gentoo resync : 06.04.2022

3 files changed, 63 insertions, 0 deletions

diff --git a/app-forensics/volatility3/Manifest b/app-forensics/volatility3/Manifest
new file mode 100644
index 000000000000..bfe4bbda5b75
--- /dev/null
+++ b/app-forensics/volatility3/Manifest
@@ -0,0 +1,3 @@
+DIST volatility3-2.0.1.tar.gz 427679 BLAKE2B eb9b4ebb885a8dd4de2769c666b503da4bef792389efbf487815808fd514cf84f7f10b5a12926cf398a4028e7b72a5b78892c4c92d3709fea37fe13a6f32af7d SHA512 752b3fc23b3668df4329f6dbefa2ff8eb2dd63bc6e22e18774096cebae93053567727e3dc6e5ecbf7a0731459c829c37cea8ac735564c62f96a4f652ad2b6cb9
+EBUILD volatility3-2.0.1.ebuild 1070 BLAKE2B 4e34bf20c94cbbaff69de8b371a4770564b026c406ef0e0df92b993edd243a79d3298c5b123888126aab9fa3ed7b042d09ab56f24b4768274a33a7c0cce3c773 SHA512 5a75000f80c3259da64f5392548dac7c48765c81ec6a2cca5269355881f245f0ee61295e2abf9f0fe6f17776b154476ececa7a729ac0750ea11c628004add1e6
+MISC metadata.xml 1304 BLAKE2B 2a972904591d4b6019a24839ac7d04a72332dd77e13beb7542c5dab31101ecdf1f4e69da5e72cdc41a5770360168df42edc745385f65d209e3161018c176a690 SHA512 0531a76f7bcb899e051ae30bf05b0f12e9fecab178837dd57907520ec94c6c96dceb7d6ac0d6aac2629ae559580f5e180409d55aecf8cca208c0ed89724590ff
diff --git a/app-forensics/volatility3/metadata.xml b/app-forensics/volatility3/metadata.xml
new file mode 100644
index 000000000000..edbcd55f84f9
--- /dev/null
+++ b/app-forensics/volatility3/metadata.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person" proxied="yes">
+		<email>mario.haustein@hrz.tu-chemnitz.de</email>
+		<name>Mario Haustein</name>
+	</maintainer>
+	<maintainer type="person">
+		<email>sam@gentoo.org</email>
+		<name>Sam James</name>
+	</maintainer>
+	<longdescription>
+		Volatility is the world's most widely used framework for extracting
+		digital artifacts from volatile memory (RAM) samples. The extraction
+		techniques are performed completely independent of the system being
+		investigated but offer visibility into the runtime state of the system.
+	</longdescription>
+	<use>
+		<flag name='crypt'>support plugins that decrypt passwords, password hashes, etc.</flag>
+		<flag name='disasm'>support plugins that perform malware analysis and disassemble code</flag>
+		<flag name='jsonschema'>improve error messages regarding improperly configured ISF files</flag>
+		<flag name='leechcore'>support memory acquisition via leechcore</flag>
+		<flag name='snappy'>support AVMLs native compression format</flag>
+		<flag name='yara'>support YARA pattern matching engine</flag>
+	</use>
+	<upstream>
+		<remote-id type="github">volatilityfoundation/volatility3</remote-id>
+	</upstream>
+</pkgmetadata>
diff --git a/app-forensics/volatility3/volatility3-2.0.1.ebuild b/app-forensics/volatility3/volatility3-2.0.1.ebuild
new file mode 100644
index 000000000000..c8b4955f0506
--- /dev/null
+++ b/app-forensics/volatility3/volatility3-2.0.1.ebuild
@@ -0,0 +1,31 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{8..10} )
+inherit distutils-r1
+
+MY_PV=${PV//_beta/-beta.}
+
+DESCRIPTION="Framework for analyzing volatile memory"
+HOMEPAGE="https://github.com/volatilityfoundation/volatility3/ https://www.volatilityfoundation.org/"
+SRC_URI="https://github.com/volatilityfoundation/volatility3/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}"/${PN}-${MY_PV}
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="crypt disasm jsonschema leechcore snappy yara"
+
+RDEPEND="
+	>=dev-python/pefile-2017.8.1[${PYTHON_USEDEP}]
+	crypt? ( >=dev-python/pycryptodome-3[${PYTHON_USEDEP}] )
+	disasm? ( >=dev-libs/capstone-3.0.5[python,${PYTHON_USEDEP}] )
+	jsonschema? ( >=dev-python/jsonschema-2.3.0[${PYTHON_USEDEP}] )
+	leechcore? ( >=dev-python/leechcorepyc-2.4.0[${PYTHON_USEDEP}] )
+	snappy? ( >=dev-python/snappy-0.6.0[${PYTHON_USEDEP}] )
+	yara? ( >=dev-python/yara-python-3.8.0[${PYTHON_USEDEP}] )
+"
+DEPEND="${RDEPEND}"