[flatcar-infra]

Update sdk_container/src/third_party/gentoo to flatcar-hub/gentoo@a1662c6.

[t-lo]

04:09:15   �[32m*�[0m Applying user patches from /etc/portage/patches ...
04:09:15   �[32m*�[0m Applying 0001-uniq-fix-read-overrun-with-w.patch ...
04:09:15  patching file src/uniq.c
04:09:15  Hunk #1 FAILED at 285.
04:09:15  1 out of 1 hunk FAILED -- saving rejects to file src/uniq.c.rej
04:09:15  �[A�[72C �[34;01m[ �[31;01m!!�[34;01m ]�[0m
04:09:15   �[31;01m*�[0m ERROR: sys-apps/coreutils-9.12::gentoo failed (prepare phase):
04:09:15   �[31;01m*�[0m   patch '-p1' '-f' '-g0' '--no-backup-if-mismatch' failed with '/etc/portage/patches/sys-apps/coreutils/0001-uniq-fix-read-overrun-with-w.patch'

Curious, applying a coreutils patch failed. Did upstream coreutils ingest it and Gentoo should stop carrying it?

[chewi]

Can't look yet, but yes, that's my guess.

[chewi]

I've checked now, 9.12 does include these changes. The patches need to be dropped.

[t-lo]

Fixed the issue in #4359 and kicked off another run.

[t-lo]

It's crun now:

17:40:08   �[32m*�[0m Applying 0001-cve-2026-88264.patch ...
17:40:08  patching file src/libcrun/linux.c
17:40:08  Hunk #1 succeeded at 4305 (offset 267 lines).
17:40:08  Hunk #2 FAILED at 4055.
17:40:08  1 out of 2 hunks FAILED -- saving rejects to file src/libcrun/linux.c.rej
17:40:08  patching file tests/test_devices.py
17:40:08  Hunk #1 succeeded at 474 with fuzz 1 (offset 75 lines).
17:40:08  Hunk #2 FAILED at 578.
17:40:08  1 out of 2 hunks FAILED -- saving rejects to file tests/test_devices.py.rej
17:40:08  �[A�[72C �[34;01m[ �[31;01m!!�[34;01m ]�[0m
17:40:08   �[31;01m*�[0m ERROR: app-containers/crun-1.30.1::gentoo failed (prepare phase):

PR/fix incoming.

[t-lo]

Note to self: Never reference a comment in a PR in another PR with the term "fixes: " before that link. Caused this PR to be auto-closed 😱

[t-lo]

Next issue is:

0:38:54  !!! The following binary packages have been ignored due to user patches:
10:38:54  
10:38:54       net-misc/wget-1.25.0-r3 for /home/sdk/trunk/src/build/images/arm64-usr/developer-9999.0.6104+github-4348-a1/dev-image-rootfs/
[...]
10:38:54  !!! All binary packages that could satisfy "net-misc/wget" for /home/sdk/trunk/src/build/images/arm64-usr/developer-9999.0.6104+github-4348-a1/dev-image-rootfs/ have been masked.

Addressed here: #4372

[t-lo]

The issue persists for binpackages that are shipped with the SDK, since these were built before the user-patches feature existed:

15:41:26  Dependency resolution took 0.45 s (backtrack: 0/20).
15:41:26  
15:41:26  
15:41:26  !!! The following binary packages have been ignored due to user patches:
15:41:26  
15:41:26       app-arch/bzip2-1.0.8-r5 for /home/sdk/trunk/src/build/images/arm64-usr/developer-9999.0.6107+github-4348-a1/dev-image-rootfs/
15:41:26  
15:41:26  !!! These user patches are triggering this warning:
15:41:26  
15:41:26      app-arch/bzip2/0001-bzip2recover-CVE-2026-42250.patch

Chewi is working on a fix.

[t-lo]

Full list of affected packages:

• app-arch/bzip2
• sec-policy/selinux-base-policy
• sec-policy/selinux-dbus
• sys-libs/libsemanage
• sec-policy/selinux-base
• sec-policy/selinux-unconfined

Manually building the binpkgs resolves this issue.

Also,

• dev-libs/openssl
  needs to be rebuilt to work around a fipsinstall issue.

@chewi Are you OK with merging this so we get an updated SDK?

[t-lo]

LGTM as good as it gets, given the portage change. Built locally after manually emerging the packages that need a rebuild for the new portage flag; image build works.

[t-lo]

Both AMD64 and ARM64 package and image builds succeed. Some test failures need to be addressed; however, given the amount of updates we're ingesting that's not unexpected.

LGTM, let's merge so we can focus on fixing the test failures.