kiki's Gentoo overlay

Personal Gentoo overlay. Auto-bumped via Forgejo Actions.

Add overlay

eselect-repository (recommended)

eselect repository add kiki git https://forgejo.toe.quest/kiki/gentoo.git
emaint sync -r kiki

Manual

Create /etc/portage/repos.conf/kiki.conf:

[kiki]
location = /var/db/repos/kiki
sync-type = git
sync-uri = https://forgejo.toe.quest/kiki/gentoo.git
auto-sync = yes

Then sync:

emaint sync -r kiki

Packages

Package	Description	Notes
app-pda/idevicerestore	Restore/upgrade firmware of iOS devices	Git snapshot: the 1.0.0 release is too old for current firmware. ~amd64
app-pda/libimobiledevice	Library to communicate with iOS devices	1.4.0, required by idevicerestore; Gentoo tree only has 1.3.0. ~amd64
app-pda/libirecovery	Library and utility to talk to iBoot/iBSS via USB	Not in Gentoo tree. Installs a udev rule giving plugdev access to DFU/recovery-mode devices. ~amd64
app-pda/libtatsu	Library for Apple's Tatsu Signing Server (TSS)	Not in Gentoo tree. ~amd64
dev-python/ipsw-py	Python library for the ipswd daemon API	PyPI name ipsw; needs ipswd from dev-util/ipsw running. ssh USE flag pulls in paramiko. ~amd64
dev-python/materialyoucolor	Python port of Google's Material Color Utilities with a C++ quantizer	Dependency of kde-misc/kde-material-you-colors; not in Gentoo tree
dev-util/ipsw	iOS/macOS research swiss army knife, plus the ipswd API daemon	Built from source without upstream's sandbox build tag, since that code is not in the public repo. Go fetches modules during the build (RESTRICT="network-sandbox"). ~amd64
games-simulation/openloco	Open source re-implementation of Chris Sawyer's Locomotion	Requires original game data
games-simulation/openrct2	Open source re-implementation of RollerCoaster Tycoon 2
games-simulation/openttd	Open source re-implementation of Transport Tycoon Deluxe
kde-apps/kunifiedpush	UnifiedPush client library and distributor daemon for KDE	Not yet in Gentoo tree
kde-misc/kde-material-you-colors	Automatic Material You color scheme generator for KDE Plasma from your wallpaper	Daemon/CLI only; Plasma widget ships separately via the KDE Store
net-im/fluxer	Fluxer chat, voice and video client	Builds the Electron app and its Rust/napi native addons from the monorepo's desktop release tag; electron-builder still packages an upstream prebuilt Electron runtime, so Chromium itself is not compiled. ~amd64. pnpm, cargo and electron-builder all fetch during the build, so it needs network access (RESTRICT="network-sandbox")
net-im/fluxer-bin	Fluxer chat, voice and video client (binary)	Upstream prebuilt tarball with a bundled Electron/Chromium runtime; installs to /opt/fluxer
net-im/neochat	KDE Matrix client	Adds push USE flag for UnifiedPush support
net-im/sable	Sable Matrix client	Built from source against the system webkit-gtk:4.1 (Tauri wry runtime), so no bundled CEF. Releases are ~amd64; the 9999 live ebuild builds git main and is unkeyworded, so it needs ACCEPT_KEYWORDS="**". pnpm and cargo fetch their dependency trees during the build, so it also needs network access (RESTRICT="network-sandbox")
net-im/sable-bin	Sable Matrix client (binary)	Upstream prebuilt tarball with a bundled CEF runtime; installs to /opt/sable
net-im/tokodon	KDE Mastodon client	Adds push USE flag for UnifiedPush support
net-misc/zapret	DPI bypass / anti-censorship multi-tool (nfqws, tpws, ip2net, mdig)	Installs to /opt/zapret with an OpenRC service; v1, upstream EOL/bugfix-only
net-misc/zapret2	DPI bypass successor with LuaJIT-driven strategies	Installs to /opt/zapret2 with an OpenRC service; coexists with net-misc/zapret
net-vpn/yggdrasil-ng	Rust rewrite of Yggdrasil: a fully end-to-end encrypted IPv6 network.
sys-fs/apfs-fuse	Read-only FUSE driver for Apple's APFS filesystem	Git snapshot (upstream has no releases); installs apfs-fuse and apfsutil, built against FUSE 3. Mount with apfs-fuse /dev/sdXN /mnt. ~amd64
www-client/helium-bin	Helium browser (binary)
www-client/ladybird	Truly independent web browser built on the LibWeb engine	Live (9999) ebuild; builds from git master. vcpkg compiles the dependency stack from source, so the build needs network access (RESTRICT="network-sandbox"), clang, and ~20G disk

USE flags

Package	Flag	Effect
net-im/neochat	push	Enables UnifiedPush support via kde-apps/kunifiedpush
net-im/tokodon	push	Enables UnifiedPush support via kde-apps/kunifiedpush

To enable:

# /etc/portage/package.use/20neochat
net-im/neochat push

# /etc/portage/package.use/20tokodon
net-im/tokodon push

Purging old ebuilds

Bump workflows only ever add versions, so package directories grow without bound. The purge-old-ebuilds workflow trims them back. It deletes things, so it is never scheduled — run it from the Actions tab, and it purges. Inputs:

Input	Default	Effect
keep	3	Released versions to keep per package
packages	(blank)	Space-separated cat/pkg list; blank means every package
keep_stable	true	Also keep the newest stable-keyworded version
dry_run	false	Set to true to print the report without changing anything

The first two lines of the log say which mode the run used — LIVE RUN: ebuilds will be deleted... or DRY RUN: reporting only... — followed by the settings it resolved, so a run that changed nothing says why. A run is only a dry run if it says so.

It keeps the newest few released versions of each package, deletes the rest, and rewrites each Manifest so it lists only distfiles the survivors still fetch — distfiles shared between versions, such as the OpenGraphics objects of games-simulation/openloco or the crates of net-vpn/yggdrasil-ng, are kept as long as something still pulls them.

Two things are never purged: 9999 live ebuilds, and the newest version with a stable keyword, so a run of pre-releases cannot push the last stable ebuild out of the overlay.

Working out which distfiles survive means reading SRC_URI, which cannot be taken from the ebuild text — it interpolates ${P} and an eclass can build it outright. The runner has no portage, so the workflow sources each surviving ebuild with inherit and every unknown command stubbed out. That covers everything with a literal SRC_URI, plus cargo.eclass, whose crate filenames are rebuilt from CRATES. Where SRC_URI really is eclass-generated (net-im/neochat and net-im/tokodon via gear.kde.org.eclass) it falls back to matching version strings in the distfile names, dropping an entry only when it carries a version being removed and none that is staying; the report says which method each package used.

Versions are ordered with sort -V, as the bump workflows already do. That does not know Gentoo's _rc/_p/-r rules, so a package using those wants checking against a dry run first.

Auto-bump workflows

Forgejo Actions check for new versions daily and commit updated ebuilds automatically.

KDE Gear: stable vs pre-release

kde-apps/kunifiedpush, net-im/neochat and net-im/tokodon all follow the KDE Gear release schedule, which uses the patch level to mark pre-releases: 80 is an alpha, 85 a beta and 90 an RC. Those are served from download.kde.org/unstable/release-service/; everything else comes from download.kde.org/stable/release-service/. The exact boundary is a two-digit patch level of 60-99, matching the glob gear.kde.org.eclass uses (??.??.[6-9]?) — the workflows follow the eclass so the tarball they hash is always the one portage fetches.

Stable and pre-release are separate workflows, so SRC_URI and KEYWORDS can never disagree with where a version actually came from:

• stable → keyworded amd64, emerges without an ACCEPT_KEYWORDS entry
• pre-release → keyworded ~amd64

Stable neochat and tokodon ebuilds are taken from the Gentoo tree and re-patched for the push USE flag. Neither ::gentoo nor ::kde carries KDE Gear pre-releases, so the pre-release ebuilds are instead derived from the newest ebuild already in this overlay, which already has those patches applied. Their dependency bounds (KFMIN and friends) are inherited from that template and may lag what a pre-release actually wants.

A pre-release is dropped again once a stable release overtakes it, since upstream removes those tarballs from download.kde.org and the ebuild would no longer fetch.

Workflow	Source	Schedule
bump-helium-bin	GitHub releases	02:17 daily
bump-openloco	GitHub releases	03:23 daily
bump-kunifiedpush-stable	KDE GitHub tags + download.kde.org/stable	04:41 daily
bump-kde-unstable	KDE GitHub tags + download.kde.org/unstable, for kunifiedpush, neochat and tokodon	04:47 daily
bump-kde-stable	gentoo/gentoo tree + download.kde.org/stable, for neochat and tokodon	04:53 daily
bump-zapret	GitHub releases, for zapret and zapret2	05:11 daily
bump-yggdrasil-ng	GitHub releases	05:37 daily
bump-sable	GitHub releases	05:47 daily
bump-fluxer	api.fluxer.app download redirect + GitHub tags	05:53 daily

Workflows covering several packages run one matrix job per package, one at a time. Shared helpers (version mangling, Manifest hashing, commit and push) live in .forgejo/scripts/lib.sh; the push USE flag patches applied to ::gentoo's neochat and tokodon ebuilds are .forgejo/scripts/push-*.sed.

bump-sable bumps net-im/sable and net-im/sable-bin together, from the same GitHub release: the source tarball for the former, the prebuilt desktop tarballs for the latter. Upstream's rolling nightly tag is a pre-release and is skipped, and no workflow ever rewrites a 9999 ebuild.

bump-fluxer bumps net-im/fluxer and net-im/fluxer-bin the same way, but there are no GitHub release assets to read: desktop builds are served from api.fluxer.app, so the version is taken from the attachment filename its latest endpoint hands back. Only the canary channel is published — /dl/desktop/stable/... redirects to it — so that is the channel both ebuilds track. Because canary rolls daily and old builds drop out of the CDN, each bump replaces the previous ebuild and rewrites the Manifest instead of adding to it, so exactly one version is ever in the overlay. The source bump is skipped when the matching fluxer-desktop-canary@<version> tag has not landed on GitHub yet; it lands with the same CI run that uploads the tarballs, so it can trail by a few minutes.