Weekly portage-stable package updates 2026-08-24

sdk_container/src/third_party/portage-stable/app-arch/gzip/files/gzip-1.14-CVE-2026-41992.patch

@@ -0,0 +1,17 @@
+https://bugs.gentoo.org/981308
+https://marc.info/?l=oss-security&m=178750295349970&w=4
+--- a/unlzh.c
++++ b/unlzh.c
+@@ -307,6 +307,12 @@ decode_p ()
+ static void
+ huf_decode_start ()
+ {
++    /* Needed in case LEFT and RIGHT are reused from a previous
++       LZW decompression.  It may be overkill to clear all of both
++       arrays, but nobody has had time to analyze this carefully.  */
++    memzero (left, (2 * NC - 1) * sizeof *left);
++    memzero (right, (2 * NC - 1) * sizeof *right);
++
+     init_getbits();  blocksize = 0;
+ }
+

sdk_container/src/third_party/portage-stable/app-arch/gzip/files/gzip-1.14-zgrep.patch

@@ -0,0 +1,22 @@
+https://debbugs.gnu.org/80868
+
+From cd74dc30f8cc5814c7805c9cee52302b6d34d811 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Mon, 20 Apr 2026 10:22:33 -0700
+Subject: [PATCH] zgrep: fix quoting typo
+
+* zgrep.in: Fix quoting typo in option parsing.
+Problem reported by Leenear (bug#80868).
+--- a/zgrep.in
++++ b/zgrep.in
+@@ -172,7 +172,7 @@ while test $# -ne 0; do
+   esac
+
+   case $option in
+-  (*\'?*)
++  (*\'*)
+     option=\'$(printf '%s\n' "$option" | LC_ALL=C sed "$escape");;
+   (*)
+     option="'$option'";;
+-- 
+2.51.0

sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.14-r1.ebuild

@@ -0,0 +1,98 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gzip.asc
+inherit eapi9-ver flag-o-matic verify-sig
+
+DESCRIPTION="Standard GNU compressor"
+HOMEPAGE="https://www.gnu.org/software/gzip/"
+if [[ ${PV} == *_p* ]] ; then
+	# Note: could put this in devspace, but if it's gone, we don't want
+	# it in tree anyway. It's just for testing.
+	MY_SNAPSHOT="$(ver_cut 1-2).56-e549"
+	SRC_URI="
+		https://meyering.net/gzip/gzip-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz
+		verify-sig? (
+			https://meyering.net/gzip/gzip-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig
+		)
+	"
+	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
+else
+	SRC_URI="
+		mirror://gnu/gzip/${P}.tar.xz
+		verify-sig? (
+			mirror://gnu/gzip/${P}.tar.xz.sig
+		)
+	"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if [[ ${PV} != *_p* ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="pic static"
+
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-gzip )"
+RDEPEND="!app-arch/pigz[symlink(-)]"
+PDEPEND="
+	app-alternatives/gzip
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.3.8-install-symlinks.patch"
+	"${FILESDIR}/${P}-CVE-2026-41992.patch"
+	"${FILESDIR}/${P}-zgrep.patch"
+)
+
+src_configure() {
+	use static && append-flags -static
+
+	# Avoid text relocation in gzip
+	use pic && export DEFS="NO_ASM"
+
+	# embeds the path to grep detected at build time into installed scripts;
+	# use the canonical USE="split-usr" agnostic path. bug #935721
+	export GREP="${EPREFIX}/bin/grep"
+
+	# bug #663928
+	econf --disable-gcc-warnings
+}
+
+src_install() {
+	default
+
+	docinto txt
+	dodoc algorithm.doc gzip.doc
+
+	# Avoid conflict with app-arch/ncompress
+	rm "${ED}"/usr/bin/uncompress || die
+
+	# keep most things in /usr, just the fun stuff in /
+	# also rename them to avoid conflict with app-alternatives/gzip
+	dodir /bin
+	local x
+	for x in gunzip gzip zcat; do
+		mv "${ED}/usr/bin/${x}" "${ED}/bin/${x}-reference" || die
+	done
+	mv "${ED}"/usr/share/man/man1/gzip{,-reference}.1 || die
+	rm "${ED}"/usr/share/man/man1/{gunzip,zcat}.1 || die
+}
+
+pkg_postinst() {
+	if ver_replacing -lt "1.12-r2"; then
+		ewarn "This package no longer installs 'uncompress'."
+		ewarn "Please use 'gzip -d' to decompress .Z files."
+	fi
+
+	# ensure to preserve the symlinks before app-alternatives/gzip
+	# is installed
+	local x
+	for x in gunzip gzip zcat; do
+		if [[ ! -h ${EROOT}/bin/${x} ]]; then
+			ln -s "${x}-reference" "${EROOT}/bin/${x}" || die
+		fi
+	done
+}

sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.35-r1.ebuild

@@ -4,7 +4,7 @@
 EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/tar.asc
-inherit branding check-reqs multiprocessing verify-sig
+inherit branding check-reqs multiprocessing toolchain-funcs verify-sig
 
 DESCRIPTION="Use this to make tarballs :)"
 HOMEPAGE="https://www.gnu.org/software/tar/"
@@ -20,7 +20,7 @@ SRC_URI="
 LICENSE="GPL-3+"
 SLOT="0"
 if [[ -z "$(ver_cut 3)" || "$(ver_cut 3)" -lt 90 ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="acl minimal nls selinux test xattr"
 RESTRICT="!test? ( test )"
@@ -96,7 +96,14 @@ src_test() {
 	# Drop after 1.35: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=18f90676e4695ffcf13413e9fbb24cc0ae2ae9d5
 	local -x XZ_OPT= XZ_DEFAULTS=
 
-	emake check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
+	local testargs=(
+		--jobs=$(get_makeopts_jobs)
+	)
+
+	# 155: time: tricky time stamps FAILED (time01.at:23)
+	! tc-has-64bit-time_t && testargs+=( -k '!time01' )
+
+	emake check TESTSUITEFLAGS="${testargs[*]}"
 }
 
 src_install() {

sdk_container/src/third_party/portage-stable/app-arch/unzip/Manifest

@@ -1,3 +1,3 @@
 DIST unzip60.tar.gz 1376845 BLAKE2B 5016d300b4452018a391f4ebc03c6960c068df400a0407c0c60bd7bb5ec5012031f916d8b204a6149ba291c2c35beba40d9b43c76fc093026e79471329ab0e47 SHA512 0694e403ebc57b37218e00ec1a406cae5cc9c5b52b6798e0d4590840b6cdbf9ddc0d9471f67af783e960f8fa2e620394d51384257dca23d06bcd90224a80ce5d
-DIST unzip_6.0-27.debian.tar.xz 24980 BLAKE2B e53a96f12af0cf5227600c73a35003484fca5de138cd37991eb1eb25b97b80371c3a566d989feeb04deb1a93acd9444253b091cd7e920b23520c87c5f5a94eeb SHA512 e1e605f023c7b314a6c5b2857a3bd630350df2d7e4bf6bb38ab8594f967336384666b4db8afad931251b85261ee4e2c38d78641c74ac7e5fd02523f26e92ddb2
 DIST unzip_6.0-29.debian.tar.xz 25876 BLAKE2B b4477fe1c611e91bf878aeab868a2fd5b5fc62f81a43eb8505716edea8d56509947ca5fe6ca2b0a72899e1681e75cdb22911c3ba454eb453eb401c0e63af7e9a SHA512 527baae307d9ae169b6f9ad29319c61a2386de523319200efeda4a763b78777554e9ec035351c0da9160656c8b8e7aba60cc18fe1eb23fccca1e0115dee63e57
+DIST unzip_6.0-31.debian.tar.xz 27232 BLAKE2B cec55b499ca41f281f9c72ff8b176ee9c3c51263a49d1888161dc8ba9a779916247c30fdaa1d8c521c5013a5ebd61a3500f4021dc262ad90625948b2a91efba8 SHA512 63ddbf7aa70469a4f9bf239e127d794dc178f274fcb12e6d2721d7325df6066590874227fd45ddece2eb55c5363f05194dda071eb10355bb84dda8a617c57ec5

sdk_container/src/third_party/portage-stable/app-arch/unzip/unzip-6.0_p29.ebuild → sdk_container/src/third_party/portage-stable/app-arch/unzip/unzip-6.0_p31.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -19,7 +19,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="Info-ZIP"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="bzip2 natspec unicode"
 
 DEPEND="
@@ -28,21 +28,25 @@ DEPEND="
 "
 RDEPEND="${DEPEND}"
 
-PATCHES=(
-	"${WORKDIR}"/debian/patches
-	"${FILESDIR}"/${PN}-6.0-no-exec-stack.patch
-	"${FILESDIR}"/${PN}-6.0-format-security.patch
-	"${FILESDIR}"/${PN}-6.0-fix-false-overlap-detection-on-32bit-systems.patch
-)
-
 src_prepare() {
+	sed -i -e '/this-is-debian-unzip/d' "${WORKDIR}"/debian/patches/series || die
+
+	PATCHES=(
+		$(sed -e 's:^:../debian/patches/:' "${WORKDIR}"/debian/patches/series || die)
+
+		"${FILESDIR}"/${PN}-6.0-no-exec-stack.patch
+		"${FILESDIR}"/${PN}-6.0-format-security.patch
+		"${FILESDIR}"/${PN}-6.0-c99-configure.patch
+	)
+
 	# bug #275244
 	use natspec && PATCHES+=( "${FILESDIR}"/${PN}-6.0-natspec.patch )
 
-	rm "${WORKDIR}"/debian/patches/02-this-is-debian-unzip.patch || die
-
 	default
 
+	sed -i \
+		-e 's:LFLAGS2="-s":LFLAGS2=:' \
+		unix/configure || die
 	sed -i -r \
 		-e '/^CFLAGS/d' \
 		-e '/CFLAGS/s:-O[0-9]?:$(CFLAGS) $(CPPFLAGS):' \
@@ -69,6 +73,9 @@ src_configure() {
 		*linux*)             TARGET="linux_noasm" ;;
 		*-darwin*)           TARGET="macosx" ;;
 		*-solaris*)          TARGET="linux_noasm" ;;
+		*-gnu)               TARGET="generic" ;;
+		# generic may work but there may be a better-suited target
+		# so we should get people to check.
 		*) die "Unknown target; please update the ebuild to handle ${CHOST}" ;;
 	esac
 
@@ -85,6 +92,14 @@ src_compile() {
 	ASFLAGS="${ASFLAGS} $(get_abi_CFLAGS)" emake -f unix/Makefile ${TARGET}
 }
 
+src_test() {
+	# Match the timezone with which test files were created, per a warning
+	# it prints upon a mismatch.
+	local -x TZ=CET
+
+	ASFLAGS="${ASFLAGS} $(get_abi_CFLAGS)" emake -f unix/Makefile check
+}
+
 src_install() {
 	dobin unzip funzip unzipsfx unix/zipgrep
 	dosym unzip /usr/bin/zipinfo

sdk_container/src/third_party/portage-stable/app-arch/zip/Manifest

@@ -1 +1,2 @@
 DIST zip30.zip 1287223 BLAKE2B d29a3e3ddbaa3ce50c80b2dd058b39c35791bf2079879b61dab0be4f011ccd3331d1768ebda5a69aa150c651713eb7a99b02833bb727eee75a3e0bbdc8504cbc SHA512 642ea6768d79adc1499251a3fb7bfc7ddc8d708699cbf9e0cfe849deda94165cb93e21dc2606bea1166ae5d8531e1e2cb056a7246bf2ab86ea7587bd4712d8d8
+DIST zip_3.0-16.debian.tar.xz 12512 BLAKE2B cd705fcafb72ac4bfa20a1844e26a073856d075f61d3da670aaf09c76e614cf4ad1b5d22f135e9d3e1e0e6417950734cd6db19a38a6ba4cf7852357d60321134 SHA512 c58b69f5749d2580a49398390adce1a4ea39bf8f27de339578ba5aa0906fbd4ff5cddc027d22b2500784ab7a9440a10b752628be7e9dca48fb471e68947bf310

sdk_container/src/third_party/portage-stable/app-arch/zip/files/zip-3.0_p16-zipnote-freeze.patch

@@ -0,0 +1,39 @@
+https://bugs.gentoo.org/322047
+--- a/zipfile.c
++++ b/zipfile.c
+@@ -5406,7 +5406,9 @@ int putlocal(z, rewrite)
+     if (z->flg & UTF8_BIT) {
+       /* If this flag is set, then restore UTF-8 as path name */
+       use_uname = 1;
++      tempzn -= nam;
+       nam = strlen(z->uname);
++      tempzn += nam;
+     } else {
+       /* use extra field */
+       add_Unicode_Path_local_extra_field(z);
+@@ -5647,7 +5650,9 @@ int putcentral(z)
+     if (z->flg & UTF8_BIT) {
+       /* If this flag is set, then restore UTF-8 as path name */
+       use_uname = 1;
++      tempzn -= nam;
+       nam = strlen(z->uname);
++      tempzn += nam;
+     } else {
+       add_Unicode_Path_cen_extra_field(z);
+     }
+--- a/zipnote.c
++++ b/zipnote.c
+@@ -575,6 +575,13 @@ char **argv;            /* command line
+       strcpy(z->iname, a+2);
+ #endif
+
++#ifdef UNICODE_SUPPORT
++#define UTF8_BIT (1 << 11)
++      if (using_utf8) {
++        z->uname = z->iname;
++      }
++#endif
++
+ /*
+  * Don't update z->nam here, we need the old value a little later.....
+  * The update is handled in zipcopy().