net-firewall/ufw
A program used to manage a netfilter firewall
Screenshots
View
Download
BrowseChangeLog
commit 8a7147085a77223b14b1173e57b08c98c80b6fb3
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Nov 4 04:53:37 2026 -0300
python3_15: mirror 75 ::gentoo packages and widen bentoo's own
Python 3.15 is final, but with PYTHON_TARGETS=python3_15 @world stopped at
95 installed packages whose PYTHON_COMPAT ends at 3.14 (first one hit:
sys-apps/util-linux). ::gentoo master has added 3.15 to none of them yet.
- Mirror 75 ::gentoo packages (76 ebuilds; clang has two slots) at the same
version, with python3_15 added to PYTHON_COMPAT and nothing else. Every
diverging axis carries a BENTOO-DIVERGENCE tag, and each copy says it goes
away once ::gentoo lists python3_15. Exceptions:
- app-admin/ansible-core: backport of upstream commit 405a6052b0 (PR #86976).
2.21 dies at import on 3.15 (dataclasses._is_type is gone), and upstream
will not backport the fix (ansible/ansible#87677).
- dev-debug/rr, app-accessibility/speech-dispatcher: OpenRC counterparts for
their systemd units (overlay rule). app-admin/system-config-printer goes on
check-openrc-coverage.sh's allowlist instead, because its unit is a
udev-triggered template and no init script can stand in for it.
- Widen 19 bentoo packages that blocked @world, plus 44 that only use Python at
build time, and eclass/gstreamer-meson.eclass, which covers ~70 gst packages.
- Not widened: sys-kernel/bentoo-kernel (its PYTHON_COMPAT lives in ::gentoo's
kernel-build.eclass) and www-client/librewolf (no 3.15 build evidence).
- .autoupdate: 68 new records, 6 re-enabled, and app-admin/ansible-core held
(2.22 would break ansible 14). iotop and meson-format-array have nothing to
probe and are listed in dead-upstreams.md.
How this was checked:
- Per-package research: upstream CI, Fedora rawhide builds on 3.15, and a grep
for every API 3.15 removed.
- Real builds against 3.15: media-gfx/blender in full (9030 targets, runs on
3.15.2), plus the C bindings of util-linux, libcap-ng, vim and pam_wrapper.
- emerge -pvuDN --with-bdeps=y @world resolves against this tree with
PYTHON_TARGETS="python3_14 python3_15" and PYTHON_SINGLE_TARGET="-* python3_15".
3.15 only is not reachable yet: 85 ::gentoo build-time-only packages (glibc,
gcc, llvm, ...) still stop at 3.14.
- gentoo-parity.sh adds no ALIGN or UNDOCUMENTED row. Its one new
[missing]/[orphans] hit, x11-misc/libinput-gestures, is a parser false
positive on "$/$"-...
- check-openrc-coverage.sh passes; pkgcheck is clean on every touched package.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
commit 92aaaedfb4294bce88a6441eab8f2699fe0bef98
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Sep 5 09:12:05 2026 -0300
rm(dev-lang/go-1.27.1, net-firewall/ufw-0.36.2-r1, media-gfx/inkscape-1.4.4-r1, net-misc/rclone-1.75.0, sci-ml/ollama-0.33.2), mod(profiles/package.unmask, .autoupdate/packages.toml): drop five ebuilds ::gentoo covers better
From the parity audit. Each was checked against a live ::gentoo substitute
before removal, and the two reasons that turned out to be wrong are recorded so
the next sweep does not re-derive them.
net-misc/rclone-1.75.0 and sci-ml/ollama-0.33.2 were not merely redundant --
they were already unmergeable. Their Manifest carries no DIST digest (only
1.75.1 / 0.33.3 have one), so a fetch dies with "Insufficient data for checksum
verification", and repo priority meant they shadowed a working ::gentoo copy.
That is a defect CLASS, not two instances: any package shipping a
::gentoo-identical version alongside a newer one can lose its digest the same
way, and no current guard sees it.
dev-lang/go-1.27.1: ::gentoo commit c7c56f6ec (2026-09-03) deleted the mask, so
the unmask entry is obsolete. It was also always a no-op -- it named
=dev-lang/go-1.27.0, a version in neither tree. Highest consumer floor in this
overlay is >=dev-lang/go-1.27.0, which ::gentoo's 1.27.1 satisfies.
net-firewall/ufw-0.36.2-r1: stands on ::gentoo's RESTRICT="test" (bug 957559)
and byte-identical files/. NOT on "lost PYTHON_COMPAT up to 3.14" -- ours was
, wider than theirs, and both reduce to anyway.
media-gfx/inkscape-1.4.4-r1: shadows ::gentoo's 1.4.4 while narrowing 11 arches
to bare amd64, dropping stable x86. NOT because the poppler patch is stale --
it is not; it compiles clean against poppler 26.05.
packages.toml also picks up the six Wave 0 removals, which never got their
enabled = false, and a correction to the tree-sitter record: it claimed no
upstream report was filed. PR #466 is merged (afb3836bda1a). What is missing is
a release carrying it, so the patch stays. Every disabled_by here is textual,
not "auto", so reconciliation cannot re-enable them on its own.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit adf179fb0d8b7f7b2054220a6634b1d6ac065487
Author: lucascouts <lucascs@protonmail.com>
Date: Tue May 5 20:31:28 2026 -0300
up(net-firewall/ufw-0.36.2 -> 0.36.2-r1)
commit 8406eed8a277ebc28db932fdfffe2d363f31d770
Author: lucascouts <lucascs@protonmail.com>
Date: Tue May 5 15:16:14 2026 -0300
add(net-firewall/ufw-0.36.2)
commit c37938fb612bbdd71144a6059b7e57b91c10d467
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Aug 25 22:03:21 2019 +0000
the master branch is the minimal overlay configuration.
commit 3a08c24f13fa5330c44403c3a85138f69b684bca
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Aug 14 15:28:21 2019 +0000
*(app-crypt/gnupg-2.2.17, app-text/poppler-0.79.0-r1, dev-lang/php-{5.6.40-r5, 7.1.31, 7.2.21, 7.3.8}, eclass/xorg-3.eclass, kde-apps/*-19.04.3, net-analyzer/wireshark-3.1.0, net-irc/konversation-1.7.5-r1, net-libs/nodejs-, net-misc/openssh-8.0_p1-r2, sys-fs/{{zfs}, {kmod}}-0.8.1, sys-kernel/gentoo-sources-, sys-kernel/spl-0.7.13, x11-apps/xrandr-1.5.1, x11-libs/wxGTK-3.0.4-r2), ^(dev-libs/libwacom-0.30 -> 0.33)
commit ca192b7074203f120090168e34878add46c96a51
Author: lucascouts <lucascs@protonmail.com>
Date: Tue Aug 13 15:15:10 2019 +0000
+(media-libs/libbluray-1.1.2), *(app-admin/syslog-ng-3.22.1, app-emulation/libvirt-5.6.0, app-text/poppler-0.79.0-r1, dev-lang/php-{5.6.40-r5, 7.1.31, 7.2.21, 7.3.8}, media-sound/lollypop-1.1.4.11, media-video/libva-utils-2.4.0, net-firewall/ufw-0.36, net-libs/libssh-0.9.0, net-misc/openssh-8.0_p1-r2, sys-kernel/gentoo-sources-, x11-libs/{libva-2.5.0-r1, {*-intel-driver-2.3.0}, x11-libs/wxGTK-{3.0.4-r2, 3.0.4-r302}), ^(app-admin/{apache-tools-2.4.39 -> 2.4.41, mongo-tools-4.0.11 -> 4.0.12}, dev-db/mongodb-4.0.11 -> 4.0.12, dev-libs/{libfilezilla-0.17.1 -> 0.18.0, libinput-1.13.4 -> 1.14.0}, dev-vcs/git-2.22.0 -> 2.22.1, media-libs/exiftool-11.60 -> 11.61, net-ftp/filezilla-3.43.0 -> 3.44.1, net-im/signal-desktop-bin-1.25.3 -> 1.26.0, sys-kernel/gentoo-sources-4.9.187 -> 4.9.189, www-servers/apache-2.4.39 -> 2.4.41)
commit 90b23252cf3c948e751641efbb9cc145eff1b7f3
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Aug 7 13:09:15 2019 +0000
+(acct-group/unrealircd-0, acct-user/unrealircd-0, net-firewall/ufw-0.36), *(acct-group/mysql-0, acct-user/mysql-0, app-emulation/{faudio-19.06, wine-vanilla-4.13}, dev-db/sqlite-3.28.0, dev-lang/php-{5.6.40-r5, 7.1.31, 7.2.21, 7.3.8}), ^(app-antivirus/clamav-0.101.2-r1 -> 0.101.3, net-libs/nodejs- -> , sys-apps/firejail-lts-0.9.56.2 -> 0.9.56.2-r1)
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Nov 4 04:53:37 2026 -0300
python3_15: mirror 75 ::gentoo packages and widen bentoo's own
Python 3.15 is final, but with PYTHON_TARGETS=python3_15 @world stopped at
95 installed packages whose PYTHON_COMPAT ends at 3.14 (first one hit:
sys-apps/util-linux). ::gentoo master has added 3.15 to none of them yet.
- Mirror 75 ::gentoo packages (76 ebuilds; clang has two slots) at the same
version, with python3_15 added to PYTHON_COMPAT and nothing else. Every
diverging axis carries a BENTOO-DIVERGENCE tag, and each copy says it goes
away once ::gentoo lists python3_15. Exceptions:
- app-admin/ansible-core: backport of upstream commit 405a6052b0 (PR #86976).
2.21 dies at import on 3.15 (dataclasses._is_type is gone), and upstream
will not backport the fix (ansible/ansible#87677).
- dev-debug/rr, app-accessibility/speech-dispatcher: OpenRC counterparts for
their systemd units (overlay rule). app-admin/system-config-printer goes on
check-openrc-coverage.sh's allowlist instead, because its unit is a
udev-triggered template and no init script can stand in for it.
- Widen 19 bentoo packages that blocked @world, plus 44 that only use Python at
build time, and eclass/gstreamer-meson.eclass, which covers ~70 gst packages.
- Not widened: sys-kernel/bentoo-kernel (its PYTHON_COMPAT lives in ::gentoo's
kernel-build.eclass) and www-client/librewolf (no 3.15 build evidence).
- .autoupdate: 68 new records, 6 re-enabled, and app-admin/ansible-core held
(2.22 would break ansible 14). iotop and meson-format-array have nothing to
probe and are listed in dead-upstreams.md.
How this was checked:
- Per-package research: upstream CI, Fedora rawhide builds on 3.15, and a grep
for every API 3.15 removed.
- Real builds against 3.15: media-gfx/blender in full (9030 targets, runs on
3.15.2), plus the C bindings of util-linux, libcap-ng, vim and pam_wrapper.
- emerge -pvuDN --with-bdeps=y @world resolves against this tree with
PYTHON_TARGETS="python3_14 python3_15" and PYTHON_SINGLE_TARGET="-* python3_15".
3.15 only is not reachable yet: 85 ::gentoo build-time-only packages (glibc,
gcc, llvm, ...) still stop at 3.14.
- gentoo-parity.sh adds no ALIGN or UNDOCUMENTED row. Its one new
[missing]/[orphans] hit, x11-misc/libinput-gestures, is a parser false
positive on "$/$"-...
- check-openrc-coverage.sh passes; pkgcheck is clean on every touched package.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
commit 92aaaedfb4294bce88a6441eab8f2699fe0bef98
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Sep 5 09:12:05 2026 -0300
rm(dev-lang/go-1.27.1, net-firewall/ufw-0.36.2-r1, media-gfx/inkscape-1.4.4-r1, net-misc/rclone-1.75.0, sci-ml/ollama-0.33.2), mod(profiles/package.unmask, .autoupdate/packages.toml): drop five ebuilds ::gentoo covers better
From the parity audit. Each was checked against a live ::gentoo substitute
before removal, and the two reasons that turned out to be wrong are recorded so
the next sweep does not re-derive them.
net-misc/rclone-1.75.0 and sci-ml/ollama-0.33.2 were not merely redundant --
they were already unmergeable. Their Manifest carries no DIST digest (only
1.75.1 / 0.33.3 have one), so a fetch dies with "Insufficient data for checksum
verification", and repo priority meant they shadowed a working ::gentoo copy.
That is a defect CLASS, not two instances: any package shipping a
::gentoo-identical version alongside a newer one can lose its digest the same
way, and no current guard sees it.
dev-lang/go-1.27.1: ::gentoo commit c7c56f6ec (2026-09-03) deleted the mask, so
the unmask entry is obsolete. It was also always a no-op -- it named
=dev-lang/go-1.27.0, a version in neither tree. Highest consumer floor in this
overlay is >=dev-lang/go-1.27.0, which ::gentoo's 1.27.1 satisfies.
net-firewall/ufw-0.36.2-r1: stands on ::gentoo's RESTRICT="test" (bug 957559)
and byte-identical files/. NOT on "lost PYTHON_COMPAT up to 3.14" -- ours was
, wider than theirs, and both reduce to anyway.
media-gfx/inkscape-1.4.4-r1: shadows ::gentoo's 1.4.4 while narrowing 11 arches
to bare amd64, dropping stable x86. NOT because the poppler patch is stale --
it is not; it compiles clean against poppler 26.05.
packages.toml also picks up the six Wave 0 removals, which never got their
enabled = false, and a correction to the tree-sitter record: it claimed no
upstream report was filed. PR #466 is merged (afb3836bda1a). What is missing is
a release carrying it, so the patch stays. Every disabled_by here is textual,
not "auto", so reconciliation cannot re-enable them on its own.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit adf179fb0d8b7f7b2054220a6634b1d6ac065487
Author: lucascouts <lucascs@protonmail.com>
Date: Tue May 5 20:31:28 2026 -0300
up(net-firewall/ufw-0.36.2 -> 0.36.2-r1)
commit 8406eed8a277ebc28db932fdfffe2d363f31d770
Author: lucascouts <lucascs@protonmail.com>
Date: Tue May 5 15:16:14 2026 -0300
add(net-firewall/ufw-0.36.2)
commit c37938fb612bbdd71144a6059b7e57b91c10d467
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Aug 25 22:03:21 2019 +0000
the master branch is the minimal overlay configuration.
commit 3a08c24f13fa5330c44403c3a85138f69b684bca
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Aug 14 15:28:21 2019 +0000
*(app-crypt/gnupg-2.2.17, app-text/poppler-0.79.0-r1, dev-lang/php-{5.6.40-r5, 7.1.31, 7.2.21, 7.3.8}, eclass/xorg-3.eclass, kde-apps/*-19.04.3, net-analyzer/wireshark-3.1.0, net-irc/konversation-1.7.5-r1, net-libs/nodejs-, net-misc/openssh-8.0_p1-r2, sys-fs/{{zfs}, {kmod}}-0.8.1, sys-kernel/gentoo-sources-, sys-kernel/spl-0.7.13, x11-apps/xrandr-1.5.1, x11-libs/wxGTK-3.0.4-r2), ^(dev-libs/libwacom-0.30 -> 0.33)
commit ca192b7074203f120090168e34878add46c96a51
Author: lucascouts <lucascs@protonmail.com>
Date: Tue Aug 13 15:15:10 2019 +0000
+(media-libs/libbluray-1.1.2), *(app-admin/syslog-ng-3.22.1, app-emulation/libvirt-5.6.0, app-text/poppler-0.79.0-r1, dev-lang/php-{5.6.40-r5, 7.1.31, 7.2.21, 7.3.8}, media-sound/lollypop-1.1.4.11, media-video/libva-utils-2.4.0, net-firewall/ufw-0.36, net-libs/libssh-0.9.0, net-misc/openssh-8.0_p1-r2, sys-kernel/gentoo-sources-, x11-libs/{libva-2.5.0-r1, {*-intel-driver-2.3.0}, x11-libs/wxGTK-{3.0.4-r2, 3.0.4-r302}), ^(app-admin/{apache-tools-2.4.39 -> 2.4.41, mongo-tools-4.0.11 -> 4.0.12}, dev-db/mongodb-4.0.11 -> 4.0.12, dev-libs/{libfilezilla-0.17.1 -> 0.18.0, libinput-1.13.4 -> 1.14.0}, dev-vcs/git-2.22.0 -> 2.22.1, media-libs/exiftool-11.60 -> 11.61, net-ftp/filezilla-3.43.0 -> 3.44.1, net-im/signal-desktop-bin-1.25.3 -> 1.26.0, sys-kernel/gentoo-sources-4.9.187 -> 4.9.189, www-servers/apache-2.4.39 -> 2.4.41)
commit 90b23252cf3c948e751641efbb9cc145eff1b7f3
Author: lucascouts <lucascs@protonmail.com>
Date: Wed Aug 7 13:09:15 2019 +0000
+(acct-group/unrealircd-0, acct-user/unrealircd-0, net-firewall/ufw-0.36), *(acct-group/mysql-0, acct-user/mysql-0, app-emulation/{faudio-19.06, wine-vanilla-4.13}, dev-db/sqlite-3.28.0, dev-lang/php-{5.6.40-r5, 7.1.31, 7.2.21, 7.3.8}), ^(app-antivirus/clamav-0.101.2-r1 -> 0.101.3, net-libs/nodejs- -> , sys-apps/firejail-lts-0.9.56.2 -> 0.9.56.2-r1)