flatcar · krnowak · Feb 20, 2026 · Jan 12, 2026 · Jan 12, 2026 · Jan 12, 2026
@@ -3,6 +3,7 @@
 acct-group/adm
 acct-group/audio
 acct-group/cdrom
+acct-group/cuse
 acct-group/dialout
 acct-group/disk
 acct-group/dnsmasq
@@ -11,6 +12,7 @@ acct-group/floppy
 acct-group/incus
 acct-group/incus-admin
 acct-group/input
+acct-group/jobserver
 acct-group/kmem
 acct-group/kvm
 acct-group/lp
@@ -303,7 +305,6 @@ dev-libs/yajl
 
 dev-perl/File-Slurper
 dev-perl/Parse-Yapp
-dev-perl/PerlIO-utf8_strict
 
 dev-python/backports-tarfile
 dev-python/cachecontrol
@@ -392,6 +393,7 @@ dev-util/pkgcheck
 dev-util/pkgconf
 dev-util/re2c
 dev-util/xdelta
+dev-util/xxd
 
 dev-vcs/git
 
@@ -401,6 +403,7 @@ eclass/alternatives.eclass
 eclass/app-alternatives.eclass
 eclass/autotools.eclass
 eclass/bash-completion-r1.eclass
+eclass/branding.eclass
 eclass/cargo.eclass
 eclass/check-reqs.eclass
 eclass/cmake-multilib.eclass
@@ -750,7 +753,6 @@ virtual/perl-Carp
 virtual/perl-Encode
 virtual/perl-Exporter
 virtual/perl-ExtUtils-MakeMaker
-virtual/perl-XSLoader
 virtual/pkgconfig
 virtual/resolvconf
 virtual/service-manager

@@ -28,13 +28,37 @@ build_target_toolchain() {
     local ROOT="/build/${board}"
     local SYSROOT="/usr/$(get_board_chost "${board}")"
 
-    mkdir -p "${ROOT}/usr"
-    cp -at "${ROOT}" "${SYSROOT}"/lib*
-    cp -at "${ROOT}"/usr "${SYSROOT}"/usr/include "${SYSROOT}"/usr/lib*
+    function btt_emerge() {
+        # --root is required because run_merge overrides ROOT=
+        PORTAGE_CONFIGROOT="$ROOT" run_merge --root="$ROOT" --sysroot="$ROOT" "${@}"
+    }
 
-    # --root is required because run_merge overrides ROOT=
-    PORTAGE_CONFIGROOT="$ROOT" \
-        run_merge -u --root="$ROOT" --sysroot="$ROOT" "${TOOLCHAIN_PKGS[@]}"
+    # install baselayout first so we have the basic directory
+    # structure for libraries and binaries copied from sysroot
+    btt_emerge --oneshot --nodeps sys-apps/baselayout
+
+    # copy libraries, binaries and header files from sysroot to root -
+    # sysroot may be using split-usr, whereas root does not, so take
+    # this into account
+    (
+        shopt -s nullglob
+        local d f
+        local -a files
+        for d in "${SYSROOT}"/{,usr/}{bin,sbin,lib*}; do
+            if [[ ! -d ${d} ]]; then
+                continue
+            fi
+            files=( "${d}"/* )
+            if [[ ${#files[@]} -gt 0 ]]; then
+                f=${d##*/}
+                cp -at "${ROOT}/usr/${f}" "${files[@]}"
+            fi
+        done
+        cp -at "${ROOT}"/usr "${SYSROOT}"/usr/include
+    )
+
+    btt_emerge --update "${TOOLCHAIN_PKGS[@]}"
+    unset -f btt_emerge
 }
 
 configure_crossdev_overlay / /usr/local/portage/crossdev

@@ -490,10 +490,14 @@ binutils_set_latest_profile() {
 # The extra flag can be blank, hardenednopie, and so on. See gcc-config -l
 # Usage: gcc_get_latest_profile chost [extra]
 gcc_get_latest_profile() {
-    local prefix="${1}-"
-    local suffix="${2+-$2}"
+    local prefix=${1}
+    local suffix=${2+-${2}}
     local status
-    gcc-config -l | cut -d' ' -f3 | grep "^${prefix}[0-9\\.]*${suffix}$" | tail -n1
+    gcc-config --list-profiles --nocolor | \
+        sed -e 's/^\s*//' | \
+        cut -d' ' -f2 | \
+        grep "^${prefix}-[0-9\\.]*${suffix}$" | \
+        tail -n1
 
     # return 1 if anything in the above pipe failed
     for status in ${PIPESTATUS[@]}; do

@@ -269,16 +269,18 @@ if [[ "${FLAGS_usepkgonly}" -eq "${FLAGS_FALSE}" ]]; then
   # systemd[cryptsetup] -> cryptsetup[udev] -> virtual/udev -> systemd
   # systemd[tpm] -> tpm2-tss -> util-linux[udev] -> virtual/udev -> systemd
   # curl[http2] -> nghttp2[systemd] -> systemd[curl] -> curl
-  # sys-libs/pam[systemd] -> sys-apps/system[pam] -> sys-libs/pam
-  #   not dropping pam from sys-apps/systemd, otherwise we would need
-  #   to drop pam from sys-auth/pambase
-  break_dep_loop sys-apps/util-linux udev,systemd,cryptsetup \
+  # sys-libs/pam[systemd] -> sys-apps/systemd[pam] -> sys-libs/pam
+  #   dropping USE=pam from sys-apps/systemd requires dropping
+  #   USE=systemd from sys-auth/pambase
+  # sys-auth/pambase[sssd] -> sys-auth/sssd -> sys-apps/shadow[pam] -> sys-auth/pambase
+  break_dep_loop sys-apps/util-linux cryptsetup,systemd,udev \
                  sys-fs/cryptsetup udev \
-                 sys-fs/lvm2 udev,systemd \
-                 sys-apps/systemd cryptsetup,tpm \
+                 sys-fs/lvm2 systemd,udev \
+                 sys-apps/systemd cryptsetup,pam,tpm \
                  net-misc/curl http2 \
                  net-libs/nghttp2 systemd \
-                 sys-libs/pam systemd
+                 sys-libs/pam systemd \
+                 sys-auth/pambase sssd,systemd
 fi
 
 if [[ "${FLAGS_only_resolve_circular_deps}" -eq "${FLAGS_TRUE}" ]]; then

@@ -0,0 +1,6 @@
+- bind ([CVE-2025-40778](https://www.cve.org/CVERecord?id=CVE-2025-40778), [CVE-2025-40780](https://www.cve.org/CVERecord?id=CVE-2025-40780), [CVE-2025-8677](https://www.cve.org/CVERecord?id=CVE-2025-8677))
+- gnutls ([CVE-2025-9820](https://www.cve.org/CVERecord?id=CVE-2025-9820))
+- go ([CVE-2025-61727](https://www.cve.org/CVERecord?id=CVE-2025-61727), [CVE-2025-61729](https://www.cve.org/CVERecord?id=CVE-2025-61729))
+- libarchive ([CVE-2025-60753](https://www.cve.org/CVERecord?id=CVE-2025-60753))
+- podman ([CVE-2025-9566](https://www.cve.org/CVERecord?id=CVE-2025-9566), [CVE-2025-52881](https://www.cve.org/CVERecord?id=CVE-2025-52881))
+- urllib3 ([CVE-2025-66418](https://www.cve.org/CVERecord?id=CVE-2025-66418), [CVE-2025-66471](https://www.cve.org/CVERecord?id=CVE-2025-66471))
@@ -0,0 +1,56 @@
+- SDK: cmake ([4.1.4](https://cmake.org/cmake/help/v4.1/release/4.1.html#updates))
+- SDK: crossdev ([20251214](https://gitweb.gentoo.org/proj/crossdev.git/log/?h=20251214))
+- SDK: go ([1.25.5](https://go.dev/doc/devel/release#go1.25.minor))
+- SDK: perl ([5.42.0](https://perldoc.perl.org/perl5420delta))
+- SDK: rust ([1.91.0](https://blog.rust-lang.org/2025/10/30/Rust-1.91.0/) (includes [1.90.0](https://blog.rust-lang.org/2025/09/18/Rust-1.90.0/)))
+- azure, dev, sysext-python: urllib3 ([2.6.3](https://raw.githubusercontent.com/urllib3/urllib3/refs/tags/2.6.3/CHANGES.rst))
+- base, dev: bash ([5.3_p9](https://cgit.git.savannah.gnu.org/cgit/bash.git/log/?id=637f5c8696a6adc9b4519f1cd74aa78492266b7f))
+- base, dev: bind ([9.18.42](https://bind9.readthedocs.io/en/v9.18.42/notes.html#notes-for-bind-9-18-42))
+- base, dev: binutils-config ([5.6](https://gitweb.gentoo.org/proj/binutils-config.git/log/?h=v5.6))
+- base, dev: btrfs-progs ([6.17.1](https://github.com/kdave/btrfs-progs/releases/tag/v6.17.1))
+- base, dev: coreutils ([9.9](https://lists.gnu.org/archive/html/coreutils-announce/2025-11/msg00000.html))
+- base, dev: cri-tools ([1.33.0](https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.33.0))
+- base, dev: curl ([8.17.0](https://curl.se/ch/8.17.0.html))
+- base, dev: elfutils ([0.194](https://inbox.sourceware.org/elfutils-devel/CAJDtP-S0rYAOZQeDZvMtPkQztgK9RboWtYwpqNLCNGNdaSGn-A@mail.gmail.com/T/#u))
+- base, dev: git ([2.52.0](https://raw.githubusercontent.com/git/git/refs/tags/v2.52.0/Documentation/RelNotes/2.52.0.adoc))
+- base, dev: gnutls ([3.8.11](https://lists.gnu.org/archive/html/info-gnu/2025-11/msg00003.html))
+- base, dev: kexec-tools ([2.0.32](https://github.com/horms/kexec-tools/commits/v2.0.32/))
+- base, dev: libarchive ([3.8.5](https://github.com/libarchive/libarchive/releases/tag/v3.8.5) (includes [3.8.4](https://github.com/libarchive/libarchive/releases/tag/v3.8.4), [3.8.3](https://github.com/libarchive/libarchive/releases/tag/v3.8.3), [3.8.2](https://github.com/libarchive/libarchive/releases/tag/v3.8.2)))
+- base, dev: libcap ([2.77](https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.mr55t4z9vzea))
+- base, dev: libnftnl ([1.3.1](https://lwn.net/Articles/1049279/))
+- base, dev: libnl ([3.11.0](https://lists.infradead.org/pipermail/libnl/2024-October/002441.html))
+- base, dev: libnvme ([1.16.1](https://github.com/linux-nvme/libnvme/releases/tag/v1.16.1) (includes [1.16](https://github.com/linux-nvme/libnvme/releases/tag/v1.16)))
+- base, dev: libpcre2 ([10.47](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.47))
+- base, dev: libxml2 ([2.15.1](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.15.1) (includes [2.15.0](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.15.0)))
+- base, dev: nvme-cli ([2.16](https://github.com/linux-nvme/nvme-cli/releases/tag/v2.16))
+- base, dev: pambase ([20251104](https://gitweb.gentoo.org/proj/pambase.git/log/?h=pambase-20251104))
+- base, dev: readline ([8.3_p3](https://cgit.git.savannah.gnu.org/cgit/readline.git/log/?id=553d6bb272f26400d6d4d1cac7c1df84c447449b))
+- base, dev: selinux-base ([2.20250618](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250618))
+- base, dev: systemd ([257.10](https://github.com/systemd/systemd/commits/v257.10/))
+- base, dev: thin-provisioning-tools ([1.3.1](https://raw.githubusercontent.com/device-mapper-utils/thin-provisioning-tools/refs/tags/v1.3.1/CHANGES))
+- base, dev: usbutils ([019](https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usbutils.git/plain/NEWS?h=v019))
+- base, dev: userspace-rcu ([0.15.5](https://lwn.net/Articles/1046059/))
+- base, dev: xfsprogs ([6.17.0](https://web.git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/plain/doc/CHANGES?h=v6.17.0))
+- dev, sysext-incus: squashfs-tools ([4.7.4](https://github.com/plougher/squashfs-tools/releases?q=4.7.4))
+- dev: bash-completion ([2.17.0](https://github.com/scop/bash-completion/releases/tag/2.17.0))
+- dev: binutils ([2.45.1](https://sourceware.org/pipermail/binutils/2025-November/145592.html))
+- dev: cJSON ([1.7.19](https://github.com/DaveGamble/cJSON/releases/tag/v1.7.19))
+- dev: gcc-config ([2.12.2](https://gitweb.gentoo.org/proj/gcc-config.git/log/?h=v2.12.2))
+- dev: portage ([3.0.72](https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.72) (includes [3.0.71](https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.71), [3.0.70](https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.70)))
+- sysext-containerd: containerd ([2.2.0](https://github.com/containerd/containerd/releases/tag/v2.2.0))
+- sysext-containerd: runc ([1.4.0](https://github.com/opencontainers/runc/releases/tag/v1.4.0))
+- sysext-docker: docker ([28.2.2](https://github.com/moby/moby/releases/tag/v28.2.2) (includes [28.2.1](https://github.com/moby/moby/releases/tag/v28.2.1), [28.2.0](https://github.com/moby/moby/releases/tag/v28.2.0), [28.1.1](https://github.com/moby/moby/releases/tag/v28.1.1), [28.1.0](https://github.com/moby/moby/releases/tag/v28.1.0)))
+- sysext-docker: docker-cli ([28.4.0](https://github.com/moby/moby/releases/tag/v28.4.0) (includes [28.3.0](https://github.com/moby/moby/releases/tag/v28.3.0), [28.2.0](https://github.com/moby/moby/releases/tag/v28.2.0), [28.1.0](https://github.com/moby/moby/releases/tag/v28.1.0)))
+- sysext-incus: incus ([6.0.5](https://discuss.linuxcontainers.org/t/incus-6-0-5-lts-has-been-released/24445))
+- sysext-incus: lxc ([6.0.5](https://discuss.linuxcontainers.org/t/lxc-6-0-5-lts-has-been-released/24438))
+- sysext-incus: lxcfs ([6.0.5](https://discuss.linuxcontainers.org/t/lxcfs-6-0-5-lts-has-been-released/24437))
+- sysext-nvidia-drivers-570, sysext-nvidia-drivers-570-open: nvidia-drivers (570.207)
+- sysext-podman: containers-image ([5.35.0](https://github.com/containers/image/releases/tag/v5.35.0))
+- sysext-podman: podman ([5.7.0](https://github.com/containers/podman/releases/tag/v5.7.0) (includes [5.6.0](https://github.com/containers/podman/releases/tag/v5.6.0)))
+- sysext-python: charset-normalizer ([3.4.4](https://github.com/jawah/charset_normalizer/releases/tag/3.4.4))
+- sysext-python: idna ([3.11](https://github.com/kjd/idna/releases/tag/v3.11))
+- sysext-python: msgpack ([1.1.2](https://github.com/msgpack/msgpack-python/releases/tag/v1.1.2))
+- sysext-python: pip ([25.3](https://github.com/pypa/pip/blob/25.3/NEWS.rst))
+- sysext-python: setuptools-scm ([9.2.2](https://github.com/pypa/setuptools-scm/releases/tag/v9.2.2))
+- sysext-python: trove-classifiers ([2025.11.14.15](https://github.com/pypa/trove-classifiers/releases/tag/2025.11.14.15))
+- sysext-zfs: zfs ([2.3.4](https://github.com/openzfs/zfs/releases/tag/zfs-2.3.4))
@@ -1,3 +1,21 @@
-cros_pre_src_compile_pkgconfig() {
-	export PKG_CONFIG="$(tc-getPKG_CONFIG)"
+# https://codeberg.org/gentoo/gentoo/pulls/36
+cros_post_src_compile_move_agent_binaries() {
+    local bindir="_dist/bin"
+    local host_arch=$(go-env_goarch "${CBUILD}")
+    if [[ "${GOARCH}" = "${host_arch}" ]]; then
+        # nothing to fix
+        return 0
+    fi
+    local correct_bindir="_dist/bin/linux_${GOARCH}"
+    mv '_dist/bin/incus-agent.'* "${correct_bindir}" || die
+}
+
+# https://codeberg.org/gentoo/gentoo/pulls/36
+cros_post_src_install_move_agent_binaries() {
+    if use amd64; then
+        # nothing to fix
+        return 0
+    fi
+    dodir '/usr/libexec/incus/agents'
+    mv "${ED}/usr/libexec/incus/incus-agent."* "${ED}/usr/libexec/incus/agents" || die
 }