commit 60563775269884942ae151e82e8dead969439455
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Aug 8 22:11:11 2026 -0300

fix(sci-biology/foldingathome-8.5.6-r1 -> -r2): reconcile RDEPEND with the shipped payload, del(foldingathome-8.5.6-r1)

RDEPEND did not describe the payload. Three edits, each decided from the
installed image rather than from upstream's packaging:

+ app-arch/lz4 liblz4.so.1 is DT_NEEDED on a BIND_NOW
binary, so the loader aborts before main()
without it -- the same failure class as
the libsystemd.so.0 bug -r1 fixed.
+ app-misc/ca-certificates the client speaks HTTPS to the assignment
servers, and on a minimal headless or
container host nothing else necessarily
pulls a CA bundle in.
- dev-libs/openssl:= nothing links it; TLS is static. See below.
sys-libs/zlib:= -> virtual/zlib:=, clearing the DeprecatedDep
pkgcheck reported on both 8.5.6 and -r1.

dev-libs/expat was deliberately NOT added even though upstream's .deb
Depends lists libexpat1. Also below.

Deliberately out of scope: upstream's Pre-Depends (adduser, procps) are
Debian packaging mechanics and the identities already come from
acct-user/acct-group; polkitd is Recommends and the rules file this
ebuild installs is inert without polkit rather than broken;
nvidia-opencl-icd is Recommends and accel backends are opt-in USE flags
in this overlay, never hardcoded deps.

--- evidence: readelf / strings on the installed fah-client ---

DT_NEEDED, 8 entries, no libssl/libcrypto/libexpat among them:
libsystemd.so.0 libpthread.so.0 libdl.so.2 liblz4.so.1
libz.so.1 libm.so.6 libc.so.6 ld-linux-x86-64.so.2

dlopen IS live in this binary. `readelf -W --dyn-syms` shows dlopen,
dlsym, dlclose, dlerror and dladdr imported UND at GLIBC_2.2.5(10),
which `readelf -W -V` maps to libdl.so.2 -- already DT_NEEDED and
already covered by sys-libs/glibc, so it adds no atom. It does mean the
string table has to be read before concluding anything: a dlopen'd
library has no DT_NEEDED entry. Note that plain `readelf --dyn-syms`
WITHOUT -W truncates the symbol-name column and shows none of these
five; the -W is load-bearing, and omitting it produced a wrong
first-pass reading of this same binary.

The complete lib*.so* string-literal set is the 8 DT_NEEDED names plus
exactly three dlopen candidates, all optional accel backends:
libcuda.so libOpenCL.so libamdhip64.so
No libexpat, libssl or libcrypto candidate exists.

dev-libs/expat -- NOT ADDED. `strings -a | grep -i expat` returns only
Expat's own compiled-in material: expat.txt, its license text, the
internal version string "expat_2.2.6", the message "requested feature
requires XML_DTD support in Expat", and the mangled cbang symbol
N2cb3XML12ExpatAdapterE (cb::XML::ExpatAdapter). No libexpat.so*
string, no DT_NEEDED entry, no XML_* dynamic symbol. That is static
linkage, not a dlopen miss, so the "err toward declaring it" rule does
not fire. Do not re-add it from the .deb's Depends without repeating
this check.

dev-libs/openssl:= -- REMOVED. Same method, same answer. No
libssl.so*/libcrypto.so* in DT_NEEDED, in the string set, or as an
imported symbol (grep for SSL_|EVP_|BIO_|X509_|OPENSSL_init in
--dyn-syms: no match), and upstream's own Depends never listed it. What
IS present is ~30 CRYPTOGAMS perlasm banners ("AES-NI GCM module for
x86_64, CRYPTOGAMS by <appro@openssl.org>", GHASH, Poly1305, ChaCha20,
X25519, Keccak-1600, the SHA transforms, the AESNI-CBC+SHA stitches),
an embedded "OpenSSL 1.1.1n 15 Mar 2022" banner, and the source paths
src/cbang/openssl/{KeyGenPacifier,KeyPair,SSLContext,SecurityUtilities}
.cpp.

CVE exposure, recorded because dropping the := hides it: TLS is
compiled into fah-client. A host-side dev-libs/openssl update does not
patch this binary, and without the subslot operator Portage will no
longer even propose the rebuild that never helped anyway. The bundled
copy self-reports OpenSSL 1.1.1n (2022-03-15), a branch that reached
EOL on 2023-09-11. A real fix has to come from upstream re-releasing
the .deb.

--- the check that would have caught this ---

scripts/check-foldingathome-libsystemd.sh is renamed to
scripts/check-foldingathome-image.sh (renamed in d7ba26372) and grows
two checks. A name that undersells what a gate covers is how the gate
goes stale, which is exactly what produced this bugfix: -r1 added a
section titled "Declared dependencies match what is installed" and
reconciled only the Python half.

14 every DT_NEEDED SONAME resolves to something RDEPEND declares
15 every declared library atom is referenced by the binary, either
as DT_NEEDED or as a dlopen string literal

Red against -r1, green against -r2, checks 01-13 unchanged in both:

FAIL 14 needed but not in RDEPEND: liblz4.so.1 -> app-arch/lz4
FAIL 15 declared but never loaded: dev-libs/openssl [9 lib(s)]
RESULT FAIL 2 of 15 checks red (8.5.6-r1)

PASS 14 8 DT_NEEDED entries all accounted for
PASS 15 every declared library atom is referenced by the binary
RESULT PASS 15/15 checks green (8.5.6-r2)

Three traps the checks had to handle, all of which produce a wrong
answer rather than a missing one:

* SONAME resolution is image-first, host-second. This package ships
its own libsystemd.so.0 (the elogind symlink), so asking the host
answers sys-apps/systemd -- an atom the elogind build correctly
does not declare, i.e. a false FAIL manufactured by asking the
wrong machine.
* virtual/* is expanded one level into its providers, or libz.so.1
(owned by sys-libs/zlib) stops matching the moment RDEPEND says
virtual/zlib.
* RDEPEND is read from build-info/RDEPEND, which portage writes
already USE-resolved, never from the ebuild text.

Both checks are host-relative and say so on every run: an atom not
installed on the checking host is printed as NOT JUDGED rather than
counted green. Check 15 also exempts python/acct-*/virtual atoms, which
are declared for reasons other than ELF linkage, and prints that
exemption list every run.

--- unchanged installed image ---

A dependency-atom change must not alter what is installed. Built both
revisions with USE="elogind -systemd" and compared:

diff -r --no-dereference <r1-image> <r2-image>
Only in r1/usr/share/doc: foldingathome-8.5.6-r1
Only in r2/usr/share/doc: foldingathome-8.5.6-r2

The docdir rename is dodoc following $; README.md.bz2 is
byte-identical (cmp) on both sides. Nothing else differs.

--- commit split ---

This change reached master in three commits, not one, and the two
earlier ones were not written by the author of the change:

d7ba26372 the script rename + checks 14/15, and -r2 carrying only
the lz4/ca-certificates half of the reconciliation
cff5fb8da the openssl removal, bundled with unrelated mesa and
llama-cpp bumps
this one the zlib atom, del(-r1), the md5-cache entry, and the
reasoning for all of it

Despite the bump-shaped subject lines, no automated sweep exists in
this repository -- no cron, no timer, no script emits them. Several
sessions run concurrently against this one checkout and each `git add`s
whatever it finds, so a tree that is mid-change gets committed and
pushed by whichever session commits next. Both were already pushed when
this was noticed, so rewriting was off the table: users sync from this
overlay.

Stricter staging is not the fix. Explicit paths were used here and
still lost two thirds of the change, because the problem is a second
writer to the same index, not a careless `git add`. The fix is one
`git worktree` per session, which gives each its own index and working
tree while sharing `.git`. Until that exists, a story requirement of
the form "commit in reviewable slices" is not satisfiable here and
should not be written as an acceptance criterion.

--- pre-existing, not introduced here ---

pkgcheck reports NonsolvableDepsInDev on 6 ~arm64 musl profiles,
solution set [ sys-libs/glibc ]. That atom is unchanged from -r1 and a
musl profile cannot satisfy glibc by construction, so the finding
predates this change. It is also not wrong: the payload is a
glibc-linked Debian binary and genuinely does not run on musl. The
honest fix is a musl mask, which is a separate decision from
reconciling RDEPEND.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit cff5fb8da4ccc1e49177cc5d0a79908340d37e5d
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Aug 8 21:57:22 2026 -0300

add(metadata/{md5-cache/dev-util/mesa_clc-26.3.0_pre20260809, md5-cache/media-libs/mesa-26.3.0_pre20260809, md5-cache/sci-ml/llama-cpp-0_pre10331}), mod(sci-biology/foldingathome-8.5.6-r2), mod(.autoupdate/packages.toml), up(dev-util/mesa_clc-26.3.0_pre20260808 -> 26.3.0_pre20260809, media-libs/mesa-26.3.0_pre20260808 -> 26.3.0_pre20260809, sci-ml/llama-cpp-0_pre10330 -> 0_pre10331)

commit d7ba26372c4942b42904ba4cc83f3efb52aa9523
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Aug 8 21:49:50 2026 -0300

add(sci-biology/foldingathome-8.5.6-r2), add(scripts/check-foldingathome-image.sh), del(scripts/check-foldingathome-libsystemd.sh)

commit ddf98b5d4512928c76581cb3515f9daf27fe2f6c
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Aug 7 17:30:38 2026 -0300

fix(sci-biology/foldingathome-8.5.6-r1): default to elogind so headless OpenRC still merges, add(scripts/check-foldingathome-libsystemd.sh)

The libsystemd fix shipped with IUSE="elogind systemd" and no default.
Neither flag is default-on by itself: elogind comes from the desktop
target, systemd only from systemd profiles. On a plain OpenRC server or
headless profile that leaves both off, so REQUIRED_USE refused the merge
on 30 amd64 profiles -- pkgcheck RequiredUseDefaults. 8.5.6 at least
merged there and failed at runtime; -r1 did not merge at all, which is a
regression for exactly the audience the fix was written for. Default to
+elogind. On a systemd profile elogind is USE-masked, so the default is
overridden there and the exactly-one-of constraint still resolves.

Drop the multilib inherit. get_libdir is a PMS built-in for EAPI >= 6
(eapi.sh:41 gates it, phase-helpers.sh:961 defines it); multilib.eclass
only uses it. The inherit was carried on a false premise and produced a
pkgcheck UnusedInherits warning that 8.5.6 did not have. Re-verified by
execution: the image check stays 13/13 green with $(get_libdir) still
resolving to lib64 without the eclass.

Extend PYTHON_COMPAT to python3_15, which dev-python/websocket-client-1.9.0
supports.

All three were invisible to the QA gate that cleared -r1: it ran pkgcheck
with -c ManifestCheck,MetadataVarCheck,DependencyCheck,SrcUriCheck,
PackageMetadataXmlCheck, chosen to dodge the git-addon IndexError that
crashes a bare full scan. None of those five checks can emit
RequiredUseDefaults, UnusedInherits or PythonCompatUpdate. Narrow by
keyword (-k) instead: it bypasses the same crash without blinding the
gate. The scan now matches the 8.5.6 baseline exactly -- DeprecatedDep on
sys-libs/zlib:= and NonsolvableDepsInDev on arm64/musl, both pre-existing.

Commit the image check itself. It previously lived under .epic/, which is
gitignored, so neither the script nor its recorded output survived outside
one working tree, and the green build directory was already gone by the
time this was audited.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit c556c503b72f7f0cc16d6c34ec02323dc26398a0
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Aug 7 16:45:27 2026 -0300

fix(sci-biology/foldingathome-8.5.6 -> -r1): resolve libsystemd.so.0 via elogind on OpenRC

Upstream 8.5.6 added a DT_NEEDED on libsystemd.so.0 to the prebuilt
fah-client (8.5.5 had none). It imports seven sd_bus_* symbols, all
version-scoped to LIBSYSTEMD_221/222, and the binary is BIND_NOW -- so on
a host without that SONAME the loader aborts before main() and the package
is unusable. sys-apps/systemd-utils does not ship the library.

Select the provider with mutually exclusive elogind/systemd USE flags.
Under USE=elogind, install a private symlink to sys-auth/elogind's
libelogind.so.0 and bake a DT_RUNPATH into the binary, so the loader finds
it with no environment variable from the caller. elogind's version script
declares the LIBSYSTEMD_<n> version nodes and all seven symbols, so this
satisfies the loader's version check rather than merely matching a name.
The systemd path installs no symlink and no RUNPATH, resolving through
ld.so.cache as before. Neither provider can be an unconditional RDEPEND:
sys-auth/elogind carries !sys-apps/systemd.

Also declare what fahctl actually needs. It is a python3 script whose
`from websocket import create_connection` is mandatory -- the ImportError
branch exits 1 -- so python-single-r1 pulls dev-python/websocket-client
for the selected interpreter and python_fix_shebang pins the shebang to it.

Drop the stale md5-cache entry of the superseded 8.5.6.

Verified against the installed image, not by reading the ebuild: 13/13
checks green on -r1 and 5 red on 8.5.6. No OpenRC host was available, so
this proves the package loads, not that it folds work units there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit faaa7641f5823a7be3029c200577c0f0c01a62f1
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Aug 7 15:14:05 2026 -0300

add(metadata/{md5-cache/dev-python/uv-bin-0.12.3, md5-cache/dev-util/spirv-tools-1.4.357.0_p20260807, md5-cache/dev-util/vulkan-tools-1.4.359_p20260807, md5-cache/dev-util/vulkan-utility-libraries-1.4.359, md5-cache/media-libs/vulkan-loader-1.4.359_p20260807, md5-cache/sci-biology/foldingathome-8.5.6-r1, md5-cache/sci-ml/llama-cpp-0_pre10319}), mod(.autoupdate/packages.toml), up(dev-python/uv-bin-0.12.2 -> 0.12.3, dev-util/{spirv-tools-1.4.357.0_p20260806 -> 1.4.357.0_p20260807, vulkan-tools-1.4.358_p20260806 -> 1.4.359_p20260807, vulkan-utility-libraries-1.4.358_p20260806 -> 1.4.359}, media-libs/vulkan-loader-1.4.358_p20260806 -> 1.4.359_p20260807, sci-biology/foldingathome-8.5.6 -> 8.5.6-r1, sci-ml/llama-cpp-0_pre10312 -> 0_pre10319)

commit 99bb5388458f91658ea4702167439e9301141d3e
Author: lucascouts <lucascs@protonmail.com>
Date: Mon Jul 13 13:40:56 2026 -0300

add(metadata/{md5-cache/app-editors/zed-1.12.0_pre20260713, md5-cache/app-portage/bentoolkit-0.13.1, md5-cache/dev-util/codex-0.144.3, md5-cache/dev-util/codex-bin-0.144.3, md5-cache/dev-util/mesa_clc-26.2.0_pre20260713, md5-cache/media-libs/mesa-26.2.0_pre20260713, md5-cache/media-libs/vulkan-layers-1.4.352_p20260713, md5-cache/net-misc/modemmanager-1.25.1_p20260713, md5-cache/net-misc/postman-bin-12.19.0, md5-cache/sci-biology/foldingathome-8.5.6, md5-cache/sci-ml/llama-cpp-0_pre9987}), mod(metadata/md5-cache/app-portage/bentoolkit-0.13.0-r1, .autoupdate/packages.toml), up(app-editors/zed-1.12.0_pre20260712 -> 1.12.0_pre20260713, app-portage/bentoolkit-0.13.0-r1 -> 0.13.1, dev-util/codex{,-bin}-0.144.1 -> 0.144.3, media-libs/{mesa-26.2.0_pre20260712 -> 26.2.0_pre20260713, vulkan-layers-1.4.352_p20260712 -> 1.4.352_p20260713}, net-misc/{modemmanager-1.25.1_p20260710 -> 1.25.1_p20260713, postman-bin-12.18.5 -> 12.19.0}, sci-biology/foldingathome-8.5.5 -> 8.5.6, sci-ml/llama-cpp-0_pre9977 -> 0_pre9987)

commit ec3d8e936fe552efbfea33d4718352b475c36ffb
Author: lucascouts <lucascs@protonmail.com>
Date: Tue Apr 14 21:32:27 2026 -0300

add(dev-libs/{fzssh-1.1.10, libfilezilla-0.55.3}, sci-biology/foldingathome-8.5.5), mod(app-editors/zed-0.233.0_pre20260414, net-ftp/filezilla-3.70.3), up(dev-util/claude-code-2.1.105 -> 2.1.108)