app-crypt/sequoia-chameleon-gnupg: fix clock faking

This also fixes tests.

Closes: https://bugs.gentoo.org/970711
Signed-off-by: Sam James <sam@gentoo.org>

app-crypt/sequoia-chameleon-gnupg/files/sequoia-chameleon-gnupg-0.13.1-tests.patch

@@ -0,0 +1,73 @@
+https://bugs.gentoo.org/970711
+https://gitlab.com/sequoia-pgp/sequoia-chameleon-gnupg/-/commit/90e370fef788980e49aa807ac28531264bb9f404
+
+From 90e370fef788980e49aa807ac28531264bb9f404 Mon Sep 17 00:00:00 2001
+From: Malte Meiboom <malte@sequoia-pgp.org>
+Date: Fri, 20 Feb 2026 13:50:40 +0100
+Subject: [PATCH] Fix missing time corrections
+
+- `gpg-sq` can set a fake system time via `--faked-system-time`.
+- Fixed some occurrences where `None` was used as time instead of the
+  passed fake time.
+- fixes: #156
+---
+ src/decrypt.rs       | 2 +-
+ src/generate_key.rs  | 2 +-
+ src/gpg.rs           | 2 +-
+ tests/gpg/decrypt.rs | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/decrypt.rs b/src/decrypt.rs
+index 2749532..d722389 100644
+--- a/src/decrypt.rs
++++ b/src/decrypt.rs
+@@ -715,7 +715,7 @@ impl<'a, 'store> DHelper<'a, 'store> {
+                         .filter_map(|cert| cert.to_cert().ok().cloned())
+                     {
+                         if let Some(key) = cert.keys()
+-                            .with_policy(&self.config.de_vs_producer, None)
++                            .with_policy(&self.config.de_vs_producer, self.config.now())
+                             .key_handle(recipient.clone()).next()
+                         {
+                             compliant = compliant &&
+diff --git a/src/generate_key.rs b/src/generate_key.rs
+index 85e41b4..5dd42f9 100644
+--- a/src/generate_key.rs
++++ b/src/generate_key.rs
+@@ -280,7 +280,7 @@ async fn real_cmd_quick_add_key(config: &mut crate::Config<'_>, args: &[String])
+             all_expired_or_revoked: false,
+         })?;
+ 
+-    let vcert = cert.with_policy(config.policy(), None)?;
++    let vcert = cert.with_policy(config.policy(), config.now())?;
+     let mut primary_signer =
+         config.get_signer(&vcert, cert.primary_key().role_as_unspecified()).await?;
+ 
+diff --git a/src/gpg.rs b/src/gpg.rs
+index 81d5353..b4e4d38 100644
+--- a/src/gpg.rs
++++ b/src/gpg.rs
+@@ -721,7 +721,7 @@ impl<'store> Config<'store> {
+                             all_expired_or_revoked: false,
+                         })?;
+ 
+-                    if let Ok(vcert) = cert.with_policy(self.policy(), None) {
++                    if let Ok(vcert) = cert.with_policy(self.policy(), self.now()) {
+                         for sk in vcert.keys().key_flags(&flags).alive()
+                             .revoked(false)
+                         {
+diff --git a/tests/gpg/decrypt.rs b/tests/gpg/decrypt.rs
+index 3fefe95..a34f693 100644
+--- a/tests/gpg/decrypt.rs
++++ b/tests/gpg/decrypt.rs
+@@ -489,7 +489,7 @@ fn encrypt_for(recipient_certs: &[&Cert]) -> Result<Vec<u8>> {
+         // Make sure we add at least one subkey from every
+         // certificate.
+         let mut found_one = false;
+-        for key in cert.keys().with_policy(p, None)
++        for key in cert.keys().with_policy(p, Experiment::now())
+             .supported().alive().revoked(false).for_transport_encryption()
+         {
+             recipients.push(key);
+-- 
+GitLab

app-crypt/sequoia-chameleon-gnupg/sequoia-chameleon-gnupg-0.13.1-r4.ebuild

@@ -0,0 +1,109 @@
+# Copyright 2023-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+CRATES="
+"
+
+LLVM_COMPAT=( {18..20} )
+RUST_MIN_VER="1.79.0"
+
+inherit cargo llvm-r1 shell-completion xdg-utils
+
+DESCRIPTION="Sequoia's reimplementation of the GnuPG interface"
+HOMEPAGE="https://sequoia-pgp.org/ https://gitlab.com/sequoia-pgp/sequoia-chameleon-gnupg/"
+SRC_URI="
+	https://gitlab.com/sequoia-pgp/sequoia-chameleon-gnupg/-/archive/v${PV}/${P}-v${PV}.tar.bz2
+	${CARGO_CRATE_URIS}
+"
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-crates.tar.xz"
+S="${WORKDIR}"/${PN}-v${PV}-6fbe6d0fba83d5324ddf66a45cd349a458044b58
+
+LICENSE="GPL-3+"
+# Dependent crate licenses
+LICENSE+="
+	0BSD Apache-2.0 BSD Boost-1.0 CC0-1.0 ISC LGPL-2+ MIT MPL-2.0
+	Unicode-3.0
+	|| ( GPL-2 GPL-3 LGPL-3 )
+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+IUSE="botan test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	app-arch/bzip2
+	dev-db/sqlite:3
+	dev-libs/openssl:=
+	botan? ( dev-libs/botan:3= )
+"
+# gpg-agent needed for secret key operations
+# https://gitlab.com/sequoia-pgp/sequoia-chameleon-gnupg#gpg-sq
+RDEPEND="
+	${DEPEND}
+	|| (
+		app-crypt/gnupg
+		app-crypt/freepg
+	)
+"
+# Clang needed for bindgen
+BDEPEND="
+	$(llvm_gen_dep '
+		llvm-core/clang:${LLVM_SLOT}
+	')
+	test? (
+		app-crypt/sequoia-sq
+	)
+	virtual/pkgconfig
+"
+
+QA_FLAGS_IGNORED="usr/bin/gpg-sq usr/bin/gpgv-sq"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-tests.patch
+)
+
+pkg_setup() {
+	llvm-r1_pkg_setup
+	rust_pkg_setup
+}
+
+src_configure() {
+	# https://wiki.gentoo.org/wiki/Project:Rust/sys_crates#bzip2-sys
+	mkdir "${T}/pkg-config" || die
+	export PKG_CONFIG_PATH=${T}/pkg-config${PKG_CONFIG_PATH+:${PKG_CONFIG_PATH}}
+	cat >> "${T}/pkg-config/bzip2.pc" <<-EOF || die
+		Name: bzip2
+		Version: 9999
+		Description:
+		Libs: -lbz2
+	EOF
+
+	local myfeatures=(
+		$(usex botan crypto-{botan,openssl})
+	)
+
+	cargo_src_configure --no-default-features
+
+	export ASSET_OUT_DIR=${T}/assets
+}
+
+src_test() {
+	# long temporary file paths change output wrapping which leads
+	# to completely confusing test failures
+	local -x TMPDIR=/tmp
+
+	xdg_environment_reset
+	RUST_BACKTRACE=full cargo_src_test -vv --no-fail-fast
+}
+
+src_install() {
+	cargo_src_install
+
+	doman "${T}"/assets/man-pages/*
+	newbashcomp "${T}"/assets/shell-completions/gpg-sq.bash gpg-sq
+	newbashcomp "${T}"/assets/shell-completions/gpgv-sq.bash gpgv-sq
+	dofishcomp "${T}"/assets/shell-completions/*.fish
+	dozshcomp "${T}"/assets/shell-completions/_gpg{,v}-sq
+}