commit d1a32258558a4b7c5866ecbb758403424bde762d
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Sep 5 19:07:04 2026 -0300

mod(net-misc/networkmanager, media-gfx/blender, app-emulation/crossover-bin, media-plugins/frei0r-plugins): document 10 divergences

networkmanager's four axes are one upstream decision, and this settles a
question two earlier passes could not answer from the ebuilds alone.
clat is not ours: 1.58.1's own meson_options.txt declares

option('clat', type: 'boolean', value: true, description: 'Build with CLAT support')

and its DHCP choices are dhcpcd / internal / nettools, with no dhclient
anywhere -- upstream dropped ISC DHCP. ::gentoo is on 1.56, before both,
so the swap and the libbpf/bpftool that come with it are series, not
policy.

frei0r-plugins carries an opencv5-xobjdetect patch because OpenCV 5 moved
CascadeClassifier and HOGDescriptor into the contrib xobjdetect module;
::gentoo needs no counterpart, not having moved to OpenCV 5.
crossover-bin exposes a capi flag over net-libs/libcapi, which lives in
::gentoo, so only the flag is ours.

blender's ceres-solver is tagged but NOT settled, and the tag says so.
The ebuild passes WITH_SYSTEM_ for bullet, eigen3, freetype, gflags and
glog; there is no WITH_SYSTEM_CERES to pass, and ::gentoo takes gflags
and glog from the system while declaring no ceres at all. The dependency
looks inert. It was left in place rather than dropped on that inference,
because proving it needs the 5.2 tarball, which is not cached here -- but
pkgcheck lists ceres-solver among the solutions for NonsolvableDepsInDev
on ~arm64, so a dependency that may do nothing is helping to cost an arch
this overlay exists to cover. Worth an hour with the tarball.

Two more of the same shape surfaced and are recorded here rather than
fixed: networkmanager's clat reaches dev-util/bpftool, which has no
keywords on sparc or alpha, and crossover-bin's libcapi is unsolvable
without abi_x86_32. Both predate this commit. With libreoffice/libeot and
gst-plugins-meta/nvcodec that makes four packages whose KEYWORDS are
wider than something they depend on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 0922e3b48f2a627434a525b4a264160e439334af
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Sep 5 14:07:28 2026 -0300

mod(sys-firmware/edk2, net-libs/libqmi, app-editors/{vim,zed}, app-office/libreoffice, +10): apply the approved parity remediation

Second pass over the 2026-09-04 audit, after the items that block or verify.
Each one was re-measured against the tree as it stands today rather than taken
from the report, and three of them came out differently for it.

SECURITY, and the one judgement call in the set:

sys-firmware/edk2 -> openssl 3.5.8 (revbump to -r2). We are deliberately NOT
faithful to edk2-stable202608's submodule pin (8cf17aae = 3.5.7) here, which is
the unusual direction for this overlay, so the ebuild carries the reasoning: the
library is linked statically into firmware with no host update path, and 3.5.8
fixes ten CVEs including CVE-2026-63072, an 8-byte OOB heap write in CMS
AES-WRAP-PAD. Diverging from a submodule SHA is reversible at any bump; an
unfixed CVE in flashed firmware is not. ::gentoo made the same call.

SILENT CORRECTNESS:

net-libs/libqmi declared SLOT="0/5.11" while installing libqmi-glib.so.5.12.0
(measured in VDB CONTENTS). A subslot that does not match its library disables
the rebuild it exists to trigger. Revbumped to -r1, because correcting the value
alone only changes what FUTURE consumers record.

app-editors/zed gained sys-apps/xdg-desktop-portal, which it never had: ashpd is
used from both gpui backends (x11/client.rs and wayland/client.rs), so file
dialogs and screen capture failed at runtime, not at build. ::gentoo has it.

dev-util/glslang gained the multilib_src_test skip for bug #977176. We keyword
~arm without the skip that makes ~arm testable.

app-office/libreoffice: --disable-gtk3 sat 44 lines above $(use_enable gtk3),
contradicting IUSE="+gtk3". It works today only because autoconf honours the
last flag, so a reordering breaks it silently -- removed.
--enable-skia-vulkan-validation was passed unconditionally inside
--enable-release-build; that is SK_ENABLE_VK_LAYERS=1, debug instrumentation, so
it is now gated on USE=debug. Plus the two missing := subslots.

app-editors/vim: restore five of the six patches in ::gentoo's vim-patches
snapshot, which this overlay had been dropping on every bump. Measured, not
assumed -- each verified with portage's own patch flags against the 9.2.1036
tarball. 002_all_vim-7.3-apache is deliberately excluded and tagged: it fails
with 2 hunks because upstream rewrote the block, and it costs syntax
highlighting for two Gentoo-specific config paths. ::gentoo has not hit this yet
(its newest vim is 9.1.1652, where it still applies).

ARCH COVERAGE, against the overlay's own "restricting to ~amd64 needs a
justification" rule. All widened to ~arch only -- our versions are newer than
::gentoo's, so nothing enters stable: dev-lang/lua (1 arch -> 16),
media-plugins/frei0r-plugins (2 -> 9), app-emulation/qemu (2 -> 8),
net-analyzer/netdata (1 -> 5), dev-util/mesa_clc (+~riscv).

dev-util/spirv-headers is the one with a measured failure behind it, and the
audit had it backwards. It is not behind ::gentoo -- it is byte-identical to
their 9999. The defect is INTERNAL: our spirv-tools carries 13 arches and our
spirv-headers 8, so the consumer cannot resolve its header on ~mips (48
profiles) and ~alpha (82). Widened to match the consumer; pkgcheck
NonsolvableDeps for the pair goes to zero.

STALE FLOORS: media-libs/mesa RUST_MIN_VER 1.82.0 -> 1.85.0 (::gentoo raised it
at 26.2.1); net-misc/modemmanager was LOWERING the tree-wide
gobject-introspection floor to 1.38.

WHERE THE REPORT WAS WRONG:

media-gfx/imagemagick "lost verify-sig" is not remediable and the ebuild now
says why, with evidence. The old comment claimed upstream signs only the latest
release; it does not sign that either -- 7.1.2-31 IS the newest and both the
tarball and its .asc are 404 on all three mirror://imagemagick hosts, as are
-30, -29, -28 and -25. ::gentoo's copy works because Gentoo mirrors distfiles on
its own infrastructure. Adopting their SRC_URI would trade a working fetch for a
signature we cannot obtain, so the divergence is documented with the two
conditions that would reverse it.

The vim finding was five patches, not four. The spirv-headers finding pointed at
the wrong tree.

Also drops app-editors/vim-core/files/{vimrc-r7,xxd-completion}, orphaned -- no
ebuild in the overlay references either.

Verification: pkgcheck one target at a time with --cache=-git over all 16
packages. What remains is pre-existing or inherited and was checked as such:
app-editors/zed DeprecatedEclass llvm-r1 (::gentoo's zed uses it too),
app-office/libreoffice NonsolvableDeps on media-libs/libeot (no ~arm in
::gentoo). egencache with an explicit filter; it also pruned 101 orphan cache
entries, and no live ebuild lost its entry. No build was merged -- this host has
no sudo.

app-office/libreoffice-l10n is NOT in this commit. The new digest axis found all
180 of its 26.2.6.1 distfiles missing from the Manifest; regenerating it is a
separate change and a large download.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 06fec529c420c98fcebf0c3c7e63803949f6f7b9
Author: lucascouts <lucascs@protonmail.com>
Date: Mon Aug 24 23:50:06 2026 -0300

.

commit 378ad714b75b5aafa2c8bf290b0e7e437d3b6f24
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Aug 21 15:46:23 2026 -0300

add(metadata/{md5-cache/app-editors/vim-9.2.0993, md5-cache/app-editors/vim-core-9.2.0993, md5-cache/media-libs/vulkan-layers-1.4.360_p20260821, md5-cache/media-plugins/frei0r-plugins-3.4.3, md5-cache/net-misc/networkmanager-1.58.1, md5-cache/net-misc/postman-bin-12.24.5, md5-cache/sci-ml/llama-cpp-0_pre10549, md5-cache/www-client/brave-browser-1.93.138}), mod(.autoupdate/packages.toml), up(app-editors/{vim, vim-core}-9.2.0992 -> 9.2.0993, media-libs/vulkan-layers-1.4.360_p20260820 -> 1.4.360_p20260821, media-plugins/frei0r-plugins-3.4.1 -> 3.4.3, net-misc/{networkmanager-1.58.0 -> 1.58.1, postman-bin-12.24.4 -> 12.24.5}, sci-ml/llama-cpp-0_pre10545 -> 0_pre10549, www-client/brave-browser-1.93.137 -> 1.93.138)

commit f2aff9f21f15532932a9aa181db9de5f92ca853d
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Aug 21 05:24:58 2026 -0300

add(metadata/md5-cache/media-plugins/frei0r-plugins-3.4.1), mod(.autoupdate/packages.toml), up(app-editors/zed-1.18.0_pre20260820 -> 1.18.0_pre20260821, media-plugins/frei0r-plugins-3.4.0 -> 3.4.1)

commit 2c7775d77dfff8468e4c7ebf4fe1f7eec0911f1f
Author: lucascouts <lucascs@protonmail.com>
Date: Tue Aug 18 12:49:44 2026 -0300

add(metadata/{md5-cache/app-misc/claude-desktop-bin-1.32352.1, md5-cache/dev-db/sqlcipher-4.18.0, md5-cache/dev-lang/dart-3.13.1, md5-cache/dev-python/conda-26.7.1, md5-cache/media-plugins/frei0r-plugins-3.4.0, md5-cache/net-misc/postman-bin-12.24.1, md5-cache/sci-ml/llama-cpp-0_pre10488, md5-cache/sci-ml/sherpa-onnx-1.13.6, md5-cache/sys-kernel/linux-firmware-20260818, md5-cache/www-client/librewolf-bin-154.0_p2}), mod(.autoupdate/packages.toml), up(app-misc/claude-desktop-bin-1.32352.0 -> 1.32352.1, dev-db/sqlcipher-4.17.0 -> 4.18.0, dev-lang/dart-3.13.0 -> 3.13.1, dev-python/conda-26.7.0 -> 26.7.1, media-plugins/frei0r-plugins-3.3.2 -> 3.4.0, net-misc/postman-bin-12.23.8 -> 12.24.1, sci-ml/{llama-cpp-0_pre10472 -> 0_pre10488, sherpa-onnx-1.13.5-r1 -> 1.13.6}, sys-kernel/linux-firmware-20260814 -> 20260818, www-client/librewolf-bin-153.0.4_p1 -> 154.0_p2)

commit 2b67ba988804f96b06f551144318371c520c3b75
Author: lucascouts <lucascs@protonmail.com>
Date: Mon Aug 17 23:12:18 2026 -0300

add(metadata/{md5-cache/app-editors/vim-9.2.0967, md5-cache/app-editors/vim-core-9.2.0967, md5-cache/app-misc/claude-desktop-bin-1.32352.0, md5-cache/dev-python/openai-3.2.0, md5-cache/dev-python/tiktoken-0.14.0, md5-cache/dev-util/claude-code-2.1.234, md5-cache/dev-util/codex-desktop-bin-26.814.41407, md5-cache/dev-util/glslang-1.4.357.0_p20260817, md5-cache/dev-util/mesa_clc-26.3.0_pre20260818, md5-cache/media-libs/mesa-26.3.0_pre20260818, md5-cache/media-plugins/frei0r-plugins-3.3.2}), mod(metadata/md5-cache/app-office/libreoffice-l10n-26.2.6.1, .autoupdate/packages.toml), up(app-editors/{vim, vim-core}-9.2.0958 -> 9.2.0967, app-misc/claude-desktop-bin-1.30096.5 -> 1.32352.0, dev-python/{openai-3.1.0 -> 3.2.0, tiktoken-0.13.0 -> 0.14.0}, dev-util/{claude-code-2.1.233 -> 2.1.234, codex-desktop-bin-26.810.52044 -> 26.814.41407, glslang-1.4.357.0_p20260814 -> 1.4.357.0_p20260817, mesa_clc-26.3.0_pre20260817 -> 26.3.0_pre20260818}, media-libs/mesa-26.3.0_pre20260817 -> 26.3.0_pre20260818, media-plugins/frei0r-plugins-3.3.0 -> 3.3.2)

commit 790590959abc6b87ffd0a2ded3a9fb2b07e937d0
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Aug 16 12:08:17 2026 -0300

fix(media-plugins/frei0r-plugins-3.3.0): name the opencv5 patch after $

The 3.2.3 -> 3.3.0 bump renamed the ebuild but not files/, so PATCHES
still asked for $-opencv5-xobjdetect.patch while the tree only had
the 3.2.3-named copy. eapply died in src_prepare with "No such file or
directory" -- the patch itself was never the problem.

Drop the version from the file name instead of retargeting it at 3.3.0:
the patch is guarded by CV_VERSION_MAJOR, so it is version-agnostic by
construction, and the autoupdate applier never renames files/ entries.
With $ this failure mode cannot recur on a future bump.

Also prune the stale md5-cache entry for the removed 3.2.3 ebuild.

Verified against the 3.3.0 tarball on media-libs/opencv-5.0.0:
- patch -p1 --dry-run applies both hunks clean
- grep -rn xobjdetect on the unpacked source is empty (still unfixed
upstream, so the patch is still required)
- ebuild ... prepare compile passes with USE="facedetect scale0tilt";
facedetect.so and facebl0r.so link libopencv_xobjdetect.so.5.0.0
Not merged (this host has no sudo), and no revbump: 3.3.0 never got
past src_prepare, so there is no installed copy to invalidate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 9fe322e28c7c54c8e1ffa9ec8a5537494be2eba9
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Aug 16 08:54:03 2026 -0300

add(metadata/{md5-cache/app-editors/zed-1.17.0_pre20260816, md5-cache/media-plugins/frei0r-plugins-3.3.0, md5-cache/sci-ml/llama-cpp-0_pre10452, md5-cache/sci-ml/ollama-0.32.13-r1}), del(metadata/{md5-cache/sci-ml/ollama-0.32.13, md5-cache/sci-ml/ollama-0.32.6-r1, md5-cache/sci-ml/ollama-0.32.7, md5-cache/sci-ml/ollama-0.32.9}), mod(.autoupdate/packages.toml), up(app-editors/zed-1.17.0_pre20260815 -> 1.17.0_pre20260816, media-plugins/frei0r-plugins-3.2.3 -> 3.3.0, sci-ml/{llama-cpp-0_pre10448 -> 0_pre10452, ollama-0.32.13 -> 0.32.13-r1})

commit 19d3ec9cd5ad19e36c3a4ea7d37e56217bc2ee3e
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Jun 27 14:29:23 2026 -0300

add(metadata/md5-cache/net-wireless/mt7927-dkms-2.11-r3), del(metadata/md5-cache/net-wireless/mt7927-dkms-2.11-r2), up(net-wireless/mt7927-dkms-2.11-r2 -> 2.11-r3)

commit 352cdbce4989887dc35f38a8637974ee0677d672
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Jun 27 12:04:18 2026 -0300

add(metadata/{md5-cache/app-editors/vim-9.2.0735, md5-cache/app-editors/vim-9.2.0738, md5-cache/app-editors/vim-core-9.2.0735, md5-cache/app-editors/vim-core-9.2.0738, md5-cache/app-editors/zed-1.10.0_pre20260626-r2, md5-cache/app-editors/zed-1.10.0_pre20260626-r3, md5-cache/app-editors/zed-1.10.0_pre20260627, md5-cache/app-emulation/qemu-11.0.2, md5-cache/dev-python/uv-bin-0.11.25, md5-cache/dev-util/claude-code-2.1.195, md5-cache/dev-util/codex-0.142.2-r1, md5-cache/dev-util/codex-0.142.3, md5-cache/dev-util/codex-bin-0.142.3, md5-cache/dev-util/mesa_clc-26.2.0_pre20260627, md5-cache/media-libs/mesa-26.2.0_pre20260627, md5-cache/media-libs/vulkan-layers-1.4.352_p20260627, md5-cache/media-plugins/frei0r-plugins-3.2.3, md5-cache/media-video/shotcut-26.6.25, md5-cache/sci-ml/ollama-0.30.11, md5-cache/sci-ml/ollama-bin-0.30.11, md5-cache/www-client/brave-browser-1.91.180}), mod(metadata/{md5-cache/app-emulation/qemu-11.0.1, md5-cache/media-plugins/frei0r-plugins-3.2.2, md5-cache/media-video/shotcut-26.6.1}), up(app-editors/{vim-9.2.0725 -> 9.2.0738, vim-core-9.2.0725 -> 9.2.0738, zed-1.10.0_pre20260626-r2 -> 1.10.0_pre20260627}, app-emulation/qemu-11.0.1 -> 11.0.2, dev-python/uv-bin-0.11.24 -> 0.11.25, dev-util/{claude-code-2.1.193 -> 2.1.195, codex-0.142.2-r1 -> 0.142.3, codex-bin-0.142.2 -> 0.142.3, mesa_clc-26.2.0_pre20260626 -> 26.2.0_pre20260627}, media-libs/{mesa-26.2.0_pre20260626 -> 26.2.0_pre20260627, vulkan-layers-1.4.352_p20260626 -> 1.4.352_p20260627}, media-plugins/frei0r-plugins-3.2.2 -> 3.2.3, media-video/shotcut-26.6.1 -> 26.6.25, sci-ml/ollama{,-bin}-0.30.10 -> 0.30.11, www-client/brave-browser-1.91.178 -> 1.91.180)

commit 696c82a2e85755a85aa8cd55ae89c0e2bb138521
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Jun 21 12:28:18 2026 -0300

add(metadata/{md5-cache/app-editors/vim-9.2.0688, md5-cache/app-editors/vim-core-9.2.0688, md5-cache/dev-util/mesa_clc-26.2.0_pre20260621, md5-cache/media-libs/mesa-26.2.0_pre20260621, md5-cache/net-misc/rustdesk-1.4.8, md5-cache/net-misc/rustdesk-bin-1.4.8}), mod(media-plugins/frei0r-plugins-3.2.2), up(app-editors/{vim, vim-core}-9.2.0680 -> 9.2.0688, dev-util/mesa_clc-26.2.0_pre20260620 -> 26.2.0_pre20260621, media-libs/mesa-26.2.0_pre20260620 -> 26.2.0_pre20260621, net-misc/rustdesk-bin-1.4.7 -> 1.4.8)

commit 8bf80563a4db38208c970c9d455cfef5eec495e4
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Jun 20 23:30:43 2026 -0300

add(metadata/{md5-cache/app-editors/vim-9.2.0680, md5-cache/app-editors/vim-core-9.2.0680, md5-cache/dev-python/playwright-bin-1.60.0, md5-cache/dev-util/cargo-deny-0.19.9, md5-cache/media-libs/vulkan-layers-1.4.352_p20260620, md5-cache/media-plugins/frei0r-plugins-3.2.2, md5-cache/sci-ml/ollama-0.30.10}), mod(metadata/{md5-cache/dev-python/playwright-bin-1.58.0, md5-cache/media-plugins/frei0r-plugins-3.1.3, md5-cache/sci-ml/ollama-0.30.4}, .autoupdate/packages.toml), up(app-editors/{vim, vim-core}-9.2.0678 -> 9.2.0680, dev-python/playwright-bin-1.58.0 -> 1.60.0, dev-util/cargo-deny-0.19.8 -> 0.19.9, media-libs/vulkan-layers-1.4.352_p20260619 -> 1.4.352_p20260620, media-plugins/frei0r-plugins-3.1.3 -> 3.2.2, sci-ml/ollama-0.30.4 -> 0.30.10)

commit c8b9159e6beffa5418f14ee1c5551fee81c9e3b1
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Jun 7 00:25:50 2026 -0300

add(media-plugins/frei0r-plugins-3.1.3), add(metadata/md5-cache/media-plugins/frei0r-plugins-3.1.3), mod(.autoupdate/packages.toml)