commit 83053994d6761c3882e339a01df3e18f05cdb6f9
Author: lucascouts <lucascs@protonmail.com>
Date: Tue Oct 13 04:29:19 2026 -0300

up(dev-go/govulncheck-1.9.0 -> 1.9.0-r1): report the real scanner version

1.9.0 landed (8e61c9dca) still applying the 1.8.0 patch, which hardcodes
cfg.ScannerVersion = "v1.8.0", so the 1.9.0 binary called itself
govulncheck@v1.8.0 in every report.

The patch now writes a @GENTOO_PV@ placeholder that src_prepare fills
from $, guarded by a grep that dies if the substitution misses, so
a bump no longer needs a patch refresh. Revbump so installed 1.9.0
picks up the fix. Built here: `govulncheck -version` prints
"Scanner: govulncheck@v1.9.0".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

commit 8e61c9dcaa091c81f0aa48a174225a3bb9c215b0
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Oct 11 13:56:53 2026 -0300

add(metadata/{md5-cache/app-admin/doctl-1.182.0, md5-cache/dev-go/govulncheck-1.9.0, md5-cache/dev-python/pillow-heif-1.8.1, md5-cache/dev-util/cc-switch-bin-4.0.9, md5-cache/dev-util/mesa_clc-26.3.0_pre20261011, md5-cache/media-libs/mesa-26.3.0_pre20261011}), del(metadata/{md5-cache/app-admin/doctl-1.181.0, md5-cache/dev-go/govulncheck-1.8.0, md5-cache/dev-python/pillow-heif-1.8.0, md5-cache/dev-util/cc-switch-bin-4.0.8, md5-cache/dev-util/mesa_clc-26.3.0_pre20261010, md5-cache/media-libs/mesa-26.3.0_pre20261010}), mod(.autoupdate/packages.toml), up(app-admin/doctl-1.181.0 -> 1.182.0, dev-go/govulncheck-1.8.0 -> 1.9.0, dev-python/pillow-heif-1.8.0 -> 1.8.1, dev-util/{cc-switch-bin-4.0.8 -> 4.0.9, mesa_clc-26.3.0_pre20261010 -> 26.3.0_pre20261011}, media-libs/mesa-26.3.0_pre20261010 -> 26.3.0_pre20261011)

commit ae787f1ab04e5e6847abbb73113a002e82345d16
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Oct 10 23:44:06 2026 -0300

treewide: drop non-amd64 keywords from bentoo's own ebuilds

Applies the amd64-only baseline to the 132 ebuilds (126 packages) that
have no ::gentoo counterpart; the 375 mirror ebuilds keep upstream's
KEYWORDS.

- KEYWORDS: only ~amd64 (amd64 stays stable on gst-plugins-va and
librewolf-bin).
- SRC_URI: arm64?/x86?/... blocks removed from 36 ebuilds, plus the dead
`elif use arm64` branches that picked those distfiles.
- Manifest: 80 DIST lines nothing references any more, from 34 packages.
- Comments in ebuilds and .autoupdate/packages.toml that justified
~arm64 rewritten; no probe url or pattern changed.
- md5-cache regenerated for exactly the edited ebuilds.

librewolf and kata-* keep their per-arch logic on purpose: it mirrors
the Firefox/Kata build scripts and keeping it eases rebases.

Verified: pkgcheck per package shows no new finding vs master (14 fewer),
gentoo-parity.sh output identical to master, emerge -pv resolves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

commit 2888c3be92826f90ad13d2518f3857ca7708b451
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Oct 2 17:10:30 2026 -0300

mod(app-forensics/aflplusplus-5.03c, app-text/libetonyek-0.1.13-r1, dev-go/govulncheck-1.8.0, dev-util/{breakpad-2024.02.16-r1, shfmt-3.14.1}, media-libs/draco-1.5.7, net-misc/rustdesk-1.4.9-r2, .autoupdate/packages.toml, metadata/md5-cache/{app-forensics/aflplusplus-5.03c, app-text/libetonyek-0.1.13-r1, dev-go/govulncheck-1.8.0, dev-util/breakpad-2024.02.16-r1, dev-util/shfmt-3.14.1, media-libs/draco-1.5.7, net-misc/rustdesk-1.4.9-r2})

Make two kinds of autoupdate-bump debt survive the next bump.

Patches referenced as $-*.patch now name the file literally
($-<ver>-*.patch): the applier copies the ebuild to the new PV but
never renames files/, so the next bump would look for a patch that does
not exist and die in src_prepare. The files and the installed result are
unchanged, hence no revbump.

Seven exact-anchored series (dart@stable, shotcut, zed, zed-bin) accept
an optional -rN: the checker matches series against the PVR, so the
first revbump of those ebuilds would have failed the record.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

commit 1d108753cf613636bce908fb7eda66c48c13bb50
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Sep 11 22:21:03 2026 -0300

add(app-benchmarks/vegeta-12.13.0, app-misc/watchexec-2.7.2, dev-go/govulncheck-1.8.0, dev-util/{ast-grep-0.45.3, cargo-fuzz-0.13.2, cargo-geiger-0.13.0, cargo-llvm-cov-0.9.1, cargo-mutants-27.1.0, reviewdog-0.21.0, shfmt-3.14.1, tokei-15.0.0}, dev-vcs/trufflehog-3.97.4, net-analyzer/nuclei-3.11.1), mod(.autoupdate/packages.toml)

Thirteen Rust and Go developer tools, none of which ::gentoo carries. Two
new categories: app-benchmarks (vegeta, next to ::gentoo's hey/wrk/siege)
and dev-go (govulncheck, next to ::gentoo's delve/gopls).

Only three existed anywhere: watchexec and tokei in guru, nuclei in pentoo.
Those three are derived from those ebuilds and moved forward -- watchexec
2.5.0 -> 2.7.2, tokei 14 -> 15, nuclei 3.11.0 -> 3.11.1 -- with CRATES
regenerated and ~arm64 added, which guru does not keyword. The other ten
are new.

DEPENDENCY RESOLUTION, AND WHY IT DIFFERS FROM dev-vcs/gitleaks

The six Go packages take a `go mod vendor` tarball hosted on
distfiles.obentoo.org as a second SRC_URI, the shape ::gentoo uses for
dev-go/golangci-lint. gitleaks, the overlay's existing Go package, instead
sets RESTRICT=network-sandbox and runs `ego mod download` at build time --
which pulls code off the network with nothing in the Manifest to check it
against. Here every dependency is covered by a Manifest checksum and the
build stays inside the sandbox. The cost is a tarball to regenerate on each
bump; every autoupdate record says so.

govulncheck: PROBE THE TAGS, NOT THE RELEASES

golang/vuln stopped publishing GitHub releases at v1.1.4 (January 2025) but
kept tagging; the current tag is v1.8.0, from three days ago. Pinning what
releases/latest reports is not merely stale, it is broken: v1.1.4 carries
golang.org/x/tools v0.29.0, which predates the Go 1.27 AST and panics with
"unexpected expr: *ast.KeyValueExpr" on any modern tree. Measured on four
projects before switching the record to rank tags.

This is the mirror image of the trap documented at the top of packages.toml,
where ranking tags is what misleads. Both records now state which endpoint
lies and why -- watchexec is the opposite case in the same commit: its tag
space is shared with a library crate sitting six majors ahead
(watchexec-v8.4.1 against CLI v2.7.2), so there the release endpoint is the
only safe one.

FOUND BY LOOKING AT THE INSTALLED IMAGE, NOT THE EBUILD

* ast-grep also installs a binary named `sg`, straight on top of
/usr/bin/sg from sys-apps/shadow -- a symlink to newgrp, base system. The
ebuild removes it, guarded so upstream dropping the binary fails loudly
rather than silently changing what ships.
* shfmt and govulncheck both report their version through
debug.ReadBuildInfo(), which for a tarball build says "(devel)". They
installed fine and then could not name themselves: `shfmt --version` said
"(devel)" and the scanner called itself govulncheck@v0.0.0, in output
people paste into reports. One patch each, in files/.

LICENSING

nuclei is MIT but statically links github.com/projectdiscovery/ldapserver,
which is GPL-2, so the binary is effectively GPL-2 and LICENSE says so. The
HashiCorp dependencies that first looked AGPL are not: the MPL-2.0 text
names the AGPL in its Secondary License clause.

cargo-llvm-cov drops its test-helper dev-dependency in src_prepare. It is a
git dependency pinned by rev, and cargo.eclass's [patch] entry does not
substitute a git source pinned that way, so cargo reaches for the network
even with the tarball unpacked beside it. Since cargo resolves the whole
graph before it knows only the binary is wanted, the dependency has to go;
the suite that uses it is restricted.

SECURITY REVIEW

Reachability analysis with govulncheck 1.8.0 rather than dependency-level
counting alone -- roughly half the declared findings are not reachable:
shfmt 0, govulncheck 0, vegeta 3 of 7, reviewdog 4 of 7, nuclei 5 of 8,
trufflehog 6 of 11. Rust side, osv-scanner over Cargo.lock: watchexec
clean, ast-grep 1, cargo-fuzz 2, cargo-llvm-cov 2, cargo-mutants 5, tokei
16, and cargo-geiger 62 across 40 packages -- it has not released since
August 2025 and carries cargo 0.86 against 0.97. No dependency was bumped
away from upstream: that would diverge the tree and break the next bump.

VERIFIED LOCALLY, NOTHING MERGED (host has no sudo)

All thirteen built and installed through `ebuild ... clean install` under a
PORTAGE_CONFIGROOT with the four unprivileged overrides; pkgcheck
--cache=no is clean on all thirteen; every md5-cache _md5_ matches its
ebuild; all thirteen autoupdate records were probed against the live
endpoint and agree with the packaged version.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>