[gentoo-commits] proj/portage:prefix commit in: /

[Fabian Groffen]

commit:     990c5f4896b309fdcaf1dbbb5779177ecfcf6e74
Author:     Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 28 17:52:16 2014 +0000
Commit:     Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Sun Sep 28 17:52:16 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/portage.git;a=commit;h=990c5f48

Merge remote-tracking branch 'overlays-gentoo-org/master' into prefix

Conflicts:
	bin/ebuild-helpers/emake
	bin/misc-functions.sh
	bin/portageq
	doc/Makefile
	pym/_emerge/EbuildBuild.py
	pym/portage/const.py
	pym/portage/dbapi/vartree.py
	pym/portage/package/ebuild/doebuild.py


 .gitignore                                         |   1 +
 .travis.yml                                        |  13 +
 DEVELOPING                                         |  22 +-
 MANIFEST.in                                        |  18 +
 Makefile                                           | 215 ------
 NEWS                                               |  27 +-
 RELEASE-NOTES                                      |  65 +-
 bin/archive-conf                                   |   4 +-
 bin/binhost-snapshot                               |   4 +-
 bin/chpathtool.py                                  |   8 +-
 bin/clean_locks                                    |   4 +-
 bin/deprecated-path                                |  28 +
 bin/dispatch-conf                                  |   4 +-
 bin/ebuild                                         |   4 +-
 bin/ebuild-helpers/emake                           |   4 +-
 bin/ebuild-helpers/xattr/install                   |  27 +-
 bin/ebuild-ipc.py                                  |  20 +-
 bin/ebuild.sh                                      | 131 ++--
 bin/egencache                                      |   4 +-
 bin/emaint                                         |   4 +-
 bin/emerge                                         |  14 +-
 bin/emerge-webrsync                                |   4 +-
 bin/env-update                                     |   4 +-
 bin/fixpackages                                    |   4 +-
 bin/glsa-check                                     |   4 +-
 bin/install-qa-check.d/05double-D                  |  17 +
 bin/install-qa-check.d/05prefix                    | 118 +++
 bin/install-qa-check.d/10executable-issues         | 140 ++++
 bin/install-qa-check.d/10ignored-flags             |  99 +++
 bin/install-qa-check.d/20deprecated-directories    |  18 +
 bin/install-qa-check.d/20runtime-directories       |  26 +
 bin/install-qa-check.d/60bash-completion           | 130 ++++
 bin/install-qa-check.d/60openrc                    |  41 ++
 bin/install-qa-check.d/60pkgconfig                 |  15 +
 bin/install-qa-check.d/60pngfix                    |  35 +
 bin/install-qa-check.d/60systemd                   |  25 +
 bin/install-qa-check.d/60udev                      |  21 +
 bin/install-qa-check.d/80libraries                 | 167 +++++
 bin/install-qa-check.d/80multilib-strict           |  50 ++
 bin/install-qa-check.d/90gcc-warnings              | 168 +++++
 bin/install-qa-check.d/90world-writable            |  27 +
 bin/misc-functions.sh                              | 800 +--------------------
 bin/phase-functions.sh                             | 153 ++--
 bin/phase-helpers.sh                               |  40 +-
 bin/portageq                                       | 339 +++++----
 bin/quickpkg                                       |   8 +-
 bin/regenworld                                     |   4 +-
 bin/repoman                                        |  32 +-
 bin/save-ebuild-env.sh                             |   2 +-
 bin/xattr-helper.py                                |   6 +-
 cnf/sets/portage.conf                              |   5 +
 doc/Makefile                                       |  13 -
 doc/fragment/version                               |   1 -
 man/emerge.1                                       |  19 +-
 man/repoman.1                                      |   4 +
 misc/emerge-delta-webrsync                         |   4 +-
 mkrelease.sh                                       | 141 ----
 pym/_emerge/Binpkg.py                              |   9 +-
 pym/_emerge/EbuildBuild.py                         |   6 +-
 pym/_emerge/FakeVartree.py                         |   4 +-
 pym/_emerge/MiscFunctionsProcess.py                |   6 +-
 pym/_emerge/PackageMerge.py                        |   5 +-
 pym/_emerge/Scheduler.py                           |   2 +-
 pym/_emerge/UserQuery.py                           |  71 ++
 pym/_emerge/actions.py                             |  60 +-
 pym/_emerge/depgraph.py                            | 380 ++++++++--
 pym/_emerge/main.py                                |  18 +-
 pym/_emerge/post_emerge.py                         |   5 +-
 pym/_emerge/resolver/output_helpers.py             |   2 +-
 pym/_emerge/resolver/package_tracker.py            |   2 +-
 pym/_emerge/sync/old_tree_timestamp.py             |  12 +-
 pym/_emerge/unmerge.py                             |   8 +-
 pym/_emerge/userquery.py                           |  55 --
 pym/portage/__init__.py                            |  16 +-
 pym/portage/_emirrordist/FetchTask.py              |   6 +-
 pym/portage/_global_updates.py                     |   4 +-
 pym/portage/_sets/dbapi.py                         |  85 ++-
 pym/portage/cache/sqlite.py                        |   4 +-
 pym/portage/const.py                               |  12 +-
 pym/portage/dbapi/__init__.py                      |   6 +-
 pym/portage/dbapi/vartree.py                       |  25 +-
 pym/portage/dep/_slot_operator.py                  |  27 +-
 pym/portage/dep/dep_check.py                       |  20 +-
 pym/portage/dispatch_conf.py                       |   3 +-
 pym/portage/emaint/main.py                         |   6 +-
 pym/portage/emaint/module.py                       |   2 +-
 pym/portage/emaint/modules/binhost/__init__.py     |   8 +-
 pym/portage/emaint/modules/config/__init__.py      |   8 +-
 pym/portage/emaint/modules/logs/__init__.py        |   8 +-
 pym/portage/emaint/modules/merges/__init__.py      |  31 +
 pym/portage/emaint/modules/merges/merges.py        | 290 ++++++++
 pym/portage/emaint/modules/move/__init__.py        |   8 +-
 pym/portage/emaint/modules/move/move.py            |   5 +-
 pym/portage/emaint/modules/resume/__init__.py      |   6 +-
 pym/portage/emaint/modules/world/__init__.py       |   8 +-
 pym/portage/exception.py                           |   4 +
 pym/portage/localization.py                        |   7 +-
 pym/portage/mail.py                                |  12 +-
 pym/portage/news.py                                |   8 +-
 pym/portage/output.py                              |   6 +-
 pym/portage/package/ebuild/config.py               |  17 +-
 pym/portage/package/ebuild/doebuild.py             |   9 +-
 pym/portage/tests/__init__.py                      |  24 +-
 .../date => pym/portage/tests/bin/__test__.py      |   0
 .../tests/{bin/__test__ => dbapi/__test__.py}      |   0
 pym/portage/tests/dbapi/test_portdb_cache.py       |  23 +-
 .../tests/{dbapi/__test__ => dep/__test__.py}      |   0
 .../tests/{dep/__test__ => ebuild/__test__.py}     |   0
 pym/portage/tests/ebuild/test_config.py            |  71 +-
 .../tests/{ebuild/__test__ => emerge/__test__.py}  |   0
 pym/portage/tests/emerge/test_emerge_slot_abi.py   |   7 +-
 pym/portage/tests/emerge/test_simple.py            |  36 +-
 .../tests/{emerge/__test__ => env/__test__.py}     |   0
 .../tests/env/{__test__ => config/__test__.py}     |   0
 .../{env/config/__test__ => glsa/__test__.py}      |   0
 pym/portage/tests/glsa/test_security_set.py        |   3 +-
 .../{glsa/__test__ => lafilefixer/__test__.py}     |   0
 .../__test__ => lazyimport/__test__.py}            |   0
 .../{lazyimport/__test__ => lint/__test__.py}      |   0
 pym/portage/tests/lint/test_compile_modules.py     |  10 +-
 pym/portage/tests/lint/test_import_modules.py      |   8 +-
 .../tests/{lint/__test__ => locks/__test__.py}     |   0
 .../tests/{locks/__test__ => news/__test__.py}     |   0
 .../tests/{news/__test__ => process/__test__.py}   |   0
 .../{process/__test__ => repoman/__test__.py}      |   0
 pym/portage/tests/repoman/test_simple.py           |   8 +-
 pym/portage/tests/resolver/ResolverPlayground.py   |  59 +-
 .../{repoman/__test__ => resolver/__test__.py}     |   0
 .../tests/resolver/test_autounmask_use_breakage.py |  63 ++
 pym/portage/tests/resolver/test_or_choices.py      |  73 ++
 ...fied.py => test_slot_conflict_force_rebuild.py} |  56 +-
 .../test_slot_conflict_unsatisfied_deep_deps.py    | 115 +++
 ...nsatisfied.py => test_slot_operator_rebuild.py} |  52 +-
 .../resolver/test_slot_operator_required_use.py    |  72 ++
 ...test_solve_non_slot_operator_slot_conflicts.py} |  49 +-
 pym/portage/tests/{runTests => runTests.py}        |   0
 .../{resolver/__test__ => sets/base/__test__.py}   |   0
 .../sets/{base/__test__ => files/__test__.py}      |   0
 .../sets/{files/__test__ => shell/__test__.py}     |   0
 .../{sets/shell/__test__ => unicode/__test__.py}   |   0
 .../tests/{unicode/__test__ => update/__test__.py} |   0
 .../tests/{update/__test__ => util/__test__.py}    |   0
 pym/portage/tests/util/test_getconfig.py           |   4 +-
 .../tests/{util/__test__ => versions/__test__.py}  |   0
 pym/portage/tests/xpak/__test__                    |   0
 .../tests/{versions/__test__ => xpak/__test__.py}  |   0
 pym/portage/util/__init__.py                       |   3 +-
 pym/portage/util/_eventloop/EventLoop.py           |   8 +-
 pym/portage/util/_eventloop/PollSelectAdapter.py   |   6 +-
 pym/repoman/checks.py                              |  16 -
 runtests.sh                                        |   8 +-
 setup.py                                           | 652 +++++++++++++++++
 testpath                                           |  11 +
 153 files changed, 4118 insertions(+), 1920 deletions(-)

diff --cc bin/ebuild-helpers/emake
index 60286ec,4618053..dcb64a3
--- a/bin/ebuild-helpers/emake
+++ b/bin/ebuild-helpers/emake
@@@ -22,7 -22,7 +22,7 @@@ if [[ $PORTAGE_QUIET != 1 ]] ; the
  	) >&2
  fi
  
- ${MAKE:-make} SHELL="${BASH:-/bin/bash}" ${MAKEOPTS} ${EXTRA_EMAKE} "$@"
 -${MAKE:-make} ${MAKEOPTS} "$@" ${EXTRA_EMAKE}
++${MAKE:-make} SHELL="${BASH:-/bin/bash}" ${MAKEOPTS} "$@" ${EXTRA_EMAKE}
  ret=$?
  [[ $ret -ne 0 ]] && __helpers_die "${0##*/} failed"
  exit $ret
diff --cc bin/install-qa-check.d/05prefix
index 0000000,e1fc2bd..32561e2
mode 000000,100644..100644
--- a/bin/install-qa-check.d/05prefix
+++ b/bin/install-qa-check.d/05prefix
@@@ -1,0 -1,117 +1,118 @@@
+ # Prefix specific QA checks
+ 
+ install_qa_check_prefix() {
+ 	[[ ${ED} == ${D} ]] && return
+ 
+ 	if [[ -d ${ED}/${D} ]] ; then
+ 		find "${ED}/${D}" | \
+ 		while read i ; do
+ 			eqawarn "QA Notice: /${i##${ED}/${D}} installed in \${ED}/\${D}"
+ 		done
+ 		die "Aborting due to QA concerns: files installed in ${ED}/${D}"
+ 	fi
+ 
+ 	if [[ -d ${ED}/${EPREFIX} ]] ; then
+ 		find "${ED}/${EPREFIX}/" | \
+ 		while read i ; do
+ 			eqawarn "QA Notice: ${i#${D}} double prefix"
+ 		done
+ 		die "Aborting due to QA concerns: double prefix files installed"
+ 	fi
+ 
+ 	if [[ -d ${D} ]] ; then
+ 		INSTALLTOD=$(find ${D%/} | egrep -v "^${ED}" | sed -e "s|^${D%/}||" | awk '{if (length($0) <= length("'"${EPREFIX}"'")) { if (substr("'"${EPREFIX}"'", 1, length($0)) != $0) {print $0;} } else if (substr($0, 1, length("'"${EPREFIX}"'")) != "'"${EPREFIX}"'") {print $0;} }')
+ 		if [[ -n ${INSTALLTOD} ]] ; then
+ 			eqawarn "QA Notice: the following files are outside of the prefix:"
+ 			eqawarn "${INSTALLTOD}"
+ 			die "Aborting due to QA concerns: there are files installed outside the prefix"
+ 		fi
+ 	fi
+ 
+ 	# all further checks rely on ${ED} existing
+ 	[[ -d ${ED} ]] || return
+ 
+ 	# check shebangs, bug #282539
+ 	rm -f "${T}"/non-prefix-shebangs-errs
+ 	local WHITELIST=" /usr/bin/env "
+ 	# this is hell expensive, but how else?
+ 	find "${ED}" -executable \! -type d -print0 \
+ 			| xargs -0 grep -H -n -m1 "^#!" \
+ 			| while read f ;
+ 	do
+ 		local fn=${f%%:*}
+ 		local pos=${f#*:} ; pos=${pos%:*}
+ 		local line=${f##*:}
+ 		# shebang always appears on the first line ;)
+ 		[[ ${pos} != 1 ]] && continue
+ 		local oldIFS=${IFS}
+ 		IFS=$'\r'$'\n'$'\t'" "
+ 		line=( ${line#"#!"} )
+ 		IFS=${oldIFS}
+ 		[[ ${WHITELIST} == *" ${line[0]} "* ]] && continue
+ 		local fp=${fn#${D}} ; fp=/${fp%/*}
+ 		# line[0] can be an absolutised path, bug #342929
+ 		local eprefix=$(canonicalize ${EPREFIX})
+ 		local rf=${fn}
+ 		# in case we deal with a symlink, make sure we don't replace it
+ 		# with a real file (sed -i does that)
+ 		if [[ -L ${fn} ]] ; then
+ 			rf=$(readlink ${fn})
+ 			[[ ${rf} != /* ]] && rf=${fn%/*}/${rf}
+ 			# ignore symlinks pointing to outside prefix
+ 			# as seen in sys-devel/native-cctools
+ 			[[ $(canonicalize "/${rf#${D}}") != ${eprefix}/* ]] && continue
+ 		fi
+ 		# does the shebang start with ${EPREFIX}, and does it exist?
+ 		if [[ ${line[0]} == ${EPREFIX}/* || ${line[0]} == ${eprefix}/* ]] ; then
+ 			if [[ ! -e ${ROOT%/}${line[0]} && ! -e ${D%/}${line[0]} ]] ; then
+ 				# hmm, refers explicitly to $EPREFIX, but doesn't exist,
+ 				# if it's in PATH that's wrong in any case
+ 				if [[ ":${PATH}:" == *":${fp}:"* ]] ; then
+ 					echo "${fn#${D}}:${line[0]} (explicit EPREFIX but target not found)" \
+ 						>> "${T}"/non-prefix-shebangs-errs
+ 				else
+ 					eqawarn "${fn#${D}} has explicit EPREFIX in shebang but target not found (${line[0]})"
+ 				fi
+ 			fi
+ 			continue
+ 		fi
 -		# unprefixed shebang, is the script directly in $PATH?
 -		if [[ ":${PATH}:" == *":${fp}:"* ]] ; then
++		# unprefixed shebang, is the script directly in $PATH or an init
++		# script?
++		if [[ ":${PATH}:${EPREFIX}/etc/init.d:" == *":${fp}:"* ]] ; then
+ 			if [[ -e ${EROOT}${line[0]} || -e ${ED}${line[0]} ]] ; then
+ 				# is it unprefixed, but we can just fix it because a
+ 				# prefixed variant exists
+ 				eqawarn "prefixing shebang of ${fn#${D}}"
+ 				# statement is made idempotent on purpose, because
+ 				# symlinks may point to the same target, and hence the
+ 				# same real file may be sedded multiple times since we
+ 				# read the shebangs in one go upfront for performance
+ 				# reasons
+ 				sed -i -e '1s:^#! \?'"${line[0]}"':#!'"${EPREFIX}"${line[0]}':' "${rf}"
+ 				continue
+ 			else
+ 				# this is definitely wrong: script in $PATH and invalid shebang
+ 				echo "${fn#${D}}:${line[0]} (script ${fn##*/} installed in PATH but interpreter ${line[0]} not found)" \
+ 					>> "${T}"/non-prefix-shebangs-errs
+ 			fi
+ 		else
+ 			# unprefixed/invalid shebang, but outside $PATH, this may be
+ 			# intended (e.g. config.guess) so remain silent by default
+ 			has stricter ${FEATURES} && \
+ 				eqawarn "invalid shebang in ${fn#${D}}: ${line[0]}"
+ 		fi
+ 	done
+ 	if [[ -e "${T}"/non-prefix-shebangs-errs ]] ; then
+ 		eqawarn "QA Notice: the following files use invalid (possible non-prefixed) shebangs:"
+ 		while read line ; do
+ 			eqawarn "  ${line}"
+ 		done < "${T}"/non-prefix-shebangs-errs
+ 		rm -f "${T}"/non-prefix-shebangs-errs
+ 		die "Aborting due to QA concerns: invalid shebangs found"
+ 	fi
+ }
+ 
+ install_qa_check_prefix
+ : # guarantee successful exit
+ 
+ # vim:ft=sh
diff --cc bin/install-qa-check.d/80libraries
index 0000000,3977bae..c83f278
mode 000000,100644..100644
--- a/bin/install-qa-check.d/80libraries
+++ b/bin/install-qa-check.d/80libraries
@@@ -1,0 -1,158 +1,167 @@@
+ # Check for issues with installed libraries
+ 
+ lib_check() {
+ 	local f x i j
+ 
+ 	if type -P scanelf > /dev/null && ! has binchecks ${RESTRICT}; then
+ 		# Check for shared libraries lacking SONAMEs
+ 		local qa_var="QA_SONAME_${ARCH/-/_}"
+ 		eval "[[ -n \${!qa_var} ]] && QA_SONAME=(\"\${${qa_var}[@]}\")"
+ 		f=$(scanelf -ByF '%S %p' "${ED}"{,usr/}lib*/lib*.so* | awk '$2 == "" { print }' | sed -e "s:^[[:space:]]${ED}:/:")
+ 		if [[ -n ${f} ]] ; then
+ 			echo "${f}" > "${T}"/scanelf-missing-SONAME.log
+ 			if [[ "${QA_STRICT_SONAME-unset}" == unset ]] ; then
+ 				if [[ ${#QA_SONAME[@]} -gt 1 ]] ; then
+ 					for x in "${QA_SONAME[@]}" ; do
+ 						sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-SONAME.log
+ 					done
+ 				else
+ 					local shopts=$-
+ 					set -o noglob
+ 					for x in ${QA_SONAME} ; do
+ 						sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-SONAME.log
+ 					done
+ 					set +o noglob
+ 					set -${shopts}
+ 				fi
+ 			fi
+ 			sed -e "/^\$/d" -i "${T}"/scanelf-missing-SONAME.log
+ 			f=$(<"${T}"/scanelf-missing-SONAME.log)
+ 			if [[ -n ${f} ]] ; then
+ 				__vecho -ne '\n'
+ 				eqawarn "QA Notice: The following shared libraries lack a SONAME"
+ 				eqawarn "${f}"
+ 				__vecho -ne '\n'
+ 				sleep 1
+ 			else
+ 				rm -f "${T}"/scanelf-missing-SONAME.log
+ 			fi
+ 		fi
+ 
+ 		# Check for shared libraries lacking NEEDED entries
+ 		qa_var="QA_DT_NEEDED_${ARCH/-/_}"
+ 		eval "[[ -n \${!qa_var} ]] && QA_DT_NEEDED=(\"\${${qa_var}[@]}\")"
+ 		f=$(scanelf -ByF '%n %p' "${ED}"{,usr/}lib*/lib*.so* | awk '$2 == "" { print }' | sed -e "s:^[[:space:]]${ED}:/:")
+ 		if [[ -n ${f} ]] ; then
+ 			echo "${f}" > "${T}"/scanelf-missing-NEEDED.log
+ 			if [[ "${QA_STRICT_DT_NEEDED-unset}" == unset ]] ; then
+ 				if [[ ${#QA_DT_NEEDED[@]} -gt 1 ]] ; then
+ 					for x in "${QA_DT_NEEDED[@]}" ; do
+ 						sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-NEEDED.log
+ 					done
+ 				else
+ 					local shopts=$-
+ 					set -o noglob
+ 					for x in ${QA_DT_NEEDED} ; do
+ 						sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-NEEDED.log
+ 					done
+ 					set +o noglob
+ 					set -${shopts}
+ 				fi
+ 			fi
+ 			sed -e "/^\$/d" -i "${T}"/scanelf-missing-NEEDED.log
+ 			f=$(<"${T}"/scanelf-missing-NEEDED.log)
+ 			if [[ -n ${f} ]] ; then
+ 				__vecho -ne '\n'
+ 				eqawarn "QA Notice: The following shared libraries lack NEEDED entries"
+ 				eqawarn "${f}"
+ 				__vecho -ne '\n'
+ 				sleep 1
+ 			else
+ 				rm -f "${T}"/scanelf-missing-NEEDED.log
+ 			fi
+ 		fi
+ 	fi
+ 
+ 	# this should help to ensure that all (most?) shared libraries are executable
+ 	# and that all libtool scripts / static libraries are not executable
+ 	for i in "${ED}"opt/*/lib* \
+ 	         "${ED}"lib* \
+ 	         "${ED}"usr/lib* ; do
+ 		[[ ! -d ${i} ]] && continue
+ 
+ 		for j in "${i}"/*.so.* "${i}"/*.so ; do
+ 			[[ ! -e ${j} ]] && continue
+ 			[[ -L ${j} ]] && continue
+ 			[[ -x ${j} ]] && continue
+ 			__vecho "making executable: ${j#${ED}}"
+ 			chmod +x "${j}"
+ 		done
+ 
+ 		for j in "${i}"/*.a "${i}"/*.la ; do
+ 			[[ ! -e ${j} ]] && continue
+ 			[[ -L ${j} ]] && continue
+ 			[[ ! -x ${j} ]] && continue
+ 			__vecho "removing executable bit: ${j#${ED}}"
+ 			chmod -x "${j}"
+ 		done
+ 
+ 		for j in "${i}"/*.{a,dll,dylib,sl,so}.* "${i}"/*.{a,dll,dylib,sl,so} ; do
+ 			[[ ! -e ${j} ]] && continue
+ 			[[ ! -L ${j} ]] && continue
+ 			linkdest=$(readlink "${j}")
+ 			if [[ ${linkdest} == /* ]] ; then
+ 				__vecho -ne '\n'
+ 				eqawarn "QA Notice: Found an absolute symlink in a library directory:"
+ 				eqawarn "           ${j#${D}} -> ${linkdest}"
+ 				eqawarn "           It should be a relative symlink if in the same directory"
+ 				eqawarn "           or a linker script if it crosses the /usr boundary."
+ 			fi
+ 		done
+ 	done
+ 
+ 	# When installing static libraries into /usr/lib and shared libraries into
+ 	# /lib, we have to make sure we have a linker script in /usr/lib along side
+ 	# the static library, or gcc will utilize the static lib when linking :(.
+ 	# http://bugs.gentoo.org/4411
+ 	local abort="no"
+ 	local a s
+ 	for a in "${ED}"usr/lib*/*.a ; do
 -		s=${a%.a}.so
++		# PREFIX LOCAL: support MachO objects
++		[[ ${CHOST} == *-darwin* ]] \
++			&& s=${a%.a}.dylib \
++			|| s=${a%.a}.so
++		# END PREFIX LOCAL
+ 		if [[ ! -e ${s} ]] ; then
+ 			s=${s%usr/*}${s##*/usr/}
+ 			if [[ -e ${s} ]] ; then
+ 				__vecho -ne '\n'
+ 				eqawarn "QA Notice: Missing gen_usr_ldscript for ${s##*/}"
+ 				abort="yes"
+ 			fi
+ 		fi
+ 	done
+ 	[[ ${abort} == "yes" ]] && die "add those ldscripts"
+ 
+ 	# Make sure people don't store libtool files or static libs in /lib
 -	f=$(ls "${ED}"lib*/*.{a,la} 2>/dev/null)
++	# PREFIX LOCAL: on AIX, "dynamic libs" have extension .a, so don't
++	# get false positives
++	[[ ${CHOST} == *-aix* ]] \
++		&& f=$(ls "${ED}"lib*/*.la 2>/dev/null || true) \
++		|| f=$(ls "${ED}"lib*/*.{a,la} 2>/dev/null)
++	# END PREFIX LOCAL
+ 	if [[ -n ${f} ]] ; then
+ 		__vecho -ne '\n'
+ 		eqawarn "QA Notice: Excessive files found in the / partition"
+ 		eqawarn "${f}"
+ 		__vecho -ne '\n'
+ 		die "static archives (*.a) and libtool library files (*.la) belong in /usr/lib*, not /lib*"
+ 	fi
+ 
+ 	# Verify that the libtool files don't contain bogus $D entries.
+ 	local abort=no gentoo_bug=no always_overflow=no
+ 	for a in "${ED}"usr/lib*/*.la ; do
+ 		s=${a##*/}
+ 		if grep -qs "${ED}" "${a}" ; then
+ 			__vecho -ne '\n'
+ 			eqawarn "QA Notice: ${s} appears to contain PORTAGE_TMPDIR paths"
+ 			abort="yes"
+ 		fi
+ 	done
+ 	[[ ${abort} == "yes" ]] && die "soiled libtool library files found"
+ }
+ 
+ lib_check
+ : # guarantee successful exit
+ 
+ # vim:ft=sh
diff --cc bin/install-qa-check.d/80multilib-strict
index 0000000,f944be9..436932e
mode 000000,100644..100644
--- a/bin/install-qa-check.d/80multilib-strict
+++ b/bin/install-qa-check.d/80multilib-strict
@@@ -1,0 -1,50 +1,50 @@@
+ # Strict multilib directory checks
+ multilib_strict_check() {
+ 	if has multilib-strict ${FEATURES} && \
 -	   [[ -x /usr/bin/file && -x /usr/bin/find ]] && \
++	   [[ -x ${EPREFIX}/usr/bin/file && -x ${EPREFIX}/usr/bin/find ]] && \
+ 	   [[ -n ${MULTILIB_STRICT_DIRS} && -n ${MULTILIB_STRICT_DENY} ]]
+ 	then
+ 		rm -f "${T}/multilib-strict.log"
+ 		local abort=no dir file
+ 		MULTILIB_STRICT_EXEMPT=$(echo ${MULTILIB_STRICT_EXEMPT} | sed -e 's:\([(|)]\):\\\1:g')
+ 		for dir in ${MULTILIB_STRICT_DIRS} ; do
+ 			[[ -d ${ED}/${dir} ]] || continue
+ 			for file in $(find ${ED}/${dir} -type f | grep -v "^${ED}/${dir}/${MULTILIB_STRICT_EXEMPT}"); do
+ 				if file ${file} | egrep -q "${MULTILIB_STRICT_DENY}" ; then
+ 					echo "${file#${ED}//}" >> "${T}/multilib-strict.log"
+ 				fi
+ 			done
+ 		done
+ 
+ 		if [[ -s ${T}/multilib-strict.log ]] ; then
+ 			if [[ ${#QA_MULTILIB_PATHS[@]} -eq 1 ]] ; then
+ 				local shopts=$-
+ 				set -o noglob
+ 				QA_MULTILIB_PATHS=(${QA_MULTILIB_PATHS})
+ 				set +o noglob
+ 				set -${shopts}
+ 			fi
+ 			if [ "${QA_STRICT_MULTILIB_PATHS-unset}" = unset ] ; then
+ 				local x
+ 				for x in "${QA_MULTILIB_PATHS[@]}" ; do
+ 					sed -e "s#^${x#/}\$##" -i "${T}/multilib-strict.log"
+ 				done
+ 				sed -e "/^\$/d" -i "${T}/multilib-strict.log"
+ 			fi
+ 			if [[ -s ${T}/multilib-strict.log ]] ; then
+ 				abort=yes
+ 				echo "Files matching a file type that is not allowed:"
+ 				while read -r ; do
+ 					echo "   ${REPLY}"
+ 				done < "${T}/multilib-strict.log"
+ 			fi
+ 		fi
+ 
+ 		[[ ${abort} == yes ]] && die "multilib-strict check failed!"
+ 	fi
+ }
+ 
+ multilib_strict_check
+ : # guarantee successful exit
+ 
+ # vim:ft=sh
diff --cc bin/install-qa-check.d/90world-writable
index 0000000,771027e..635612d
mode 000000,100644..100644
--- a/bin/install-qa-check.d/90world-writable
+++ b/bin/install-qa-check.d/90world-writable
@@@ -1,0 -1,25 +1,27 @@@
+ # Check for world-writable files
+ 
+ world_writable_check() {
+ 	# Now we look for all world writable files.
 -	local unsafe_files=$(find "${ED}" -type f -perm -2 | sed -e "s:^${ED}:- :")
++	# PREFIX LOCAL: keep offset prefix in the reported files
++	local unsafe_files=$(find "${ED}" -type f -perm -2 | sed -e "s:^${D}:- :")
++	# END PREFIX LOCAL
+ 	if [[ -n ${unsafe_files} ]] ; then
+ 		__vecho "QA Security Notice: world writable file(s):"
+ 		__vecho "${unsafe_files}"
+ 		__vecho "- This may or may not be a security problem, most of the time it is one."
+ 		__vecho "- Please double check that $PF really needs a world writeable bit and file bugs accordingly."
+ 		sleep 1
+ 	fi
+ 
 -	local unsafe_files=$(find "${ED}" -type f '(' -perm -2002 -o -perm -4002 ')' | sed -e "s:^${ED}:/:")
++	local unsafe_files=$(find "${ED}" -type f '(' -perm -2002 -o -perm -4002 ')' | sed -e "s:^${D}:/:")
+ 	if [[ -n ${unsafe_files} ]] ; then
+ 		eqawarn "QA Notice: Unsafe files detected (set*id and world writable)"
+ 		eqawarn "${unsafe_files}"
+ 		die "Unsafe files found in \${D}.  Portage will not install them."
+ 	fi
+ }
+ 
+ world_writable_check
+ : # guarantee successful exit
+ 
+ # vim:ft=sh
diff --cc bin/misc-functions.sh
index d92103f,cc652a9..1904c25
mode 100644,100755..100644
--- a/bin/misc-functions.sh
+++ b/bin/misc-functions.sh
@@@ -1,5 -1,5 +1,5 @@@
 -#!/bin/bash
 +#!@PORTAGE_BASH@
- # Copyright 1999-2013 Gentoo Foundation
+ # Copyright 1999-2014 Gentoo Foundation
  # Distributed under the terms of the GNU General Public License v2
  #
  # Miscellaneous shell functions that make use of the ebuild env but don't need
@@@ -172,67 -168,34 +172,36 @@@ install_qa_check() 
  		local EPREFIX= ED=${D}
  	fi
  
 -	cd "${ED}" || die "cd failed"
 +	# PREFIX LOCAL: ED needs not to exist, whereas D does
 +	cd "${D}" || die "cd failed"
 +	# END PREFIX LOCAL
  
- 	qa_var="QA_FLAGS_IGNORED_${ARCH/-/_}"
- 	eval "[[ -n \${!qa_var} ]] && QA_FLAGS_IGNORED=(\"\${${qa_var}[@]}\")"
- 	if [[ ${#QA_FLAGS_IGNORED[@]} -eq 1 ]] ; then
- 		local shopts=$-
- 		set -o noglob
- 		QA_FLAGS_IGNORED=(${QA_FLAGS_IGNORED})
- 		set +o noglob
- 		set -${shopts}
- 	fi
+ 	# Run QA checks from install-qa-check.d.
+ 	# Note: checks need to be run *before* stripping.
+ 	local f
+ 	# TODO: handle nullglob-like
+ 	for f in "${PORTAGE_BIN_PATH}"/install-qa-check.d/*; do
+ 		# Run in a subshell to treat it like external script,
+ 		# but use 'source' to pass all variables through.
+ 		(
+ 			source "${f}" || eerror "Post-install QA check ${f##*/} failed to run"
+ 		)
+ 	done
  
- 	# Check for files built without respecting *FLAGS. Note that
- 	# -frecord-gcc-switches must be in all *FLAGS variables, in
- 	# order to avoid false positive results here.
- 	# NOTE: This check must execute before prepall/prepstrip, since
- 	# prepstrip strips the .GCC.command.line sections.
- 	if type -P scanelf > /dev/null && ! has binchecks ${RESTRICT} && \
- 		[[ "${CFLAGS}" == *-frecord-gcc-switches* ]] && \
- 		[[ "${CXXFLAGS}" == *-frecord-gcc-switches* ]] && \
- 		[[ "${FFLAGS}" == *-frecord-gcc-switches* ]] && \
- 		[[ "${FCFLAGS}" == *-frecord-gcc-switches* ]] ; then
- 		rm -f "${T}"/scanelf-ignored-CFLAGS.log
- 		for x in $(scanelf -qyRF '#k%p' -k '!.GCC.command.line' "${ED}") ; do
- 			# Separate out file types that are known to support
- 			# .GCC.command.line sections, using the `file` command
- 			# similar to how prepstrip uses it.
- 			f=$(file "${x}") || continue
- 			[[ -z ${f} ]] && continue
- 			if [[ ${f} == *"SB executable"* ||
- 				${f} == *"SB shared object"* ]] ; then
- 				echo "${x}" >> "${T}"/scanelf-ignored-CFLAGS.log
+ 	# Run QA checks from repositories
+ 	# (yes, PORTAGE_ECLASS_LOCATIONS contains repo paths...)
+ 	local repo_location
+ 	for repo_location in "${PORTAGE_ECLASS_LOCATIONS[@]}"; do
+ 		for f in "${repo_location}"/metadata/install-qa-check.d/*; do
+ 			if [[ -f ${f} ]]; then
+ 				(
+ 					# allow inheriting eclasses
+ 					_IN_INSTALL_QA_CHECK=1
+ 					source "${f}" || eerror "Post-install QA check ${f##*/} failed to run"
+ 				)
  			fi
  		done
- 
- 		if [[ -f "${T}"/scanelf-ignored-CFLAGS.log ]] ; then
- 
- 			if [ "${QA_STRICT_FLAGS_IGNORED-unset}" = unset ] ; then
- 				for x in "${QA_FLAGS_IGNORED[@]}" ; do
- 					sed -e "s#^${x#/}\$##" -i "${T}"/scanelf-ignored-CFLAGS.log
- 				done
- 			fi
- 			# Filter anything under /usr/lib/debug/ in order to avoid
- 			# duplicate warnings for splitdebug files.
- 			sed -e "s#^usr/lib/debug/.*##" -e "/^\$/d" -e "s#^#/#" \
- 				-i "${T}"/scanelf-ignored-CFLAGS.log
- 			f=$(<"${T}"/scanelf-ignored-CFLAGS.log)
- 			if [[ -n ${f} ]] ; then
- 				__vecho -ne '\n'
- 				eqawarn "${BAD}QA Notice: Files built without respecting CFLAGS have been detected${NORMAL}"
- 				eqawarn " Please include the following list of files in your report:"
- 				eqawarn "${f}"
- 				__vecho -ne '\n'
- 				sleep 1
- 			else
- 				rm -f "${T}"/scanelf-ignored-CFLAGS.log
- 			fi
- 		fi
- 	fi
+ 	done
  
  	export STRIP_MASK
  	prepall
@@@ -240,327 -203,6 +209,39 @@@
  	ecompressdir --dequeue
  	ecompress --dequeue
  
- 	# Prefix specific checks
- 	[[ ${ED} != ${D} ]] && install_qa_check_prefix
- 
- 	f=
- 	for x in etc/app-defaults usr/man usr/info usr/X11R6 usr/doc usr/locale ; do
- 		[[ -d ${ED}/$x ]] && f+="  $x\n"
- 	done
- 	if [[ -n $f ]] ; then
- 		eqawarn "QA Notice: This ebuild installs into the following deprecated directories:"
- 		eqawarn
- 		eqawarn "$f"
- 	fi
- 
- 	# It's ok create these directories, but not to install into them. #493154
- 	# TODO: We should add var/lib to this list.
- 	f=
- 	for x in var/cache var/lock var/run run ; do
- 		if [[ ! -L ${ED}/${x} && -d ${ED}/${x} ]] ; then
- 			if [[ -z $(find "${ED}/${x}" -prune -empty) ]] ; then
- 				f+=$(cd "${ED}"; find "${x}" -printf '  %p\n')
- 			fi
- 		fi
- 	done
- 	if [[ -n ${f} ]] ; then
- 		eqawarn "QA Notice: This ebuild installs into paths that should be created at runtime."
- 		eqawarn " To fix, simply do not install into these directories.  Instead, your package"
- 		eqawarn " should create dirs on the fly at runtime as needed via init scripts/etc..."
- 		eqawarn
- 		eqawarn "${f}"
- 	fi
- 
- 	set +f
- 	f=
- 	for x in "${ED}etc/udev/rules.d/"* "${ED}lib"*"/udev/rules.d/"* ; do
- 		[[ -e ${x} ]] || continue
- 		[[ ${x} == ${ED}lib/udev/rules.d/* ]] && continue
- 		f+="  ${x#${ED}}\n"
- 	done
- 	if [[ -n $f ]] ; then
- 		eqawarn "QA Notice: udev rules should be installed in /lib/udev/rules.d:"
- 		eqawarn
- 		eqawarn "$f"
- 	fi
- 
- 	# Now we look for all world writable files.
- 	# PREFIX LOCAL: keep offset in the paths
- 	local unsafe_files=$(find "${ED}" -type f -perm -2 | sed -e "s:^${D}:- :")
- 	# END PREFIX LOCAL
- 	if [[ -n ${unsafe_files} ]] ; then
- 		__vecho "QA Security Notice: world writable file(s):"
- 		__vecho "${unsafe_files}"
- 		__vecho "- This may or may not be a security problem, most of the time it is one."
- 		__vecho "- Please double check that $PF really needs a world writeable bit and file bugs accordingly."
- 		sleep 1
- 	fi
- 
 +	# PREFIX LOCAL:
 +	# anything outside the prefix should be caught by the Prefix QA
 +	# check, so if there's nothing in ED, we skip searching for QA
 +	# checks there, the specific QA funcs can hence rely on ED existing
 +	if [[ -d ${ED} ]] ; then
 +		case ${CHOST} in
 +			*-darwin*)
 +				# Mach-O platforms (NeXT, Darwin, OSX)
 +				install_qa_check_macho
 +			;;
 +			*-interix*|*-winnt*)
 +				# PECOFF platforms (Windows/Interix)
 +				install_qa_check_pecoff
 +			;;
 +			*-aix*)
 +				# XCOFF platforms (AIX)
 +				install_qa_check_xcoff
 +			;;
 +			*)
 +				# because this is the majority: ELF platforms (Linux,
 +				# Solaris, *BSD, IRIX, etc.)
 +				install_qa_check_elf
 +			;;
 +		esac
 +	fi
 +
 +	# this is basically here such that the diff with trunk remains just
 +	# offsetted and not out of order
 +	install_qa_check_misc
 +	# END PREFIX LOCAL
 +}
 +
 +install_qa_check_elf() {
- 	if type -P scanelf > /dev/null && ! has binchecks ${RESTRICT}; then
- 		local insecure_rpath=0 tmp_quiet=${PORTAGE_QUIET}
- 		local x
- 
- 		# display warnings when using stricter because we die afterwards
- 		if has stricter ${FEATURES} ; then
- 			unset PORTAGE_QUIET
- 		fi
- 
- 		# Make sure we disallow insecure RUNPATH/RPATHs.
- 		#   1) References to PORTAGE_BUILDDIR are banned because it's a
- 		#      security risk. We don't want to load files from a
- 		#      temporary directory.
- 		#   2) If ROOT != "/", references to ROOT are banned because
- 		#      that directory won't exist on the target system.
- 		#   3) Null paths are banned because the loader will search $PWD when
- 		#      it finds null paths.
- 		local forbidden_dirs="${PORTAGE_BUILDDIR}"
- 		if [[ -n "${ROOT}" && "${ROOT}" != "/" ]]; then
- 			forbidden_dirs+=" ${ROOT}"
- 		fi
- 		local dir l rpath_files=$(scanelf -F '%F:%r' -qBR "${ED}")
- 		f=""
- 		for dir in ${forbidden_dirs}; do
- 			for l in $(echo "${rpath_files}" | grep -E ":${dir}|::|: "); do
- 				f+="  ${l%%:*}\n"
- 				if ! has stricter ${FEATURES}; then
- 					__vecho "Auto fixing rpaths for ${l%%:*}"
- 					TMPDIR="${dir}" scanelf -BXr "${l%%:*}" -o /dev/null
- 				fi
- 			done
- 		done
- 
- 		# Reject set*id binaries with $ORIGIN in RPATH #260331
- 		x=$(
- 			find "${ED}" -type f \( -perm -u+s -o -perm -g+s \) -print0 | \
- 			xargs -0 scanelf -qyRF '%r %p' | grep '$ORIGIN'
- 		)
- 
- 		# Print QA notice.
- 		if [[ -n ${f}${x} ]] ; then
- 			__vecho -ne '\n'
- 			eqawarn "QA Notice: The following files contain insecure RUNPATHs"
- 			eqawarn " Please file a bug about this at http://bugs.gentoo.org/"
- 			eqawarn " with the maintaining herd of the package."
- 			eqawarn "${f}${f:+${x:+\n}}${x}"
- 			__vecho -ne '\n'
- 			if [[ -n ${x} ]] || has stricter ${FEATURES} ; then
- 				insecure_rpath=1
- 			fi
- 		fi
- 
- 		# TEXTRELs are baaaaaaaad
- 		# Allow devs to mark things as ignorable ... e.g. things that are
- 		# binary-only and upstream isn't cooperating (nvidia-glx) ... we
- 		# allow ebuild authors to set QA_TEXTRELS_arch and QA_TEXTRELS ...
- 		# the former overrides the latter ... regexes allowed ! :)
- 		qa_var="QA_TEXTRELS_${ARCH/-/_}"
- 		[[ -n ${!qa_var} ]] && QA_TEXTRELS=${!qa_var}
- 		[[ -n ${QA_STRICT_TEXTRELS} ]] && QA_TEXTRELS=""
- 		export QA_TEXTRELS="${QA_TEXTRELS} lib*/modules/*.ko"
- 		f=$(scanelf -qyRF '%t %p' "${ED}" | grep -v 'usr/lib/debug/')
- 		if [[ -n ${f} ]] ; then
- 			scanelf -qyRAF '%T %p' "${PORTAGE_BUILDDIR}"/ &> "${T}"/scanelf-textrel.log
- 			__vecho -ne '\n'
- 			eqawarn "QA Notice: The following files contain runtime text relocations"
- 			eqawarn " Text relocations force the dynamic linker to perform extra"
- 			eqawarn " work at startup, waste system resources, and may pose a security"
- 			eqawarn " risk.  On some architectures, the code may not even function"
- 			eqawarn " properly, if at all."
- 			eqawarn " For more information, see http://hardened.gentoo.org/pic-fix-guide.xml"
- 			eqawarn " Please include the following list of files in your report:"
- 			eqawarn "${f}"
- 			__vecho -ne '\n'
- 			die_msg="${die_msg} textrels,"
- 			sleep 1
- 		fi
- 
- 		# Also, executable stacks only matter on linux (and just glibc atm ...)
- 		f=""
- 		case ${CTARGET:-${CHOST}} in
- 			*-linux-gnu*)
- 			# Check for files with executable stacks, but only on arches which
- 			# are supported at the moment.  Keep this list in sync with
- 			# http://www.gentoo.org/proj/en/hardened/gnu-stack.xml (Arch Status)
- 			case ${CTARGET:-${CHOST}} in
- 				arm*|i?86*|ia64*|m68k*|s390*|sh*|x86_64*)
- 					# Allow devs to mark things as ignorable ... e.g. things
- 					# that are binary-only and upstream isn't cooperating ...
- 					# we allow ebuild authors to set QA_EXECSTACK_arch and
- 					# QA_EXECSTACK ... the former overrides the latter ...
- 					# regexes allowed ! :)
- 
- 					qa_var="QA_EXECSTACK_${ARCH/-/_}"
- 					[[ -n ${!qa_var} ]] && QA_EXECSTACK=${!qa_var}
- 					[[ -n ${QA_STRICT_EXECSTACK} ]] && QA_EXECSTACK=""
- 					qa_var="QA_WX_LOAD_${ARCH/-/_}"
- 					[[ -n ${!qa_var} ]] && QA_WX_LOAD=${!qa_var}
- 					[[ -n ${QA_STRICT_WX_LOAD} ]] && QA_WX_LOAD=""
- 					export QA_EXECSTACK="${QA_EXECSTACK} lib*/modules/*.ko"
- 					export QA_WX_LOAD="${QA_WX_LOAD} lib*/modules/*.ko"
- 					f=$(scanelf -qyRAF '%e %p' "${ED}" | grep -v 'usr/lib/debug/')
- 					;;
- 			esac
- 			;;
- 		esac
- 		if [[ -n ${f} ]] ; then
- 			# One more pass to help devs track down the source
- 			scanelf -qyRAF '%e %p' "${PORTAGE_BUILDDIR}"/ &> "${T}"/scanelf-execstack.log
- 			__vecho -ne '\n'
- 			eqawarn "QA Notice: The following files contain writable and executable sections"
- 			eqawarn " Files with such sections will not work properly (or at all!) on some"
- 			eqawarn " architectures/operating systems.  A bug should be filed at"
- 			eqawarn " http://bugs.gentoo.org/ to make sure the issue is fixed."
- 			eqawarn " For more information, see http://hardened.gentoo.org/gnu-stack.xml"
- 			eqawarn " Please include the following list of files in your report:"
- 			eqawarn " Note: Bugs should be filed for the respective maintainers"
- 			eqawarn " of the package in question and not hardened@g.o."
- 			eqawarn "${f}"
- 			__vecho -ne '\n'
- 			die_msg="${die_msg} execstacks"
- 			sleep 1
- 		fi
- 
- 		# Check for files built without respecting LDFLAGS
- 		if [[ "${LDFLAGS}" == *,--hash-style=gnu* ]] && \
- 			! has binchecks ${RESTRICT} ; then
- 			f=$(scanelf -qyRF '#k%p' -k .hash "${ED}")
- 			if [[ -n ${f} ]] ; then
- 				echo "${f}" > "${T}"/scanelf-ignored-LDFLAGS.log
- 				if [ "${QA_STRICT_FLAGS_IGNORED-unset}" = unset ] ; then
- 					for x in "${QA_FLAGS_IGNORED[@]}" ; do
- 						sed -e "s#^${x#/}\$##" -i "${T}"/scanelf-ignored-LDFLAGS.log
- 					done
- 				fi
- 				# Filter anything under /usr/lib/debug/ in order to avoid
- 				# duplicate warnings for splitdebug files.
- 				sed -e "s#^usr/lib/debug/.*##" -e "/^\$/d" -e "s#^#/#" \
- 					-i "${T}"/scanelf-ignored-LDFLAGS.log
- 				f=$(<"${T}"/scanelf-ignored-LDFLAGS.log)
- 				if [[ -n ${f} ]] ; then
- 					__vecho -ne '\n'
- 					eqawarn "${BAD}QA Notice: Files built without respecting LDFLAGS have been detected${NORMAL}"
- 					eqawarn " Please include the following list of files in your report:"
- 					eqawarn "${f}"
- 					__vecho -ne '\n'
- 					sleep 1
- 				else
- 					rm -f "${T}"/scanelf-ignored-LDFLAGS.log
- 				fi
- 			fi
- 		fi
- 
- 		if [[ ${insecure_rpath} -eq 1 ]] ; then
- 			die "Aborting due to serious QA concerns with RUNPATH/RPATH"
- 		elif [[ -n ${die_msg} ]] && has stricter ${FEATURES} ; then
- 			die "Aborting due to QA concerns: ${die_msg}"
- 		fi
- 
- 		# Check for shared libraries lacking SONAMEs
- 		qa_var="QA_SONAME_${ARCH/-/_}"
- 		eval "[[ -n \${!qa_var} ]] && QA_SONAME=(\"\${${qa_var}[@]}\")"
- 		f=$(scanelf -ByF '%S %p' "${ED}"{,usr/}lib*/lib*.so* | awk '$2 == "" { print }' | sed -e "s:^[[:space:]]${ED}:/:")
- 		if [[ -n ${f} ]] ; then
- 			echo "${f}" > "${T}"/scanelf-missing-SONAME.log
- 			if [[ "${QA_STRICT_SONAME-unset}" == unset ]] ; then
- 				if [[ ${#QA_SONAME[@]} -gt 1 ]] ; then
- 					for x in "${QA_SONAME[@]}" ; do
- 						sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-SONAME.log
- 					done
- 				else
- 					local shopts=$-
- 					set -o noglob
- 					for x in ${QA_SONAME} ; do
- 						sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-SONAME.log
- 					done
- 					set +o noglob
- 					set -${shopts}
- 				fi
- 			fi
- 			sed -e "/^\$/d" -i "${T}"/scanelf-missing-SONAME.log
- 			f=$(<"${T}"/scanelf-missing-SONAME.log)
- 			if [[ -n ${f} ]] ; then
- 				__vecho -ne '\n'
- 				eqawarn "QA Notice: The following shared libraries lack a SONAME"
- 				eqawarn "${f}"
- 				__vecho -ne '\n'
- 				sleep 1
- 			else
- 				rm -f "${T}"/scanelf-missing-SONAME.log
- 			fi
- 		fi
- 
- 		# Check for shared libraries lacking NEEDED entries
- 		qa_var="QA_DT_NEEDED_${ARCH/-/_}"
- 		eval "[[ -n \${!qa_var} ]] && QA_DT_NEEDED=(\"\${${qa_var}[@]}\")"
- 		# PREFIX LOCAL: keep offset prefix in the recorded files
- 		f=$(scanelf -ByF '%n %p' "${ED}"{,usr/}lib*/lib*.so* | awk '$2 == "" { print }' | sed -e "s:^[[:space:]]${D}:/:")
- 		# END PREFIX LOCAL
- 		if [[ -n ${f} ]] ; then
- 			echo "${f}" > "${T}"/scanelf-missing-NEEDED.log
- 			if [[ "${QA_STRICT_DT_NEEDED-unset}" == unset ]] ; then
- 				if [[ ${#QA_DT_NEEDED[@]} -gt 1 ]] ; then
- 					for x in "${QA_DT_NEEDED[@]}" ; do
- 						sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-NEEDED.log
- 					done
- 				else
- 					local shopts=$-
- 					set -o noglob
- 					for x in ${QA_DT_NEEDED} ; do
- 						sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-NEEDED.log
- 					done
- 					set +o noglob
- 					set -${shopts}
- 				fi
- 			fi
- 			sed -e "/^\$/d" -i "${T}"/scanelf-missing-NEEDED.log
- 			f=$(<"${T}"/scanelf-missing-NEEDED.log)
- 			if [[ -n ${f} ]] ; then
- 				__vecho -ne '\n'
- 				eqawarn "QA Notice: The following shared libraries lack NEEDED entries"
- 				eqawarn "${f}"
- 				__vecho -ne '\n'
- 				sleep 1
- 			else
- 				rm -f "${T}"/scanelf-missing-NEEDED.log
- 			fi
- 		fi
- 
- 		PORTAGE_QUIET=${tmp_quiet}
- 	fi
- 
  	# Create NEEDED.ELF.2 regardless of RESTRICT=binchecks, since this info is
  	# too useful not to have (it's required for things like preserve-libs), and
  	# it's tempting for ebuild authors to set RESTRICT=binchecks for packages
@@@ -588,829 -230,11 +269,396 @@@
  			eqawarn "$(while read -r x; do x=${x#*;} ; x=${x%%;*} ; echo "${x#${EPREFIX}}" ; done < "${PORTAGE_BUILDDIR}"/build-info/NEEDED.ELF.2)"
  		fi
  	fi
 +}
  
 +install_qa_check_misc() {
- 	# PREFIX LOCAL: keep offset prefix in the reported files
- 	local unsafe_files=$(find "${ED}" -type f '(' -perm -2002 -o -perm -4002 ')' | sed -e "s:^${D}:/:")
- 	# END PREFIX LOCAL
- 	if [[ -n ${unsafe_files} ]] ; then
- 		eqawarn "QA Notice: Unsafe files detected (set*id and world writable)"
- 		eqawarn "${unsafe_files}"
- 		die "Unsafe files found in \${D}.  Portage will not install them."
- 	fi
- 
- 	if [[ -d ${D%/}${D} ]] ; then
- 		local -i INSTALLTOD=0
- 		while read -r -d $'\0' i ; do
- 			eqawarn "QA Notice: /${i##${D%/}${D}} installed in \${D}/\${D}"
- 			((INSTALLTOD++))
- 		done < <(find "${D%/}${D}" -print0)
- 		die "Aborting due to QA concerns: ${INSTALLTOD} files installed in ${D%/}${D}"
- 	fi
- 
- 	# Sanity check syntax errors in init.d scripts
- 	local d
- 	for d in /etc/conf.d /etc/init.d ; do
- 		[[ -d ${ED}/${d} ]] || continue
- 		for i in "${ED}"/${d}/* ; do
- 			[[ -L ${i} ]] && continue
- 			# if empty conf.d/init.d dir exists (baselayout), then i will be "/etc/conf.d/*" and not exist
- 			[[ ! -e ${i} ]] && continue
- 			if [[ ${d} == /etc/init.d && ${i} != *.sh ]] ; then
- 				# skip non-shell-script for bug #451386
- 				[[ $(head -n1 "${i}") =~ ^#!.*[[:space:]/](runscript|sh)$ ]] || continue
- 			fi
- 			bash -n "${i}" || die "The init.d file has syntax errors: ${i}"
- 		done
- 	done
- 
- 	local checkbashisms=$(type -P checkbashisms)
- 	if [[ -n ${checkbashisms} ]] ; then
- 		for d in /etc/init.d ; do
- 			[[ -d ${ED}${d} ]] || continue
- 			for i in "${ED}${d}"/* ; do
- 				[[ -e ${i} ]] || continue
- 				[[ -L ${i} ]] && continue
- 				f=$("${checkbashisms}" -f "${i}" 2>&1)
- 				[[ $? != 0 && -n ${f} ]] || continue
- 				eqawarn "QA Notice: shell script appears to use non-POSIX feature(s):"
- 				while read -r ;
- 					do eqawarn "   ${REPLY}"
- 				done <<< "${f//${ED}}"
- 			done
- 		done
- 	fi
- 
- 	# Look for leaking LDFLAGS into pkg-config files
- 	f=$(egrep -sH '^Libs.*-Wl,(-O[012]|--hash-style)' "${ED}"/usr/*/pkgconfig/*.pc)
- 	if [[ -n ${f} ]] ; then
- 		eqawarn "QA Notice: pkg-config files with wrong LDFLAGS detected:"
- 		eqawarn "${f//${D}}"
- 	fi
- 
- 	# this should help to ensure that all (most?) shared libraries are executable
- 	# and that all libtool scripts / static libraries are not executable
- 	local j
- 	for i in "${ED}"opt/*/lib* \
- 	         "${ED}"lib* \
- 	         "${ED}"usr/lib* ; do
- 		[[ ! -d ${i} ]] && continue
- 
- 		for j in "${i}"/*.so.* "${i}"/*.so "${i}"/*.dylib "${i}"/*.dll ; do
- 			[[ ! -e ${j} ]] && continue
- 			[[ -L ${j} ]] && continue
- 			[[ -x ${j} ]] && continue
- 			__vecho "making executable: ${j#${ED}}"
- 			chmod +x "${j}"
- 		done
- 
- 		for j in "${i}"/*.a "${i}"/*.la ; do
- 			[[ ! -e ${j} ]] && continue
- 			[[ -L ${j} ]] && continue
- 			[[ ! -x ${j} ]] && continue
- 			__vecho "removing executable bit: ${j#${ED}}"
- 			chmod -x "${j}"
- 		done
- 
- 		for j in "${i}"/*.{a,dll,dylib,sl,so}.* "${i}"/*.{a,dll,dylib,sl,so} ; do
- 			[[ ! -e ${j} ]] && continue
- 			[[ ! -L ${j} ]] && continue
- 			linkdest=$(readlink "${j}")
- 			if [[ ${linkdest} == /* ]] ; then
- 				__vecho -ne '\n'
- 				eqawarn "QA Notice: Found an absolute symlink in a library directory:"
- 				eqawarn "           ${j#${D}} -> ${linkdest}"
- 				eqawarn "           It should be a relative symlink if in the same directory"
- 				eqawarn "           or a linker script if it crosses the /usr boundary."
- 			fi
- 		done
- 	done
- 
- 	# When installing static libraries into /usr/lib and shared libraries into
- 	# /lib, we have to make sure we have a linker script in /usr/lib along side
- 	# the static library, or gcc will utilize the static lib when linking :(.
- 	# http://bugs.gentoo.org/4411
- 	abort="no"
- 	local a s
- 	for a in "${ED}"usr/lib*/*.a ; do
- 		# PREFIX LOCAL: support MachO objects
- 		[[ ${CHOST} == *-darwin* ]] \
- 			&& s=${a%.a}.dylib \
- 			|| s=${a%.a}.so
- 		# END PREFIX LOCAL
- 		if [[ ! -e ${s} ]] ; then
- 			s=${s%usr/*}${s##*/usr/}
- 			if [[ -e ${s} ]] ; then
- 				__vecho -ne '\n'
- 				eqawarn "QA Notice: Missing gen_usr_ldscript for ${s##*/}"
- 	 			abort="yes"
- 			fi
- 		fi
- 	done
- 	[[ ${abort} == "yes" ]] && die "add those ldscripts"
- 
- 	# Make sure people don't store libtool files or static libs in /lib
- 	# PREFIX LOCAL: on AIX, "dynamic libs" have extension .a, so don't
- 	# get false positives
- 	[[ ${CHOST} == *-aix* ]] \
- 		&& f=$(ls "${ED}"lib*/*.la 2>/dev/null || true) \
- 		|| f=$(ls "${ED}"lib*/*.{a,la} 2>/dev/null)
- 	# END PREFIX LOCAL
- 	if [[ -n ${f} ]] ; then
- 		__vecho -ne '\n'
- 		eqawarn "QA Notice: Excessive files found in the / partition"
- 		eqawarn "${f}"
- 		__vecho -ne '\n'
- 		die "static archives (*.a) and libtool library files (*.la) belong in /usr/lib*, not /lib*"
- 	fi
- 
- 	# Verify that the libtool files don't contain bogus $D entries.
- 	local abort=no gentoo_bug=no always_overflow=no
- 	for a in "${ED}"usr/lib*/*.la ; do
- 		s=${a##*/}
- 		if grep -qs "${ED}" "${a}" ; then
- 			__vecho -ne '\n'
- 			eqawarn "QA Notice: ${s} appears to contain PORTAGE_TMPDIR paths"
- 			abort="yes"
- 		fi
- 	done
- 	[[ ${abort} == "yes" ]] && die "soiled libtool library files found"
- 
- 	# Evaluate misc gcc warnings
- 	if [[ -n ${PORTAGE_LOG_FILE} && -r ${PORTAGE_LOG_FILE} ]] ; then
- 		# In debug mode, this variable definition and corresponding grep calls
- 		# will produce false positives if they're shown in the trace.
- 		local reset_debug=0
- 		if [[ ${-/x/} != $- ]] ; then
- 			set +x
- 			reset_debug=1
- 		fi
- 		local m msgs=(
- 			": warning: dereferencing type-punned pointer will break strict-aliasing rules"
- 			": warning: dereferencing pointer .* does break strict-aliasing rules"
- 			": warning: implicit declaration of function"
- 			": warning: incompatible implicit declaration of built-in function"
- 			": warning: is used uninitialized in this function" # we'll ignore "may" and "might"
- 			": warning: comparisons like X<=Y<=Z do not have their mathematical meaning"
- 			": warning: null argument where non-null required"
- 			": warning: array subscript is below array bounds"
- 			": warning: array subscript is above array bounds"
- 			": warning: attempt to free a non-heap object"
- 			": warning: .* called with .*bigger.* than .* destination buffer"
- 			": warning: call to .* will always overflow destination buffer"
- 			": warning: assuming pointer wraparound does not occur when comparing"
- 			": warning: hex escape sequence out of range"
- 			": warning: [^ ]*-hand operand of comma .*has no effect"
- 			": warning: converting to non-pointer type .* from NULL"
- 			": warning: NULL used in arithmetic"
- 			": warning: passing NULL to non-pointer argument"
- 			": warning: the address of [^ ]* will always evaluate as"
- 			": warning: the address of [^ ]* will never be NULL"
- 			": warning: too few arguments for format"
- 			": warning: reference to local variable .* returned"
- 			": warning: returning reference to temporary"
- 			": warning: function returns address of local variable"
- 			": warning: .*\\[-Wsizeof-pointer-memaccess\\]"
- 			": warning: .*\\[-Waggressive-loop-optimizations\\]"
- 			# this may be valid code :/
- 			#": warning: multi-character character constant"
- 			# need to check these two ...
- 			#": warning: assuming signed overflow does not occur when"
- 			#": warning: comparison with string literal results in unspecified behav"
- 			# yacc/lex likes to trigger this one
- 			#": warning: extra tokens at end of .* directive"
- 			# only gcc itself triggers this ?
- 			#": warning: .*noreturn.* function does return"
- 			# these throw false positives when 0 is used instead of NULL
- 			#": warning: missing sentinel in function call"
- 			#": warning: not enough variable arguments to fit a sentinel"
- 		)
- 		abort="no"
- 		i=0
- 		local grep_cmd=grep
- 		[[ $PORTAGE_LOG_FILE = *.gz ]] && grep_cmd=zgrep
- 		while [[ -n ${msgs[${i}]} ]] ; do
- 			m=${msgs[$((i++))]}
- 			# force C locale to work around slow unicode locales #160234
- 			f=$(LC_ALL=C $grep_cmd "${m}" "${PORTAGE_LOG_FILE}")
- 			if [[ -n ${f} ]] ; then
- 				abort="yes"
- 				# for now, don't make this fatal (see bug #337031)
- 				#case "$m" in
- 				#	": warning: call to .* will always overflow destination buffer") always_overflow=yes ;;
- 				#esac
- 				if [[ $always_overflow = yes ]] ; then
- 					eerror
- 					eerror "QA Notice: Package triggers severe warnings which indicate that it"
- 					eerror "           may exhibit random runtime failures."
- 					eerror
- 					eerror "${f}"
- 					eerror
- 					eerror " Please file a bug about this at http://bugs.gentoo.org/"
- 					eerror " with the maintaining herd of the package."
- 					eerror
- 				else
- 					__vecho -ne '\n'
- 					eqawarn "QA Notice: Package triggers severe warnings which indicate that it"
- 					eqawarn "           may exhibit random runtime failures."
- 					eqawarn "${f}"
- 					__vecho -ne '\n'
- 				fi
- 			fi
- 		done
- 		local cat_cmd=cat
- 		[[ $PORTAGE_LOG_FILE = *.gz ]] && cat_cmd=zcat
- 		[[ $reset_debug = 1 ]] && set -x
- 		# Use safe cwd, avoiding unsafe import for bug #469338.
- 		f=$(cd "${PORTAGE_PYM_PATH}" ; $cat_cmd "${PORTAGE_LOG_FILE}" | \
- 			"${PORTAGE_PYTHON:-@PREFIX_PORTAGE_PYTHON@}" "$PORTAGE_BIN_PATH"/check-implicit-pointer-usage.py || die "check-implicit-pointer-usage.py failed")
- 		if [[ -n ${f} ]] ; then
- 
- 			# In the future this will be a forced "die". In preparation,
- 			# increase the log level from "qa" to "eerror" so that people
- 			# are aware this is a problem that must be fixed asap.
- 
- 			# just warn on 32bit hosts but bail on 64bit hosts
- 			case ${CHOST} in
- 				alpha*|hppa64*|ia64*|powerpc64*|mips64*|sparc64*|sparcv9*|x86_64*) gentoo_bug=yes ;;
- 			esac
- 
- 			abort=yes
- 
- 			if [[ $gentoo_bug = yes ]] ; then
- 				eerror
- 				eerror "QA Notice: Package triggers severe warnings which indicate that it"
- 				eerror "           will almost certainly crash on 64bit architectures."
- 				eerror
- 				eerror "${f}"
- 				eerror
- 				eerror " Please file a bug about this at http://bugs.gentoo.org/"
- 				eerror " with the maintaining herd of the package."
- 				eerror
- 			else
- 				__vecho -ne '\n'
- 				eqawarn "QA Notice: Package triggers severe warnings which indicate that it"
- 				eqawarn "           will almost certainly crash on 64bit architectures."
- 				eqawarn "${f}"
- 				__vecho -ne '\n'
- 			fi
- 
- 		fi
- 		if [[ ${abort} == "yes" ]] ; then
- 			if [[ $gentoo_bug = yes || $always_overflow = yes ]] ; then
- 				die "install aborted due to severe warnings shown above"
- 			else
- 				echo "Please do not file a Gentoo bug and instead" \
- 				"report the above QA issues directly to the upstream" \
- 				"developers of this software." | fmt -w 70 | \
- 				while read -r line ; do eqawarn "${line}" ; done
- 				eqawarn "Homepage: ${HOMEPAGE}"
- 				has stricter ${FEATURES} && \
- 					die "install aborted due to severe warnings shown above"
- 			fi
- 		fi
- 	fi
- 
  	# Portage regenerates this on the installed system.
  	rm -f "${ED}"/usr/share/info/dir{,.gz,.bz2} || die "rm failed!"
- 
- 	if has multilib-strict ${FEATURES} && \
- 	   [[ -x ${EPREFIX}/usr/bin/file && -x ${EPREFIX}/usr/bin/find ]] && \
- 	   [[ -n ${MULTILIB_STRICT_DIRS} && -n ${MULTILIB_STRICT_DENY} ]]
- 	then
- 		rm -f "${T}/multilib-strict.log"
- 		local abort=no dir file
- 		MULTILIB_STRICT_EXEMPT=$(echo ${MULTILIB_STRICT_EXEMPT} | sed -e 's:\([(|)]\):\\\1:g')
- 		for dir in ${MULTILIB_STRICT_DIRS} ; do
- 			[[ -d ${ED}/${dir} ]] || continue
- 			for file in $(find ${ED}/${dir} -type f | grep -v "^${ED}/${dir}/${MULTILIB_STRICT_EXEMPT}"); do
- 				if file ${file} | egrep -q "${MULTILIB_STRICT_DENY}" ; then
- 					echo "${file#${ED}//}" >> "${T}/multilib-strict.log"
- 				fi
- 			done
- 		done
- 
- 		if [[ -s ${T}/multilib-strict.log ]] ; then
- 			if [[ ${#QA_MULTILIB_PATHS[@]} -eq 1 ]] ; then
- 				local shopts=$-
- 				set -o noglob
- 				QA_MULTILIB_PATHS=(${QA_MULTILIB_PATHS})
- 				set +o noglob
- 				set -${shopts}
- 			fi
- 			if [ "${QA_STRICT_MULTILIB_PATHS-unset}" = unset ] ; then
- 				for x in "${QA_MULTILIB_PATHS[@]}" ; do
- 					sed -e "s#^${x#/}\$##" -i "${T}/multilib-strict.log"
- 				done
- 				sed -e "/^\$/d" -i "${T}/multilib-strict.log"
- 			fi
- 			if [[ -s ${T}/multilib-strict.log ]] ; then
- 				abort=yes
- 				echo "Files matching a file type that is not allowed:"
- 				while read -r ; do
- 					echo "   ${REPLY}"
- 				done < "${T}/multilib-strict.log"
- 			fi
- 		fi
- 
- 		[[ ${abort} == yes ]] && die "multilib-strict check failed!"
- 	fi
- }
- 
- install_qa_check_prefix() {
- 	if [[ -d ${ED%/}/${D} ]] ; then
- 		find "${ED%/}/${D}" | \
- 		while read i ; do
- 			eqawarn "QA Notice: /${i##${ED%/}/${D}} installed in \${ED}/\${D}"
- 		done
- 		die "Aborting due to QA concerns: files installed in ${ED}/${D}"
- 	fi
- 
- 	if [[ -d ${ED%/}/${EPREFIX} ]] ; then
- 		find "${ED%/}/${EPREFIX}/" | \
- 		while read i ; do
- 			eqawarn "QA Notice: ${i#${D}} double prefix"
- 		done
- 		die "Aborting due to QA concerns: double prefix files installed"
- 	fi
- 
- 	if [[ -d ${D} ]] ; then
- 		INSTALLTOD=$(find ${D%/} | egrep -v "^${ED}" | sed -e "s|^${D%/}||" | awk '{if (length($0) <= length("'"${EPREFIX}"'")) { if (substr("'"${EPREFIX}"'", 1, length($0)) != $0) {print $0;} } else if (substr($0, 1, length("'"${EPREFIX}"'")) != "'"${EPREFIX}"'") {print $0;} }')
- 		if [[ -n ${INSTALLTOD} ]] ; then
- 			eqawarn "QA Notice: the following files are outside of the prefix:"
- 			eqawarn "${INSTALLTOD}"
- 			die "Aborting due to QA concerns: there are files installed outside the prefix"
- 		fi
- 	fi
- 
- 	# all further checks rely on ${ED} existing
- 	[[ -d ${ED} ]] || return
- 
- 	# check shebangs, bug #282539
- 	rm -f "${T}"/non-prefix-shebangs-errs
- 	local WHITELIST=" /usr/bin/env "
- 	# this is hell expensive, but how else?
- 	find "${ED}" -executable \! -type d -print0 \
- 			| xargs -0 grep -H -n -m1 "^#!" \
- 			| while read f ;
- 	do
- 		local fn=${f%%:*}
- 		local pos=${f#*:} ; pos=${pos%:*}
- 		local line=${f##*:}
- 		# shebang always appears on the first line ;)
- 		[[ ${pos} != 1 ]] && continue
- 		local oldIFS=${IFS}
- 		IFS=$'\r'$'\n'$'\t'" "
- 		line=( ${line#"#!"} )
- 		IFS=${oldIFS}
- 		[[ ${WHITELIST} == *" ${line[0]} "* ]] && continue
- 		local fp=${fn#${D}} ; fp=/${fp%/*}
- 		# line[0] can be an absolutised path, bug #342929
- 		local eprefix=$(canonicalize ${EPREFIX})
- 		local rf=${fn}
- 		# in case we deal with a symlink, make sure we don't replace it
- 		# with a real file (sed -i does that)
- 		if [[ -L ${fn} ]] ; then
- 			rf=$(readlink ${fn})
- 			[[ ${rf} != /* ]] && rf=${fn%/*}/${rf}
- 			# ignore symlinks pointing to outside prefix
- 			# as seen in sys-devel/native-cctools
- 			[[ $(canonicalize "/${rf#${D}}") != ${eprefix}/* ]] && continue
- 		fi
- 		# does the shebang start with ${EPREFIX}, and does it exist?
- 		if [[ ${line[0]} == ${EPREFIX}/* || ${line[0]} == ${eprefix}/* ]] ; then
- 			if [[ ! -e ${ROOT%/}${line[0]} && ! -e ${D%/}${line[0]} ]] ; then
- 				# hmm, refers explicitly to $EPREFIX, but doesn't exist,
- 				# if it's in PATH that's wrong in any case
- 				if [[ ":${PATH}:" == *":${fp}:"* ]] ; then
- 					echo "${fn#${D}}:${line[0]} (explicit EPREFIX but target not found)" \
- 						>> "${T}"/non-prefix-shebangs-errs
- 				else
- 					eqawarn "${fn#${D}} has explicit EPREFIX in shebang but target not found (${line[0]})"
- 				fi
- 			fi
- 			continue
- 		fi
- 		# unprefixed shebang, is the script directly in $PATH or an init
- 		# script?
- 		if [[ ":${PATH}:${EPREFIX}/etc/init.d:" == *":${fp}:"* ]] ; then
- 			if [[ -e ${EROOT}${line[0]} || -e ${ED}${line[0]} ]] ; then
- 				# is it unprefixed, but we can just fix it because a
- 				# prefixed variant exists
- 				eqawarn "prefixing shebang of ${fn#${D}}"
- 				# statement is made idempotent on purpose, because
- 				# symlinks may point to the same target, and hence the
- 				# same real file may be sedded multiple times since we
- 				# read the shebangs in one go upfront for performance
- 				# reasons
- 				sed -i -e '1s:^#! \?'"${line[0]}"':#!'"${EPREFIX}"${line[0]}':' "${rf}"
- 				continue
- 			else
- 				# this is definitely wrong: script in $PATH and invalid shebang
- 				echo "${fn#${D}}:${line[0]} (script ${fn##*/} installed in PATH but interpreter ${line[0]} not found)" \
- 					>> "${T}"/non-prefix-shebangs-errs
- 			fi
- 		else
- 			# unprefixed/invalid shebang, but outside $PATH, this may be
- 			# intended (e.g. config.guess) so remain silent by default
- 			has stricter ${FEATURES} && \
- 				eqawarn "invalid shebang in ${fn#${D}}: ${line[0]}"
- 		fi
- 	done
- 	if [[ -e "${T}"/non-prefix-shebangs-errs ]] ; then
- 		eqawarn "QA Notice: the following files use invalid (possible non-prefixed) shebangs:"
- 		while read line ; do
- 			eqawarn "  ${line}"
- 		done < "${T}"/non-prefix-shebangs-errs
- 		rm -f "${T}"/non-prefix-shebangs-errs
- 		die "Aborting due to QA concerns: invalid shebangs found"
- 	fi
  }
  
 +install_qa_check_macho() {
 +	if ! has binchecks ${RESTRICT} ; then
 +		# on Darwin, dynamic libraries are called .dylibs instead of
 +		# .sos.  In addition the version component is before the
 +		# extension, not after it.  Check for this, and *only* warn
 +		# about it.  Some packages do ship .so files on Darwin and make
 +		# it work (ugly!).
 +		rm -f "${T}/mach-o.check"
 +		find ${ED%/} -name "*.so" -or -name "*.so.*" | \
 +		while read i ; do
 +			[[ $(file $i) == *"Mach-O"* ]] && \
 +				echo "${i#${D}}" >> "${T}/mach-o.check"
 +		done
 +		if [[ -f ${T}/mach-o.check ]] ; then
 +			f=$(< "${T}/mach-o.check")
 +			vecho -ne '\a\n'
 +			eqawarn "QA Notice: Found .so dynamic libraries on Darwin:"
 +			eqawarn "    ${f//$'\n'/\n    }"
 +		fi
 +		rm -f "${T}/mach-o.check"
 +
 +		# The naming for dynamic libraries is different on Darwin; the
 +		# version component is before the extention, instead of after
 +		# it, as with .sos.  Again, make this a warning only.
 +		rm -f "${T}/mach-o.check"
 +		find ${ED%/} -name "*.dylib.*" | \
 +		while read i ; do
 +			echo "${i#${D}}" >> "${T}/mach-o.check"
 +		done
 +		if [[ -f "${T}/mach-o.check" ]] ; then
 +			f=$(< "${T}/mach-o.check")
 +			vecho -ne '\a\n'
 +			eqawarn "QA Notice: Found wrongly named dynamic libraries on Darwin:"
 +			eqawarn "    ${f// /\n    }"
 +		fi
 +		rm -f "${T}/mach-o.check"
 +	fi
 +
 +	install_name_is_relative() {
 +		case $1 in
 +			"@executable_path/"*)  return 0  ;;
 +			"@loader_path"/*)      return 0  ;;
 +			"@rpath/"*)            return 0  ;;
 +			*)                     return 1  ;;
 +		esac
 +	}
 +
 +	# While we generate the NEEDED files, check that we don't get kernel
 +	# traps at runtime because of broken install_names on Darwin.
 +	rm -f "${T}"/.install_name_check_failed
 +	scanmacho -qyRF '%a;%p;%S;%n' "${D}" | { while IFS= read l ; do
 +		arch=${l%%;*}; l=${l#*;}
 +		obj="/${l%%;*}"; l=${l#*;}
 +		install_name=${l%%;*}; l=${l#*;}
 +		needed=${l%%;*}; l=${l#*;}
 +
 +		ignore=
 +		qa_var="QA_IGNORE_INSTALL_NAME_FILES_${ARCH/-/_}"
 +		eval "[[ -n \${!qa_var} ]] &&
 +			QA_IGNORE_INSTALL_NAME_FILES=(\"\${${qa_var}[@]}\")"
 +
 +		if [[ ${#QA_IGNORE_INSTALL_NAME_FILES[@]} -gt 1 ]] ; then
 +			for x in "${QA_IGNORE_INSTALL_NAME_FILES[@]}" ; do
 +				[[ ${obj##*/} == ${x} ]] && \
 +					ignore=true
 +			done
 +		else
 +			local shopts=$-
 +			set -o noglob
 +			for x in ${QA_IGNORE_INSTALL_NAME_FILES} ; do
 +				[[ ${obj##*/} == ${x} ]] && \
 +					ignore=true
 +			done
 +			set +o noglob
 +			set -${shopts}
 +		fi
 +
 +		# See if the self-reference install_name points to an existing
 +		# and to be installed file.  This usually is a symlink for the
 +		# major version.
 +		if install_name_is_relative ${install_name} ; then
 +			# try to locate the library in the installed image
 +			local inpath=${install_name#@*/}
 +			local libl
 +			for libl in $(find "${ED}" -name "${inpath##*/}") ; do
 +				if [[ ${libl} == */${inpath} ]] ; then
 +					install_name=/${libl#${D}}
 +					break
 +				fi
 +			done
 +		fi
 +		if [[ ! -e ${D}${install_name} ]] ; then
 +			eqawarn "QA Notice: invalid self-reference install_name ${install_name} in ${obj}"
 +			# remember we are in an implicit subshell, that's
 +			# why we touch a file here ... ideally we should be
 +			# able to die correctly/nicely here
 +			[[ -z ${ignore} && touch "${T}"/.install_name_check_failed
 +		fi
 +
 +		# this is ugly, paths with spaces won't work
 +		for lib in ${needed//,/ } ; do
 +			if [[ ${lib} == ${D}* ]] ; then
 +				eqawarn "QA Notice: install_name references \${D}: ${lib} in ${obj}"
 +				[[ -z ${ignore} && touch "${T}"/.install_name_check_failed
 +			elif [[ ${lib} == ${S}* ]] ; then
 +				eqawarn "QA Notice: install_name references \${S}: ${lib} in ${obj}"
 +				[[ -z ${ignore} && touch "${T}"/.install_name_check_failed
 +			elif ! install_name_is_relative ${lib} && [[ ! -e ${lib} && ! -e ${D}${lib} ]] ; then
 +				eqawarn "QA Notice: invalid reference to ${lib} in ${obj}"
 +				[[ -z ${ignore} && touch "${T}"/.install_name_check_failed
 +			fi
 +		done
 +
 +		# backwards compatibility
 +		echo "${obj} ${needed}" >> "${PORTAGE_BUILDDIR}"/build-info/NEEDED
 +		# what we use
 +		echo "${arch};${obj};${install_name};${needed}" >> "${PORTAGE_BUILDDIR}"/build-info/NEEDED.MACHO.3
 +	done }
 +	if [[ -f ${T}/.install_name_check_failed ]] ; then
 +		# secret switch "allow_broken_install_names" to get
 +		# around this and install broken crap (not a good idea)
 +		has allow_broken_install_names ${FEATURES} || \
 +			die "invalid install_name found, your application or library will crash at runtime"
 +	fi
 +}
 +
 +install_qa_check_pecoff() {
 +	local _pfx_scan="readpecoff ${CHOST}"
 +
 +	# this one uses readpecoff, which supports multiple prefix platforms!
 +	# this is absolutely _not_ optimized for speed, and there may be plenty
 +	# of possibilities by introducing one or the other cache!
 +	if ! has binchecks ${RESTRICT}; then
 +		# copied and adapted from the above scanelf code.
 +		local qa_var insecure_rpath=0 tmp_quiet=${PORTAGE_QUIET}
 +		local f x
 +
 +		# display warnings when using stricter because we die afterwards
 +		if has stricter ${FEATURES} ; then
 +			unset PORTAGE_QUIET
 +		fi
 +
 +		local _exec_find_opt="-executable"
 +		[[ ${CHOST} == *-winnt* ]] && _exec_find_opt='-name *.dll -o -name *.exe'
 +
 +		# Make sure we disallow insecure RUNPATH/RPATH's
 +		# Don't want paths that point to the tree where the package was built
 +		# (older, broken libtools would do this).  Also check for null paths
 +		# because the loader will search $PWD when it finds null paths.
 +
 +		f=$(
 +			find "${ED}" -type f '(' ${_exec_find_opt} ')' -print0 | xargs -0 ${_pfx_scan} | \
 +			while IFS=";" read arch obj soname rpath needed ; do \
 +			echo "${rpath}" | grep -E "(${PORTAGE_BUILDDIR}|: |::|^:|^ )" > /dev/null 2>&1 \
 +				&& echo "${obj}"; done;
 +		)
 +		# Reject set*id binaries with $ORIGIN in RPATH #260331
 +		x=$(
 +			find "${ED}" -type f '(' -perm -u+s -o -perm -g+s ')' -print0 | \
 +			xargs -0 ${_pfx_scan} | while IFS=";" read arch obj soname rpath needed; do \
 +			echo "${rpath}" | grep '$ORIGIN' > /dev/null 2>&1 && echo "${obj}"; done;
 +		)
 +		if [[ -n ${f}${x} ]] ; then
 +			vecho -ne '\a\n'
 +			eqawarn "QA Notice: The following files contain insecure RUNPATH's"
 +			eqawarn " Please file a bug about this at http://bugs.gentoo.org/"
 +			eqawarn " with the maintaining herd of the package."
 +			eqawarn "${f}${f:+${x:+\n}}${x}"
 +			vecho -ne '\a\n'
 +			if [[ -n ${x} ]] || has stricter ${FEATURES} ; then
 +				insecure_rpath=1
 +			else
 +				eqawarn "cannot automatically fix runpaths on interix platforms!"
 +			fi
 +		fi
 +
 +		rm -f "${PORTAGE_BUILDDIR}"/build-info/NEEDED
 +		rm -f "${PORTAGE_BUILDDIR}"/build-info/NEEDED.PECOFF.1
 +
 +		# Save NEEDED information after removing self-contained providers
 +		find "${ED}" -type f '(' ${_exec_find_opt} ')' -print0 | xargs -0 ${_pfx_scan} | { while IFS=';' read arch obj soname rpath needed; do
 +			# need to strip image dir from object name.
 +			obj="/${obj#${D}}"
 +			if [ -z "${rpath}" -o -n "${rpath//*ORIGIN*}" ]; then
 +				# object doesn't contain $ORIGIN in its runpath attribute
 +				echo "${obj} ${needed}"	>> "${PORTAGE_BUILDDIR}"/build-info/NEEDED
 +				echo "${arch};${obj};${soname};${rpath};${needed}" >> "${PORTAGE_BUILDDIR}"/build-info/NEEDED.PECOFF.1
 +			else
 +				dir=${obj%/*}
 +				# replace $ORIGIN with the dirname of the current object for the lookup
 +				opath=$(echo :${rpath}: | sed -e "s#.*:\(.*\)\$ORIGIN\(.*\):.*#\1${dir}\2#")
 +				sneeded=$(echo ${needed} | tr , ' ')
 +				rneeded=""
 +				for lib in ${sneeded}; do
 +					found=0
 +					for path in ${opath//:/ }; do
 +						[ -e "${ED}/${path}/${lib}" ] && found=1 && break
 +					done
 +					[ "${found}" -eq 0 ] && rneeded="${rneeded},${lib}"
 +				done
 +				rneeded=${rneeded:1}
 +				if [ -n "${rneeded}" ]; then
 +					echo "${obj} ${rneeded}" >> "${PORTAGE_BUILDDIR}"/build-info/NEEDED
 +					echo "${arch};${obj};${soname};${rpath};${rneeded}" >> "${PORTAGE_BUILDDIR}"/build-info/NEEDED.PECOFF.1
 +				fi
 +			fi
 +		done }
 +		
 +		if [[ ${insecure_rpath} -eq 1 ]] ; then
 +			die "Aborting due to serious QA concerns with RUNPATH/RPATH"
 +		elif [[ -n ${die_msg} ]] && has stricter ${FEATURES} ; then
 +			die "Aborting due to QA concerns: ${die_msg}"
 +		fi
 +
 +		local _so_ext='.so*'
 +
 +		case "${CHOST}" in
 +			*-winnt*) _so_ext=".dll" ;; # no "*" intentionally!
 +		esac
 +
 +		# Run some sanity checks on shared libraries
 +		for d in "${ED}"lib* "${ED}"usr/lib* ; do
 +			[[ -d "${d}" ]] || continue
 +			f=$(find "${d}" -name "lib*${_so_ext}" -print0 | \
 +				xargs -0 ${_pfx_scan} | while IFS=";" read arch obj soname rpath needed; \
 +				do [[ -z "${soname}" ]] && echo "${obj}"; done)
 +			if [[ -n ${f} ]] ; then
 +				vecho -ne '\a\n'
 +				eqawarn "QA Notice: The following shared libraries lack a SONAME"
 +				eqawarn "${f}"
 +				vecho -ne '\a\n'
 +				sleep 1
 +			fi
 +
 +			f=$(find "${d}" -name "lib*${_so_ext}" -print0 | \
 +				xargs -0 ${_pfx_scan} | while IFS=";" read arch obj soname rpath needed; \
 +				do [[ -z "${needed}" ]] && echo "${obj}"; done)
 +			if [[ -n ${f} ]] ; then
 +				vecho -ne '\a\n'
 +				eqawarn "QA Notice: The following shared libraries lack NEEDED entries"
 +				eqawarn "${f}"
 +				vecho -ne '\a\n'
 +				sleep 1
 +			fi
 +		done
 +
 +		PORTAGE_QUIET=${tmp_quiet}
 +	fi
 +}
 +
 +install_qa_check_xcoff() {
 +	if ! has binchecks ${RESTRICT}; then
 +		local tmp_quiet=${PORTAGE_QUIET}
 +		local queryline deplib
 +		local insecure_rpath_list= undefined_symbols_list=
 +
 +		# display warnings when using stricter because we die afterwards
 +		if has stricter ${FEATURES} ; then
 +			unset PORTAGE_QUIET
 +		fi
 +
 +		rm -f "${PORTAGE_BUILDDIR}"/build-info/NEEDED.XCOFF.1
 +
 +		local neededfd
 +		for neededfd in {3..1024} none; do ( : <&${neededfd} ) 2>/dev/null || break; done
 +		[[ ${neededfd} != none ]] || die "cannot find free file descriptor handle"
 +
 +		eval "exec ${neededfd}>\"${PORTAGE_BUILDDIR}\"/build-info/NEEDED.XCOFF.1" || die "cannot open ${PORTAGE_BUILDDIR}/build-info/NEEDED.XCOFF.1"
 +
 +		(	# work around a problem in /usr/bin/dump (used by aixdll-query)
 +			# dumping core when path names get too long.
 +			cd "${ED}" >/dev/null &&
 +			find . -not -type d -exec \
 +				aixdll-query '{}' FILE MEMBER FLAGS FORMAT RUNPATH DEPLIBS ';'
 +		) > "${T}"/needed 2>/dev/null
 +
 +		# Symlinking shared archive libraries is not a good idea on aix,
 +		# as there is nothing like "soname" on pure filesystem level.
 +		# So we create a copy instead of the symlink.
 +		local prev_FILE=
 +		local FILE MEMBER FLAGS FORMAT RUNPATH DEPLIBS
 +		while read queryline
 +		do
 +			FILE= MEMBER= FLAGS= FORMAT= RUNPATH= DEPLIBS=
 +			eval ${queryline}
 +			FILE=${FILE#./}
 +
 +			if [[ ${prev_FILE} != ${FILE} ]]; then
 +				if [[ " ${FLAGS} " == *" SHROBJ "* && -h ${ED}${FILE} ]]; then
 +					prev_FILE=${FILE}
 +					local target=$(readlink "${ED}${FILE}")
 +					if [[ ${target} == /* ]]; then
 +						target=${D}${target}
 +					else
 +						target=${FILE%/*}/${target}
 +					fi
 +					rm -f "${ED}${FILE}" || die "cannot prune ${FILE}"
 +					cp -f "${ED}${target}" "${ED}${FILE}" || die "cannot copy ${target} to ${FILE}"
 +				fi
 +			fi
 +		done <"${T}"/needed
 +
 +		prev_FILE=
 +		while read queryline
 +		do
 +			FILE= MEMBER= FLAGS= FORMAT= RUNPATH= DEPLIBS=
 +			eval ${queryline}
 +			FILE=${FILE#./}
 +
 +			if [[ -n ${MEMBER} && ${prev_FILE} != ${FILE} ]]; then
 +				# Save NEEDED information for each archive library stub
 +				# even if it is static only: the already installed archive
 +				# may contain shared objects to be preserved.
 +				echo "${FORMAT##* }${FORMAT%%-*};${EPREFIX}/${FILE};${FILE##*/};;" >&${neededfd}
 +			fi
 +			prev_FILE=${FILE}
 +
 +			# shared objects have both EXEC and SHROBJ flags,
 +			# while executables have EXEC flag only.
 +			[[ " ${FLAGS} " == *" EXEC "* ]] || continue
 +
 +			# Make sure we disallow insecure RUNPATH's
 +			# Don't want paths that point to the tree where the package was built
 +			# (older, broken libtools would do this).  Also check for null paths
 +			# because the loader will search $PWD when it finds null paths.
 +			# And we really want absolute paths only.
 +			if [[ -n $(echo ":${RUNPATH}:" | grep -E "(${PORTAGE_BUILDDIR}|::|:[^/])") ]]; then
 +				insecure_rpath_list="${insecure_rpath_list}\n${FILE}${MEMBER:+[${MEMBER}]}"
 +			fi
 +
 +			local needed=
 +			[[ -n ${MEMBER} ]] && needed=${FILE##*/}
 +			for deplib in ${DEPLIBS}; do
 +				eval deplib=${deplib}
 +				if [[ ${deplib} == '.' || ${deplib} == '..' ]]; then
 +					# Although we do have runtime linking, we don't want undefined symbols.
 +					# AIX does indicate this by needing either '.' or '..'
 +					undefined_symbols_list="${undefined_symbols_list}\n${FILE}"
 +				else
 +					needed="${needed}${needed:+,}${deplib}"
 +				fi
 +			done
 +
 +			FILE=${EPREFIX}/${FILE}
 +
 +			[[ -n ${MEMBER} ]] && MEMBER="[${MEMBER}]"
 +			# Save NEEDED information
 +			echo "${FORMAT##* }${FORMAT%%-*};${FILE}${MEMBER};${FILE##*/}${MEMBER};${RUNPATH};${needed}" >&${neededfd}
 +		done <"${T}"/needed
 +
 +		eval "exec ${neededfd}>&-" || die "cannot close handle to ${PORTAGE_BUILDDIR}/build-info/NEEDED.XCOFF.1"
 +
 +		if [[ -n ${undefined_symbols_list} ]]; then
 +			vecho -ne '\a\n'
 +			eqawarn "QA Notice: The following files contain undefined symbols."
 +			eqawarn " Please file a bug about this at http://bugs.gentoo.org/"
 +			eqawarn " with 'prefix' as the maintaining herd of the package."
 +			eqawarn "${undefined_symbols_list}"
 +			vecho -ne '\a\n'
 +		fi
 +
 +		if [[ -n ${insecure_rpath_list} ]] ; then
 +			vecho -ne '\a\n'
 +			eqawarn "QA Notice: The following files contain insecure RUNPATH's"
 +			eqawarn " Please file a bug about this at http://bugs.gentoo.org/"
 +			eqawarn " with 'prefix' as the maintaining herd of the package."
 +			eqawarn "${insecure_rpath_list}"
 +			vecho -ne '\a\n'
 +			if has stricter ${FEATURES} ; then
 +				insecure_rpath=1
 +			fi
 +		fi
 +
 +		if [[ ${insecure_rpath} -eq 1 ]] ; then
 +			die "Aborting due to serious QA concerns with RUNPATH/RPATH"
 +		elif [[ -n ${die_msg} ]] && has stricter ${FEATURES} ; then
 +			die "Aborting due to QA concerns: ${die_msg}"
 +		fi
 +
 +		PORTAGE_QUIET=${tmp_quiet}
 +	fi
 +}
 +
  install_mask() {
  	local root="$1"
  	shift
diff --cc bin/portageq
index ea9dfde,009f116..7b9e177
--- a/bin/portageq
+++ b/bin/portageq
@@@ -23,22 -23,22 +23,22 @@@ except KeyboardInterrupt
  import os
  import types
  
 -if os.path.isfile(os.path.join(os.path.dirname(os.path.dirname(os.path.realpath(__file__))), ".portage_not_installed")):
 -	pym_paths = [os.path.join(os.path.dirname(os.path.dirname(os.path.realpath(__file__))), "pym")]
 -	sys.path.insert(0, pym_paths[0])
 +# for an explanation on this logic, see pym/_emerge/__init__.py
 +if os.environ.__contains__("PORTAGE_PYTHONPATH"):
 +	pym_path = os.environ["PORTAGE_PYTHONPATH"]
  else:
 -	import distutils.sysconfig
 -	pym_paths = [os.path.join(distutils.sysconfig.get_python_lib(), x) for x in ("_emerge", "portage")]
 +	pym_path = os.path.join(os.path.dirname(
 +		os.path.dirname(os.path.realpath(__file__))), "pym")
- # Avoid sandbox violations after python upgrade.
+ # Avoid sandbox violations after Python upgrade.
  if os.environ.get("SANDBOX_ON") == "1":
  	sandbox_write = os.environ.get("SANDBOX_WRITE", "").split(":")
- 	if pym_path not in sandbox_write:
- 		sandbox_write.append(pym_path)
- 		os.environ["SANDBOX_WRITE"] = \
- 			":".join(filter(None, sandbox_write))
- 	del sandbox_write
+ 	for pym_path in pym_paths:
+ 		if pym_path not in sandbox_write:
+ 			sandbox_write.append(pym_path)
+ 			os.environ["SANDBOX_WRITE"] = ":".join(filter(None, sandbox_write))
+ 	del pym_path, sandbox_write
+ del pym_paths
  
- sys.path.insert(0, pym_path)
  import portage
  portage._internal_caller = True
  from portage import os
diff --cc pym/portage/const.py
index 89d7ee2,acb90f9..5f00fab
--- a/pym/portage/const.py
+++ b/pym/portage/const.py
@@@ -65,35 -58,23 +65,36 @@@ DEPCACHE_PATH            = "/var/cache/
  GLOBAL_CONFIG_PATH       = "/usr/share/portage/config"
  
  # these variables are not used with target_root or config_root
 +PORTAGE_BASE_PATH        = PORTAGE_BASE
  # NOTE: Use realpath(__file__) so that python module symlinks in site-packages
  # are followed back to the real location of the whole portage installation.
 +#PREFIX: below should work, but I'm not sure how it it affects other places
- #PORTAGE_BASE_PATH        = os.path.join(os.sep, os.sep.join(os.path.realpath(
- #                               __file__.rstrip("co")).split(os.sep)[:-3]))
+ # NOTE: Please keep PORTAGE_BASE_PATH in one line to help substitutions.
 -PORTAGE_BASE_PATH        = os.path.join(os.sep, os.sep.join(os.path.realpath(__file__.rstrip("co")).split(os.sep)[:-3]))
++#PORTAGE_BASE_PATH        = os.path.join(os.sep, os.sep.join(os.path.realpath(__file__.rstrip("co")).split(os.sep)[:-3]))
  PORTAGE_BIN_PATH         = PORTAGE_BASE_PATH + "/bin"
- PORTAGE_PYM_PATH         = PORTAGE_BASE_PATH + "/pym"
+ PORTAGE_PYM_PATH         = os.path.realpath(os.path.join(__file__, '../..'))
  LOCALE_DATA_PATH         = PORTAGE_BASE_PATH + "/locale"  # FIXME: not used
  EBUILD_SH_BINARY         = PORTAGE_BIN_PATH + "/ebuild.sh"
  MISC_SH_BINARY           = PORTAGE_BIN_PATH + "/misc-functions.sh"
 -SANDBOX_BINARY           = "/usr/bin/sandbox"
 -FAKEROOT_BINARY          = "/usr/bin/fakeroot"
 -BASH_BINARY              = "/bin/bash"
 -MOVE_BINARY              = "/bin/mv"
 +SANDBOX_BINARY           = EPREFIX + "/usr/bin/sandbox"
 +FAKEROOT_BINARY          = EPREFIX + "/usr/bin/fakeroot"
 +BASH_BINARY              = PORTAGE_BASH
 +MOVE_BINARY              = PORTAGE_MV
  PRELINK_BINARY           = "/usr/sbin/prelink"
 +MACOSSANDBOX_BINARY      = "/usr/bin/sandbox-exec"
 +MACOSSANDBOX_PROFILE     = '''(version 1)
 +(allow default)
 +(deny file-write*)
 +(allow file-write*
 +@@MACOSSANDBOX_PATHS@@)
 +(allow file-write-data
 +@@MACOSSANDBOX_PATHS_CONTENT_ONLY@@)'''
 +
 +PORTAGE_GROUPNAME        = portagegroup
 +PORTAGE_USERNAME         = portageuser
  
  INVALID_ENV_FILE         = "/etc/spork/is/not/valid/profile.env"
+ MERGING_IDENTIFIER       = "-MERGING-"
  REPO_NAME_FILE           = "repo_name"
  REPO_NAME_LOC            = "profiles" + "/" + REPO_NAME_FILE
  
diff --cc pym/portage/dbapi/vartree.py
index 040b546,b46ba0b..deeb779
--- a/pym/portage/dbapi/vartree.py
+++ b/pym/portage/dbapi/vartree.py
@@@ -48,7 -46,7 +49,7 @@@ portage.proxy.lazyimport.lazyimport(glo
  )
  
  from portage.const import CACHE_PATH, CONFIG_MEMORY_FILE, \
- 	PORTAGE_PACKAGE_ATOM, PRIVATE_PATH, VDB_PATH, EPREFIX, EPREFIX_LSTRIP, BASH_BINARY
 -	MERGING_IDENTIFIER, PORTAGE_PACKAGE_ATOM, PRIVATE_PATH, VDB_PATH
++	MERGING_IDENTIFIER, PORTAGE_PACKAGE_ATOM, PRIVATE_PATH, VDB_PATH, EPREFIX, EPREFIX_LSTRIP, BASH_BINARY
  from portage.dbapi import dbapi
  from portage.exception import CommandNotFound, \
  	InvalidData, InvalidLocation, InvalidPackageName, \
diff --cc pym/portage/package/ebuild/config.py
index fb4956d,264ed8e..6e578a9
--- a/pym/portage/package/ebuild/config.py
+++ b/pym/portage/package/ebuild/config.py
@@@ -37,10 -37,11 +37,11 @@@ from portage.dep import Atom, isvalidat
  from portage.eapi import eapi_exports_AA, eapi_exports_merge_type, \
  	eapi_supports_prefix, eapi_exports_replace_vars, _get_eapi_attrs
  from portage.env.loaders import KeyValuePairFileLoader
- from portage.exception import InvalidDependString, PortageException
+ from portage.exception import InvalidDependString, IsADirectory, \
+ 		PortageException
  from portage.localization import _
  from portage.output import colorize
 -from portage.process import fakeroot_capable, sandbox_capable
 +from portage.process import fakeroot_capable, sandbox_capable, macossandbox_capable
  from portage.repository.config import load_repository_config
  from portage.util import ensure_dirs, getconfig, grabdict, \
  	grabdict_package, grabfile, grabfile_package, LazyItemsDict, \
diff --cc pym/portage/package/ebuild/doebuild.py
index 3c2167a,d3e3f5a..8e55fe2
--- a/pym/portage/package/ebuild/doebuild.py
+++ b/pym/portage/package/ebuild/doebuild.py
@@@ -46,8 -45,7 +46,7 @@@ from portage import auxdbkeys, bsd_chfl
  	unmerge, _encodings, _os_merge, \
  	_shell_quote, _unicode_decode, _unicode_encode
  from portage.const import EBUILD_SH_ENV_FILE, EBUILD_SH_ENV_DIR, \
- 	EBUILD_SH_BINARY, INVALID_ENV_FILE, MISC_SH_BINARY, \
- 	EPREFIX, MACOSSANDBOX_PROFILE
 -	EBUILD_SH_BINARY, INVALID_ENV_FILE, MISC_SH_BINARY, PORTAGE_PYM_PACKAGES
++	EBUILD_SH_BINARY, INVALID_ENV_FILE, MISC_SH_BINARY, PORTAGE_PYM_PACKAGES, EPREFIX, MACOSSANDBOX_PROFILE
  from portage.data import portage_gid, portage_uid, secpass, \
  	uid, userpriv_groups
  from portage.dbapi.porttree import _parse_uri_map