Weekly portage-stable package updates 2025-11-03

.github/workflows/portage-stable-packages-list

@@ -79,6 +79,7 @@ app-alternatives/awk
 app-alternatives/bc
 app-alternatives/bzip2
 app-alternatives/cpio
+app-alternatives/gpg
 app-alternatives/gzip
 app-alternatives/lex
 app-alternatives/ninja

changelog/security/2025-11-05-weekly-updates.md

@@ -0,0 +1,2 @@
+- coreutils ([CVE-2025-5278](https://www.cve.org/CVERecord?id=CVE-2025-5278))
+- go ([CVE-2025-47912](https://www.cve.org/CVERecord?id=CVE-2025-47912), [CVE-2025-58183](https://www.cve.org/CVERecord?id=CVE-2025-58183), [CVE-2025-58185](https://www.cve.org/CVERecord?id=CVE-2025-58185), [CVE-2025-58186](https://www.cve.org/CVERecord?id=CVE-2025-58186), [CVE-2025-58187](https://www.cve.org/CVERecord?id=CVE-2025-58187), [CVE-2025-58188](https://www.cve.org/CVERecord?id=CVE-2025-58188), [CVE-2025-58189](https://www.cve.org/CVERecord?id=CVE-2025-58189), [CVE-2025-61723](https://www.cve.org/CVERecord?id=CVE-2025-61723), [CVE-2025-61724](https://www.cve.org/CVERecord?id=CVE-2025-61724), [CVE-2025-61725](https://www.cve.org/CVERecord?id=CVE-2025-61725))

changelog/updates/2025-11-05-weekly-updates.md

@@ -0,0 +1,19 @@
+- SDK: cmake ([4.1.2](https://cmake.org/cmake/help/v4.1/release/4.1.html#id22) (includes [4.1.1](https://cmake.org/cmake/help/v4.1/release/4.1.html#id21), [4.1](https://cmake.org/cmake/help/v4.1/release/4.1.html), [4.0](https://cmake.org/cmake/help/v4.0/release/4.0.html)))
+- SDK: go ([1.25.3](https://go.dev/doc/devel/release#go1.25.minor))
+- base, dev: btrfs-progs ([6.17](https://github.com/kdave/btrfs-progs/releases/tag/v6.17))
+- base, dev: cifs-utils ([7.4](https://lwn.net/Articles/1024956/))
+- base, dev: coreutils ([9.8](https://lists.gnu.org/archive/html/info-gnu/2025-09/msg00005.html))
+- base, dev: hwdata ([0.399](https://github.com/vcrhonek/hwdata/releases/tag/v0.399))
+- base, dev: inih ([62](https://github.com/benhoyt/inih/releases/tag/r62) (includes [61](https://github.com/benhoyt/inih/releases/tag/r61)))
+- base, dev: iproute2 ([6.17.0](https://lore.kernel.org/all/[email protected]/))
+- base, dev: kbd ([2.9.0](https://github.com/legionus/kbd/releases/tag/v2.9.0))
+- base, dev: libtirpc ([1.3.7](https://git.linux-nfs.org/?p=steved/libtirpc.git;a=log;h=refs/tags/libtirpc-1-3-7))
+- base, dev: samba ([4.22.5](https://www.samba.org/samba/history/samba-4.22.5.html) (includes [4.22.4](https://www.samba.org/samba/history/samba-4.22.4.html)))
+- base, dev: strace ([6.17](https://github.com/strace/strace/releases/tag/v6.17))
+- base, dev: util-linux ([2.41.2](https://github.com/util-linux/util-linux/blob/v2.41.2/Documentation/releases/v2.41.2-ReleaseNotes))
+- dev: portage ([3.0.69.3](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.69.3) (includes [3.0.69.2](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.69.2), [3.0.69.1](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.69.1), [3.0.69](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.69)))
+- sysext-overlaybd: overlaybd ([1.0.16](https://github.com/containerd/overlaybd/releases/tag/v1.0.16))
+- sysext-podman: netavark ([1.16.1](https://github.com/containers/netavark/releases/tag/v1.16.1) (includes [1.16.0](https://github.com/containers/netavark/releases/tag/v1.16.0)))
+- sysext-python: more-itertools ([10.8.0](https://github.com/more-itertools/more-itertools/releases/tag/v10.8.0))
+- sysext-python: setuptools-scm ([9.2.0](https://github.com/pypa/setuptools-scm/releases/tag/v9.2.0) (includes [9.1.0](https://github.com/pypa/setuptools-scm/releases/tag/v9.1.0), [9.0.0](https://github.com/pypa/setuptools-scm/releases/tag/v9.0.0)))
+- sysext-python: trove-classifiers ([2025.9.11.17](https://github.com/pypa/trove-classifiers/releases/tag/2025.9.11.17) (includes (2025.9.9.12)[https://github.com/pypa/trove-classifiers/releases/tag/2025.9.9.12], [2025.9.8.13](https://github.com/pypa/trove-classifiers/releases/tag/2025.9.8.13)))

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -56,9 +56,6 @@ dev-cpp/azure-security-keyvault-keys
 =dev-libs/cowsql-1.15.9 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
-# CVE-2025-7039
-=dev-libs/glib-2.84.4 ~amd64 ~arm64
-
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/jose-12 **
 
@@ -74,16 +71,9 @@ dev-cpp/azure-security-keyvault-keys
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 =dev-util/catalyst-4.0.0 ~amd64 ~arm64
 
-# CVE-2025-7039
-=dev-util/gdbus-codegen-2.84.4 ~amd64 ~arm64
-=dev-util/glib-utils-2.84.4 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.8-r1 ~arm64
 
-# Needed to address CVE-2025-2312.
-=net-fs/cifs-utils-7.3 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
@@ -100,6 +90,7 @@ dev-cpp/azure-security-keyvault-keys
 sys-apps/azure-vm-utils
 
 # Keep versions on both arches in sync.
+=sys-apps/coreutils-9.8-r1 ~amd64
 =sys-apps/zram-generator-1.2.1 ~arm64
 =sys-auth/sssd-2.9.7 ~arm64
 =sys-boot/mokutil-0.7.2 **
@@ -108,9 +99,7 @@ sys-apps/azure-vm-utils
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
 # Keep versions on both arches in sync.
-=sys-devel/binutils-2.45-r1 ~arm64
 =sys-fs/lxcfs-6.0.4 ~arm64
-=sys-libs/binutils-libs-2.45-r1 ~arm64
 
 =app-containers/containerd-2.1* ~amd64 ~arm64
 =app-containers/runc-1.3* ~amd64 ~arm64

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.force

@@ -7,6 +7,7 @@ app-alternatives/awk gawk
 app-alternatives/bc gnu
 app-alternatives/bzip2 reference
 app-alternatives/cpio gnu
+app-alternatives/gpg reference
 app-alternatives/gzip reference
 app-alternatives/lex flex
 app-alternatives/ninja reference

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask

@@ -1,5 +1,5 @@
-# We don't ship GnuTLS by default, and smartcard has a dep loop
-app-crypt/gnupg smartcard ssl
+# Smartcard has a dep loop.
+app-crypt/gnupg smartcard
 
 # Our ISOs are not built with Catalyst.
 dev-util/catalyst iso

sdk_container/src/third_party/coreos-overlay/sys-fs/overlaybd/files/0001-Patch-Photon-after-fetching-to-fix-cross-issues.patch

@@ -0,0 +1,25 @@
+From 72d823c414a1416dffc2276e5a0a17f03c5e4549 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <[email protected]>
+Date: Mon, 28 Jul 2025 12:16:50 +0100
+Subject: [PATCH 1/2] Patch Photon after fetching to fix cross issues
+
+Signed-off-by: James Le Cuirot <[email protected]>
+---
+ CMake/Findphoton.cmake | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/CMake/Findphoton.cmake b/CMake/Findphoton.cmake
+index c905bd9..5507f66 100644
+--- a/CMake/Findphoton.cmake
++++ b/CMake/Findphoton.cmake
+@@ -6,6 +6,7 @@ FetchContent_Declare(
+   photon
+   GIT_REPOSITORY https://github.com/alibaba/PhotonLibOS.git
+   GIT_TAG v0.6.17
++  PATCH_COMMAND patch -p1 -i @FILESDIR@/photon-cross.patch
+ )
+
+ if(BUILD_TESTING)
+-- 
+2.51.0
+

sdk_container/src/third_party/coreos-overlay/sys-fs/overlaybd/files/0002-Patch-yaml-cpp-after-fetching-to-fix-cmake-issues.patch

@@ -0,0 +1,25 @@
+From eae89e8432d993417e6f0e17ae519b4e02f72c9b Mon Sep 17 00:00:00 2001
+From: Krzesimir Nowak <[email protected]>
+Date: Fri, 7 Nov 2025 12:06:05 +0100
+Subject: [PATCH 2/2] Patch yaml-cpp after fetching to fix cmake issues
+
+Signed-off-by: Krzesimir Nowak <[email protected]>
+---
+ CMakeLists.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 753b081..03b2ab9 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -53,6 +53,7 @@ if (NOT yaml-cpp_FOUND)
+     yaml-cpp
+     GIT_REPOSITORY https://github.com/jbeder/yaml-cpp.git
+     GIT_TAG 0.8.0
++    PATCH_COMMAND patch -p1 -i @FILESDIR@/yaml-cpp-cmake-4.0.patch
+   )
+   FetchContent_MakeAvailable(yaml-cpp)
+ endif()
+-- 
+2.51.0
+

sdk_container/src/third_party/coreos-overlay/sys-fs/overlaybd/files/yaml-cpp-cmake-4.0.patch

@@ -0,0 +1,42 @@
+From 10a573aa85db4eeb13df9e9cfa7047a0dc55d334 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christoph=20Gr=C3=BCninger?= <[email protected]>
+Date: Mon, 24 Mar 2025 08:32:25 +0100
+Subject: [PATCH] [cmake] Require minimum CMake version 3.5
+
+Soon CMake 4.0 will be released. It requires that projects
+set a minimum required CMake version of 3.5. There is a
+workaround with an additional flag, but it would is better
+to increase the minimum required version.
+---
+ CMakeLists.txt      | 5 +++--
+ test/CMakeLists.txt | 1 -
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 46dc180..ee04e75 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,5 +1,6 @@
+-# 3.5 is actually available almost everywhere, but this a good minimum
+-cmake_minimum_required(VERSION 3.4)
++# 3.5 is actually available almost everywhere.
++# 3.30 as the upper policy limit avoids CMake deprecation warnings.
++cmake_minimum_required(VERSION 3.5...3.30)
+
+ # enable MSVC_RUNTIME_LIBRARY target property
+ # see https://cmake.org/cmake/help/latest/policy/CMP0091.html
+diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
+index 351b03f..210e629 100644
+--- a/test/CMakeLists.txt
++++ b/test/CMakeLists.txt
+@@ -2,7 +2,6 @@ find_package(Threads REQUIRED)
+
+ set(gtest_force_shared_crt ON CACHE BOOL "" FORCE)
+ set(BUILD_MOCK ON CACHE BOOL "" FORCE)
+-set(CMAKE_POLICY_DEFAULT_CMP0048 NEW)
+
+ add_subdirectory(
+   "${CMAKE_CURRENT_SOURCE_DIR}/gtest-1.11.0"
+-- 
+2.51.0
+

sdk_container/src/third_party/coreos-overlay/sys-fs/overlaybd/overlaybd-9999.ebuild

@@ -44,21 +44,21 @@ RDEPEND="
 "
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-cross.patch
-	"${FILESDIR}"/${PN}-pin-tcmu.patch
+	"${FILESDIR}"/0001-Patch-Photon-after-fetching-to-fix-cross-issues.patch
+	"${FILESDIR}"/0002-Patch-yaml-cpp-after-fetching-to-fix-cmake-issues.patch
 )
 
 src_prepare() {
 	cmake_src_prepare
-	sed -i "s:@FILESDIR@:${FILESDIR}:g" CMake/Findphoton.cmake || die
+	sed -i "s:@FILESDIR@:${FILESDIR}:g" CMakeLists.txt CMake/Findphoton.cmake || die
 }
 
 src_configure() {
 	# crc32c.cpp explicitly uses special instructions but checks for them at
 	# runtime. Only DSA hard requires at least AVX2. However, the code doesn't
 	# try especially hard to avoid these instructions from being implicitly used
 	# outside these runtime checks. :(
-  # ISAL similarly leads to "illegal instruction" termination on QEMU.
+	# ISAL similarly leads to "illegal instruction" termination on QEMU.
 	local mycmakeargs=(
 		-DBUILD_SHARED_LIBS=no
 		-DBUILD_TESTING=no

sdk_container/src/third_party/portage-stable/app-admin/eselect/Manifest

@@ -1,2 +1,2 @@
-DIST eselect-1.4.29.tar.xz 185948 BLAKE2B bb387a14c81d5ff5bf2e6e703465b24140b047f1464dee3c7fc0a125c9d94544a9afd801b42d2902dd6dee1af705f7dcfad854286d7e243a0f654cec35ab8eea SHA512 0466be2634f9d632d628cb11793d604002d989c222758ed33259c6b1dede80765d80f782242b22704e890bde84b2e1e3b3fb3d31574812cc803aad64ba8e7cf6
 DIST eselect-1.4.30.tar.xz 186060 BLAKE2B f58c2bdacfcb933aef2414e65866a4be33d02ddc42005770fd4f3200a7aa0437d31301ac35991309d51f2e95e8be2eafa0590600281801c6c63db08b3451b9ef SHA512 89ff9af40849e5d712716c35705e21bfc5d073536da8750566368d519d1b7de823575ffe730faabab4170ca773df31e7bb9d633d8e48361704102987c5d3e681
+DIST eselect-1.4.31.tar.xz 186520 BLAKE2B f40851ffea69c0d8b0142b49669e1112fc34384b0c8f1f6ce8aebbfd48fb6a6f8239e8682d7fe8b49c9d27cc9f7cee4b7c781baef7780e347df90f7cd4b5131e SHA512 ffcd6cdb5aef51b2949893abfc3af356d3011e256671eaae588e3fe6ff41f7bf74167dccef8c794422704097c3351f5c457009b051bbc8f008b2d2f250fa9c1b

sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.29.ebuild → sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.31.ebuild

@@ -1,7 +1,7 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 # Packages sharing a common release tarball:
 # app-admin/eselect
@@ -16,7 +16,7 @@ SRC_URI="https://dev.gentoo.org/~ulm/eselect/${P}.tar.xz"
 
 LICENSE="GPL-2+ || ( GPL-2+ CC-BY-SA-4.0 )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc emacs vim-syntax"
 
 # coreutils for realpath