systemd/systemd-services: remove tmpfiles and sysusers configs

Signed-off-by: Aster Boese <asterboese@mailbox.org>
main/postmarketos-sysusers-configs: add sing-box config
2025-08-16 18:35:11 -04:00 · 2025-08-16 18:34:57 -04:00 · 2025-08-16 18:34:57 -04:00 · 2025-08-16 18:34:56 -04:00 · 2025-08-16 18:34:40 -04:00 · 2025-08-16 18:34:40 -04:00
24 changed files with 935 additions and 44 deletions
@@ -3,7 +3,7 @@
 pkgname=gdm
 pkgver=99948.0
 _pkgver=48.0
-pkgrel=4
+pkgrel=5
 pkgdesc="GNOME display manager"
 url="https://wiki.gnome.org/Projects/GDM"
 # blocked by gnome-shell
@@ -46,7 +46,6 @@ source="https://download.gnome.org/sources/gdm/${_pkgver%%.*}/gdm-$_pkgver.tar.x
 	0003-DOWNSTREAM-pam-rename-common-to-base.patch
 	Xsession
 	gcc15.patch
-	gdm.sysusers
 	"
 install="gdm.pre-install gdm.post-deinstall"
 builddir="$srcdir/gdm-$_pkgver"
@@ -76,13 +75,6 @@ package() {
 	#sed -i "s/pam_systemd\.so/pam_elogind.so/" "$pkgdir"/etc/pam.d/*

 	install -m755 -D "$srcdir/Xsession" "$pkgdir"/etc/gdm
-
-	install -Dm644 "$srcdir/gdm.sysusers" "$pkgdir"/usr/lib/sysusers.d/gdm.conf
-}
-
-systemd() {
-	amove usr/lib/sysusers.d/gdm.conf
-	default_systemd
 }

 sha512sums="
@@ -91,5 +83,4 @@ aa302c33c9b31e823ab98ca80c330c3f7eaa10d05c402cf111d78a35fbec82ce90bff34c19b713b6
 66611d49fc4c9578415a7e554834edcb9de99396bd0ca511dcfd4fb256e8a1cd1fd5f10464f4668ffe04799d919bc22ddb58e8bf272017edba69a7951522e63d  0003-DOWNSTREAM-pam-rename-common-to-base.patch
 f836cf0acdf148f2ae09ac28251b5126ce597f08254c43b1ec77596f75e1a3229926116c13f98554625be763e8d28415b27bd679b0a5de9f86bdca7857054c82  Xsession
 9b6b1aba510267bfa366666dd1f2d3b22b0a8875313d72dbdbd568d79255e59b705a052889acff3b052a3dae38b87b3bc770a70604f64670f77a16c045c9d29c  gcc15.patch
-499cee7844d3ffb355ed8771c1cf0726e1f4c57ecbd1e0d6b25c1a3f6e6c95ad3dd45e878498a818e6db8086dab90912210d96bc024da6734ab5c53cd907ca55  gdm.sysusers
 "
@@ -7,7 +7,7 @@
 # How to add a new service file (5 steps):
 pkgname=systemd-services
 # 1. bump pkgver
-pkgver=86
+pkgver=89
 pkgrel=0
 pkgdesc="Systemd service files"
 url="https://postmarketos.org"
@@ -36,7 +36,6 @@ subpackages="
 	containerd-systemd:_service
 	cosmic-greeter-systemd:_service
 	dconf-systemd:_service
-	dnsmasq-systemd:_service
 	docker-engine-systemd:_service
 	eg25-manager-systemd:_service
 	evolution-data-server-systemd:_service
@@ -142,7 +141,6 @@ _connman_sources="
 _containerd_sources="system/containerd.service"  # From: https://github.com/containerd/containerd/blob/main/containerd.service
 _cosmic_greeter_sources="system/cosmic-greeter.service system/cosmic-greeter-daemon.service" # From https://github.com/pop-os/cosmic-greeter/tree/master/debian
 _dconf_sources="user/dconf.service"
-_dnsmasq_sources="sysusers.d/dnsmasq.conf"  # From: https://src.fedoraproject.org/rpms/dnsmasq/blob/rawhide/f/dnsmasq-systemd-sysusers.conf
 _docker_engine_sources="system/docker.service system/docker.socket"  # From https://github.com/moby/moby/blob/master/contrib/init/systemd
 _eg25_manager_sources="system/eg25-manager.service" # From https://gitlab.com/mobian1/eg25-manager/-/blob/master/data/eg25-manager.service.in
 _evolution_data_server_sources="
@@ -159,13 +157,11 @@ _flatpak_sources="
 	user/flatpak-session-helper.service
 	system-environment-generators/60-flatpak-system-only
 	user-environment-generators/60-flatpak
-	tmpfiles.d/flatpak.conf
 " # From
 # - https://github.com/flatpak/flatpak/blob/main/system-helper/flatpak-system-helper.service.in
 # - https://github.com/flatpak/flatpak/blob/main/session-helper/flatpak-session-helper.service.in
 # - https://github.com/flatpak/flatpak/blob/main/portal/flatpak-portal.service.in
 # - https://github.com/flatpak/flatpak/tree/main/env.d
-# - https://github.com/flatpak/flatpak/tree/main/data/tmpfiles.d
 _fnott_sources="user/fnott.service"
 _fprintd_sources="system/fprintd.service" # From https://gitlab.freedesktop.org/libfprint/fprintd/-/blob/master/data/fprintd.service.in
 _geoclue_sources="system/geoclue.service" # From https://gitlab.freedesktop.org/geoclue/geoclue/-/blob/master/data/geoclue.service.in
@@ -196,12 +192,7 @@ _msm_modem_sources="system/msm-modem-uim-selection.service"
 _msm_modem_wwan_port_sources="system/msm-modem-wwan-port.service"
 _nftables_sources="system/nftables.service"
 _nginx_sources="system/nginx.service" # Based on arch's service: https://gitlab.archlinux.org/archlinux/packaging/packages/nginx/-/blob/main/nginx.service
-_openssh_server_pam_sources="
-	system/sshd.service
-	system/sshd@.service
-	system/sshdgenkeys.service
-	sysusers.d/sshd.conf
-"
+_openssh_server_pam_sources="system/sshd.service system/sshd@.service system/sshdgenkeys.service"
 _pd_mapper_sources="system/pd-mapper.service"
 _plasma_mobile_sources="system/plasma-mobile.service"
 _polkit_kde_agent_1_sources="user/plasma-polkit-agent.service" # From https://invent.kde.org/plasma/polkit-kde-agent-1/-/blob/master/plasma-polkit-agent.service.in
@@ -253,8 +244,6 @@ _zram_init_sources="system/zram_swap.service"  # adapted from https://github.com
 _sing_box_sources="
 	system/sing-box.service
 	system/sing-box@.service
-	tmpfiles.d/sing-box.conf
-	sysusers.d/sing-box.conf
 " # From https://github.com/SagerNet/sing-box/tree/dev-next/release/config

 flatpath() {
@@ -279,7 +268,6 @@ source="$(flatpath \
 	$_containerd_sources \
 	$_cosmic_greeter_sources \
 	$_dconf_sources \
-	$_dnsmasq_sources \
 	$_docker_engine_sources \
 	$_eg25_manager_sources \
 	$_evolution_data_server_sources \
@@ -370,10 +358,6 @@ _service() {
 		mode=644
 		if echo "user system" | grep -q "${f%%/*}"; then
 			prefix="$prefix/usr/lib/systemd"
-		elif echo "tmpfiles.d" | grep -q "${f%%/*}"; then
-			prefix="$prefix/usr/lib"
-		elif echo "sysusers.d" | grep -q "${f%%/*}"; then
-			prefix="$prefix/usr/lib"
 		elif echo "user-environment-generators system-environment-generators" | grep -q "${f%%/*}"; then
 			prefix="$prefix/usr/lib/systemd"
 			mode=755
@@ -418,7 +402,6 @@ b7cc164dc0520652df9b2bf6f9708b7230bc6a3274d02ce222ba507f94bf31e3125532cf806af7ca
 4c64d433da3999c4f778c379e67779b30370b3a06ee09f22eaa594ce68f948afe2d3827c254ddf4b53341b394718eb5e29d242d2db5209e87084502cb581cac8  system-cosmic-greeter.service
 0da725086569f336593f52de6e61fa34482522bd83cd477c3a8de610813c9a96278d94b59d84e2ce9fc3605f893a4e2708f2cf9452aae6c4cfe2ffca54c91e2c  system-cosmic-greeter-daemon.service
 e4de73d12abd046c8683e3be6e3aab40a5db3f5d6246cedbb3ff099bcc8037a167b23ac957d30f1118db571b69cb10c042272ac2b54dacf83fa6a3e9dad13a87  user-dconf.service
-97887423ad5b8344786912899553cd2f2033da6a79104a9ad59ebda813505ee05bef19c9e6f46af5ecee62dd0d436773a9a0d10bad759cd92aad3f53b95e62a2  sysusers.d-dnsmasq.conf
 1189ada8b126b2e574aea2e9b3ad9b0a86282d82be4f4ad4c58b1d968ce15ff45e8c60108f5e128ee946aa7e6e57f9fbb0b5d31d8371e79a2f0b3f3456bbd65f  system-docker.service
 c2d1f2a55bd7eed5a296e14b3250baa2f568dbdbce4444bae4635c1ce4bd6d3f1036462926d8c32d62d6609f5fcfb58933bf7eeb1924aefd814e864bc77bb7c7  system-docker.socket
 780912dbfdc7e9a350e934d46022b043edda86a393a7c107d0c855e9580240e4bce791428fdadef0a45adc6cfa24fb5d58981b6ccd80e3dad99da3e5fa3dc7b8  system-eg25-manager.service
@@ -433,7 +416,6 @@ c4dcaa578bbe9e0023cff139a6857a0df28fb81c9814577348e9996122945e26f8ec2760189a312b
 f73df99518af1fd13f96342f561d43b69ebf757cdfd4444cee61665d5bfaa715c5be458cb44feb4a15e5d5613a91dec9e971a7bca30d2ae880d9e10eb7405ead  user-flatpak-session-helper.service
 62be7a7a7dce425fe8155f92ceab57aea52542687d27a2ce3cd9da0a80672381361fb3e4a8d58caf9cc02d80824a29e161ffb9f065f640b4481704851eb0378a  system-environment-generators-60-flatpak-system-only
 2d1337da0d1ac7ea5d6ffefbe05621970fef491278028589f5095ee6072867977eca7a68a997d6870e450546c2077d999207fadb568ab611833769555bfb5c64  user-environment-generators-60-flatpak
-ae2d20da95e519041f6eca39dd140895b2c46284f0894c60a29cf56b87704805146ddc2435e46e7fffbfc8bcab2cabceb32a10804ba1b648e2ed041c0b056102  tmpfiles.d-flatpak.conf
 0924315d4b7337edb42a2ecd7ba84d6a10437633028cd9c6ebd143c0668a6e6fea365d6644c336c70158e62d75a072db38bdee36cb677dfbfa609e9fdf43aca0  user-fnott.service
 c86ffe994aa78b3d68c3956c54255c9479d832c4a2fd3905deec6ef620871bacf60f7a9cb7ef9a3dfd7993354d4590b8b5efef3159274477857c3ead614dee02  system-fprintd.service
 f3463b85ac47055b400dfd2e24694c5e1dc6ab039efac0fe54496fc027c0732cda5e52a362a497b372dea671dc615154e8abfea866728d243cbbcd25e68a91aa  system-geoclue.service
@@ -472,7 +454,6 @@ cf85311596958ebbd0b9744e0323a69b06375d72d355274fda190d9465f5511344304112d542e139
 fa445c4a53214524baed4e9c52a5463592a074f88a5a286eacb60d0907c0545f725afde23abd68cf611067add80c2ccb289a381fc5ff6a5f654ea49c81f02fe8  system-sshd.service
 6f1db26dbbcf96a5e14996cc468f1911c51a46fc3f70552af3591c0dfaaa043135d137d435818a2a2cce656f09fa305337c3c86121a5109dc20f0326a2e0ec15  system-sshd@.service
 c0badea3905c1d53d213fbfe11d25b556a2e484fe77eb50e9f4d42e25b67b56a0804e7d8e1b7731cd280cbb3525b4c60311817609381e2308d9f2dfb7c0d7072  system-sshdgenkeys.service
-4a6d716a907a730675505bfc4ac38598f9c4e7d962fa9cdeea51dbbaa6afec80d1b82b98627c37c164dc5cdcc7f68118104e3adb73d985f32a24f1941766c5af  sysusers.d-sshd.conf
 0bed9a8a719661609ad84d1c6fcdf2fe9213e741682b7ddebad82d9744f137c593788ed522868f10b95b599d81743d07ec3212630a7e99d333261dfa1bf1cc11  system-pd-mapper.service
 e12d8e98e28a795f879aebcceb32a991ee4abcb3bc5ec458aa5378bb52ff86cf39be04bc4a196925f532d623304b3005f561fa5e55d1c87944d718058ec4c0e6  system-plasma-mobile.service
 ebd194aad645a836ba2b51bfcebd7f78a8ec703e62dd7a7e85343df4f7b60e99abfebd6de12e540e4be24e9079aee0b8ea450e5169ce9ee97e44d0b370013a07  user-plasma-polkit-agent.service
@@ -519,6 +500,4 @@ e09a3c76f3be961dce9f564bb654ea84d1d7fb59907a2168c0569bf6c17a5ebe9fbe4d1f94f1d014
 e0014662e4ec2c52d3beabe3247ede7c6b12c1d22b7c62d6b04ff82a668f492c09060243acf92090e6a7ec75a44b41760b3bbd144da4f36c14364cfa28a8dac3  system-zram_swap.service
 4d201f29ad98abf38a15e877bb1b4f46fb08ab0cd5cb83f29aaa104eaa0a51fd14784110ee844ccb89914aa73b985fc9c61e216f8d2ac230adfa1d1660ebd573  system-sing-box.service
 f4042114ed0f36e51bc32f6df184843d6d7e58b7cece8a845796910d80e1f26c9d0be9415ed90f7a91211bd669d8bb002b24a5a79657f8b699f952299ddfb5d2  system-sing-box@.service
-e67997cfad302af405e1bee78f79ea9caaa8fec0b765003ff08901f43a2ea07209726d0a20f2640b796bc6775606e34143da362d1e0471ce32b919747004d53c  tmpfiles.d-sing-box.conf
-014eff9e21ddaa64260f3915655e0a1fa771b356c0c56b3a5d868830237a561ba3e5cc06085bf70dde9dbf809807c301addd0a968a005436c067b6ce0a52672d  sysusers.d-sing-box.conf
 "
@@ -1,2 +0,0 @@
-# This is a systemd tmpfiles.d configuration file
-R! /var/tmp/flatpak-cache-*
@@ -1,7 +1,7 @@
 # Maintainer: Oliver Smith <ollieparaoid@postmarketos.org>
 pkgname=mobile-config-firefox
 pkgver=4.6.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Firefox tweaks for mobile and privacy"
 url="https://gitlab.postmarketos.org/postmarketOS/mobile-config-firefox"
 source="
@@ -12,14 +12,28 @@ license="GPL-3.0-or-later"
 options="!check" # No tests
 subpackages="$pkgname-librewolf"

+_firefoxes="
+	firefox
+	firefox-esr
+	librewolf
+"
+
 build() {
 	make
 }

 package() {
-	make DESTDIR="$pkgdir" FIREFOX_DIR=/usr/lib/firefox install
-	make DESTDIR="$pkgdir" FIREFOX_DIR=/usr/lib/firefox-esr install
-	make DESTDIR="$pkgdir" FIREFOX_DIR=/usr/lib/librewolf install
+	for firefox in $_firefoxes; do
+		firefox_dir="/usr/lib/${firefox}"
+		firefox_config_dir="$firefox_dir/distribution"
+		make DESTDIR="$pkgdir" \
+			FIREFOX_DIR="$firefox_dir" \
+			FIREFOX_CONFIG_DIR="$firefox_config_dir" \
+			install
+		mv "$pkgdir"/"$firefox_config_dir"/policies/policies.json \
+			"$pkgdir"/"$firefox_config_dir"/policies.json
+		rm -r "$pkgdir"/"$firefox_config_dir"/policies
+	done
 }

 librewolf() {
@@ -1,5 +1,5 @@
 pkgname=postmarketos-base
-pkgver=46
+pkgver=47
 pkgrel=0
 pkgdesc="Meta package for minimal postmarketOS base"
 url="https://postmarketos.org"
@@ -55,8 +55,8 @@ replaces_priority=100  # leave plenty for alpine
 provides="alpine-base=1000-r0"

 _source440="
-	etc/sudoers
-	etc/doas.d/10-postmarketos.conf
+	usr/share/sudo/sudoers
+	usr/share/doas/doas.d/10-postmarketos.conf
 	"
 _source600="
 	etc/ssh/sshd_config.d/50-postmarketos-ui-policy.conf
@@ -216,8 +216,8 @@ release() {
 }

 sha512sums="
-e529f5cef1f31481b577f99b8917704f2cfefb963d98bf40a14b017938e55a00134d2033f81d2cb0b8489c5e9b4a92fdc0a788013f1adb4cd46d9580c9988186  rootfs-etc-sudoers
-ab09e67203bb82226b0c9e600c8bc231a5c0111977b80edb355e55be101d008ac3c06798c263f0ca50e203758e1bfbf25767ad12f2654d082fb007c0411bbd1f  rootfs-etc-doas.d-10-postmarketos.conf
+e529f5cef1f31481b577f99b8917704f2cfefb963d98bf40a14b017938e55a00134d2033f81d2cb0b8489c5e9b4a92fdc0a788013f1adb4cd46d9580c9988186  rootfs-usr-share-sudo-sudoers
+ab09e67203bb82226b0c9e600c8bc231a5c0111977b80edb355e55be101d008ac3c06798c263f0ca50e203758e1bfbf25767ad12f2654d082fb007c0411bbd1f  rootfs-usr-share-doas-doas.d-10-postmarketos.conf
 1d2975e7e2745020f88fac639021cc9a47b477fb0390c3e146a070d98faab32c3f1c7bd1121f45a26be97301ab65c736ae0a4905d28a7251919a1994895f9c8d  rootfs-etc-ssh-sshd_config.d-50-postmarketos-ui-policy.conf
 224d58717f7f95851c91914753f4aefaf8964a2e62350ed898783c295c509cdadd85c325ee00baceb21ff2763ca2f4c7b1478a5638eb7d86836f91336b739376  rootfs-etc-apk-config
 e0d2d48b82a03239a4c0a00acaf83e00d397c23a8d7c71053d4e2a383357c22dcedef9e81b0e12a1d7514e1fdbe0bb3eb82613d18b29034a7ce5447f13c84a53  rootfs-etc-conf.d-swapfile
@@ -0,0 +1,66 @@
+# sysusers configs for projects that need system users
+
+maintainer="Aster Boese <asterboese@mailbox.org>"
+# How to add a new config (5 steps):
+pkgname=postmarketos-sysusers-configs
+# 1. bump pkgver
+pkgver=4
+pkgrel=0
+pkgdesc="systemd-sysusers configs"
+url="https://postmarketos.org"
+arch="noarch"
+options="!check"
+license="BSD-3-Clause"
+
+# 2. Add a new entry to subpackages in the format
+#    <pkgname>-sysusers:_sysusers where pkgname is the name
+#    of the package this sysusers config should be part of
+#    ALPHABETICAL ORDER!!!
+subpackages="
+	dnsmasq-sysusers:_sysusers
+	gdm-sysusers:_sysusers
+	openssh-sysusers:_sysusers
+	sing-box-sysusers:_sysusers
+	"
+
+# 3. Add a new entry below with the list of sysusers configs
+#    to install for that package
+_dnsmasq_sources="dnsmasq.conf"
+_gdm_sources="gdm.conf"
+_openssh_sources="sshd.conf"
+_sing_box_sources="sing-box.conf"
+
+# 4. Add the _sources variable to the list below
+source="
+	$_dnsmasq_sources
+	$_gdm_sources
+	$_openssh_sources
+	$_sing_box_sources
+	"
+
+_sysusers() {
+	local name=$(echo ${subpkgname%%-sysusers})
+	local n=$(echo ${subpkgname%-sysusers} | sed s/-/_/g)
+	install_if="$pkgname=$pkgver-r$pkgrel $name systemd"
+
+	for f in $(eval "echo \$_${n}_sources"); do
+		prefix="$subpkgdir"
+		mode=644
+		prefix="$prefix/usr/lib/sysusers.d"
+		install -Dm"$mode" "$srcdir/$f" "$prefix/$f"
+	done
+
+	depends="systemd"
+	pkgdesc="$pkgdesc (sysusers configs)"
+}
+
+package() {
+	mkdir -p "$pkgdir"
+}
+
+sha512sums="
+97887423ad5b8344786912899553cd2f2033da6a79104a9ad59ebda813505ee05bef19c9e6f46af5ecee62dd0d436773a9a0d10bad759cd92aad3f53b95e62a2  dnsmasq.conf
+499cee7844d3ffb355ed8771c1cf0726e1f4c57ecbd1e0d6b25c1a3f6e6c95ad3dd45e878498a818e6db8086dab90912210d96bc024da6734ab5c53cd907ca55  gdm.conf
+4a6d716a907a730675505bfc4ac38598f9c4e7d962fa9cdeea51dbbaa6afec80d1b82b98627c37c164dc5cdcc7f68118104e3adb73d985f32a24f1941766c5af  sshd.conf
+014eff9e21ddaa64260f3915655e0a1fa771b356c0c56b3a5d868830237a561ba3e5cc06085bf70dde9dbf809807c301addd0a968a005436c067b6ce0a52672d  sing-box.conf
+"
@@ -0,0 +1,62 @@
+# tmpfiles configs for projects that install files outside /usr/
+
+maintainer="Aster Boese <asterboese@mailbox.org>"
+# How to add a new config (5 steps):
+pkgname=postmarketos-tmpfiles-configs
+# 1. bump pkgver
+pkgver=4
+pkgrel=0
+pkgdesc="systemd-tmpfiles configs"
+url="https://postmarketos.org"
+arch="noarch"
+options="!check"
+license="BSD-3-Clause"
+
+# 2. Add a new entry to subpackages in the format
+#    <pkgname>-tmpfiles:_tmpfiles where pkgname is the name
+#    of the package this tmpfile config should be part of
+#    ALPHABETICAL ORDER!!!
+subpackages="
+	flatpak-tmpfiles:_tmpfiles
+	mobile-config-firefox-tmpfiles:_tmpfiles
+	sing-box-tmpfiles:_tmpfiles
+	"
+
+# 3. Add a new entry below with the list of tmpfile configs
+#    to install for that package
+_flatpak_sources="flatpak.conf" # https://github.com/flatpak/flatpak/tree/main/data/tmpfiles.d
+_mobile_config_firefox_sources="mobile-config-firefox.conf"
+_sing_box_sources="sing-box.conf"
+
+# 4. Add the _sources variable to the list below
+source="
+	$_flatpak_sources
+	$_mobile_config_firefox_sources
+	$_sing_box_sources
+	"
+
+_tmpfiles() {
+	local name=$(echo ${subpkgname%%-tmpfiles})
+	local n=$(echo ${subpkgname%-tmpfiles} | sed s/-/_/g)
+	install_if="$pkgname=$pkgver-r$pkgrel $name systemd"
+
+	for f in $(eval "echo \$_${n}_sources"); do
+		prefix="$subpkgdir"
+		mode=644
+		prefix="$prefix/usr/lib/tmpfiles.d"
+		install -Dm"$mode" "$srcdir/$f" "$prefix/$f"
+	done
+
+	depends="systemd"
+	pkgdesc="$pkgdesc (tmpfiles configs)"
+}
+
+package() {
+	mkdir -p "$pkgdir"
+}
+
+sha512sums="
+78aea43f61ba553ff53e5e878c5980da8de9de6ef5c2eb0ed13a6fd0d2a9d6191d1890d83d0301c1e1320b0b302b19c04b5b0603f00c0b264ec39f05c0b5e51a  flatpak.conf
+8903fe38e8ce4734c8bffcd800a5d3bbf5c94fefd9b6d819957ac71d48111b8e29514fd86923c46d39689ad182e67a6fc8cd05b230c4ec7bcd92ec608d677e4c  mobile-config-firefox.conf
+e67997cfad302af405e1bee78f79ea9caaa8fec0b765003ff08901f43a2ea07209726d0a20f2640b796bc6775606e34143da362d1e0471ce32b919747004d53c  sing-box.conf
+"
@@ -0,0 +1 @@
+R! /var/tmp/flatpak-cache-*
@@ -0,0 +1 @@
+L /etc/mobile-config-firefox - - - - /usr/share/factory/etc/mobile-config-firefox
@@ -0,0 +1,60 @@
+# Fork from Alpine to move configuration under /usr
+
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=doas
+pkgver=99996.8.2
+_pkgver=6.8.2
+pkgrel=0
+pkgdesc="OpenBSD's temporary privilege escalation tool"
+url="https://github.com/Duncaen/OpenDoas"
+arch="all"
+license="ISC"
+makedepends="bison"
+subpackages="$pkgname-doc"
+install="$pkgname.post-upgrade"
+source="$pkgname-$_pkgver.tar.gz::https://github.com/Duncaen/OpenDoas/archive/v$_pkgver.tar.gz
+	configuration-directory.patch
+	manpage-example-path.patch
+	change-PATH.patch
+	rowhammer.patch
+	doas.conf
+	"
+builddir="$srcdir/OpenDoas-$_pkgver"
+options="$options suid"
+
+# secfixes:
+#   6.8-r1:
+#     - CVE-2019-25016
+
+build() {
+	./configure \
+		--prefix=/usr \
+		--sysconfdir=/usr/share/doas \
+		--without-pam \
+		--with-timestamp \
+		--with-doas-confdir
+	make
+}
+
+check() {
+	# doas -v returns 1
+	./doas -v || test $? = 1
+}
+
+package() {
+	make install DESTDIR="$pkgdir"
+
+	install -d -m 750 "$pkgdir"/usr/share/doas/doas.d
+	install -m 640 "$srcdir"/doas.conf -t "$pkgdir"/usr/share/doas/
+
+	install -D -m 644 "$srcdir"/doas.conf "$pkgdir"/usr/share/doc/$pkgname/doas.conf.example
+}
+
+sha512sums="
+4a93ff477413c859ba2702e688fa4f83248fff85e61e12336838a1e9aa1a8d9963a9782e4bc5e58e8d04b86c2c8ceb6b235ae9d3b32b3e548a2514a43653137d  doas-6.8.2.tar.gz
+efad2866d9d3e26266bdb37555453a436aa88ff4b8877b2ba01f7446ea095d998313aa566cafba30d426c79968d3d4a610dfbaa2e33735ab60f1283c9d9fa4ef  configuration-directory.patch
+60efd196595bda2c4f036cd0080a8825a85fedcc7524c917304b342373863213b3c557b4336f1dab760f167fd8cc2a59b2e744d8a47ff8a8acebbe74b1328f4f  manpage-example-path.patch
+31a87aced097ea1189c2162172788cd27b82af318db3476e1c143d3c87d99e2aa6350f63b81361d0a54482ba8dd0cfd10928ff6074a4c66248a1ec815a274f68  change-PATH.patch
+c18e0e164606466c2e59b94c463f31c8d4ba7f050938114525a70855935655d0c690662de63358ca6854d3411a486d5a85aa247895b640c3b124c957ff325fe9  rowhammer.patch
+215e20a7db1c14edc4596f8b879f0e628cb2a0e3c51d6c37ed7327e7db9d3f90ba896523b81fe371d5ae68145c88bfd7a2ecdd60452d3030130d04e10f2488f3  doas.conf
+"
@@ -0,0 +1,19 @@
+From: Jakub Jirutka <jakub@jirutka.cz>
+Date: Tue, 28 Jun 2022 22:36:16 +0200
+Subject: [PATCH] Change default PATH to the Alpine's default
+
+Use the same PATH as in openssh, sudo and our /etc/profile.
+
+--- a/doas.c
+++ b/doas.c
+@@ -238,8 +238,8 @@
+ int
+ main(int argc, char **argv)
+ {
+-	const char *safepath = "/bin:/sbin:/usr/bin:/usr/sbin:"
+-	    "/usr/local/bin:/usr/local/sbin";
+	const char *safepath = "/usr/local/sbin:/usr/local/bin:"
+	    "/usr/sbin:/usr/bin:/sbin:/bin";
+ 	const char *confpath = NULL;
+ 	char *shargv[] = { NULL, NULL };
+ 	char *sh;
@@ -0,0 +1,447 @@
+Patch-Source: https://github.com/Duncaen/OpenDoas/pull/71 (rebased + one extra commit)
+--
+From a6aa77d9f4b9ad4556e478d6779dbebd4143a98a Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Wed, 4 Aug 2021 04:47:04 -0600
+Subject: [PATCH] add --with-confdir feature
+
+This adds support for an /etc/doas.d configuration directory as discussed in #61. It is disabled by default.
+
+diff --git a/GNUmakefile b/GNUmakefile
+index 9470202..22be971 100644
+--- a/GNUmakefile
+++ b/GNUmakefile
+@@ -27,6 +27,7 @@ install: ${PROG} ${PAM_DOAS} ${MAN}
+ 	[ -n "${PAM_DOAS}" ] && chmod 0644 ${DESTDIR}${PAMDIR}/doas || true
+ 	cp -f doas.1 ${DESTDIR}${MANDIR}/man1
+ 	cp -f doas.conf.5 ${DESTDIR}${MANDIR}/man5
+	cp -f doas.d.5 ${DESTDIR}${MANDIR}/man5
+ 
+ uninstall:
+ 	rm -f ${DESTDIR}${BINDIR}/${PROG}
+diff --git a/README.md b/README.md
+index 20ef9f2..92acded 100644
+--- a/README.md
+++ b/README.md
+@@ -43,3 +43,12 @@ similar to sudo.
+ 
+ See the comment block in `timestamp.c` for an in-depth description on how
+ timestamps are created and checked to be as safe as possible.
+
+### `--with-doas-confdir`
+
+An optional feature can be enabled which will result in `doas` reading configuration
+snippets from `/etc/doas.d`.  These configuration snippets have the same requirements
+as `/etc/doas.conf` (owned by root, not world-writable).
+
+If this feature is enabled, only the `/etc/doas.d` directory is read, and the historical
+`/etc/doas.conf` file is ignored.
+\ No newline at end of file
+diff --git a/configure b/configure
+index 1c5d989..22a078e 100755
+--- a/configure
+++ b/configure
+@@ -28,6 +28,7 @@ usage: configure [options]
+   --without-shadow       disable shadow support
+ 
+   --with-timestamp       enable timestamp support
+  --with-doas-confdir    enable configuration directory support
+ 
+   --uid-max=NUM          set UID_MAX (default 65535)
+   --gid-max=NUM          set GID_MAX (default 65535)
+@@ -39,6 +40,7 @@ EOF
+ 
+ # defaults
+ WITHOUT_TIMESTAMP=yes
+WITHOUT_CONFDIR=yes
+ UID_MAX=65535
+ GID_MAX=65535
+ 
+@@ -58,6 +60,8 @@ for x; do
+ 	--target) TARGET=$var ;;
+ 	--enable-debug) DEBUG=yes ;;
+ 	--enable-static) BUILD_STATIC=yes ;;
+	--with-doas-confdir) WITHOUT_CONFDIR= ;;
+	--without-doas-confdir) WITHOUT_CONFDIR=yes ;;
+ 	--with-pam) WITHOUT_PAM=; WITHOUT_SHADOW=yes ;;
+ 	--with-shadow) WITHOUT_SHADOW=; WITHOUT_PAM=yes ;;
+ 	--without-pam) WITHOUT_PAM=yes ;;
+@@ -565,4 +569,8 @@ fi
+ 
+ printf '#define DOAS_CONF "%s/doas.conf"\n' "${SYSCONFDIR}" >>$CONFIG_H
+ 
+if [ -z "$WITHOUT_CONFDIR" ]; then
+	printf '#define DOAS_CONFDIR "%s/doas.d"\n' "${SYSCONFDIR}" >>$CONFIG_H
+fi
+
+ printf '\n#endif /* CONFIG_H */\n' >>$CONFIG_H
+diff --git a/doas.c b/doas.c
+index ac3a42a..d77186b 100644
+--- a/doas.c
+++ b/doas.c
+@@ -35,6 +35,7 @@
+ #include <syslog.h>
+ #include <errno.h>
+ #include <fcntl.h>
+#include <dirent.h>
+ 
+ #include "openbsd.h"
+ #include "doas.h"
+@@ -155,6 +156,7 @@ permit(uid_t uid, gid_t *groups, int ngroups, const struct rule **lastr,
+ static void
+ parseconfig(const char *filename, int checkperms)
+ {
+	extern const char *yyfn;
+ 	extern FILE *yyfp;
+ 	extern int yyparse(void);
+ 	struct stat sb;
+@@ -164,6 +166,8 @@ parseconfig(const char *filename, int checkperms)
+ 		err(1, checkperms ? "doas is not enabled, %s" :
+ 		    "could not open config file %s", filename);
+ 
+	yyfn = filename;
+
+ 	if (checkperms) {
+ 		if (fstat(fileno(yyfp), &sb) != 0)
+ 			err(1, "fstat(\"%s\")", filename);
+@@ -174,11 +178,82 @@ parseconfig(const char *filename, int checkperms)
+ 	}
+ 
+ 	yyparse();
+	yyfn = NULL;
+
+ 	fclose(yyfp);
+ 	if (parse_errors)
+ 		exit(1);
+ }
+ 
+#ifdef DOAS_CONFDIR
+static int
+isconfdir(const char *dirpath)
+{
+	struct stat sb;
+
+	if (lstat(dirpath, &sb) != 0) {
+		if (errno != ENOENT)
+			err(1, "lstat(\"%s\")", dirpath);
+
+		errno = ENOTDIR;
+		return 0;
+	}
+
+	if ((sb.st_mode & (S_IFMT)) == S_IFDIR)
+		return 1;
+
+	errno = ENOTDIR;
+	return 0;
+}
+
+static void
+parseconfdir(const char *dirpath, int checkperms)
+{
+	struct dirent **dirent_table;
+	int i, m, dirent_count;
+	char pathbuf[PATH_MAX];
+
+	if (!isconfdir(dirpath))
+		err(1, checkperms ? "doas is not enabled, %s" :
+		    "could not open config directory %s", dirpath);
+
+	dirent_count = scandir(dirpath, &dirent_table, NULL, alphasort);
+	if (dirent_count < 0)
+		err(1, checkperms ? "doas is not enabled, %s" :
+		    "could not open config directory %s", dirpath);
+
+	for (i = 0, m = 0; i < dirent_count; i++)
+	{
+		struct stat sb;
+		size_t pathlen;
+
+		pathlen = snprintf(pathbuf, sizeof pathbuf, "%s/%s", dirpath, dirent_table[i]->d_name);
+		free(dirent_table[i]);
+
+		/* make sure path ends in .conf */
+		if (pathlen < 6)
+			continue;
+
+		if (strcmp(pathbuf + (pathlen - 5), ".conf"))
+			continue;
+
+		if (stat(pathbuf, &sb) != 0)
+			err(1, "stat(\"%s\")", pathbuf);
+
+		if ((sb.st_mode & (S_IFMT)) != S_IFREG)
+			continue;
+
+		parseconfig(pathbuf, checkperms);
+		m++;
+	}
+
+	free(dirent_table);
+
+	if (!m)
+		errx(1, "doas is not enabled, %s: no matching configuration files found\n", dirpath);
+}
+#endif
+
+ static void __dead
+ checkconfig(const char *confpath, int argc, char **argv,
+     uid_t uid, gid_t *groups, int ngroups, uid_t target)
+@@ -188,6 +263,11 @@ checkconfig(const char *confpath, int argc, char **argv,
+ 	if (setresuid(uid, uid, uid) != 0)
+ 		err(1, "setresuid");
+ 
+#ifdef DOAS_CONFDIR
+	if (isconfdir(confpath))
+		parseconfdir(confpath, 0);
+	else
+#endif
+ 	parseconfig(confpath, 0);
+ 	if (!argc)
+ 		exit(0);
+@@ -330,6 +410,11 @@ main(int argc, char **argv)
+ 	if (geteuid())
+ 		errx(1, "not installed setuid");
+ 
+#ifdef DOAS_CONFDIR
+	if (isconfdir(DOAS_CONFDIR))
+		parseconfdir(DOAS_CONFDIR, 1);
+	else
+#endif
+ 	parseconfig(DOAS_CONF, 1);
+ 
+ 	/* cmdline is used only for logging, no need to abort on truncate */
+diff --git a/doas.conf.5 b/doas.conf.5
+index e98bfbe..e90d512 100644
+--- a/doas.conf.5
+++ b/doas.conf.5
+@@ -143,6 +143,7 @@ permit nopass keepenv setenv { PATH } root as root
+ .Ed
+ .Sh SEE ALSO
+ .Xr doas 1 ,
+.Xr doas.d 5 ,
+ .Xr syslogd 8
+ .Sh HISTORY
+ The
+diff --git a/doas.d.5 b/doas.d.5
+new file mode 100644
+index 0000000..c5eaa72
+--- /dev/null
+++ b/doas.d.5
+@@ -0,0 +1,50 @@
+.\"Copyright (c) 2021 Ariadne Conill <ariadne@dereferenced.org>
+.\"
+.\"Permission to use, copy, modify, and distribute this software for any
+.\"purpose with or without fee is hereby granted, provided that the above
+.\"copyright notice and this permission notice appear in all copies.
+.\"
+.\"THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+.\"WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+.\"MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+.\"ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+.\"WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+.\"ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+.\"OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.Dd $Mdocdate: October 9 2020 $
+.Dt DOAS.D 5
+.Os
+.Sh NAME
+.Nm doas.d
+.Nd doas configuration directory
+.Sh DESCRIPTION
+The
+.Xr doas 1
+utility executes commands as other users according to the rules
+configured in either the configuration file or, optionally, the
+configuration directory.  The preference to use the configuration
+file or configuration directory is determined at compile time,
+.Xr doas 1
+will only consult one or the other.
+.Pp
+Configuration snippets stored in the configuration directory
+follow the same rules as the classic
+.Xr doas 1
+configuration file, documented in
+.Xr doas.conf 5 .
+They must end with the .conf extension, or they will be ignored.
+.Pp
+These snippets are read in alphabetical order and thus can be
+ordered in the same way as other configuration directories.
+.Sh FILES
+.Bl -tag -width /etc/doas.d -compact
+.It Pa /etc/doas.d
+.Xr doas 1
+configuration directory.
+.Sh SEE ALSO
+.Xr doas 1 ,
+.Xr doas.conf 5
+.Sh HISTORY
+The
+.Nm
+configuration directory first appeared in OpenDoas.
+diff --git a/parse.y b/parse.y
+index 388c2a5..c6d7ebf 100644
+--- a/parse.y
+++ b/parse.y
+@@ -49,6 +49,7 @@ typedef struct {
+ } yystype;
+ #define YYSTYPE yystype
+ 
+const char *yyfn;
+ FILE *yyfp;
+ 
+ struct rule **rules;
+@@ -203,7 +204,7 @@ yyerror(const char *fmt, ...)
+ 	va_start(va, fmt);
+ 	vfprintf(stderr, fmt, va);
+ 	va_end(va);
+-	fprintf(stderr, " at line %d\n", yylval.lineno + 1);
+	fprintf(stderr, " at %s, line %d\n", yyfn, yylval.lineno + 1);
+ 	parse_errors++;
+ }
+ 
+--
+From c871cf723cc4cc1045ffc7de380f5271b4c29acf Mon Sep 17 00:00:00 2001
+From: Jakub Jirutka <jakub@jirutka.cz>
+Date: Sat, 13 May 2023 22:38:23 +0200
+Subject: [PATCH 9/9] read both /etc/doas.conf and /etc/doas.d/*.conf if
+ confdir is enabled
+
+The current behaviour of the configuration directory was required by the
+upstream, but it doesn't conform to established conventions used by
+virtually all programs on Linux that support modular configuration, and
+what the users naturally expect. Also, when someone used to vanilla
+OpenDoas or doas on BSD comes to Alpine, the way they're used to
+configuring it (via /etc/doas.conf) will no work without notice! It
+has already caused some problems and confusion.
+
+The current behaviour is: if /etc/doas.d exists, there must be at least one
+*.conf file and /etc/doas.conf is *ignored*.
+
+Since it doesn't look like the upstream will ever merge this, better to
+fix this patch to work as it should from the beginning...
+
+This new behaviour: /etc/doas.conf must always exist (as in unpatched
+OpenDoas) and will be read first; if /etc/doas.d exists and there are any
+*.conf files, they will be loaded as well.
+---
+ README.md |  7 +++----
+ doas.c    | 22 +++++-----------------
+ doas.d.5  | 14 +++++---------
+ 3 files changed, 13 insertions(+), 30 deletions(-)
+
+diff --git a/README.md b/README.md
+index 92acded..d5b2e72 100644
+--- a/README.md
+++ b/README.md
+@@ -48,7 +48,6 @@ timestamps are created and checked to be as safe as possible.
+ 
+ An optional feature can be enabled which will result in `doas` reading configuration
+ snippets from `/etc/doas.d`.  These configuration snippets have the same requirements
+-as `/etc/doas.conf` (owned by root, not world-writable).
+-
+-If this feature is enabled, only the `/etc/doas.d` directory is read, and the historical
+-`/etc/doas.conf` file is ignored.
+\ No newline at end of file
+as `/etc/doas.conf` (owned by root, not world-writable).  The main configuration file
+`/etc/doas.conf` is still required to exist and it is read before `/etc/doas.d`.  It is
+not an error if `/etc/doas.d` does not exist or no matching files are found there.
+diff --git a/doas.c b/doas.c
+index d77186b..affbe39 100644
+--- a/doas.c
+++ b/doas.c
+@@ -210,19 +210,14 @@ static void
+ parseconfdir(const char *dirpath, int checkperms)
+ {
+ 	struct dirent **dirent_table;
+-	int i, m, dirent_count;
+	int i, dirent_count;
+ 	char pathbuf[PATH_MAX];
+ 
+-	if (!isconfdir(dirpath))
+-		err(1, checkperms ? "doas is not enabled, %s" :
+-		    "could not open config directory %s", dirpath);
+-
+ 	dirent_count = scandir(dirpath, &dirent_table, NULL, alphasort);
+ 	if (dirent_count < 0)
+-		err(1, checkperms ? "doas is not enabled, %s" :
+-		    "could not open config directory %s", dirpath);
+		return;
+ 
+-	for (i = 0, m = 0; i < dirent_count; i++)
+	for (i = 0; i < dirent_count; i++)
+ 	{
+ 		struct stat sb;
+ 		size_t pathlen;
+@@ -244,13 +239,9 @@ parseconfdir(const char *dirpath, int checkperms)
+ 			continue;
+ 
+ 		parseconfig(pathbuf, checkperms);
+-		m++;
+ 	}
+ 
+ 	free(dirent_table);
+-
+-	if (!m)
+-		errx(1, "doas is not enabled, %s: no matching configuration files found\n", dirpath);
+ }
+ #endif
+ 
+@@ -263,12 +254,11 @@ checkconfig(const char *confpath, int argc, char **argv,
+ 	if (setresuid(uid, uid, uid) != 0)
+ 		err(1, "setresuid");
+ 
+	parseconfig(confpath, 0);
+ #ifdef DOAS_CONFDIR
+ 	if (isconfdir(confpath))
+ 		parseconfdir(confpath, 0);
+-	else
+ #endif
+-	parseconfig(confpath, 0);
+ 	if (!argc)
+ 		exit(0);
+ 
+@@ -410,13 +400,11 @@ main(int argc, char **argv)
+ 	if (geteuid())
+ 		errx(1, "not installed setuid");
+ 
+	parseconfig(DOAS_CONF, 1);
+ #ifdef DOAS_CONFDIR
+ 	if (isconfdir(DOAS_CONFDIR))
+ 		parseconfdir(DOAS_CONFDIR, 1);
+-	else
+ #endif
+-	parseconfig(DOAS_CONF, 1);
+-
+ 	/* cmdline is used only for logging, no need to abort on truncate */
+ 	(void)strlcpy(cmdline, argv[0], sizeof(cmdline));
+ 	for (i = 1; i < argc; i++) {
+diff --git a/doas.d.5 b/doas.d.5
+index c5eaa72..5911a12 100644
+--- a/doas.d.5
+++ b/doas.d.5
+@@ -21,14 +21,9 @@
+ The
+ .Xr doas 1
+ utility executes commands as other users according to the rules
+-configured in either the configuration file or, optionally, the
+-configuration directory.  The preference to use the configuration
+-file or configuration directory is determined at compile time,
+-.Xr doas 1
+-will only consult one or the other.
+-.Pp
+-Configuration snippets stored in the configuration directory
+-follow the same rules as the classic
+configured in the configuration file and, optionally, the
+configuration directory.  Configuration snippets stored in the
+configuration directory follow the same rules as the classic
+ .Xr doas 1
+ configuration file, documented in
+ .Xr doas.conf 5 .
+@@ -47,4 +42,5 @@ configuration directory.
+ .Sh HISTORY
+ The
+ .Nm
+-configuration directory first appeared in OpenDoas.
+configuration directory first appeared as a patch for doas on
+Alpine Linux and it is not supported in upstream OpenDoas.
@@ -0,0 +1,5 @@
+# See doas.conf(5) and doas.d(5) for configuration details.
+# Configuration here may be overridden by /etc/doas.d/*.conf if files exist.
+
+# Uncomment to allow group "wheel" to become root.
+# permit persist :wheel
@@ -0,0 +1,65 @@
+#!/bin/sh
+
+ver_old="$2"
+
+if [ "$(apk version -t "$ver_old" '6.8.1-r6')" = '<' ]; then
+	if [ "$(stat -c "%a" /etc/doas.d)" = "755" ]; then
+		chmod 0750 /etc/doas.d
+	fi
+fi
+
+if [ "$(apk version -t "$ver_old" '6.8.1-r4')" = '<' ]; then
+	:  # do nothing, this is prior renaming /etc/doas.conf to /etc/doas.d/doas.conf
+
+# Undo what was done by the previous post-{install,upgrade} script.
+elif [ "$(apk version -t "$ver_old" '6.8.2-r5')" = '<' ]; then
+	cat >&2 <<-EOF
+	*
+	* Since 6.8.2-r5, doas reads both /etc/doas.conf and /etc/doas.d/*.conf
+	* (if exists), in this order, and /etc/doas.conf is required to exist.
+	*
+	EOF
+	if [ -L /etc/doas.conf ] && [ "$(readlink -f /etc/doas.conf)" = '/etc/doas.d/doas.conf' ]; then
+		cat >&2 <<-EOF
+		* Removing /etc/doas.conf symlink and moving /etc/doas.d/doas.conf
+		* to /etc/doas.conf.
+		*
+		EOF
+		rm /etc/doas.conf  # symlink
+		mv /etc/doas.d/doas.conf /etc/doas.conf  # user's config
+
+		# Remove outdated comment added by the previous post-upgrade script.
+		# Note: /etc/doas.conf.apk-new has been created by the upgrade,
+		#  so it already has correct perms.
+		cat /etc/doas.conf \
+			| tr '\n' '\f' \
+			| sed 's|# This file is actually located at /etc/doas.d/doas.conf, and reflects\f# the system doas configuration.  It may have been migrated from its\f# previous location, /etc/doas.conf, automatically.\f||' \
+			| tr '\f' '\n' \
+			> /etc/doas.conf.apk-new
+
+	# Note: If /etc/doas.conf existed, the package upgrade has created
+	# doas.conf.apk-new.
+	elif [ -f /etc/doas.conf ] && [ -f /etc/doas.conf.apk-new ] && [ "$(ls /etc/doas.d/*.conf 2>/dev/null)" ]; then
+		bakfile='/etc/doas.conf.bak'
+		[ -e "$bakfile" ] && bakfile="$bakfile$(date +%s)"
+
+		cat >&2 <<-EOF
+		*! CAUTION: /etc/doas.conf already exists and /etc/doas.d is not empty,
+		*! so it's been ignored until now! Renaming it to $bakfile.
+		*! It's strongly recommended that you check your configuration!
+		*
+		EOF
+		mv /etc/doas.conf "$bakfile"  # user's config
+		mv /etc/doas.conf.apk-new /etc/doas.conf  # new config
+
+	elif [ -f /etc/doas.d/doas.conf ]; then
+		cat >&2 <<-EOF
+		* Moving /etc/doas.d/doas.conf to /etc/doas.conf.
+		*
+		EOF
+		mv /etc/doas.conf /etc/doas.conf.apk-new  # new config
+		mv /etc/doas.d/doas.conf /etc/doas.conf  # user's config
+	fi
+fi
+
+exit 0
@@ -0,0 +1,16 @@
+--- OpenDoas-6.8.1.orig/doas.conf.5
+++ OpenDoas-6.8.1/doas.conf.5
+@@ -114,11 +114,11 @@
+ it is not considered a keyword.
+ .El
+ .Sh FILES
+-.Bl -tag -width /etc/examples/doas.conf -compact
+.Bl -tag -width /usr/share/doc/doas/doas.conf.example -compact
+ .It Pa /etc/doas.conf
+ .Xr doas 1
+ configuration file.
+-.It Pa /etc/examples/doas.conf
+.It Pa /usr/share/doc/doas/doas.conf.example
+ Example configuration file.
+ .El
+ .Sh EXAMPLES
@@ -0,0 +1,73 @@
+This patch has been taken from OpenBSD upstream, it changes permit bits to make
+them more rowhammer-resistent. A similar patch has also been committed to sudo.
+
+The patch has not made its way into OpenDoas yet, but at the time of writting
+OpenDoas upstream is rather stale (last commit was done 2 years ago).
+
+See:
+
+* https://github.com/openbsd/src/commit/38599afa1d1d1f14a897b01350e8ce94486e1788
+* https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f
+
+diff --git a/doas.c b/doas.c
+index ac3a42a..93f0836 100644
+--- a/doas.c
+++ b/doas.c
+@@ -148,8 +148,10 @@ permit(uid_t uid, gid_t *groups, int ngroups, const struct rule **lastr,
+ 			*lastr = rules[i];
+ 	}
+ 	if (!*lastr)
+		return -1;
+	if ((*lastr)->action == PERMIT)
+ 		return 0;
+-	return (*lastr)->action == PERMIT;
+	return -1;
+ }
+ 
+ static void
+@@ -184,6 +186,7 @@ checkconfig(const char *confpath, int argc, char **argv,
+     uid_t uid, gid_t *groups, int ngroups, uid_t target)
+ {
+ 	const struct rule *rule;
+	int rv;
+ 
+ 	if (setresuid(uid, uid, uid) != 0)
+ 		err(1, "setresuid");
+@@ -191,9 +194,9 @@ checkconfig(const char *confpath, int argc, char **argv,
+ 	parseconfig(confpath, 0);
+ 	if (!argc)
+ 		exit(0);
+-
+-	if (permit(uid, groups, ngroups, &rule, target, argv[0],
+-	    (const char **)argv + 1)) {
+	rv = permit(uid, groups, ngroups, &rule, target, argv[0],
+ 	    (const char **)argv + 1);
+	if (rv == 0) {
+ 		printf("permit%s\n", (rule->options & NOPASS) ? " nopass" : "");
+ 		exit(0);
+ 	} else {
+@@ -342,8 +345,9 @@ main(int argc, char **argv)
+ 	}
+ 
+ 	cmd = argv[0];
+-	if (!permit(uid, groups, ngroups, &rule, target, cmd,
+-	    (const char **)argv + 1)) {
+	rv = permit(uid, groups, ngroups, &rule, target, cmd,
+	    (const char **)argv + 1);
+	if (rv != 0) {
+ 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
+ 		    "command not permitted for %s: %s", mypw->pw_name, cmdline);
+ 		errc(1, EPERM, NULL);
+diff --git a/doas.h b/doas.h
+index a8aa41b..591816f 100644
+--- a/doas.h
+++ b/doas.h
+@@ -36,7 +36,7 @@ struct passwd;
+ char **prepenv(const struct rule *, const struct passwd *,
+     const struct passwd *);
+ 
+-#define PERMIT	1
+#define PERMIT	-1
+ #define DENY	2
+ 
+ #define NOPASS		0x1
@@ -0,0 +1,94 @@
+# Forked from Alpine to set sysconfdir to /usr/share/sudo
+
+# Contributor: Sören Tempel <soeren+alpine@soeren-tempel.net>
+# Contributor: Łukasz Jendrysik <scadu@yandex.com>
+# Maintainer: Celeste <cielesti@protonmail.com>
+maintainer="Celeste <cielesti@protonmail.com>"
+pkgname=sudo
+pkgver=99991.9.17_p1
+_pkgver=1.9.17_p1
+pkgrel=0
+_realver=${_pkgver/_/}
+pkgdesc="Give certain users the ability to run some commands as root"
+url="https://www.sudo.ws/sudo/"
+arch="all"
+license="custom ISC"
+makedepends_host="zlib-dev"
+subpackages="$pkgname-doc-extra::noarch $pkgname-doc $pkgname-dev"
+source="https://www.sudo.ws/dist/sudo-$_realver.tar.gz"
+options="suid"
+builddir="$srcdir/sudo-$_realver"
+
+provides="sudo-virt"
+provider_priority=100
+replaces="sudo-ldap"
+
+# secfixes:
+#   1.9.17_p1-r0:
+#     - CVE-2025-32462
+#     - CVE-2025-32463
+#   1.9.12_p2-r0:
+#     - CVE-2023-22809
+#   1.9.5_p2-r0:
+#     - CVE-2021-3156
+#   1.9.5-r0:
+#     - CVE-2021-23239
+#     - CVE-2021-23240
+#   1.8.31-r0:
+#     - CVE-2019-18634
+#   1.8.28-r0:
+#     - CVE-2019-14287
+#   1.8.20_p2-r0:
+#     - CVE-2017-1000368
+
+build() {
+	CFLAGS="$CFLAGS -flto=auto" \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/usr/share/sudo \
+		--libexecdir=/usr/lib \
+		--mandir=/usr/share/man \
+		--with-rundir=/run/sudo \
+		--with-vardir=/var/lib/sudo \
+		--with-tzdir=/usr/share/zoneinfo \
+		--with-logdir=/var/log \
+		--with-iologdir=/var/log/sudo-io \
+		--with-logpath=/var/log/sudo.log \
+		--with-relaydir=/var/log/sudo_logsrvd \
+		--disable-nls \
+		--enable-pie \
+		--with-env-editor \
+		--with-mdoc \
+		--without-pam \
+		--without-skey \
+		--with-sendmail=/usr/sbin/sendmail \
+		--with-passprompt="[sudo] password for %p: "
+
+	make
+}
+
+check() {
+	make check
+}
+
+package() {
+	# the sudo's mkinstalldir script miscreates the leading
+	# path components with bad permissions. fix this.
+	install -dm0755 "$pkgdir"/var "$pkgdir"/var/db
+	make -j1 DESTDIR="$pkgdir" install
+
+	# Exactly the same as /etc/sudoers
+	rm -v "$pkgdir"/usr/share/sudo/sudoers.dist
+}
+
+extra() {
+	pkgdesc="$pkgdesc (examples and news)"
+
+	amove usr/share/doc
+}
+
+sha512sums="
+1a9fb27a117b54adf5c99443b3375f7e0eaaf3a2d5a3d409f7c7b10c43432eb301d721df93fb1a8a2e45bf4a4957288d4f153359fc018af00973be57f62a1ebc  sudo-1.9.17p1.tar.gz
+"
Author	SHA1	Message	Date
Aster Boese	8105d7d884	systemd/systemd-services: remove tmpfiles and sysusers configs Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:35:11 -04:00
Aster Boese	a5c1218a91	main/postmarketos-sysusers-configs: add sing-box config Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:34:57 -04:00
Aster Boese	b666010edd	main/postmarketos-tmpfiles-configs: add sing-box config Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:34:57 -04:00
Aster Boese	d5bebe9c83	systemd/systemd-services: remove flatpak tmpfiles config Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:34:56 -04:00
Aster Boese	260dee1d79	main/postmarketos-tmpfiles-configs: add flatpak config Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:34:40 -04:00
Aster Boese	6dd076f79d	main/postmarketos-sysusers-configs: add openssh config Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:34:40 -04:00
Aster Boese	07a1e7da10	main/postmarketos-sysusers-configs: add dnsmasq config Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:34:40 -04:00
Aster Boese	666ae39186	systemd/systemd-services: revert "systemd/systemd-services: add sysuser conf for ssh and dnsmasq" Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:34:39 -04:00
Aster Boese	8e5cb3c0d9	main/postmarketos-sysusers-configs: new package Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:33:50 -04:00
Aster Boese	1ca8cbd0f7	systemd/gdm: revert "systemd/gdm: add sysuser config"	2025-08-16 18:33:50 -04:00
Aster Boese	8c488651e6	main/postmarketos-base: install sudo configuration under /usr Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:33:50 -04:00
Aster Boese	12b0c3249f	temp/sudo: fork from Alpine to install configs under /usr Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:33:50 -04:00
Aster Boese	91b1bb3d68	main/postmarketos-base: move doas configuration to /usr/share/doas Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:33:50 -04:00
Aster Boese	9500d62ebb	temp/doas: fork from Alpine to install configs under /usr Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:33:50 -04:00
Aster Boese	8eb8089b4c	main/mobile-config-firefox: set config dir to be under /usr Sets FIREFOX_CONFIG_DIR to be `/usr/lib/${firefox}/distribution` since this is where distribution overrides should go. Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:33:50 -04:00
Aster Boese	f75cea4270	main/postmarketos-tmpfiles-configs: new package Signed-off-by: Aster Boese <asterboese@mailbox.org>	2025-08-16 18:33:50 -04:00
				`@@ -0,0 +1 @@`
				`L /etc/mobile-config-firefox - - - - /usr/share/factory/etc/mobile-config-firefox`