Adding metadata

13 files changed, 319 insertions, 314 deletions

diff --git a/net-analyzer/monitoring-plugins/Manifest b/net-analyzer/monitoring-plugins/Manifest
index bf0cd41dd230..20dd4cfa5c9e 100644
--- a/net-analyzer/monitoring-plugins/Manifest
+++ b/net-analyzer/monitoring-plugins/Manifest
@@ -1 +1,2 @@
 DIST monitoring-plugins-2.4.0.tar.gz 2746382 BLAKE2B 3e062b9392b4e5885a549ca619eee25f29517e83682e0eb76c8780235b48ab26d79994827c1167e981a993ece3f3f339de61874c912e6fcb17b4cb1af22e97d9 SHA512 7e9aae7768ed9fccbaf377fc54a70374f6a41e8e8ef95cf7440e44fca1080eb23e6b3d737214c96d772eb9a32cdfdbf1b88e0eb35eda0690047d5fe1b485a6b2
+DIST monitoring-plugins-3.0.1.tar.gz 3005747 BLAKE2B a9eef6b2fa7e8c138d10c222fc575426138ea19cf0a33516daac55cec6fd3d511c8921ca81d95e2d78dd37cc1fc438a959340b6f4d4c01c087134429573f85e7 SHA512 c9f462debec7a444eb1bbe76331d824c76d4e795881069543bbb588710121253fb3870b4e80dbeb711b39741f1f0fbfef533953283ab2779298b4843c4002ad8
diff --git a/net-analyzer/monitoring-plugins/files/monitoring-plugins-3.0.1-check-ntp-buildfix.patch b/net-analyzer/monitoring-plugins/files/monitoring-plugins-3.0.1-check-ntp-buildfix.patch
new file mode 100644
index 000000000000..875ec5773119
--- /dev/null
+++ b/net-analyzer/monitoring-plugins/files/monitoring-plugins-3.0.1-check-ntp-buildfix.patch
@@ -0,0 +1,36 @@
+From e84ecb1dc8e27a27c35267077764c0ea10f12306 Mon Sep 17 00:00:00 2001
+From: Michael Orlitzky <michael@orlitzky.com>
+Date: Fri, 3 Jul 2026 22:04:49 -0400
+Subject: [PATCH] plugins/check_ntp_time.c: add missing sockaddr_un -> sockaddr
+ cast
+
+Newer GCC with -Werror=incompatible-pointer-types enabled by default
+will choke on this:
+
+  check_ntp_time.c: In function 'offset_request':
+  check_ntp_time.c:404:42: error: passing argument 2 of 'connect' from
+  incompatible pointer type [-Wincompatible-pointer-types]
+  404 | if (connect(socklist[0], &unix_socket, sizeof(unix_socket))) {
+      |                          ^~~~~~~~~~~~
+      |                          |
+      |                          struct sockaddr_un *
+---
+ plugins/check_ntp_time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/plugins/check_ntp_time.c b/plugins/check_ntp_time.c
+index 2d9a6f40..5ad615c2 100644
+--- a/plugins/check_ntp_time.c
++++ b/plugins/check_ntp_time.c
+@@ -401,7 +401,7 @@ static offset_request_wrapper offset_request(const char *host, const char *port,
+ 		}
+ 		strncpy(unix_socket.sun_path, host, sizeof(unix_socket.sun_path));
+ 
+-		if (connect(socklist[0], &unix_socket, sizeof(unix_socket))) {
++		if (connect(socklist[0], (struct sockaddr *)&unix_socket, sizeof(unix_socket))) {
+ 			/* don't die here, because it is enough if there is one server
+ 			   answering in time. This also would break for dual ipv4/6 stacked
+ 			   ntp servers when the client only supports on of them.
+-- 
+2.54.0
+
diff --git a/net-analyzer/monitoring-plugins/metadata.xml b/net-analyzer/monitoring-plugins/metadata.xml
index ddeeed321c58..52b1efc486ff 100644
--- a/net-analyzer/monitoring-plugins/metadata.xml
+++ b/net-analyzer/monitoring-plugins/metadata.xml
@@ -22,6 +22,10 @@
       Install <pkg>games-util/qstat</pkg> required for monitoring FPS
       servers. Disabling the flag does not remove any plugins.
     </flag>
+    <flag name="filecaps">
+      Use filesystem capabilities for privileged executables like
+      check_icmp (preferable to suid).
+    </flag>
     <flag name="fping">
       Install <pkg>net-analyzer/fping</pkg> required for fancy ping
       monitoring. Disabling the flag does not remove any plugins.
@@ -42,6 +46,10 @@
       <pkg>net-analyzer/net-snmp</pkg> required for monitoring SNMP
       values. Disabling the flag does not remove any plugins.
     </flag>
+    <flag name="suid">
+      Fall back to suid for privileged checks like check_icmp if
+      filecaps are disabled or unavailable.
+    </flag>
   </use>
   <origin>baldeagleos-repo</origin>
 </pkgmetadata>
diff --git a/net-analyzer/monitoring-plugins/monitoring-plugins-2.4.0-r2.ebuild b/net-analyzer/monitoring-plugins/monitoring-plugins-3.0.1-r1.ebuild
index a86935897c03..45daeed5cd77 100644
--- a/net-analyzer/monitoring-plugins/monitoring-plugins-2.4.0-r2.ebuild
+++ b/net-analyzer/monitoring-plugins/monitoring-plugins-3.0.1-r1.ebuild
@@ -1,18 +1,19 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit flag-o-matic
+inherit fcaps flag-o-matic
 
 DESCRIPTION="50+ standard plugins for Icinga, Naemon, Nagios, Shinken, Sensu"
-HOMEPAGE="https://www.monitoring-plugins.org/"
+HOMEPAGE="https://www.monitoring-plugins.org/
+	https://github.com/monitoring-plugins/monitoring-plugins/"
 SRC_URI="https://www.monitoring-plugins.org/download/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~sparc ~x86"
-IUSE="curl gnutls ipv6 ldap mysql dns fping game postgres radius rpc samba snmp ssh +ssl"
+KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~sparc ~x86"
+IUSE="curl ipv6 ldap mysql dns fping game postgres radius rpc samba snmp ssh suid"
 
 # Most of the plugins use automagic dependencies, i.e. the plugin will
 # get built if the binary it uses is installed. For example, check_snmp
@@ -23,6 +24,11 @@ IUSE="curl gnutls ipv6 ldap mysql dns fping game postgres radius rpc samba snmp
 # REAL_DEPEND contains the dependencies that are actually needed to
 # build. DEPEND contains those plus the automagic dependencies.
 #
+# Note: openssl is required unconditionally because the build fails
+# without it:
+#
+#   * https://github.com/monitoring-plugins/monitoring-plugins/issues/2135
+#
 REAL_DEPEND="dev-lang/perl
 	curl? (
 		dev-libs/uriparser
@@ -31,12 +37,7 @@ REAL_DEPEND="dev-lang/perl
 	ldap? ( net-nds/openldap:= )
 	mysql? ( || ( dev-db/mysql-connector-c dev-db/mariadb-connector-c ) )
 	postgres? ( dev-db/postgresql:= )
-	ssl? (
-		!gnutls? (
-			dev-libs/openssl:0=
-		)
-		gnutls? ( net-libs/gnutls )
-	)
+	dev-libs/openssl:0=
 	radius? ( net-dialup/freeradius-client )"
 
 DEPEND="${REAL_DEPEND}
@@ -51,8 +52,6 @@ DEPEND="${REAL_DEPEND}
 
 # Basically everything collides with nagios-plugins.
 RDEPEND="${DEPEND}
-	acct-group/nagios
-	acct-user/nagios
 	!net-analyzer/nagios-plugins"
 
 # At least one test is interactive.
@@ -68,20 +67,18 @@ QA_CONFIG_IMPL_DECL_SKIP=(
 	alignof
 )
 
+PATCHES=( "${FILESDIR}/${P}-check-ntp-buildfix.patch" )
+
+DOCS=( ACKNOWLEDGEMENTS AUTHORS CODING ChangeLog FAQ \
+		NEWS README REQUIREMENTS SUPPORT THANKS )
+
 src_configure() {
+	# https://github.com/monitoring-plugins/monitoring-plugins/issues/2295
 	append-flags -fno-strict-aliasing
 
 	# Use an array to prevent econf from mangling the ping args.
 	local myconf=()
 
-	if use ssl; then
-		myconf+=( $(use_with !gnutls openssl /usr)
-				  $(use_with gnutls gnutls /usr) )
-	else
-		myconf+=( --without-openssl )
-		myconf+=( --without-gnutls )
-	fi
-
 	# The autodetection for these two commands can hang if localhost is
 	# down or ICMP traffic is filtered (bug #468296). But also the path
 	# likes to move around on us (bug #883729).
@@ -99,13 +96,41 @@ src_configure() {
 		$(use_with ldap) \
 		$(use_with postgres pgsql /usr) \
 		$(use_with radius) \
+		--with-openssl=/usr \
+		--without-gnutls \
 		"${myconf[@]}" \
 		--libexecdir="/usr/$(get_libdir)/nagios/plugins" \
 		--sysconfdir="/etc/nagios"
 }
 
-DOCS=( ACKNOWLEDGEMENTS AUTHORS CODING ChangeLog FAQ \
-		NEWS README REQUIREMENTS SUPPORT THANKS )
+src_install() {
+	default
+
+	# Prefer capabilities to suid. Beware that fcaps and fperms require
+	# two different kinds of paths; fperms always prepends ${ED}, but
+	# fcaps only does so it if the path does not already start with a
+	# slash. Anyway, begin by removing suid unconditionally.
+	local pd="usr/$(get_libdir)/nagios/plugins"
+
+	if use filecaps; then
+		local flags msg
+		if use suid; then
+			# use suid if setcap fails
+			flags="-m u+s"
+			msg=" (with suid fallback)"
+		fi
+		einfo "replacing suid bits with filecaps${msg}"
+		fperms ug-s /"${pd}"/check_{dhcp,icmp}
+		fcaps ${flags} cap_net_bind_service "${pd}"/check_dhcp
+		fcaps ${flags} cap_net_bind_service,cap_net_raw "${pd}"/check_icmp
+	else
+		# no filecaps, just suid (or not)
+		if ! use suid; then
+			einfo "stripping suid bits"
+			fperms ug-s /"${pd}"/check_{dhcp,icmp}
+		fi
+	fi
+}
 
 pkg_postinst() {
 	elog "This ebuild has a number of USE flags that determine what you"
diff --git a/net-analyzer/nagios-core/Manifest b/net-analyzer/nagios-core/Manifest
index 05d25fd9fa6f..bff7ff47c968 100644
--- a/net-analyzer/nagios-core/Manifest
+++ b/net-analyzer/nagios-core/Manifest
@@ -1,3 +1,2 @@
-DIST nagios-4.5.12.tar.gz 2590063 BLAKE2B 20aa455270655180d4a4c6d32e2d114eaf8b665b1315eda690b15e9d69e115751d559cc20a8cab5ddbe932c0612c63c1f0e9387918d5b8e21badad0db0a540d1 SHA512 2b172f6d4c7ff87ac488bf276a170b626cf10b0dcefe8870d95002c73cd0b6d5fbb9397b99af21e5fd89425165249b82542e4f96920fc353a099a9d930d52bf8
 DIST nagios-4.5.13.tar.gz 2590052 BLAKE2B 35cba4a07ffa0e3ed180fa28376a420255353a2fff7285ce58298f06870c5ca844c5e01e439b04c1c83ea97b51e4db4f1436b96e2ac5b868000f81cd26eec8b2 SHA512 f5dc03f1bb5db633594ce50b1d58a18e8dd095cfc362416a39e88de02056ad0c05b60acd5f86a629d5b59d214724a2f7d48e681149a648ed464565c7b818c371
 DIST nagios-core-gentoo-icons-20141125.tar 40960 BLAKE2B 31c1953e1160c7c7b89606b72b1a80407e4c1b7a7938b40bd1c577cd0c309dd88ca6b775d692a9b846dbf67736537fa9c91e56aa15fdd447769608ca525bff09 SHA512 bf109879cddd6136b76baba55d0b60b2596e37431dcf5ce0905d34a9fa292ebf7e4bde82d9a084362c486e8fac344c76d88f9298b1b85541ed70ffd608493766
diff --git a/net-analyzer/nagios-core/nagios-core-4.5.12.ebuild b/net-analyzer/nagios-core/nagios-core-4.5.12.ebuild
deleted file mode 100644
index 99d8fa0821bd..000000000000
--- a/net-analyzer/nagios-core/nagios-core-4.5.12.ebuild
+++ /dev/null
@@ -1,274 +0,0 @@
-# Copyright 1999-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit systemd toolchain-funcs
-
-MY_P="${PN/-core}-${PV}"
-DESCRIPTION="Nagios core - monitoring daemon, web GUI, and documentation"
-HOMEPAGE="https://www.nagios.org/"
-
-# The name of the directory into which our Gentoo icons will be
-# extracted, and also the basename of the archive containing it.
-GENTOO_ICONS="${PN}-gentoo-icons-20141125"
-SRC_URI="https://downloads.sourceforge.net/nagios/${MY_P}.tar.gz
-	web? ( https://dev.gentoo.org/~mjo/distfiles/${GENTOO_ICONS}.tar )"
-
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~ppc ppc64 ~riscv ~sparc x86"
-IUSE="apache2 classicui lighttpd +web vim-syntax"
-
-# In pkg_postinst(), we change the group of the Nagios configuration
-# directory to that of the web server user. It can't belong to both
-# apache/lighttpd groups at the same time, so we block this combination
-# for our own sanity.
-#
-# This could be made to work, but we would need a better way to allow
-# the web user read-only access to Nagios's configuration directory.
-#
-REQUIRED_USE="apache2? ( !lighttpd )"
-
-#
-# Note, we require one of the apache2 CGI modules:
-#
-#   * mod_cgi (USE=apache2_modules_cgi)
-#   * mod_cgid (USE=apache2_modules_cgid)
-#   * mod_fcgid (www-apache/mod_fcgid)
-#
-# We just don't care /which/ one. And of course PHP supports both CGI
-# (USE=cgi) and FastCGI (USE=fpm). We're pretty lenient with the
-# dependencies, and expect the user not to do anything /too/
-# stupid. (For example, installing Apache with only FastCGI support, and
-# PHP with only CGI support.)
-#
-# Another annoyance is that the upstream Makefile uses app-arch/unzip to
-# extract a snapshot of AngularJS, but that's only needed when USE=web.
-#
-MOD_ALIAS=apache2_modules_alias
-
-# The dependencies checked by the configure script. All of these are
-# also runtime dependencies; that's why ./configure checks for them.
-CONFIGURE_DEPEND="acct-group/nagios
-	acct-user/nagios
-	virtual/mailx
-	dev-lang/perl:="
-
-# In addition to the things that the ./configure script checks for,
-# we also need to be able to unzip stuff on the build host.
-#
-# We need the apache/lighttpd groups in src_install() for the things
-# installed as the --with-command-group argument, so they go here too.
-# The groups are also needed at runtime, but that is ensured by apache
-# and lighttpd themselves being in RDEPEND.
-#
-# The sys-apps/which dependency is removed in,
-#
-#   https://github.com/NagiosEnterprises/nagioscore/pull/1031
-#
-# but would require an autoreconf if we wanted to backport it.
-#
-BDEPEND="${CONFIGURE_DEPEND}
-	sys-apps/which
-	apache2? ( acct-group/apache )
-	lighttpd? ( acct-group/lighttpd )
-	web? ( app-arch/unzip )"
-
-# This is linked into /usr/bin/nagios{,tats}
-DEPEND="dev-libs/libltdl:0"
-
-RDEPEND="${CONFIGURE_DEPEND}
-	${DEPEND}
-	web? (
-		media-libs/gd[jpeg,png]
-		lighttpd? ( www-servers/lighttpd[php] )
-		apache2? (
-			|| (
-				www-servers/apache[${MOD_ALIAS},apache2_modules_cgi]
-				www-servers/apache[${MOD_ALIAS},apache2_modules_cgid]
-				( www-servers/apache[${MOD_ALIAS}] www-apache/mod_fcgid ) )
-			|| (
-				dev-lang/php:*[apache2]
-				dev-lang/php:*[cgi]
-				dev-lang/php:*[fpm] )
-		)
-	)
-	vim-syntax? ( app-vim/nagios-syntax )"
-
-src_configure() {
-	local myconf
-
-	if use !apache2 && use !lighttpd ; then
-		myconf="${myconf} --with-command-group=nagios"
-	else
-		if use apache2 ; then
-			myconf="${myconf} --with-command-group=apache"
-			myconf="${myconf} --with-httpd-conf=/etc/apache2/conf.d"
-		elif use lighttpd ; then
-			myconf="${myconf} --with-command-group=lighttpd"
-		fi
-	fi
-
-	# We pass "unknown" as the init type because we don't want it to
-	# guess. Later on, we'll manually install both OpenRC and systemd
-	# services.
-	econf ${myconf} \
-		--prefix="${EPREFIX}/usr" \
-		--bindir="${EPREFIX}/usr/sbin" \
-		--localstatedir="${EPREFIX}/var/lib/nagios" \
-		--sysconfdir="${EPREFIX}/etc/nagios" \
-		--libexecdir="${EPREFIX}/usr/$(get_libdir)/nagios/plugins" \
-		--with-cgibindir="${EPREFIX}/usr/$(get_libdir)/nagios/cgi-bin" \
-		--with-webdir="${EPREFIX}/usr/share/nagios/htdocs" \
-		--with-init-type="unknown"
-
-	# The paths in the web server configuration files need to match
-	# those passed to econf above.
-	cp "${FILESDIR}/99_nagios4-r1.conf" \
-		"${FILESDIR}/lighttpd_nagios4-r1.conf" \
-		"${T}/" || die "failed to create copies of web server conf files"
-
-	sed -e "s|@CGIBINDIR@|${EPREFIX}/usr/$(get_libdir)/nagios/cgi-bin|g" \
-		-e "s|@WEBDIR@|${EPREFIX}/usr/share/nagios/htdocs|" \
-		-i "${T}/99_nagios4-r1.conf" \
-		-i "${T}/lighttpd_nagios4-r1.conf" \
-		|| die "failed to substitute paths into web server conf files"
-
-}
-
-src_compile() {
-	emake CC="$(tc-getCC)" nagios
-
-	if use web; then
-		# Only compile the CGIs/HTML when USE=web is set.
-		emake CC="$(tc-getCC)" cgis html
-	fi
-}
-
-src_install() {
-	dodoc Changelog CONTRIBUTING.md README.md THANKS UPGRADING
-
-	# There is no way to install the CGIs unstripped from the top-level
-	# makefile, so descend into base/ here. The empty INSTALL_OPTS
-	# ensures that root:root: owns the nagios executables.
-	cd "${S}/base" || die
-	emake INSTALL_OPTS="" DESTDIR="${D}" install-unstripped
-	cd "${S}" || die
-
-	# Otherwise this gets installed as 770 and you get "access denied"
-	# for some reason or other when starting nagios. The permissions
-	# on nagiostats are just for consistency (these should both get
-	# fixed upstream).
-	fperms 775 /usr/sbin/nagios /usr/sbin/nagiostats
-
-	# INSTALL_OPTS are needed for most of install-basic, but we don't
-	# want them on the LIBEXECDIR, argh.
-	emake DESTDIR="${D}" install-basic
-	fowners root:root /usr/$(get_libdir)/nagios/plugins
-
-	# Don't make the configuration owned by the nagios user, because
-	# then he can edit nagios.cfg and trick nagios into running as root
-	# and doing his bidding.
-	emake INSTALL_OPTS="" DESTDIR="${D}" install-config
-
-	# No INSTALL_OPTS used in install-commandmode, thankfully.
-	emake DESTDIR="${D}" install-commandmode
-
-	# The build system installs these directories, but portage assumes
-	# that the build system doesn't know what it's doing so we have to
-	# keepdir them, too. I guess you'll have to manually re-check the
-	# upstream build system forever to see if this is still necessary.
-	keepdir /var/lib/nagios{,/archives,/rw,/spool,/spool/checkresults}
-
-	if use web; then
-		# There is no way to install the CGIs unstripped from the
-		# top-level makefile, so descend into cgi/ here. The empty
-		# INSTALL_OPTS ensures that root:root: owns the CGI executables.
-		cd "${S}/cgi" || die
-		emake INSTALL_OPTS="" DESTDIR="${D}" install-unstripped
-		cd "${S}" || die
-
-		# install-html installs the new exfoliation theme
-		emake INSTALL_OPTS="" DESTDIR="${D}" install-html
-
-		if use classicui; then
-			# This overwrites the already-installed exfoliation theme
-			emake INSTALL_OPTS="" DESTDIR="${D}" install-classicui
-		fi
-
-		# Install cute Gentoo icons (bug #388323), setting their
-		# owner, group, and mode to match those of the rest of Nagios's
-		# images.
-		insinto /usr/share/nagios/htdocs/images/logos
-		doins "${WORKDIR}/${GENTOO_ICONS}"/*.*
-	fi
-
-	# The ./configure script for nagios detects the init system on the
-	# build host, which is wrong for all sorts of reasons. We've gone
-	# to great lengths above to avoid running "install-init" -- even
-	# indirectly -- and so now we must install whatever service files
-	# we need by hand.
-	newinitd startup/openrc-init nagios
-	systemd_newunit startup/default-service nagios.service
-
-	if use web ; then
-		if use apache2 ; then
-			# Install the Nagios configuration file for Apache.
-			insinto "/etc/apache2/modules.d"
-			newins "${T}/99_nagios4-r1.conf" "99_nagios4.conf"
-		elif use lighttpd ; then
-			# Install the Nagios configuration file for Lighttpd.
-			insinto /etc/lighttpd
-			newins "${T}/lighttpd_nagios4-r1.conf" nagios.conf
-		else
-			ewarn "${CATEGORY}/${PF} only supports apache or lighttpd"
-			ewarn "out of the box. Since you are not using one of them, you"
-			ewarn "will have to configure your webserver yourself."
-		fi
-	fi
-}
-
-pkg_postinst() {
-
-	if use web; then
-		if use apache2 || use lighttpd ; then
-			if use apache2; then
-				elog "To enable the Nagios web front-end, please edit"
-				elog "${ROOT}/etc/conf.d/apache2 and add \"-D NAGIOS -D PHP\""
-				elog "to APACHE2_OPTS. Then Nagios will be available at,"
-				elog
-			elif use lighttpd; then
-				elog "To enable the Nagios web front-end, please add"
-				elog "'include \"nagios.conf\"' to the lighttpd configuration"
-				elog "file at ${ROOT}/etc/lighttpd/lighttpd.conf. Then Nagios"
-				elog "will be available at,"
-				elog
-			fi
-
-			elog "  http://localhost/nagios/"
-		fi
-	fi
-
-	elog
-	elog "If your kernel has /proc protection, nagios"
-	elog "will not be happy as it relies on accessing the proc"
-	elog "filesystem. You can fix this by adding nagios into"
-	elog "the group wheel, but this is not recomended."
-	elog
-
-	if [ -n "${REPLACING_VERSIONS}" ]; then
-		ewarn "The local state directory for nagios has changed in v4.4.5,"
-		ewarn "from ${EROOT}/var/nagios to ${EROOT}/var/lib/nagios. If you"
-		ewarn "wish to migrate your state to the new location, first stop"
-		ewarn "nagios and then run"
-		ewarn ""
-		ewarn "  diff --recursive --brief ${EROOT}/var/nagios ${EROOT}/var/lib/nagios"
-		ewarn ""
-		ewarn "to identify any files that should be moved to the new"
-		ewarn "location. They can simply be moved with \"mv\" before"
-		ewarn "restarting nagios."
-	fi
-}
diff --git a/net-analyzer/nagios-plugins/Manifest b/net-analyzer/nagios-plugins/Manifest
index 5b26e509708a..d15c0a42bcc9 100644
--- a/net-analyzer/nagios-plugins/Manifest
+++ b/net-analyzer/nagios-plugins/Manifest
@@ -1 +1,2 @@
 DIST nagios-plugins-2.4.12.tar.gz 2752829 BLAKE2B b72b9350e9c72c9cbe0cbca3effce16ec753887945455a1ac47975105e68f516923020cc88ee42da0c8cd815fe841a82ff5053c3ba5688888bec7be12c08fb8c SHA512 fbff697d0cea1cbeb83737f240a42c00e18bf443b8af303b5d7f7f735eb6faa5305d8740fb27472876dc1398735204e0d7a0e5863c2064ec2a37541253f91502
+DIST nagios-plugins-2.5.tar.gz 2752957 BLAKE2B 6acd5fa3a6df2142989308ab517c1437f5ebe34ae9c4d49ca7d55140244db73fdc33c70ad6b82de8058e2c54c7f78ac021f6ce0a91d2f3d135fa3861b67f87bf SHA512 c91ede043a393d67299589c8e67496dc23381d804876ab81b6bba2db2ba19a0f786893be0c9b3e009e408c9dfd194ba4fa2d7c1fbc8ca08640e6bcc79942a9dc
diff --git a/net-analyzer/nagios-plugins/files/nagios-plugins-2.5-check-icmp-segfault.patch b/net-analyzer/nagios-plugins/files/nagios-plugins-2.5-check-icmp-segfault.patch
new file mode 100644
index 000000000000..b530710bdb73
--- /dev/null
+++ b/net-analyzer/nagios-plugins/files/nagios-plugins-2.5-check-icmp-segfault.patch
@@ -0,0 +1,39 @@
+From c94e36bd08d959faf89c9cfe80e082d5c59c3d9f Mon Sep 17 00:00:00 2001
+From: Michael Orlitzky <michael@orlitzky.com>
+Date: Wed, 1 Jul 2026 16:31:41 -0400
+Subject: [PATCH] plugins-root/check_icmp.c: fix unsigned short overflow
+
+The number of targets (hosts) for check_icmp is tallied up, one at a
+time, in
+
+  static unsigned short targets = 0;
+
+When more than USHRT_MAX hosts are specified, check_icmp segfaults
+before dropping privileges. This may be exploitable, and is bad in any
+case. The same issue was recently fixed in monitoring-plugins:
+
+  https://www.openwall.com/lists/oss-security/2026/07/01/5
+
+The two codebases have diverged, but the issue is easy to reproduce in
+nagios-plugins as well. Afterwards, fixing it is a matter of refusing
+to add_target() when there are already USHRT_MAX targets.
+---
+ plugins-root/check_icmp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
+index f21228fa..34ea12a1 100644
+--- a/plugins-root/check_icmp.c
++++ b/plugins-root/check_icmp.c
+@@ -1705,6 +1705,11 @@ static int add_target_ip(char *arg, struct sockaddr_storage *in) {
+   struct sockaddr_in *sin = NULL, *host_sin;
+   struct sockaddr_in6 *sin6 = NULL, *host_sin6;
+ 
++  if (targets == USHRT_MAX) {
++    crash("add_target_ip(%s, ...): maximum number of targets (%hu) exceeded",
++	  arg, USHRT_MAX);
++  }
++
+   if (address_family == AF_INET) {
+     sin = (struct sockaddr_in *)in;
+   } else {
diff --git a/net-analyzer/nagios-plugins/metadata.xml b/net-analyzer/nagios-plugins/metadata.xml
index e33cee69f8de..99f440eb084e 100644
--- a/net-analyzer/nagios-plugins/metadata.xml
+++ b/net-analyzer/nagios-plugins/metadata.xml
@@ -10,6 +10,10 @@
     <name>Gentoo Sysadmin Project</name>
   </maintainer>
   <use>
+    <flag name="filecaps">
+      Use filesystem capabilities for privileged executables like
+      check_icmp (preferable to suid).
+    </flag>
     <flag name="ipv6">
       Enable ipv6 checks.
     </flag>
@@ -37,6 +41,10 @@
       Install <pkg>dev-perl/Net-SNMP</pkg> required for monitoring
       SNMP values. Disabling the flag does not remove any plugin file.
     </flag>
+    <flag name="suid">
+      Fall back to suid for privileged checks like check_icmp if
+      filecaps are disabled or unavailable.
+    </flag>
   </use>
   <origin>baldeagleos-repo</origin>
 </pkgmetadata>
diff --git a/net-analyzer/nagios-plugins/nagios-plugins-2.5.ebuild b/net-analyzer/nagios-plugins/nagios-plugins-2.5.ebuild
new file mode 100644
index 000000000000..a911d660eab0
--- /dev/null
+++ b/net-analyzer/nagios-plugins/nagios-plugins-2.5.ebuild
@@ -0,0 +1,176 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools fcaps
+
+DESCRIPTION="Official plugins for Nagios"
+HOMEPAGE="https://nagios-plugins.org/
+	https://github.com/nagios-plugins/nagios-plugins"
+SRC_URI="https://github.com/${PN}/${PN}/releases/download/release-${PV}/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="ipv6 ldap mysql nagios-dns nagios-ping nagios-game nls postgres samba selinux snmp ssh +ssl suid rpc"
+
+# Most of the plugins use automagic dependencies, i.e. the plugin will
+# get built if the binary it uses is installed. For example, check_snmp
+# will be built only if snmpget from net-analyzer/net-snmp[-minimal] is
+# installed. End result: most of our runtime dependencies are required
+# at build time as well.
+AUTOMAGIC_DEPEND="
+	nagios-dns? ( net-dns/bind )
+	nagios-game? ( games-util/qstat )
+	nagios-ping? ( net-analyzer/fping )
+	rpc? ( net-nds/rpcbind )
+	samba? ( net-fs/samba )
+	ssh? ( virtual/openssh )
+	snmp? ( dev-perl/Net-SNMP
+			net-analyzer/net-snmp[-minimal] )"
+
+# Perl really needs to run during the build...
+BDEPEND="${AUTOMAGIC_DEPEND}
+	dev-lang/perl"
+
+DEPEND="
+	ldap? ( net-nds/openldap:= )
+	mysql? ( dev-db/mysql-connector-c:= )
+	postgres? ( dev-db/postgresql:* )
+	ssl? (
+		dev-libs/openssl:0=
+	)"
+
+# Basically everything in net-analyzer/monitoring-plugins collides with
+# nagios-plugins. Perl (from BDEPEND) is needed at runtime, too.
+RDEPEND="${BDEPEND}
+	${DEPEND}
+	!net-analyzer/monitoring-plugins
+	selinux? ( sec-policy/selinux-nagios )"
+
+# At least one test is interactive.
+RESTRICT="test"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-2.4.12-postgresql-detection.patch"
+	"${FILESDIR}/${PN}-2.4.12-snmpgetnext.patch"
+	"${FILESDIR}/${P}-check-icmp-segfault.patch"
+)
+
+DOCS=(
+	ACKNOWLEDGEMENTS
+	AUTHORS
+	CODING
+	ChangeLog
+	FAQ
+	NEWS
+	README
+	REQUIREMENTS
+	SUPPORT
+	THANKS
+)
+
+# These all come from gnulib and the ./configure checks are working as
+# intended when the functions aren't present. Bugs 907755 and 924341.
+QA_CONFIG_IMPL_DECL_SKIP=(
+	statvfs64
+	re_set_syntax
+	re_compile_pattern
+	re_search
+	re_match
+)
+
+src_prepare() {
+	default
+
+	# Fix the path to our perl interpreter
+	sed -i -e "1s:/usr/local/bin/perl:/usr/bin/perl:" \
+		"${S}"/plugins-scripts/*.pl \
+		|| die 'failed to fix perl interpreter path'
+
+	# Don't warn about needing to be run as root; hopefully you
+	# have USE=filecaps on and that's not true.
+	sed -e '/^[ \t]*np_warn_if_not_root();$/d' \
+		-i plugins-root/check_{dhcp,icmp}.c || die
+
+	eautoreconf
+
+	# eautoreconf replaces $(MKDIR_P) with $(mkdir_p) in
+	# po/Makefile.in.in. As you might expect, this does not work.
+	sed -i po/Makefile.in.in \
+		-e 's/@mkdir_p@/@MKDIR_P@/' \
+		|| die
+}
+
+src_configure() {
+	# Use an array to prevent econf from mangling the ping args.
+	local myconf=()
+
+	if use ssl; then
+		myconf+=( $(use_with ssl openssl /usr) )
+	else
+		myconf+=( --without-openssl )
+		myconf+=( --without-gnutls )
+	fi
+
+	# The autodetection for these two commands can hang if localhost is
+	# down or ICMP traffic is filtered (bug #468296). But also the path
+	# likes to move around on us (bug #883765).
+	myconf+=( --with-ping-command="$(command -v ping) -n -U -w %d -c %d %s" )
+
+	if use ipv6; then
+		myconf+=( --with-ping6-command="$(command -v ping6) -n -U -w %d -c %d %s" )
+	fi
+
+	# Radius support has been broken for a long time and causes the build
+	# to fail (bug 957000, but before that too). I would recommend using
+	# net-analyzer/monitoring-plugins if you need check_radius.
+	econf \
+		$(use_with ipv6) \
+		$(use_with ldap) \
+		$(use_with mysql) \
+		$(use_enable nls) \
+		$(use_with postgres pgsql /usr) \
+		--without-radius \
+		"${myconf[@]}" \
+		--libexecdir="/usr/$(get_libdir)/nagios/plugins" \
+		--sysconfdir="/etc/nagios"
+}
+
+src_install() {
+	default
+
+	# Prefer capabilities to suid. Beware that fcaps and fperms require
+	# two different kinds of paths; fperms always prepends ${ED}, but
+	# fcaps only does so it if the path does not already start with a
+	# slash. Anyway, begin by removing suid unconditionally.
+	local pd="usr/$(get_libdir)/nagios/plugins"
+
+	if use filecaps; then
+		local flags msg
+		if use suid; then
+			# use suid if setcap fails
+			flags="-m u+s"
+			msg=" (with suid fallback)"
+		fi
+		einfo "replacing suid bits with filecaps${msg}"
+		fperms ug-s /"${pd}"/check_{dhcp,icmp}
+		fcaps ${flags} cap_net_bind_service "${pd}"/check_dhcp
+		fcaps ${flags} cap_net_bind_service,cap_net_raw "${pd}"/check_icmp
+	else
+		# no filecaps, just suid (or not)
+		if ! use suid; then
+			einfo "stripping suid bits"
+			fperms ug-s /"${pd}"/check_{dhcp,icmp}
+		fi
+	fi
+}
+
+pkg_postinst() {
+	elog "This ebuild has a number of USE flags that determine what you"
+	elog "are able to monitor. Depending on what you want to monitor, some"
+	elog "or all of these USE flags need to be set."
+	elog
+	elog "The plugins are installed in ${ROOT}/usr/$(get_libdir)/nagios/plugins"
+}
diff --git a/net-analyzer/nagios/nagios-4.5.12.ebuild b/net-analyzer/nagios/nagios-4.5.12.ebuild
deleted file mode 100644
index 2c77143e18bf..000000000000
--- a/net-analyzer/nagios/nagios-4.5.12.ebuild
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 1999-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="The Nagios metapackage"
-HOMEPAGE="https://www.nagios.org/"
-
-LICENSE="metapackage"
-SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~ppc ppc64 ~riscv ~sparc x86"
-
-RDEPEND="~net-analyzer/nagios-core-${PV}
-	|| ( net-analyzer/nagios-plugins net-analyzer/monitoring-plugins )"
diff --git a/net-analyzer/nagios/nagios-4.5.13.ebuild b/net-analyzer/nagios/nagios-4.5.13.ebuild
index 1707d8cf0b6f..2c77143e18bf 100644
--- a/net-analyzer/nagios/nagios-4.5.13.ebuild
+++ b/net-analyzer/nagios/nagios-4.5.13.ebuild
@@ -8,7 +8,7 @@ HOMEPAGE="https://www.nagios.org/"
 
 LICENSE="metapackage"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~ppc ppc64 ~riscv ~sparc x86"
 
 RDEPEND="~net-analyzer/nagios-core-${PV}
 	|| ( net-analyzer/nagios-plugins net-analyzer/monitoring-plugins )"
diff --git a/net-analyzer/wireshark/wireshark-9999.ebuild b/net-analyzer/wireshark/wireshark-9999.ebuild
index 0ed52f98146d..ceb178e4e61e 100644
--- a/net-analyzer/wireshark/wireshark-9999.ebuild
+++ b/net-analyzer/wireshark/wireshark-9999.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LUA_COMPAT=( lua5-{1,3,4} luajit )
 PYTHON_COMPAT=( python3_{13..14} )
 
-inherit fcaps lua-single python-any-r1 qmake-utils toolchain-funcs xdg cmake
+inherit fcaps lua-single python-any-r1 qt-utils toolchain-funcs xdg cmake
 
 DESCRIPTION="Network protocol analyzer (sniffer)"
 HOMEPAGE="https://www.wireshark.org/"