Merge pull request #3270 from dm0-/glsa

Fix remaining GLSAs

sdk_container/src/third_party/coreos-overlay/net-fs/samba/Manifest

@@ -1,2 +1,2 @@
-DIST samba-4.5.1.tar.gz 20930661 SHA256 b0a703e069677ff3182e5da3a91e018db344e3b54e0a43ed43dbfd8eb7d3f085 SHA512 636c0d2c68f2e041c6961013365314192b5bdb670281fad52c6a7d9ae8e617d0c678f382cde4132cda694c8c5f0552d681ea45ae98bf6f339fa149227d75a3f2 WHIRLPOOL 5c978b03878cd08beff98ac91213c5ac52da8c41527a1c32150a81a142ec4f2f7911c888dd8a70f8ffbdb4e82508856deefbf0c39fd225db6f324518fdedba80
+DIST samba-4.5.11-disable-python-patches.tar.xz 6292 SHA256 8db451910c3d46fc715203e0b674c49846528cf864c381520dc93de20a3637d3 SHA512 f0e3076e3e1ecaae3f06b3ef30efc81719fb3f63a1041dcbdae4b62ca4cf693732f9eb16f047d046d4930136fed82194e82b455ea888e12cf845b3e6a122d57d WHIRLPOOL 641d429fc4865e12e89bad28110b03ca87c6b658f59943f4d44c0b3a91fc49b5dc90e496a8a9d391c2897aec87fc43ea1c9a26084f3394b1883ad9755fd0eca3
-DIST samba-disable-python-patches-4.5.0_rc1.tar.xz 6204 SHA256 fa0d776e04e3222c0dc4761e376717f4154937cdcb85f4117b8978dfb770a78e SHA512 920089ba3c6e8e7d913b1d7ef1017262a19d1af41215adb30cfc98a57556efc4b0116931d4ef774c01124149d8eca2be3a23814ce7e11daf0180d2c111799927 WHIRLPOOL 6d55710895435ad012e23f8c252e5276966241014710349ca7fa9cf037e8742030b8e053f7cb71309a0a45f48d2235d55393243bf4d19476a22dd39bb1b7748d
+DIST samba-4.5.16.tar.gz 21024396 SHA256 3a3356faab1694680e2ccd7fdf051ab1bbd3b0d058fc1f671e135dd2d1eae1aa SHA512 de8a41013cfb5ef3adcb290efd97a78a5de876d90ad05764d631f14e663a1849bb53e4ac394b46c906f1109be5748fee9316407a659c57007d36851ae8adcd7f WHIRLPOOL 28b95f4e57fc7630adaa503eadbb8e53950876d9954df10cceab154021390d6bb45c8f54b6fe6cc61a128a2b9c58f01d542b434ea0c75b8121ebd7c07605fe53

sdk_container/src/third_party/coreos-overlay/net-fs/samba/files/4.4/samba4.initd-r1

@@ -1,7 +1,6 @@
 #!/sbin/openrc-run
 # Copyright 1999-2016 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License, v2 or later
-# $Id$
 
 extra_started_commands="reload"
 piddir="/run/samba"

sdk_container/src/third_party/coreos-overlay/net-fs/samba/files/samba-4.5.1-compile_et_fix.patch

@@ -0,0 +1,16 @@
+--- samba-4.5.1/source4/heimdal_build/wscript_configure
++++ samba-4.5.1/source4/heimdal_build/wscript_configure
+@@ -258,7 +258,11 @@
+ 
+ # With the proper checks in place we should be able to build against the system libtommath.
+ #if conf.CHECK_BUNDLED_SYSTEM('tommath', checkfunctions='mp_init', headers='tommath.h'):
+ #    conf.define('USING_SYSTEM_TOMMATH', 1)
+ 
+-check_system_heimdal_binary("compile_et")
+-check_system_heimdal_binary("asn1_compile")
++# comment out next line to stop Gentoo Samba build from using the compile_et in e2fsprogs-libs
++# to compile the error tables. This produces a compile error later on.
++#check_system_heimdal_binary("compile_et")
++#
++# As a precaution do the same for asn1_compile
++#check_system_heimdal_binary("asn1_compile")

sdk_container/src/third_party/coreos-overlay/net-fs/samba/files/samba-glibc-2.26-no_rpc.patch

@@ -0,0 +1,14 @@
+https://attachments.samba.org/attachment.cgi?id=13172
+https://bugs.gentoo.org/637320
+
+--- a/lib/replace/wscript
++++ b/lib/replace/wscript
+@@ -71,7 +71,7 @@
+     conf.CHECK_HEADERS('sys/fileio.h sys/filesys.h sys/dustat.h sys/sysmacros.h')
+     conf.CHECK_HEADERS('xfs/libxfs.h netgroup.h')
+ 
+-    conf.CHECK_CODE('', headers='rpc/rpc.h rpcsvc/yp_prot.h', define='HAVE_RPCSVC_YP_PROT_H')
++    conf.CHECK_CODE('ypstat s;', headers='rpc/rpc.h rpcsvc/yp_prot.h', define='HAVE_RPCSVC_YP_PROT_H')
+ 
+     conf.CHECK_HEADERS('valgrind.h valgrind/valgrind.h valgrind/memcheck.h')
+     conf.CHECK_HEADERS('nss_common.h nsswitch.h ns_api.h')

sdk_container/src/third_party/coreos-overlay/net-fs/samba/metadata.xml

@@ -10,22 +10,23 @@
 	</longdescription>
 	<use>
 		<flag name="addc">Enable Active Directory Domain Controller support</flag>
-		<flag name="ads">Enable Active Directory support</flag>
-		<flag name="swat">Enables support for swat configuration gui</flag>
-		<flag name="winbind">Enables support for the winbind auth daemon</flag>
-		<flag name="client">Enables the client part</flag>
-		<flag name="server">Enables the server part</flag>
-		<flag name="netapi">Enable building of netapi bits</flag>
 		<flag name="addns">Enable AD DNS integration</flag>
+		<flag name="ads">Enable Active Directory support</flag>
 		<flag name="aio">Enable asynchronous IO support</flag>
+		<flag name="ceph">Enable support for Ceph distributed filesystem via <pkg>sys-cluster/ceph</pkg></flag>
+		<flag name="client">Enables the client part</flag>
 		<flag name="cluster">Enable support for clustering</flag>
 		<flag name="dmapi">Enable support for DMAPI. This currently works only in combination with XFS.</flag>
-		<flag name="ldb">Enable the ldb tools</flag>
+		<flag name="gpg">Use <pkg>app-crypt/gpgme</pkg> for AD DC</flag>
+		<flag name="iprint">Enabling iPrint technology by Novell</flag>
 		<flag name="quota">Enables support for user quotas</flag>
-		<flag name="smbclient">Enable smbclient tool</flag>
+		<flag name="system-heimdal">Use <pkg>app-crypt/heimdal</pkg> instead of
-		<flag name="smbsharemodes">Enable special smb share modes (?) </flag>
+			bundled heimdal.</flag>
 		<flag name="system-mitkrb5">Use <pkg>app-crypt/mit-krb5</pkg> instead of
 			<pkg>app-crypt/heimdal</pkg>.</flag>
-		<flag name="iprint">Enabling iPrint technology by Novell</flag>
+		<flag name="winbind">Enables support for the winbind auth daemon</flag>
 	</use>
+	<upstream>
+		<remote-id type="cpe">cpe:/a:samba:samba</remote-id>
+	</upstream>
 </pkgmetadata>

sdk_container/src/third_party/coreos-overlay/net-fs/samba/samba-4.5.16.ebuild

@@ -1,6 +1,5 @@
-# Copyright 1999-2016 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Id$
 
 EAPI=6
 PYTHON_COMPAT=( python2_7 )
@@ -15,9 +14,9 @@ SRC_PATH="stable"
 [[ ${PV} = *_rc* ]] && SRC_PATH="rc"
 
 SRC_URI="mirror://samba/${SRC_PATH}/${MY_P}.tar.gz
-	https://dev.gentoo.org/~polynomial-c/samba-disable-python-patches-4.5.0_rc1.tar.xz"
+	https://dev.gentoo.org/~polynomial-c/samba-4.5.11-disable-python-patches.tar.xz"
 [[ ${PV} = *_rc* ]] || \
-KEYWORDS="amd64 arm64 ~hppa ~x86"
+KEYWORDS="alpha amd64 arm arm64 ~hppa ia64 ppc ppc64 sparc x86"
 
 DESCRIPTION="Samba Suite Version 4"
 HOMEPAGE="http://www.samba.org/"
@@ -25,8 +24,15 @@ LICENSE="GPL-3"
 
 SLOT="0"
 
-IUSE="acl addc addns ads client cluster cups dmapi fam gnutls iprint ldap
+IUSE="acl addc addns ads client cluster cups dmapi fam gnutls gpg iprint ldap pam
-+minimal pam quota selinux syslog +system-mitkrb5 systemd test winbind zeroconf"
+quota selinux syslog system-heimdal +system-mitkrb5 systemd test winbind zeroconf"
+IUSE+=" +minimal"  # COREOS: Only install libraries, not executables.
+
+# the test suite is messed, it uses system-installed samba
+# bits instead of what was built, tests things disabled via use
+# flags, and generally just fails to work in a way ebuilds could
+# rely on in its current state
+RESTRICT="test"
 
 MULTILIB_WRAPPED_HEADERS=(
 	/usr/include/samba-4.0/policy.h
@@ -46,42 +52,63 @@ CDEPEND="
 	dev-libs/libbsd[${MULTILIB_USEDEP}]
 	dev-libs/iniparser:0
 	dev-libs/popt[${MULTILIB_USEDEP}]
-	sys-libs/readline:=
-	virtual/libiconv
 	sys-apps/attr[${MULTILIB_USEDEP}]
 	sys-libs/libcap
 	sys-libs/ncurses:0=[${MULTILIB_USEDEP}]
+	sys-libs/readline:0=
 	sys-libs/zlib[${MULTILIB_USEDEP}]
+	virtual/libiconv
 	pam? ( virtual/pam )
 	acl? ( virtual/acl )
 	addns? ( net-dns/bind-tools[gssapi] )
-	cluster? ( !dev-db/ctdb )
+	cluster? (
+		net-libs/rpcsvc-proto
+		!dev-db/ctdb
+	)
 	cups? ( net-print/cups )
 	dmapi? ( sys-apps/dmapi )
 	fam? ( virtual/fam )
-	gnutls? ( dev-libs/libgcrypt:0
+	gnutls? (
-		>=net-libs/gnutls-1.4.0 )
+		dev-libs/libgcrypt:0
+		>=net-libs/gnutls-1.4.0
+	)
+	gpg? ( app-crypt/gpgme )
 	ldap? ( net-nds/openldap[${MULTILIB_USEDEP}] )
+	system-heimdal? ( >=app-crypt/heimdal-1.5[-ssl,${MULTILIB_USEDEP}] )
 	system-mitkrb5? ( app-crypt/mit-krb5[${MULTILIB_USEDEP}] )
-	!system-mitkrb5? ( >=app-crypt/heimdal-1.5[-ssl,${MULTILIB_USEDEP}] )
 	systemd? ( sys-apps/systemd:0= )"
 DEPEND="${CDEPEND}
+	${PYTHON_DEPS}
+	app-text/docbook-xsl-stylesheets
 	dev-lang/perl:=
-	virtual/pkgconfig"
+	dev-libs/libxslt
+	virtual/pkgconfig
+	test? (
+		>=sys-libs/nss_wrapper-1.1.3
+		>=net-dns/resolv_wrapper-1.1.4
+		>=net-libs/socket_wrapper-1.1.7
+		>=sys-libs/uid_wrapper-1.2.1
+	)"
 RDEPEND="${CDEPEND}
 	client? ( net-fs/cifs-utils[ads?] )
 	selinux? ( sec-policy/selinux-samba )
 	!dev-perl/Parse-Yapp
 "
 
-REQUIRED_USE="addc? ( gnutls !system-mitkrb5 )
+REQUIRED_USE="
+	addc? ( gnutls !system-mitkrb5 )
 	ads? ( acl gnutls ldap )
-	"
+	cluster? ( ads )
+	gpg? ( addc )
+	?? ( system-heimdal system-mitkrb5 )
+	${PYTHON_REQUIRED_USE}"
 
 S="${WORKDIR}/${MY_P}"
 
 PATCHES=(
 	"${FILESDIR}/${PN}-4.4.0-pam.patch"
+	"${FILESDIR}/${PN}-4.5.1-compile_et_fix.patch"
+	"${FILESDIR}/${PN}-glibc-2.26-no_rpc.patch" #637320
 )
 
 #CONFDIR="${FILESDIR}/$(get_version_component_range 1-2)"
@@ -94,7 +121,9 @@ SHAREDMODS=""
 pkg_setup() {
 	python-single-r1_pkg_setup
 	if use cluster ; then
-		SHAREDMODS="${SHAREDMODS}idmap_rid,idmap_tdb2,idmap_ad"
+		SHAREDMODS="idmap_rid,idmap_tdb2,idmap_ad"
+	elif use ads ; then
+		SHAREDMODS="idmap_ad"
 	fi
 }
 
@@ -102,12 +131,27 @@ src_prepare() {
 	default
 
 	# install the patches from tarball(s)
-	eapply "${WORKDIR}/patches/"
+	eapply "${WORKDIR}/patches"
 
+	sed -e 's:<gpgme\.h>:<gpgme/gpgme.h>:' \
+		-i source4/dsdb/samdb/ldb_modules/password_hash.c \
+		|| die
+
+	# Friggin' WAF shit
 	multilib_copy_sources
 }
 
 multilib_src_configure() {
+	# when specifying libs for samba build you must append NONE to the end to
+	# stop it automatically including things
+	local bundled_libs="NONE"
+	if ! use system-heimdal && ! use system-mitkrb5 ; then
+		bundled_libs="heimbase,heimntlm,hdb,kdc,krb5,wind,gssapi,hcrypto,hx509,roken,asn1,com_err,NONE"
+	fi
+
+	# COREOS: Don't depend on tons of new packages with broken cross-compilation support.
+	bundled_libs=ALL
+
 	local myconf=()
 	myconf=(
 		--enable-fhs
@@ -115,13 +159,15 @@ multilib_src_configure() {
 		--localstatedir="${EPREFIX}/var"
 		--with-modulesdir="${EPREFIX}/usr/$(get_libdir)/samba"
 		--with-piddir="${EPREFIX}/run/${PN}"
-		--bundled-libraries=ALL
+		--without-lttng
+		--bundled-libraries="${bundled_libs}"
 		--builtin-libraries=NONE
 		--disable-rpath
 		--disable-rpath-install
-		--disable-python
 		--nopyc
 		--nopyo
+		--disable-cephfs
+		--disable-python  # COREOS: Don't build libraries requiring Python.
 	)
 	if multilib_is_native_abi ; then
 		myconf+=(
@@ -129,12 +175,12 @@ multilib_src_configure() {
 			$(usex addc '' '--without-ad-dc')
 			$(use_with addns dnsupdate)
 			$(use_with ads)
-			$(usex ads '--with-shared-modules=idmap_ad' '')
 			$(use_with cluster cluster-support)
 			$(use_enable cups)
 			$(use_with dmapi)
 			$(use_with fam)
 			$(use_enable gnutls)
+			$(use_with gpg gpgme)
 			$(use_enable iprint)
 			$(use_with ldap)
 			$(use_with pam)
@@ -160,6 +206,7 @@ multilib_src_configure() {
 			--without-dmapi
 			--without-fam
 			--disable-gnutls
+			--without-gpgme
 			--disable-iprint
 			$(use_with ldap)
 			--without-pam
@@ -168,6 +215,7 @@ multilib_src_configure() {
 			--without-systemd
 			$(usex system-mitkrb5 '--with-system-mitkrb5' '')
 			--without-winbind
+			--disable-python
 		)
 	fi
 
@@ -175,6 +223,10 @@ multilib_src_configure() {
 		waf-utils_src_configure ${myconf[@]}
 }
 
+multilib_src_compile() {
+	waf-utils_src_compile
+}
+
 multilib_src_install() {
 	waf-utils_src_install
 
@@ -190,13 +242,26 @@ multilib_src_install() {
 
 		# create symlink for cups (bug #552310)
 		if use cups ; then
-			dosym /usr/bin/smbspool /usr/libexec/cups/backend/smb
+			dosym ../../../bin/smbspool /usr/libexec/cups/backend/smb
 		fi
 
 		# install example config file
 		insinto /etc/samba
 		doins examples/smb.conf.default
 
+		# Fix paths in example file (#603964)
+		sed \
+			-e '/log file =/s@/usr/local/samba/var/@/var/log/samba/@' \
+			-e '/include =/s@/usr/local/samba/lib/@/etc/samba/@' \
+			-e '/path =/s@/usr/local/samba/lib/@/var/lib/samba/@' \
+			-e '/path =/s@/usr/local/samba/@/var/lib/samba/@' \
+			-e '/path =/s@/usr/spool/samba@/var/spool/samba@' \
+			-i "${ED%/}"/etc/samba/smb.conf.default || die
+
+		# Install init script and conf.d file
+		newinitd "${CONFDIR}/samba4.initd-r1" samba
+		newconfd "${CONFDIR}/samba4.confd" samba
+
 		if ! use minimal ; then
 			systemd_dotmpfilesd "${FILESDIR}"/samba.conf
 		fi
@@ -206,19 +271,18 @@ multilib_src_install() {
 		systemd_dounit "${FILESDIR}"/winbindd.service
 		systemd_dounit "${FILESDIR}"/samba.service
 	fi
-	rm ${D}/usr/lib*/samba/ldb/*
-	rm ${D}/etc/samba/smb.conf.default
 
+	rm -f "${ED%/}"/etc/samba/*
+	rm -f "${ED%/}"/usr/lib*/samba/ldb/*
 	if use minimal ; then
-	   mv ${D}/usr/bin/net ${T}
+		mv "${ED%/}"/usr/bin/net "${T}"/
-	   rm ${D}/usr/bin/*
+		rm -f "${ED%/}"/usr/bin/* "${ED%/}"/usr/sbin/*
-	   mv ${T}/net ${D}/usr/bin/net
+		mv "${T}"/net "${ED%/}"/usr/bin/net
-	   rm ${D}/usr/sbin/*
+		rm -rf ${ED%/}/lib*/security
-	   rm -rf ${D}/lib*/security
+		rm -rf ${ED%/}/usr/lib/systemd
-	   rm -rf ${D}/usr/lib/systemd
+		rm -rf ${ED%/}/usr/lib*/perl*
-	   rm -rf ${D}/var/
+		rm -rf ${ED%/}/usr/lib*/python*
-	   rm -rf ${D}/usr/lib*/perl5
+		rm -rf ${ED%/}/var
-	   rm -rf ${D}/usr/lib*/python2.7
 	fi
 }
 
@@ -236,6 +300,6 @@ pkg_postinst() {
 
 	elog "For further information and migration steps make sure to read "
 	elog "http://samba.org/samba/history/${P}.html "
-	elog "http://samba.org/samba/history/${PN}-4.2.0.html and"
+	elog "http://samba.org/samba/history/${PN}-4.5.0.html and"
 	elog "http://wiki.samba.org/index.php/Samba4/HOWTO "
 }

sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/Manifest

@@ -1 +1 @@
-DIST shadow-4.5.tar.gz 3804933 SHA256 ed2d53bd0e80cf32261e82b8d93684334e8809266dba1ec7a42bfa747605989e SHA512 02d6482a1159689e404dd49a68b4e2db85e9ffdcdfbacc8efcbd9043f14a1ec3fc4d749700df915d375df67d589219b6b0f57a6cfd9fb5b197012888a608913b WHIRLPOOL 73552aff621cf34ef977095a05d9b679b7b6ffa78979d69eeb43089564aca5cc1d841dc9cbb6f0fba4c4f712f0e89f6cc683b733ea1041e4633b5d9fe58b5499
+DIST shadow-4.6.tar.gz 3804282 BLAKE2B 268c90e7daba138827aec6039f428f52cdcf7929743fa1f49f801cc669de7456ec5a69531194cdb29f051ce7d0b2f1e966fdf2513a9fc8f7fbdeb29d786a509f SHA512 36358333e7f03ef558772f3361bc5851a7d7fd3d85c993a6b732e37304b8068b2893d55607b9bfe8b8eed616a687264f947ff66cefc74ea1a48ba9396d464714

sdk_container/src/third_party/coreos-overlay/sys-apps/shadow/shadow-4.6.ebuild

@@ -1,9 +1,9 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="5"
+EAPI=6
 
-inherit eutils libtool pam multilib systemd
+inherit libtool pam multilib systemd
 
 DESCRIPTION="Utilities to deal with user accounts"
 HOMEPAGE="https://github.com/shadow-maint/shadow http://pkg-shadow.alioth.debian.org/"
@@ -11,11 +11,10 @@ SRC_URI="https://github.com/shadow-maint/shadow/releases/download/${PV}/${P}.tar
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86"
-IUSE="acl audit cracklib nls pam selinux skey xattr"
+IUSE="acl audit +cracklib nls pam selinux skey xattr"
 # Taken from the man/Makefile.am file.
 LANGS=( cs da de es fi fr hu id it ja ko pl pt_BR ru sv tr zh_CN zh_TW )
-IUSE+=" $(printf 'linguas_%s ' ${LANGS[*]})"
 
 RDEPEND="acl? ( sys-apps/acl:0= )
 	audit? ( >=sys-process/audit-2.6:0= )
@@ -35,37 +34,39 @@ RDEPEND="${RDEPEND}
 	pam? ( >=sys-auth/pambase-20150213 )"
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-4.1.3-dots-in-usernames.patch
+	"${FILESDIR}/${PN}-4.1.3-dots-in-usernames.patch"
 )
 
 src_prepare() {
-	epatch "${PATCHES[@]}"
+	default
-	epatch_user
 	#eautoreconf
 	elibtoolize
 }
 
 src_configure() {
-	econf \
+	local myeconfargs=(
-		--without-group-name-max-length \
+		--without-group-name-max-length
-		--without-tcb \
+		--without-tcb
-		--enable-shared=no \
+		--enable-shared=no
-		--enable-static=yes \
+		--enable-static=yes
-		$(use_with acl) \
+		$(use_with acl)
-		$(use_with audit) \
+		$(use_with audit)
-		$(use_with cracklib libcrack) \
+		$(use_with cracklib libcrack)
-		$(use_with pam libpam) \
+		$(use_with pam libpam)
-		$(use_with skey) \
+		$(use_with skey)
-		$(use_with selinux) \
+		$(use_with selinux)
-		$(use_enable nls) \
+		$(use_enable nls)
-		$(use_with elibc_glibc nscd) \
+		$(use_with elibc_glibc nscd)
 		$(use_with xattr attr)
+	)
+	econf "${myeconfargs[@]}"
+
 	has_version 'sys-libs/uclibc[-rpc]' && sed -i '/RLOGIN/d' config.h #425052
 
 	if use nls ; then
 		local l langs="po" # These are the pot files.
 		for l in ${LANGS[*]} ; do
-			use linguas_${l} && langs+=" ${l}"
+			has ${l} ${LINGUAS-${l}} && langs+=" ${l}"
 		done
 		sed -i "/^SUBDIRS = /s:=.*:= ${langs}:" man/Makefile || die
 	fi
@@ -77,13 +78,13 @@ set_login_opt() {
 		comment="#"
 		sed -i \
 			-e "/^${opt}\>/s:^:#:" \
-			"${ED}"/usr/share/shadow/login.defs || die
+			"${ED%/}"/usr/share/shadow/login.defs || die
 	else
 		sed -i -r \
 			-e "/^#?${opt}\>/s:.*:${opt} ${val}:" \
-			"${ED}"/usr/share/shadow/login.defs
+			"${ED%/}"/usr/share/shadow/login.defs
 	fi
-	local res=$(grep "^${comment}${opt}\>" "${ED}"/usr/share/shadow/login.defs)
+	local res=$(grep "^${comment}${opt}\>" "${ED%/}"/usr/share/shadow/login.defs)
 	einfo "${res:-Unable to find ${opt} in /usr/share/shadow/login.defs}"
 }
 
@@ -95,24 +96,26 @@ src_install() {
 	#   Currently, libshadow.a is for internal use only, so if you see
 	#   -lshadow in a Makefile of some other package, it is safe to
 	#   remove it.
-	rm -f "${ED}"/{,usr/}$(get_libdir)/lib{misc,shadow}.{a,la}
+	rm -f "${ED%/}"/{,usr/}$(get_libdir)/lib{misc,shadow}.{a,la}
 
 	# Remove files from /etc, they will be symlinks to /usr instead.
-	rm -f "${ED}"/etc/{limits,login.access,login.defs,securetty,default/useradd}
+	rm -f "${ED%/}"/etc/{limits,login.access,login.defs,securetty,default/useradd}
 
 	# CoreOS: break shadow.conf into two files so that we only have to apply
 	# etc-shadow.conf in the initrd.
 	systemd_dotmpfilesd "${FILESDIR}"/tmpfiles.d/etc-shadow.conf
 	systemd_dotmpfilesd "${FILESDIR}"/tmpfiles.d/var-shadow.conf
+	# Package the symlinks for the SDK and containers.
+	systemd-tmpfiles --create --root="${ED}" "${FILESDIR}"/tmpfiles.d/*
 
 	insinto /usr/share/shadow
-	# Using a securetty with devfs device names added
-	# (compat names kept for non-devfs compatibility)
-	insopts -m0600 ; doins "${FILESDIR}"/securetty
 	if ! use pam ; then
 		insopts -m0600
 		doins etc/login.access etc/limits
 	fi
+	# Using a securetty with devfs device names added
+	# (compat names kept for non-devfs compatibility)
+	insopts -m0600 ; doins "${FILESDIR}"/securetty
 	# Output arch-specific cruft
 	local devs
 	case $(tc-arch) in
@@ -120,10 +123,10 @@ src_install() {
 		hppa)  devs="ttyB0";;
 		arm)   devs="ttyFB0 ttySAC0 ttySAC1 ttySAC2 ttySAC3 ttymxc0 ttymxc1 ttymxc2 ttymxc3 ttyO0 ttyO1 ttyO2";;
 		sh)    devs="ttySC0 ttySC1";;
-		amd64|x86)	devs="hvc0";;
+		amd64|x86)      devs="hvc0";;
 	esac
 	if [[ -n ${devs} ]]; then
-		printf '%s\n' ${devs} >> "${ED}"/usr/share/shadow/securetty
+		printf '%s\n' ${devs} >> "${ED%/}"/usr/share/shadow/securetty
 	fi
 
 	# needed for 'useradd -D'
@@ -182,27 +185,27 @@ src_install() {
 			-e 'b exit' \
 			-e ': pamnote; i# NOTE: This setting should be configured via /etc/pam.d/ and not in this file.' \
 			-e ': exit' \
-			"${ED}"/usr/share/shadow/login.defs || die
+			"${ED%/}"/usr/share/shadow/login.defs || die
 
 		# remove manpages that pam will install for us
 		# and/or don't apply when using pam
-		find "${ED}"/usr/share/man \
+		find "${ED%/}"/usr/share/man \
 			'(' -name 'limits.5*' -o -name 'suauth.5*' ')' \
 			-delete
 
 		# Remove pam.d files provided by pambase.
-		rm "${ED}"/etc/pam.d/{login,passwd,su} || die
+		rm "${ED%/}"/etc/pam.d/{login,passwd,su} || die
 	fi
 
 	# Remove manpages that are handled by other packages
-	find "${ED}"/usr/share/man \
+	find "${ED%/}"/usr/share/man \
 		'(' -name id.1 -o -name passwd.5 -o -name getspnam.3 ')' \
 		-delete
 
-	cd "${S}"
+	cd "${S}" || die
 	dodoc ChangeLog NEWS TODO
 	newdoc README README.download
-	cd doc
+	cd doc || die
 	dodoc HOWTO README* WISHLIST *.txt
 }