Weekly portage-stable package updates 2025-06-30

[github-actions]

CI: http://jenkins.infra.kinvolk.io:8080/job/container/job/sdk/2137/cldsv/

Had to make a small fix for the way we invoke mksquashfs with pseudofiles (when building pxe image) - we just updated squashfs-tools and the new version seems to be pickier (doesn't like overwriting existing files and probably dropped some heurstics for location of the pseudofile).

--

• app-arch/libarchive: [PROD] [DEV]

  • from 3.7.9 to 3.8.1
  • build dependencies:
    • added a dependency 'virtual/pkgconfig'
  • release notes: https://github.com/libarchive/libarchive/releases/tag/v3.8.1 https://github.com/libarchive/libarchive/releases/tag/v3.8.0

• app-containers/containerd: [SYSEXT-CONTAINERD]

  • still at 2.0.5
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• app-containers/containers-common: [SYSEXT-PODMAN]

  • from 0.62.2 to 0.63.0
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://github.com/containers/common/releases/tag/v0.63.0

• app-containers/crun: [SYSEXT-PODMAN]

  • still at 1.20
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• app-containers/docker: [SYSEXT-DOCKER]

  • from 28.0.1 to 28.0.4
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • runtime dependencies:
    • changes for app-containers/containerd:
      • changed version constraint from >=2.0.2 to >=2.0.4
    • changes for app-containers/docker-cli weak blocker:
      • changed version constraint from <28.0.1 to <28.0.4
    • changes for app-containers/runc:
      • changed version constraint from >=1.2.3 to >=1.2.5
  • release notes: https://github.com/moby/moby/releases/tag/v28.0.4 https://github.com/moby/moby/releases/tag/v28.0.3 https://github.com/moby/moby/releases/tag/v28.0.2

• app-containers/docker-cli: [SYSEXT-DOCKER]

  • from 28.0.1 to 28.0.4
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://github.com/moby/moby/releases/tag/v28.0.4 https://github.com/moby/moby/releases/tag/v28.0.3 https://github.com/moby/moby/releases/tag/v28.0.2

• app-containers/incus: [SYSEXT-INCUS]

  • still at 6.0.4-r1
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• app-containers/lxc: [SYSEXT-INCUS]

  • still at 6.0.4-r1
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• app-containers/runc: [SYSEXT-CONTAINERD]

  • still at 1.2.6
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• app-crypt/gnupg: [PROD] [DEV]

  • from 2.4.7-r1 to 2.4.8
  • package became unstable on 'arm64'
    • added accept keywords to overlay profiles
  • release notes: https://dev.gnupg.org/T7428

• app-shells/bash-completion: [DEV]

  • from 2.16.0 to 2.16.0-r1
  • build dependencies added because the build system gets regenerated
  • build dependencies:
    • added a dependency '>=app-portage/elt-patches-20250306'
    • added a dependency '>=dev-build/libtool-2.4.7-r3'
    • added a dependency 'sys-devel/gnuconfig'
    • added a dependency '>=dev-build/automake-1.18:1.18' for USE '||'
    • added a dependency '>=dev-build/automake-1.17-r1:1.17' for USE '||'
    • added a dependency '>=dev-build/autoconf-2.72-r1:2.72' for USE '||'

• dev-build/gtk-doc-am:

  • from 1.33.2 to 1.34.0
  • EAPI changed from '7' to '8'
  • runtime dependencies:
    • changes for dev-util/gtk-doc weak blocker:
      • changed version constraint from <1.33.2 to <1.34.0
  • licenses:
    • dropped license 'GPL-2'
    • added license 'GPL-2+'
  • release notes: https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/1.34.0/NEWS

• dev-lang/python: [AZURE] [DEV] [GCE] [SYSEXT-PYTHON]

  • from 3.11.12_p2 to 3.11.13
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • stopped forcing computed gotos
    • it will be enabled if the compiler supports it
  • release notes: https://www.python.org/downloads/release/python-31113/

• dev-libs/elfutils: [PROD] [DEV]

  • from 0.192-r1 to 0.193
  • release notes: https://inbox.sourceware.org/elfutils-devel/CAJDtP-RjuT13zehLgSvz9TnwQZ1VYPOS=q_kuut5a2g+KLamgw@mail.gmail.com/T/#u

• dev-libs/glib: [PROD] [DEV]

  • still at 2.84.3
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• dev-libs/gobject-introspection-common:

  • still at 1.84.0
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• dev-libs/jansson: [PROD] [DEV]

  • from 2.14-r2 to 2.14.1
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://jansson.readthedocs.io/en/latest/changes.html#version-2-14-1

• dev-libs/json-c: [PROD] [DEV]

  • still at 0.18
  • added a patch for new cmake

• dev-libs/libffi: [PROD] [DEV]

  • from 3.4.8-r1 to 3.4.8-r3
  • build static libraries as PIC
  • added some patch for powerpc

• dev-libs/libgcrypt: [PROD] [DEV]

  • from 1.11.0-r2 to 1.11.1
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=NEWS;h=84bc61a49f3a09302b3438cb529baf67576ad859;hb=81ce5321b1b79bde6dfdc3c164efb40c13cf656b

• dev-libs/libtracefs:

  • from 1.8.1 to 1.8.2
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/tag/?h=libtracefs-1.8.2

• dev-libs/libunistring: [PROD] [DEV]

  • from 1.2 to 1.3
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://lists.gnu.org/archive/html/info-gnu/2024-10/msg00000.html

• dev-libs/nettle: [PROD] [DEV]

  • still at 3.10.1
  • licenses:
    • dropped license 'LGPL-2.1' for USE '||'
    • dropped license 'LGPL-3' for USE '||'
    • added license 'GPL-2+' for USE '||'
    • added license 'LGPL-3+' for USE '||'

• dev-libs/openssl: [PROD] [DEV]

  • from 3.3.3 to 3.4.1
  • release notes: https://github.com/openssl/openssl/releases/tag/openssl-3.4.1 https://github.com/openssl/openssl/blob/openssl-3.4.0/NEWS.md#openssl-34

• dev-python/cryptography:

  • from 45.0.3 to 45.0.4
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://github.com/pyca/cryptography/blob/45.0.4/CHANGELOG.rst#4504---2025-06-09

• dev-python/cython:

  • from 3.1.1 to 3.1.2
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://github.com/cython/cython/releases/tag/3.1.2

• dev-python/msgpack: [SYSEXT-PYTHON]

  • from 1.1.0 to 1.1.1
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://github.com/msgpack/msgpack-python/releases/tag/v1.1.1

• dev-python/snakeoil:

  • from 0.10.10 to 0.10.11
  • build dependencies:
    • dropped a dependency '>=dev-python/flit-core-3.8[python_targets_pypy3_11(-)?,python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?]'
  • release notes: https://github.com/pkgcore/snakeoil/releases/tag/v0.10.11

• dev-python/typing-extensions: [SYSEXT-PYTHON]

  • from 4.13.2-r2 to 4.14.0
  • release notes: https://github.com/python/typing_extensions/releases/tag/4.14.0

• dev-util/gdbus-codegen:

  • still at 2.84.3
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• dev-util/glib-utils:

  • still at 2.84.3
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• dev-util/pkgcheck:

  • from 0.10.34 to 0.10.36
  • build dependencies:
    • added a dependency 'app-arch/zstd'
    • changes for dev-python/snakeoil:
      • changed version constraint from >=0.10.10 to >=0.10.11
    • dropped a dependency '<dev-python/tree-sitter-0.25.0[python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?]'
    • changes for sys-apps/pkgcore:
      • changed version constraint from >=0.12.25 to >=0.12.30
  • runtime dependencies:
    • added a dependency 'app-arch/zstd'
    • changes for dev-python/snakeoil:
      • changed version constraint from >=0.10.10 to >=0.10.11
    • dropped a dependency '<dev-python/tree-sitter-0.25.0[python_targets_python3_11(-)?,python_targets_python3_12(-)?,python_targets_python3_13(-)?]'
    • changes for sys-apps/pkgcore:
      • changed version constraint from >=0.12.25 to >=0.12.30
  • release notes: https://github.com/pkgcore/pkgcheck/blob/v0.10.36/NEWS.rst

• eclass/cmake.eclass:

  • added some detection of too low minimum cmake version requirement
    • upcoming cmake 4 drops compat with cmake 3.5 or so

• eclass/distutils-r1.eclass:

  • added some code for adding test dependencies

• eclass/dot-a.eclass:

  • made some variable local

• eclass/perl-module.eclass:

  • moved DIST_MAKE setting into perl-module_src_configure from toplevel

• eclass/python-utils-r1.eclass:

  • added some variables for test plugins

• licenses:

  • added Broadcom-tod, NVIDIA-2023, NVIDIA-2025

• net-dns/bind: [PROD] [DEV]

  • still at 9.18.37-r1
  • package became stable on 'amd64'
  • updated accept keywords in overlay profiles

• net-firewall/ipset: [PROD] [DEV]

  • from 7.23 to 7.24
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://lwn.net/Articles/1021623/

• net-libs/libnftnl: [PROD] [DEV]

  • from 1.2.8 to 1.2.9
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • build dependencies:
    • added a dependency '>=app-portage/elt-patches-20250306'
    • changes for sec-keys/openpgp-keys-netfilter with USE conditionals 'verify-sig?':
      • added version constraint >=20240415
  • release notes: https://lwn.net/Articles/1017463/

• net-misc/curl: [PROD] [DEV]

  • still at 8.13.0-r1
  • made it easier to disable QUIC

• net-misc/passt: [SYSEXT-PODMAN]

  • from 2025.02.17 to 2025.04.15
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://archives.passt.top/passt-user/20250415233140.35074c4b@elisabeth/T/#u

• profiles:

  • nothing interesting

• sys-apps/dtc:

  • from 1.7.2 to 1.7.2-r2
  • brought some fixes for building static libs
  • package became unstable on 'arm64'
  • added accept keywords in overlay profiles

• sys-apps/pkgcore:

  • from 0.12.29 to 0.12.30
  • build dependencies:
    • changes for dev-python/snakeoil:
      • changed version constraint from >=0.10.7 to >=0.10.11
  • runtime dependencies:
    • changes for app-shells/bash:
      • changed version constraint from >=5.1 to >=5.2
    • changes for dev-python/snakeoil:
      • changed version constraint from >=0.10.7 to >=0.10.11
  • release notes: https://github.com/pkgcore/pkgcore/releases/tag/v0.12.30

• sys-apps/portage: [DEV]

  • from 3.0.67-r1 to 3.0.68
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.68

• sys-auth/polkit: [PROD] [DEV]

  • still at 126-r1
  • package became stable on 'amd64'
  • dropped accept keywords from overlay profiles

• sys-boot/gnu-efi:

  • from 4.0.0 to 4.0.1
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://github.com/ncroxon/gnu-efi/releases/tag/4.0.1

• sys-fs/fuse: [SYSEXT-INCUS] [SYSEXT-PODMAN] [VMWARE]

  • still at 3.17.2
  • package became stable on 'arm64'
  • dropped accept keywords from overlay profiles

• sys-fs/squashfs-tools: [DEV] [SYSEXT-INCUS]

  • from 4.6.1 to 4.7
  • release notes: https://lkml.org/lkml/2025/6/3/1214

• sys-libs/glibc: [PROD] [DEV]

  • from 2.40-r8 to 2.40-r11
  • new patch bundle
    • there seem to be a lot of churn here: https://gitweb.gentoo.org/fork/glibc.git/log/?h=gentoo/2.40

• sys-libs/libcap: [PROD] [DEV]

  • from 2.71 to 2.76
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • dropped an unnecessary patch from user-patches
  • release notes: https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.wqnp1zp1o8bm https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.7xqcoecpcnn8 https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.ccbrq82zh7n9 https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.7yd7ab9ppagk https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.ulglddlojmy0

• sys-libs/libunwind: [PROD] [DEV]

  • from 1.8.1 to 1.8.2
  • package became unstable on 'arm64'
  • added accept keywords to overlay profiles
  • release notes: https://github.com/libunwind/libunwind/releases/tag/v1.8.2

• virtual/perl-Encode:

  • from 3.210.0-r1 to 3.210.0-r2
  • runtime dependencies:
    • added a dependency '=dev-lang/perl-5.42*' for USE '||'

• virtual/perl-Unicode-Collate:

  • from 1.310.0-r2 to 1.310.0-r3
  • runtime dependencies:
    • added a dependency '=dev-lang/perl-5.42*' for USE '||'

--

• changelog
• image diff

[krnowak]

CI passed.

[github-actions]

Build action triggered: https://github.com/flatcar/scripts/actions/runs/16024043138

[chewi]

I don't fully understand the mksquashfs changes, and I don't think CI tests PXE. Please do whatever manual testing you think is necessary there.

[krnowak]

I don't fully understand the mksquashfs changes, and I don't think CI tests PXE. Please do whatever manual testing you think is necessary there.

The said squashfs image has contents of /usr directory, so the image's toplevel directories are lib, lib64, share and so on. The first fix was to change /usr/share/flatcar/update.conf to /share/flatcar/update.conf. Otherwise mksquashfs started complaining that usr directory does not exists in the image, so some of the pseudofiles won't be installed.

Second fix is still related to the same file. It already exists in the image, so the pseudofile wanting to be installed there won't be, because mksquashfs stopped liking overwriting the files already present in the image. Which is why I added -e share/flatcar/update.conf - mksquashfs won't copy that file into the image, so that pseudofile can be created there. It was actually a suggestion printed by mksquashfs. :)

I'll add these explanations to the commit message.

And I think pxe stuff is tested by equinix metal, so I'll kick off a test for that platform to be sure.

[chewi]

That all make sense, thank you, and I think you're right about EM.

[krnowak]

CI is still running for equinix metal, but some tests already passed, so we know that the image boots just fine.