commit 2888c3be92826f90ad13d2518f3857ca7708b451
Author: lucascouts <lucascs@protonmail.com>
Date: Fri Oct 2 17:10:30 2026 -0300

mod(app-forensics/aflplusplus-5.03c, app-text/libetonyek-0.1.13-r1, dev-go/govulncheck-1.8.0, dev-util/{breakpad-2024.02.16-r1, shfmt-3.14.1}, media-libs/draco-1.5.7, net-misc/rustdesk-1.4.9-r2, .autoupdate/packages.toml, metadata/md5-cache/{app-forensics/aflplusplus-5.03c, app-text/libetonyek-0.1.13-r1, dev-go/govulncheck-1.8.0, dev-util/breakpad-2024.02.16-r1, dev-util/shfmt-3.14.1, media-libs/draco-1.5.7, net-misc/rustdesk-1.4.9-r2})

Make two kinds of autoupdate-bump debt survive the next bump.

Patches referenced as $-*.patch now name the file literally
($-<ver>-*.patch): the applier copies the ebuild to the new PV but
never renames files/, so the next bump would look for a patch that does
not exist and die in src_prepare. The files and the installed result are
unchanged, hence no revbump.

Seven exact-anchored series (dart@stable, shotcut, zed, zed-bin) accept
an optional -rN: the checker matches series against the PVR, so the
first revbump of those ebuilds would have failed the record.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

commit a267e33d24c9dd5c9933ccd7cb2713408be2c147
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Sep 6 09:53:42 2026 -0300

fix(sci-ml/lemonade, dev-games/godot, app-emulation/crossover-bin, app-text/libetonyek)

Four unrelated packages, each closing an item that had been recorded and left.

sci-ml/lemonade -- the R6 service hardening story 003 Task 5 asked for and never
got. The account ids were ACCT_USER_ID=-1 / ACCT_GROUP_ID=-1; they are now a
static 601, next to acct-user/localai at 600 and above ::gentoo's highest
assigned id (563). Dynamic ids break exactly the cases this overlay exists to
cover: a container image and its host disagreeing on the number, NFS mapping the
wrong owner, an image built on one machine being wrong on the next.

/etc/conf.d/lemond is now 0640 rather than the 0644 newconfd leaves. It holds
HF_TOKEN, LEMONADE_API_KEY and LEMONADE_ADMIN_API_KEY. root:root is sufficient:
OpenRC sources conf.d as root and only then drops to the lemonade user.

pkg_postinst named the wrong path. It told users to put secrets in
/etc/lemonade/conf.d/ "for the systemd unit", but upstream's unit reads
`EnvironmentFile=-/etc/default/lemond` (data/lemond.service.in:23). Corrected.

It also now discloses the UDP presence broadcast, which is ON BY DEFAULT --
runtime_config.cpp:1241 falls back to `true` -- and announces on RFC1918
interfaces even with the API bound to loopback.

The init script passes --host explicitly. Unlike sci-ml/localai, this is
robustness rather than a fix: upstream already defaults to localhost
(docs/dev/getting-started.md:752). Stating it keeps the bind if that default
ever changes, and LEMOND_HOST is the one place to widen it.

Not done, and recorded as superseded in the story instead: the rc_ulimit
disclosure Task 5.8 also asked for. There is no mlock, MAP_LOCKED or
RLIMIT_MEMLOCK anywhere in the 11.9.0 tree, so nothing sets it and nothing needs
it -- there was no disclosure to preserve.

dev-games/godot -- godot-4.5-scons.patch shared ::gentoo's FILENAME with
different CONTENT, so the parity sweep pairs them and reports a difference
forever. Renamed to godot-4.8-scons-toolchain.patch.

Renamed rather than replaced by ::gentoo's, because they are not older and newer
cuts of one patch: they are two mechanisms, each coupled to how its ebuild
invokes scons. ::gentoo does `tc-export AR CC CXX RANLIB` and patches
platform/linuxbsd/detect.py to read os.environ; src_compile here passes them as
scons command-line variables, so the patch declares them with opts.Add. Both
were dry-run against the 4.8-dev4 tree and both apply cleanly; mixing them is
what would break.

What ::gentoo's had and ours did not is RANLIB, which was not respected at all.
Added on our own mechanism -- opts.Add("RANLIB") plus RANLIB="$(tc-getRANLIB)"
in esconsargs -- and re-dry-run. Gentoo bug #977691 covers the AR half.

app-emulation/crossover-bin -- capi is now default-off. The flag stays, because
someone with legacy ISDN hardware should be able to turn it on and "not useful
to me" is not an exclusion criterion here. But net-libs/libcapi needs
abi_x86_32, so leaving it on made every crossover user pull a 32-bit multilib
dependency for a network technology switched off commercially across most of the
world by 2022. Enabling it later costs nothing extra: the support is already
inside the shipped binary, so the flag only decides whether the library is there
for it to use.

Its Manifest also carried a DIST line for crossover-bin-26.2.0.deb, a version no
longer in the tree. Removed; pkgcheck's UnknownManifest is gone.

app-text/libetonyek -- metadata.xml used `remote-id type="libreoffice-git"`,
which is not in metadata.xsd's enumeration, so the file failed validation. There
is no valid type for a LibreOffice-hosted project and ::gentoo carries no
remote-id here at all, so the <upstream> block is dropped. The file is now
identical to ::gentoo's and validates.

Collateral, and correct: egencache also removed
metadata/md5-cache/sci-ml/lemonade-11.8.1-r1, orphaned since b62ee0572 bumped
the package to 11.9.0 without dropping its cache entry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 9ae98726346bf1349dfc19bf2a6f012def379702
Author: lucascouts <lucascs@protonmail.com>
Date: Sat Sep 5 19:15:50 2026 -0300

mod(media-libs/vulkan-loader, dev-util/{act,mesa_clc}, dev-lang/rapydscript-ng, sys-cluster/minikube, app-text/libetonyek): document 6 divergences

Six single-axis packages, each checked before being written about:

vulkan-loader IUSE layers, a convenience flag pulling the validation
layers in as PDEPEND; ::gentoo leaves that to the user
act LICENSE+= names what the vendored Go modules are under,
where ::gentoo declares only act's own MIT
rapydscript-ng BSD-2 and MIT come from the npm tarballs fetched
individually through SRC_URI; ::gentoo ships one
prebuilt node_modules blob and declares only BSD
minikube INHERIT shell-completion, the successor eclass covering
zsh and fish; ::gentoo still has bash-completion-r1,
and newbashcomp comes from either
mesa_clc IUSE llvm_slot_23, in lockstep with media-libs/mesa
libetonyek PATCHES mdds-3.0 compatibility, needed because this
overlay carries dev-util/mdds at 3.2.1 against
::gentoo's 3.0.0

Two of these are cases where the overlay is the more precise of the two:
act and rapydscript-ng both enumerate the licences of what they actually
vendor instead of naming only the top-level project's.

Noted and NOT fixed, because it is out of this sweep's scope: libetonyek's
metadata.xml fails metadata.xsd, using remote-id type "libreoffice-git",
which is not in the schema's enumeration. It predates this commit.

egencache also dropped a batch of orphaned md5-cache entries for
vulkan-loader snapshots whose ebuilds are gone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit ff544e7e70ac4343184fa06bb704c5349367ff18
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Feb 8 23:07:35 2026 -0300

add(app-containers/docker-29.2.1, app-emulation/open-vm-tools-13.0.10, dev-lang/go-1.25.7, dev-libs/nettle-4.0, media-gfx/krita-6.1.0_alpha_pre, media-sound/ardour-9.0.0), del(app-containers/podman-compose-1.5.0, app-emulation/libvirt-12.0.0, app-office/onlyoffice-bin-9.2.1, dev-python/libvirt-python-12.0.0, media-gfx/darktable-5.4.0, media-libs/gegl-0.4.66, media-sound/audacity-3.7.7, sys-boot/grub-2.14), up(app-containers/{docker-cli-29.1.3 -> 29.2.1, docker-compose-5.0.1 -> 5.0.2}, app-text/libetonyek-0.1.13 -> 0.1.13-r1, dev-libs/libixion-0.20.0 -> 0.20.0-r1, media-gfx/krita-5.2.15 -> 5.2.16)

commit 0057bd749ade379ad52eb8dbaae495a0a6bc8032
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Feb 8 17:00:34 2026 -0300

add(app-text/{libetonyek-0.1.13, mupdf-1.27.1}, dev-libs/libinput-1.30.901), down(dev-util/mesa_clc-26.1_rc2_p20260207 -> 26.0_rc3_p20260207, media-libs/mesa-26.1_rc2_p20260207 -> 26.0_rc3_p20260207)