Weekly portage-stable package updates 2025-02-17

.github/workflows/portage-stable-packages-list

@@ -385,6 +385,7 @@ eclass/dist-kernel-utils.eclass
 eclass/distutils-r1.eclass
 eclass/eapi8-dosym.eclass
 eclass/eapi9-pipestatus.eclass
+eclass/eapi9-ver.eclass
 eclass/edo.eclass
 eclass/edos2unix.eclass
 eclass/elisp-common.eclass

changelog/security/2025-02-20-weekly-updates.md

@@ -0,0 +1,2 @@
+- openssl ([CVE-2024-12797](https://nvd.nist.gov/vuln/detail/CVE-2024-12797))
+- intel-microcode ([CVE-2023-34440](https://nvd.nist.gov/vuln/detail/CVE-2023-34440), [CVE-2023-43758](https://nvd.nist.gov/vuln/detail/CVE-2023-43758), [CVE-2024-24582](https://nvd.nist.gov/vuln/detail/CVE-2024-24582), [CVE-2024-28047](https://nvd.nist.gov/vuln/detail/CVE-2024-28047), [CVE-2024-28127](https://nvd.nist.gov/vuln/detail/CVE-2024-28127), [CVE-2024-29214](https://nvd.nist.gov/vuln/detail/CVE-2024-29214), [CVE-2024-31157](https://nvd.nist.gov/vuln/detail/CVE-2024-31157), [CVE-2024-39279](https://nvd.nist.gov/vuln/detail/CVE-2024-39279), [CVE-2024-31068](https://nvd.nist.gov/vuln/detail/CVE-2024-31068), [CVE-2024-36293](https://nvd.nist.gov/vuln/detail/CVE-2024-36293), [CVE-2024-37020](https://nvd.nist.gov/vuln/detail/CVE-2024-37020), [CVE-2024-39355](https://nvd.nist.gov/vuln/detail/CVE-2024-39355))

changelog/updates/2025-02-20-weekly-updates.md

@@ -0,0 +1,4 @@
+- SDK: go ([1.23.6](https://go.dev/doc/devel/release#go1.23.6))
+- base, dev: intel-microcode ([20250211_p20250211](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250211))
+- base, dev: openssl ([3.3.3](https://github.com/openssl/openssl/releases/tag/openssl-3.3.3))
+- sysext-podman: passt ([2025.01.21](https://archives.passt.top/passt-user/20250121182827.652400c8@elisabeth/T/#u))

pkg_auto/impl/util.sh

@@ -141,7 +141,7 @@ function yell() {
 # hashes in the top sourcer of this file.
 function print_help() {
     if [[ ${THIS} != "${BASH}" ]]; then
-        grep '^##' "${THIS}" | sed -e 's/##[[:space:]]*//'
+        grep '^##' "${THIS}" | sed -e 's/##[[:space:]]\?//'
     fi
 }
 

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -17,7 +17,7 @@
 =app-crypt/azure-keyvault-pkcs11-0_p20241129 ~amd64
 
 # Needed by arm64-native SDK
-=app-crypt/ccid-1.5.4 ~arm64
+=app-crypt/ccid-1.5.5 ~arm64
 
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =app-crypt/clevis-19-r1 **
@@ -30,6 +30,7 @@
 =dev-build/meson-1.6.1 ~arm64
 =dev-cpp/glog-0.6.0 ~arm64
 =dev-lang/yasm-1.3.0-r1 ~arm64
+=dev-lang/go-1.23.6 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
 # Needed to address CVE-2024-52533
@@ -52,7 +53,6 @@
 =dev-util/glib-utils-2.82.4 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
-=dev-util/maturin-1.8.1 ~arm64
 =net-firewall/conntrack-tools-1.4.8-r1 ~arm64
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/packages

@@ -1,4 +1,3 @@
-*app-alternatives/awk
 -*sys-apps/busybox
 *app-arch/lbzip2
 *sys-libs/nss-usrfiles

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/packages.build

@@ -1,4 +1,3 @@
-app-alternatives/awk
 app-arch/lbzip2
 sys-apps/which
 sys-libs/nss-usrfiles

sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.35.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -20,7 +20,7 @@ SRC_URI="
 LICENSE="GPL-3+"
 SLOT="0"
 if [[ -z "$(ver_cut 3)" || "$(ver_cut 3)" -lt 90 ]] ; then
-	KEYWORDS="~alpha amd64 ~arm arm64 hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="acl minimal nls selinux xattr"
 

sdk_container/src/third_party/portage-stable/app-containers/docker-buildx/Manifest

@@ -1,3 +1,4 @@
 DIST docker-buildx-0.11.2.tar.gz 10342565 BLAKE2B 1e034e9a07f36b46096f8f035869adc93b63af46cd9886f5ed4bc0939ce2f76b7f029a11ee536a34be23952e5c85251d757cec9ff05df172e3a26ea82a1bf0b1 SHA512 6f3718edf1e86c4422e1419580e4c38cf378a59555067be2aa6fac3e7f8878afe39d777765ace274cd9c47630f39cbacfacfdc4ecadd6ff46d5ee37d8f9bc75c
 DIST docker-buildx-0.14.0.tar.gz 11120356 BLAKE2B 01fec6b29665088a4778cb6a926f071c1beacb22d7a50593d55afff1225d0e74d083a82eaab4ae96ffee8a6f653ce048fd81b3410e7113bc29da210d77042b64 SHA512 bc09f29096cfd08c60efd8fca7976a1db896f0ed08d33dfc64dfca2c6487a1dc1722b3fe80b6a175ebebeacf8b460bcc214806d0c7a637f17ed5d09793d8c9d8
 DIST docker-buildx-0.19.1.tar.gz 11691424 BLAKE2B 40cc5e68eb85e8693bc6cd7bf91fe3a6300644d9934a3ff84b89c79dba31d475dce5ac4366075127391c5230905591a83bd59c762cf9f9f4bde0931834633473 SHA512 cc811eb93910bfb5a4668cc3dc59ab6c13a1308c0fa49707a81d1d733e834d209677502786e951ce3c8f098c387b559054dd3cd9933edafbecae610d1ef321e6
+DIST docker-buildx-0.20.1.tar.gz 12049522 BLAKE2B cc370f8a6bc82d9358cb59f99645447e83a4c84c656ae75409a504d0e0a973027791129d6eeb55827eb98904300d04c34685be993309e80f547514b76566fb2e SHA512 75c47204a2f11773ed978678735637fb8248ad87bb745e0b878ad7db161dea4d000dbfb98c83b03225efed126cc04b31d3a9ca500f8d3ac414620c7f980fa9cc

sdk_container/src/third_party/portage-stable/app-containers/docker-buildx/docker-buildx-0.20.1.ebuild

@@ -0,0 +1,53 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+MY_PN="buildx"
+DESCRIPTION="Docker CLI plugin for extended build capabilities with BuildKit"
+HOMEPAGE="https://github.com/docker/buildx"
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/docker/buildx.git"
+else
+	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+	S="${WORKDIR}/${MY_PN}-${PV}"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+RDEPEND="app-containers/docker-cli"
+
+src_compile() {
+	local _buildx_r='github.com/docker/buildx'
+	local version=${PV}
+	if [[ ${PV} == 9999 ]]; then
+		version="$(git rev-parse --short HEAD)"
+	fi
+	ego build -o docker-buildx \
+		-ldflags "-linkmode=external
+		-X $_buildx_r/version.Version=${version}
+		-X $_buildx_r/version.Revision=$(date -u +%FT%T%z)
+		-X $_buildx_r/version.Package=$_buildx_r" \
+		./cmd/buildx
+}
+
+src_test() {
+	# TestGit can't work in a source tarball; TestReadTargets fails seemingly due to parallelism.
+	if [[ ${PV} == 9999 ]]; then
+		ego test ./... -skip "TestReadTargets|TestIntegration"
+	else
+		ego test ./... -skip "TestGit|TestReadTargets|TestIntegration"
+	fi
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe docker-buildx
+
+	dodoc README.md
+}

sdk_container/src/third_party/portage-stable/app-crypt/ccid/Manifest

@@ -1 +1,2 @@
 DIST ccid-1.5.5.tar.bz2 708374 BLAKE2B a82986ead2dbb3241ef419ad16eb0fac835c5ab4fa988e5ee53cd1608a30a9381210a6fd013b6a059ca2835d55b4a41afa4064575e91b8eb356bff6d01d19add SHA512 9d2aebe645a5880bfad7d420ddab96811d1fd989c79afa28f5471ae53f36b6d45ee5e13b32ac4afcf59fc762ae835db7e6312ad6642b263158c2d9a30c7651bd
+DIST ccid-1.6.1.tar.xz 195844 BLAKE2B 7ab243196761b22edbaffca14b7ef840d53cc4eecc7d6252fb3255e85fc11eb0e1de65775a250da3d4687015ad6e2901d77b1227dc5921f69b42891541ad4e62 SHA512 3c8336a71e48880f3239b322acb0c40231ae83f80011cef39fef95eade6fd76849343faafdb4fcf9e962afda2c3a415e4a537d3f423b152ef2d3dddb4ecf2eac

sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.5.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -46,7 +46,7 @@ src_install() {
 
 pkg_postinst() {
 	udev_reload
-	einfo "Check https://github.com/LudovicRousseau/CCID/blob/master/INSTALL"
+	einfo "Check https://github.com/LudovicRousseau/CCID/blob/master/INSTALL.md"
 	einfo "for more info about how to configure and use ccid"
 }
 

sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.6.1.ebuild

@@ -0,0 +1,47 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson udev
+
+DESCRIPTION="CCID free software driver"
+HOMEPAGE="https://ccid.apdu.fr https://github.com/LudovicRousseau/CCID"
+SRC_URI="https://ccid.apdu.fr/files/${P}.tar.xz"
+
+LICENSE="LGPL-2.1+ LGPL-2+ GPL-2+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="twinserial"
+
+RDEPEND="
+	sys-apps/pcsc-lite
+	virtual/libusb:1
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-alternatives/lex
+	dev-lang/perl
+	virtual/pkgconfig"
+
+src_configure() {
+	local emesonargs=(
+		$(meson_use twinserial serial)
+	)
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+	udev_newrules src/92_pcscd_ccid.rules 92-pcsc-ccid.rules
+}
+
+pkg_postinst() {
+	udev_reload
+	einfo "Check https://github.com/LudovicRousseau/CCID/blob/master/INSTALL.md"
+	einfo "for more info about how to configure and use ccid"
+}
+
+pkg_postrm() {
+	udev_reload
+}

sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest

@@ -2,3 +2,5 @@ DIST gpgme-1.23.2.tar.bz2 1836904 BLAKE2B 563e470e861c7cc64ecb3e8dd0a0ed8436bc08
 DIST gpgme-1.23.2.tar.bz2.sig 238 BLAKE2B fafba6e2f1f34c53fa3f7e05953298132f7b046048660b9f2df5bc11ccb9694b581117ca78883a8f4ca9af060397a39f3132a3711be1cd28183b7c2f8f93a8b7 SHA512 65b7cdd4ce06bb0b15b13033d226423380338efdcb47ffc3f33780a92973453053f8f59b12a3f37e392e773bdd207a7420c25aa3a210c15eec45b7bfef6e891e
 DIST gpgme-1.24.1.tar.bz2 1891695 BLAKE2B 8438291baec336c329deb9b864e1f3d2710066b992495a82cf83b264b52166e65bfb997aa7a06a18d90bd1048772da8ab6189ba114dd5117f50614dc8210cd37 SHA512 13e90371a733bca4cfefeac0588059d9fab3310b63c58c759f5ba9f9fddc6b0bdab6493fc2bc129c0ebe102ce4effa8067823937d3382f7c7ff02183717bbfd6
 DIST gpgme-1.24.1.tar.bz2.sig 119 BLAKE2B 95232e31a8402cc5ec79d3a459ec6e35feb2d419dc7ac49b8e78103159ca472aac648e97acc3723dee4f2301e2333356e2b1f4376f423d8a3ef3734913249e69 SHA512 11650ea2af3e1c865eafc3c55632befeb036ce0435c32770dd6d6a03026ba7d343e9dcb3ab3597f6b6aae317f1aa26fa1e824f36caaf7214422b8b7ec76cc953
+DIST gpgme-1.24.2.tar.bz2 1891804 BLAKE2B 3d112fe3401c6143d09474eefcc3fda00394b0db61c37d7da79ddf3352c71b67e2972800efbefa89bba4726a4997ef473c3dbdac8c5d42612a73332711cf4d4a SHA512 ad69101d1fceef6cd1dd6d5348f6f2be06912da6b6a7d0fece3ce08cf35054e6953b80ca9c4748554882892faa44e7c54e705cf25bbf2b796cd4ad12b09da185
+DIST gpgme-1.24.2.tar.bz2.sig 119 BLAKE2B 015c8243e84b36110985c1524c8ce124d2756bdcbb4a74ad046620516f3fba8a93e2d9d5aedbb720ed096d171bce71b4bc24e6fdf8b6ba59c263dd4c3c672c5a SHA512 1010067b40f2720e278577ae7599c957e26fdf81d35e21ea878813f2a2bdb618a4be636726252068438c9ef89cae9c1cd3e4acaf27243359abc3e5cfd7a87855

sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild

@@ -0,0 +1,178 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should:
+# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
+# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
+# (find the one for the current release then subscribe to it +
+# any subsequent ones linked within so you're covered for a while.)
+
+DISTUTILS_EXT=1
+DISTUTILS_OPTIONAL=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..13} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+
+# in-source builds are not supported:
+# * https://dev.gnupg.org/T6313#166339
+# * https://dev.gnupg.org/T6673#174545
+inherit distutils-r1 libtool flag-o-matic out-of-source qmake-utils toolchain-funcs verify-sig
+
+DESCRIPTION="GnuPG Made Easy is a library for making GnuPG easier to use"
+HOMEPAGE="https://www.gnupg.org/related_software/gpgme"
+SRC_URI="
+	mirror://gnupg/gpgme/${P}.tar.bz2
+	verify-sig? ( mirror://gnupg/gpgme/${P}.tar.bz2.sig )
+"
+
+LICENSE="GPL-2 LGPL-2.1"
+# Please check ABI on each bump, even if SONAMEs didn't change: bug #833355
+# Use e.g. app-portage/iwdevtools integration with dev-libs/libabigail's abidiff.
+# Subslot: SONAME of each: <libgpgme.libgpgmepp.libqgpgme.FUDGE>
+# Bump FUDGE if a release is made which breaks ABI without changing SONAME.
+# (Reset to 0 if FUDGE != 0 if libgpgme/libgpgmepp/libqpggme change.)
+SLOT="1/11.6.15.2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="common-lisp static-libs +cxx python qt5 qt6 test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="
+	qt5? ( cxx )
+	qt6? ( cxx )
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+# - On each bump, update dep bounds on each version from configure.ac!
+RDEPEND="
+	>=app-crypt/gnupg-2
+	>=dev-libs/libassuan-2.5.3:=
+	>=dev-libs/libgpg-error-1.46-r1:=
+	python? ( ${PYTHON_DEPS} )
+	qt5? ( dev-qt/qtcore:5 )
+	qt6? ( dev-qt/qtbase:6 )
+"
+DEPEND="
+	${RDEPEND}
+	test? (
+		qt5? ( dev-qt/qttest:5 )
+	)
+"
+#doc? ( app-text/doxygen[dot] )
+BDEPEND="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+		dev-lang/swig
+	)
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.18.0-tests-start-stop-agent-use-command-v.patch
+	"${FILESDIR}"/${PN}-1.23.1-tests-gnupg-no-tofu.patch
+)
+
+src_prepare() {
+	default
+
+	elibtoolize
+
+	# bug #697456
+	addpredict /run/user/$(id -u)/gnupg
+
+	local MAX_WORKDIR=66
+	if use test && [[ "${#WORKDIR}" -gt "${MAX_WORKDIR}" ]]; then
+		eerror "Unable to run tests as WORKDIR='${WORKDIR}' is longer than ${MAX_WORKDIR} which causes failure!"
+		die "Could not run tests as requested with too-long WORKDIR."
+	fi
+
+	# Make best effort to allow longer PORTAGE_TMPDIR
+	# as usock limitation fails build/tests
+	ln -s "${P}" "${WORKDIR}/b" || die
+	S="${WORKDIR}/b"
+}
+
+my_src_configure() {
+	# bug #847955
+	append-lfs-flags
+
+	cd "${BUILD_DIR}" || die
+
+	local languages=(
+		$(usev common-lisp 'cl')
+		$(usev cxx 'cpp')
+		$(usev qt5 'qt5')
+		$(usev qt6 'qt6')
+	)
+
+	use qt5 && export MOC5="$(qt5_get_bindir)/moc"
+	use qt6 && export MOC6="$(qt6_get_libdir)/qt6/libexec/moc"
+
+	local myeconfargs=(
+		$(use test || echo "--disable-gpgconf-test --disable-gpg-test --disable-gpgsm-test --disable-g13-test")
+		--enable-languages="${languages[*]}"
+		$(use_enable static-libs static)
+		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+
+	if use python ; then
+		emake -C lang/python prepare
+
+		pushd lang/python > /dev/null || die
+		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_configure
+		popd > /dev/null || die
+	fi
+}
+
+my_src_compile() {
+	cd "${BUILD_DIR}" || die
+
+	emake
+
+	if use python ; then
+		pushd lang/python > /dev/null || die
+		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_compile
+		popd > /dev/null || die
+	fi
+}
+
+my_src_test() {
+	cd "${BUILD_DIR}" || die
+
+	emake check
+
+	if use python ; then
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	emake -C lang/python/tests check \
+		PYTHON=${EPYTHON} \
+		PYTHONS=${EPYTHON} \
+		TESTFLAGS="--python-libdir=${BUILD_DIR}/lib"
+}
+
+my_src_install() {
+	einstalldocs
+
+	cd "${BUILD_DIR}" || die
+
+	emake DESTDIR="${D}" install
+
+	if use python ; then
+		pushd lang/python > /dev/null || die
+		top_builddir="../.." srcdir="${S}/lang/python" CPP="$(tc-getCPP)" distutils-r1_src_install
+		popd > /dev/null || die
+	fi
+
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	# Backward compatibility for gentoo
+	# (in the past, we had slots)
+	dodir /usr/include/gpgme
+	dosym -r /usr/include/gpgme.h /usr/include/gpgme/gpgme.h
+}