Re: [PATCH v2 2/5] selinux-policy-2.eclass: respect the sanctity of -rN for EAPI=8

I'll send an updated series tommorow with the other eclass changes and the
sec-policy/selinux-* EAPI 7 -> 8 patches.

Rahul

On Mon Apr 6, 2026 at 11:25 PM BST, Rahul Sandhu wrote:
> Currently, ebuild revisions are molested by the versioning of policy
> patch bundles. -rN is reserved _exclusively_ for ebuild revisions; they
> should not be relied upon for versioning tarballs.
>
> Right now, this poses a problem: we can't revbump any ebuilds without
> breaking SRC_URI. This is because the BASEPOL variable, which is then
> later used to fetch the patchbundle in SRC_URI, is set to ${PVR} by
> default.
>
> To remedy this, transform a PV of XXX_pN to XXX-rN for EAPI=8. We can't
> do this for EAPI=7, sadly, as this would break the existing conventions
> for naming that are used by our consumers.
>
> Signed-off-by: Rahul Sandhu <[email protected]>
> ---
>  eclass/selinux-policy-2.eclass | 37 +++++++++++++++++++++++++---------
>  1 file changed, 27 insertions(+), 10 deletions(-)
>
> v2: mark SELINUX_POLICY_USEDEP as an @OUTPUT_VARIABLE
>
> diff --git a/eclass/selinux-policy-2.eclass b/eclass/selinux-policy-2.eclass
> index 2f75baec5c47..6bb6620e0a8a 100644
> --- a/eclass/selinux-policy-2.eclass
> +++ b/eclass/selinux-policy-2.eclass
> @@ -32,12 +32,22 @@ _SELINUX_POLICY_2_ECLASS=1
>  # This name is only the module name, not the category!
>  : "${MODS:="_illegal"}"
>  
> -# @ECLASS_VARIABLE: BASEPOL
> -# @DESCRIPTION:
> -# This variable contains the version string of the selinux-base-policy package
> -# that this module build depends on. It is used to patch with the appropriate
> -# patch bundle(s) that are part of selinux-base-policy.
> -: "${BASEPOL:="${PVR}"}"
> +if [[ ${EAPI} = 7 ]]; then
> +	# @ECLASS_VARIABLE: BASEPOL
> +	# @DESCRIPTION:
> +	# This variable contains the version string of the selinux-base-policy package
> +	# that this module build depends on. It is used to patch with the appropriate
> +	# patch bundle(s) that are part of selinux-base-policy.
> +	: "${BASEPOL:="${PVR}"}"
> +else
> +	# @ECLASS_VARIABLE: BASEPOL
> +	# @DESCRIPTION:
> +	# This variable contains the version string of the selinux-base-policy package
> +	# that this module build depends on. It is used to patch with the appropriate
> +	# patch bundle(s) that are part of selinux-base-policy.
> +	# _pN corresponds to -rN in the patch bundle(s).
> +	: "${BASEPOL:="${PV/_p/-r}"}"
> +fi
>  
>  # @ECLASS_VARIABLE: POLICY_PATCH
>  # @DESCRIPTION:
> @@ -85,9 +95,16 @@ fi
>  : "${SELINUX_GIT_BRANCH:="master"}"
>  
>  # @ECLASS_VARIABLE: SELINUX_POLICY_USEDEP
> +# @OUTPUT_VARIABLE
>  # @DESCRIPTION:
>  # This variable contains the USE dependency constraints for policy packages.
> -: "${SELINUX_POLICY_USEDEP:="selinux_policy_types_targeted(-)?,selinux_policy_types_strict(-)?,selinux_policy_types_mcs(-)?,selinux_policy_types_mls(-)?"}"
> +SELINUX_POLICY_USEDEP="selinux_policy_types_targeted(-)?,selinux_policy_types_strict(-)?,selinux_policy_types_mcs(-)?,selinux_policy_types_mls(-)?"
> +
> +# @ECLASS_VARIABLE: _SELINUX_POLICY_UPSTREAM_PV
> +# @INTERNAL
> +# @DESCRIPTION:
> +# Internal variable representing (spoofed) upstream refpolicy version.
> +_SELINUX_POLICY_UPSTREAM_PV=$(ver_cut 1-2)
>  
>  case ${BASEPOL} in
>  	9999)
> @@ -107,11 +124,11 @@ fi
>  HOMEPAGE="https://wiki.gentoo.org/wiki/Project:SELinux"
>  if [[ -n ${BASEPOL} && "${BASEPOL}" != "9999" ]]; then
>  	SRC_URI="
> -		https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${PV/./_}/refpolicy-${PV}.tar.bz2
> +		https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${_SELINUX_POLICY_UPSTREAM_PV/./_}/refpolicy-${_SELINUX_POLICY_UPSTREAM_PV}.tar.bz2
>  		https://dev.gentoo.org/~perfinion/patches/selinux-base-policy/patchbundle-selinux-base-policy-${BASEPOL}.tar.bz2
>  	"
>  elif [[ "${BASEPOL}" != "9999" ]]; then
> -	SRC_URI="https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${PV/./_}/refpolicy-${PV}.tar.bz2"
> +	SRC_URI="https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${_SELINUX_POLICY_UPSTREAM_PV/./_}/refpolicy-${_SELINUX_POLICY_UPSTREAM_PV}.tar.bz2"
>  fi
>  
>  LICENSE="GPL-2"
> @@ -123,7 +140,7 @@ S="${WORKDIR}"
>  if [[ -n ${BASEPOL} ]]; then
>  	_BASE_POLICY_VERSION="${BASEPOL}"
>  else
> -	_BASE_POLICY_VERSION="${PV}"
> +	_BASE_POLICY_VERSION="${_SELINUX_POLICY_UPSTREAM_PV}"
>  fi
>  
>  if [[ ${EAPI} = 7 ]]; then