--- nss-3.13.6.ebuild.old	2012-09-25 13:47:10.534156441 +0200
+++ nss-3.13.6.ebuild	2012-09-25 14:28:13.894223984 +0200
@@ -2,7 +2,7 @@
 # Distributed under the terms of the GNU General Public License v2
 # $Header: /var/cvsroot/gentoo-x86/dev-libs/nss/nss-3.13.6.ebuild,v 1.4 2012/09/15 12:12:45 nativemad Exp $
 
-EAPI=3
+EAPI=4
 inherit eutils flag-o-matic multilib toolchain-funcs
 
 NSPR_VER="4.9.2"
@@ -26,6 +26,15 @@
 	>=dev-db/sqlite-3.5
 	sys-libs/zlib"
 
+pkg_pretend() {
+	if [ "${ROOT}" != "/" ]; then
+		HOST_SHLIBSIGN=$(which shlibsign)
+		if [ -z "$HOST_SHLIBSIGN" ]; then
+			die "Please install NSS with USE=utils on host system."
+		fi
+	fi
+}
+
 src_setup() {
 	export LC_ALL="C"
 }
@@ -37,6 +46,7 @@
 	epatch "${DISTDIR}/${PN}-3.13.6-add_spi+cacerts_ca_certs.patch"
 	epatch "${DISTDIR}/${PN}-3.13.3_pem.support"
 	epatch "${FILESDIR}/${PN}-3.13.5-x32.patch"
+	epatch "${FILESDIR}/${PN}-3.13.6-no-sign.patch"
 
 	cd "${S}"/mozilla/security/coreconf || die
 	# hack nspr paths
@@ -59,6 +69,11 @@
 
 	epatch "${FILESDIR}/nss-3.13.1-solaris-gcc.patch"
 
+	if tc-is-cross-compiler; then
+		# use the nsinstall binary we build later
+		epatch "${FILESDIR}/${PN}-3.13.6-nsinstall-path.patch"
+	fi
+
 	# dirty hack
 	cd "${S}"/mozilla/security/nss || die
 	sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../freebl/\$(OBJDIR):" \
@@ -79,8 +94,8 @@
 	*) die "Failed to detect whether your arch is 64bits or 32bits, disable distcc if you're using it, please";;
 	esac
 
-	export NSPR_INCLUDE_DIR=`nspr-config --includedir`
-	export NSPR_LIB_DIR=`nspr-config --libdir`
+	export NSPR_INCLUDE_DIR=${ROOT}/$( $(tc-getPKG_CONFIG) --variable includedir nspr )
+	export NSPR_LIB_DIR=${ROOT}/$( $(tc-getPKG_CONFIG) --variable libdir nspr )
 	export BUILD_OPT=1
 	export NSS_USE_SYSTEM_SQLITE=1
 	export NSDISTMODE=copy
@@ -89,12 +104,26 @@
 	export FREEBL_NO_DEPEND=1
 	export ASFLAGS=""
 
-	cd "${S}"/mozilla/security/coreconf || die
-	emake -j1 CC="$(tc-getCC)" || die "coreconf make failed"
+	local make_args
+
+	if tc-is-cross-compiler; then
+		# NSS can't figure out anything when cross compiling
+		make_args="OS_TARGET=Linux OS_RELEASE=2.6 OS_TEST=$(tc-arch)"
+
+		# build a host version of nsinstall
+		$(tc-getBUILD_CC) $BUILD_CFLAGS $BUILD_LDFLAGS \
+			"${S}"/mozilla/security/coreconf/nsinstall/{nsinstall,pathsub}.c \
+			-o "${S}"/mozilla/security/build-nsinstall \
+			|| die "failed to compile build-nsinstall"
+	else
+		cd "${S}"/mozilla/security/coreconf || die
+		emake -j1 CC="$(tc-getCC)" || die "coreconf make failed"
+	fi
+
 	cd "${S}"/mozilla/security/dbm || die
-	emake -j1 CC="$(tc-getCC)" || die "dbm make failed"
+	emake -j1 CC="$(tc-getCC)" ${make_args} || die "dbm make failed"
 	cd "${S}"/mozilla/security/nss || die
-	emake -j1 CC="$(tc-getCC)" || die "nss make failed"
+	emake -j1 CC="$(tc-getCC)" ${make_args} || die "nss make failed"
 }
 
 # Altering these 3 libraries breaks the CHK verification.
@@ -204,7 +233,20 @@
 
 pkg_postinst() {
 	# We must re-sign the libraries AFTER they are stripped.
-	generate_chk "${EROOT}"/usr/bin/shlibsign "${EROOT}"/usr/$(get_libdir)
+	local shlibsign
+	if [ "${ROOT}" == "/" ]; then
+		shlibsign="${EROOT}"/usr/bin/shlibsign
+	else
+		shlibsign=$(which shlibsign)
+		if [ -z "${shlibsign}" ]; then
+			eerror "Could not sign libraries because shlibsign is not available."
+			eerror "Please install NSS with USE=utils on host and reinstall this"
+			eerror "to get libraries properly signed."
+			return
+		fi
+	fi
+
+	generate_chk "${shlibsign}" "${EROOT}"/usr/$(get_libdir)
 }
 
 pkg_postrm() {