commit a267e33d24c9dd5c9933ccd7cb2713408be2c147
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Sep 6 09:53:42 2026 -0300

fix(sci-ml/lemonade, dev-games/godot, app-emulation/crossover-bin, app-text/libetonyek)

Four unrelated packages, each closing an item that had been recorded and left.

sci-ml/lemonade -- the R6 service hardening story 003 Task 5 asked for and never
got. The account ids were ACCT_USER_ID=-1 / ACCT_GROUP_ID=-1; they are now a
static 601, next to acct-user/localai at 600 and above ::gentoo's highest
assigned id (563). Dynamic ids break exactly the cases this overlay exists to
cover: a container image and its host disagreeing on the number, NFS mapping the
wrong owner, an image built on one machine being wrong on the next.

/etc/conf.d/lemond is now 0640 rather than the 0644 newconfd leaves. It holds
HF_TOKEN, LEMONADE_API_KEY and LEMONADE_ADMIN_API_KEY. root:root is sufficient:
OpenRC sources conf.d as root and only then drops to the lemonade user.

pkg_postinst named the wrong path. It told users to put secrets in
/etc/lemonade/conf.d/ "for the systemd unit", but upstream's unit reads
`EnvironmentFile=-/etc/default/lemond` (data/lemond.service.in:23). Corrected.

It also now discloses the UDP presence broadcast, which is ON BY DEFAULT --
runtime_config.cpp:1241 falls back to `true` -- and announces on RFC1918
interfaces even with the API bound to loopback.

The init script passes --host explicitly. Unlike sci-ml/localai, this is
robustness rather than a fix: upstream already defaults to localhost
(docs/dev/getting-started.md:752). Stating it keeps the bind if that default
ever changes, and LEMOND_HOST is the one place to widen it.

Not done, and recorded as superseded in the story instead: the rc_ulimit
disclosure Task 5.8 also asked for. There is no mlock, MAP_LOCKED or
RLIMIT_MEMLOCK anywhere in the 11.9.0 tree, so nothing sets it and nothing needs
it -- there was no disclosure to preserve.

dev-games/godot -- godot-4.5-scons.patch shared ::gentoo's FILENAME with
different CONTENT, so the parity sweep pairs them and reports a difference
forever. Renamed to godot-4.8-scons-toolchain.patch.

Renamed rather than replaced by ::gentoo's, because they are not older and newer
cuts of one patch: they are two mechanisms, each coupled to how its ebuild
invokes scons. ::gentoo does `tc-export AR CC CXX RANLIB` and patches
platform/linuxbsd/detect.py to read os.environ; src_compile here passes them as
scons command-line variables, so the patch declares them with opts.Add. Both
were dry-run against the 4.8-dev4 tree and both apply cleanly; mixing them is
what would break.

What ::gentoo's had and ours did not is RANLIB, which was not respected at all.
Added on our own mechanism -- opts.Add("RANLIB") plus RANLIB="$(tc-getRANLIB)"
in esconsargs -- and re-dry-run. Gentoo bug #977691 covers the AR half.

app-emulation/crossover-bin -- capi is now default-off. The flag stays, because
someone with legacy ISDN hardware should be able to turn it on and "not useful
to me" is not an exclusion criterion here. But net-libs/libcapi needs
abi_x86_32, so leaving it on made every crossover user pull a 32-bit multilib
dependency for a network technology switched off commercially across most of the
world by 2022. Enabling it later costs nothing extra: the support is already
inside the shipped binary, so the flag only decides whether the library is there
for it to use.

Its Manifest also carried a DIST line for crossover-bin-26.2.0.deb, a version no
longer in the tree. Removed; pkgcheck's UnknownManifest is gone.

app-text/libetonyek -- metadata.xml used `remote-id type="libreoffice-git"`,
which is not in metadata.xsd's enumeration, so the file failed validation. There
is no valid type for a LibreOffice-hosted project and ::gentoo carries no
remote-id here at all, so the <upstream> block is dropped. The file is now
identical to ::gentoo's and validates.

Collateral, and correct: egencache also removed
metadata/md5-cache/sci-ml/lemonade-11.8.1-r1, orphaned since b62ee0572 bumped
the package to 11.9.0 without dropping its cache entry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit a8e57db34bf744fcaf43a6f7be6af7d0edad58a3
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Jul 24 16:30:56 2026 -0300

add(acct-group/lemonade-0, acct-user/lemonade-0, media-libs/dav1d-1.5.4, sci-ml/lemonade{,-bin}-11.5.0), add(metadata/{md5-cache/acct-group/lemonade-0, md5-cache/acct-user/lemonade-0, md5-cache/app-editors/cursor-3.13.10, md5-cache/app-editors/vim-9.2.0846, md5-cache/app-editors/vim-core-9.2.0846, md5-cache/app-misc/claude-desktop-bin-1.24012.9, md5-cache/dev-util/claude-code-2.1.219, md5-cache/dev-util/glslang-1.4.350.1_p20260724, md5-cache/media-libs/dav1d-1.5.4, md5-cache/media-libs/vulkan-layers-1.4.352_p20260724, md5-cache/sci-ml/lemonade-11.5.0, md5-cache/sci-ml/lemonade-bin-11.5.0, md5-cache/sci-ml/llama-cpp-0_pre10107, md5-cache/www-client/brave-browser-1.92.144}), mod(.autoupdate/packages.toml), up(app-editors/{cursor-3.12.30 -> 3.13.10, vim-9.2.0843 -> 9.2.0846, vim-core-9.2.0843 -> 9.2.0846}, app-misc/claude-desktop-bin-1.24012.1 -> 1.24012.9, dev-util/{claude-code-2.1.218 -> 2.1.219, glslang-1.4.350.1_p20260723 -> 1.4.350.1_p20260724}, media-libs/vulkan-layers-1.4.352_p20260721 -> 1.4.352_p20260724, sci-ml/llama-cpp-0_pre10106 -> 0_pre10107, www-client/brave-browser-1.92.143 -> 1.92.144)