net-*/*: stop exporting $pidfile in OpenRC service scripts (insecure)

Say it with me: the pidfile and its parent directories should
only be writable by root unless you use supervise-daemon ;)

With `checkpath -o someuser:someuser $pidfile` in start_pre(), it can
cause DOS attacks because the now unprivelaged process can replace the
pidfile with some other pid number in it like pid 1 and cause the host
machine to crash when the daemon finally stops. Supervise-daemon can
supervise without the daemon creating a pidfile so don't export the
variable at all.

That assumes the scripts *are* using supervise-daemon, if
supervise-daemon fails to start (due to maybe some incorrect config
option *wink wink*) then OpenRC falls back to the older
start-stop-daemon and that *does* use the $pidfile. If thats the case
then the daemon will simply fail to start (yes I haven't tested if any
these packages work without $pidfile which they should since they are
specifying `supervisor=supervise-daemon`).

IMO failing to start is better than running in a potentially vulnerable
configuration.

Merges: https://codeberg.org/gentoo/guru/pulls/92
Part-off: https://codeberg.org/gentoo/guru/pulls/92
Signed-off-by: zyxhere💭 <zyx@envs.net>

net-im/mautrix-signal/files/mautrix-signal.initd-r2

@@ -0,0 +1,20 @@
+#!/sbin/openrc-run
+# shellcheck shell=sh
+#
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="Matrix-Signal puppeting bridge"
+supervisor="supervise-daemon"
+command="/usr/bin/mautrix-signal"
+command_args="-c ${MAUTRIX_SIGNAL_CONFIG} ${MAUTRIX_SIGNAL_OPTS}"
+command_user="mautrix-signal:mautrix"
+
+depend() {
+	need net
+	use dns postgresql
+}
+
+start_pre() {
+	checkpath -d -o "${command_user}" /run/mautrix-signal
+}

net-im/mautrix-signal/mautrix-signal-26.02.1-r1.ebuild

@@ -0,0 +1,95 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module systemd toolchain-funcs
+
+MY_PV="0.$(ver_rs 1 '')"
+DESCRIPTION="Matrix-Signal puppeting bridge"
+HOMEPAGE="https://github.com/mautrix/signal"
+SRC_URI="https://github.com/mautrix/signal/archive/refs/tags/v${MY_PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/gentoo-golang-dist/signal/releases/download/v${MY_PV}/signal-${MY_PV}-vendor.tar.xz"
+S="${WORKDIR}/signal-${MY_PV}"
+
+LICENSE="AGPL-3+"
+# Go dependency licenses
+LICENSE+=" AGPL-3 Apache-2.0 BSD GPL-3+ ISC MIT MPL-2.0 public-domain"
+SLOT="0"
+KEYWORDS="~amd64"
+
+RDEPEND="
+	acct-user/mautrix-signal
+	dev-libs/olm
+	virtual/zlib:=
+"
+DEPEND="${RDEPEND}
+	~dev-libs/libsignal-ffi-0.87.5
+"
+
+DOCS=( {CHANGELOG,README,ROADMAP}.md )
+
+pkg_setup() {
+	[[ ${MERGE_TYPE} == "binary" ]] && return 0
+
+	# https://github.com/mautrix/signal/issues/595
+	tc-is-clang && die "Clang compiler is not supported"
+}
+
+src_compile() {
+	local MAUTRIX_VERSION=$(awk '/maunium\.net\/go\/mautrix / { print $2 }' go.mod)
+	local BUILD_TIME=$(date -Iseconds)
+	local go_ldflags=(
+		-X "main.Tag=v${MY_PV}"
+		-X "main.BuildTime=${BUILD_TIME}"
+		-X "maunium.net/go/mautrix.GoModVersion=${MAUTRIX_VERSION}"
+	)
+
+	ego build -ldflags "${go_ldflags[*]}" ./cmd/mautrix-signal
+}
+
+src_install() {
+	dobin mautrix-signal
+	einstalldocs
+
+	newinitd "${FILESDIR}"/mautrix-signal.initd-r2 mautrix-signal
+	newconfd "${FILESDIR}"/mautrix-signal.confd mautrix-signal
+	systemd_dounit "${FILESDIR}"/mautrix-signal.service
+
+	local dir
+	for dir in /var/log/mautrix /etc/mautrix; do
+		keepdir "${dir}"
+		fowners -R root:mautrix "${dir}"
+		fperms 770 "${dir}"
+	done
+
+	keepdir /var/lib/mautrix/signal
+	fowners -R mautrix-signal:mautrix /var/lib/mautrix/signal
+}
+
+src_test() {
+	ego test -vet=off ./...
+}
+
+pkg_postinst() {
+	einfo
+	elog "Before you can use mautrix-signal, you need to configure it correctly."
+	elog "To generate the configuration file, use the following command:"
+	elog "	# runuser -u mautrix-signal -g mautrix -- mautrix-signal -c /etc/mautrix/mautrix_signal.yaml -e"
+	elog
+	elog "Configure the /etc/mautrix/mautrix_signal.yaml file according to your"
+	elog "homeserver. When done, run the following command:"
+	elog "	# emerge --config ${CATEGORY}/${PN}"
+	elog
+	elog "Then, you need to register the bridge with your homeserver."
+	elog "Refer your homeserver's documentation for instructions."
+	elog "The registration file is located at /var/lib/mautrix/signal/registration.yaml"
+	elog
+	elog "Finally, you may start the mautrix-signal daemon."
+	einfo
+}
+
+pkg_config() {
+	runuser -u mautrix-signal -g mautrix -- \
+		mautrix-signal -c /etc/mautrix/mautrix_signal.yaml -g -r /var/lib/mautrix/signal/registration.yaml
+}

net-im/mautrix-telegram/files/mautrix-telegram.initd-r3

@@ -0,0 +1,21 @@
+#!/sbin/openrc-run
+# shellcheck shell=sh
+#
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+: "${supervisor:=supervise-daemon}"
+
+description="Matrix-Telegram Messenger puppeting bridge"
+command="/usr/bin/mautrix-telegram"
+command_args="-c ${MAUTRIX_TELEGRAM_CONFIG:-/etc/mautrix/mautrix_telegram.yaml} ${MAUTRIX_TELEGRAM_OPTS}"
+command_user="mautrix-telegram:mautrix"
+
+depend() {
+	need net
+	use dns postgresql
+}
+
+start_pre() {
+	checkpath -d -o "${command_user}" /run/mautrix-telegram
+}

net-im/mautrix-telegram/mautrix-telegram-26.07-r1.ebuild

@@ -0,0 +1,114 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module optfeature systemd
+
+MY_PV="0.$(ver_rs 1-2 '').0"
+DESCRIPTION="Matrix-Telegram puppeting bridge"
+HOMEPAGE="https://github.com/mautrix/telegram"
+SRC_URI="https://github.com/mautrix/telegram/archive/refs/tags/v${MY_PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/sysrq-golang-dist/${PN}/releases/download/v${MY_PV}/${PN}-${MY_PV}-deps.tar.xz"
+S="${WORKDIR}/telegram-${MY_PV}"
+
+LICENSE="AGPL-3+"
+# Go dependency licenses
+LICENSE+=" Apache-2.0 BSD GPL-3+ ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="+crypt"
+
+RDEPEND="
+	acct-user/mautrix-telegram
+	dev-db/sqlite:3
+	media-libs/libwebp:=
+	crypt? ( dev-libs/olm )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	>=dev-lang/go-1.25.0
+	virtual/pkgconfig
+"
+
+DOCS=( {CHANGELOG,README,ROADMAP}.md )
+
+src_configure() {
+	default
+
+	# https://github.com/mattn/go-sqlite3#linux
+	# -tags libsqlite3: use system sqlite3 instead of bundled
+	GO_BUILD_TAGS="libsqlite3"
+	use crypt || GO_BUILD_TAGS+=",nocrypto"
+}
+
+src_prepare() {
+	default
+
+	# unbundle libwebp
+	cd "${GOMODCACHE}" || die
+	rm go.mau.fi/webp@v0.3.0/z_*.c || die
+	eapply "${FILESDIR}"/${PN}-26.07-unbundle-libwebp.patch
+}
+
+src_compile() {
+	local MAUTRIX_VERSION=$(awk '/maunium\.net\/go\/mautrix / { print $2 }' go.mod)
+	local BUILD_TIME=$(date -Iseconds)
+	local go_ldflags=(
+		-X "main.Tag=v${MY_PV}"
+		-X "main.Commit=unknown"
+		-X "main.BuildTime=${BUILD_TIME}"
+		-X "maunium.net/go/mautrix.GoModVersion=${MAUTRIX_VERSION}"
+	)
+
+	ego build -tags "${GO_BUILD_TAGS}" -ldflags "${go_ldflags[*]}" ./cmd/mautrix-telegram
+}
+
+src_test() {
+	ego test -tags "${GO_BUILD_TAGS}" -vet=off \
+		$(ego list ./... | grep -Fvx go.mau.fi/mautrix-telegram/pkg/gotd/tgerr)
+}
+
+src_install() {
+	dobin mautrix-telegram
+	einstalldocs
+
+	newinitd "${FILESDIR}"/mautrix-telegram.initd-r3 mautrix-telegram
+	newconfd "${FILESDIR}"/mautrix-telegram.confd mautrix-telegram
+	systemd_newunit "${FILESDIR}"/mautrix-telegram.service-r1 mautrix-telegram.service
+
+	local dir
+	for dir in /var/log/mautrix /etc/mautrix; do
+		keepdir "${dir}"
+		fowners -R root:mautrix "${dir}"
+		fperms 770 "${dir}"
+	done
+
+	keepdir /var/lib/mautrix/telegram
+	fowners -R mautrix-telegram:mautrix /var/lib/mautrix/telegram
+}
+
+pkg_postinst() {
+	einfo
+	elog "Before you can use mautrix-telegram, you need to configure it correctly."
+	elog "To generate the configuration file, use the following command:"
+	elog "	# runuser -u mautrix-telegram -g mautrix -- mautrix-telegram -c /etc/mautrix/mautrix_telegram.yaml -e"
+	elog
+	elog "Configure the /etc/mautrix/mautrix_telegram.yaml file according to your"
+	elog "homeserver. When done, run the following command:"
+	elog "	# emerge --config ${CATEGORY}/${PN}"
+	elog
+	elog "Then, you need to register the bridge with your homeserver."
+	elog "Refer your homeserver's documentation for instructions."
+	elog "The registration file is located at /var/lib/mautrix/telegram/registration.yaml"
+	elog
+	elog "Finally, you may start the mautrix-telegram daemon."
+	einfo
+
+	optfeature "animated sticker support" "dev-util/lottieconverter media-video/ffmpeg[vpx,webp]"
+}
+
+pkg_config() {
+	runuser -u mautrix-telegram -g mautrix -- \
+		mautrix-telegram -c /etc/mautrix/mautrix_telegram.yaml -g -r /var/lib/mautrix/telegram/registration.yaml
+}

net-irc/pounce/files/pounce.initd-r2

@@ -0,0 +1,33 @@
+#!/sbin/openrc-run
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+#
+# shellcheck shell=sh
+
+extra_started_commands="reload"
+
+description="IRC bouncer"
+description_reload="Refresh TLS keys"
+
+supervisor="supervise-daemon"
+command="/usr/bin/pounce"
+command_args="${POUNCE_CONFIG:-/etc/pounce/pounce.conf}"
+command_user="${POUNCE_USER:-pounce:pounce}"
+
+output_logger="logger -p daemon.info -t pounce --"
+error_logger="logger -p daemon.err -t pounce --"
+
+depend() {
+	use dns logger
+	need net
+}
+
+start_pre() {
+	checkpath -d -o "${command_user}" /run/pounce
+}
+
+reload() {
+	ebegin "Refreshing ${RC_SVCNAME} keys"
+	start-stop-daemon --signal SIGUSR1 --pidfile "${pidfile}"
+	eend $? "Failed to reload ${RC_SVCNAME}"
+}

net-irc/pounce/pounce-3.1-r2.ebuild

@@ -0,0 +1,60 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo toolchain-funcs
+
+DESCRIPTION="Multi-client, TLS-only IRC bouncer"
+HOMEPAGE="https://git.causal.agency/pounce/about/"
+SRC_URI="https://git.causal.agency/${PN}/snapshot/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="palaver"
+
+DEPEND="
+	dev-libs/libretls:=
+	virtual/libcrypt:=
+	palaver? (
+		dev-db/sqlite:3
+		net-misc/curl
+	)
+"
+RDEPEND="${DEPEND}
+	acct-user/pounce
+"
+BDEPEND="virtual/pkgconfig"
+
+DOCS=( {QUIRKS,README}.7 )
+
+src_configure() {
+	tc-export CC
+
+	local confargs=(
+		--enable-notify
+		$(use_enable palaver)
+
+		--prefix="${EPREFIX}/usr"
+		--mandir="${EPREFIX}/usr/share/man"
+	)
+
+	# note: not an autoconf configure script
+	edo ./configure "${confargs[@]}"
+}
+
+src_compile() {
+	emake all
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+	einstalldocs
+
+	newinitd "${FILESDIR}"/pounce.initd-r2 pounce
+	newconfd "${FILESDIR}"/pounce.confd-r1 pounce
+
+	insinto /etc/pounce
+	doins "${FILESDIR}"/example.conf
+}

net-misc/graftcp/files/graftcp-local.initd-r1

@@ -0,0 +1,25 @@
+#!/sbin/openrc-run
+# shellcheck shell=sh
+#
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="Translate TCP to SOCKS5 or HTTP proxy"
+supervisor="supervise-daemon"
+command="/usr/bin/graftcp-local"
+command_args="\
+	-config ${GRAFTCP_CONFIG:-/etc/graftcp-local/graftcp-local.conf} \
+	-syslog \
+	-pipepath /run/graftcp/${RC_SVCNAME}.fifo \
+	${GRAFTCP_OPTS}
+"
+: "${command_user=graftcp:graftcp}"
+
+depend() {
+	need net
+	use logger
+}
+
+start_pre() {
+	checkpath -d -o "${command_user}" /run/graftcp
+}

net-misc/graftcp/graftcp-0.7.4-r1.ebuild

@@ -0,0 +1,97 @@
+# Copyright 2024-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module systemd toolchain-funcs
+
+EGO_SUM=(
+		"github.com/hashicorp/go-syslog v1.0.0"
+		"github.com/hashicorp/go-syslog v1.0.0/go.mod"
+		"github.com/jedisct1/dlog v0.0.0-20210101122416-354ffe815216"
+		"github.com/jedisct1/dlog v0.0.0-20210101122416-354ffe815216/go.mod"
+		"github.com/kardianos/service v1.2.0"
+		"github.com/kardianos/service v1.2.0/go.mod"
+		"github.com/pborman/getopt/v2 v2.1.0"
+		"github.com/pborman/getopt/v2 v2.1.0/go.mod"
+		"github.com/vishvananda/netlink v1.1.0"
+		"github.com/vishvananda/netlink v1.1.0/go.mod"
+		"github.com/vishvananda/netlink v1.2.1-beta.2.0.20240713210050-d13535d71ed3"
+		"github.com/vishvananda/netlink v1.2.1-beta.2.0.20240713210050-d13535d71ed3/go.mod"
+		"github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df"
+		"github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod"
+		"github.com/vishvananda/netns v0.0.4"
+		"github.com/vishvananda/netns v0.0.4/go.mod"
+		"golang.org/x/net v0.23.0"
+		"golang.org/x/net v0.23.0/go.mod"
+		"golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod"
+		"golang.org/x/sys v0.0.0-20201015000850-e3ed0017c211/go.mod"
+		"golang.org/x/sys v0.0.0-20201231184435-2d18734c6014/go.mod"
+		"golang.org/x/sys v0.2.0/go.mod"
+		"golang.org/x/sys v0.10.0/go.mod"
+		"golang.org/x/sys v0.18.0"
+		"golang.org/x/sys v0.18.0/go.mod"
+		"golang.org/x/sys v0.22.0"
+		"golang.org/x/sys v0.22.0/go.mod"
+)
+
+go-module_set_globals
+
+DESCRIPTION="A tool for redirecting a given program's TCP traffic to SOCKS5 or HTTP proxy"
+HOMEPAGE="https://github.com/hmgle/graftcp"
+SRC_URI="https://github.com/hmgle/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz
+	${EGO_SUM_SRC_URI}"
+
+SLOT="0"
+LICENSE="GPL-3+"
+# Go dependency licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 MIT ZLIB"
+KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+
+RDEPEND="acct-user/graftcp"
+BDEPEND=">=dev-lang/go-1.21"
+
+PATCHES=(
+	"${FILESDIR}/0002-build-no-longer-strip-symbols.patch"
+	"${FILESDIR}/0005-let-graftcp-respect-LDFLAGS.patch"
+)
+
+DOCS=(
+	README{,.zh-CN}.md
+	example-{black,white}list-ip.txt
+	example-graftcp.conf
+	local/example-graftcp-local.conf
+)
+
+# Written in golang
+QA_FLAGS_IGNORED="
+	usr/bin/graftcp-local
+	usr/bin/mgraftcp
+"
+
+src_compile() {
+	local mymakeargs=(
+		VERSION="v${PV}"
+		CC="$(tc-getCC)"
+		AR="$(tc-getAR)"
+		CFLAGS="${CFLAGS} -DNDEBUG"
+	)
+	emake "${mymakeargs[@]}"
+}
+
+src_install() {
+	local mymakeargs=(
+		DESTDIR="${D}"
+		PREFIX="${EPREFIX}/usr"
+		SYSTEMD_UNIT_DIR="$(systemd_get_systemunitdir)"
+	)
+	emake -j1 "${mymakeargs[@]}" install install_systemd
+
+	fowners -R root:graftcp /etc/graftcp-local
+	fperms 0640 /etc/graftcp-local/graftcp-local.conf
+
+	newinitd "${FILESDIR}"/graftcp-local.initd-r1 graftcp-local
+	newconfd "${FILESDIR}"/graftcp-local.confd graftcp-local
+
+	einstalldocs
+}

net-proxy/byedpi/byedpi-0.17.3-r1.ebuild

@@ -0,0 +1,45 @@
+# Copyright 2024-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd toolchain-funcs
+
+DESCRIPTION="Bypass DPI SOCKS proxy"
+HOMEPAGE="https://github.com/hufrea/byedpi"
+
+if [[ ${PV} == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/hufrea/byedpi.git"
+else
+	SRC_URI="https://github.com/hufrea/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+
+RDEPEND="acct-user/byedpi"
+
+src_prepare() {
+	default
+
+	# respect optimization level
+	sed -i 's/ -O.\b/ /' Makefile || die
+}
+
+src_configure() {
+	tc-export CC
+}
+
+src_install() {
+	dobin ciadpi
+	einstalldocs
+
+	newinitd "${FILESDIR}"/byedpi.initd-r3 byedpi
+	newconfd "${FILESDIR}"/byedpi.confd byedpi
+	systemd_dounit dist/linux/byedpi.service
+
+	insinto /etc
+	doins dist/linux/byedpi.conf
+}

net-proxy/byedpi/files/byedpi.initd-r3

@@ -0,0 +1,31 @@
+#!/sbin/openrc-run
+# shellcheck shell=sh
+#
+# Copyright 2024-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+: "${BYEDPI_USER:=byedpi}"
+: "${BYEDPI_GROUP:=nobody}"
+
+: "${BYEDPI_BIND_IP:=0.0.0.0}"
+: "${BYEDPI_BIND_PORT:=1080}"
+: "${BYEDPI_OPTS:=--split 1 --disorder 3+s --mod-http=h,d --auto=torst --tlsrec 1+s}"
+
+description="Bypass DPI SOCKS proxy"
+supervisor="supervise-daemon"
+command="/usr/bin/ciadpi"
+pidfile="/run/byedpi/${RC_SVCNAME}.pid"
+command_user="${BYEDPI_USER}:${BYEDPI_GROUP}"
+command_args="--ip ${BYEDPI_BIND_IP} --port ${BYEDPI_BIND_PORT} ${BYEDPI_OPTS}"
+command_args_background="--daemon --pidfile ${pidfile}"
+output_logger="logger -p daemon.info -t byedpi --"
+error_logger="logger -p daemon.err -t byedpi --"
+
+depend() {
+	need net
+	use firewall logger
+}
+
+start_pre() {
+	checkpath -q -do "${BYEDPI_USER}":root /run/"${RC_SVCNAME}"
+}