From 0733f7f61478980a180d8ecaa088dd2134fdf9ae Mon Sep 17 00:00:00 2001 From: Sam James Date: Thu, 9 Jul 2026 21:19:49 +0100 Subject: [PATCH 1/8] cargo.eclass: fix indentation Signed-off-by: Sam James --- eclass/cargo.eclass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eclass/cargo.eclass b/eclass/cargo.eclass index c385b8e5abd45..bf2a820537878 100644 --- a/eclass/cargo.eclass +++ b/eclass/cargo.eclass @@ -21,7 +21,7 @@ if [[ -z ${_CARGO_ECLASS} ]]; then _CARGO_ECLASS=1 if [[ -n ${RUST_NEEDS_LLVM} ]]; then - inherit llvm-r1 + inherit llvm-r1 fi if [[ -n ${CARGO_OPTIONAL} ]]; then From b982445cd7fb9651381a3aed8d672417962bdb15 Mon Sep 17 00:00:00 2001 From: Sam James Date: Fri, 10 Jul 2026 17:20:59 +0100 Subject: [PATCH 2/8] cargo.eclass: avoid heredoc in global scope A heredoc may cause the use of a temporary file with < EAPI 9 and even then still with >= EAPI 9 if the input is large. This becomes a problem if sandboxing is applied to metadata generation. Bug: https://bugs.gentoo.org/978857 Signed-off-by: Sam James --- eclass/cargo.eclass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eclass/cargo.eclass b/eclass/cargo.eclass index bf2a820537878..185531490a25a 100644 --- a/eclass/cargo.eclass +++ b/eclass/cargo.eclass @@ -310,7 +310,7 @@ _cargo_set_crate_uris() { local crate commit crate_uri crate_dir host repo_ext feat_expr for crate in "${!GIT_CRATES[@]}"; do - IFS=';' read -r crate_uri commit crate_dir host <<< "${GIT_CRATES[${crate}]}" || die "${ECLASS}: could not create heredoc" + IFS=';' read -rd '' crate_uri commit crate_dir host < <(printf %s "${GIT_CRATES[${crate}]}") if [[ -z ${host} ]]; then case "${crate_uri}" in From c3dcad735f350145abc6da96b09e47812d7de487 Mon Sep 17 00:00:00 2001 From: Sam James Date: Fri, 10 Jul 2026 17:21:59 +0100 Subject: [PATCH 3/8] nginx.eclass: avoid heredoc in global scope A heredoc may cause the use of a temporary file with < EAPI 9 and even then still with >= EAPI 9 if the input is large. This becomes a problem if sandboxing is applied to metadata generation. Closes: https://bugs.gentoo.org/978940 Signed-off-by: Sam James --- eclass/nginx.eclass | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/eclass/nginx.eclass b/eclass/nginx.eclass index c77cbcf64eb20..1212d296173b1 100644 --- a/eclass/nginx.eclass +++ b/eclass/nginx.eclass @@ -376,7 +376,8 @@ _ngx_set_mod_required_use() { if has "${mod}" "${_NGX_MODULES[@]#+}"; then result='' # Feed comma-delimited dependencies into the dep_list array. - IFS=, read -ra dep_list <<< "${_NGX_DEP_TABLE[${mod}]}" + mapfile -td ',' dep_list < <(printf %s "${_NGX_DEP_TABLE[${mod}]}") + for dep in "${dep_list[@]}"; do has "${dep}" "${_NGX_MODULES[@]#+}" && result+=" nginx_modules_${dep}" From 55db1fb17fcc1eca9fc9c3e7a41036df24654776 Mon Sep 17 00:00:00 2001 From: Sam James Date: Fri, 10 Jul 2026 17:22:30 +0100 Subject: [PATCH 4/8] sec-keys.eclass: avoid heredoc in global scope A heredoc may cause the use of a temporary file with < EAPI 9 and even then still with >= EAPI 9 if the input is large. This becomes a problem if sandboxing is applied to metadata generation. Closes: https://bugs.gentoo.org/978941 Signed-off-by: Sam James --- eclass/sec-keys.eclass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eclass/sec-keys.eclass b/eclass/sec-keys.eclass index ca1b4de572412..b53b7143bea65 100644 --- a/eclass/sec-keys.eclass +++ b/eclass/sec-keys.eclass @@ -68,7 +68,7 @@ _sec_keys_set_globals() { for key in "${SEC_KEYS_VALIDPGPKEYS[@]}"; do fingerprint=${key%%:*} name=${key#${fingerprint}:}; name=${name%%:*} - IFS=, read -r -a locations <<<"${key##*:}" + mapfile -td ',' locations < <(printf %s "${key##*:}") [[ ${locations[@]} ]] || die "${ECLASS}: ${name}: PGP key remote is mandatory" for loc in "${locations[@]}"; do case ${loc} in From b93b99648973c09652d1ba49950a74047a293f8a Mon Sep 17 00:00:00 2001 From: Sam James Date: Fri, 10 Jul 2026 17:23:25 +0100 Subject: [PATCH 5/8] x11-terms/wezterm: avoid heredoc in global scope A heredoc may cause the use of a temporary file with < EAPI 9 and even then still with >= EAPI 9 if the input is large. This becomes a problem if sandboxing is applied to metadata generation. Closes: https://bugs.gentoo.org/978944 Signed-off-by: Sam James --- x11-terms/wezterm/wezterm-20260616.002039.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x11-terms/wezterm/wezterm-20260616.002039.ebuild b/x11-terms/wezterm/wezterm-20260616.002039.ebuild index cb994e7cbd6b1..71e85e1d11a4f 100644 --- a/x11-terms/wezterm/wezterm-20260616.002039.ebuild +++ b/x11-terms/wezterm/wezterm-20260616.002039.ebuild @@ -91,7 +91,7 @@ QA_FLAGS_IGNORED=" submodule_uris() { for line in "${SUBMODULES[@]}"; do - read -r name hoster dep url commit <<< "${line}" || die + read -rd '' name hoster dep url commit < <(printf %s "${line}") if [ ${hoster} == "github" ]; then From 690c4a1c4c1b8342f6cb567ace85b8daa0099a9b Mon Sep 17 00:00:00 2001 From: Sam James Date: Fri, 10 Jul 2026 17:24:37 +0100 Subject: [PATCH 6/8] sci-physics/geant-data: avoid heredoc in global scope A heredoc may cause the use of a temporary file with < EAPI 9 and even then still with >= EAPI 9 if the input is large. This becomes a problem if sandboxing is applied to metadata generation. Closes: https://bugs.gentoo.org/978943 Signed-off-by: Sam James --- sci-physics/geant-data/geant-data-4.11.3.ebuild | 4 ++-- sci-physics/geant-data/geant-data-4.11.4.ebuild | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/sci-physics/geant-data/geant-data-4.11.3.ebuild b/sci-physics/geant-data/geant-data-4.11.3.ebuild index 8cc5e6fc73d2a..31e5f2c594bfd 100644 --- a/sci-physics/geant-data/geant-data-4.11.3.ebuild +++ b/sci-physics/geant-data/geant-data-4.11.3.ebuild @@ -1,4 +1,4 @@ -# Copyright 1999-2025 Gentoo Authors +# Copyright 1999-2026 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=8 @@ -35,7 +35,7 @@ DATASETS=( ) for DATASET in ${!DATASETS[@]}; do - read FILENAME VERSION ENVVAR <<< "${DATASETS[$DATASET]}" + read -rd '' FILENAME VERSION ENVVAR < <(printf %s "${DATASETS[$DATASET]}") SRC_URI+="${SRC_DATA}/${FILENAME}.${VERSION}.tar.gz " done unset DATASET FILENAME VERSION ENVVAR diff --git a/sci-physics/geant-data/geant-data-4.11.4.ebuild b/sci-physics/geant-data/geant-data-4.11.4.ebuild index 1505d4cc15309..cdb959e88c943 100644 --- a/sci-physics/geant-data/geant-data-4.11.4.ebuild +++ b/sci-physics/geant-data/geant-data-4.11.4.ebuild @@ -1,4 +1,4 @@ -# Copyright 1999-2025 Gentoo Authors +# Copyright 1999-2026 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=8 @@ -35,7 +35,7 @@ DATASETS=( ) for DATASET in ${!DATASETS[@]}; do - read FILENAME VERSION ENVVAR <<< "${DATASETS[$DATASET]}" + read -rd '' FILENAME VERSION ENVVAR < <(printf %s "${DATASETS[$DATASET]}") SRC_URI+="${SRC_DATA}/${FILENAME}.${VERSION}.tar.gz " done unset DATASET FILENAME VERSION ENVVAR From bbc89239c398062f5af0c0e8fa984adf6a7f103e Mon Sep 17 00:00:00 2001 From: Sam James Date: Fri, 10 Jul 2026 17:50:02 +0100 Subject: [PATCH 7/8] app-office/lyx: avoid tilde expansion (in global scope) Closes: https://bugs.gentoo.org/978945 Signed-off-by: Sam James --- app-office/lyx/lyx-2.5.0.ebuild | 10 +++++----- app-office/lyx/lyx-2.5.1.ebuild | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/app-office/lyx/lyx-2.5.0.ebuild b/app-office/lyx/lyx-2.5.0.ebuild index aed7ea4927504..af850cb6ccaf0 100644 --- a/app-office/lyx/lyx-2.5.0.ebuild +++ b/app-office/lyx/lyx-2.5.0.ebuild @@ -10,12 +10,12 @@ inherit desktop font optfeature python-single-r1 cmake verify-sig xdg DESCRIPTION="WYSIWYM (What You See Is What You Mean) document processor based on LaTeX" HOMEPAGE="https://www.lyx.org/" SRC_URI=" - http://ftp.lyx.org/pub/lyx/stable/$(ver_cut 1-2).x/${P/_rc/~RC}.tar.xz - http://ftp.lyx.org/pub/lyx/devel/lyx-$(ver_cut 1-2)/${P/_rc/~RC}.tar.xz - http://ftp.lyx.org/pub/lyx/stable/$(ver_cut 1-2).x/${P/_rc/~RC}.tar.xz.sig - http://ftp.lyx.org/pub/lyx/devel/lyx-$(ver_cut 1-2)/${P/_rc/~RC}.tar.xz.sig + http://ftp.lyx.org/pub/lyx/stable/$(ver_cut 1-2).x/${P/_rc/\~RC}.tar.xz + http://ftp.lyx.org/pub/lyx/devel/lyx-$(ver_cut 1-2)/${P/_rc/\~RC}.tar.xz + http://ftp.lyx.org/pub/lyx/stable/$(ver_cut 1-2).x/${P/_rc/\~RC}.tar.xz.sig + http://ftp.lyx.org/pub/lyx/devel/lyx-$(ver_cut 1-2)/${P/_rc/\~RC}.tar.xz.sig " -S=${WORKDIR}/${P/_rc/~RC} +S=${WORKDIR}/${P/_rc/\~RC} LICENSE="GPL-2+" SLOT="0" diff --git a/app-office/lyx/lyx-2.5.1.ebuild b/app-office/lyx/lyx-2.5.1.ebuild index 8b9b4b3b0c714..a60d1d9f42fa2 100644 --- a/app-office/lyx/lyx-2.5.1.ebuild +++ b/app-office/lyx/lyx-2.5.1.ebuild @@ -10,14 +10,14 @@ inherit desktop font optfeature python-single-r1 cmake verify-sig xdg DESCRIPTION="WYSIWYM (What You See Is What You Mean) document processor based on LaTeX" HOMEPAGE="https://www.lyx.org/" SRC_URI=" - http://ftp.lyx.org/pub/lyx/stable/$(ver_cut 1-2).x/${P/_rc/~RC}.tar.xz - http://ftp.lyx.org/pub/lyx/devel/lyx-$(ver_cut 1-2)/${P/_rc/~RC}.tar.xz + http://ftp.lyx.org/pub/lyx/stable/$(ver_cut 1-2).x/${P/_rc/\~RC}.tar.xz + http://ftp.lyx.org/pub/lyx/devel/lyx-$(ver_cut 1-2)/${P/_rc/\~RC}.tar.xz verify-sig? ( - http://ftp.lyx.org/pub/lyx/stable/$(ver_cut 1-2).x/${P/_rc/~RC}.tar.xz.sig - http://ftp.lyx.org/pub/lyx/devel/lyx-$(ver_cut 1-2)/${P/_rc/~RC}.tar.xz.sig + http://ftp.lyx.org/pub/lyx/stable/$(ver_cut 1-2).x/${P/_rc/\~RC}.tar.xz.sig + http://ftp.lyx.org/pub/lyx/devel/lyx-$(ver_cut 1-2)/${P/_rc/\~RC}.tar.xz.sig ) " -S=${WORKDIR}/${P/_rc/~RC} +S=${WORKDIR}/${P/_rc/\~RC} LICENSE="GPL-2+" SLOT="0" From a4105cc5844d9805336e13bb69ac87bcca1e7112 Mon Sep 17 00:00:00 2001 From: Sam James Date: Fri, 10 Jul 2026 17:50:41 +0100 Subject: [PATCH 8/8] media-libs/hamlib: avoid tilde expansion (in global scope) Closes: https://bugs.gentoo.org/978946 Signed-off-by: Sam James --- media-libs/hamlib/hamlib-4.7.1-r1.ebuild | 2 +- media-libs/hamlib/hamlib-4.7.2.ebuild | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/media-libs/hamlib/hamlib-4.7.1-r1.ebuild b/media-libs/hamlib/hamlib-4.7.1-r1.ebuild index 890d5e6f5e83e..18658b597f16e 100644 --- a/media-libs/hamlib/hamlib-4.7.1-r1.ebuild +++ b/media-libs/hamlib/hamlib-4.7.1-r1.ebuild @@ -4,7 +4,7 @@ EAPI=8 PYTHON_COMPAT=( python3_{11..14} ) -MY_P=${P/_rc2/~rc2} +MY_P=${P/_rc2/\~rc2} inherit autotools flag-o-matic python-single-r1 diff --git a/media-libs/hamlib/hamlib-4.7.2.ebuild b/media-libs/hamlib/hamlib-4.7.2.ebuild index e1f9e120633c8..18319effac7d9 100644 --- a/media-libs/hamlib/hamlib-4.7.2.ebuild +++ b/media-libs/hamlib/hamlib-4.7.2.ebuild @@ -4,7 +4,7 @@ EAPI=8 PYTHON_COMPAT=( python3_{11..14} ) -MY_P=${P/_rc2/~rc2} +MY_P=${P/_rc2/\~rc2} inherit autotools flag-o-matic python-single-r1