Adding metadata

7 files changed, 377 insertions, 2 deletions

diff --git a/dev-debug/scap-driver/Manifest b/dev-debug/scap-driver/Manifest
index 84c27ad4f85d..a2690e1bd668 100644
--- a/dev-debug/scap-driver/Manifest
+++ b/dev-debug/scap-driver/Manifest
@@ -1 +1,2 @@
 DIST falcosecurity-libs-0.20.0.tar.gz 4545190 BLAKE2B 93a074ab6451c16c7ad58498ac580f0476339e7dee65112e56142307f79966c43b69c71234a784aff03f47ec2e37e838e797beb4b36e9c105db88cf32cad135e SHA512 b5ef481bda92a29b7b409baee25dabd0b766e4bbcac762740635f99b36cd823a6d98f541817fd03b1a86a1385d3fe24888b33b84dc3486cd9f8d00e5384eb705
+DIST falcosecurity-libs-0.21.0.tar.gz 4511266 BLAKE2B 4d2014f8370da0e0777fd46736ada9655226fdc5d5e3e546fa1bce4251cb0874dfa0edaebd077800eed36760f2814a529fddedd1106a21a16e032942d2cda275 SHA512 d2c27fbdf13cc85bd4cff0270fc26cf6aa5fa7367cd1b32d7c407f1e5245d4d110038546066e838b1fce90ff588d2a0abcf4d95b1fae5734cd06e032be2f0fbc
diff --git a/dev-debug/scap-driver/scap-driver-0.21.0.ebuild b/dev-debug/scap-driver/scap-driver-0.21.0.ebuild
new file mode 100644
index 000000000000..f292640e703e
--- /dev/null
+++ b/dev-debug/scap-driver/scap-driver-0.21.0.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake linux-mod-r1
+
+DESCRIPTION="Kernel module for dev-debug/sysdig"
+HOMEPAGE="https://www.sysdig.com/"
+SRC_URI="https://github.com/falcosecurity/libs/archive/${PV}.tar.gz -> falcosecurity-libs-${PV}.tar.gz"
+S="${WORKDIR}/libs-${PV}"
+
+LICENSE="Apache-2.0 GPL-2 MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+
+BDEPEND="
+	dev-libs/uthash
+	virtual/libelf:=
+	virtual/zlib:=
+"
+
+CONFIG_CHECK="HAVE_SYSCALL_TRACEPOINTS ~TRACEPOINTS"
+
+# We need to specify the driver version manually since we do not use a git tree.
+# This version can usually be found as git tag on the same commit as the libs version.
+DRIVER_VERSION="8.1.0+driver"
+
+PATCHES=(
+	"${FILESDIR}"/libs-0.20.0-properly-use-LD.patch
+)
+
+src_configure() {
+	local mycmakeargs=(
+		# we will use linux-mod, so in order to make it through the cmake setup
+		# just pretend to use bundled deps and then override only what we need.
+		-DUSE_BUNDLED_DEPS=ON
+		-DUSE_BUNDLED_LIBELF=OFF
+		-DUSE_BUNDLED_UTHASH=OFF
+		-DUSE_BUNDLED_ZLIB=OFF
+		-DCREATE_TEST_TARGETS=OFF
+		-DDRIVER_VERSION="${DRIVER_VERSION}"
+	)
+
+	cmake_src_configure
+}
+
+src_compile() {
+	local modlist=( scap=:"${BUILD_DIR}"/driver/src )
+	local modargs=( KERNELDIR="${KV_OUT_DIR}" )
+
+	linux-mod-r1_src_compile
+}
diff --git a/dev-debug/sysdig/Manifest b/dev-debug/sysdig/Manifest
index 8c80b43fae88..f7ad4b178593 100644
--- a/dev-debug/sysdig/Manifest
+++ b/dev-debug/sysdig/Manifest
@@ -1,2 +1,5 @@
+DIST container-0.6.0-linux-x86_64.tar.gz 13118035 BLAKE2B 08aa198838114a56504a93b960374e92c0d6bfec3ff2759d1d9aed5ca784a7660f27e75eac033ad4122f40558e0a4471fcfaffa3980cd601d0d8df653209d2d1 SHA512 e67d99e0f393be69de1092ba5e7a036fcbd7a15299539f2d3aec2af400f1d9b6e52b19e2886f000cd9ab1d3a14106b42a1234378784d8ba23843214201ac00d8
 DIST falcosecurity-libs-0.20.0.tar.gz 4545190 BLAKE2B 93a074ab6451c16c7ad58498ac580f0476339e7dee65112e56142307f79966c43b69c71234a784aff03f47ec2e37e838e797beb4b36e9c105db88cf32cad135e SHA512 b5ef481bda92a29b7b409baee25dabd0b766e4bbcac762740635f99b36cd823a6d98f541817fd03b1a86a1385d3fe24888b33b84dc3486cd9f8d00e5384eb705
+DIST falcosecurity-libs-0.21.0.tar.gz 4511266 BLAKE2B 4d2014f8370da0e0777fd46736ada9655226fdc5d5e3e546fa1bce4251cb0874dfa0edaebd077800eed36760f2814a529fddedd1106a21a16e032942d2cda275 SHA512 d2c27fbdf13cc85bd4cff0270fc26cf6aa5fa7367cd1b32d7c407f1e5245d4d110038546066e838b1fce90ff588d2a0abcf4d95b1fae5734cd06e032be2f0fbc
 DIST sysdig-0.40.1.tar.gz 68296332 BLAKE2B 17ed9154d1e955dc18700ab764f0fce11461bea9b6970e8661761269d4f0bbb786ddd8a4cc4c806121a52d0d486080fc231f2447dc69d26d41fa582c1dabda41 SHA512 a50372192ea8708d19ede0550659a2f7ea6b535b419d649ae9b52e32f9c71576f0a3e3ab85dcc8d23f792dff078f15eca1435a1e402e3d98aba7eefc1920989e
+DIST sysdig-0.41.4.tar.gz 43418620 BLAKE2B 1d59ca97088e7ce3483343729659b17711029500e422904a253d041a296686c66a365a1fe5482aaebd427e7579f016f1961139799556f081f883d732d5d06f32 SHA512 3250bce00d9b40efd8baa948c820ff391c51e81f685f4c1e70ad337b9bb947aa218dc9f9930a682afb9ce78e63b6ed5ff948b9b9e3364cf1bfbd082f70cd65dc
diff --git a/dev-debug/sysdig/files/0.40.1-cmake4.patch b/dev-debug/sysdig/files/0.40.1-cmake4.patch
new file mode 100644
index 000000000000..56fc16b26d2e
--- /dev/null
+++ b/dev-debug/sysdig/files/0.40.1-cmake4.patch
@@ -0,0 +1,68 @@
+From https://github.com/draios/sysdig/pull/2167
+
+From: =?UTF-8?q?Holger=20Hoffst=C3=A4tte?= <holger@applied-asynchrony.com>
+Date: Sun, 19 Oct 2025 12:56:26 +0200
+Subject: [PATCH] fix(build): bump cmake_minimum_required to 3.12 everywhere
+
+This brings the required CMake version in line with falcosecurity/libs.
+
+Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+---
+ CMakeLists.txt                                       | 2 +-
+ CMakeListsGtestInclude.cmake                         | 2 +-
+ cmake/modules/driver-repo/CMakeLists.txt             | 2 +-
+ cmake/modules/falcosecurity-libs-repo/CMakeLists.txt | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b1cbd02ccd..97957b0835 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -33,7 +33,7 @@ if(EXISTS ${CMAKE_CURRENT_BINARY_DIR}/CMakeLists.txt)
+ 		"The following wiki page has more information on manually building sysdig: http://bit.ly/1oJ84UI")
+ endif()
+ 
+-cmake_minimum_required(VERSION 3.5.1)
++cmake_minimum_required(VERSION 3.12)
+ 
+ project(sysdig)
+ 
+diff --git a/CMakeListsGtestInclude.cmake b/CMakeListsGtestInclude.cmake
+index 76c0f1b1ca..375e8efba0 100644
+--- a/CMakeListsGtestInclude.cmake
++++ b/CMakeListsGtestInclude.cmake
+@@ -16,7 +16,7 @@
+ # limitations under the License.
+ #
+ 
+-cmake_minimum_required(VERSION 2.8.2)
++cmake_minimum_required(VERSION 3.12)
+ 
+ project(googletest-download NONE)
+ 
+diff --git a/cmake/modules/driver-repo/CMakeLists.txt b/cmake/modules/driver-repo/CMakeLists.txt
+index 6f8684b574..5c1939ce15 100644
+--- a/cmake/modules/driver-repo/CMakeLists.txt
++++ b/cmake/modules/driver-repo/CMakeLists.txt
+@@ -16,7 +16,7 @@
+ # limitations under the License.
+ #
+ 
+-cmake_minimum_required(VERSION 3.5.1)
++cmake_minimum_required(VERSION 3.12)
+ 
+ project(driver-repo NONE)
+ 
+diff --git a/cmake/modules/falcosecurity-libs-repo/CMakeLists.txt b/cmake/modules/falcosecurity-libs-repo/CMakeLists.txt
+index 946cf5d260..5131a07ce2 100644
+--- a/cmake/modules/falcosecurity-libs-repo/CMakeLists.txt
++++ b/cmake/modules/falcosecurity-libs-repo/CMakeLists.txt
+@@ -16,7 +16,7 @@
+ # limitations under the License.
+ #
+ 
+-cmake_minimum_required(VERSION 3.5.1)
++cmake_minimum_required(VERSION 3.12)
+ 
+ project(falcosecurity-libs-repo NONE)
+ 
diff --git a/dev-debug/sysdig/files/libs-0.21.0-fix-INET6_ADDRSTRLEN-buffer-size.patch b/dev-debug/sysdig/files/libs-0.21.0-fix-INET6_ADDRSTRLEN-buffer-size.patch
new file mode 100644
index 000000000000..bf9e68ee338b
--- /dev/null
+++ b/dev-debug/sysdig/files/libs-0.21.0-fix-INET6_ADDRSTRLEN-buffer-size.patch
@@ -0,0 +1,61 @@
+From upstream commit:
+https://github.com/falcosecurity/libs/commit/a273f3d05c6e90ffc5d47a919a92b3e4d887b340
+
+From: =?UTF-8?q?Holger=20Hoffst=C3=A4tte?= <holger@applied-asynchrony.com>
+Date: Sun, 3 Aug 2025 16:57:14 +0200
+Subject: [PATCH] fix(libsinsp): use proper INET6_ADDRSTRLEN buffer size for inet_ntop
+
+glibc-2.42 added __inet_ntop_chk fortification, which started to fail:
+
+  *** buffer overflow detected ***: terminated
+  Program received signal SIGABRT, Aborted.
+  0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
+  (gdb) bt
+  #0  0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
+  #1  0x00007ffff6242572 in raise () from /lib64/libc.so.6
+  #2  0x00007ffff6229f3b in abort () from /lib64/libc.so.6
+  #3  0x00007ffff622b148 in __libc_message_impl.cold () from /lib64/libc.so.6
+  #4  0x00007ffff6327337 in __fortify_fail () from /lib64/libc.so.6
+  #5  0x00007ffff6326c92 in __chk_fail () from /lib64/libc.so.6
+  #6  0x00007ffff6327a62 in __inet_ntop_chk () from /lib64/libc.so.6
+  #7  0x000055555569da3d in inet_ntop (__af=10, __src=0x555555ee0800, __dst=0x7fffffff4f90 "\260P\377\377\377\177", __dst_size=100) at /usr/include/bits/inet-fortified.h:36
+  #8  ipv6tuple_to_string[abi:cxx11](ipv6tuple*, bool) (tuple=0x555555ee0800, resolve=false) at /tmp/portage/dev-debug/sysdig-0.40.1/work/libs-0.20.0/userspace/libsinsp/utils.c
+
+Use INET6_ADDRSTRLEN as destination buffer size.
+
+Fixes: https://github.com/falcosecurity/libs/issues/2573
+Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+---
+ userspace/libsinsp/utils.cpp | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/userspace/libsinsp/utils.cpp b/userspace/libsinsp/utils.cpp
+index 06b921cbbf..b676b8dd34 100644
+--- a/userspace/libsinsp/utils.cpp
++++ b/userspace/libsinsp/utils.cpp
+@@ -1042,8 +1042,8 @@ std::string ipv4tuple_to_string(const ipv4tuple& tuple, const bool resolve) {
+ }
+ 
+ std::string ipv6serveraddr_to_string(const ipv6serverinfo& addr, const bool resolve) {
+-	char address[100];
+-	if(!inet_ntop(AF_INET6, addr.m_ip.m_b, address, 100)) {
++	char address[INET6_ADDRSTRLEN];
++	if(!inet_ntop(AF_INET6, addr.m_ip.m_b, address, INET6_ADDRSTRLEN)) {
+ 		return std::string();
+ 	}
+ 
+@@ -1058,12 +1058,12 @@ std::string ipv6serveraddr_to_string(const ipv6serverinfo& addr, const bool reso
+ 
+ std::string ipv6tuple_to_string(const ipv6tuple& tuple, const bool resolve) {
+ 	char source_address[INET6_ADDRSTRLEN];
+-	if(!inet_ntop(AF_INET6, tuple.m_fields.m_sip.m_b, source_address, 100)) {
++	if(!inet_ntop(AF_INET6, tuple.m_fields.m_sip.m_b, source_address, INET6_ADDRSTRLEN)) {
+ 		return std::string();
+ 	}
+ 
+ 	char destination_address[INET6_ADDRSTRLEN];
+-	if(!inet_ntop(AF_INET6, tuple.m_fields.m_dip.m_b, destination_address, 100)) {
++	if(!inet_ntop(AF_INET6, tuple.m_fields.m_dip.m_b, destination_address, INET6_ADDRSTRLEN)) {
+ 		return std::string();
+ 	}
+ 
diff --git a/dev-debug/sysdig/sysdig-0.40.1-r1.ebuild b/dev-debug/sysdig/sysdig-0.40.1-r1.ebuild
index aefc4494bab5..67e5a0e20c9c 100644
--- a/dev-debug/sysdig/sysdig-0.40.1-r1.ebuild
+++ b/dev-debug/sysdig/sysdig-0.40.1-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -58,10 +58,11 @@ PDEPEND="modules? ( =dev-debug/scap-driver-${LIBS_VERSION}* )"
 
 PATCHES=(
 	"${FILESDIR}/0.38.1-scap-loader.patch"
+	"${FILESDIR}/0.40.1-cmake4.patch"
 )
 
 pkg_pretend() {
-	if use bpf; then
+	if use bpf && [[ ${MERGE_TYPE} != binary ]] ; then
 		local CONFIG_CHECK="
 			~BPF
 			~BPF_EVENTS
diff --git a/dev-debug/sysdig/sysdig-0.41.4.ebuild b/dev-debug/sysdig/sysdig-0.41.4.ebuild
new file mode 100644
index 000000000000..1bf984aae619
--- /dev/null
+++ b/dev-debug/sysdig/sysdig-0.41.4.ebuild
@@ -0,0 +1,188 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+
+inherit bash-completion-r1 cmake flag-o-matic linux-info lua-single
+
+DESCRIPTION="A system exploration and troubleshooting tool"
+HOMEPAGE="https://www.sysdig.com/"
+
+# The version of falcosecurity-libs required by sysdig as source tree
+LIBS_VERSION="0.21.0"
+LIBS="falcosecurity-libs-${LIBS_VERSION}"
+
+# The version of the container plugin binary
+CONTAINER_VERSION="0.6.0"
+
+SRC_URI="
+	https://github.com/draios/sysdig/archive/${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/falcosecurity/libs/archive/${LIBS_VERSION}.tar.gz -> ${LIBS}.tar.gz
+	https://download.falco.org/plugins/stable/container-${CONTAINER_VERSION}-linux-x86_64.tar.gz
+"
+
+# The driver version as found in cmake/modules/driver.cmake or alternatively
+# as git tag on the $LIBS_VERSION of falcosecurity-libs.
+DRIVER_VERSION="8.1.0+driver"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="bpf +modules"
+REQUIRED_USE="${LUA_REQUIRED_USE}"
+
+RDEPEND="${LUA_DEPS}
+	dev-cpp/abseil-cpp:=
+	dev-cpp/tbb:=
+	dev-cpp/yaml-cpp:=
+	dev-libs/jsoncpp:=
+	dev-libs/libb64:=
+	dev-libs/re2:=
+	dev-libs/uthash
+	sys-libs/ncurses:=
+	virtual/libelf:=
+	virtual/zlib:=
+	bpf? ( >=dev-libs/libbpf-1.5:= )
+"
+
+DEPEND="${RDEPEND}
+	dev-cpp/nlohmann_json
+	dev-cpp/valijson
+	virtual/os-headers
+	bpf? (
+		dev-util/bpftool
+		llvm-core/clang:*[llvm_targets_BPF]
+	)
+"
+
+# pin the driver to the falcosecurity-libs version
+PDEPEND="modules? ( =dev-debug/scap-driver-${LIBS_VERSION}* )"
+
+QA_PREBUILT="usr/share/sysdig/plugins/libcontainer.so"
+QA_PRESTRIPPED=${QA_PREBUILT}
+
+PATCHES=(
+	"${FILESDIR}/0.38.1-scap-loader.patch"
+)
+
+pkg_pretend() {
+	if use bpf && [[ ${MERGE_TYPE} != binary ]] ; then
+		local CONFIG_CHECK="
+			~BPF
+			~BPF_EVENTS
+			~BPF_JIT
+			~BPF_SYSCALL
+			~FTRACE_SYSCALLS
+			~HAVE_EBPF_JIT
+		"
+		check_extra_config
+	fi
+}
+
+src_prepare() {
+	# manually apply patches to falcosecurity-libs
+	pushd "${WORKDIR}/libs-${LIBS_VERSION}"
+		eapply "${FILESDIR}/libs-0.21.0-fix-INET6_ADDRSTRLEN-buffer-size.patch" || die
+	popd
+
+	# do not build with debugging info
+	sed -i -e 's/-ggdb//g' CMakeLists.txt "${WORKDIR}"/libs-${LIBS_VERSION}/cmake/modules/CompilerFlags.cmake || die
+
+	# fix the driver version
+	sed -i -e 's/0.0.0-local/${DRIVER_VERSION}/g' cmake/modules/driver.cmake || die
+
+	# we download & install the container plugin ourselves
+	sed -i -e '/include(container_plugin)/d' CMakeLists.txt || die
+
+	cmake_src_prepare
+}
+
+src_configure() {
+	# known problems with strict aliasing:
+	# https://github.com/falcosecurity/libs/issues/1964
+	append-flags -fno-strict-aliasing
+
+	local mycmakeargs=(
+		# do not build the kernel driver
+		-DBUILD_DRIVER=OFF
+		-DENABLE_DKMS=OFF
+
+		# disable all test targets
+		-DCREATE_TEST_TARGETS=OFF
+
+		# libscap examples are not installed or really useful
+		-DBUILD_LIBSCAP_EXAMPLES=OFF
+
+		# do not build internal libs as shared
+		-DBUILD_SHARED_LIBS=OFF
+
+		# build modern BPF probe depending on USE
+		-DBUILD_SYSDIG_MODERN_BPF=$(usex bpf)
+
+		# set driver location/version
+		-DDRIVER_SOURCE_DIR="${WORKDIR}"/libs-${LIBS_VERSION}/driver
+		-DDRIVER_VERSION=${DRIVER_VERSION}
+
+		# point sysdig to the libs tree
+		-DUSE_BUNDLED_FALCOSECURITY_LIBS=ON
+		-DFALCOSECURITY_LIBS_SOURCE_DIR="${WORKDIR}"/libs-${LIBS_VERSION}
+
+		# explicitly set sysdig version - required for some reason
+		-DSYSDIG_VERSION=${PV}
+
+		# do not use bundled dependencies for sysdig
+		-DUSE_BUNDLED_DEPS=OFF
+
+		# do not use bundled dependencies for falcosecurity-libs
+		-DUSE_BUNDLED_B64=OFF
+		-DUSE_BUNDLED_JSONCPP=OFF
+		-DUSE_BUNDLED_RE2=OFF
+		-DUSE_BUNDLED_TBB=OFF
+		-DUSE_BUNDLED_VALIJSON=OFF
+
+		# set valijson include path to prevent downloading
+		-DVALIJSON_INCLUDE="${ESYSROOT}"/usr/include
+
+		# enable chisels
+		-DWITH_CHISEL=ON
+	)
+
+	cmake_src_configure
+}
+
+src_install() {
+	cmake_src_install
+
+	# remove driver headers
+	rm -r "${ED}"/usr/src || die
+
+	# remove libscap/libsinsp headers & libs (see #938187)
+	rm -r "${ED}"/usr/include/sysdig || die
+	rm -r "${ED}"/usr/$(get_libdir) || die
+
+	# move bashcomp to the proper location
+	dobashcomp "${ED}"/usr/etc/bash_completion.d/sysdig || die
+	rm -r "${ED}"/usr/etc || die
+
+	# users can drop things in here
+	keepdir /usr/share/sysdig/plugins
+
+	# install container plugin
+	insinto /usr/share/sysdig/plugins
+	insopts -m0755
+	doins "${WORKDIR}"/libcontainer.so
+}
+
+pkg_postinst() {
+	if use bpf; then
+		elog
+		elog "You have enabled the 'modern BPF' probe."
+		elog "This eBPF-based event source is an alternative to the traditional"
+		elog "scap kernel module."
+		elog
+		elog "To use it, start sysdig/csysdig with '--modern-bpf'."
+		elog
+	fi
+}