pkgcore 0.12.41__tar.gz → 0.12.42__tar.gz

{pkgcore-0.12.41 → pkgcore-0.12.42}/NEWS.rst

@@ -2,6 +2,57 @@
 Release Notes
 =============
 
+----------------------------
+pkgcore 0.12.42 (2026-09-05)
+----------------------------
+
+Features
+~~~~~~~~
+
+- eclass: support the ``@DEAD`` tag, rendering a warning box in the eclass docs
+  (Arthur Zamarin)
+
+- eclass: support the ``@BUGREPORTS:`` tag, replacing the default bug reporting
+  instructions (Arthur Zamarin)
+
+- eclass: support the ``@USER_VARIABLE`` tag on ``@VARIABLE:`` blocks, and
+  label such function variables in the docs (Arthur Zamarin)
+
+- ``pmaint eclass``: report docutils' complaints about eclassdoc through
+  pkgcore's logger, so they name the eclass and are silenced by ``-q``
+  (Arthur Zamarin)
+
+- ``pkgcore.landlock``: new module confining a process to a set of writable
+  paths, with outgoing TCP denied, for use around ebuild sourcing.  Requires
+  ``py-landlock`` and a kernel with Landlock enabled (Arthur Zamarin)
+
+- ``pmaint regen`` now confines itself while regenerating, so a sourced ebuild
+  can only write to the caches being regenerated.  Disable it with
+  ``--sandbox=n``, or require it with ``--sandbox=y`` (Arthur Zamarin)
+
+Fixes
+~~~~~
+
+- resolver: fix ``pmerge`` dying with ``TypeError: It's prohibited to pass
+  unhashable arguments to the WeaklyCached class MutableContainmentRestriction``
+  before it could resolve anything (Arthur Zamarin)
+
+- ``pmaint eclass -f man``: eclassdoc writes its own angle brackets around
+  maintainer and author addresses, and docutils wrapped the recognized address
+  in another pair, rendering ``<<gnu-emacs@gentoo.org>>`` (Arthur Zamarin, #479)
+
+- ``pmaint eclass``: fix escaping of variable values (Arthur Zamarin)
+
+- ``pmaint eclass -f man``: fix ``to_man()`` dropping the eclass blurb from the
+  object rather than from the document (Arthur Zamarin)
+
+- eclass: don't use all-caps for variable types (Ulrich Müller, #481)
+
+- eclass: fix regex for initial var="val" extraction (Ulrich Müller, #483)
+
+- eclass: remove backwards-compat code for ``@ECLASS-VARIABLE`` (Ulrich Müller,
+  #484)
+
 ----------------------------
 pkgcore 0.12.41 (2026-08-30)
 ----------------------------

{pkgcore-0.12.41 → pkgcore-0.12.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pkgcore
-Version: 0.12.41
+Version: 0.12.42
 Summary: package managing framework
 Author-email: Michał Górny <mgorny@gentoo.org>, Tim Harder <radhermit@gmail.com>, Brian Harring <ferringb@gmail.com>, Arthur Zamarin <arthurzam@gentoo.org>, Marien Zwart <marienz@gentoo.org>
 Maintainer-email: Arthur Zamarin <arthurzam@gentoo.org>
@@ -11,12 +11,14 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 License-File: LICENSE
-Requires-Dist: snakeoil >= 0.11.5
+Requires-Dist: snakeoil >= 0.11.6
 Requires-Dist: lxml
+Requires-Dist: py-landlock
 Requires-Dist: sphinx ; extra == "doc"
 Requires-Dist: ruff ; extra == "formatter"
 Requires-Dist: pytest >= 9.0 ; extra == "test"
 Requires-Dist: pytest-cov ; extra == "test"
+Requires-Dist: docutils >= 0.18 ; extra == "test"
 Project-URL: Documentation, https://pkgcore.github.io/pkgcore/
 Project-URL: Homepage, https://github.com/pkgcore/pkgcore
 Project-URL: Source, https://github.com/pkgcore/pkgcore

{pkgcore-0.12.41 → pkgcore-0.12.42}/build/sphinx/man/patom.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PATOM" "1" "Aug 30, 2026" "0.12.41" "pkgcore"
+.TH "PATOM" "1" "Sep 05, 2026" "0.12.42" "pkgcore"
 .SH NAME
 patom \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.41 → pkgcore-0.12.42}/build/sphinx/man/pclean.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PCLEAN" "1" "Aug 30, 2026" "0.12.41" "pkgcore"
+.TH "PCLEAN" "1" "Sep 05, 2026" "0.12.42" "pkgcore"
 .SH NAME
 pclean \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.41 → pkgcore-0.12.42}/build/sphinx/man/pclonecache.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PCLONECACHE" "1" "Aug 30, 2026" "0.12.41" "pkgcore"
+.TH "PCLONECACHE" "1" "Sep 05, 2026" "0.12.42" "pkgcore"
 .SH NAME
 pclonecache \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.41 → pkgcore-0.12.42}/build/sphinx/man/pconfig.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PCONFIG" "1" "Aug 30, 2026" "0.12.41" "pkgcore"
+.TH "PCONFIG" "1" "Sep 05, 2026" "0.12.42" "pkgcore"
 .SH NAME
 pconfig \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.41 → pkgcore-0.12.42}/build/sphinx/man/pebuild.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PEBUILD" "1" "Aug 30, 2026" "0.12.41" "pkgcore"
+.TH "PEBUILD" "1" "Sep 05, 2026" "0.12.42" "pkgcore"
 .SH NAME
 pebuild \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.41 → pkgcore-0.12.42}/build/sphinx/man/pinspect.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PINSPECT" "1" "Aug 30, 2026" "0.12.41" "pkgcore"
+.TH "PINSPECT" "1" "Sep 05, 2026" "0.12.42" "pkgcore"
 .SH NAME
 pinspect \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.41 → pkgcore-0.12.42}/build/sphinx/man/pmaint.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PMAINT" "1" "Aug 30, 2026" "0.12.41" "pkgcore"
+.TH "PMAINT" "1" "Sep 05, 2026" "0.12.42" "pkgcore"
 .SH NAME
 pmaint \- Wrapper for running commandline scripts.
 .SH SYNOPSIS
@@ -222,8 +222,8 @@ if a matching pkg already exists in the target, don\(aqt update it
 .EX
 pmaint regen [\-\-domain DOMAIN] [\-h] [\-\-debug] [\-q] [\-v]
              [\-\-color BOOLEAN] [\-\-disable\-eclass\-caching] [\-t THREADS]
-             [\-\-force] [\-\-dir CACHE_DIR] [\-\-rsync] [\-\-use\-local\-desc]
-             [\-\-pkg\-desc\-index]
+             [\-\-force] [\-\-dir CACHE_DIR] [\-\-sandbox BOOLEAN] [\-\-rsync]
+             [\-\-use\-local\-desc] [\-\-pkg\-desc\-index]
              [repo ...]
 .EE
 .UNINDENT
@@ -300,6 +300,14 @@ use separate directory to store repository caches
 .UNINDENT
 .INDENT 0.0
 .TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes are
+limited to the caches being regenerated, and outgoing TCP is denied.
+Enabled by default; \(aqy\(aq turns an unsupported kernel into an error
+instead of continuing unconfined, and \(aqn\(aq disables it.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B \-\-rsync
 perform actions necessary for rsync repos (update metadata/timestamp.chk)
 .UNINDENT

{pkgcore-0.12.41 → pkgcore-0.12.42}/build/sphinx/man/pmerge.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PMERGE" "1" "Aug 30, 2026" "0.12.41" "pkgcore"
+.TH "PMERGE" "1" "Sep 05, 2026" "0.12.42" "pkgcore"
 .SH NAME
 pmerge \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.41 → pkgcore-0.12.42}/build/sphinx/man/pquery.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PQUERY" "1" "Aug 30, 2026" "0.12.41" "pkgcore"
+.TH "PQUERY" "1" "Sep 05, 2026" "0.12.42" "pkgcore"
 .SH NAME
 pquery \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.41 → pkgcore-0.12.42}/pyproject.toml

@@ -1,7 +1,7 @@
 [build-system]
 requires = [
 	"flit_core >=3.8,<4",
-	"snakeoil >= 0.11.4",
+	"snakeoil >= 0.11.6",
 ]
 build-backend = "py_build"
 backend-path = ["."]
@@ -32,14 +32,16 @@ classifiers = [
 dynamic = ["version"]
 
 dependencies = [
-	"snakeoil >= 0.11.5",
+	"snakeoil >= 0.11.6",
 	"lxml",
+	"py-landlock",
 ]
 
 [project.optional-dependencies]
 test = [
 	"pytest >= 9.0",
 	"pytest-cov",
+	"docutils >= 0.18",
 ]
 doc = [
 	"sphinx",

{pkgcore-0.12.41 → pkgcore-0.12.42}/src/pkgcore/__init__.py

@@ -1,4 +1,4 @@
 __title__ = "pkgcore"
-__version__ = "0.12.41"
-__version_info__ = (0, 12, 41)
+__version__ = "0.12.42"
+__version_info__ = (0, 12, 42)
 __python_mininum_version__ = (3, 12, 0)

pkgcore-0.12.42/src/pkgcore/_verinfo.py

@@ -0,0 +1 @@
+version_info={'rev': 'a91f7fd1dcc90999bec67269b4d63aea5c18d0d8', 'date': 'Sat Sep 05 12:37:16 2026', 'timestamp': 1788611836, 'tag': '0.12.42', 'commits': 0}

{pkgcore-0.12.41 → pkgcore-0.12.42}/src/pkgcore/ebuild/eclass.py

@@ -1,5 +1,6 @@
 """Eclass parsing support."""
 
+import logging
 import os
 import re
 import shlex
@@ -35,6 +36,11 @@ class AttrDict(ImmutableDict):
         return sorted(dir(self._dict) + list(self._dict))
 
 
+def _rst_escape(text):
+    """Escape reST inline markup in text that should render verbatim."""
+    return re.sub(r"([*`_|\\])", r"\\\1", text)
+
+
 def _rst_header(char, text, leading=False, newline=False):
     """Create rST header data from a given character and header text."""
     sep = char * len(text)
@@ -46,6 +52,46 @@ def _rst_header(char, text, leading=False, newline=False):
     return data
 
 
+_DEAD_NOTICE = (
+    ".. warning::",
+    "",
+    "   This eclass is dead: it is slated for removal from the tree and must",
+    "   not be inherited by any new ebuild or eclass.",
+    "",
+)
+
+
+class _DocutilsWarnings:
+    """Sink reporting docutils' diagnostics through pkgcore's logger."""
+
+    _levels: typing.ClassVar[dict] = {
+        "DEBUG": logging.DEBUG,
+        "INFO": logging.INFO,
+        "WARNING": logging.WARNING,
+        "ERROR": logging.ERROR,
+        "SEVERE": logging.CRITICAL,
+    }
+
+    def __init__(self):
+        self._diagnostic = re.compile(
+            r"(?P<source>.*?):(?P<line>\d*): \((?P<level>[A-Z]+)/\d\) (?P<msg>.*)",
+            re.DOTALL,
+        )
+
+    def write(self, data):
+        """Report one diagnostic; docutils writes each in a single call."""
+        if not (data := data.strip()):
+            return
+        if mo := self._diagnostic.fullmatch(data):
+            loc = mo.group("source")
+            if line := mo.group("line"):
+                loc += f", line {line}"
+            level = self._levels.get(mo.group("level"), logging.WARNING)
+            logger.log(level, f"{loc}: {mo.group('msg')}")
+        else:
+            logger.warning(data)
+
+
 class ParseEclassDoc:
     """Generic block for eclass docs.
 
@@ -221,9 +267,11 @@ class EclassBlock(ParseEclassDoc):
             "@VCSURL:": ("vcsurl", False, self._tag_inline_arg, None),
             "@BLURB:": ("blurb", True, self._tag_inline_arg, None),
             "@DEPRECATED:": ("deprecated", False, self._tag_deprecated, False),
+            "@DEAD": ("dead", False, self._tag_bool, False),
             "@PROVIDES:": ("raw_provides", False, self._tag_inline_list, ()),
             "@MAINTAINER:": ("maintainers", True, self._tag_multiline_args, None),
             "@AUTHOR:": ("authors", False, self._tag_multiline_args, None),
+            "@BUGREPORTS:": ("bugreports", False, self._tag_multiline_str, None),
             "@DESCRIPTION:": ("description", False, self._tag_multiline_str, None),
             "@EXAMPLE:": ("example", False, self._tag_multiline_str, None),
             "@SUPPORTED_EAPIS:": ("supported_eapis", False, self._supported_eapis, ()),
@@ -267,43 +315,14 @@ class EclassVarBlock(ParseEclassDoc):
     def parse(self, lines, line_ind, next_line):
         data = dict(super().parse(lines, line_ind, next_line))
         var_name = data["name"]
-        if mo := re.search(rf"{var_name}=(?P<value>.*)", next_line):
-            data["initial_value"] = mo.group("value")
-        if mo := re.search(rf": \${{{var_name}:?=(?P<value>.*)}}", next_line):
+        # Test : "${var=val}" first, since the second regex also matches it
+        if mo := re.search(rf": \"?\${{{var_name}:?=(?P<value>.*)}}", next_line):
             data["default_value"] = mo.group("value")
+        elif mo := re.search(rf"{var_name}=(?P<value>.*)", next_line):
+            data["initial_value"] = mo.group("value")
         return AttrDict(data)
 
 
-# For backwards compatibility, can be removed after 2022-12-31
-class EclassVarBlockCompat(ParseEclassDoc):
-    """ECLASS-VARIABLE doc block."""
-
-    tag = "@ECLASS-VARIABLE:"
-    key = "variables"
-    default = True
-
-    def __init__(self):
-        tags = {
-            "@ECLASS-VARIABLE:": ("name", True, self._eclass_variable, None),
-            "@DEPRECATED:": ("deprecated", False, self._tag_deprecated, False),
-            "@DEFAULT_UNSET": ("default_unset", False, self._tag_bool, False),
-            "@INTERNAL": ("internal", False, self._tag_bool, False),
-            "@REQUIRED": ("required", False, self._tag_bool, False),
-            "@PRE_INHERIT": ("pre_inherit", False, self._tag_bool, False),
-            "@USER_VARIABLE": ("user_variable", False, self._tag_bool, False),
-            "@OUTPUT_VARIABLE": ("output_variable", False, self._tag_bool, False),
-            "@DESCRIPTION:": ("description", True, self._tag_multiline_str, None),
-        }
-        super().__init__(tags)
-
-    def _eclass_variable(self, block, tag, lineno):
-        """Parse @ECLASS-VARIABLE tag."""
-        logger.warning(
-            f"{tag!r}, line {lineno}: deprecated, use '@ECLASS_VARIABLE' instead"
-        )
-        return self._tag_inline_arg(block, tag, lineno)
-
-
 class EclassFuncBlock(ParseEclassDoc):
     """FUNCTION doc block."""
 
@@ -357,6 +376,7 @@ class EclassFuncVarBlock(ParseEclassDoc):
             "@DEFAULT_UNSET": ("default_unset", False, self._tag_bool, False),
             "@INTERNAL": ("internal", False, self._tag_bool, False),
             "@REQUIRED": ("required", False, self._tag_bool, False),
+            "@USER_VARIABLE": ("user_variable", False, self._tag_bool, False),
             "@DESCRIPTION:": ("description", True, self._tag_multiline_str, None),
         }
         super().__init__(tags)
@@ -370,7 +390,7 @@ _eclass_blocks_re = re.compile(
 class EclassDoc(AttrDict):
     """Support parsing eclass docs for a given eclass path."""
 
-    ABI_VERSION = 5
+    ABI_VERSION = 6
 
     def __init__(self, path, /, *, sourced=False, repo=None):
         self.mtime = os.path.getmtime(path)
@@ -568,7 +588,7 @@ class EclassDoc(AttrDict):
 
         return data
 
-    def to_rst(self):
+    def to_rst(self, *, name_section=True):
         """Convert eclassdoc object to reStructuredText."""
         if self.name is None:
             raise ValueError("eclass lacking doc support")
@@ -576,9 +596,12 @@ class EclassDoc(AttrDict):
         _header_only = partial(_rst_header, newline=True)
 
         rst = _header_only("=", self.name, leading=True)
-        if self.blurb:
+        if self.dead:
+            rst.extend(_rst_header("-", "Dead"))
+            rst.extend(_DEAD_NOTICE)
+        if name_section and self.blurb:
             rst.extend(_rst_header("-", "Name"))
-            rst.append(f"``{self.name}`` -- {self.blurb}")
+            rst.append(f"``{self.name}`` — {self.blurb}")
             rst.append("")
 
         if self.description:
@@ -639,17 +662,17 @@ class EclassDoc(AttrDict):
                 vartype = ""
                 var_value = ""
                 if default_value := getattr(var, "default_value", None):
-                    var_value = f" ?= *{default_value}*"
+                    var_value = f" ?= *{_rst_escape(default_value)}*"
                 elif initial_value := getattr(var, "initial_value", None):
-                    var_value = f" = *{initial_value}*"
+                    var_value = f" = *{_rst_escape(initial_value)}*"
                 if var.required:
-                    vartype += " (REQUIRED)"
+                    vartype += " (required)"
                 if var.pre_inherit:
-                    vartype += " (SET BEFORE INHERIT)"
+                    vartype += " (set before inherit)"
                 if var.user_variable:
-                    vartype += " (USER VARIABLE)"
+                    vartype += " (user variable)"
                 if var.output_variable:
-                    vartype += " (GENERATED BY ECLASS)"
+                    vartype += " (generated by eclass)"
                 rst.append(f"**{var.name}**{var_value}{vartype}")
                 if var.description:
                     rst.append(
@@ -661,7 +684,9 @@ class EclassDoc(AttrDict):
             for var in external_func_vars:
                 vartype = ""
                 if var.required:
-                    vartype += " (REQUIRED)"
+                    vartype += " (required)"
+                if var.user_variable:
+                    vartype += " (user variable)"
 
                 rst.append(f"**{var.name}**{vartype}")
                 if var.description:
@@ -680,12 +705,15 @@ class EclassDoc(AttrDict):
             rst.append("")
 
         rst.extend(_rst_header("-", "Reporting Bugs"))
-        rst.append("Please report bugs via https://bugs.gentoo.org/")
+        if self.bugreports:
+            rst.append(self.bugreports)
+        else:
+            rst.append("Please report bugs via https://bugs.gentoo.org/")
         rst.append("")
 
         return "\n".join(rst)
 
-    def _to_docutils(self, writer):
+    def _to_docutils(self, writer, **kwargs):
         """Convert eclassdoc object using docutils."""
         from docutils import nodes
         from docutils.core import publish_string
@@ -716,11 +744,13 @@ class EclassDoc(AttrDict):
         writer.get_transforms = lambda: writer_transforms() + [RenderProblematicAsText]
 
         return publish_string(
-            source=self.to_rst(),
+            source=self.to_rst(**kwargs),
+            source_path=f"<{self.name}.rst>",
             writer=writer,
             settings_overrides={
                 "input_encoding": "unicode",
                 "output_encoding": "unicode",
+                "warning_stream": _DocutilsWarnings(),
             },
         )
 
@@ -750,10 +780,39 @@ class EclassDoc(AttrDict):
                 super().__init__(*args, **kwargs)
                 self._docinfo.update(man_data)
 
-        self.blurb = None  # skip addition of blurb as man page header already holds it
+            @staticmethod
+            def _is_bracketed(node):
+                """Check if the surrounding text already wraps the node in ``<>``."""
+                siblings = node.parent.children
+                idx = siblings.index(node)
+                before = siblings[idx - 1].astext()[-1:] if idx else ""
+                after = (
+                    siblings[idx + 1].astext()[:1] if idx + 1 < len(siblings) else ""
+                )
+                return before == "<" and after == ">"
+
+            def visit_reference(self, node):
+                # docutils pads bare URIs and emails with " <" and "> ", which
+                # duplicates the brackets eclass docs write around addresses
+                if "refuri" not in node:
+                    return
+                if node["refuri"].endswith(node.astext()) and not self._is_bracketed(
+                    node
+                ):
+                    self.body.append("<")
+
+            def depart_reference(self, node):
+                if "refuri" not in node:
+                    return
+                if not node["refuri"].endswith(node.astext()):
+                    self.body.append(f" <{node['refuri']}>")
+                elif not self._is_bracketed(node):
+                    self.body.append(">")
+
+        # the man page header already holds the blurb, skip the Name section
         writer = manpage.Writer()
         writer.translator_class = Translator
-        return self._to_docutils(writer)
+        return self._to_docutils(writer, name_section=False)
 
     def to_html(self):
         """Convert eclassdoc object to an HTML 5 document."""

pkgcore-0.12.42/src/pkgcore/landlock.py

@@ -0,0 +1,147 @@
+"""Self-confinement with the Linux Landlock LSM.
+
+Generating metadata means sourcing ebuilds with bash, which runs code out of the
+repo it came from with whatever access the invoking user has.  :py:func:`confine`
+takes away what that doesn't need: everything stays readable and executable, but
+writes are denied outside the paths the caller names, as is outgoing TCP.
+
+Restrictions cannot be lifted and are inherited by every thread and process
+started afterwards, so only call this from a command's main function, in a
+process meant to stay confined for the rest of its life.  In particular, never
+call it from library code whose caller carries on working once the ebuilds have
+been sourced.
+
+Landlock mediates TCP bind and connect only, leaving UDP, ICMP and unix sockets
+untouched, so this is not an exfiltration boundary.  Access through an already
+open descriptor is unaffected as well, since rights are checked when a path is
+resolved rather than on the descriptor.
+"""
+
+__all__ = ("confine", "writable_cache_paths")
+
+import os
+import tempfile
+from collections.abc import Iterator
+
+from .exceptions import PkgcoreUserException
+from .log import logger
+
+try:
+    from py_landlock import AccessFs, Landlock, LandlockError
+
+    # Rights granted on a writable directory and everything beneath it.  Fifos
+    # and sockets are included for the sake of the temp dir: bash falls back to
+    # a named pipe for process substitution when built without /dev/fd support,
+    # and multiprocessing uses a unix socket for non-fork start methods.
+    _DIR_RW = (
+        AccessFs.READ_FILE
+        | AccessFs.READ_DIR
+        | AccessFs.WRITE_FILE
+        | AccessFs.TRUNCATE
+        | AccessFs.MAKE_REG
+        | AccessFs.MAKE_DIR
+        | AccessFs.MAKE_SYM
+        | AccessFs.MAKE_FIFO
+        | AccessFs.MAKE_SOCK
+        | AccessFs.REMOVE_FILE
+        | AccessFs.REMOVE_DIR
+        | AccessFs.REFER
+        | AccessFs.EXECUTE
+    )
+    # Rights granted on a writable file.  Directory-only rights have to be left
+    # out: the kernel rejects the entire rule for a non-directory rather than
+    # ignoring the ones that don't apply.  Ioctls matter only for the device
+    # nodes below, and only for ones opened after the ruleset applies --
+    # inherited descriptors such as a terminal on stdin are never affected.
+    _FILE_RW = (
+        AccessFs.READ_FILE
+        | AccessFs.WRITE_FILE
+        | AccessFs.TRUNCATE
+        | AccessFs.IOCTL_DEV
+    )
+except ImportError:  # pragma: no cover
+    Landlock = None
+
+
+def _ebd_paths() -> Iterator[str]:
+    """Paths that sourcing an ebuild needs to be able to write, whatever else does."""
+    # The ebuild daemon is handed a minimal environment, so the bash sourcing
+    # ebuilds never sees a redirected TMPDIR and falls back to the system one.
+    # Here-documents too big for a pipe land there.
+    yield tempfile.gettempdir()
+    # opened read-write by subprocess.DEVNULL, among others
+    yield os.devnull
+    # where sandbox(1) reports access violations; losing them would hide the
+    # very misbehaviour worth knowing about, and the inherited output
+    # descriptors already point at the same terminal
+    yield "/dev/tty"
+
+
+def writable_cache_paths(*repos) -> Iterator[str]:
+    """Cache locations pkgcore may write while generating metadata for *repos*.
+
+    Repos whose cache is already read-only are skipped, so passing every repo
+    involved in a run grants no more than pkgcore would have written anyway.
+    """
+    for repo in repos:
+        for cache in getattr(repo, "cache", ()):
+            if cache.readonly:
+                continue
+            # pkgcore creates a missing cache dir on demand and decides
+            # writability from the closest existing parent, so grant that
+            path = cache.location
+            while not os.path.exists(path):
+                if (parent := os.path.dirname(path)) == path:
+                    break
+                path = parent
+            yield path
+
+
+def _unavailable(required: bool, msg: str) -> bool:
+    """Fail or note that confinement couldn't be set up."""
+    if required:
+        raise PkgcoreUserException(f"sandbox unavailable: {msg}")
+    logger.debug("skipping landlock confinement: %s", msg)
+    return False
+
+
+def confine(*writable: str, allow_net: bool = False, required: bool = False) -> bool:
+    """Deny writes outside *writable*, and outgoing TCP unless *allow_net*.
+
+    The paths sourcing an ebuild needs are always granted on top of *writable*.
+    A path that doesn't exist is skipped, and rights the kernel won't accept for
+    a non-directory are dropped rather than failing the whole rule.
+
+    :param required: raise rather than carry on unconfined when landlock is
+        unavailable, too old, or disabled at boot.
+    :raises PkgcoreUserException: if *required* and the restrictions couldn't be
+        applied.
+    :return: whether the restrictions were applied.
+    """
+    if Landlock is None:
+        return _unavailable(required, "py-landlock is not installed")
+
+    try:
+        sandbox = Landlock(strict=False)
+        # scoping signals and abstract sockets isn't what this is for
+        sandbox.allow_all_scope()
+        if allow_net:
+            sandbox.allow_all_network()
+        # the whole filesystem stays readable and executable; this only takes
+        # away the ability to write to it
+        sandbox.add_path_rule(
+            "/", access=AccessFs.READ_FILE | AccessFs.READ_DIR | AccessFs.EXECUTE
+        )
+        for path in (*writable, *_ebd_paths()):
+            if os.path.isdir(path):
+                sandbox.add_path_rule(path, access=_DIR_RW)
+            elif os.path.exists(path):
+                sandbox.add_path_rule(path, access=_FILE_RW)
+            else:
+                logger.debug("landlock: no such path, skipping: %r", path)
+        sandbox.apply()
+    except (LandlockError, OSError) as e:
+        return _unavailable(required, str(e))
+
+    logger.debug("landlock confinement applied, ABI %s", sandbox.abi_version)
+    return True

{pkgcore-0.12.41 → pkgcore-0.12.42}/src/pkgcore/resolver/plan.py

@@ -110,7 +110,7 @@ def lowest_iter_sort(l, pkg_grabber=pkg_grabber):
     return l
 
 
-class MutableContainmentRestriction(values.base):
+class MutableContainmentRestriction(values.base, caching=False):
     __slots__ = ("_blacklist", "match")
 
     def __init__(self, blacklist):