overlay app-admin/locksmith: Use Gentoo eclasses, bump deps

[krnowak]

CI: https://jenkins.flatcar.org/job/container/job/packages_all_arches/700/cldsv/
Locksmith PR: flatcar/locksmith#37

Closes flatcar/Flatcar#2168

• changelog

[Copilot]

🟡 Changes recommended

Both ebuilds have unresolved build or metadata requirements before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request updates locksmith packaging to use Gentoo Go/systemd eclasses, refreshes dependencies, and adds stable version 0.7.0-r3.

Changes:

• Refreshes the source archive and Manifest checksums.
• Migrates build and installation logic to Gentoo eclasses.
• Adds the versioned 0.7.0-r3 ebuild.

File summaries

File	Summary
sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/Manifest	Updates source archive checksums.
sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild	Migrates live packaging. Critical (2 votes): add explicit Go 1.26 BDEPEND on lines 7 and 26. Moderate (1 vote): add applicable BSD-2 and MIT license identifiers. Nit (1 vote): add update/security changelog entries and affected CVEs.
sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-0.7.0-r3.ebuild	Adds the stable package revision. Critical (2 votes): add explicit Go 1.26 BDEPEND. Moderate (1 vote): add applicable license identifiers. Nit (2 votes): add release metadata under changelog/updates.

Review details

Suppressed comments (3)

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:26

• The source commit's archive has no bin/ directory (it is listed as generated in upstream .gitignore), and go build -o does not create missing parent directories. This makes src_compile fail before installation; create the directory first or write the output to an existing path.

	go build -o bin/locksmithctl ./locksmithctl

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:16

• This security-driven package update has no changelog entry, and the PR checklist still leaves changelog unchecked. Add the release entry under changelog/updates and the affected CVEs under changelog/security, following current entries such as changelog/updates/2026-09-08-weekly-updates.md and changelog/security/2026-06-05-weekly-updates.md, before merging.

	EGIT_VERSION="ec045e63f89b86b6c8ba0c61591d6e13f3e16362" # krnowak/deps-bump

sdk_container/src/third_party/coreos-overlay/app-admin/locksmith/locksmith-9999.ebuild:16

• The new dependency set is not covered by LICENSE="Apache-2.0" alone: the vendored modules include BSD-2 and MIT-licensed code (for example godbus and json-iterator), while this tree's go-module.eclass requires licenses for statically linked dependencies. Add all applicable identifiers here, as the etcd ebuild does.

	EGIT_VERSION="ec045e63f89b86b6c8ba0c61591d6e13f3e16362" # krnowak/deps-bump

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.