Adding metadata

7 files changed, 354 insertions, 0 deletions

diff --git a/dev-debug/sysdig/Manifest b/dev-debug/sysdig/Manifest
new file mode 100644
index 000000000000..8c80b43fae88
--- /dev/null
+++ b/dev-debug/sysdig/Manifest
@@ -0,0 +1,2 @@
+DIST falcosecurity-libs-0.20.0.tar.gz 4545190 BLAKE2B 93a074ab6451c16c7ad58498ac580f0476339e7dee65112e56142307f79966c43b69c71234a784aff03f47ec2e37e838e797beb4b36e9c105db88cf32cad135e SHA512 b5ef481bda92a29b7b409baee25dabd0b766e4bbcac762740635f99b36cd823a6d98f541817fd03b1a86a1385d3fe24888b33b84dc3486cd9f8d00e5384eb705
+DIST sysdig-0.40.1.tar.gz 68296332 BLAKE2B 17ed9154d1e955dc18700ab764f0fce11461bea9b6970e8661761269d4f0bbb786ddd8a4cc4c806121a52d0d486080fc231f2447dc69d26d41fa582c1dabda41 SHA512 a50372192ea8708d19ede0550659a2f7ea6b535b419d649ae9b52e32f9c71576f0a3e3ab85dcc8d23f792dff078f15eca1435a1e402e3d98aba7eefc1920989e
diff --git a/dev-debug/sysdig/files/0.38.1-scap-loader.patch b/dev-debug/sysdig/files/0.38.1-scap-loader.patch
new file mode 100644
index 000000000000..1f350948b37a
--- /dev/null
+++ b/dev-debug/sysdig/files/0.38.1-scap-loader.patch
@@ -0,0 +1,32 @@
+
+Sanitize the scap loader script to not attempt driver downloads or compilation
+by default, which would not work anyway as sysdig does not host prebuilt modules
+for Gentoo.
+
+Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+
+--- sysdig-0.38.0/scripts/scap-driver-loader.in~ 2024-06-17 11:14:55.000000000 +0200
++++ sysdig-0.38.0/scripts/scap-driver-loader.in	2024-06-17 11:14:55.000000000 +0200
+@@ -662,8 +662,8 @@ print_usage() {
+ 	echo "Options:"
+ 	echo "  --help         show brief help"
+ 	echo "  --clean        try to remove an already present driver installation"
+-	echo "  --compile      try to compile the driver locally (default true)"
+-	echo "  --download     try to download a prebuilt driver (default true)"
++	echo "  --compile      try to compile the driver locally (default false)"
++	echo "  --download     try to download a prebuilt driver (default false)"
+ 	echo "  --source-only  skip execution and allow sourcing in another script"
+ 	echo ""
+ 	echo "Environment variables:"
+@@ -770,11 +770,6 @@ while test $# -gt 0; do
+ 	esac
+ done
+ 
+-if [ -z "$has_opts" ]; then
+-	ENABLE_COMPILE="yes"
+-	ENABLE_DOWNLOAD="yes"
+-fi
+-
+ if [ -z "$source_only" ]; then
+ 	echo "* Running scap-driver-loader for: driver version=${DRIVER_VERSION}, arch=${ARCH}, kernel release=${KERNEL_RELEASE}, kernel version=${KERNEL_VERSION}"
+ 
diff --git a/dev-debug/sysdig/files/libs-0.20.0-fix-INET6_ADDRSTRLEN-buffer-size.patch b/dev-debug/sysdig/files/libs-0.20.0-fix-INET6_ADDRSTRLEN-buffer-size.patch
new file mode 100644
index 000000000000..f2ea81289e0f
--- /dev/null
+++ b/dev-debug/sysdig/files/libs-0.20.0-fix-INET6_ADDRSTRLEN-buffer-size.patch
@@ -0,0 +1,54 @@
+Backported patch from: https://github.com/falcosecurity/libs/pull/2574
+
+glibc-2.42 added __inet_ntop_chk fortification, which started to fail:
+
+*** buffer overflow detected ***: terminated
+Program received signal SIGABRT, Aborted.
+0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
+(gdb) bt
+#0  0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
+#1  0x00007ffff6242572 in raise () from /lib64/libc.so.6
+#2  0x00007ffff6229f3b in abort () from /lib64/libc.so.6
+#3  0x00007ffff622b148 in __libc_message_impl.cold () from /lib64/libc.so.6
+#4  0x00007ffff6327337 in __fortify_fail () from /lib64/libc.so.6
+#5  0x00007ffff6326c92 in __chk_fail () from /lib64/libc.so.6
+#6  0x00007ffff6327a62 in __inet_ntop_chk () from /lib64/libc.so.6
+#7  0x000055555569da3d in inet_ntop (__af=10, __src=0x555555ee0800, __dst=0x7fffffff4f90 "\260P\377\377\377\177", __dst_size=100) at /usr/include/bits/inet-fortified.h:36
+#8  ipv6tuple_to_string[abi:cxx11](ipv6tuple*, bool) (tuple=0x555555ee0800, resolve=false) at /tmp/portage/dev-debug/sysdig-0.40.1/work/libs-0.20.0/userspace/libsinsp/utils.cpp:1110
+
+Pass a target buffer size appropriate for IPv addresses.
+
+--- libs-0.20.0/userspace/libsinsp/utils.cpp
++++ libs-0.20.0-new/userspace/libsinsp/utils.cpp
+@@ -1089,13 +1089,13 @@ std::string ipv4tuple_to_string(ipv4tupl
+ }
+ 
+ std::string ipv6serveraddr_to_string(ipv6serverinfo* addr, bool resolve) {
+-	char address[100];
+-	char buf[200];
++	char address[INET6_ADDRSTRLEN];
+ 
+-	if(NULL == inet_ntop(AF_INET6, addr->m_ip.m_b, address, 100)) {
++	if(NULL == inet_ntop(AF_INET6, addr->m_ip.m_b, address, INET6_ADDRSTRLEN)) {
+ 		return std::string();
+ 	}
+ 
++	char buf[200];
+ 	snprintf(buf,
+ 	         200,
+ 	         "%s:%s",
+@@ -1107,12 +1107,12 @@ std::string ipv6serveraddr_to_string(ipv
+ 
+ std::string ipv6tuple_to_string(ipv6tuple* tuple, bool resolve) {
+ 	char source_address[INET6_ADDRSTRLEN];
+-	if(NULL == inet_ntop(AF_INET6, tuple->m_fields.m_sip.m_b, source_address, 100)) {
++	if(NULL == inet_ntop(AF_INET6, tuple->m_fields.m_sip.m_b, source_address, INET6_ADDRSTRLEN)) {
+ 		return std::string();
+ 	}
+ 
+ 	char destination_address[INET6_ADDRSTRLEN];
+-	if(NULL == inet_ntop(AF_INET6, tuple->m_fields.m_dip.m_b, destination_address, 100)) {
++	if(NULL == inet_ntop(AF_INET6, tuple->m_fields.m_dip.m_b, destination_address, INET6_ADDRSTRLEN)) {
+ 		return std::string();
+ 	}
+ 
diff --git a/dev-debug/sysdig/files/libs-0.20.0-fix-buffer-overrun-reading-sockets-from-procfs.patch b/dev-debug/sysdig/files/libs-0.20.0-fix-buffer-overrun-reading-sockets-from-procfs.patch
new file mode 100644
index 000000000000..238cd12ac540
--- /dev/null
+++ b/dev-debug/sysdig/files/libs-0.20.0-fix-buffer-overrun-reading-sockets-from-procfs.patch
@@ -0,0 +1,35 @@
+Patch from:
+https://github.com/falcosecurity/libs/commit/de3f4cac9233682eae63c63377c82efb649679f5
+
+From de3f4cac9233682eae63c63377c82efb649679f5 Mon Sep 17 00:00:00 2001
+From: Shane Lawrence <shane@lawrence.dev>
+Date: Thu, 20 Feb 2025 14:55:41 +0000
+Subject: [PATCH] Fix buffer overrun reading sockets from procfs.
+
+Signed-off-by: Shane Lawrence <shane@lawrence.dev>
+---
+ userspace/libscap/linux/scap_fds.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/userspace/libscap/linux/scap_fds.c b/userspace/libscap/linux/scap_fds.c
+index f98ac3f32f..73e99ca428 100644
+--- a/userspace/libscap/linux/scap_fds.c
++++ b/userspace/libscap/linux/scap_fds.c
+@@ -766,7 +766,7 @@ int32_t scap_fd_read_ipv4_sockets_from_proc_fs(const char *dir,
+ 					break;
+ 				}
+ 
+-				while(*scan_pos == ' ' && scan_pos < scan_end) {
++				while(scan_pos < scan_end && *scan_pos == ' ') {
+ 					scan_pos++;
+ 				}
+ 
+@@ -974,7 +974,7 @@ int32_t scap_fd_read_ipv6_sockets_from_proc_fs(char *dir,
+ 					break;
+ 				}
+ 
+-				while(*scan_pos == ' ' && scan_pos < scan_end) {
++				while(scan_pos < scan_end && *scan_pos == ' ') {
+ 					scan_pos++;
+ 				}
+ 
diff --git a/dev-debug/sysdig/files/libs-0.20.0-fix-driver-and-bpf-makefile-for-kernel-6.13.patch b/dev-debug/sysdig/files/libs-0.20.0-fix-driver-and-bpf-makefile-for-kernel-6.13.patch
new file mode 100644
index 000000000000..f0c16d176d12
--- /dev/null
+++ b/dev-debug/sysdig/files/libs-0.20.0-fix-driver-and-bpf-makefile-for-kernel-6.13.patch
@@ -0,0 +1,39 @@
+Patch from:
+https://github.com/falcosecurity/libs/commit/7f01ec89c565fcb45ade833b1312ae69637bc4ec
+
+From: Federico Di Pierro <nierro92@gmail.com>
+Date: Fri, 28 Mar 2025 08:35:23 +0100
+Subject: [PATCH] fix(driver): fix driver and bpf makefile for linux 6.13.
+
+Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
+---
+ driver/Makefile.in  | 2 +-
+ driver/bpf/Makefile | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/driver/Makefile.in b/driver/Makefile.in
+index 7b1fdc2dba..ec60103d0d 100644
+--- a/driver/Makefile.in
++++ b/driver/Makefile.in
+@@ -29,7 +29,7 @@ install: all
+ 
+ else
+ 
+-KERNELDIR 	?= $(CURDIR)
++KERNELDIR 	?= $(realpath $(objtree))
+ #
+ # Get the path of the module sources
+ #
+diff --git a/driver/bpf/Makefile b/driver/bpf/Makefile
+index 58d1b11165..c94647c608 100644
+--- a/driver/bpf/Makefile
++++ b/driver/bpf/Makefile
+@@ -28,7 +28,7 @@ clean:
+ 
+ else
+ 
+-KERNELDIR 	?= $(CURDIR)
++KERNELDIR 	?= $(realpath $(objtree))
+ #
+ # Get the path of the module sources
+ #
diff --git a/dev-debug/sysdig/metadata.xml b/dev-debug/sysdig/metadata.xml
new file mode 100644
index 000000000000..8c8cf93b9e02
--- /dev/null
+++ b/dev-debug/sysdig/metadata.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>holger@applied-asynchrony.com</email>
+    <name>Holger Hoffstätte</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <use>
+    <flag name="bpf">Enable the BPF probe as alternative event source
+			to <pkg>dev-debug/scap-driver</pkg>.</flag>
+    <flag name="modules">Build kernel modules needed for tracing local
+			events. Disable this only if you intend to use sysdig purely
+			to work with dumpfiles.</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/dev-debug/sysdig/sysdig-0.40.1-r1.ebuild b/dev-debug/sysdig/sysdig-0.40.1-r1.ebuild
new file mode 100644
index 000000000000..aefc4494bab5
--- /dev/null
+++ b/dev-debug/sysdig/sysdig-0.40.1-r1.ebuild
@@ -0,0 +1,172 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+
+inherit bash-completion-r1 cmake flag-o-matic linux-info lua-single
+
+DESCRIPTION="A system exploration and troubleshooting tool"
+HOMEPAGE="https://www.sysdig.com/"
+
+# The version of falcosecurity-libs required by sysdig as source tree
+LIBS_VERSION="0.20.0"
+LIBS="falcosecurity-libs-${LIBS_VERSION}"
+
+SRC_URI="https://github.com/draios/sysdig/archive/${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/falcosecurity/libs/archive/${LIBS_VERSION}.tar.gz -> ${LIBS}.tar.gz"
+
+# The driver version as found in cmake/modules/driver.cmake or alternatively
+# as git tag on the $LIBS_VERSION of falcosecurity-libs.
+DRIVER_VERSION="8.0.0+driver"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~x86"
+IUSE="bpf +modules"
+REQUIRED_USE="${LUA_REQUIRED_USE}"
+
+RDEPEND="${LUA_DEPS}
+	dev-cpp/abseil-cpp:=
+	dev-cpp/tbb:=
+	dev-cpp/yaml-cpp:=
+	dev-libs/jsoncpp:=
+	dev-libs/libb64:=
+	bpf? ( >=dev-libs/libbpf-1.1:= )
+	dev-libs/protobuf:=
+	dev-libs/re2:=
+	dev-libs/uthash
+	net-libs/grpc:=
+	net-misc/curl
+	sys-libs/ncurses:=
+	virtual/zlib:=
+	virtual/libelf:="
+
+DEPEND="${RDEPEND}
+	dev-cpp/nlohmann_json
+	dev-cpp/valijson
+	virtual/os-headers"
+
+BDEPEND="bpf? (
+			dev-util/bpftool
+			llvm-core/clang:*[llvm_targets_BPF]
+		)"
+
+# pin the driver to the falcosecurity-libs version
+PDEPEND="modules? ( =dev-debug/scap-driver-${LIBS_VERSION}* )"
+
+PATCHES=(
+	"${FILESDIR}/0.38.1-scap-loader.patch"
+)
+
+pkg_pretend() {
+	if use bpf; then
+		local CONFIG_CHECK="
+			~BPF
+			~BPF_EVENTS
+			~BPF_JIT
+			~BPF_SYSCALL
+			~FTRACE_SYSCALLS
+			~HAVE_EBPF_JIT
+		"
+		check_extra_config
+	fi
+}
+
+src_prepare() {
+	# manually apply patches to falcosecurity-libs
+	pushd "${WORKDIR}/libs-${LIBS_VERSION}"
+		eapply "${FILESDIR}/libs-0.20.0-fix-buffer-overrun-reading-sockets-from-procfs.patch" || die
+		eapply "${FILESDIR}/libs-0.20.0-fix-driver-and-bpf-makefile-for-kernel-6.13.patch" || die
+		eapply "${FILESDIR}/libs-0.20.0-fix-INET6_ADDRSTRLEN-buffer-size.patch" || die
+	popd
+
+	# do not build with debugging info
+	sed -i -e 's/-ggdb//g' CMakeLists.txt "${WORKDIR}"/libs-${LIBS_VERSION}/cmake/modules/CompilerFlags.cmake || die
+
+	# fix the driver version
+	sed -i -e 's/0.0.0-local/${DRIVER_VERSION}/g' cmake/modules/driver.cmake || die
+
+	cmake_src_prepare
+}
+
+src_configure() {
+	# known problems with strict aliasing:
+	# https://github.com/falcosecurity/libs/issues/1964
+	append-flags -fno-strict-aliasing
+
+	local mycmakeargs=(
+		# do not build the kernel driver
+		-DBUILD_DRIVER=OFF
+		-DENABLE_DKMS=OFF
+
+		# disable all test targets
+		-DCREATE_TEST_TARGETS=OFF
+
+		# libscap examples are not installed or really useful
+		-DBUILD_LIBSCAP_EXAMPLES=OFF
+
+		# do not build internal libs as shared
+		-DBUILD_SHARED_LIBS=OFF
+
+		# build modern BPF probe depending on USE
+		-DBUILD_SYSDIG_MODERN_BPF=$(usex bpf)
+
+		# set driver location/version
+		-DDRIVER_SOURCE_DIR="${WORKDIR}"/libs-${LIBS_VERSION}/driver
+		-DDRIVER_VERSION=${DRIVER_VERSION}
+
+		# point sysdig to the libs tree
+		-DUSE_BUNDLED_FALCOSECURITY_LIBS=ON
+		-DFALCOSECURITY_LIBS_SOURCE_DIR="${WORKDIR}"/libs-${LIBS_VERSION}
+
+		# explicitly set sysdig version - required for some reason
+		-DSYSDIG_VERSION=${PV}
+
+		# do not use bundled dependencies for sysdig
+		-DUSE_BUNDLED_DEPS=OFF
+
+		# do not use bundled dependencies for falcosecurity-libs
+		-DUSE_BUNDLED_B64=OFF
+		-DUSE_BUNDLED_JSONCPP=OFF
+		-DUSE_BUNDLED_RE2=OFF
+		-DUSE_BUNDLED_TBB=OFF
+		-DUSE_BUNDLED_VALIJSON=OFF
+
+		# set valijson include path to prevent downloading
+		-DVALIJSON_INCLUDE="${ESYSROOT}"/usr/include
+
+		# enable chisels
+		-DWITH_CHISEL=ON
+	)
+
+	cmake_src_configure
+}
+
+src_install() {
+	cmake_src_install
+
+	# remove driver headers
+	rm -r "${ED}"/usr/src || die
+
+	# remove libscap/libsinsp headers & libs (see #938187)
+	rm -r "${ED}"/usr/include/sysdig || die
+	rm -r "${ED}"/usr/$(get_libdir) || die
+
+	# move bashcomp to the proper location
+	dobashcomp "${ED}"/usr/etc/bash_completion.d/sysdig || die
+	rm -r "${ED}"/usr/etc || die
+}
+
+pkg_postinst() {
+	if use bpf; then
+		elog
+		elog "You have enabled the 'modern BPF' probe."
+		elog "This eBPF-based event source is an alternative to the traditional"
+		elog "scap kernel module."
+		elog
+		elog "To use it, start sysdig/csysdig with '--modern-bpf'."
+		elog
+	fi
+}