overlay app-admin/locksmith: Use Gentoo eclasses, bump deps

[krnowak]

CI: https://jenkins.flatcar.org/job/container/job/packages_all_arches/700/cldsv/
Locksmith PR: flatcar/locksmith#37

Closes flatcar/Flatcar#2168

[Copilot]

🟡 Changes recommended

Both ebuilds have unresolved build or metadata requirements before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request updates locksmith packaging to use Gentoo Go/systemd eclasses, refreshes dependencies, and adds stable version 0.7.0-r3.

Changes:

• Refreshes the source archive and Manifest checksums.
• Migrates build and installation logic to Gentoo eclasses.
• Adds the versioned 0.7.0-r3 ebuild.

File summaries

File	Summary
sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/Manifest	Updates source archive checksums.
sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild	Migrates live packaging. Critical (2 votes): add explicit Go 1.26 BDEPEND on lines 7 and 26. Moderate (1 vote): add applicable BSD-2 and MIT license identifiers. Nit (1 vote): add update/security changelog entries and affected CVEs.
sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-0.7.0-r3.ebuild	Adds the stable package revision. Critical (2 votes): add explicit Go 1.26 BDEPEND. Moderate (1 vote): add applicable license identifiers. Nit (2 votes): add release metadata under changelog/updates.

Review details

Suppressed comments (3)

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:26

• The source commit's archive has no bin/ directory (it is listed as generated in upstream .gitignore), and go build -o does not create missing parent directories. This makes src_compile fail before installation; create the directory first or write the output to an existing path.

	go build -o bin/locksmithctl ./locksmithctl

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:16

• This security-driven package update has no changelog entry, and the PR checklist still leaves changelog unchecked. Add the release entry under changelog/updates and the affected CVEs under changelog/security, following current entries such as changelog/updates/2026-09-08-weekly-updates.md and changelog/security/2026-06-05-weekly-updates.md, before merging.

	EGIT_VERSION="ec045e63f89b86b6c8ba0c61591d6e13f3e16362" # krnowak/deps-bump

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:16

• The new dependency set is not covered by LICENSE="Apache-2.0" alone: the vendored modules include BSD-2 and MIT-licensed code (for example godbus and json-iterator), while this tree's go-module.eclass requires licenses for statically linked dependencies. Add all applicable identifiers here, as the etcd ebuild does.

	EGIT_VERSION="ec045e63f89b86b6c8ba0c61591d6e13f3e16362" # krnowak/deps-bump

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:7

• The vendored source's go.mod declares go 1.26.0, but inheriting go-module only adds a >=dev-lang/go-1.24.11 dependency here. A valid dependency resolution can therefore select a compiler that rejects this module before compilation; add an explicit Go 1.26 minimum.

inherit systemd go-module

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:26

• The upstream tree at this commit has no bin/ directory, so this output path is not writable in a clean unpack and the build fails before src_install. Create the directory before building (and use ego so build failures are propagated).
  sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:16
• This update addresses the linked etcd CVEs (CVE-2020-15114 and CVE-2026-33413), but the PR has no security changelog entry and its changelog checklist is still unchecked. Add a package/CVE item under the repository's changelog/security directory before merging, following entries such as changelog/security/2026-09-08-weekly-updates.md.

	EGIT_VERSION="6ea5e7c73bb83cf6c013ff191cc0646e08cb3240" # flatcar-master

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Resolve the outstanding build, dependency metadata, license, and security changelog findings.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:7

• This ebuild now builds the vendored dependency tree through go-module, but LICENSE below still declares only Apache-2.0. The go-module eclass requires all licenses of statically linked dependencies; the updated module set also contains BSD/BSD-2, ISC, MIT, and MPL-2.0 components. Add those identifiers here (and keep the live and versioned ebuilds in sync).

inherit systemd go-module

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:25

• This assignment replaces the BDEPEND initialized by go-module, dropping its app-arch/unzip dependency and the := slot operator. Append the stricter Go constraint instead so the eclass-provided dependencies and rebuild tracking remain intact.

BDEPEND=">=dev-lang/go-1.26.0"

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

One or more issues must be addressed before approval.

Review details

Suppressed comments (2)

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:25

• Because this package now builds the vendored module graph through go-module, the eclass requires LICENSE to include every statically linked dependency. The new vendor set includes BSD-2-Clause (godbus/dbus/v5), BSD (x/sys), ISC, MIT, and MPL-2.0 components, so the Apache-only metadata is incomplete; update the LICENSE field accordingly.

BDEPEND=">=dev-lang/go-1.26.0"

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:28

• The upstream archive and git checkout do not contain a bin/ directory (/bin is ignored), and go build -o does not create missing parent directories. This phase therefore fails with open bin/locksmithctl: no such file or directory; create the directory before building or write to an existing path.

	go build -o bin/locksmithctl ./locksmithctl

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite