 +
 +    die "Can't determine compiler command"
 +        if scalar(@prefix) == 0;
 +
 +    return @prefix;
 +}
 +
 +sub compiler_runtime_probe_args {
 +    my (@args) = @_;
 +    my @probe_args = ();
 +
 +    for (my $n = 0; $n <= $#args; $n++) {
 +        my $arg = $args[$n];
 +
 +        if ($arg eq "-m32" || $arg eq "-m64") {
 +            push @probe_args, $arg;
 +            next;
 +        }
 +
 +        if ($arg eq "-B" || $arg eq "--sysroot" || $arg eq "-resource-dir"
 +            || $arg eq "-target" || $arg eq "--target"
 +            || $arg eq "--gcc-toolchain") {
 +            last if $n == $#args;
 +            push @probe_args, $arg, $args[++$n];
 +            next;
 +        }
 +
 +        if ($arg =~ /^(-B|--sysroot=|-resource-dir=|-target=|--target=|--gcc-toolchain=|--rtlib=|-rtlib=|-stdlib=|-fuse-ld=)/) {
 +            push @probe_args, $arg;
 +            next;
 +        }
 +    }
 +
 +    return @probe_args;
 +}
 +
 +sub compiler_runtime_archive {
 +    my (@args) = @_;
 +    my @compiler = compiler_cmd_prefix(@args);
 +    my @probe_args = compiler_runtime_probe_args(@args);
 +
 +    foreach my $probe ("-print-libgcc-file-name", "-print-file-name=libgcc.a") {
 +        my $path = capture_command_output(@compiler, @probe_args, $probe);
 +        chomp $path;
 +        next if $path eq "" || $path eq "libgcc.a";
 +        return $path if -f $path;
 +    }
 +
 +    return "-lgcc";
 +}
 +
 # expect at least: alt-load-address gcc -o foo bar.o
 die "Not enough arguments"
     if (($#ARGV + 1) < 5);
@@ -69,7 +147,9 @@
 die "Bogus alt-load address"
     if (length($ala) < 3 || index($ala, "0x") != 0);
 -my $cmd = join(" ", @ARGV, "-static -Wl,@FLAG_T_TEXT@=$ala");
 +my $compiler_runtime = compiler_runtime_archive(@ARGV);
 +
 +my $cmd = join(" ", @ARGV, $compiler_runtime, "-static -Wl,@FLAG_T_TEXT@=$ala");
 #print "link_tool_exe_linux: $cmd\n";
 diff -urN a/coregrind/link_tool_exe_solaris.in b/coregrind/link_tool_exe_solaris.in
 --- a/coregrind/link_tool_exe_solaris.in	2025-10-24 13:43:21.000000000 -0500
 +++ b/coregrind/link_tool_exe_solaris.in	2026-03-22 12:59:22.464512205 -0500
@@ -21,6 +21,84 @@
 use File::Temp qw/tempfile unlink0/;
 use Fcntl qw/F_SETFD/;
 +sub capture_command_output {
 +    my (@cmd) = @_;
 +    my $pid = open(my $fh, "-|");
 +    die "Can't fork: $!" if !defined $pid;
 +
 +    if ($pid == 0) {
 +        open(STDERR, ">", "/dev/null")
 +            or die "Can't redirect stderr: $!";
 +        exec @cmd or die "Can't exec @cmd: $!";
 +    }
 +
 +    local $/ = undef;
 +    my $output = <$fh>;
 +    close($fh);
 +
 +    return defined $output ? $output : "";
 +}
 +
 +sub compiler_cmd_prefix {
 +    my (@args) = @_;
 +    my @prefix = ();
 +
 +    foreach my $arg (@args) {
 +        last if $arg =~ /^-/;
 +        last if $arg =~ /\.(?:a|o|c|cc|cpp|cxx|s|S)$/;
 +        push @prefix, $arg;
 +    }
 +
 +    die "Can't determine compiler command"
 +        if scalar(@prefix) == 0;
 +
 +    return @prefix;
 +}
 +
 +sub compiler_runtime_probe_args {
 +    my (@args) = @_;
 +    my @probe_args = ();
 +
 +    for (my $n = 0; $n <= $#args; $n++) {
 +        my $arg = $args[$n];
 +
 +        if ($arg eq "-m32" || $arg eq "-m64") {
 +            push @probe_args, $arg;
 +            next;
 +        }
 +
 +        if ($arg eq "-B" || $arg eq "--sysroot" || $arg eq "-resource-dir"
 +            || $arg eq "-target" || $arg eq "--target"
 +            || $arg eq "--gcc-toolchain") {
 +            last if $n == $#args;
 +            push @probe_args, $arg, $args[++$n];
 +            next;
 +        }
 +
 +        if ($arg =~ /^(-B|--sysroot=|-resource-dir=|-target=|--target=|--gcc-toolchain=|--rtlib=|-rtlib=|-stdlib=|-fuse-ld=)/) {
 +            push @probe_args, $arg;
 +            next;
 +        }
 +    }
 +
 +    return @probe_args;
 +}
 +
 +sub compiler_runtime_archive {
 +    my (@args) = @_;
 +    my @compiler = compiler_cmd_prefix(@args);
 +    my @probe_args = compiler_runtime_probe_args(@args);
 +
 +    foreach my $probe ("-print-libgcc-file-name", "-print-file-name=libgcc.a") {
 +        my $path = capture_command_output(@compiler, @probe_args, $probe);
 +        chomp $path;
 +        next if $path eq "" || $path eq "libgcc.a";
 +        return $path if -f $path;
 +    }
 +
 +    return "-lgcc";
 +}
 +
 # expect at least: alt-load-address gcc -o foo bar.o
 die "Not enough arguments"
     if (($#ARGV + 1) < 5);
@@ -62,7 +140,9 @@
 END
 # build up the complete command here:
 -# 'cc' -Wl,-Mtmpfile 'restargs'
 +# 'cc' -Wl,-Mtmpfile 'restargs' compiler-runtime-archive
 +
 +my $compiler_runtime = compiler_runtime_archive(@ARGV[1 .. $#ARGV]);
 my $cmd="$cc -Wl,-M/proc/$$/fd/" . fileno($fh);
@@ -71,6 +151,8 @@
     $cmd = "$cmd $ARGV[$n]";
 }
 +$cmd = "$cmd $compiler_runtime";
 +
 #print "link_tool_exe_solaris: $cmd\n";
 diff -urN a/dhat/Makefile.in b/dhat/Makefile.in
 --- a/dhat/Makefile.in	2025-10-24 13:43:45.000000000 -0500
 +++ b/dhat/Makefile.in	2026-03-22 12:59:22.461512099 -0500
@@ -767,7 +767,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/drd/Makefile.in b/drd/Makefile.in
 --- a/drd/Makefile.in	2025-10-24 13:43:45.000000000 -0500
 +++ b/drd/Makefile.in	2026-03-22 12:59:22.460512064 -0500
@@ -848,7 +848,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/exp-bbv/Makefile.in b/exp-bbv/Makefile.in
 --- a/exp-bbv/Makefile.in	2025-10-24 13:43:45.000000000 -0500
 +++ b/exp-bbv/Makefile.in	2026-03-22 12:59:22.462512134 -0500
@@ -703,7 +703,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/helgrind/Makefile.in b/helgrind/Makefile.in
 --- a/helgrind/Makefile.in	2025-10-24 13:43:46.000000000 -0500
 +++ b/helgrind/Makefile.in	2026-03-22 12:59:22.464050754 -0500
@@ -790,7 +790,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/lackey/Makefile.in b/lackey/Makefile.in
 --- a/lackey/Makefile.in	2025-10-24 13:43:46.000000000 -0500
 +++ b/lackey/Makefile.in	2026-03-22 12:59:22.461512099 -0500
@@ -703,7 +703,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/massif/Makefile.in b/massif/Makefile.in
 --- a/massif/Makefile.in	2025-10-24 13:43:46.000000000 -0500
 +++ b/massif/Makefile.in	2026-03-22 12:59:22.462512134 -0500
@@ -757,7 +757,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/memcheck/Makefile.in b/memcheck/Makefile.in
 --- a/memcheck/Makefile.in	2025-10-24 13:43:46.000000000 -0500
 +++ b/memcheck/Makefile.in	2026-03-22 12:59:22.459512028 -0500
@@ -790,7 +790,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/none/Makefile.in b/none/Makefile.in
 --- a/none/Makefile.in	2025-10-24 13:43:47.000000000 -0500
 +++ b/none/Makefile.in	2026-03-22 12:59:22.461512099 -0500
@@ -701,7 +701,7 @@
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/coregrind/libcoregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a \
 @VGCONF_HAVE_PLATFORM_SEC_TRUE@	$(top_builddir)/VEX/libvex-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
 -TOOL_LDADD_COMMON = -lgcc
 +TOOL_LDADD_COMMON =
 TOOL_LDADD_@VGCONF_PLATFORM_PRI_CAPS@ =  \
 	$(TOOL_DEPENDENCIES_@VGCONF_PLATFORM_PRI_CAPS@) \
 	$(TOOL_LDADD_COMMON) $(am__append_7) $(am__append_9)
 diff -urN a/none/tests/Makefile.am b/none/tests/Makefile.am
 --- a/none/tests/Makefile.am	2025-10-24 13:43:21.000000000 -0500
 +++ b/none/tests/Makefile.am	2026-03-22 12:59:22.458511993 -0500
@@ -502,9 +502,8 @@
 vgprintf_nvalgrind_CFLAGS = ${AM_CFLAGS} -DNVALGRIND
 valgrind_cpp_test_SOURCES = valgrind_cpp_test.cpp
 -valgrind_cpp_test_LDADD   = -lstdc++
 +valgrind_cpp_test_LDADD   =
 # C++ tests
 coolo_sigaction_SOURCES	= coolo_sigaction.cpp
 gxx304_SOURCES		= gxx304.cpp
 -
 diff -urN a/none/tests/Makefile.in b/none/tests/Makefile.in
 --- a/none/tests/Makefile.in	2025-10-24 13:43:47.000000000 -0500
 +++ b/none/tests/Makefile.in	2026-03-22 12:59:22.459512028 -0500
@@ -1581,7 +1581,7 @@
 vgprintf_nvalgrind_SOURCES = vgprintf.c
 vgprintf_nvalgrind_CFLAGS = ${AM_CFLAGS} -DNVALGRIND
 valgrind_cpp_test_SOURCES = valgrind_cpp_test.cpp
 -valgrind_cpp_test_LDADD = -lstdc++
 +valgrind_cpp_test_LDADD =
 # C++ tests
 coolo_sigaction_SOURCES = coolo_sigaction.cpp
 diff -urN a/valgrind.pc.in b/valgrind.pc.in
 --- a/valgrind.pc.in	2025-10-24 13:43:21.000000000 -0500
 +++ b/valgrind.pc.in	2026-03-22 12:59:22.458511993 -0500
@@ -11,6 +11,5 @@
 Description: A dynamic binary instrumentation framework
 Version: @VERSION@
 Requires:
 -Libs: -L${libdir}/valgrind -lcoregrind-@VGCONF_ARCH_PRI@-@VGCONF_OS@ -lvex-@VGCONF_ARCH_PRI@-@VGCONF_OS@ -lgcc
 +Libs: -L${libdir}/valgrind -lcoregrind-@VGCONF_ARCH_PRI@-@VGCONF_OS@ -lvex-@VGCONF_ARCH_PRI@-@VGCONF_OS@
 Cflags: -I${includedir}
 -
@@ -0,0 +1,282 @@
 --- a/configure	2025-08-16 00:29:41.000000000 -0500
 +++ b/configure	2026-03-25 01:07:23.787385597 -0500
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 if test x"$1" = x"-h" -o x"$1" = x"--help" ; then
 cat <<EOF
@@ -62,7 +62,7 @@
 fi
 log_check() {
 -    echo -n "checking $1... " >> config.log
 +    printf 'checking %s... ' "$1" >> config.log
 }
 log_ok() {
@@ -81,13 +81,14 @@
     # several non gcc compilers issue an incredibly large number of warnings on high warning levels,
     # suppress them by reducing the warning level rather than having to use #pragmas
     for arg in $*; do
 -        [[ "$arg" = -falign-loops* ]] && arg=
 +        case $arg in
 +            -falign-loops*|-mpreferred-stack-boundary*|-l*|-L*)
 +                arg=
 +                ;;
 +        esac
         [ "$arg" = -fno-tree-vectorize ] && arg=
         [ "$arg" = -Wshadow ] && arg=
         [ "$arg" = -Wno-maybe-uninitialized ] && arg=
 -        [[ "$arg" = -mpreferred-stack-boundary* ]] && arg=
 -        [[ "$arg" = -l* ]] && arg=
 -        [[ "$arg" = -L* ]] && arg=
         if [ $compiler_style = MS ]; then
             [ "$arg" = -ffast-math ] && arg="-fp:fast"
             [ "$arg" = -Wall ] && arg=
@@ -103,15 +104,27 @@
         fi
         [ $compiler = CL -a "$arg" = -O3 ] && arg=-O2
 -        [ -n "$arg" ] && echo -n "$arg "
 +        [ -n "$arg" ] && printf '%s ' "$arg"
     done
 }
 cl_ldflags() {
     for arg in $*; do
 -        arg=${arg/LIBPATH/libpath}
 -        [ "${arg#-libpath:}" == "$arg" -a "${arg#-l}" != "$arg" ] && arg=${arg#-l}.lib
 -        [ "${arg#-L}" != "$arg" ] && arg=-libpath:${arg#-L}
 +        case $arg in
 +            *LIBPATH*)
 +                arg=$(printf '%s\n' "$arg" | sed 's/LIBPATH/libpath/')
 +                ;;
 +        esac
 +        case $arg in
 +            -libpath:*)
 +                ;;
 +            -l*)
 +                arg=${arg#-l}.lib
 +                ;;
 +            -L*)
 +                arg=-libpath:${arg#-L}
 +                ;;
 +        esac
         [ "$arg" = -Wl,--large-address-aware ] && arg=-largeaddressaware
         [ "$arg" = -s ] && arg=
         [ "$arg" = -Wl,-Bsymbolic ] && arg=
@@ -119,15 +132,23 @@
         [ "$arg" = -Werror ] && arg=
         [ "$arg" = -Wshadow ] && arg=
         [ "$arg" = -Wmaybe-uninitialized ] && arg=
 -        [[ "$arg" = -Qdiag-error* ]] && arg=
 -
 -        arg=${arg/pthreadGC/pthreadVC}
 +        case $arg in
 +            -Qdiag-error*)
 +                arg=
 +                ;;
 +        esac
 +
 +        case $arg in
 +            *pthreadGC*)
 +                arg=$(printf '%s\n' "$arg" | sed 's/pthreadGC/pthreadVC/')
 +                ;;
 +        esac
         [ "$arg" = avifil32.lib ] && arg=vfw32.lib
         [ "$arg" = gpac_static.lib ] && arg=libgpac_static.lib
         [ "$arg" = gpac.lib ] && arg=libgpac.lib
         [ "$arg" = x264.lib ] && arg=libx264.lib
 -        [ -n "$arg" ] && echo -n "$arg "
 +        [ -n "$arg" ] && printf '%s ' "$arg"
     done
 }
@@ -191,7 +212,7 @@
     for arg in $1; do
         echo "#include <$arg>" >> conftest.c
     done
 -    echo -e "#if !($3) \n#error $4 \n#endif " >> conftest.c
 +    printf '#if !(%s)\n#error %s\n#endif\n' "$3" "$4" >> conftest.c
     if [ $compiler_style = MS ]; then
         cpp_cmd="$CC conftest.c $(cc_cflags $CFLAGS $2) -P"
     else
@@ -352,16 +373,21 @@
 # Construct a path to the specified directory relative to the working directory
 relative_path() {
 -    local base="${PWD%/}"
 -    local path="$(cd "$1" >/dev/null; printf '%s/.' "${PWD%/}")"
 -    local up=''
 -
 -    while [[ $path != "$base/"* ]]; do
 -        base="${base%/*}"
 -        up="../$up"
 +    relative_base="${PWD%/}"
 +    relative_pathname=$(cd "$1" >/dev/null && printf '%s/.' "${PWD%/}") || return 1
 +    relative_up=
 +
 +    while :; do
 +        case $relative_pathname in
 +            "$relative_base"/*)
 +                break
 +                ;;
 +        esac
 +        relative_base=${relative_base%/*}
 +        relative_up="../$relative_up"
     done
 -    dirname "$up${path#"$base/"}"
 +    dirname "$relative_up${relative_pathname#"$relative_base/"}"
 }
 SRCPATH="$(relative_path "$(dirname "$0")")"
@@ -604,10 +630,16 @@
 # test for use of compilers that require specific handling
 cc_base="$(basename "$CC")"
 QPRE="-"
 -if [[ $host_os = mingw* || $host_os = msys* || $host_os = cygwin* ]]; then
 -    if [[ "$cc_base" = icl || "$cc_base" = icl[\ .]* ]]; then
 +case $host_os in
 +mingw*|msys*|cygwin*)
 +    case $cc_base in
 +    icl|icl.*|icl\ *)
         # Windows Intel Compiler creates dependency generation with absolute Windows paths, Cygwin's make does not support Windows paths.
 -        [[ $host_os = cygwin* ]] && die "Windows Intel Compiler support requires MSYS"
 +        case $host_os in
 +            cygwin*)
 +                die "Windows Intel Compiler support requires MSYS"
 +                ;;
 +        esac
         compiler=ICL
         compiler_style=MS
         CFLAGS="$CFLAGS -Qstd=c99 -nologo -Qms0 -DHAVE_STRING_H -I\$(SRCPATH)/extras"
@@ -621,7 +653,8 @@
         if cc_check '' -Qdiag-error:10006,10157 ; then
             CHECK_CFLAGS="$CHECK_CFLAGS -Qdiag-error:10006,10157"
         fi
 -    elif [[ "$cc_base" = cl || "$cc_base" = cl[\ .]* ]]; then
 +        ;;
 +    cl|cl.*|cl\ *)
         # Standard Microsoft Visual Studio
         compiler=CL
         compiler_style=MS
@@ -636,16 +669,22 @@
         elif cpp_check '' '' 'defined(_M_ARM)' ; then
             host_cpu=arm
         fi
 -    else
 +        ;;
 +    *)
         # MinGW uses broken pre-VS2015 Microsoft printf functions unless it's told to use the POSIX ones.
         CFLAGS="$CFLAGS -D_POSIX_C_SOURCE=200112L"
 -    fi
 -else
 -    if [[ "$cc_base" = icc || "$cc_base" = icc[\ .]* ]]; then
 +        ;;
 +    esac
 +    ;;
 +*)
 +    case $cc_base in
 +    icc|icc.*|icc\ *)
         AR="xiar"
         compiler=ICC
 -    fi
 -fi
 +        ;;
 +    esac
 +    ;;
 +esac
 if [ $compiler = GNU ]; then
     if cc_check '' -Werror=unknown-warning-option ; then
@@ -711,7 +750,7 @@
         ;;
     cygwin*|mingw*|msys*)
         EXE=".exe"
 -        if [[ $host_os = cygwin* ]] && cpp_check "" "" "defined(__CYGWIN__)" ; then
 +        if case $host_os in cygwin*) true ;; *) false ;; esac && cpp_check "" "" "defined(__CYGWIN__)" ; then
             SYS="CYGWIN"
             define HAVE_MALLOC_H
         else
@@ -766,11 +805,23 @@
         AS_EXT=".asm"
         ASFLAGS="$ASFLAGS -DARCH_X86_64=0 -I\$(SRCPATH)/common/x86/"
         if [ $compiler = GNU ]; then
 -            if [[ "$asm" == auto && "$CFLAGS" != *-march* ]]; then
 -                CFLAGS="$CFLAGS -march=i686"
 +            if [ "$asm" = auto ]; then
 +                case " $CFLAGS " in
 +                    *" -march"*)
 +                        ;;
 +                    *)
 +                        CFLAGS="$CFLAGS -march=i686"
 +                        ;;
 +                esac
             fi
 -            if [[ "$asm" == auto && "$CFLAGS" != *-mfpmath* ]]; then
 -                CFLAGS="$CFLAGS -mfpmath=sse -msse -msse2"
 +            if [ "$asm" = auto ]; then
 +                case " $CFLAGS " in
 +                    *" -mfpmath"*)
 +                        ;;
 +                    *)
 +                        CFLAGS="$CFLAGS -mfpmath=sse -msse -msse2"
 +                        ;;
 +                esac
             fi
             CFLAGS="-m32 $CFLAGS"
             LDFLAGS="-m32 $LDFLAGS"
@@ -1000,7 +1051,7 @@
 if [ $asm = auto -a $ARCH = ARM ] ; then
     # set flags so neon is built by default
 -    [ $compiler == CL ] || echo $CFLAGS | grep -Eq '(-mcpu|-march|-mfpu)' || CFLAGS="$CFLAGS -mcpu=cortex-a8 -mfpu=neon"
 +    [ "$compiler" = CL ] || printf '%s\n' "$CFLAGS" | grep -Eq '(^| )(-mcpu|-march|-mfpu)' || CFLAGS="$CFLAGS -mcpu=cortex-a8 -mfpu=neon"
     cc_check '' '' '__asm__("add r0, r1, r2");' && define HAVE_ARM_INLINE_ASM
     if [ $compiler = CL ] && cpp_check '' '' 'defined(_M_ARM) && _M_ARM >= 7' ; then
@@ -1392,7 +1443,13 @@
 if [ "$pic" = "yes" ] ; then
     [ "$SYS" != WINDOWS -a "$SYS" != CYGWIN ] && CFLAGS="$CFLAGS -fPIC"
 -    [[ "$ASFLAGS" != *"-DPIC"* ]] && ASFLAGS="$ASFLAGS -DPIC"
 +    case " $ASFLAGS " in
 +        *" -DPIC "*)
 +            ;;
 +        *)
 +            ASFLAGS="$ASFLAGS -DPIC"
 +            ;;
 +    esac
     # resolve textrels in the x86 asm
     cc_check stdio.h "-shared -Wl,-Bsymbolic" && SOFLAGS="$SOFLAGS -Wl,-Bsymbolic"
     [ $SYS = SunOS -a "$ARCH" = "X86" ] && SOFLAGS="$SOFLAGS -mimpure-text"
@@ -1682,8 +1739,14 @@
 if [ "$bashcompletion" = "auto" ]; then
     if [ "$cli" = "no" ]; then
         bashcompletion="no"
 -    elif [[ -z "$bashcompletionsdir" && "$prefix" != "/usr" && "$prefix" != "/usr/"* ]]; then
 -        bashcompletion="no"
 +    elif [ -z "$bashcompletionsdir" ]; then
 +        case $prefix in
 +            /usr|/usr/*)
 +                ;;
 +            *)
 +                bashcompletion="no"
 +                ;;
 +        esac
     fi
 fi
@@ -1750,8 +1813,7 @@
 cat conftest.log
 [ "$SRCPATH" != "." ] && ln -sf ${SRCPATH}/Makefile ./Makefile
 -mkdir -p common/{aarch64,arm,mips,ppc,x86,loongarch} encoder extras filters/video input output tools
 +mkdir -p common/aarch64 common/arm common/mips common/ppc common/x86 common/loongarch encoder extras filters/video input output tools
 echo
 echo "You can run 'make' or 'make fprofiled' now."
 -
@@ -0,0 +1,385 @@
 diff --git a/Makefile.am b/Makefile.am
 index cbbe124..496f993 100644
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -68,7 +68,7 @@ EXTRA_DIST = xmlto.spec \
 	doc/xmlif.xml \
 	xmlto.mak
 -GEN_MANPAGE = FORMAT_DIR=$(top_srcdir)/format $(XMLTO_BASH_PATH) ./xmlto --skip-validation -o $(@D) man $<
 +GEN_MANPAGE = FORMAT_DIR=$(top_srcdir)/format $(XMLTO_SH_PATH) ./xmlto --skip-validation -o $(@D) man $<
 man/man1/xmlto.1: doc/xmlto.xml ; $(GEN_MANPAGE)
 man/man1/xmlif.1: doc/xmlif.xml ; $(GEN_MANPAGE)
 diff --git a/configure.ac b/configure.ac
 index 675dcb8..e5e3b7a 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -18,8 +18,11 @@ AC_CHECK_PROG([MKTEMP], [mktemp],, [mktemp])
 AC_ARG_VAR([FIND], [Name of the GNU `find' program.])
 AC_CHECK_PROG([FIND], [find],, [find] )
 -AC_ARG_VAR([XMLTO_BASH_PATH], [Name and path of the GNU `bash' shell.])
 -AC_PATH_PROG([XMLTO_BASH_PATH], [bash], [/bin/bash])
 +AC_ARG_VAR([XMLTO_SH_PATH], [Name and path of the POSIX `sh' shell.])
 +AC_ARG_VAR([XMLTO_BASH_PATH], [Deprecated alias for XMLTO_SH_PATH.])
 +AS_IF([test -n "$XMLTO_BASH_PATH" && test -z "$XMLTO_SH_PATH"],
 +      [XMLTO_SH_PATH=$XMLTO_BASH_PATH])
 +AC_PATH_PROG([XMLTO_SH_PATH], [sh], [/bin/sh])
 AC_ARG_VAR([GETOPT], [Name of the `getopt' program (requires longopt support).])
 AC_CHECK_PROG([GETOPT], [getopt],, [getopt])
 diff --git a/format/docbook/epub b/format/docbook/epub
 index 118d605..7acf1d4 100755
 --- a/format/docbook/epub
 +++ b/format/docbook/epub
@@ -1,4 +1,4 @@
 -if [ -z "`type -t $ZIP_PATH`" ]
 +if ! command -v "$ZIP_PATH" >/dev/null 2>&1
 then
   echo >&2 "Missing zip utility at $ZIP_PATH, conversion to epub not possible."
   echo >&2 "Exiting !"
@@ -26,7 +26,7 @@ case "$1" in
   do
     ${GCP_PATH:-cp} -R -P -p -- $INPUT_DIR/$CSS_SOURCE $CSS_DEST_DIR/
   done
 -  echo -n "application/epub+zip" > mimetype
 +  printf '%s' 'application/epub+zip' > mimetype
   EPUB_NAME=$(basename "${XSLT_PROCESSED%.*}").epub
   [ -e "$XSLT_PROCESSED" ] && rm "$XSLT_PROCESSED"
   ${ZIP_PATH} -0Xq $EPUB_NAME mimetype
 diff --git a/format/docbook/txt b/format/docbook/txt
 index fe42a1f..f356b47 100755
 --- a/format/docbook/txt
 +++ b/format/docbook/txt
@@ -1,14 +1,14 @@
 case "$USE_BACKEND" in
 DEFAULT|DBLATEX)
 -	if [ -n "`type -t $W3M_PATH`" ]
 +	if command -v "$W3M_PATH" >/dev/null 2>&1
 	then
 	  CONVERT="$W3M_PATH"
 	  ARGS="-T text/html -dump"
 -	elif [ -n "`type -t $LYNX_PATH`" ]
 +	elif command -v "$LYNX_PATH" >/dev/null 2>&1
 	then
 	  CONVERT="$LYNX_PATH"
 	  ARGS="-force_html -dump -nolist -width=72"
 -	elif [ -n "`type -t $LINKS_PATH`" ]
 +	elif command -v "$LINKS_PATH" >/dev/null 2>&1
 	then
 	  CONVERT="$LINKS_PATH"
 	  ARGS="-dump"
 diff --git a/format/fo/dvi b/format/fo/dvi
 index 6615048..82794cc 100755
 --- a/format/fo/dvi
 +++ b/format/fo/dvi
@@ -6,7 +6,7 @@ post-process)
   then
     echo >&2 "Post-process XSL-FO to DVI"
   fi
 -  if [ -z "`type -t $XMLTEX_PATH`" ]
 +  if ! command -v "$XMLTEX_PATH" >/dev/null 2>&1
   then
     echo >&2 "Can't process, xmltex tool not found at $XMLTEX_PATH."
     exit 3
 diff --git a/format/fo/pdf b/format/fo/pdf
 index 9e586b3..63936eb 100755
 --- a/format/fo/pdf
 +++ b/format/fo/pdf
@@ -8,7 +8,7 @@ DEFAULT|DBLATEX)
 	  then
 	    echo >&2 "Post-process XSL-FO to PDF"
 	  fi
 -	  if [ -z "`type -t $PDFXMLTEX_PATH`" ]
 +	  if ! command -v "$PDFXMLTEX_PATH" >/dev/null 2>&1
 	  then
 	    echo >&2 "Can't process, pdfxmltex tool not found at $PDFXMLTEX_PATH."
 	    exit 3
 diff --git a/format/xhtml1/txt b/format/xhtml1/txt
 index eb1c07a..2c843c2 100755
 --- a/format/xhtml1/txt
 +++ b/format/xhtml1/txt
@@ -1,14 +1,14 @@
 case "$USE_BACKEND" in
 DEFAULT|DBLATEX)
 -  if [ -n "`type -t $W3M_PATH`" ]
 +  if command -v "$W3M_PATH" >/dev/null 2>&1
   then
     CONVERT="$W3M_PATH"
     ARGS="-T text/html -dump"
 -  elif [ -n "`type -t $LYNX_PATH`" ]
 +  elif command -v "$LYNX_PATH" >/dev/null 2>&1
   then
     CONVERT="$LYNX_PATH"
     ARGS="-force_html -dump -nolist -width=72"
 -  elif [ -n "`type -t $LINKS_PATH`" ]
 +  elif command -v "$LINKS_PATH" >/dev/null 2>&1
   then
     CONVERT="$LINKS_PATH"
     ARGS="-dump"
 diff --git a/xmlif/test/run-test b/xmlif/test/run-test
 index a7ddbca..f007928 100755
 --- a/xmlif/test/run-test
 +++ b/xmlif/test/run-test
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 XMLIF=${top_builddir}/xmlif/xmlif
 INPUT=${top_srcdir}/xmlif/test/test.xml
 diff --git a/xmlto.in b/xmlto.in
 index d5a81a8..f75bfe3 100755
 --- a/xmlto.in
 +++ b/xmlto.in
@@ -1,4 +1,4 @@
 -#!@XMLTO_BASH_PATH@
 +#!@XMLTO_SH_PATH@
 #
 # @PACKAGE@ - apply an XSL stylesheet to an XML document
 # Copyright (C) 2001, 2002, 2003  Tim Waugh <twaugh@redhat.com>
@@ -19,7 +19,7 @@
 # Utilities that we need that aren't everywhere
 FIND=@FIND@               # This must be GNU find (need -maxdepth)
 MKTEMP=@MKTEMP@           # See http://www.mktemp.org if missing on your system
 -BASH=@XMLTO_BASH_PATH@    # GNU bash, for running the format scripts
 +SH=@XMLTO_SH_PATH@        # POSIX sh, for running the format scripts
 GETOPT=@GETOPT@           # a getopt that supports --longoptions
 TAIL=@TAIL@               # a tail that supports -n (posix)
 GREP=@GREP@               # GNU grep, for searching patterns
@@ -78,28 +78,41 @@ EOF
 #  * Remembers the temporary file's name so it can be deleted on exit
 #  * If the failure message is empty or missing, exits on failure
 make_temp () {
 -  local dirflag="" prefix="@PACKAGE@"
 -  [ "$1" = "-d" ] && { dirflag="-d"; shift; }
 -  [ -n "$1" ] && prefix="@PACKAGE@-$1"
 +  make_temp_dirflag=
 +  make_temp_prefix="@PACKAGE@"
 +  if [ "$1" = "-d" ]
 +  then
 +    make_temp_dirflag="-d"
 +    shift
 +  fi
 +  if [ -n "$1" ]
 +  then
 +    make_temp_prefix="@PACKAGE@-$1"
 +  fi
 -  if eval $2='$(${MKTEMP} $dirflag "${TMPDIR:-/tmp}/${prefix}.XXXXXX")'
 +  if eval "$2=\$(${MKTEMP} $make_temp_dirflag \"\${TMPDIR:-/tmp}/${make_temp_prefix}.XXXXXX\")"
   then
 -    CLEANFILES="$CLEANFILES ${!2}"
 +    eval "make_temp_path=\${$2}"
 +    CLEANFILES="$CLEANFILES $make_temp_path"
 +    unset make_temp_dirflag make_temp_path make_temp_prefix
     return 0
   elif [ -z "$3" ]
   then
 +    unset make_temp_dirflag make_temp_prefix
     echo >&2 "mktemp failed!"
     exit 2
   else
 +    unset make_temp_dirflag make_temp_prefix
     echo >&2 "mktemp failed. $3"
     return 2
   fi
 }
 compute_searchpath () {
 -  local oldIFS="${IFS}"
 +  compute_searchpath_oldIFS="${IFS}"
   IFS=":"
 -  for asearchpath in "$1"; do
 +  for asearchpath in $1
 +  do
     # wrangle relative paths into absolute ones so that the user
     # isn't surprised if he does ``--searchpath .''
     case "${asearchpath}" in
@@ -111,7 +124,8 @@ compute_searchpath () {
     # and only after the first iteration.
     XML_SEARCHPATH_SEPARATOR=":"
   done
 -  IFS="${oldIFS}"
 +  IFS="${compute_searchpath_oldIFS}"
 +  unset compute_searchpath_oldIFS
 }
 # Allow FORMAT_DIR to be over-ridden, so that we can be
@@ -135,7 +149,7 @@ XSL_MODS=
 # List of files to remove after exit
 CLEANFILES=
 -trap -- 'cd /; [ -z "$CLEANFILES" ] || rm -rf $CLEANFILES' EXIT
 +trap 'cd /; [ -z "$CLEANFILES" ] || rm -rf $CLEANFILES' 0
 XSLTOPTS=
 SEARCHPATH=
@@ -145,13 +159,13 @@ XMLLINT_PATH=@XMLLINT@
 XSLTPROC_PATH=@XSLTPROC@
 # Try to setup papersize using libpaper first ...
 -if type "$PAPERCONF_PATH" >/dev/null 2>&1
 +if command -v "$PAPERCONF_PATH" >/dev/null 2>&1
 then
   papername=`"$PAPERCONF_PATH" -n`
   paperheight=`"$PAPERCONF_PATH" -mh | sed 's/ //g'`
   paperwidth=`"$PAPERCONF_PATH" -mw | sed 's/ //g'`
 -  if [ -n "$paperheight" -a -n "$paperwidth" ]
 +  if [ -n "$paperheight" ] && [ -n "$paperwidth" ]
   then
     make_temp xsl papersizemod "Using default paper type." &&
     cat << EOF > "$papersizemod"
@@ -176,7 +190,7 @@ EOF
   fi
 # ... or use magic paper size, based on LC_PAPER
 -elif type "$LOCALE_PATH" >/dev/null 2>&1
 +elif command -v "$LOCALE_PATH" >/dev/null 2>&1
 then
   # For paper sizes we know about, specify them.
   h=$("$LOCALE_PATH" LC_PAPER 2>/dev/null | head -n 1)
@@ -199,7 +213,7 @@ EOF
 fi
 # Magic encoding, based on locale
 -if type "$LOCALE_PATH" >/dev/null 2>&1
 +if command -v "$LOCALE_PATH" >/dev/null 2>&1
 then
   charmap=$("$LOCALE_PATH" charmap 2>/dev/null)
@@ -249,12 +263,12 @@ XMLTEX_PATH=@XMLTEX@
 PDFXMLTEX_PATH=@PDFXMLTEX@
 #check if we could use fop/dblatex backend as default(if not, use passivetex)
 -if [ x"$USE_BACKEND" = xFOP ] && ! type "$FOP_PATH" >/dev/null 2>&1
 +if [ x"$USE_BACKEND" = xFOP ] && ! command -v "$FOP_PATH" >/dev/null 2>&1
 then
   echo >&2 "@PACKAGE@: Warning: fop not found or not executable."
   echo >&2 "@PACKAGE@: Using default backend..."
   USE_BACKEND=DEFAULT
 -elif type "$FOP_PATH" >/dev/null 2>&1
 +elif command -v "$FOP_PATH" >/dev/null 2>&1
 then
   # we should enable fop.extensions for fop 0_17,0_18 and 0_20*,
   # fop1.extensions for the rest
@@ -265,7 +279,7 @@ then
   fi
 fi
 if [ x"$USE_BACKEND" = xDBLATEX ] && \
 -   ! type "$DBLATEX_PATH" >/dev/null 2>&1
 +   ! command -v "$DBLATEX_PATH" >/dev/null 2>&1
 then
   echo >&2 "@PACKAGE@: Warning: dblatex not found or not executable."
   echo >&2 "@PACKAGE@: Using default backend..."
@@ -315,7 +329,7 @@ while [ "$#" -gt "0" ]; do
 	;;
   -o)
 	OUTPUT_DIR="$2"
 -	if type -p cygpath >/dev/null; then
 +	if command -v cygpath >/dev/null 2>&1; then
 		OUTPUT_DIR=$(cygpath "$OUTPUT_DIR")
 	fi
 	case "$OUTPUT_DIR" in
@@ -362,7 +376,7 @@ while [ "$#" -gt "0" ]; do
 	shift 2
 	;;
   --noclean)
 -	trap -- 'cd /; [ -z "$CLEANFILES" ] || echo "$CLEANFILES"' EXIT
 +	trap 'cd /; [ -z "$CLEANFILES" ] || echo "$CLEANFILES"' 0
 	shift
 	;;
   --noautosize)
@@ -371,7 +385,7 @@ while [ "$#" -gt "0" ]; do
   ;;
   --with-fop)
 	##use fop instead of passivetex where possible
 -	if ! type "$FOP_PATH" >/dev/null 2>&1
 +	if ! command -v "$FOP_PATH" >/dev/null 2>&1
 	then
 		echo >&2 Warning: fop not found or not executable.
 		echo >&2 Using default backend...
@@ -382,7 +396,7 @@ while [ "$#" -gt "0" ]; do
 	;;
   --with-dblatex)
 	##use dblatex instead of passivetex where possible
 -	if ! type "$DBLATEX_PATH" >/dev/null 2>&1
 +	if ! command -v "$DBLATEX_PATH" >/dev/null 2>&1
 	then
 		echo >&2 Warning: dblatex not found or not executable.
 		echo >&2 Using default backend...
@@ -426,7 +440,7 @@ case "$2" in
  *) INPUT_FILE="$PWD/$2" ;;
 esac
 -if [ -z "$DEST_FORMAT" -o -z "$INPUT_FILE" ]
 +if [ -z "$DEST_FORMAT" ] || [ -z "$INPUT_FILE" ]
 then
   usage
   exit 1
@@ -454,7 +468,7 @@ rootel_xpath='concat("{", namespace-uri(/*), "}", local-name(/*))'
 rootel="$("$XMLLINT_PATH" --xpath "$rootel_xpath" "$INPUT_FILE" 2>/dev/null)"
 -case $(echo $rootel) in
 +case $rootel in
   "{http://www.w3.org/1999/XSL/Format}root")
 	SOURCE_FORMAT="fo"
 	;;
@@ -498,13 +512,13 @@ export PDFXMLTEX_PATH
 export USE_BACKEND
 if [ -z "$STYLESHEET" ]
 then
 -  STYLESHEET="$(${BASH} "$FORMAT" stylesheet)" || exit 1
 +  STYLESHEET="$(${SH} "$FORMAT" stylesheet)" || exit 1
   [ "$VERBOSE" -ge 1 ] && echo >&2 "Stylesheet: ${STYLESHEET}"
 fi
 # We might need to create a temporary stylesheet if there are
 # XSL fragments that need adding.
 -if [ -n "$XSL_MODS" -a -n "$STYLESHEET" ]
 +if [ -n "$XSL_MODS" ] && [ -n "$STYLESHEET" ]
 then
   REAL_STYLESHEET="$STYLESHEET"
   [ "$VERBOSE" -ge 1 ] && echo >&2 "Real stylesheet: ${REAL_STYLESHEET}"
@@ -536,7 +550,7 @@ cd "$XSLT_PROCESSED_DIR"
 if [ "$SKIP_VALIDATION" -eq 0 ] && [ "$SOURCE_FORMAT" != "fo" ]
 then
   #do we have xmllint validation tool?
 -  if ! type "$XMLLINT_PATH" >/dev/null 2>&1
 +  if ! command -v "$XMLLINT_PATH" >/dev/null 2>&1
   then
     echo >&2 "@PACKAGE@: xmllint validation tool not found or not executable."
     echo >&2 "@PACKAGE@: Skipping validation... " \
@@ -572,7 +586,7 @@ XSLTOPTS="${XSLTPARAMS} ${XSLTOPTS}"
 if [ "$PROFILE" -eq 1 ] || [ -n "${STYLESHEET}" ]
 then
   #do we have xsltproc tool?
 -  if ! type "$XSLTPROC_PATH" >/dev/null 2>&1
 +  if ! command -v "$XSLTPROC_PATH" >/dev/null 2>&1
   then
     echo >&2 "@PACKAGE@: Can't continue, xsltproc tool not found or not executable."
     exit 3
@@ -653,6 +667,6 @@ export SEARCHPATH
 if [ "$VERBOSE" -gt 2 ]
 then
   # Extremely verbose
 -  BASH="${BASH} -x"
 +  SH="${SH} -x"
 fi
 -${BASH} "$FORMAT" post-process || exit 1
 +${SH} "$FORMAT" post-process || exit 1
 diff --git a/xmlto.spec.in b/xmlto.spec.in
 index b9eb4a2..763f76d 100644
 --- a/xmlto.spec.in
 +++ b/xmlto.spec.in
@@ -57,7 +57,7 @@ xhtml1 source format.
 %autosetup -p1
 %build
 -%configure BASH=/bin/bash
 +%configure XMLTO_SH_PATH=/bin/sh
 %make_build
 %check
@@ -0,0 +1,19 @@
 diff --git a/xslt/common/domains/gen_yelp_xml.sh b/xslt/common/domains/gen_yelp_xml.sh
 index 29e133b..e77ca99 100755
 --- a/xslt/common/domains/gen_yelp_xml.sh
 +++ b/xslt/common/domains/gen_yelp_xml.sh
@@ -1,4 +1,4 @@
 -#!/bin/bash
 +#!/bin/sh
 set -e
@@ -10,7 +10,7 @@ output=''
 target=''
 parse_options() {
 -    while [[ -n "${1}" ]]; do
 +    while [ -n "${1}" ]; do
         case "${1}" in
             --input)
                 input="${2}"
@@ -0,0 +1,63 @@
 diff -u a/Src/exec.c b/Src/exec.c
 --- a/Src/exec.c	2022-05-08 01:18:22.000000000 -0500
 +++ b/Src/exec.c	2026-02-25 22:23:44.602848997 -0600
@@ -4679,7 +4679,34 @@
 	zclose(pipes[1]);
 	retval = readoutput(pipes[0], qt, NULL);
 	fdtable[pipes[0]] = FDT_UNUSED;
 -	waitforpid(pid, 0);		/* unblocks */
 +	wait_for_processes();
 +	/*
 +	 * The SIGCHLD handler may already have reaped the command
 +	 * substitution child while readoutput() had signals unblocked.
 +	 * In that case cmdoutpid is cleared, and calling waitforpid()
 +	 * on a stale PID can hang if the PID has been reused.
 +	 */
 +	if (cmdoutpid == pid) {
 +	    int status;
 +	    pid_t waitret;
 +
 +	    while ((waitret = waitpid(pid, &status, 0)) < 0 && errno == EINTR)
 +		;
 +	    if (waitret == pid) {
 +		cmdoutpid = 0;
 +		if (WIFSIGNALED(status))
 +		    cmdoutval = (0200 | WTERMSIG(status));
 +		else
 +		    cmdoutval = WEXITSTATUS(status);
 +		use_cmdoutval = 1;
 +		get_usage();
 +	    } else if (waitret < 0 && errno == ECHILD) {
 +		wait_for_processes();
 +		if (cmdoutpid == pid)
 +		    cmdoutpid = 0;
 +	    }
 +	}
 +	child_unblock();
 	lastval = cmdoutval;
 	return retval;
     }
@@ -4884,7 +4911,22 @@
 	return nam;
     } else if (pid) {
 	close(fd);
 -	waitforpid(pid, 0);
 +	wait_for_processes();
 +	if (cmdoutpid == pid) {
 +	    int status;
 +	    pid_t waitret;
 +
 +	    while ((waitret = waitpid(pid, &status, 0)) < 0 && errno == EINTR)
 +		;
 +	    if (waitret == pid)
 +		cmdoutpid = 0;
 +	    else if (waitret < 0 && errno == ECHILD) {
 +		wait_for_processes();
 +		if (cmdoutpid == pid)
 +		    cmdoutpid = 0;
 +	    }
 +	}
 +	child_unblock();
 	cmdoutval = 0;
 	return nam;
     }