repo/gentoo:master commit in: dev-debug/sysdig/, dev-debug/sysdig/files/

commit:     b503590759ca6e03accad94e4c56b67a7598f80b
Author:     Holger Hoffstätte <holger <AT> applied-asynchrony <DOT> com>
AuthorDate: Tue Jun  9 12:20:15 2026 +0000
Commit:     Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Fri Aug 14 14:26:37 2026 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b5035907

dev-debug/sysdig: add 0.41.4

After over a year of broken upstream releases this finally adds a
version that works and no longer crashes when running Lua chisels.
The most notable change is that this release no longer needs gRPC
for container support and instead relies on a binary plugin, which
unfortunately means we permanently lose ~x86 support.
Details on the container plugin can be found at:
https://github.com/falcosecurity/plugins/tree/main/plugins/container

Signed-off-by: Holger Hoffstätte <holger <AT> applied-asynchrony.com>
Part-of: https://codeberg.org/gentoo/gentoo/pulls/1118
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>

 dev-debug/sysdig/Manifest                          |   3 +
 ...s-0.21.0-fix-INET6_ADDRSTRLEN-buffer-size.patch |  61 +++++++
 dev-debug/sysdig/sysdig-0.41.4.ebuild              | 188 +++++++++++++++++++++
 3 files changed, 252 insertions(+)

diff --git a/dev-debug/sysdig/Manifest b/dev-debug/sysdig/Manifest
index 8c80b43fae88..f7ad4b178593 100644
--- a/dev-debug/sysdig/Manifest
+++ b/dev-debug/sysdig/Manifest
@@ -1,2 +1,5 @@
+DIST container-0.6.0-linux-x86_64.tar.gz 13118035 BLAKE2B 08aa198838114a56504a93b960374e92c0d6bfec3ff2759d1d9aed5ca784a7660f27e75eac033ad4122f40558e0a4471fcfaffa3980cd601d0d8df653209d2d1 SHA512 e67d99e0f393be69de1092ba5e7a036fcbd7a15299539f2d3aec2af400f1d9b6e52b19e2886f000cd9ab1d3a14106b42a1234378784d8ba23843214201ac00d8
 DIST falcosecurity-libs-0.20.0.tar.gz 4545190 BLAKE2B 93a074ab6451c16c7ad58498ac580f0476339e7dee65112e56142307f79966c43b69c71234a784aff03f47ec2e37e838e797beb4b36e9c105db88cf32cad135e SHA512 b5ef481bda92a29b7b409baee25dabd0b766e4bbcac762740635f99b36cd823a6d98f541817fd03b1a86a1385d3fe24888b33b84dc3486cd9f8d00e5384eb705
+DIST falcosecurity-libs-0.21.0.tar.gz 4511266 BLAKE2B 4d2014f8370da0e0777fd46736ada9655226fdc5d5e3e546fa1bce4251cb0874dfa0edaebd077800eed36760f2814a529fddedd1106a21a16e032942d2cda275 SHA512 d2c27fbdf13cc85bd4cff0270fc26cf6aa5fa7367cd1b32d7c407f1e5245d4d110038546066e838b1fce90ff588d2a0abcf4d95b1fae5734cd06e032be2f0fbc
 DIST sysdig-0.40.1.tar.gz 68296332 BLAKE2B 17ed9154d1e955dc18700ab764f0fce11461bea9b6970e8661761269d4f0bbb786ddd8a4cc4c806121a52d0d486080fc231f2447dc69d26d41fa582c1dabda41 SHA512 a50372192ea8708d19ede0550659a2f7ea6b535b419d649ae9b52e32f9c71576f0a3e3ab85dcc8d23f792dff078f15eca1435a1e402e3d98aba7eefc1920989e
+DIST sysdig-0.41.4.tar.gz 43418620 BLAKE2B 1d59ca97088e7ce3483343729659b17711029500e422904a253d041a296686c66a365a1fe5482aaebd427e7579f016f1961139799556f081f883d732d5d06f32 SHA512 3250bce00d9b40efd8baa948c820ff391c51e81f685f4c1e70ad337b9bb947aa218dc9f9930a682afb9ce78e63b6ed5ff948b9b9e3364cf1bfbd082f70cd65dc

diff --git a/dev-debug/sysdig/files/libs-0.21.0-fix-INET6_ADDRSTRLEN-buffer-size.patch b/dev-debug/sysdig/files/libs-0.21.0-fix-INET6_ADDRSTRLEN-buffer-size.patch
new file mode 100644
index 000000000000..bf9e68ee338b
--- /dev/null
+++ b/dev-debug/sysdig/files/libs-0.21.0-fix-INET6_ADDRSTRLEN-buffer-size.patch
@@ -0,0 +1,61 @@
+From upstream commit:
+https://github.com/falcosecurity/libs/commit/a273f3d05c6e90ffc5d47a919a92b3e4d887b340
+
+From: =?UTF-8?q?Holger=20Hoffst=C3=A4tte?= <[email protected]>
+Date: Sun, 3 Aug 2025 16:57:14 +0200
+Subject: [PATCH] fix(libsinsp): use proper INET6_ADDRSTRLEN buffer size for inet_ntop
+
+glibc-2.42 added __inet_ntop_chk fortification, which started to fail:
+
+  *** buffer overflow detected ***: terminated
+  Program received signal SIGABRT, Aborted.
+  0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
+  (gdb) bt
+  #0  0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
+  #1  0x00007ffff6242572 in raise () from /lib64/libc.so.6
+  #2  0x00007ffff6229f3b in abort () from /lib64/libc.so.6
+  #3  0x00007ffff622b148 in __libc_message_impl.cold () from /lib64/libc.so.6
+  #4  0x00007ffff6327337 in __fortify_fail () from /lib64/libc.so.6
+  #5  0x00007ffff6326c92 in __chk_fail () from /lib64/libc.so.6
+  #6  0x00007ffff6327a62 in __inet_ntop_chk () from /lib64/libc.so.6
+  #7  0x000055555569da3d in inet_ntop (__af=10, __src=0x555555ee0800, __dst=0x7fffffff4f90 "\260P\377\377\377\177", __dst_size=100) at /usr/include/bits/inet-fortified.h:36
+  #8  ipv6tuple_to_string[abi:cxx11](ipv6tuple*, bool) (tuple=0x555555ee0800, resolve=false) at /tmp/portage/dev-debug/sysdig-0.40.1/work/libs-0.20.0/userspace/libsinsp/utils.c
+
+Use INET6_ADDRSTRLEN as destination buffer size.
+
+Fixes: https://github.com/falcosecurity/libs/issues/2573
+Signed-off-by: Holger Hoffstätte <[email protected]>
+---
+ userspace/libsinsp/utils.cpp | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/userspace/libsinsp/utils.cpp b/userspace/libsinsp/utils.cpp
+index 06b921cbbf..b676b8dd34 100644
+--- a/userspace/libsinsp/utils.cpp
++++ b/userspace/libsinsp/utils.cpp
+@@ -1042,8 +1042,8 @@ std::string ipv4tuple_to_string(const ipv4tuple& tuple, const bool resolve) {
+ }
+ 
+ std::string ipv6serveraddr_to_string(const ipv6serverinfo& addr, const bool resolve) {
+-	char address[100];
+-	if(!inet_ntop(AF_INET6, addr.m_ip.m_b, address, 100)) {
++	char address[INET6_ADDRSTRLEN];
++	if(!inet_ntop(AF_INET6, addr.m_ip.m_b, address, INET6_ADDRSTRLEN)) {
+ 		return std::string();
+ 	}
+ 
+@@ -1058,12 +1058,12 @@ std::string ipv6serveraddr_to_string(const ipv6serverinfo& addr, const bool reso
+ 
+ std::string ipv6tuple_to_string(const ipv6tuple& tuple, const bool resolve) {
+ 	char source_address[INET6_ADDRSTRLEN];
+-	if(!inet_ntop(AF_INET6, tuple.m_fields.m_sip.m_b, source_address, 100)) {
++	if(!inet_ntop(AF_INET6, tuple.m_fields.m_sip.m_b, source_address, INET6_ADDRSTRLEN)) {
+ 		return std::string();
+ 	}
+ 
+ 	char destination_address[INET6_ADDRSTRLEN];
+-	if(!inet_ntop(AF_INET6, tuple.m_fields.m_dip.m_b, destination_address, 100)) {
++	if(!inet_ntop(AF_INET6, tuple.m_fields.m_dip.m_b, destination_address, INET6_ADDRSTRLEN)) {
+ 		return std::string();
+ 	}
+ 

diff --git a/dev-debug/sysdig/sysdig-0.41.4.ebuild b/dev-debug/sysdig/sysdig-0.41.4.ebuild
new file mode 100644
index 000000000000..67e8777b08b1
--- /dev/null
+++ b/dev-debug/sysdig/sysdig-0.41.4.ebuild
@@ -0,0 +1,188 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LUA_COMPAT=( luajit )
+
+inherit bash-completion-r1 cmake flag-o-matic linux-info lua-single
+
+DESCRIPTION="A system exploration and troubleshooting tool"
+HOMEPAGE="https://www.sysdig.com/"
+
+# The version of falcosecurity-libs required by sysdig as source tree
+LIBS_VERSION="0.21.0"
+LIBS="falcosecurity-libs-${LIBS_VERSION}"
+
+# The version of the container plugin binary
+CONTAINER_VERSION="0.6.0"
+
+SRC_URI="
+	https://github.com/draios/sysdig/archive/${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/falcosecurity/libs/archive/${LIBS_VERSION}.tar.gz -> ${LIBS}.tar.gz
+	https://download.falco.org/plugins/stable/container-${CONTAINER_VERSION}-linux-x86_64.tar.gz
+"
+
+# The driver version as found in cmake/modules/driver.cmake or alternatively
+# as git tag on the $LIBS_VERSION of falcosecurity-libs.
+DRIVER_VERSION="8.1.0+driver"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="bpf +modules"
+REQUIRED_USE="${LUA_REQUIRED_USE}"
+
+RDEPEND="${LUA_DEPS}
+	dev-cpp/abseil-cpp:=
+	dev-cpp/tbb:=
+	dev-cpp/yaml-cpp:=
+	dev-libs/jsoncpp:=
+	dev-libs/libb64:=
+	bpf? ( >=dev-libs/libbpf-1.5:= )
+	dev-libs/re2:=
+	dev-libs/uthash
+	sys-libs/ncurses:=
+	virtual/libelf:=
+	virtual/zlib:=
+"
+
+DEPEND="${RDEPEND}
+	bpf? (
+		dev-util/bpftool
+		llvm-core/clang:*[llvm_targets_BPF]
+	)
+	dev-cpp/nlohmann_json
+	dev-cpp/valijson
+	virtual/os-headers
+"
+
+# pin the driver to the falcosecurity-libs version
+PDEPEND="modules? ( =dev-debug/scap-driver-${LIBS_VERSION}* )"
+
+QA_PREBUILT="usr/share/sysdig/plugins/libcontainer.so"
+QA_PRESTRIPPED=${QA_PREBUILT}
+
+PATCHES=(
+	"${FILESDIR}/0.38.1-scap-loader.patch"
+)
+
+pkg_pretend() {
+	if use bpf && [[ ${MERGE_TYPE} != binary ]] ; then
+		local CONFIG_CHECK="
+			~BPF
+			~BPF_EVENTS
+			~BPF_JIT
+			~BPF_SYSCALL
+			~FTRACE_SYSCALLS
+			~HAVE_EBPF_JIT
+		"
+		check_extra_config
+	fi
+}
+
+src_prepare() {
+	# manually apply patches to falcosecurity-libs
+	pushd "${WORKDIR}/libs-${LIBS_VERSION}"
+		eapply "${FILESDIR}/libs-0.21.0-fix-INET6_ADDRSTRLEN-buffer-size.patch" || die
+	popd
+
+	# do not build with debugging info
+	sed -i -e 's/-ggdb//g' CMakeLists.txt "${WORKDIR}"/libs-${LIBS_VERSION}/cmake/modules/CompilerFlags.cmake || die
+
+	# fix the driver version
+	sed -i -e 's/0.0.0-local/${DRIVER_VERSION}/g' cmake/modules/driver.cmake || die
+
+	# we download & install the container plugin ourselves
+	sed -i -e '/include(container_plugin)/d' CMakeLists.txt || die
+
+	cmake_src_prepare
+}
+
+src_configure() {
+	# known problems with strict aliasing:
+	# https://github.com/falcosecurity/libs/issues/1964
+	append-flags -fno-strict-aliasing
+
+	local mycmakeargs=(
+		# do not build the kernel driver
+		-DBUILD_DRIVER=OFF
+		-DENABLE_DKMS=OFF
+
+		# disable all test targets
+		-DCREATE_TEST_TARGETS=OFF
+
+		# libscap examples are not installed or really useful
+		-DBUILD_LIBSCAP_EXAMPLES=OFF
+
+		# do not build internal libs as shared
+		-DBUILD_SHARED_LIBS=OFF
+
+		# build modern BPF probe depending on USE
+		-DBUILD_SYSDIG_MODERN_BPF=$(usex bpf)
+
+		# set driver location/version
+		-DDRIVER_SOURCE_DIR="${WORKDIR}"/libs-${LIBS_VERSION}/driver
+		-DDRIVER_VERSION=${DRIVER_VERSION}
+
+		# point sysdig to the libs tree
+		-DUSE_BUNDLED_FALCOSECURITY_LIBS=ON
+		-DFALCOSECURITY_LIBS_SOURCE_DIR="${WORKDIR}"/libs-${LIBS_VERSION}
+
+		# explicitly set sysdig version - required for some reason
+		-DSYSDIG_VERSION=${PV}
+
+		# do not use bundled dependencies for sysdig
+		-DUSE_BUNDLED_DEPS=OFF
+
+		# do not use bundled dependencies for falcosecurity-libs
+		-DUSE_BUNDLED_B64=OFF
+		-DUSE_BUNDLED_JSONCPP=OFF
+		-DUSE_BUNDLED_RE2=OFF
+		-DUSE_BUNDLED_TBB=OFF
+		-DUSE_BUNDLED_VALIJSON=OFF
+
+		# set valijson include path to prevent downloading
+		-DVALIJSON_INCLUDE="${ESYSROOT}"/usr/include
+
+		# enable chisels
+		-DWITH_CHISEL=ON
+	)
+
+	cmake_src_configure
+}
+
+src_install() {
+	cmake_src_install
+
+	# remove driver headers
+	rm -r "${ED}"/usr/src || die
+
+	# remove libscap/libsinsp headers & libs (see #938187)
+	rm -r "${ED}"/usr/include/sysdig || die
+	rm -r "${ED}"/usr/$(get_libdir) || die
+
+	# move bashcomp to the proper location
+	dobashcomp "${ED}"/usr/etc/bash_completion.d/sysdig || die
+	rm -r "${ED}"/usr/etc || die
+
+	# users can drop things in here
+	keepdir /usr/share/sysdig/plugins
+
+	# install container plugin
+	insinto /usr/share/sysdig/plugins
+	insopts -m0755
+	doins "${WORKDIR}"/libcontainer.so
+}
+
+pkg_postinst() {
+	if use bpf; then
+		elog
+		elog "You have enabled the 'modern BPF' probe."
+		elog "This eBPF-based event source is an alternative to the traditional"
+		elog "scap kernel module."
+		elog
+		elog "To use it, start sysdig/csysdig with '--modern-bpf'."
+		elog
+	fi
+}