gentoo auto-resync : 31:12:2022 - 14:19:51

15 files changed, 149 insertions, 42 deletions

diff --git a/sys-apps/Manifest.gz b/sys-apps/Manifest.gz
index 4c3740a49478..a2ba11730d95 100644
--- a/sys-apps/Manifest.gz
+++ b/sys-apps/Manifest.gz
diff --git a/sys-apps/file/Manifest b/sys-apps/file/Manifest
index 65c83a4333ce..1e76a5d40da9 100644
--- a/sys-apps/file/Manifest
+++ b/sys-apps/file/Manifest
@@ -1,12 +1,15 @@
 AUX file-5.39-portage-sandbox.patch 457 BLAKE2B ff4b67570144d5995ef62326da5f7a4ac5fe4befc3db56ff6d6a711c84bb4316da9e1a203326a6bc219066acd8e40634bf17f28f95d583bfa2f3d4698bcd57fc SHA512 20f66d918a605233f733fa6f5c038d9c56ec1175e706b76b16ecb8be81d64d79c3a932824b61092bf1edcd55c29fc2bcfa8bdf506e5717c10e849ec6110bbd3d
 AUX file-5.40-seccomp-fstatat64-musl.patch 578 BLAKE2B c2c074e4dca62253303bae3af88a7ce0bc7d3efd608bd7269d624ad69b0fe4022db38efc5bb63d8f6d1f7bf45c2a1d749c406e76cf1ce42be731e663e2874ad5 SHA512 008c2a2c18b14eaa49f62b87fa14f4bea46bfd56efda17e49541fd51d87201d4d5511d3aae50b53dfcd68cc8e9a38884711ac59458acff9bf3290e267c2891bb
 AUX file-5.43-configure-clang16.patch 473 BLAKE2B 4f98016638a5afb5e7dd8c1085077d562a65811585971f5c5dd3c36b1848754900e2c41779c55b69b65c8ca07533f379623e230f7cd9cecd00318619572f1e24 SHA512 96627055e6a970fbad2f8a3c8d6ad5b326e89fceab081187e012c3a363975bb3d2368320653093121ef132fa80e4c9576278e3d58aee4b5a4afc26aa88ecd5c7
+AUX file-5.43-portage-sandbox.patch 640 BLAKE2B d0442694866d6d0dfa203f686309de3f79a9f3047cbb20b8ea2d9042293c437cbd6b04f02a6c779df9b6331a7c9cee4fc460b2e4ed0c29563fce981f33d69ec3 SHA512 10a8d059a62d3d4f58a255c8204f9f72660babb16e76d9de9946cb1c91130e56c9733f1fcf30396c40bc9906055a123b47ea55d38a54f3473e8b2c69a2f91ef3
+AUX file-5.43-seccomp-fstatat64-musl.patch 565 BLAKE2B 31c42ae9857958e70dc459afc6c2cf1a297c0d29048908e54bd9ea5e15b85608a6fa76795d89716d3c5293a131e986fb83398f4a6eb560a72d794a448387fe2c SHA512 d53ed79b84a7b499c92b5d57ef4b482750a96dbeca904d480b44017e757fee8f404703485513d9da823c7aace7c1b51c64be4402afd6aca0ff9e4ece6ccfcb53
 AUX file-5.44-limits-solaris.patch 443 BLAKE2B d7481f0669b48d6c1a94e50706b6523636adba4e789d8f5a43fe231d26cbe89b8faded72470059cce7064d011eb5587ae4d5ef34c83c0463f04dd322d09aa5a4 SHA512 d96e84db2e87ca616d2d0eea58e188847f5bd98fcb843d1b875786e3f23faf515d199b2ccf5d4cc22834153a889439b7754091f80d5588f7cbd343d218a442c4
+AUX file-5.44-seccomp-utimes.patch 587 BLAKE2B c1d2a8861034e9de0d4b1d0440935bd1ce25b789de0ac7f573378a1ef5d409f4c879deb0fd8dc89c48674d5af795cf8b99f7da870c9e5d54cec7a2d400b803f5 SHA512 e41b80f2e858ecc3e100b128d41c2d2e948a334f87523ae5d0c3b50916c678f37d6f26948d0b51a1bbdea9b0ab2683a3955004df2736d1240dcf80ee14390d9f
 DIST file-5.43.tar.gz 1162786 BLAKE2B aaaf32c5054fb83e912af6656e5e67947f45576ec3711c7cba5531ed780e142a448580e0db41a828c8a3c5d2f1bf0c8ed49bc9688499caaae4a08baa16b3610c SHA512 9d02f4e7a69d90468d6bd35df5ec240ddee8c2408b7df3e73427d7f18736baf77db0638a1fe8283f4e6abd1d5ad653890ed3a5a0d48bb52d4023ca4070ecdf06
 DIST file-5.43.tar.gz.asc 195 BLAKE2B d7f83b3e21d1390467989f8870e36daa48ebb8c5ac7ab8dc6d667a65d10561126d32cfc5ef3d81a130990b3e46bcba9b5e03f0a7dd169782351b02cebec2471f SHA512 c565958840f2f5c62821cd08d4149ec97c574232913ec00400473364e160250cfaced8c715e109c4c617359e33d2470f7ca6af1891cbdf994329e890f90c8be3
 DIST file-5.44.tar.gz 1186437 BLAKE2B a90ccae738a95315d75a0aaee7bbff3624425cc9267daf18ba9147b7c9b9ebfb31288b54c63a73e4695eca0e876f206e40bcb81c422f1bf572b976e753b25a42 SHA512 26c3b9c7a6950649d0b2de896bfeca54289febe4cd487c0f91aa6ff1857fa49f9077f8738a17b86100125668a31dae05b586615c564f78da47ac20a1e4a74f63
 DIST file-5.44.tar.gz.asc 195 BLAKE2B a0905d42fec0fa052d75fb5b267c6ae223176451c0f1d3346006d4b760c3d858f2dcda5f0a30c6aa4b09b5afee427b75bc4debd5033d978f39dc1da01d3e1bd1 SHA512 1a4dc39283f4859581441aa35b3ed72b323c4e05ca0960d17126d1b9ec18465c695c0545e24f09f8437a60ab52e582be67b6cbbc656bbb676de00148c3644d23
-EBUILD file-5.43-r1.ebuild 3748 BLAKE2B 5cce5b890df2d675984dd049b669d4160e9a714d948b4c7213047eda7d0fb4f68bb94059412df0ec222cf3e1b2d3b0bf249e0f13175e8a6fb266f49e3917a61a SHA512 cbed9dfc83dd46e449533c776440e551e545a4c5d215b583ad10aa20ea61917dfb2d84f62e6a858696ac1193253757c67540476e90b79f69029ed48feb393958
-EBUILD file-5.44.ebuild 3922 BLAKE2B a583129159094168006320b2a1843353d1b99817542a305c72d3ff6d1e6a17c9010cdaf81a2b50227234c915c55ffbb0de773b113ca6c5d29d9c3dac10820ef4 SHA512 596c7ff8f285b10a3f0edbd3654994fbeedd5c3a28f6e09f60294ff715a067822af65900b1abcc8afb9d5a0ed401cbf18fc193d30656c1b27ac87d556cdd73bf
-EBUILD file-9999.ebuild 3870 BLAKE2B ac7f37d005c94d589cf9663a2443d7ea49df93e52da2b66c60d1e755ba787810c1885d47268e424857e19755786d69660415f137baf3f4b2325b40e94dc998a3 SHA512 d44ae484b41b20df592a0b69ce054557a963f8b63b956f9ec70564351d7c23ab26d969bc3f1d914a0440da7dad72b1ae413193c1e6cc1a1263e4052a64028309
+EBUILD file-5.43-r2.ebuild 3748 BLAKE2B 8a3bf79b24f0e7adb88254c67efffd6c4d811b2dbbe95067861ca0c750ce3f4eaf48d996cf9d903196da0889796051c55d79443132b0ff4ef3337342f730b5e1 SHA512 e3cad781107a0db9d3125584c48ffb70aa22ca211691aba621d342f61878bb6b1460aede609e51d2f80bfd866dac5d9f1e57fca1c5bfd03c83e7063307ffb519
+EBUILD file-5.44-r1.ebuild 3977 BLAKE2B 3f59ebb6fe4aa4d30c634ed3605df50e9353a764314a3199a402637ef05f726799da80e51dae5743d7aae04aaf7b41218edbd172216166ce58340bc7081ea97e SHA512 f73860f67289d5193d08874d4c6552e4f4a56145bab1cbb78224c81a4cfed4ed7a2a517e334673e54b07674b77b9abce977b60d54e2582f291266c984c55a6ad
+EBUILD file-9999.ebuild 3855 BLAKE2B 29dc182f37fe2d0195eee8df904472447b97f97db750a46d686badb2795736035661ec2a398e36b416c27880df4caadddd283fddf2762a17ce1e94faca4faf49 SHA512 a271f686925d2b3be69e08f58a84be9ab742a19c0dc5f8d86413aae646aedbcc27fe51c0e8451ca92633d268bed1e529e52aa227e1c77b520f60048cc7dcd60c
 MISC metadata.xml 565 BLAKE2B 737512e354fedb4483608b04c594a486c0d8a0f70d23d306c59c78dedb0c8116f80ff558926444b9d9b9ef15805b3826163523b5644c88f01a330be1b8c9a76f SHA512 f240bf9e064c6e6f5b63e3265dfe3adf5b1d2c2b5b2456b79ea7451580150271ccb4097d33967de57ba767fecbdbea51fb62ccb683fcc5e1cca101be660ffd19
diff --git a/sys-apps/file/file-5.43-r1.ebuild b/sys-apps/file/file-5.43-r2.ebuild
index 10bf50a18e4f..610753073aa6 100644
--- a/sys-apps/file/file-5.43-r1.ebuild
+++ b/sys-apps/file/file-5.43-r2.ebuild
@@ -49,8 +49,8 @@ BDEPEND+="
 	)"
 
 PATCHES=(
-	"${FILESDIR}/file-5.39-portage-sandbox.patch" #713710 #728978
-	"${FILESDIR}/file-5.40-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-portage-sandbox.patch" #713710 #728978
+	"${FILESDIR}/file-5.43-seccomp-fstatat64-musl.patch" #789336, not upstream yet
 	"${FILESDIR}/${P}-configure-clang16.patch"
 )
 
diff --git a/sys-apps/file/file-5.44.ebuild b/sys-apps/file/file-5.44-r1.ebuild
index 8d91170d66e5..c29778951f51 100644
--- a/sys-apps/file/file-5.44.ebuild
+++ b/sys-apps/file/file-5.44-r1.ebuild
@@ -18,7 +18,7 @@ else
 	SRC_URI="ftp://ftp.astron.com/pub/file/${P}.tar.gz"
 	SRC_URI+=" verify-sig? ( ftp://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
 fi
@@ -52,9 +52,10 @@ BDEPEND+="
 	)"
 
 PATCHES=(
-	"${FILESDIR}/file-5.39-portage-sandbox.patch" #713710 #728978
-	"${FILESDIR}/file-5.40-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-portage-sandbox.patch" #889046
 	"${FILESDIR}/file-5.44-limits-solaris.patch" # applied upstream
+	"${FILESDIR}/file-5.44-seccomp-utimes.patch" # upstream
 )
 
 src_prepare() {
diff --git a/sys-apps/file/file-9999.ebuild b/sys-apps/file/file-9999.ebuild
index 81f60050024c..c83ce4f71f81 100644
--- a/sys-apps/file/file-9999.ebuild
+++ b/sys-apps/file/file-9999.ebuild
@@ -18,7 +18,7 @@ else
 	SRC_URI="ftp://ftp.astron.com/pub/file/${P}.tar.gz"
 	SRC_URI+=" verify-sig? ( ftp://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
 fi
@@ -52,8 +52,8 @@ BDEPEND+="
 	)"
 
 PATCHES=(
-	"${FILESDIR}/file-5.39-portage-sandbox.patch" #713710 #728978
-	"${FILESDIR}/file-5.40-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-seccomp-fstatat64-musl.patch" #789336, not upstream yet
+	"${FILESDIR}/file-5.43-portage-sandbox.patch" #889046
 )
 
 src_prepare() {
diff --git a/sys-apps/file/files/file-5.43-portage-sandbox.patch b/sys-apps/file/files/file-5.43-portage-sandbox.patch
new file mode 100644
index 000000000000..f9e715cc366f
--- /dev/null
+++ b/sys-apps/file/files/file-5.43-portage-sandbox.patch
@@ -0,0 +1,28 @@
+Allow syscalls for Gentoo's portage sandbox
+
+- Add getcwd (bug #728978)
+- Add faccessat2 (bug #889046)
+
+Bug: https://bugs.gentoo.org/728978
+Bug: https://bugs.gentoo.org/889046
+--- a/src/seccomp.c
++++ b/src/seccomp.c
+@@ -174,6 +174,9 @@ enable_sandbox_full(void)
+ 	ALLOW_RULE(exit_group);
+ #ifdef __NR_faccessat
+ 	ALLOW_RULE(faccessat);
++#endif
++#ifdef __NR_faccessat2
++        ALLOW_RULE(faccessat2);
+ #endif
+ 	ALLOW_RULE(fcntl);
+  	ALLOW_RULE(fcntl64);
+@@ -237,6 +240,8 @@ enable_sandbox_full(void)
+ 	ALLOW_RULE(write);
+ 	ALLOW_RULE(writev);
+ 
++	// needed by Gentoo's portage sandbox
++	ALLOW_RULE(getcwd);
+ 
+ #if 0
+ 	// needed by valgrind
diff --git a/sys-apps/file/files/file-5.43-seccomp-fstatat64-musl.patch b/sys-apps/file/files/file-5.43-seccomp-fstatat64-musl.patch
new file mode 100644
index 000000000000..a039882ac8d7
--- /dev/null
+++ b/sys-apps/file/files/file-5.43-seccomp-fstatat64-musl.patch
@@ -0,0 +1,22 @@
+From 8c13923a8e17a02be0989649b2edc20124816729 Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Tue, 15 Jun 2021 16:08:22 -0400
+Subject: [PATCH] seccomp: undef fstatat64 to avoid build failure on musl
+
+sys/stat.h in musl does this:
+
+  #define fstatat64 fstatat
+
+Counteract this with an #undef.
+
+Bug: https://bugs.gentoo.org/789336
+--- a/src/seccomp.c
++++ b/src/seccomp.c
+@@ -182,6 +182,7 @@ enable_sandbox_full(void)
+ #endif
+  	ALLOW_RULE(fstat64);
+ #ifdef __NR_fstatat64
++#undef fstatat64
+ 	ALLOW_RULE(fstatat64);
+ #endif
+ 	ALLOW_RULE(futex);
diff --git a/sys-apps/file/files/file-5.44-seccomp-utimes.patch b/sys-apps/file/files/file-5.44-seccomp-utimes.patch
new file mode 100644
index 000000000000..49f1c2e4b739
--- /dev/null
+++ b/sys-apps/file/files/file-5.44-seccomp-utimes.patch
@@ -0,0 +1,18 @@
+https://github.com/file/file/commit/1590a653b520123d47070a47436abfba42d4c943
+
+From 1590a653b520123d47070a47436abfba42d4c943 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Mon, 26 Dec 2022 18:57:29 +0000
+Subject: [PATCH] PR/408: SpraxDev: Add utimes to the allow list for -p
+
+--- a/src/seccomp.c
++++ b/src/seccomp.c
+@@ -233,6 +233,7 @@ enable_sandbox_full(void)
+ 	ALLOW_RULE(umask);	// Used in file_pipe2file()
+ 	ALLOW_RULE(getpid);	// Used by glibc in file_pipe2file()
+ 	ALLOW_RULE(unlink);
++	ALLOW_RULE(utimes);
+ 	ALLOW_RULE(write);
+ 	ALLOW_RULE(writev);
+ 
+
diff --git a/sys-apps/portage/Manifest b/sys-apps/portage/Manifest
index 1746b991834c..9e1eecc22439 100644
--- a/sys-apps/portage/Manifest
+++ b/sys-apps/portage/Manifest
@@ -7,8 +7,8 @@ AUX portage-tmpdir.conf 76 BLAKE2B 79f35df57dbdcd461d94d558212261df7df54253d5205
 DIST portage-3.0.38.1.tar.bz2 1116216 BLAKE2B d1cb4cc1924673d07ea7174ad0a84b3af977dd28ca659695d3e4014e4aa83b054acba82a160e7c0a8d3d4fbc3514bea619c3d720e450cb4890818e4b1bc1e43a SHA512 1375565e936276fd6cfd2a4f6f782b91e234e973d6a998f2276a076dd165272bcf12067fd01e77b238f194eac69edf967bbe3ac62edc3701fe9375c693622ab9
 DIST portage-3.0.41.tar.bz2 1119737 BLAKE2B 6c6d1fa11f16362505e321eb530d233cf73a7e1cc7dab2fc88ad40701c16835e08a7d16a408381e2f717ac5f48d46344e57b9b5296be4eba0a7583540c6a81aa SHA512 046621ee59b2b1b374a63091028ed3462b1212960b337e8e034c739d5c51d5ae1e7b491c88940199e710081409e38778749a5c86576cf5bb6c59b1890dc892b5
 DIST portage-3.0.42.tar.bz2 1122793 BLAKE2B 9df93e5ebeab415bd3b56e4e1771b628f5e3622d997aa8818e7ce42f77d60ffcb1807093dbc44852c5b359c632c11dcb7db6c026f2e7e224293e7ebb9e64b286 SHA512 f3d2bb5a1adc801c641ff14043b1617831c646a9432b2602e48343d8264850bb410a1666d646b97e224864d56cc7acae0aa044a7476384030063fb77e4323724
-EBUILD portage-3.0.38.1-r5.ebuild 9166 BLAKE2B 08cd16f97004d6957f74368105f0284ffb2bb563ba14c2c07ff82b52a1f219d21ceeb9ac29f0b3db22a4bbc7b32aefdb6593b9f640ef96e03cd8cf18b3233755 SHA512 3804e8b9fd0d39c1334ac7b8da6005a63fe9702d8182745b6953f64da251e5eb367797b9da8ad906d80f1b5436b00cd6da57b94d514b1cab117dc11e4df808ec
-EBUILD portage-3.0.41-r1.ebuild 9132 BLAKE2B 05ff0d35daf6660b24b665d189954246c0fcccc7be1000b981be013e06e2dd0d94385387ff39859e8321ec2cc903ac9486ca1c0f958975d0b477548d0b930ed0 SHA512 72fe7520842f125e26715e8fcac2b0a3b7e52b595e1e549fe78d6c9f029239713ce8b5e4270172daa594c9e4ed1f3d16c0d676e073b5ea6e78093a8aa1d3dfe4
-EBUILD portage-3.0.42.ebuild 9140 BLAKE2B f6228e5de275039e3aacd0c5ca8321527cb82118d1d0f0abf10ae257213e314372e35e17bd0b5af2c156cf1052e785c70f6bd5f8972c426c07a409fbc3fef24a SHA512 22eff20bca50a8fede5d780d27924b9d21b672c009b119b0a9205a18c6e81a5eb6e4ce62aae5e557c6f50ad187e564b692357fd98e9af24bb60c9d36b56371d3
-EBUILD portage-9999.ebuild 8380 BLAKE2B a5086b7a5d23fc4e3c4bd3d5c314f01c94866e956b003c9b17bb2fcd7f1e4120d9d4eb98066abba2103fcc692ebed3dc3bfc022d0cdcb29e1ba1851a97fe80c0 SHA512 64d0ba17919fdea6bc72c8c4e4a3e7c974f8c7c694b60f9befc9fc72a3fbbeca27ced69ad395647f4f8505223a2d107e7a8adcc37c373128e8fef9f21191841e
+EBUILD portage-3.0.38.1-r6.ebuild 9294 BLAKE2B d22e4580b7afc07fc6ed98fb00f9b2b1b2993549239ab3abfd6411865ae5adb281fe423cdd96549458d91139d53911f044f8f01736f86292809576377f6c09c6 SHA512 6a642e20914d25ea37c5f94d053741378c8be60d8be0ed07ec7becc35e7f0dd9ff9a6edce238b1ac5b67236d0cbefece005f51ee06945dc59927db771d452103
+EBUILD portage-3.0.41-r2.ebuild 9261 BLAKE2B 836391be0afa5d1f971775a9cc1b6db8bf26a940315f46d04d6e36c7fadc7f316dc8551d7d379913e1cb3eb5bb3dd376cbac59e0f6cdfd955685c3c529baca2a SHA512 08c70bbca341b0acc5f8636f8b84f828cd351a91e8d5a58e493f3602b66a2568cd6914f2deabd12216e0839b12328370f1bb7f94f021ea781647007234cd5df6
+EBUILD portage-3.0.42-r1.ebuild 9269 BLAKE2B 0cc257e6cf91ea251575cff68ab3a704a44c40a08d59ff8eadacfd6bcba72a72712e002d1ecf1d1475904a94d5dfa1e96fbd9f3f2b95e7aada77f3fb19c620c3 SHA512 8dbd085382e1688958bb2154c9bead21b430670d107ae1b13c8487c0d61bf0e63eb1779347913c42555ce5a5541fb95a21885946af35f08af15a8fa552ecd9e9
+EBUILD portage-9999.ebuild 8507 BLAKE2B 5cf45f1540fcb04ca5d03ad158e339557ed418cc9b8bc61fd8bb31f791c23a083b506af8b77348a093705772accc83da1f68a282bbde06ea4d1a09d961866ee3 SHA512 6303c0c02ee72409411266542d6026d6a8e34fdcf46eaa9652984f5704f83d2eccaf7c8f574ddbf26385ef21fc1961dd973560ed2b35d89d4ae63e17d41e8edd
 MISC metadata.xml 1487 BLAKE2B 5b9833e8bfc2c38e4db95f2368a65d85623aa8dd166e4e09bed4cbe3a7e59d47da69a9dff1e6615fd64f349cc05f57217ee61ebfd23e3e13622a7573ea135659 SHA512 b22f8c1f3a4dce636d0f823f1303f60d32fd570b484e93a64dfbdcbe145534b3472ae94c1ac992a478c9e2930fbc8a5311e0080b4722f9b5dc29dff59ddaa7c8
diff --git a/sys-apps/portage/portage-3.0.38.1-r5.ebuild b/sys-apps/portage/portage-3.0.38.1-r6.ebuild
index 2f21f269366b..636d3faab4a1 100644
--- a/sys-apps/portage/portage-3.0.38.1-r5.ebuild
+++ b/sys-apps/portage/portage-3.0.38.1-r6.ebuild
@@ -22,7 +22,8 @@ RESTRICT="!test? ( test )"
 BDEPEND="
 	app-arch/xz-utils
 	test? ( dev-vcs/git )"
-DEPEND="!build? ( $(python_gen_impl_dep 'ssl(+)') )
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
 	>=app-arch/tar-1.27
 	dev-lang/python-exec:2
 	>=sys-apps/sed-4.0.5 sys-devel/patch
@@ -30,7 +31,8 @@ DEPEND="!build? ( $(python_gen_impl_dep 'ssl(+)') )
 	apidoc? (
 		dev-python/sphinx[${PYTHON_USEDEP}]
 		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
-	)"
+	)
+"
 # Require sandbox-2.2 for bug #288863.
 # For whirlpool hash, require python[ssl] (bug #425046).
 # For compgen, require bash[readline] (bug #445576).
@@ -63,13 +65,19 @@ RDEPEND="
 	!<app-admin/logrotate-3.8.0
 	!<app-portage/gentoolkit-0.4.6
 	!<app-portage/repoman-2.3.10
-	!~app-portage/repoman-3.0.0"
+	!~app-portage/repoman-3.0.0
+"
+# Weird dep construct for sys-apps/file can be removed once >=file-5.44-r1 stable
 PDEPEND="
 	!build? (
 		>=net-misc/rsync-2.6.4
-		>=sys-apps/file-5.41
+		|| (
+			>=sys-apps/file-5.44-r1
+			=sys-apps/file-5.43-r2
+		)
 		>=sys-apps/coreutils-6.4
-	)"
+	)
+"
 # coreutils-6.4 rdep is for date format in emerge-webrsync #164532
 # NOTE: FEATURES=installsources requires debugedit and rsync
 
diff --git a/sys-apps/portage/portage-3.0.41-r1.ebuild b/sys-apps/portage/portage-3.0.41-r2.ebuild
index 7c0dd5a89947..7654a8382e76 100644
--- a/sys-apps/portage/portage-3.0.41-r1.ebuild
+++ b/sys-apps/portage/portage-3.0.41-r2.ebuild
@@ -21,8 +21,10 @@ RESTRICT="!test? ( test )"
 
 BDEPEND="
 	app-arch/xz-utils
-	test? ( dev-vcs/git )"
-DEPEND="!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	test? ( dev-vcs/git )
+"
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
 	>=app-arch/tar-1.27
 	dev-lang/python-exec:2
 	>=sys-apps/sed-4.0.5 sys-devel/patch
@@ -30,7 +32,8 @@ DEPEND="!build? ( $(python_gen_impl_dep 'ssl(+)') )
 	apidoc? (
 		dev-python/sphinx[${PYTHON_USEDEP}]
 		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
-	)"
+	)
+"
 # Require sandbox-2.2 for bug #288863.
 # For whirlpool hash, require python[ssl] (bug #425046).
 # For compgen, require bash[readline] (bug #445576).
@@ -63,13 +66,19 @@ RDEPEND="
 	!<app-admin/logrotate-3.8.0
 	!<app-portage/gentoolkit-0.4.6
 	!<app-portage/repoman-2.3.10
-	!~app-portage/repoman-3.0.0"
+	!~app-portage/repoman-3.0.0
+"
+# Weird dep construct for sys-apps/file can be removed once >=file-5.44-r1 stable
 PDEPEND="
 	!build? (
 		>=net-misc/rsync-2.6.4
-		>=sys-apps/file-5.41
+		|| (
+			>=sys-apps/file-5.44-r1
+			=sys-apps/file-5.43-r2
+		)
 		>=sys-apps/coreutils-6.4
-	)"
+	)
+"
 # coreutils-6.4 rdep is for date format in emerge-webrsync #164532
 # NOTE: FEATURES=installsources requires debugedit and rsync
 
diff --git a/sys-apps/portage/portage-3.0.42.ebuild b/sys-apps/portage/portage-3.0.42-r1.ebuild
index f01eddfc50ae..cba50d3d026d 100644
--- a/sys-apps/portage/portage-3.0.42.ebuild
+++ b/sys-apps/portage/portage-3.0.42-r1.ebuild
@@ -21,8 +21,10 @@ RESTRICT="!test? ( test )"
 
 BDEPEND="
 	app-arch/xz-utils
-	test? ( dev-vcs/git )"
-DEPEND="!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	test? ( dev-vcs/git )
+"
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
 	>=app-arch/tar-1.27
 	dev-lang/python-exec:2
 	>=sys-apps/sed-4.0.5 sys-devel/patch
@@ -30,7 +32,8 @@ DEPEND="!build? ( $(python_gen_impl_dep 'ssl(+)') )
 	apidoc? (
 		dev-python/sphinx[${PYTHON_USEDEP}]
 		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
-	)"
+	)
+"
 # Require sandbox-2.2 for bug #288863.
 # For whirlpool hash, require python[ssl] (bug #425046).
 # For compgen, require bash[readline] (bug #445576).
@@ -63,13 +66,19 @@ RDEPEND="
 	!<app-admin/logrotate-3.8.0
 	!<app-portage/gentoolkit-0.4.6
 	!<app-portage/repoman-2.3.10
-	!~app-portage/repoman-3.0.0"
+	!~app-portage/repoman-3.0.0
+"
+# Weird dep construct for sys-apps/file can be removed once >=file-5.44-r1 stable
 PDEPEND="
 	!build? (
 		>=net-misc/rsync-2.6.4
-		>=sys-apps/file-5.41
+		|| (
+			>=sys-apps/file-5.44-r1
+			=sys-apps/file-5.43-r2
+		)
 		>=sys-apps/coreutils-6.4
-	)"
+	)
+"
 # coreutils-6.4 rdep is for date format in emerge-webrsync #164532
 # NOTE: FEATURES=installsources requires debugedit and rsync
 
diff --git a/sys-apps/portage/portage-9999.ebuild b/sys-apps/portage/portage-9999.ebuild
index f44665dcdb56..27741e2fdd31 100644
--- a/sys-apps/portage/portage-9999.ebuild
+++ b/sys-apps/portage/portage-9999.ebuild
@@ -21,8 +21,10 @@ IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux
 RESTRICT="!test? ( test )"
 
 BDEPEND="
-	test? ( dev-vcs/git )"
-DEPEND="!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	test? ( dev-vcs/git )
+"
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
 	>=app-arch/tar-1.27
 	dev-lang/python-exec:2
 	>=sys-apps/sed-4.0.5 sys-devel/patch
@@ -64,12 +66,17 @@ RDEPEND="
 	!<app-portage/gentoolkit-0.4.6
 	!<app-portage/repoman-2.3.10
 	!~app-portage/repoman-3.0.0"
+# Weird dep construct for sys-apps/file can be removed once >=file-5.44-r1 stable
 PDEPEND="
 	!build? (
 		>=net-misc/rsync-2.6.4
-		>=sys-apps/file-5.41
+		|| (
+			>=sys-apps/file-5.44-r1
+			=sys-apps/file-5.43-r2
+		)
 		>=sys-apps/coreutils-6.4
-	)"
+	)
+"
 # coreutils-6.4 rdep is for date format in emerge-webrsync #164532
 # NOTE: FEATURES=installsources requires debugedit and rsync
 
diff --git a/sys-apps/sandbox/Manifest b/sys-apps/sandbox/Manifest
index a94791d80012..53a103fcba0d 100644
--- a/sys-apps/sandbox/Manifest
+++ b/sys-apps/sandbox/Manifest
@@ -2,5 +2,5 @@ AUX 09sandbox 37 BLAKE2B 181213e2cc0bcfa328310cced40bfaba4530d8d2f80e892cb5649d5
 DIST sandbox-2.29.tar.xz 452784 BLAKE2B 388f5d9c49134696bafbc6b882581396a9fa2e7caa6ccfb4376706d653f836ce18e0d77527c4c4f2ff753c0b920ab5ab60e151dd8a4e399e13dbc3fe7c0533d6 SHA512 15c0e6b71e8b8547b8188f857568c99b1925d5a837a289b21c4f842341361bf7119b96083697dc83546caf530daab700fb8c2704974e7cfb804d64bb5257a4b4
 DIST sandbox-2.30.tar.xz 455764 BLAKE2B eb3bf46aedda96154a96f31d31469b394fd7ea113c2f2f01e739c690f2305ce95e0e2c7b641c1c7e088d89a1c36b82ce7afd6422fd137b7d93fd5b601be43996 SHA512 4a7dd2c7c50ac68d1944bea1275d0b66789055342f3aaa507f7440926bf5d9639850a98fa036da539708b6dbe4766b60f960b738db1c5ee5518ca81d1a629cae
 EBUILD sandbox-2.29.ebuild 1559 BLAKE2B 932256bc928e7bd353bb63314d99dd2910f0d27d162804f318bab5e6d912450b1078ba91c79441b16990726b96fa1fe6302ea1a30c8b27ec416c1226ef440932 SHA512 798034189cde52b59c4a8d613590462a0353253e9b18dd33dda80dd27c1027c3b5dd83901789390665a3a56e287ee365e1af8c50edd7948b8c0ec95809b84465
-EBUILD sandbox-2.30.ebuild 1568 BLAKE2B 830be28da17e37d2319e3b515a8e12dd610c1777dabf9d47d48a73e8b8655f4d244857ef278b9ba641987898a52e41eb74298e665c5498a604167c705c282561 SHA512 3c0c597e8e82ed10b0c93f78ef3d822ba58c8bc6064a5f4ac778ae4d7099b4d65add6ac8e2d36db7a9bef2c64f46e42ce2acb873bcab8ef6932c87c32eef2d47
+EBUILD sandbox-2.30-r1.ebuild 1745 BLAKE2B 350055cc75f6a9ae440c5eda45d9bc95ba8e82d1d854a7cc1915b89ff4f00805eb688209d937118e4ddecc54806ee58d04d216fe998d1e6634f61559c57bf066 SHA512 d0aa96a0079552cc633514915ff10ac98857953bb0e8876ef3520e7ecc171321d2c9a39ac83f28e344b8a322260bab5ce0bfde4bf654789dc1cf844ab89f385c
 MISC metadata.xml 377 BLAKE2B fcbc91501a4a61bfa3c3cc01b0746f5f638093933cf8a9ba1e6206071cb0482c9ba18c5c10541d934327cf805ee0e40c010b3f25a221ab63fefa2fd9f39da0d7 SHA512 92aa26a3200dd1508fb86da0e0bc70be66ccbcf66593ee6833102c9961ac17c8a99c5b070a2cd2e79dba8e5daa0316cdb6744baa3fbd9342953fcc00b1277d35
diff --git a/sys-apps/sandbox/sandbox-2.30.ebuild b/sys-apps/sandbox/sandbox-2.30-r1.ebuild
index faed8b2a7983..7a018dc315d1 100644
--- a/sys-apps/sandbox/sandbox-2.30.ebuild
+++ b/sys-apps/sandbox/sandbox-2.30-r1.ebuild
@@ -14,9 +14,12 @@ SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="+nnp"
 
-DEPEND="app-arch/xz-utils
-	>=app-misc/pax-utils-0.1.19" #265376
-RDEPEND=""
+# pax-utils lower bound for bug #265376
+DEPEND=">=app-misc/pax-utils-0.1.19"
+# Avoid folks installing with older file, bug #889046. We still need the
+# >= dep in Portage but this is a safety net if people do partial upgrades.
+RDEPEND="!<sys-apps/file-5.44-r1"
+BDEPEND="app-arch/xz-utils"
 
 has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS+=" sandbox_death_notice"
 
@@ -34,8 +37,7 @@ src_prepare() {
 
 	# sandbox uses `__asm__ (".symver "...` which does
 	# not play well with gcc's LTO: https://gcc.gnu.org/PR48200
-	append-flags -fno-lto
-	append-ldflags -fno-lto
+	filter-lto
 }
 
 multilib_src_configure() {