commit 39821b302b8006e39aa54016d2fceab8dc74a9d9
Author: lucascouts <lucascs@protonmail.com>
Date: Thu Nov 5 12:55:05 2026 -0300

app-crypt/oo7: new package, 0.7.0

oo7 is the Rust Secret Service provider that Fedora 45 made its default in
place of gnome-keyring. No Gentoo overlay packages it; Alpine's
community/oo7 was the reference, for its OpenRC user scripts.

0.7.0 and not 0.6.0: the PAM hardening (supplementary groups dropped before
the credential switch, secrets locked in memory without IPC_LOCK, socket
ownership checked) landed after 0.6.0. cargo audit over the 223 locked
crates reports no advisory. The tag is unsigned; the Manifest hash matches
the tarball fetched straight from GitHub.

The three meson projects (server, portal, pam) run cargo from their build
directory, so those directories live inside $ and share one target
directory; src_prepare limits each to its own crate, guarded, so the pyo3
bindings are never built. The daemon installs no D-Bus activation file,
hence no file collision with gnome-keyring: the conflict is runtime only and
pkg_postinst says so. OpenRC user scripts are installed unconditionally,
with no_new_privs and umask 0077; the systemd user units are behind
USE=systemd. pam_oo7.so stays inert until listed in a PAM stack.

Verified unprivileged with USE="pam portal server systemd" through
src_install (no merge: no sudo here): 0 QA notices, PIE/RELRO/BIND_NOW, no
setuid helper, pkgcheck clean, check-openrc-coverage PASS. Not run:
USE=-systemd, the upstream test suites (RESTRICT=test, they need a session
bus and PAM). New autoupdate record, probe checked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>