pkgcore 0.12.43__tar.gz → 0.12.45__tar.gz

{pkgcore-0.12.43 → pkgcore-0.12.45}/NEWS.rst

@@ -2,6 +2,293 @@
 Release Notes
 =============
 
+----------------------------
+pkgcore 0.12.45 (2026-10-03)
+----------------------------
+
+Fixes
+~~~~~
+
+- resolver: resolve a package's IDEPEND instead of resolving its PDEPEND
+  twice (Arthur Zamarin)
+
+- resolver: when a candidate fails to insert, check the next one against its
+  own dependencies rather than the previous candidate's (Arthur Zamarin)
+
+- binpkg: installing or replacing from a binpkg repo no longer fails with a
+  TypeError (Arthur Zamarin)
+
+- unmerging a package with files matching ``UNINSTALL_IGNORE`` no longer
+  crashes (Arthur Zamarin)
+
+- fetch: a download that succeeds on the last allowed attempt is no longer
+  reported as failed, so ``attempts=1`` works (Arthur Zamarin)
+
+- GPG signed Manifests can be read again (Arthur Zamarin)
+
+- ebd: a sandbox violation shows its access summary again instead of hanging
+  the build (Arthur Zamarin)
+
+- ebd: ``nonfatal`` works again for ``newins`` and the other ``new*`` helpers
+  (Arthur Zamarin)
+
+- ebd: a failed ``nonfatal doins`` (and other install helpers) no longer breaks
+  every later call in the same phase (Arthur Zamarin)
+
+- ebd: ``eapply_user`` no longer reuses the options of the last ``eapply``
+  call, such as ``-p0`` (Arthur Zamarin)
+
+- EAPI 9: ``ver_replacing`` can be called (Arthur Zamarin)
+
+- profiles can be looked up by absolute path, which also fixes
+  ``pkgcheck --profiles /path/to/profile`` (Arthur Zamarin)
+
+- ``ACCEPT_KEYWORDS`` wildcards (``*``, ``~*`` and ``**``) work without any
+  package.accept_keywords entries (Arthur Zamarin)
+
+- USE is now stacked in portage's order: make.conf USE, including ``-*`` and
+  USE_EXPAND variables such as ``VIDEO_CARDS``, overrides the profile's
+  package.use, and ``USE`` from the environment overrides package.use
+  (Arthur Zamarin)
+
+- ebd: environments saved by pkgcore or portage are filtered again before
+  the ``pkg_*`` phases load them, so stale internal variables no longer leak
+  in (Arthur Zamarin)
+
+- an unquoted ``EAPI=8 # comment`` line is accepted again (Arthur Zamarin)
+
+- binpkgs containing device nodes can be read (Arthur Zamarin)
+
+- vdb: installing a package that has no ebuild no longer crashes and leaves a
+  half-written entry behind (Arthur Zamarin)
+
+- ebd: ``eapply`` on a directory applies only the patches directly inside it,
+  as PMS says, instead of descending into subdirectories (Arthur Zamarin)
+
+- with ``XDG_CONFIG_HOME``, ``XDG_CACHE_HOME`` or ``XDG_DATA_HOME`` set, pkgcore
+  now uses a ``pkgcore`` subdirectory of it, as it does for the defaults. A
+  config at ``$XDG_CONFIG_HOME/pkgcore.conf`` has to move to
+  ``$XDG_CONFIG_HOME/pkgcore/pkgcore.conf`` (Arthur Zamarin)
+
+- rsync sync: the timestamp check uses the repo's ssh, proxy and rsync
+  settings, and a failed check falls back to a full sync instead of aborting
+  (Arthur Zamarin)
+
+- a malformed line in ``use.desc``, ``use.local.desc`` or ``desc/*.desc`` is
+  logged and skipped instead of making every USE description unavailable
+  (Arthur Zamarin)
+
+- ``FEATURES=unmerge-backup`` saves a binpkg of the package being removed again
+  (Arthur Zamarin)
+
+- ``pkgcore.bugzilla``: searching an empty list of bug ids or packages
+  returns nothing instead of every bug on the server (Arthur Zamarin)
+
+- ``pkgcore.bugzilla``: ``limit`` and ``offset`` apply to a whole search even
+  when a long one is split into several requests, rather than to each request
+  (Arthur Zamarin)
+
+- ``pkgcore.bugzilla``: a 429 response is retried whatever its body
+  (Arthur Zamarin)
+
+- ``pkgcore.bugzilla``: a connection reset while reading the response is
+  retried and raised as ``BugzillaConnectionError``, instead of escaping as a
+  bare ``OSError`` (Arthur Zamarin)
+
+- ``pkgcore.bugzilla``: redirects are refused with a caller supplied opener
+  too, so the api key isn't sent on to another host (Arthur Zamarin)
+
+- ``pkgcore.bugzilla.ListChange``: combining a ``setting()`` with adds or
+  removes keeps it a set of the resulting list, instead of dropping the set
+  (Arthur Zamarin)
+
+- ``pkgcore.bugzilla.BugUpdate``: an update that clears a field, such as
+  ``whiteboard=""``, is no longer falsy (Arthur Zamarin)
+
+- ``--api-key`` is stripped, and a blank one falls back to the environment and
+  dotfiles like an unset one, instead of being sent as the key (Arthur Zamarin)
+
+- a configured binpkg repo passes install, uninstall and replace through to the
+  underlying repo again (Arthur Zamarin)
+
+- looking a repo up by path no longer matches a sibling whose name starts the
+  same, such as ``gentoo-extra`` for ``gentoo`` (Arthur Zamarin)
+
+- ``bugzilla_cassette`` fixture: a test that fails no longer gets an extra
+  "unused recordings" error on top (Arthur Zamarin)
+
+- ``pinspect profile status`` and ``pinspect query get_profiles`` work again
+  (Arthur Zamarin)
+
+- cvs sync: the first checkout names the module to check out (Arthur Zamarin)
+
+- rsync sync: ``metadata/timestamp.chk`` is read as UTC with its offset, rather
+  than as local time, so the "is the tree new enough" check isn't skewed by the
+  local timezone (Arthur Zamarin)
+
+- libtool archive fixing no longer rewrites every ``.la`` file that has an
+  ``inherited_linker_flags`` entry, and moves thread flags into that entry
+  when present, as portage does (Arthur Zamarin)
+
+- an unknown ``profile-formats`` entry no longer adds ``pms`` next to the known
+  ones, so ``portage-2`` repos with an extra format keep directory support
+  (Arthur Zamarin)
+
+- the bash version an EAPI needs is compared numerically, so bash 5.10 won't
+  disable EAPI 9, and a bash that can't be queried no longer fails the import
+  (Arthur Zamarin)
+
+- http, tar and sqfs sync: a DNS or connection failure is reported as a sync
+  error instead of crashing with ``AttributeError`` (Arthur Zamarin)
+
+- a failed fetch through package operations created without an observer
+  reports the fetch failure instead of crashing with ``AttributeError``
+  (Arthur Zamarin)
+
+- the unsafe world writable SetUID/SetGID warning names the right bit, and a
+  world writable setgid directory is left alone, as portage does
+  (Arthur Zamarin)
+
+- ebd: shutting down a daemon that stopped answering kills it instead of
+  hanging forever, as on Ctrl-C during a phase (Arthur Zamarin)
+
+- ebd: a multi-line error from a ``nonfatal`` helper, such as ``install``'s
+  stderr, no longer leaves stray lines that confuse the next helper call
+  (Arthur Zamarin)
+
+- config: a native int given to an int typed setting, as from Python built
+  config sections, is accepted instead of failing to convert (Arthur Zamarin)
+
+- ``pconfig dump`` and ``pconfig dump-uncollapsed`` show int settings
+  (Arthur Zamarin)
+
+- ``pmaint eclass <dir>`` reads the eclasses from that directory rather than
+  the current one (Arthur Zamarin)
+
+- incremental settings from ``/etc/profile.env``, such as ``CONFIG_PROTECT_MASK``,
+  are kept even when the profile doesn't set them (Arthur Zamarin)
+
+- a bad ``parent`` entry in a profile outside a repo, such as a stale
+  ``/etc/portage/make.profile`` directory, is logged instead of crashing with
+  ``AttributeError`` (Arthur Zamarin)
+
+- ebd: ``doman -i18n=<lang>`` installs into that language's man directory
+  instead of failing (Arthur Zamarin)
+
+- merging a symlink over an existing directory resolves the link's target from
+  the link's own directory, and an absolute target under ``ROOT``, rather than
+  checking the wrong path or the host system (Arthur Zamarin)
+
+- ``pmerge -x`` and ``--pdb-intercept`` given more than once keep every value,
+  not only the last one (Arthur Zamarin)
+
+- ``pclean`` removes files even when its output is redirected, as from cron;
+  only ``--pretend`` lists them, one bare path per line when redirected
+  (Arthur Zamarin)
+
+- ``restrictions``: the DNF solutions of a negated ``OrRestriction`` are only
+  the negated terms, without the original ones after them (Arthur Zamarin)
+
+- ``pkgcore.pkgsets.glsa``: an unaffected glob range such as ``1.5*`` no longer
+  marks the vulnerable versions safe and the fixed ones vulnerable, and glob and
+  ``-r0`` revision ranges respect the GLSA's slot (Arthur Zamarin)
+
+- ``pkgcore.pkgsets.glsa``: a GLSA range with a subslot, such as
+  ``slot="0/esr78"``, matches that slot and subslot instead of nothing, and
+  ``slot="*"`` matches any slot (Arthur Zamarin)
+
+- ``pkgcore.ebuild.atom``: an ``=*`` glob only matches up to a version
+  component boundary, so ``=cat/pkg-1*`` no longer matches ``cat/pkg-10``, as
+  in Portage; GLSA glob ranges follow the same rule (Arthur Zamarin)
+
+- ``pkgcore.ebuild.ebd_ipc``: ``dosym`` checks for a directory target in the
+  image instead of on the host, and ``dohard`` links a file from the image
+  instead of the host's copy (Arthur Zamarin)
+
+- ``pkgcore.ebuild.processor``: environment values containing both a quote and
+  a backslash, such as ``it's C:\new``, reach the ebuild unchanged instead of
+  with the backslash sequences expanded (Arthur Zamarin)
+
+- ``pkgcore.ebuild.ebd_ipc``: ``doins`` given only directories without ``-r``
+  fails instead of installing nothing and succeeding, as in Portage
+  (Arthur Zamarin)
+
+- ``pkgcore.ebuild.conditionals``: merging a package with ``:=`` deps that
+  aren't all installed, such as ``|| ( a:= b:= )``, no longer crashes; the
+  unmatched atoms are recorded as written, as in Portage. Recording the slots
+  also no longer changes the same atoms elsewhere in the process
+  (Arthur Zamarin)
+
+- ``pkgcore.ebuild.portageq``: ``pinspect query mass_best_version`` and its
+  ``pinspect portageq`` form print each best version instead of failing with a
+  TypeError (Arthur Zamarin)
+
+- ``pkgcore.merge.triggers.BinaryDebug``: configured extra strip flags are
+  passed once per binary instead of piling up with each one stripped
+  (Arthur Zamarin)
+
+- ``pkgcore.config.basics``: an inline config section of the wrong type is
+  reported as such instead of failing with an ``AttributeError``
+  (Arthur Zamarin)
+
+- ``pquery -`` and ``patom -F FORMAT -`` skip blank lines read from stdin
+  instead of rejecting them as invalid atoms (Arthur Zamarin)
+
+- ``pquery -1`` stops at the first match instead of printing one per repo
+  (Arthur Zamarin)
+
+- ``pkgcore.fs.fs.get_major_minor``: device files with a major or minor number
+  above 255, such as NVMe disks, get their real numbers instead of truncated
+  ones (Arthur Zamarin)
+
+- ``pkgcore.util.commandline.StoreRepoObject``: ``-r``/``--repo`` looks up
+  repos in the domain chosen with ``--domain`` instead of always in the default
+  domain (Arthur Zamarin)
+
+- ``FEATURES=multilib-strict`` without ``MULTILIB_STRICT_DIRS`` or
+  ``MULTILIB_STRICT_DENY`` set skips the check, as in Portage, instead of
+  crashing every merge (Arthur Zamarin)
+
+- profiles: a repo inside a directory named ``profiles`` gets the right
+  profile names and file paths (Arthur Zamarin)
+
+- ``pmaint regen``: ``_eclasses_`` in the metadata cache follows each
+  package's inherit order, so regenerating no longer reorders unchanged
+  entries (Arthur Zamarin)
+
+----------------------------
+pkgcore 0.12.44 (2029-09-26)
+----------------------------
+
+Features
+~~~~~~~~
+
+- ``--sandbox`` is now shared machinery rather than something ``pmaint regen``
+  owns, so any command that sources ebuilds can offer it (Arthur Zamarin)
+
+- ``pquery`` now confines itself while querying with landlock (Arthur Zamarin)
+
+- ``pinspect``: the usage reports and ``digests`` now confine themselves with
+  landlock (Arthur Zamarin)
+
+- ``pmaint eclass`` now confines itself with landlock (Arthur Zamarin)
+
+- ``pmaint copy`` now confines itself with landlock (Arthur Zamarin)
+
+- ``pmaint sync --import`` adds a repo from Gentoo's published repository list
+  and syncs it, so a new overlay no longer needs a hand-written repos.conf
+  entry first (Arthur Zamarin)
+
+- ``pmaint sync --import-masters`` does the same for everything a repo inherits
+  from, following masters of masters (Arthur Zamarin)
+
+Fixes
+~~~~~
+
+- landlock: shut down ebuild daemons started before the restrictions go on.
+  Landlock only reaches processes started afterwards, so one left over from
+  earlier kept the access it was spawned with (Arthur Zamarin)
+
 ----------------------------
 pkgcore 0.12.43 (2029-09-12)
 ----------------------------
@@ -29,6 +316,10 @@ Fixes
 - eclass: separate an ``@SUBSECTION`` heading from the prose above it, so it
   renders as a heading (Arthur Zamarin)
 
+- ``ContainmentMatch``: render its values in sorted order, so the string form of
+  a restriction is stable across runs rather than following set iteration order
+  (Arthur Zamarin)
+
 ----------------------------
 pkgcore 0.12.42 (2026-09-05)
 ----------------------------

{pkgcore-0.12.43 → pkgcore-0.12.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pkgcore
-Version: 0.12.43
+Version: 0.12.45
 Summary: package managing framework
 Author-email: Michał Górny <mgorny@gentoo.org>, Tim Harder <radhermit@gmail.com>, Brian Harring <ferringb@gmail.com>, Arthur Zamarin <arthurzam@gentoo.org>, Marien Zwart <marienz@gentoo.org>
 Maintainer-email: Arthur Zamarin <arthurzam@gentoo.org>

{pkgcore-0.12.43 → pkgcore-0.12.45}/build/sphinx/man/patom.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PATOM" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PATOM" "1" "Oct 03, 2026" "0.12.45" "pkgcore"
 .SH NAME
 patom \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.45}/build/sphinx/man/pclean.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PCLEAN" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PCLEAN" "1" "Oct 03, 2026" "0.12.45" "pkgcore"
 .SH NAME
 pclean \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.45}/build/sphinx/man/pclonecache.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PCLONECACHE" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PCLONECACHE" "1" "Oct 03, 2026" "0.12.45" "pkgcore"
 .SH NAME
 pclonecache \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.45}/build/sphinx/man/pconfig.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PCONFIG" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PCONFIG" "1" "Oct 03, 2026" "0.12.45" "pkgcore"
 .SH NAME
 pconfig \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.45}/build/sphinx/man/pebuild.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PEBUILD" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PEBUILD" "1" "Oct 03, 2026" "0.12.45" "pkgcore"
 .SH NAME
 pebuild \- Wrapper for running commandline scripts.
 .SH SYNOPSIS

{pkgcore-0.12.43 → pkgcore-0.12.45}/build/sphinx/man/pinspect.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PINSPECT" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PINSPECT" "1" "Oct 03, 2026" "0.12.45" "pkgcore"
 .SH NAME
 pinspect \- Wrapper for running commandline scripts.
 .SH SYNOPSIS
@@ -168,7 +168,7 @@ where stdout is not a tty.
 .EX
 pinspect eapi_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                     [\-\-no\-final\-summary] [\-\-sort\-by\-name]
-                    [\-\-first FIRST | \-\-last LAST]
+                    [\-\-first FIRST | \-\-last LAST] [\-\-sandbox BOOLEAN]
                     [repo ...]
 .EE
 .UNINDENT
@@ -200,6 +200,15 @@ show only the first N detail items
 .B \-\-last LAST
 show only the last N detail items
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -238,6 +247,7 @@ where stdout is not a tty.
 pinspect license_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                        [\-\-no\-final\-summary] [\-\-sort\-by\-name]
                        [\-\-first FIRST | \-\-last LAST]
+                       [\-\-sandbox BOOLEAN]
                        [repo ...]
 .EE
 .UNINDENT
@@ -269,6 +279,15 @@ show only the first N detail items
 .B \-\-last LAST
 show only the last N detail items
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -307,6 +326,7 @@ where stdout is not a tty.
 pinspect eclass_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                       [\-\-no\-final\-summary] [\-\-sort\-by\-name]
                       [\-\-first FIRST | \-\-last LAST]
+                      [\-\-sandbox BOOLEAN]
                       [repo ...]
 .EE
 .UNINDENT
@@ -338,6 +358,15 @@ show only the first N detail items
 .B \-\-last LAST
 show only the last N detail items
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -376,6 +405,7 @@ where stdout is not a tty.
 pinspect mirror_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                       [\-\-no\-final\-summary] [\-\-sort\-by\-name]
                       [\-\-first FIRST | \-\-last LAST]
+                      [\-\-sandbox BOOLEAN]
                       [repo ...]
 .EE
 .UNINDENT
@@ -407,6 +437,15 @@ show only the first N detail items
 .B \-\-last LAST
 show only the last N detail items
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -446,7 +485,7 @@ pinspect distfiles_usage [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
                          [\-\-no\-final\-summary | \-\-no\-repo\-summary |
                          \-\-no\-detail] [\-\-sort\-by\-name]
                          [\-\-first FIRST | \-\-last LAST]
-                         [\-\-include\-nonmirrored]
+                         [\-\-sandbox BOOLEAN] [\-\-include\-nonmirrored]
                          [\-\-include\-restricted]
                          [repo ...]
 .EE
@@ -491,6 +530,15 @@ show only the last N detail items
 .UNINDENT
 .INDENT 0.0
 .TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B \-\-include\-nonmirrored
 if set, nonmirrored  distfiles will be included in the total
 .UNINDENT
@@ -2739,7 +2787,7 @@ where stdout is not a tty.
 .sp
 .EX
 pinspect digests [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
-                 [\-\-domain DOMAIN]
+                 [\-\-domain DOMAIN] [\-\-sandbox BOOLEAN]
                  [repos ...]
 .EE
 .UNINDENT
@@ -2750,6 +2798,16 @@ pinspect digests [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN]
 .B repos
 repo to inspect
 .UNINDENT
+.SS Options
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP

{pkgcore-0.12.43 → pkgcore-0.12.45}/build/sphinx/man/pmaint.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PMAINT" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PMAINT" "1" "Oct 03, 2026" "0.12.45" "pkgcore"
 .SH NAME
 pmaint \- Wrapper for running commandline scripts.
 .SH SYNOPSIS
@@ -100,7 +100,9 @@ general system maintenance
 .INDENT 3.5
 .sp
 .EX
-pmaint sync [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN] [\-f] [repo ...]
+pmaint sync [\-h] [\-\-debug] [\-q] [\-v] [\-\-color BOOLEAN] [\-f]
+            [\-\-import REPO] [\-\-import\-masters PATH]
+            [repo ...]
 .EE
 .UNINDENT
 .UNINDENT
@@ -116,6 +118,35 @@ repo(s) to sync
 .B \-f, \-\-force
 force syncing to occur regardless of staleness checks
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-import REPO
+Look a repository up by name in Gentoo\(aqs published repository list,
+write a \fBrepos.conf\fP entry for it, and sync it. Pass the option
+again to add more than one repo.
+.sp
+New repos land beside the repos already being synced, which is
+\fB/var/db/repos\fP on an ordinary install, and get a file of their own
+when \fBrepos.conf\fP is a directory. The list is fetched from
+\%<https://\:api\:.gentoo\:.org/\:overlays/\:repositories\:.xml> and cached locally.
+.sp
+A repo that\(aqs already configured is simply synced, so an import can be
+repeated without failing.
+.sp
+Importing leaves the rest of the configured repos alone; name them as
+arguments to sync those as well.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-import\-masters PATH
+Read the masters of the repo at the given path, add the ones that
+aren\(aqt configured yet, and sync them all.
+.sp
+Masters of masters are followed as each repo is synced and its own
+\fBlayout.conf\fP becomes readable, so the repo ends up with everything
+it inherits from present and current. That makes it the one command a
+CI run needs before checking a repo it doesn\(aqt own the parents of.
+.UNINDENT
 .SS Base Options
 .INDENT 0.0
 .TP
@@ -153,6 +184,7 @@ where stdout is not a tty.
 .EX
 pmaint copy [\-\-domain DOMAIN] [\-h] [\-\-debug] [\-q] [\-v]
             [\-\-color BOOLEAN] [\-s SOURCE_REPO] [\-i]
+            [\-\-sandbox BOOLEAN]
             target_repo query [query ...]
 .EE
 .UNINDENT
@@ -214,6 +246,15 @@ copy strictly from the supplied repository; else it copies from wherever a match
 .B \-i, \-\-ignore\-existing
 if a matching pkg already exists in the target, don\(aqt update it
 .UNINDENT
+.INDENT 0.0
+.TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
 .SS pmaint regen \- regenerate repository caches
 .SS Synopsis
 .INDENT 0.0
@@ -301,10 +342,11 @@ use separate directory to store repository caches
 .INDENT 0.0
 .TP
 .B \-\-sandbox BOOLEAN
-Confine the run with Landlock where the kernel supports it: writes are
-limited to the caches being regenerated, and outgoing TCP is denied.
-Enabled by default; \(aqy\(aq turns an unsupported kernel into an error
-instead of continuing unconfined, and \(aqn\(aq disables it.
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -380,8 +422,8 @@ do not update etc/ldso.conf and ld.so.cache
 .sp
 .EX
 pmaint eclass [\-\-domain DOMAIN] [\-h] [\-\-debug] [\-q] [\-v]
-              [\-\-color BOOLEAN] [\-\-dir OUTPUT_DIR] [\-o OUTPUT_FORMAT]
-              [\-f {rst,man,html,devbook}] [\-r REPO]
+              [\-\-color BOOLEAN] [\-\-dir OUTPUT_DIR] [\-\-sandbox BOOLEAN]
+              [\-o OUTPUT_FORMAT] [\-f {rst,man,html,devbook}] [\-r REPO]
               [eclasses ...]
 .EE
 .UNINDENT
@@ -435,6 +477,15 @@ output directory
 .UNINDENT
 .INDENT 0.0
 .TP
+.B \-\-sandbox BOOLEAN
+Confine the run with Landlock where the kernel supports it: writes
+are limited to the paths the command legitimately needs, and
+outgoing TCP is denied. Enabled by default; \(aqy\(aq turns an
+unsupported kernel into an error instead of continuing unconfined,
+and \(aqn\(aq disables it.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B \-o, \-\-output OUTPUT_FORMAT
 Output file name format. Defaults to \fB{eclass}.eclass.{format}\fP\&. You
 can use \fB{eclass}\fP and \fB{format}\fP placeholders to customize the

{pkgcore-0.12.43 → pkgcore-0.12.45}/build/sphinx/man/pmerge.1

@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "PMERGE" "1" "Sep 12, 2026" "0.12.43" "pkgcore"
+.TH "PMERGE" "1" "Oct 03, 2026" "0.12.45" "pkgcore"
 .SH NAME
 pmerge \- Wrapper for running commandline scripts.
 .SH SYNOPSIS