diff --git a/dev-libs/libxml2/Manifest b/dev-libs/libxml2/Manifest
index 9ded83c..4519fba 100644
--- a/dev-libs/libxml2/Manifest
+++ b/dev-libs/libxml2/Manifest
@@ -1,5 +1,8 @@
 DIST libxml2-2.9.10-r1-patchset.tar.xz 72088 BLAKE2B 4d5f8aed35d6c0232089e09f22a77cbd25cbd2007c1330538e1c7acc4398ec3ef9023289129677cf5499dbacde4c2f28850ae81acab351d02625d3452aedaede SHA512 a63032d1e85128f637c2b54356aab06a17e31eb1f5facd8fdf88463eb21df6a1d9fd8cc751fa94b8d322fa4f796be4e1d9aa071cbd0826ab31fae46525fde952
 DIST libxml2-2.9.10.tar.gz 5624761 BLAKE2B a9958bd7db17fbfb8259b64d66548eb19d28f1aecf40cf66752fcec5720855d31cea9941d52963badd8c18ea1770485f1c11da6213149458336ce0273418f421 SHA512 0adfd12bfde89cbd6296ba6e66b6bed4edb814a74b4265bda34d95c41d9d92c696ee7adb0c737aaf9cc6e10426a31a35079b2a23d26c074e299858da12c072ed
 DIST xmlts20080827.tar.gz 638940 BLAKE2B c5aab959c6e0698acd5b9be82b48a8ac26f4d01cc03f9acfff20d344f97f4711fc6d4a524ae70457147e8e30c72e27b6726829e1dd21896286aa974ed60774e7 SHA512 7325d0977c4427fc4944b291ccf896a665f654cc24399e5565c12a849c2bc3aef4fa3ee42a09ac115abcb6570c51a8fbd052c38d64d164279ecdecad5a4e884d
+DIST libxml2-2.9.12.tar.gz 5681632 BLAKE2B ab93633140e9fd119d3a48ed829a91213c3d7956a00d181203f5188fb0ed0d3a7150d3128fe986b13efadf6fe484393262a3de575527f38f74aa6c0067a6d934 SHA512 df1c6486e80f0fcf3c506f3599bcfb94b620c00d0b5d26831bc983daa78d58ec58b5057b1ec7c1a26c694f40199c6234ee2a6dcabf65abfa10c447cb5705abbd
+DIST libxml2-2.9.12.tar.gz.asc 488 BLAKE2B 48ec86ec373d94de73bdb52141fc77fccd0ca296a35ed97aa3479ecdcf82b15422dd7d751359b5b1ca477e24b8eee9226784cfbfd861236e10eed2519e7959bf SHA512 69ca6ab7170cad467724e19eff99a3544966a26069e78a7b7cc27ae93a9077b11cc8dad2536bd0b27c3b45f4ea7520c813fe5a018cd65f103059f7f75147a656
+DIST xmlts20130923.tar.gz 641522 BLAKE2B 63a47bc69278ef510cd0b3779aed729e1b309e30efa0015d28ed051cc03f9dfddb447ab57b07b3393e8f47393d15473b0e199c34cb1f5f746b15ddfaa55670be SHA512 d5c4d26b324ed21f4e0641cd7f8b76dbf9de80df8b519982e44d41c960df29fd03618e02e9693b2d11ad06d19c4a965274c95a048ec3b9653eacb919a7f8b733
 DIST xsts-2002-01-16.tar.gz 6894439 BLAKE2B 1e9ec63d2c104655e64249e07440a04d862fcbcd4d4e19745d81b34994319b510a531c9d6df1491fae1e90b5d0764f0f1a827251ca8df5d613178b0eab01ef25 SHA512 43300af6d39c1e2221b0ed7318fe14c7464eeb6eb030ed1e22eb29b4ab17f014e2a4c8887c3a46ae5d243e3072da27f00f4e285498ae6f1288177d38d1108288
 DIST xsts-2004-01-14.tar.gz 2761085 BLAKE2B 41545995fb3a65d053257c376c07d45ffd1041a433bfbdb46d4dd87a5afb60c18c8629a3d988323f9e7a1d709775b5a7e5930276a7121c0725a22705c0976e36 SHA512 32854388d7e720ad67156baf50bf2bae7bd878ca3e35fd7e44e57cad3f434f69d56bbbedd61509f8a1faf01c9eae74a078df8fe130780b182c05c05cb1c39ebe
diff --git a/dev-libs/libxml2/files/libxml2-2.9.11-disable-fuzz-tests.patch b/dev-libs/libxml2/files/libxml2-2.9.11-disable-fuzz-tests.patch
new file mode 100644
index 0000000..7f6fd4a
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.9.11-disable-fuzz-tests.patch
@@ -0,0 +1,33 @@
+https://gitlab.gnome.org/GNOME/libxml2/-/issues/252
+
+From 5d6403682a3463f29a1f7c27aa54ecb5e3971547 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Thu, 13 May 2021 17:40:22 +0000
+Subject: [PATCH] Disable fuzz tests
+
+Not all of the fuzz files are included with the dist tarball,
+so disabling them for now to get the release in with most tests
+given the security bug.
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -2,9 +2,9 @@
+ 
+ ACLOCAL_AMFLAGS = -I m4
+ 
+-SUBDIRS = include . doc example fuzz xstc $(PYTHON_SUBDIR)
++SUBDIRS = include . doc example xstc $(PYTHON_SUBDIR)
+ 
+-DIST_SUBDIRS = include . doc example fuzz python xstc
++DIST_SUBDIRS = include . doc example python xstc
+ 
+ AM_CPPFLAGS = -I$(top_builddir)/include -I$(srcdir)/include
+ 
+@@ -210,7 +210,6 @@ runtests: runtest$(EXEEXT) testrecurse$(EXEEXT) testapi$(EXEEXT) \
+ 	    $(CHECKER) ./runxmlconf$(EXEEXT)
+ 	@(if [ "$(PYTHON_SUBDIR)" != "" ] ; then cd python ; \
+ 	    $(MAKE) tests ; fi)
+-	@cd fuzz; $(MAKE) tests
+ 
+ check: all runtests
+ 
+-- 
diff --git a/dev-libs/libxml2/libxml2-2.9.12.ebuild b/dev-libs/libxml2/libxml2-2.9.12.ebuild
new file mode 100644
index 0000000..12cd4c1
--- /dev/null
+++ b/dev-libs/libxml2/libxml2-2.9.12.ebuild
@@ -0,0 +1,240 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+# Note: Please bump in sync with dev-libs/libxslt
+
+PYTHON_COMPAT=( python3_{6,7,8} )
+PYTHON_REQ_USE="xml"
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/danielveillard.asc
+inherit autotools flag-o-matic prefix python-r1 multilib-minimal verify-sig
+
+XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
+XSTS_NAME_1="xmlschema2002-01-16"
+XSTS_NAME_2="xmlschema2004-01-14"
+XSTS_TARBALL_1="xsts-2002-01-16.tar.gz"
+XSTS_TARBALL_2="xsts-2004-01-14.tar.gz"
+XMLCONF_TARBALL="xmlts20130923.tar.gz"
+DESCRIPTION="XML C parser and toolkit"
+HOMEPAGE="http://www.xmlsoft.org/ https://gitlab.gnome.org/GNOME/libxml2"
+SRC_URI="
+	ftp://xmlsoft.org/${PN}/${PN}-${PV/_rc/-rc}.tar.gz
+	test? (
+		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
+		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2}
+		https://www.w3.org/XML/Test/${XMLCONF_TARBALL}
+	)
+	verify-sig? ( ftp://xmlsoft.org/${PN}/${PN}-${PV/_rc/-rc}.tar.gz.asc )
+"
+S="${WORKDIR}/${PN}-${PV%_rc*}"
+
+LICENSE="MIT"
+SLOT="2"
+KEYWORDS="*"
+IUSE="debug examples icu ipv6 lzma +python readline static-libs test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+BDEPEND="
+	dev-util/gtk-doc-am
+	virtual/pkgconfig
+	verify-sig? ( app-crypt/openpgp-keys-danielveillard )
+"
+RDEPEND="
+	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
+	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:= )
+"
+DEPEND="${RDEPEND}"
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/xml2-config
+)
+
+DOCS=( AUTHORS ChangeLog NEWS README TODO TODO_SCHEMAS )
+
+PATCHES=(
+	# Patches needed for prefix support
+	"${FILESDIR}"/${PN}-2.7.1-catalog_path.patch
+
+	# Fix python detection, bug #567066
+	# https://bugzilla.gnome.org/show_bug.cgi?id=760458
+	"${FILESDIR}"/${PN}-2.9.2-python-ABIFLAG.patch
+
+	# Fix python tests when building out of tree #565576
+	"${FILESDIR}"/${PN}-2.9.8-out-of-tree-test.patch
+
+	# bug #745162
+	"${FILESDIR}"/${PN}-2.9.8-python3-unicode-errors.patch
+
+	# Avoid failure on missing fuzz.h when running tests
+	"${FILESDIR}"/${PN}-2.9.11-disable-fuzz-tests.patch
+)
+
+src_unpack() {
+	local tarname=${P/_rc/-rc}.tar.gz
+
+	if use verify-sig ; then
+		verify-sig_verify_detached "${DISTDIR}"/${tarname}{,.asc}
+	fi
+
+	# ${A} isn't used to avoid unpacking of test tarballs into ${WORKDIR},
+	# as they are needed as tarballs in ${S}/xstc instead and not unpacked
+	unpack ${tarname}
+	cd "${S}" || die
+
+	if use test ; then
+		cp "${DISTDIR}/${XSTS_TARBALL_1}" \
+			"${DISTDIR}/${XSTS_TARBALL_2}" \
+			"${S}"/xstc/ \
+			|| die "Failed to install test tarballs"
+		unpack ${XMLCONF_TARBALL}
+	fi
+}
+
+src_prepare() {
+	default
+
+	eprefixify catalog.c xmlcatalog.c runtest.c xmllint.c
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Avoid final linking arguments for python modules
+		sed -i -e '/PYTHON_LIBS/s/ldflags/libs/' configure.ac || die
+		# gcc-apple doesn't grok -Wno-array-bounds
+		sed -i -e 's/-Wno-array-bounds//' configure.ac || die
+	fi
+
+	# Please do not remove, as else we get references to PORTAGE_TMPDIR
+	# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
+	# We now need to run eautoreconf at the end to prevent maintainer mode.
+	#elibtoolize
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# Filter seemingly problematic CFLAGS (#26320)
+	filter-flags -fprefetch-loop-arrays -funroll-loops
+
+	# Notes:
+	# 1) USE zlib support breaks gnome2
+	#    (libgnomeprint for instance fails to compile with
+	#    fresh install, and existing) - <azarah@gentoo.org> (22 Dec 2002).
+	#
+	# 2) The meaning of the 'debug' USE flag does not apply to the --with-debug
+	#    switch (enabling the libxml2 debug module). See bug #100898.
+	#
+	# 3) --with-mem-debug causes unusual segmentation faults (bug #105120).
+
+	libxml2_configure() {
+		ECONF_SOURCE="${S}" econf \
+			--with-html-subdir=${PF}/html \
+			$(use_with debug run-debug) \
+			$(use_with icu) \
+			$(use_with lzma) \
+			$(use_enable ipv6) \
+			$(use_enable static-libs static) \
+			$(multilib_native_use_with readline) \
+			$(multilib_native_use_with readline history) \
+			"$@"
+	}
+
+	libxml2_py_configure() {
+		# Ensure python build dirs exist
+		mkdir -p "${BUILD_DIR}" || die
+
+		# Odd build system, also see bug #582130
+		run_in_build_dir libxml2_configure \
+			"--with-python=${EPYTHON}" \
+			"--with-python-install-dir=$(python_get_sitedir)"
+	}
+
+	# Build python bindings separately
+	libxml2_configure --without-python
+
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl libxml2_py_configure
+	fi
+}
+
+libxml2_py_emake() {
+	pushd "${BUILD_DIR}/python" > /dev/null || die
+
+	emake "$@"
+
+	popd > /dev/null || die
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		local native_builddir="${BUILD_DIR}"
+
+		python_foreach_impl libxml2_py_emake \
+				top_builddir="${native_builddir}" \
+				all
+	fi
+}
+
+multilib_src_test() {
+	ln -s "${S}"/xmlconf || die
+
+	emake check
+
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl libxml2_py_emake test
+	fi
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		EXAMPLES_DIR="${EPREFIX}"/usr/share/doc/${PF}/examples \
+		install
+
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl libxml2_py_emake \
+			DESTDIR="${D}" \
+			docsdir="${EPREFIX}"/usr/share/doc/${PF}/python \
+			exampledir="${EPREFIX}"/usr/share/doc/${PF}/python/examples \
+			install
+
+		python_foreach_impl python_optimize
+	fi
+}
+
+multilib_src_install_all() {
+	rm -rf "${ED}"/usr/share/doc/${P}
+
+	einstalldocs
+
+	if ! use examples ; then
+		rm -rf "${ED}"/usr/share/doc/${PF}/examples
+		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	# We don't want to do the xmlcatalog during stage1, as xmlcatalog will not
+	# be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887.
+	if [[ -n "${ROOT}" ]]; then
+		elog "Skipping XML catalog creation for stage building (bug #208887)."
+	else
+		# Need an XML catalog, so no-one writes to a non-existent one
+		CATALOG="${EROOT}/etc/xml/catalog"
+
+		# We don't want to clobber an existing catalog though,
+		# only ensure that one is there
+		# <obz@gentoo.org>
+		if [[ ! -e "${CATALOG}" ]]; then
+			[[ -d "${EROOT}/etc/xml" ]] || mkdir -p "${EROOT}/etc/xml"
+			"${EPREFIX}"/usr/bin/xmlcatalog --create > "${CATALOG}"
+			einfo "Created XML catalog in ${CATALOG}"
+		fi
+	fi
+}
diff --git a/eclass/verify-sig.eclass b/eclass/verify-sig.eclass
new file mode 100644
index 0000000..e3ef7f2
--- /dev/null
+++ b/eclass/verify-sig.eclass
@@ -0,0 +1,271 @@
+# Copyright 2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# @ECLASS: verify-sig.eclass
+# @MAINTAINER:
+# Michał Górny <mgorny@gentoo.org>
+# @SUPPORTED_EAPIS: 7
+# @BLURB: Eclass to verify upstream signatures on distfiles
+# @DESCRIPTION:
+# verify-sig eclass provides a streamlined approach to verifying
+# upstream signatures on distfiles.  Its primary purpose is to permit
+# developers to easily verify signatures while bumping packages.
+# The eclass removes the risk of developer forgetting to perform
+# the verification, or performing it incorrectly, e.g. due to additional
+# keys in the local keyring.  It also permits users to verify
+# the developer's work.
+#
+# To use the eclass, start by packaging the upstream's key
+# as app-crypt/openpgp-keys-*.  Then inherit the eclass, add detached
+# signatures to SRC_URI and set VERIFY_SIG_OPENPGP_KEY_PATH.  The eclass
+# provides verify-sig USE flag to toggle the verification.
+#
+# Example use:
+# @CODE
+# inherit verify-sig
+#
+# SRC_URI="https://example.org/${P}.tar.gz
+#   verify-sig? ( https://example.org/${P}.tar.gz.sig )"
+# BDEPEND="
+#   verify-sig? ( app-crypt/openpgp-keys-example )"
+#
+# VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/example.asc
+# @CODE
+
+case "${EAPI:-0}" in
+	0|1|2|3|4|5|6)
+		die "Unsupported EAPI=${EAPI} (obsolete) for ${ECLASS}"
+		;;
+	7)
+		;;
+	*)
+		die "Unsupported EAPI=${EAPI} (unknown) for ${ECLASS}"
+		;;
+esac
+
+EXPORT_FUNCTIONS src_unpack
+
+if [[ ! ${_VERIFY_SIG_ECLASS} ]]; then
+
+IUSE="verify-sig"
+
+BDEPEND="
+	verify-sig? (
+		app-crypt/gnupg
+		>=app-portage/gemato-16
+	)"
+
+# @ECLASS-VARIABLE: VERIFY_SIG_OPENPGP_KEY_PATH
+# @DEFAULT_UNSET
+# @DESCRIPTION:
+# Path to key bundle used to perform the verification.  This is required
+# when using default src_unpack.  Alternatively, the key path can be
+# passed directly to the verification functions.
+
+# @ECLASS-VARIABLE: VERIFY_SIG_OPENPGP_KEYSERVER
+# @DEFAULT_UNSET
+# @DESCRIPTION:
+# Keyserver used to refresh keys.  If not specified, the keyserver
+# preference from the key will be respected.  If no preference
+# is specified by the key, the GnuPG default will be used.
+
+# @ECLASS-VARIABLE: VERIFY_SIG_OPENPGP_KEY_REFRESH
+# @USER_VARIABLE
+# @DESCRIPTION:
+# Attempt to refresh keys via WKD/keyserver.  Set it to "yes"
+# in make.conf to enable.  Note that this requires working Internet
+# connection.
+: ${VERIFY_SIG_OPENPGP_KEY_REFRESH:=no}
+
+# @FUNCTION: verify-sig_verify_detached
+# @USAGE: <file> <sig-file> [<key-file>]
+# @DESCRIPTION:
+# Read the detached signature from <sig-file> and verify <file> against
+# it.  <key-file> can either be passed directly, or it defaults
+# to VERIFY_SIG_OPENPGP_KEY_PATH.  The function dies if verification
+# fails.
+verify-sig_verify_detached() {
+	local file=${1}
+	local sig=${2}
+	local key=${3:-${VERIFY_SIG_OPENPGP_KEY_PATH}}
+
+	[[ -n ${key} ]] ||
+		die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset"
+
+	local extra_args=()
+	[[ ${VERIFY_SIG_OPENPGP_KEY_REFRESH} == yes ]] || extra_args+=( -R )
+	[[ -n ${VERIFY_SIG_OPENPGP_KEYSERVER+1} ]] && extra_args+=(
+		--keyserver "${VERIFY_SIG_OPENPGP_KEYSERVER}"
+	)
+
+	# GPG upstream knows better than to follow the spec, so we can't
+	# override this directory.  However, there is a clean fallback
+	# to GNUPGHOME.
+	addpredict /run/user
+
+	local filename=${file##*/}
+	[[ ${file} == - ]] && filename='(stdin)'
+	einfo "Verifying ${filename} ..."
+	gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \
+		gpg --verify "${sig}" "${file}" ||
+		die "PGP signature verification failed"
+}
+
+# @FUNCTION: verify-sig_verify_message
+# @USAGE: <file> <output-file> [<key-file>]
+# @DESCRIPTION:
+# Verify that the file ('-' for stdin) contains a valid, signed PGP
+# message and write the message into <output-file> ('-' for stdout).
+# <key-file> can either be passed directly, or it defaults
+# to VERIFY_SIG_OPENPGP_KEY_PATH.  The function dies if verification
+# fails.  Note that using output from <output-file> is important as it
+# prevents the injection of unsigned data.
+verify-sig_verify_message() {
+	local file=${1}
+	local output_file=${2}
+	local key=${3:-${VERIFY_SIG_OPENPGP_KEY_PATH}}
+
+	[[ -n ${key} ]] ||
+		die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset"
+
+	local extra_args=()
+	[[ ${VERIFY_SIG_OPENPGP_KEY_REFRESH} == yes ]] || extra_args+=( -R )
+	[[ -n ${VERIFY_SIG_OPENPGP_KEYSERVER+1} ]] && extra_args+=(
+		--keyserver "${VERIFY_SIG_OPENPGP_KEYSERVER}"
+	)
+
+	# GPG upstream knows better than to follow the spec, so we can't
+	# override this directory.  However, there is a clean fallback
+	# to GNUPGHOME.
+	addpredict /run/user
+
+	local filename=${file##*/}
+	[[ ${file} == - ]] && filename='(stdin)'
+	einfo "Verifying ${filename} ..."
+	gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \
+		gpg --verify --output="${output_file}" "${file}" ||
+		die "PGP signature verification failed"
+}
+
+# @FUNCTION: verify-sig_verify_signed_checksums
+# @USAGE: <checksum-file> <algo> <files> [<key-file>]
+# @DESCRIPTION:
+# Verify the checksums for all files listed in the space-separated list
+# <files> (akin to ${A}) using a PGP-signed <checksum-file>.  <algo>
+# specified the checksum algorithm (e.g. sha256).  <key-file> can either
+# be passed directly, or it defaults to VERIFY_SIG_OPENPGP_KEY_PATH.
+#
+# The function dies if PGP verification fails, the checksum file
+# contains unsigned data, one of the files do not match checksums
+# or are missing from the checksum file.
+verify-sig_verify_signed_checksums() {
+	local checksum_file=${1}
+	local algo=${2}
+	local files=()
+	read -r -d '' -a files <<<"${3}"
+	local key=${4:-${VERIFY_SIG_OPENPGP_KEY_PATH}}
+
+	local chksum_prog chksum_len
+	case ${algo} in
+		sha256)
+			chksum_prog=sha256sum
+			chksum_len=64
+			;;
+		*)
+			die "${FUNCNAME}: unknown checksum algo ${algo}"
+			;;
+	esac
+
+	[[ -n ${key} ]] ||
+		die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset"
+
+	local checksum filename junk ret=0 count=0
+	while read -r checksum filename junk; do
+		[[ ${#checksum} -eq ${chksum_len} ]] || continue
+		[[ -z ${checksum//[0-9a-f]} ]] || continue
+		has "${filename}" "${files[@]}" || continue
+		[[ -z ${junk} ]] || continue
+
+		"${chksum_prog}" -c --strict - <<<"${checksum} ${filename}"
+		if [[ ${?} -eq 0 ]]; then
+			(( count++ ))
+		else
+			ret=1
+		fi
+	done < <(verify-sig_verify_message "${checksum_file}" - "${key}")
+
+	[[ ${ret} -eq 0 ]] ||
+		die "${FUNCNAME}: at least one file did not verify successfully"
+	[[ ${count} -eq ${#files[@]} ]] ||
+		die "${FUNCNAME}: checksums for some of the specified files were missing"
+}
+
+# @FUNCTION: verify-sig_src_unpack
+# @DESCRIPTION:
+# Default src_unpack override that verifies signatures for all
+# distfiles if 'verify-sig' flag is enabled.  The function dies if any
+# of the signatures fails to verify or if any distfiles are not signed.
+# Please write src_unpack() yourself if you need to perform partial
+# verification.
+verify-sig_src_unpack() {
+	if use verify-sig; then
+		local f suffix found
+		local distfiles=() signatures=() nosigfound=() straysigs=()
+
+		# find all distfiles and signatures, and combine them
+		for f in ${A}; do
+			found=
+			for suffix in .asc .sig; do
+				if [[ ${f} == *${suffix} ]]; then
+					signatures+=( "${f}" )
+					found=sig
+					break
+				else
+					if has "${f}${suffix}" ${A}; then
+						distfiles+=( "${f}" )
+						found=dist+sig
+						break
+					fi
+				fi
+			done
+			if [[ ! ${found} ]]; then
+				nosigfound+=( "${f}" )
+			fi
+		done
+
+		# check if all distfiles are signed
+		if [[ ${#nosigfound[@]} -gt 0 ]]; then
+			eerror "The following distfiles lack detached signatures:"
+			for f in "${nosigfound[@]}"; do
+				eerror "  ${f}"
+			done
+			die "Unsigned distfiles found"
+		fi
+
+		# check if there are no stray signatures
+		for f in "${signatures[@]}"; do
+			if ! has "${f%.*}" "${distfiles[@]}"; then
+				straysigs+=( "${f}" )
+			fi
+		done
+		if [[ ${#straysigs[@]} -gt 0 ]]; then
+			eerror "The following signatures do not match any distfiles:"
+			for f in "${straysigs[@]}"; do
+				eerror "  ${f}"
+			done
+			die "Unused signatures found"
+		fi
+
+		# now perform the verification
+		for f in "${signatures[@]}"; do
+			verify-sig_verify_detached \
+				"${DISTDIR}/${f%.*}" "${DISTDIR}/${f}"
+		done
+	fi
+
+	# finally, unpack the distfiles
+	default_src_unpack
+}
+
+_VERIFY_SIG_ECLASS=1
+fi
diff --git a/metadata/md5-cache/dev-libs/libxml2-2.9.12 b/metadata/md5-cache/dev-libs/libxml2-2.9.12
new file mode 100644
index 0000000..0714c69
--- /dev/null
+++ b/metadata/md5-cache/dev-libs/libxml2-2.9.12
@@ -0,0 +1,16 @@
+BDEPEND=dev-util/gtk-doc-am virtual/pkgconfig verify-sig? ( app-crypt/openpgp-keys-danielveillard ) >=app-portage/elt-patches-20170815 verify-sig? ( app-crypt/gnupg >=app-portage/gemato-16 )
+DEFINED_PHASES=compile configure install postinst prepare test unpack
+DEPEND=>=sys-libs/zlib-1.2.8-r1:=[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?,abi_arm_32(-)?,abi_arm_64(-)?] icu? ( >=dev-libs/icu-51.2-r1:=[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?,abi_arm_32(-)?,abi_arm_64(-)?] ) lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?,abi_arm_32(-)?,abi_arm_64(-)?] ) python? ( python_targets_python3_7? ( dev-lang/python:3.7[xml] ) python_targets_python3_8? ( dev-lang/python:3.8[xml] ) python_targets_python3_9? ( dev-lang/python:3.9[xml] ) >=dev-lang/python-exec-2:=[python_targets_python3_7(-)?,python_targets_python3_8(-)?,python_targets_python3_9(-)?,-python_single_target_python3_7(-),-python_single_target_python3_8(-),-python_single_target_python3_9(-)] ) readline? ( sys-libs/readline:= ) !<sys-devel/gettext-0.18.1.1-r3 || ( >=sys-devel/automake-1.16.1:1.16 >=sys-devel/automake-1.15.1:1.15 ) >=sys-devel/autoconf-2.69 >=sys-devel/libtool-2.4
+DESCRIPTION=XML C parser and toolkit
+EAPI=7
+HOMEPAGE=http://www.xmlsoft.org/ https://gitlab.gnome.org/GNOME/libxml2
+IUSE=debug examples icu ipv6 lzma +python readline static-libs test python_targets_python3_7 python_targets_python3_8 python_targets_python3_9 abi_x86_32 abi_x86_64 abi_x86_x32 abi_mips_n32 abi_mips_n64 abi_mips_o32 abi_ppc_32 abi_ppc_64 abi_s390_32 abi_s390_64 abi_arm_32 abi_arm_64 verify-sig
+KEYWORDS=*
+LICENSE=MIT
+RDEPEND=>=sys-libs/zlib-1.2.8-r1:=[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?,abi_arm_32(-)?,abi_arm_64(-)?] icu? ( >=dev-libs/icu-51.2-r1:=[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?,abi_arm_32(-)?,abi_arm_64(-)?] ) lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?,abi_arm_32(-)?,abi_arm_64(-)?] ) python? ( python_targets_python3_7? ( dev-lang/python:3.7[xml] ) python_targets_python3_8? ( dev-lang/python:3.8[xml] ) python_targets_python3_9? ( dev-lang/python:3.9[xml] ) >=dev-lang/python-exec-2:=[python_targets_python3_7(-)?,python_targets_python3_8(-)?,python_targets_python3_9(-)?,-python_single_target_python3_7(-),-python_single_target_python3_8(-),-python_single_target_python3_9(-)] ) readline? ( sys-libs/readline:= )
+REQUIRED_USE=python? ( || ( python_targets_python3_7 python_targets_python3_8 python_targets_python3_9 ) )
+RESTRICT=!test? ( test )
+SLOT=2
+SRC_URI=ftp://xmlsoft.org/libxml2/libxml2-2.9.12.tar.gz test? ( http://www.w3.org/XML/2004/xml-schema-test-suite/xmlschema2002-01-16/xsts-2002-01-16.tar.gz http://www.w3.org/XML/2004/xml-schema-test-suite/xmlschema2004-01-14/xsts-2004-01-14.tar.gz https://www.w3.org/XML/Test/xmlts20130923.tar.gz ) verify-sig? ( ftp://xmlsoft.org/libxml2/libxml2-2.9.12.tar.gz.asc )
+_eclasses_=autotools	d0e5375d47f4c809f406eb892e531513	eutils	fcb2aa98e1948b835b5ae66ca52868c5	flag-o-matic	5d5921a298e95441da2f85be419894c0	libtool	f143db5a74ccd9ca28c1234deffede96	multibuild	40fe59465edacd730c644ec2bc197809	multilib	2477ebe553d3e4d2c606191fe6c33602	multilib-build	1979aa0ff4d356d32507ca4650d9f37d	multilib-minimal	8bddda43703ba94d8341f4e247f97566	prefix	e51c7882b7b721e54e684f7eb143cbfe	python-r1	79e26ce8f853c9daebe9a4956e37cc1b	python-utils-r1	157a6a7a3e99c7dbdf81acc9dd4f57cd	toolchain-funcs	605c126bed8d87e4378d5ff1645330cb	verify-sig	40b4f4f782cf67118f594ce604cc4c0a
+_md5_=0a504425f0a2e5f75222d46355f316f8