commit 31906eeed005f3268ff222e445857da7bf9c386a
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Sep 11 15:50:46 2026 -0300

fix(dev-libs/libgcrypt-1.12.4): drop patches already merged upstream

The 1.12.4 bump copied the 1.12.3-r1 ebuild verbatim, keeping the three
"Post-1.12.3 fixes" RSA patches in PATCHES. Upstream shipped those very
commits inside 1.12.4, so 0001 failed to apply and src_prepare died.

Verified by reverse-applying each patch against the 1.12.4 tarball: all
three revert cleanly, i.e. the source already carries them (the fixed
line sits at cipher/rsa-common.c:758).

The patch files are removed as well: libgcrypt-1.12.3-r1 was dropped in
8b6bda20c, so nothing else in the overlay referenced them.

Validated locally (no sudo on this host, so src_prepare is the ceiling):
- ebuild ... clean prepare -> ">>> Source prepared." exit 0
- pkgcheck scan dev-libs/libgcrypt -> exit 0, no results (re-run with
--cache=no to rule out the result cache)
- md5-cache regenerated; _md5_ now matches the ebuild

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 8b6bda20c7a2ab2b72ed062e2c7b14c46b794a33
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Sep 11 13:53:51 2026 -0300

rm(mail-client/{thunderbird,thunderbird-l10n}, media-libs/{dav1d,kquickimageeditor}, net-misc/networkmanager, app-admin/calamares-3.4.2-r1, dev-libs/libgcrypt-1.12.3-r1, sys-power/upower-1.91.3), up(dev-util/nvidia-cuda-toolkit-13.4.1 -> -r1), mod(.autoupdate/packages.toml)

Parity audit against ::gentoo synced 2026-09-11 14:15 UTC.

Five packages removed because the overlay copy carried nothing ::gentoo
does not already ship:

mail-client/thunderbird 155.0.1 byte-identical, files/ and
mail-client/thunderbird-l10n 155.0.1 metadata.xml included. Removed as
a pair: thunderbird RDEPENDs on
~thunderbird-l10n-$.
media-libs/dav1d 1.5.4 byte-identical; ::gentoo also has
1.5.1, 1.5.0, 1.4.2 and 9999.
media-libs/kquickimageeditor 0.7.0.1 sole difference was IUSE="", which
says the same as declaring none.
net-misc/networkmanager 1.58.1 ::gentoo's 1.58.1-r1 landed the
clat option this fork existed for,
and leads on four further axes:
>=dev-util/bpftool-5.6.0 floor,
sys-libs/slang, PYTHON_COMPAT up to
3.15, -Dsystemdsystemgeneratordir.
All four BENTOO-DIVERGENCE tags on
it read "::gentoo is on 1.56".

Three ebuilds removed, not their packages. Each was the previous version
copied forward by a bump and left behind, byte-identical to ::gentoo AND
missing its DIST lines, so the overlay was shadowing a working copy with
one that cannot be fetched at all:

app-admin/calamares-3.4.2-r1 (3.4.3 stays)
dev-libs/libgcrypt-1.12.3-r1 (1.12.4 stays)
sys-power/upower-1.91.3 (1.91.4 stays)

dev-util/nvidia-cuda-toolkit revbumped rather than removed: USE=examples is
genuinely ours (::gentoo drops Demo_Suite unconditionally, so its ebuild
cannot install the samples at all), but the fork had drifted behind on four
axes that ::gentoo had already fixed. Revbump because the ebuild's own
comment requires one for cuda_supported_gcc:

- GCC_MAX_VER 15 -> 16, CLANG_MAX_VER 21 -> 22. The overlay was refusing
a gcc-16 ::gentoo already allows.
- cuda_supported_gcc regained 15; cuda-config was advertising a list the
toolkit supports.
- two surviving "targets/x86_64-linux" globs -> ${narch}. Every other use
in the ebuild is already ${narch}, so on arm64 (sbsa) those two branches
silently never matched.
- rm -> rm -f for the rdma files, which SKIP_COMPONENTS may already have
dropped, and mkdir -p for $/bin.

Its three UNDOCUMENTED axes (IUSE, RDEPEND, DEFINED_PHASES) now carry
BENTOO-DIVERGENCE tags, and the Kernel_Objects / nvprof SKIP_COMPONENTS
entries carry the reasoning that would otherwise be lost at the next rebase.

Also swept: 69 md5-cache entries naming no ebuild (the floor is 0, every
bump leaves the previous entry behind), md5-cache generated for the four
packages that had none, and godot's two deprecated-editor-screen patches,
orphaned at 4.8_alpha5 exactly as that ebuild's own comment says.

The five removed packages become enabled = false in packages.toml with a
disabled_by line; the record is never deleted.

Full sweep after this commit: 0 ALIGN, 0 UNDOCUMENTED, 0 REDUNDANT, 229
JUSTIFIED, 0 digest gaps, 0 stale cache entries, 0 packages behind, exit 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 43e3f06170da7f149cac3fac25af89854a25afd0
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Sep 11 12:45:37 2026 -0300

add(app-admin/{calamares-3.4.2-r1, calamares-3.4.3}, dev-libs/{libgcrypt-1.12.3-r1, libgcrypt-1.12.4}, sys-power/{upower-1.91.3, upower-1.91.4}), del(kde-frameworks/{attica, baloo, bluez-qt, breeze-icons, extra-cmake-modules, frameworkintegration, kapidox, karchive, kauth, kbookmarks, kcalendarcore, kcmutils, kcodecs, kcolorscheme, kcompletion, kconfig, kconfigwidgets, kcontacts, kcoreaddons, kcrash, kdav, kdbusaddons, kdeclarative, kded, kdesu, kdnssd, kdoctools, kfilemetadata, kglobalaccel, kguiaddons, kholidays, ki18n, kiconthemes, kidletime, kimageformats, kio, kirigami, kitemmodels, kitemviews, kjobwidgets, kmime, knewstuff, knotifications, knotifyconfig, kpackage, kparts, kpeople, kplotting, kpty, kquickcharts, krunner, ksecretd-services, kservice, kstatusnotifieritem, ksvg, ktexteditor, ktexttemplate, ktextwidgets, kunitconversion, kuserfeedback, kwallet, kwallet-runtime, kwidgetsaddons, kwindowsystem, kxmlgui, modemmanager-qt, networkmanager-qt, oxygen-icons, prison, purpose, qqc2-desktop-style, solid, sonnet, syndication, syntax-highlighting, threadweaver}-6.30.0), mod(.autoupdate/packages.toml), up(kde-plasma/spectacle-6.7.5 -> 6.7.5-r1)

commit 71d2660a0ca332a9fbe8e67abf9b11128407f14d
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Sep 2 23:32:33 2026 -0300

del: drop 12 packages ::gentoo now covers better

A parity sweep against ::gentoo (scripts/gentoo-parity.sh plus a textual diff of
every ebuild) found twelve packages this overlay no longer needs to carry. None
held a bentoo-specific change worth keeping.

Seven were frozen copies. dev-libs/libgcrypt-1.12.3 was byte-identical to
::gentoo's, and the six kde-plasma packages were the plain 6.7.4 this overlay
copied before ::gentoo published its revisions. Portage already preferred
::gentoo for every one of them -- a higher revision beats repo priority, which
only breaks ties -- so they cost sweep noise and nothing else. What they lagged:
PYTHON_COMPAT 3.11-14 -> 3.12-15, QTMIN 6.10.1 -> 6.11.2, kwin-6.7.4-patchset-1
(fixes landing in 6.7.5), discover's BUILD_SteamOSBackend -> BUILD_HoloBackend
rename, and the X USE dep plasma-desktop's qtbase gained.

Two were actively worse where the version ties and priority does decide:

sys-apps/fwupd upstream re-signed 2.1.7 on 2026-08-19. Verified here: the
published .asc is now BLAKE2B 97a4f4e1..., gpg-good against
the tarball, while this Manifest still named the withdrawn
8c00e3f9... -- a fetch nobody without it cached can complete.
::gentoo carries the current hash and repaired the test suite
this ebuild only switched off. Closes obentoo/bentoo#31.
net-libs/cppzmq ::gentoo's 4.11.0 has the disable-static patch, drops demo/
for bug 957453, sets a multilib CMAKECONFIG_INSTALL_DIR, and
keywords amd64 ~arm ~arm64 ~riscv x86 against our ~amd64
~arm64. Not installed yet, so nothing regressed -- but the
first install would have taken the worse ebuild.

net-ftp/filezilla goes because the anomaly its own packages.toml comment
recorded has cleared: dev.gentoo.org/~dlan now serves FileZilla_3.71.1_src.tar.xz
(HTTP 200, 3583056 bytes, same size as our R2 copy), so ::gentoo's single-mirror
SRC_URI fetches unaided and the distfiles.obentoo.org fallback stopped being
load-bearing. net-ftp/filezilla-pro stays, untouched.

kde-plasma/kdeplasma-addons and kde-plasma/kameleon-qmk-helper go together, and
that pair is a choice rather than a defect. Both existed to keep corrosion off
the dependency graph: we patched it optional and lifted kdeds/kameleon into a
package of its own behind USE=qmk. ::gentoo now gates the same Rust kded
natively behind USE=led, with crates from gentoo-crate-dist, and ships
KFMIN 6.26.0 / QTMIN 6.11.2 against our 6.22.0 / 6.10.1. One mechanism suffices.

Per overlay convention the twelve packages.toml records are disabled, never
deleted, each carrying its evidence in disabled_by. The 15 orphaned
profiles/use.local.desc lines are removed by hand rather than by egencache:
regenerating that file pulls in 126 unrelated lines, which belongs in its own
commit.

Verified against the checkout via PORTAGE_REPOSITORIES, without syncing:

emerge -puDN @world exit 0, no conflict, no mask
fwupd, kdeplasma-addons resolve to ::gentoo (USE="-led% (-qmk%*)")
the other ten resolve to ::gentoo at its higher revision
check-openrc-coverage.sh PASS, no gap in 273 packages -- ::gentoo's fwupd
installs the same newinitd $-r2 from an
identical files/fwupd-r2

kde-plasma/kameleon-qmk-helper stays installed with no ebuild behind it until a
--depclean; that is expected for an overlay-only package.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 9885e7a25ba2e89457a8628907bec05256dfb6d9
Author: lucascouts <lucascs@protonmail.com>
Date: Thu Aug 27 16:45:09 2026 -0300

add(dev-libs/libgcrypt-1.12.3, metadata/md5-cache/dev-libs/libgcrypt-1.12.3), mod(.autoupdate/packages.toml)

Upstream released 1.12.3 on 2026-08-26 and ::gentoo is still on 1.12.2 (their
git tree has no newer ebuild either), so the overlay carries it ahead of the
master. Phoronix framed the release as the Intel SM3 / SM4 / SHA512 extension
work, but the security content is the stronger argument: an OOB read in the
GOST28147 IMIT MAC verify, a NULL ptr deref on an unsupported ECC genkey flag,
assertion failures in OCB (buffered block 65536) and on small-order Ed25519
public keys, plus missing validation in Argon2, Balloon, the KEM input lengths
and the RSA-PSS verify message length.

The ebuild is a verbatim copy of ::gentoo's 1.12.2 except for one line. That
is not laziness -- it is what the source says is required:

* the AC_ARG_ENABLE set is byte-identical between 1.12.2 and 1.12.3, so no
USE flag is missing. The new Intel routines have no configure knob: they
are gated on inline-asm probes (HAVE_GCC_INLINE_ASM_) and
dispatched at runtime through HWF, and they do compile here --
sha512-intel-shaext.o, sm3-intel-avx2-amd64.o, sm4-intel-avx2-amd64.o and
sm4-intel-avx512-amd64.o are all in the build tree;
* NEED_GPG_ERROR_VERSION is unchanged at 1.56, so RDEPEND already fits;
* LT_CURRENT 28 - LT_AGE 8 is still 20, so SLOT="0/20" holds and no revdep
needs a rebuild. emerge -pv confirms: 1 package, nothing dragged along;
* both ::gentoo patches apply with `patch -p1 --dry-run -F0`, zero fuzz.

The one line is KEYWORDS, downgraded from ::gentoo's stable amd64 arm arm64
ppc ppc64 x86 to ~arch. A release that is one day old is not stable, and an
overlay ebuild that claims otherwise is the failure already recorded for the
vulkan family: a stable ebuild reaching for a ~arch dependency puts the solver
somewhere it cannot resolve. scripts/gentoo-parity.sh does not catch this
axis, which is exactly why it is called out here.

Verified locally (this host has no sudo, so nothing was merged -- the image
was never built and install was never run):

* prepare: both patches applied, eautoreconf clean;
* compile: full build with the profile's own USE ("asm getentropy") and
CPU_FLAGS_X86, single ABI;
* test: "All 39 tests passed (4 tests were not run)" -- the 4 are benchmark
and bench-slope, skipped by the ebuild's own GCRYPT_NO_BENCHMARKS=1, plus
the two hashtest-*g that need --enable-large-data-tests;
* tarball signature checked against gnupg.org/signature_key.asc: valid,
"Werner Koch (dist signing 2020)", 6DAA6E64A76D2840571B4902528897B826403ADA;
* pkgcheck --cache=-git: no result. Confirmed non-vacuous by scanning all
of dev-libs/ with the same fresh cache dir -- six other packages reported
findings, libgcrypt reported none.

The autoupdate record probes gnupg.org's FTP dir, the only place upstream
publishes. It uses select = "max" rather than the default first-match: the
listing is newest-first today, but it holds every release since 1.4 on one
flat page, and a change of sort order would silently pin an ancient version.
That is safe here only because the dir carries no prereleases at all -- every
.tar.bz2 in it is a plain X.Y.Z. `--check dev-libs/libgcrypt` was run against
the live endpoint and reports up to date.

Also closes the dev-python/tree-sitter record with the "# END" line it was
missing since 8071b9ca3. It was the last record in the file, so nothing
downstream shifted; `--lint` now reports "record model OK" instead of one
missing-end issue.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit c37938fb612bbdd71144a6059b7e57b91c10d467
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Aug 25 22:03:21 2019 +0000

the master branch is the minimal overlay configuration.

commit 9b3cae6b02134d5444a0b9c6b7e5679683584f9d
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Feb 8 23:29:53 2019 -0300

added dev-libs/libgcrypt-1.8.3-r1