From 2d40c745e14c62764999c540b0380d1f5d00328c Mon Sep 17 00:00:00 2001
From: Flatcar Buildbot <buildbot@flatcar-linux.org>
Date: Mon, 16 Jun 2025 07:12:55 +0000
Subject: [PATCH] net-misc/chrony: Sync with Gentoo

It's from Gentoo commit 29a5fc395f8beb40621a9c1141d78298a2392b88.
---
 .../portage-stable/net-misc/chrony/Manifest   |   2 +
 .../net-misc/chrony/chrony-4.7.ebuild         | 271 ++++++++++++++++++
 .../net-misc/chrony/chrony-9999.ebuild        |   9 +-
 .../files/chrony-4.7-pool-vendor-gentoo.patch |  16 ++
 .../files/chrony-4.7-systemd-gentoo.patch     |  11 +
 5 files changed, 304 insertions(+), 5 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-4.7.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/chrony/files/chrony-4.7-pool-vendor-gentoo.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/net-misc/chrony/files/chrony-4.7-systemd-gentoo.patch

diff --git a/sdk_container/src/third_party/portage-stable/net-misc/chrony/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/chrony/Manifest
index 6005353620..3bb4527fec 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/chrony/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/chrony/Manifest
@@ -1,2 +1,4 @@
 DIST chrony-4.6.1.tar.gz 636076 BLAKE2B cc1299ba680eae158da9ebc6d4451ffc8b352b9b0da47056e4ccd21495589d88ee9f8cb9ef8508e7c1a1b0a14b6679453a6d324111308a00888123a265eca788 SHA512 646ae08f2587366236796f2399d8ab3eb570979e0d82f5d13f5cec49939054c876cc93dc20c8d38e105fd3500e1720d05a223a15076783cd882d0de43afd9c7e
 DIST chrony-4.6.1.tar.gz.asc 833 BLAKE2B 19e7359220beb93ede262cad7fec4963b15873510530690eefcdc28c69222ac40e41849487b9514665443dff888fbeeea1a2cbef0517da38a210a6573f4e9c99 SHA512 992b706636bf3a7eb6d502562a4990c9d8e20e5f3011d2cdb2ceb32220e9a1c2bfa6eca767212cee49b811823872602dc33f9e7201a7f9a93cc9c90e81b1db49
+DIST chrony-4.7.tar.gz 644610 BLAKE2B a1a951ea925c183c97d6b934d85d4cb35b15db555d64a4f7abe75a5a5cf69d4747ccbd9d09be403187991745dd38fc4eea994a7c4488cab44c11c6600596ec22 SHA512 419594ab8ff0fd42acaf6e4ca1a011d5cf87c8d90ab040e90bb004b43570888329531593f073fb7c5a1093b5754d61c1ae6034d0b86660e4dc37d42ee0f30623
+DIST chrony-4.7.tar.gz.asc 833 BLAKE2B 67facf41c41b729794f2cb0ce63402b91b5915cec53997f22327687d951be0b677274567bc99c03c6d2702de7c2a69becb0cf88c22147528ce0e86a823ff3af8 SHA512 c2351e6e624f60e82973bddd5cb1d84c90ee5e862d7d24dfc2b7a8f60a6a948f7446c9b7d68c5e72be4afccbd5d8f572141a4e0bde9cfeefc59aebb7e4fc74e1
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-4.7.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-4.7.ebuild
new file mode 100644
index 0000000000..d11b1f1472
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-4.7.ebuild
@@ -0,0 +1,271 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo systemd tmpfiles toolchain-funcs
+
+DESCRIPTION="NTP client and server programs"
+HOMEPAGE="https://chrony-project.org/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://gitlab.com/chrony/chrony.git"
+	inherit git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/mlichvar.asc
+	inherit verify-sig
+
+	SRC_URI="https://chrony-project.org/releases/${P/_/-}.tar.gz"
+	SRC_URI+=" verify-sig? ( https://chrony-project.org/releases/${P/_/-}-tar-gz-asc.txt -> ${P/_/-}.tar.gz.asc )"
+
+	if [[ ${PV} != *_pre* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+fi
+
+S="${WORKDIR}/${P/_/-}"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="+caps +cmdmon debug html libtomcrypt +nettle nss +nts +phc pps +readline +refclock +rtc samba +seccomp +sechash selinux"
+# nettle > nss > libtomcrypt in configure
+REQUIRED_USE="
+	sechash? ( || ( nettle nss libtomcrypt ) )
+	nettle? ( !nss )
+	nss? ( !nettle )
+	libtomcrypt? ( !nettle !nss )
+	!sechash? ( !nss )
+	!sechash? ( !nts? ( !nettle ) )
+"
+
+DEPEND="
+	caps? (
+		sys-libs/libcap
+	)
+	libtomcrypt? ( dev-libs/libtomcrypt:= )
+	nettle? ( dev-libs/nettle:= )
+	nss? ( dev-libs/nss:= )
+	nts? ( net-libs/gnutls:= )
+	pps? ( net-misc/pps-tools )
+	readline? ( dev-libs/libedit )
+	seccomp? ( sys-libs/libseccomp )
+"
+RDEPEND="
+	${DEPEND}
+	caps? (
+		acct-group/ntp
+		acct-user/ntp
+	)
+	selinux? ( sec-policy/selinux-chronyd )
+"
+BDEPEND="
+	caps? (
+		acct-group/ntp
+		acct-user/ntp
+	)
+	html? ( dev-ruby/asciidoctor )
+	nts? ( virtual/pkgconfig )
+	sechash? (
+		nettle? ( virtual/pkgconfig )
+		nss? ( virtual/pkgconfig )
+	)
+"
+
+if [[ ${PV} == 9999 ]] ; then
+	# Needed for doc generation in 9999
+	REQUIRED_USE+=" html"
+	BDEPEND+="
+		app-alternatives/yacc
+		virtual/w3m
+	"
+else
+	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-mlichvar-20210513 )"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-4.7-pool-vendor-gentoo.patch
+	"${FILESDIR}"/${PN}-4.7-systemd-gentoo.patch
+)
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# FP, checks with macro afterwards (bug #907877)
+	recvmmsg
+)
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e 's:/etc/chrony\.conf:/etc/chrony/chrony.conf:g' \
+		doc/* examples/* || die
+
+	cp "${FILESDIR}"/chronyd.conf-r3 "${T}"/chronyd.conf || die
+}
+
+src_configure() {
+	if ! use caps ; then
+		sed -i \
+			-e 's/ -u ntp//' \
+			"${T}"/chronyd.conf examples/chronyd.service || die
+	fi
+
+	if ! use seccomp ; then
+		sed -i \
+			-e 's/ -F 2//' \
+			"${T}"/chronyd.conf examples/chronyd.service || die
+	fi
+
+	tc-export CC PKG_CONFIG
+
+	# Update from time to time with output from "date +%s"
+	# on a system that is time-synced.
+	export SOURCE_DATE_EPOCH=1607976314
+
+	# Not an autotools generated script
+	local myconf=(
+		$(use_enable seccomp scfilter)
+
+		$(usev !caps '--disable-linuxcaps')
+		$(usev !cmdmon '--disable-cmdmon')
+		$(usev debug '--enable-debug')
+
+		# USE=readline here means "readline-like functionality"
+		# chrony only supports libedit in terms of the library providing
+		# it.
+		$(usev !readline '--without-editline --disable-readline')
+
+		$(usev !libtomcrypt '--without-tomcrypt')
+		$(usev !nettle '--without-nettle')
+		$(usev !nss '--without-nss')
+		$(usev !nts '--disable-nts')
+		$(usev !nts '--without-gnutls')
+		$(usev !phc '--disable-phc')
+		$(usev !pps '--disable-pps')
+		$(usev !refclock '--disable-refclock')
+		$(usev !rtc '--disable-rtc')
+		$(usev samba '--enable-ntp-signd')
+		$(usev !sechash '--disable-sechash')
+
+		--chronysockdir="${EPREFIX}/run/chrony"
+		--docdir="${EPREFIX}/usr/share/doc/${PF}"
+		--mandir="${EPREFIX}/usr/share/man"
+		--prefix="${EPREFIX}/usr"
+		--sysconfdir="${EPREFIX}/etc/chrony"
+		--with-hwclockfile="${EPREFIX}/etc/adjtime"
+		--with-pidfile="${EPREFIX}/run/chrony/chronyd.pid"
+
+		${EXTRA_ECONF}
+	)
+
+	# Print the ./configure call
+	edo ./configure "${myconf[@]}" || die
+}
+
+src_compile() {
+	if [[ ${PV} == 9999 ]] ; then
+		# Uses w3m
+		emake -C doc man txt
+	fi
+
+	emake all docs $(usev !html 'ADOC=true')
+}
+
+src_install() {
+	default
+
+	# Compatibility with other distributions who install to /etc/chrony.conf (bug #835461)
+	dosym -r /etc/chrony/chrony.conf /etc/chrony.conf
+
+	newinitd "${FILESDIR}"/chronyd.init-r2 chronyd
+	newconfd "${T}"/chronyd.conf chronyd
+
+	insinto /etc/${PN}
+	newins examples/chrony.conf.example1 chrony.conf
+
+	docinto examples
+	dodoc examples/*.example*
+
+	newtmpfiles - chronyd.conf <<<"d /run/chrony 0750 $(usex caps 'ntp ntp' 'root root')"
+
+	if use html ; then
+		docinto html
+		dodoc doc/*.html
+	fi
+
+	keepdir /var/{lib,log}/chrony
+
+	if use caps ; then
+		# Prepare a directory for the chrony.drift file (a la ntpsec)
+		# Ensures the environment is sane on new installs
+		# bug #711058
+		fowners -R ntp:ntp /var/{lib,log}/chrony
+		fperms -R 770 /var/lib/chrony
+	fi
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/chrony-2.4-r1.logrotate chrony
+
+	systemd_dounit examples/chronyd.service
+	systemd_dounit examples/chrony-wait.service
+	systemd_enable_ntpunit 50-chrony chronyd.service
+}
+
+pkg_preinst() {
+	HAD_CAPS=0
+	HAD_SECCOMP=0
+	HAD_PRE_NEW_SECCOMP_LEVEL=0
+
+	# See https://dev.gentoo.org/~zmedico/portage/doc/portage.html#package-ebuild-phases-after-2.1.5
+	# in "Ebuild Phases" for an explanation of why we need to save the variable beforehand
+	if has_version 'net-misc/chrony[caps]' ; then
+		HAD_CAPS=1
+	fi
+
+	if has_version 'net-misc/chrony[seccomp]' ; then
+		HAD_SECCOMP=1
+	fi
+
+	if has_version '>=net-misc/chrony-4.1[seccomp]' ; then
+		# This version introduced a new filter level: -F 2
+		# It's a limited set of seccomp filters designed to be 'bare minimum'
+		HAD_PRE_NEW_SECCOMP_LEVEL=1
+	fi
+}
+
+pkg_postinst() {
+	tmpfiles_process chronyd.conf
+
+	if [[ -n "${REPLACING_VERSIONS}" ]] ; then
+		if use caps && ! [[ ${HAD_CAPS} -eq 1 ]] ; then
+			# bug #719876
+			ewarn "Please adjust permissions on ${EROOT}/var/{lib,log}/chrony to be owned by ntp:ntp"
+			ewarn "e.g. chown -R ntp:ntp ${EROOT}/var/{lib,log}/chrony"
+			ewarn "This is necessary for chrony to drop privileges"
+		elif ! use caps && [[ ${HAD_CAPS} -eq 0 ]] ; then
+			ewarn "Please adjust permissions on ${EROOT}/var/{lib,log}/chrony to be owned by root:root"
+		fi
+	fi
+
+	# See bug #783915 for general discussion on enabling seccomp filtering
+	# by default.
+	local show_seccomp_enable_msg=0
+
+	# Was seccomp disabled before and now enabled?
+	if [[ ${HAD_SECCOMP} -eq 0 ]] && use seccomp ; then
+		show_seccomp_enable_msg=1
+	fi
+
+	# Are we coming from an old version without the new 'minimal' filter?
+	# (-F 2)
+	if [[ ${HAD_PRE_NEW_SECCOMP_LEVEL} -eq 0 ]] ; then
+		show_seccomp_enable_msg=1
+	fi
+
+	if [[ ${show_seccomp_enable_msg} -eq 1 ]] ; then
+		elog "To enable seccomp in a stricter mode, please modify:"
+		elog "- ${EROOT}/etc/conf.d/chronyd for OpenRC"
+		elog "- systemctl edit chronyd for systemd"
+		elog "to use -F 1 or -F -1 instead of -F 2 (see man chronyd)"
+		elog "By default, we now use -F 2 which is a baseline/minimal filter."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-9999.ebuild
index 7805861241..d11b1f1472 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/chrony/chrony-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -27,7 +27,7 @@ S="${WORKDIR}/${P/_/-}"
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="+caps +cmdmon debug html libtomcrypt +nettle nss +ntp +nts +phc pps +readline +refclock +rtc samba +seccomp +sechash selinux"
+IUSE="+caps +cmdmon debug html libtomcrypt +nettle nss +nts +phc pps +readline +refclock +rtc samba +seccomp +sechash selinux"
 # nettle > nss > libtomcrypt in configure
 REQUIRED_USE="
 	sechash? ( || ( nettle nss libtomcrypt ) )
@@ -83,8 +83,8 @@ else
 fi
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-3.5-pool-vendor-gentoo.patch
-	"${FILESDIR}"/${PN}-4.2-systemd-gentoo.patch
+	"${FILESDIR}"/${PN}-4.7-pool-vendor-gentoo.patch
+	"${FILESDIR}"/${PN}-4.7-systemd-gentoo.patch
 )
 
 QA_CONFIG_IMPL_DECL_SKIP=(
@@ -137,7 +137,6 @@ src_configure() {
 		$(usev !libtomcrypt '--without-tomcrypt')
 		$(usev !nettle '--without-nettle')
 		$(usev !nss '--without-nss')
-		$(usev !ntp '--disable-ntp')
 		$(usev !nts '--disable-nts')
 		$(usev !nts '--without-gnutls')
 		$(usev !phc '--disable-phc')
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/chrony/files/chrony-4.7-pool-vendor-gentoo.patch b/sdk_container/src/third_party/portage-stable/net-misc/chrony/files/chrony-4.7-pool-vendor-gentoo.patch
new file mode 100644
index 0000000000..e7b078872e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/chrony/files/chrony-4.7-pool-vendor-gentoo.patch
@@ -0,0 +1,16 @@
+- Use the Gentoo pool
+- Use the server directive instead of the pool directive so we get four time
+  sources and not twelve.
+--- a/examples/chrony.conf.example1
++++ b/examples/chrony.conf.example1
+@@ -1,5 +1,8 @@
+-# Use four public NTP servers from the pool.ntp.org project.
+-pool pool.ntp.org iburst
++# Use public NTP servers from the pool.ntp.org project.
++server 0.gentoo.pool.ntp.org iburst
++server 1.gentoo.pool.ntp.org iburst
++server 2.gentoo.pool.ntp.org iburst
++server 3.gentoo.pool.ntp.org iburst
+ 
+ # Record the rate at which the system clock gains/losses time.
+ driftfile /var/lib/chrony/drift
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/chrony/files/chrony-4.7-systemd-gentoo.patch b/sdk_container/src/third_party/portage-stable/net-misc/chrony/files/chrony-4.7-systemd-gentoo.patch
new file mode 100644
index 0000000000..bc9f1f494c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/chrony/files/chrony-4.7-systemd-gentoo.patch
@@ -0,0 +1,11 @@
+--- a/examples/chronyd.service
++++ b/examples/chronyd.service
+@@ -10,7 +10,7 @@ Type=notify
+ PIDFile=/run/chrony/chronyd.pid
+ Environment="OPTIONS="
+ EnvironmentFile=-/etc/sysconfig/chronyd
+-ExecStart=/usr/sbin/chronyd -n $OPTIONS
++ExecStart=/usr/sbin/chronyd -n $OPTIONS -u ntp -F 2
+ 
+ CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+ CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE