pkgcore 0.12.43__tar.gz → 0.12.44__tar.gz

{pkgcore-0.12.43 → pkgcore-0.12.44}/NEWS.rst

@@ -2,6 +2,39 @@
 Release Notes
 =============
 
+----------------------------
+pkgcore 0.12.44 (2029-09-26)
+----------------------------
+
+Features
+~~~~~~~~
+
+- ``--sandbox`` is now shared machinery rather than something ``pmaint regen``
+  owns, so any command that sources ebuilds can offer it (Arthur Zamarin)
+
+- ``pquery`` now confines itself while querying with landlock (Arthur Zamarin)
+
+- ``pinspect``: the usage reports and ``digests`` now confine themselves with
+  landlock (Arthur Zamarin)
+
+- ``pmaint eclass`` now confines itself with landlock (Arthur Zamarin)
+
+- ``pmaint copy`` now confines itself with landlock (Arthur Zamarin)
+
+- ``pmaint sync --import`` adds a repo from Gentoo's published repository list
+  and syncs it, so a new overlay no longer needs a hand-written repos.conf
+  entry first (Arthur Zamarin)
+
+- ``pmaint sync --import-masters`` does the same for everything a repo inherits
+  from, following masters of masters (Arthur Zamarin)
+
+Fixes
+~~~~~
+
+- landlock: shut down ebuild daemons started before the restrictions go on.
+  Landlock only reaches processes started afterwards, so one left over from
+  earlier kept the access it was spawned with (Arthur Zamarin)
+
 ----------------------------
 pkgcore 0.12.43 (2029-09-12)
 ----------------------------

{pkgcore-0.12.43 → pkgcore-0.12.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pkgcore
-Version: 0.12.43
+Version: 0.12.44
 Summary: package managing framework
 Author-email: Michał Górny <mgorny@gentoo.org>, Tim Harder <radhermit@gmail.com>, Brian Harring <ferringb@gmail.com>, Arthur Zamarin <arthurzam@gentoo.org>, Marien Zwart <marienz@gentoo.org>
 Maintainer-email: Arthur Zamarin <arthurzam@gentoo.org>

{pkgcore-0.12.43 → pkgcore-0.12.44}/build/sphinx/man/patom.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PATOM" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PATOM" "1" "Sep 26, 2026" "0.12.44" "pkgcore"
 .SH NAME
 patom \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.44}/build/sphinx/man/pclean.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PCLEAN" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PCLEAN" "1" "Sep 26, 2026" "0.12.44" "pkgcore"
 .SH NAME
 pclean \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.44}/build/sphinx/man/pclonecache.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PCLONECACHE" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PCLONECACHE" "1" "Sep 26, 2026" "0.12.44" "pkgcore"
 .SH NAME
 pclonecache \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.44}/build/sphinx/man/pconfig.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PCONFIG" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PCONFIG" "1" "Sep 26, 2026" "0.12.44" "pkgcore"
 .SH NAME
 pconfig \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.44}/build/sphinx/man/pebuild.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PEBUILD" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PEBUILD" "1" "Sep 26, 2026" "0.12.44" "pkgcore"
 .SH NAME
 pebuild \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.44}/build/sphinx/man/pinspect.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PINSPECT" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PINSPECT" "1" "Sep 26, 2026" "0.12.44" "pkgcore"
 .SH NAME
 pinspect \- Wrapper for running commandline scripts.
 .SH SYNOPSIS
@@ -168,7 +168,7 @@ where stdout is not a tty.
 .EX
 pinspect eapi_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                     [\-\-no\-final\-summary] [\-\-sort\-by\-name]
-                    [\-\-first FIRST | \-\-last LAST]
+                    [\-\-first FIRST | \-\-last LAST] [\-\-sandbox BOOLEAN]
                     [repo ...]
 .EE
 .UNINDENT
@@ -200,6 +200,15 @@ show only the first N detail items
 .B \-\-last LAST
 show only the last N detail items
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -238,6 +247,7 @@ where stdout is not a tty.
 pinspect license_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                        [\-\-no\-final\-summary] [\-\-sort\-by\-name]
                        [\-\-first FIRST | \-\-last LAST]
+                       [\-\-sandbox BOOLEAN]
                        [repo ...]
 .EE
 .UNINDENT
@@ -269,6 +279,15 @@ show only the first N detail items
 .B \-\-last LAST
 show only the last N detail items
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -307,6 +326,7 @@ where stdout is not a tty.
 pinspect eclass_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                       [\-\-no\-final\-summary] [\-\-sort\-by\-name]
                       [\-\-first FIRST | \-\-last LAST]
+                      [\-\-sandbox BOOLEAN]
                       [repo ...]
 .EE
 .UNINDENT
@@ -338,6 +358,15 @@ show only the first N detail items
 .B \-\-last LAST
 show only the last N detail items
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -376,6 +405,7 @@ where stdout is not a tty.
 pinspect mirror_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                       [\-\-no\-final\-summary] [\-\-sort\-by\-name]
                       [\-\-first FIRST | \-\-last LAST]
+                      [\-\-sandbox BOOLEAN]
                       [repo ...]
 .EE
 .UNINDENT
@@ -407,6 +437,15 @@ show only the first N detail items
 .B \-\-last LAST
 show only the last N detail items
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -446,7 +485,7 @@ pinspect distfiles_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                          [\-\-no\-final\-summary | \-\-no\-repo\-summary |
                          \-\-no\-detail] [\-\-sort\-by\-name]
                          [\-\-first FIRST | \-\-last LAST]
-                         [\-\-include\-nonmirrored]
+                         [\-\-sandbox BOOLEAN] [\-\-include\-nonmirrored]
                          [\-\-include\-restricted]
                          [repo ...]
 .EE
@@ -491,6 +530,15 @@ show only the last N detail items
 .UNINDENT
 .INDENT 0.0
 .TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B \-\-include\-nonmirrored
 if set, nonmirrored  distfiles will be included in the total
 .UNINDENT
@@ -2739,7 +2787,7 @@ where stdout is not a tty.
 .sp
 .EX
 pinspect digests [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
-                 [\-\-domain DOMAIN]
+                 [\-\-domain DOMAIN] [\-\-sandbox BOOLEAN]
                  [repos ...]
 .EE
 .UNINDENT
@@ -2750,6 +2798,16 @@ pinspect digests [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
 .B repos
 repo to inspect
 .UNINDENT
+.SS Options
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP

{pkgcore-0.12.43 → pkgcore-0.12.44}/build/sphinx/man/pmaint.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PMAINT" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PMAINT" "1" "Sep 26, 2026" "0.12.44" "pkgcore"
 .SH NAME
 pmaint \- Wrapper for running commandline scripts.
 .SH SYNOPSIS
@@ -100,7 +100,9 @@ general system maintenance
 .INDENT 3.5
 .sp
 .EX
-pmaint sync [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN] [\-f] [repo ...]
+pmaint sync [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN] [\-f]
+            [\-\-import REPO] [\-\-import\-masters PATH]
+            [repo ...]
 .EE
 .UNINDENT
 .UNINDENT
@@ -116,6 +118,35 @@ repo(s) to sync
 .B \-f, \-\-force
 force syncing to occur regardless of staleness checks
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-import REPO
+Look a repository up by name in Gentoo\(aqs published repository list,
+write a \fBrepos.conf\fP entry for it, and sync it. Pass the option
+again to add more than one repo.
+.sp
+New repos land beside the repos already being synced, which is
+\fB/var/db/repos\fP on an ordinary install, and get a file of their own
+when \fBrepos.conf\fP is a directory. The list is fetched from
+\%<https://\:api\:.gentoo\:.org/\:overlays/\:repositories\:.xml> and cached locally.
+.sp
+A repo that\(aqs already configured is simply synced, so an import can be
+repeated without failing.
+.sp
+Importing leaves the rest of the configured repos alone; name them as
+arguments to sync those as well.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-import\-masters PATH
+Read the masters of the repo at the given path, add the ones that
+aren\(aqt configured yet, and sync them all.
+.sp
+Masters of masters are followed as each repo is synced and its own
+\fBlayout.conf\fP becomes readable, so the repo ends up with everything
+it inherits from present and current. That makes it the one command a
+CI run needs before checking a repo it doesn\(aqt own the parents of.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -153,6 +184,7 @@ where stdout is not a tty.
 .EX
 pmaint copy [\-\-domain DOMAIN] [\-h] [\-\-debug] [\-q] [\-v]
             [\-\-color BOOLEAN] [\-s SOURCE_REPO] [\-i]
+            [\-\-sandbox BOOLEAN]
             target_repo query [query ...]
 .EE
 .UNINDENT
@@ -214,6 +246,15 @@ copy strictly from the supplied repository; else it copies from wherever a match
 .B \-i, \-\-ignore\-existing
 if a matching pkg already exists in the target, don\(aqt update it
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS pmaint regen \- regenerate repository caches
 .SS Synopsis
 .INDENT 0.0
@@ -301,10 +342,11 @@ use separate directory to store repository caches
 .INDENT 0.0
 .TP
 .B \-\-sandbox BOOLEAN
-Confine the run with Landlock where the kernel supports it: writes are
-limited to the caches being regenerated, and outgoing TCP is denied.
-Enabled by default; \(aqy\(aq turns an unsupported kernel into an error
-instead of continuing unconfined, and \(aqn\(aq disables it.
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -380,8 +422,8 @@ do not update etc/ldso.conf and ld.so.cache
 .sp
 .EX
 pmaint eclass [\-\-domain DOMAIN] [\-h] [\-\-debug] [\-q] [\-v]
-              [\-\-color BOOLEAN] [\-\-dir OUTPUT_DIR] [\-o OUTPUT_FORMAT]
-              [\-f {rst,man,html,devbook}] [\-r REPO]
+              [\-\-color BOOLEAN] [\-\-dir OUTPUT_DIR] [\-\-sandbox BOOLEAN]
+              [\-o OUTPUT_FORMAT] [\-f {rst,man,html,devbook}] [\-r REPO]
               [eclasses ...]
 .EE
 .UNINDENT
@@ -435,6 +477,15 @@ output directory
 .UNINDENT
 .INDENT 0.0
 .TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B \-o, \-\-output OUTPUT_FORMAT
 Output file name format. Defaults to \fB{eclass}.eclass.{format}\fP\&. You
 can use \fB{eclass}\fP and \fB{format}\fP placeholders to customize the

{pkgcore-0.12.43 → pkgcore-0.12.44}/build/sphinx/man/pmerge.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PMERGE" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PMERGE" "1" "Sep 26, 2026" "0.12.44" "pkgcore"
 .SH NAME
 pmerge \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.44}/build/sphinx/man/pquery.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PQUERY" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PQUERY" "1" "Sep 26, 2026" "0.12.44" "pkgcore"
 .SH NAME
 pquery \- Wrapper for running commandline scripts.
 .SH SYNOPSIS
@@ -37,11 +37,11 @@ pquery \- Wrapper for running commandline scripts.
 .sp
 .EX
 pquery [\-h] [\-\-version] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
-       [\-\-config CONFIG_PATH] [\-\-domain DOMAIN] [\-\-raw] [\-\-unfiltered]
-       [\-\-virtuals {only,disable}] [\-r REPO | \-E | \-B | \-I | \-A]
-       [\-\-all] [\-\-has\-use has_use] [\-\-license license] [\-\-live]
-       [\-\-non\-live] [\-\-revdep REVDEP] [\-\-revdep\-pkgs REVDEP_PKGS]
-       [\-\-restrict\-revdep restrict_revdep]
+       [\-\-config CONFIG_PATH] [\-\-domain DOMAIN] [\-\-sandbox BOOLEAN]
+       [\-\-raw] [\-\-unfiltered] [\-\-virtuals {only,disable}] [\-r REPO |
+       \-E | \-B | \-I | \-A] [\-\-all] [\-\-has\-use has_use]
+       [\-\-license license] [\-\-live] [\-\-non\-live] [\-\-revdep REVDEP]
+       [\-\-revdep\-pkgs REVDEP_PKGS] [\-\-restrict\-revdep restrict_revdep]
        [\-\-restrict\-revdep\-pkgs restrict_revdep_pkgs] [\-S description]
        [\-\-eapi eapi] [\-\-owns owns] [\-\-owns\-re owns_re]
        [\-\-maintainer maintainer] [\-\-maintainer\-name maintainer_name]
@@ -69,6 +69,16 @@ repo selection options are almost completely separate from the
 restriction options. The only exception to that is that restrictions on
 contents automatically select the vdb (installed packages) repo, since
 running them on source repos makes no sense.
+.SH OPTIONS
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SH BASE OPTIONS
 .INDENT 0.0
 .TP

{pkgcore-0.12.43 → pkgcore-0.12.44}/src/pkgcore/__init__.py

@@ -1,4 +1,4 @@
 __title__ = "pkgcore"
-__version__ = "0.12.43"
-__version_info__ = (0, 12, 43)
+__version__ = "0.12.44"
+__version_info__ = (0, 12, 44)
 __python_mininum_version__ = (3, 12, 0)

pkgcore-0.12.44/src/pkgcore/_verinfo.py

@@ -0,0 +1 @@
+version_info={'rev': 'be9c8f7aa79d3b08e56a9654dcc3955fde85ba88', 'date': 'Sat Sep 26 17:46:26 2026', 'timestamp': 1790444786, 'tag': '0.12.44', 'commits': 0}

pkgcore-0.12.44/src/pkgcore/ebuild/overlays.py

@@ -0,0 +1,219 @@
+"""Support for Gentoo's published list of ebuild repositories.
+
+``repositories.xml`` maps a repository name to the URIs it can be synced from.
+This module fetches and caches that list, and writes repos.conf entries for the
+repos picked out of it, which is what ``pmaint sync --import`` is built on.
+"""
+
+__all__ = (
+    "FALLBACK_REPOS_BASE",
+    "RemoteRepo",
+    "RemoteRepoError",
+    "add_repos_conf_entry",
+    "configured_repos",
+    "remote_repos",
+    "repo_masters",
+    "repos_base",
+)
+
+import configparser
+import os
+import urllib.error
+import urllib.request
+from collections import Counter
+from dataclasses import dataclass
+from email.utils import formatdate
+from os.path import join as pjoin
+
+from lxml import etree
+from snakeoil.fileutils import AtomicWriteFile, readfile_ascii
+
+from .. import const
+from ..exceptions import PkgcoreUserException
+from ..fs.livefs import sorted_scan
+from ..log import logger
+from .portage_conf import ParseConfig
+from .repo_objs import RepoConfig
+
+REPOSITORIES_XML_URI = "https://api.gentoo.org/overlays/repositories.xml"
+# where new repos go when the config gives nothing better to go on
+FALLBACK_REPOS_BASE = "/var/db/repos"
+
+# repositories.xml source types mapped onto the syncer that handles them; types
+# missing here have no pkgcore syncer to drive them.
+_SYNC_TYPES = {
+    "bzr": "bzr",
+    "git": "git",
+    "mercurial": "hg",
+    "rsync": "rsync",
+    "svn": "svn",
+}
+
+
+class RemoteRepoError(PkgcoreUserException):
+    """Failure while using the remote repository list."""
+
+
+@dataclass(slots=True, frozen=True)
+class RemoteRepo:
+    """A repository as described by the remote list."""
+
+    name: str
+    homepage: str
+    # (sync-type, sync-uri) pairs in the order the list gives them, which is
+    # the order upstream prefers them in
+    sources: tuple[tuple[str, str], ...]
+
+
+def _cache_path() -> str:
+    # the user cache even when running as root, since that's where pkgcore's
+    # own stub config keeps repos and what CI images cache between runs
+    return pjoin(const.USER_CACHE_PATH, "repositories.xml")
+
+
+def _fetch(uri: str, dest: str) -> None:
+    """Refresh the cached copy of the repository list."""
+    headers = {}
+    etag_path = dest + ".etag"
+    try:
+        mtime = os.stat(dest).st_mtime
+    except FileNotFoundError:
+        cached = False
+    else:
+        cached = True
+        headers["If-Modified-Since"] = formatdate(mtime, usegmt=True)
+        if etag := readfile_ascii(etag_path, none_on_missing=True):
+            headers["If-None-Match"] = etag.strip()
+
+    req = urllib.request.Request(uri, headers=headers, method="GET")
+    try:
+        with urllib.request.urlopen(req) as resp:
+            data = resp.read()
+            etag = resp.getheader("ETag")
+    except urllib.error.URLError as e:
+        if getattr(e, "code", None) == 304:  # not modified
+            logger.debug("repository list is unchanged")
+            return
+        if not cached:
+            raise RemoteRepoError(f"failed fetching {uri!r}: {e.reason}") from e
+        logger.warning("failed fetching %r: %s; using cached copy", uri, e.reason)
+        return
+
+    try:
+        os.makedirs(os.path.dirname(dest), exist_ok=True)
+        with AtomicWriteFile(dest, binary=True, perms=0o644) as f:
+            f.write(data)
+        if etag:
+            with AtomicWriteFile(etag_path, perms=0o644) as f:
+                f.write(etag.strip())
+    except OSError as e:
+        raise RemoteRepoError(f"failed caching {dest!r}: {e.strerror}") from e
+
+
+def remote_repos() -> dict[str, RemoteRepo]:
+    """Every repo in the remote list, keyed by name."""
+    path = _cache_path()
+    _fetch(REPOSITORIES_XML_URI, path)
+
+    try:
+        root = etree.parse(path).getroot()
+    except (OSError, etree.XMLSyntaxError) as e:
+        raise RemoteRepoError(f"failed parsing {path!r}: {e}") from e
+
+    return {
+        name: RemoteRepo(
+            name=name,
+            homepage=(el.findtext("homepage") or "").strip(),
+            sources=tuple(
+                (sync_type, uri)
+                for source in el.findall("source")
+                if (sync_type := _SYNC_TYPES.get(source.get("type")))
+                and (uri := (source.text or "").strip())
+            ),
+        )
+        for el in root.findall("repo")
+        if (name := (el.findtext("name") or "").strip())
+    }
+
+
+def configured_repos(path: str) -> dict[str, dict[str, str]]:
+    """Every repo declared under a repos.conf path, keyed by name.
+
+    Locations are resolved the way :py:class:`PortageConfig` resolves them, so
+    that they can be compared against one another.
+    """
+    parser = ParseConfig()
+    repos: dict[str, dict[str, str]] = {}
+    for fp in sorted_scan(
+        os.path.realpath(path), follow_symlinks=True, hidden=False, backup=False
+    ):
+        try:
+            with open(fp) as f:
+                _defaults, sections = parser.parse_file(f)
+        except (OSError, configparser.Error) as e:
+            raise RemoteRepoError(f"failed parsing {fp!r}: {e}") from e
+        for name, settings in sections.items():
+            if location := settings.get("location"):
+                location = os.path.expanduser(location)
+                if not os.path.isabs(location):
+                    # relative paths are based on where repos.conf is located
+                    location = os.path.abspath(pjoin(os.path.dirname(path), location))
+                settings["location"] = location
+            repos[name] = settings
+    return repos
+
+
+def repo_masters(location: str) -> tuple[str, ...]:
+    """Repos that the one at a given location inherits from."""
+    return RepoConfig(location).masters
+
+
+def repos_base(configured: dict[str, dict[str, str]]) -> str:
+    """Where a new repo belongs, going by the repos already being synced.
+
+    That's /var/db/repos on an ordinary install, but pkgcore's stub config keeps
+    repos under the user cache instead, and an import should follow whichever is
+    in use rather than scatter repos across both.
+    """
+    dirs = Counter(
+        os.path.dirname(settings["location"])
+        for settings in configured.values()
+        if settings.get("location") and settings.get("sync-uri")
+    )
+    if common := dirs.most_common(1):
+        return common[0][0]
+    return FALLBACK_REPOS_BASE
+
+
+def add_repos_conf_entry(
+    path: str, name: str, location: str, sync_type: str, sync_uri: str
+) -> str:
+    """Declare a repo under a repos.conf path, returning the file written to.
+
+    A repos.conf directory gets a file per repo so that dropping the repo later
+    is a matter of dropping its file.
+    """
+    entry = (
+        f"[{name}]\n"
+        f"location = {location}\n"
+        f"sync-type = {sync_type}\n"
+        f"sync-uri = {sync_uri}\n"
+    )
+    try:
+        if os.path.isfile(path):
+            dest = path
+            # keep the new section off the tail of the previous one
+            with open(dest) as f:
+                separator = "" if f.read().endswith("\n\n") else "\n"
+            with open(dest, "a") as f:
+                f.write(separator + entry)
+        else:
+            os.makedirs(path, exist_ok=True)
+            dest = pjoin(path, f"{name}.conf")
+            with AtomicWriteFile(dest, perms=0o644) as f:
+                f.write(entry)
+    except OSError as e:
+        raise RemoteRepoError(
+            f"failed writing {name!r} to {path!r}: {e.strerror}"
+        ) from e
+    return dest