repo/gentoo:master commit in: app-containers/incus/

commit:     55f1c405058e093e0a6532bc212d6b06324dd4c8
Author:     Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Mon Aug  3 14:32:15 2026 +0000
Commit:     Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Mon Aug  3 14:40:40 2026 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=55f1c405

app-containers/incus: revbump 7.0.1 (lts) to fix several CVEs

Bug: https://bugs.gentoo.org/980304
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>

 app-containers/incus/Manifest              |   1 +
 app-containers/incus/incus-7.0.1-r1.ebuild | 274 +++++++++++++++++++++++++++++
 2 files changed, 275 insertions(+)

diff --git a/app-containers/incus/Manifest b/app-containers/incus/Manifest
index 7b5932216c89..d9df4cc00822 100644
--- a/app-containers/incus/Manifest
+++ b/app-containers/incus/Manifest
@@ -2,5 +2,6 @@ DIST incus-7.0.1.tar.xz 13961756 BLAKE2B 6266f2c1984a8fd7b1290b6e772d01f95c6d849
 DIST incus-7.0.1.tar.xz.asc 833 BLAKE2B db72bbeacadb282964f2214bd6f2fd6548e6b6d83fb861e5f9662e67a070e4827102be920c2702ee406c3b197cbd1dc96934dcdd6dcc677538d16c89f23ff1eb SHA512 08d29eaced3c70002f1b3963443467b5a62a80bb19a680d4ea52caf7c422195fbab3887ee38036cc8a8ea77cd72a401d0e53cd400f7267fcf9edd59b3fdeef30
 DIST incus-7.2.tar.xz 13899812 BLAKE2B 67504a86755517f785cfcb869560a5ba8bda86c538e172a53309362a8590266c1c748840ff33a55a435daaf99a38b108a0becca514bcfc90c4296fad25145f97 SHA512 219e9de0d483fdb05dc7782d129de81864903b61c010c97d2606b59487be95a2a0362c5b54909471f8fe20777bbcec88c82a86d803227e28f28f8def7a5ba613
 DIST incus-7.2.tar.xz.asc 833 BLAKE2B a01ea73af3cc3447874627fa1687fbde2346f7cba77a607a3decf07def91026260aa34a1aeaaa7392d3ddd543e1530d50b657117b72e22210f811c8f6bc91535 SHA512 87f609cb97c07306b9578e869948e28f4739a1ad2d9da7ddf4614429eadb08972dd4f80e7c8c6e2fabb7bfc975ca2273432c0a975041d45cea8b1129c769772a
+DIST incus-7.3-cve-commits-bgo980304.tar.xz 9564 BLAKE2B 9c53f58e460608ae67d16be04e030515cc2862575739fb89c48627f2fc9c29c2472640dc28aa42cd634916a2375a7e1858a47a654cf408714246cd110b11e850 SHA512 96c0c6ae80096e9af3f9e2dd348bd48b553c9bbdff57bd3214e17032cdf459d450a6d25afca79b9197d1add06c01a35be5f63c910ab6e5c9d71643cebd52507c
 DIST incus-7.3.tar.xz 14151148 BLAKE2B 1f4109d956599ce798a3c156e1b37e9dfcea9350498e3cd2703b692d367da79f76cff482f9042bd35a58b99ae67fea8a7b393aaa2a9f13c54ea25ac68cd995ea SHA512 aad1a35bbe150cd3f1beee233839bff23c636a4bd9e2ff99a26f15adc971b5a383fae3900f4e7cf6997b153560f8f18dfab87f1e68d859f5a338e3522209a5c4
 DIST incus-7.3.tar.xz.asc 833 BLAKE2B 62b81b3f97f0965dd6153a4b271942c81a1f217047b04c1d96108b49fa775be06cd610e2a1418f572cce2fda2dd8509223437c4241ec6d1a8eacae7c085b6d8d SHA512 3169f98a7c4bd2d5cd9a04b538dd21bf5e34d602d4651549da9c32043be8706fb55b2256685ce16fc9b167efe8d4f2f81a3500ca8726a9f6d7f892c7275c06ee

diff --git a/app-containers/incus/incus-7.0.1-r1.ebuild b/app-containers/incus/incus-7.0.1-r1.ebuild
new file mode 100644
index 000000000000..16c6dfb69b6f
--- /dev/null
+++ b/app-containers/incus/incus-7.0.1-r1.ebuild
@@ -0,0 +1,274 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+	https://dev.gentoo.org/~juippis/distfiles/incus-7.3-cve-commits-bgo980304.tar.xz
+	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/lts"
+KEYWORDS="~amd64 ~arm64"
+IUSE="apparmor fuidshift nls qemu selinux"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-6.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.9
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	net-firewall/nftables[json]
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-6.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)
+	selinux? ( sec-policy/selinux-incus )"
+BDEPEND=">=dev-lang/go-1.25.11
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	if use verify-sig ; then
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.asc}
+	fi
+	go-module_src_unpack
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	# bgo#980304, patch multiple CVEs before 7.0.2.
+	eapply "${WORKDIR}"/incus-7.3-cve-commits-bgo980304/*.patch
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+incus_get_bindir() {
+	local host_arch=${1}
+	if [[ "${GOARCH}" != "${host_arch}" ]]; then
+		echo "_dist/bin/linux_${GOARCH}"
+	else
+		echo "_dist/bin"
+	fi
+}
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	local bindir=$(incus_get_bindir "$(go-env_goarch "${CBUILD}")")
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	local bindir=$(incus_get_bindir "${GOHOSTARCH}")
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878,
+	# and INCUS_SECURITY_SELINUX=true to enable selinux support (until its enabled by default)
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+	if use selinux; then
+		echo "INCUS_SECURITY_SELINUX=true" >> "${D}"/etc/env.d/90incus
+	fi
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}