commit 48515630fc69096b7a2a2d267c1a48cc1ecac1c9
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Mon Aug 31 10:09:17 2026 +0200

sys-apps/cuid: new package, add 10.0.0

Component Unified Identifier: builds a deterministic 122-bit ID for a hardware
component from whatever architectural markers it exposes -- a PCIe Device
Serial Number capability, an SMBIOS or ACPI serial, or a generated fingerprint
where neither exists -- so one device gets the same identifier from every tool
that asks. sys-apps rather than sci-libs: it covers CPUs, NICs and platforms as
well as GPUs and is not ROCm-specific despite shipping in the ROCm tree.

OpenSSL is declared as a dependency for a reason beyond linkage: upstream does
find_package(OpenSSL QUIET) and, when it is NOT found, falls back to
FetchContent-cloning janbar/openssl-cmake at configure time. That cannot work
under network-sandbox, and would vendor a second OpenSSL if it could.
Confirmed the system copy is what gets linked -- objdump -p on
libamdcuid_shared.so reports libcrypto.so.3.

BUILD_DAEMON stays off, as upstream defaults it: the daemon ships a systemd
unit template and a postinst script, so packaging it would need an OpenRC
service and an acct-user of its own. The library and the amdcuid_tool CLI are
the useful parts.

src_install drops amdcuid_postinst.sh and amdcuid_prerm.sh. Those are dpkg
maintainer-script hooks rather than tools, and in this configuration they are
broken by construction -- both dispatch to amdcuid_daemon_{postinst,prerm}.sh
and ../../bin/amdcuid_daemon, none of which are installed. amdcuid_setup_hmac.sh
is kept, since it is the real provisioning step, and pkg_postinst points at it
rather than running it: it writes /etc/amdcuid/hmac_key.bin, and generating
that from the ebuild would leave an untracked file under /etc.

Build-verified and run-verified on haarmek. `amdcuid_tool --list` enumerates
five devices with stable CUIDs -- platform, CPU, the gfx1150 GPU at
/sys/class/drm/renderD128, and NICs -- without the HMAC key present, since only
fingerprint-derived identifiers need it. The "Error opening key file" notice it
prints in that state is exactly what pkg_postinst tells the user how to resolve.