gentoo resync : 16.06.2018

15 files changed, 110 insertions, 170 deletions

diff --git a/eclass/Manifest.gz b/eclass/Manifest.gz
index 0827dd660ffd..257997b99096 100644
--- a/eclass/Manifest.gz
+++ b/eclass/Manifest.gz
diff --git a/eclass/bash-completion-r1.eclass b/eclass/bash-completion-r1.eclass
index eff5e68c437e..0a457676ee56 100644
--- a/eclass/bash-completion-r1.eclass
+++ b/eclass/bash-completion-r1.eclass
@@ -98,6 +98,7 @@ dobashcomp() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	(
+		insopts -m 0644
 		insinto "$(_bash-completion-r1_get_bashcompdir)"
 		doins "${@}"
 	)
@@ -112,6 +113,7 @@ newbashcomp() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	(
+		insopts -m 0644
 		insinto "$(_bash-completion-r1_get_bashcompdir)"
 		newins "${@}"
 	)
diff --git a/eclass/desktop.eclass b/eclass/desktop.eclass
index d65b0d0bf074..91521b85a821 100644
--- a/eclass/desktop.eclass
+++ b/eclass/desktop.eclass
@@ -195,6 +195,7 @@ make_desktop_entry() {
 	(
 		# wrap the env here so that the 'insinto' call
 		# doesn't corrupt the env of the caller
+		insopts -m 0644
 		insinto /usr/share/applications
 		doins "${desktop}"
 	) || die "installing desktop file failed"
@@ -228,6 +229,7 @@ make_session_desktop() {
 	(
 	# wrap the env here so that the 'insinto' call
 	# doesn't corrupt the env of the caller
+	insopts -m 0644
 	insinto /usr/share/xsessions
 	doins "${desktop}"
 	)
@@ -243,6 +245,7 @@ domenu() {
 	# wrap the env here so that the 'insinto' call
 	# doesn't corrupt the env of the caller
 	local i j ret=0
+	insopts -m 0644
 	insinto /usr/share/applications
 	for i in "$@" ; do
 		if [[ -f ${i} ]] ; then
@@ -269,6 +272,7 @@ newmenu() {
 	(
 	# wrap the env here so that the 'insinto' call
 	# doesn't corrupt the env of the caller
+	insopts -m 0644
 	insinto /usr/share/applications
 	newins "$@"
 	)
@@ -282,6 +286,7 @@ _iconins() {
 	(
 	# wrap the env here so that the 'insinto' call
 	# doesn't corrupt the env of the caller
+	insopts -m 0644
 	local funcname=$1; shift
 	local size dir
 	local context=apps
diff --git a/eclass/eutils.eclass b/eclass/eutils.eclass
index 7840afbb77b9..81621df78e63 100644
--- a/eclass/eutils.eclass
+++ b/eclass/eutils.eclass
@@ -172,6 +172,7 @@ make_wrapper() {
 
 	if [[ -n ${path} ]] ; then
 		(
+		exeopts -m 0755
 		exeinto "${path}"
 		newexe "${tmpwrapper}" "${wrapper}"
 		) || die
diff --git a/eclass/git-r3.eclass b/eclass/git-r3.eclass
index 279f03269314..7fe9bcb40fa4 100644
--- a/eclass/git-r3.eclass
+++ b/eclass/git-r3.eclass
@@ -10,7 +10,10 @@
 # git as remote repository.
 
 case "${EAPI:-0}" in
-	0|1|2|3|4|5|6|7)
+	0|1|2|3)
+		die "Unsupported EAPI=${EAPI} (obsolete) for ${ECLASS}"
+		;;
+	4|5|6|7)
 		;;
 	*)
 		die "Unsupported EAPI=${EAPI} (unknown) for ${ECLASS}"
@@ -23,9 +26,9 @@ if [[ ! ${_GIT_R3} ]]; then
 
 if [[ ! ${_INHERITED_BY_GIT_2} ]]; then
 	if [[ ${EAPI:-0} != [0123456] ]]; then
-		BDEPEND=">=dev-vcs/git-1.8.2.1"
+		BDEPEND=">=dev-vcs/git-1.8.2.1[curl]"
 	else
-		DEPEND=">=dev-vcs/git-1.8.2.1"
+		DEPEND=">=dev-vcs/git-1.8.2.1[curl]"
 	fi
 fi
 
@@ -651,31 +654,6 @@ git-r3_fetch() {
 			local fetch_command=( git fetch "${r}" )
 			local clone_type=${EGIT_CLONE_TYPE}
 
-			if [[ ${r} == http://* || ${r} == https://* ]] &&
-					[[ ! ${EGIT_CURL_WARNED} ]]
-			then
-				case ${EAPI:-0} in
-					0|1|2|3|4)
-						ROOT=/ has_version 'dev-vcs/git[curl]';;
-					5|6)
-						has_version --host-root 'dev-vcs/git[curl]';;
-					*)
-						has_version -b 'dev-vcs/git[curl]';;
-				esac
-
-				if [[ ${?} -ne 0 ]]; then
-					ewarn "git-r3: fetching from HTTP(S) requested. In order to support HTTP(S),"
-					ewarn "dev-vcs/git needs to be built with USE=curl. Example solution:"
-					ewarn
-					ewarn "	echo dev-vcs/git curl >> /etc/portage/package.use"
-					ewarn "	emerge -1v dev-vcs/git"
-					ewarn
-					ewarn "HTTP(S) URIs will be skipped."
-				fi
-
-				EGIT_CURL_WARNED=1
-			fi
-
 			if [[ ${clone_type} == mirror ]]; then
 				fetch_command+=(
 					--prune
diff --git a/eclass/gnome2-utils.eclass b/eclass/gnome2-utils.eclass
index 9b4296c11fad..65076ae2d61e 100644
--- a/eclass/gnome2-utils.eclass
+++ b/eclass/gnome2-utils.eclass
@@ -207,7 +207,9 @@ gnome2_gconf_uninstall() {
 # @FUNCTION: gnome2_icon_savelist
 # @DESCRIPTION:
 # Find the icons that are about to be installed and save their location
-# in the GNOME2_ECLASS_ICONS environment variable.
+# in the GNOME2_ECLASS_ICONS environment variable. This is only
+# necessary for eclass implementations that call
+# gnome2_icon_cache_update conditionally.
 # This function should be called from pkg_preinst.
 gnome2_icon_savelist() {
 	has ${EAPI:-0} 0 1 2 && ! use prefix && ED="${D}"
@@ -218,8 +220,7 @@ gnome2_icon_savelist() {
 
 # @FUNCTION: gnome2_icon_cache_update
 # @DESCRIPTION:
-# Updates Gtk+ icon cache files under /usr/share/icons if the current ebuild
-# have installed anything under that location.
+# Updates Gtk+ icon cache files under /usr/share/icons.
 # This function should be called from pkg_postinst and pkg_postrm.
 gnome2_icon_cache_update() {
 	has ${EAPI:-0} 0 1 2 && ! use prefix && EROOT="${ROOT}"
@@ -358,7 +359,8 @@ gnome2_scrollkeeper_update() {
 # @FUNCTION: gnome2_schemas_savelist
 # @DESCRIPTION:
 # Find if there is any GSettings schema to install and save the list in
-# GNOME2_ECLASS_GLIB_SCHEMAS variable.
+# GNOME2_ECLASS_GLIB_SCHEMAS variable. This is only necessary for eclass
+# implementations that call gnome2_schemas_update conditionally.
 # This function should be called from pkg_preinst.
 gnome2_schemas_savelist() {
 	has ${EAPI:-0} 0 1 2 && ! use prefix && ED="${D}"
@@ -370,7 +372,7 @@ gnome2_schemas_savelist() {
 # @FUNCTION: gnome2_schemas_update
 # @USAGE: gnome2_schemas_update
 # @DESCRIPTION:
-# Updates GSettings schemas if GNOME2_ECLASS_GLIB_SCHEMAS has some.
+# Updates GSettings schemas.
 # This function should be called from pkg_postinst and pkg_postrm.
 gnome2_schemas_update() {
 	has ${EAPI:-0} 0 1 2 && ! use prefix && EROOT="${ROOT}"
diff --git a/eclass/kde5-functions.eclass b/eclass/kde5-functions.eclass
index 0fbff9846a6a..89fa32146ae1 100644
--- a/eclass/kde5-functions.eclass
+++ b/eclass/kde5-functions.eclass
@@ -34,22 +34,24 @@ export KDE_BUILD_TYPE
 
 case ${CATEGORY} in
 	kde-frameworks)
-		[[ ${PV} = 5.43* ]] && : ${QT_MINIMAL:=5.7.1}
 		[[ ${KDE_BUILD_TYPE} = live ]] && : ${FRAMEWORKS_MINIMAL:=9999}
 		;;
 	kde-plasma)
-		[[ ${PV} = 5.11.5* ]] && : ${QT_MINIMAL:=5.7.1}
-		[[ ${PV} = 5.12.5* ]] && : ${QT_MINIMAL:=5.9.1}
+		if [[ ${PV} = 5.12.5* ]]; then
+			: ${FRAMEWORKS_MINIMAL:=5.43.0}
+			: ${QT_MINIMAL:=5.9.1}
+		fi
 		if [[ ${KDE_BUILD_TYPE} = live && ${PV} != 5.12* ]]; then
 			: ${FRAMEWORKS_MINIMAL:=9999}
 			: ${QT_MINIMAL:=5.10.1}
 		fi
 		;;
 	kde-apps)
-		[[ ${PV} = 17.12.3* ]] && : ${QT_MINIMAL:=5.9.1}
-		if [[ ${KDE_BUILD_TYPE} = live || ${PV} = 18.04* ]]; then
-			: ${FRAMEWORKS_MINIMAL:=5.44.0}
+		if [[ ${PV} = 17.12.3* ]]; then
+			: ${FRAMEWORKS_MINIMAL:=5.43.0}
+			: ${QT_MINIMAL:=5.9.1}
 		fi
+		[[ ${PV} = 18.04.2* ]] && : ${FRAMEWORKS_MINIMAL:=5.44.0}
 		;;
 esac
 
@@ -61,17 +63,17 @@ esac
 # @ECLASS-VARIABLE: FRAMEWORKS_MINIMAL
 # @DESCRIPTION:
 # Minimum version of Frameworks to require. This affects add_frameworks_dep.
-: ${FRAMEWORKS_MINIMAL:=5.43.0}
+: ${FRAMEWORKS_MINIMAL:=5.46.0}
 
 # @ECLASS-VARIABLE: PLASMA_MINIMAL
 # @DESCRIPTION:
 # Minimum version of Plasma to require. This affects add_plasma_dep.
-: ${PLASMA_MINIMAL:=5.11.5}
+: ${PLASMA_MINIMAL:=5.12.5}
 
 # @ECLASS-VARIABLE: KDE_APPS_MINIMAL
 # @DESCRIPTION:
 # Minimum version of KDE Applications to require. This affects add_kdeapps_dep.
-: ${KDE_APPS_MINIMAL:=14.12.0}
+: ${KDE_APPS_MINIMAL:=17.12.3}
 
 # @ECLASS-VARIABLE: KDE_GCC_MINIMAL
 # @DEFAULT_UNSET
diff --git a/eclass/php-pear-r1.eclass b/eclass/php-pear-r1.eclass
deleted file mode 100644
index 990ba3796947..000000000000
--- a/eclass/php-pear-r1.eclass
+++ /dev/null
@@ -1,122 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# @DEAD
-# @ECLASS: php-pear-r1.eclass
-# @MAINTAINER:
-# Gentoo PHP Team <php-bugs@gentoo.org>
-# @AUTHOR:
-# Author: Tal Peer <coredumb@gentoo.org>
-# Author: Luca Longinotti <chtekk@gentoo.org>
-# @BLURB: Provides means for an easy installation of PEAR packages.
-# @DESCRIPTION:
-# This eclass provides means for an easy installation of PEAR packages.
-# For more information on PEAR, see http://pear.php.net/
-# Note that this eclass doesn't handle dependencies of PEAR packages
-# on purpose; please use (R)DEPEND to define them correctly!
-
-inherit multilib
-
-EXPORT_FUNCTIONS pkg_setup src_install
-
-case "${EAPI:-0}" in
-	0|1|2|3|4)
-		PHP_DEPEND="dev-lang/php"
-		;;
-	5|6)
-		# Repoman will complain about the missing slot in newer EAPIs.
-		PHP_DEPEND="dev-lang/php:*"
-		;;
-	*)
-		die "Unsupported EAPI=${EAPI} (unknown) for ${ECLASS}"
-		;;
-esac
-
-DEPEND="${PHP_DEPEND}
-	 >=dev-php/pear-1.8.1"
-RDEPEND="${DEPEND}"
-
-# @ECLASS-VARIABLE: PHP_PEAR_PKG_NAME
-# @DESCRIPTION:
-# Set this if the the PEAR package name differs from ${PN/PEAR-/}
-# (generally shouldn't be the case).
-[[ -z "${PHP_PEAR_PKG_NAME}" ]] && PHP_PEAR_PKG_NAME="${PN/PEAR-/}"
-
-fix_PEAR_PV() {
-	local tmp="${PV}"
-	tmp="${tmp/_/}"
-	tmp="${tmp/rc/RC}"
-	tmp="${tmp/beta/b}"
-	tmp="${tmp/alpha/a}"
-	PEAR_PV="${tmp}"
-}
-
-# @ECLASS-VARIABLE: PEAR_PV
-# @DESCRIPTION:
-# Set in ebuild if the eclass ${PV} mangling breaks SRC_URI for alpha/beta/rc versions
-[[ -z "${PEAR_PV}" ]] && fix_PEAR_PV
-
-PEAR_PN="${PHP_PEAR_PKG_NAME}-${PEAR_PV}"
-: ${PHP_PEAR_URI:=pear.php.net}
-: ${PHP_PEAR_CHANNEL:=${FILESDIR}/channel.xml}
-
-[[ -z "${SRC_URI}" ]] && SRC_URI="http://${PHP_PEAR_URI}/get/${PEAR_PN}.tgz"
-[[ -z "${HOMEPAGE}" ]] && HOMEPAGE="http://${PHP_PEAR_URI}/${PHP_PEAR_PKG_NAME}"
-
-S="${WORKDIR}/${PEAR_PN}"
-
-# @FUNCTION: php-pear-lib-r1_pkg_setup
-# @DESCRIPTION:
-# Adds required PEAR channel if necessary
-php-pear-r1_pkg_setup() {
-	if [[ -f $PHP_PEAR_CHANNEL ]]; then
-		pear channel-add $PHP_PEAR_CHANNEL || einfo "Ignore any errors about existing channels"
-	fi
-}
-
-# @FUNCTION: php-pear-r1_src_install
-# @DESCRIPTION:
-# Takes care of standard install for PEAR packages.
-php-pear-r1_src_install() {
-	# SNMP support
-	addpredict /usr/share/snmp/mibs/.index
-	addpredict /var/lib/net-snmp/
-	addpredict /var/lib/net-snmp/mib_indexes
-	addpredict /session_mm_cli0.sem
-
-	PHP_BIN="/usr/bin/php"
-
-	cd "${S}"
-
-	# metadata_dir needs to be set relative to ${D} for >=dev-php/PEAR-PEAR-1.10
-	if [[ -f "${WORKDIR}"/package2.xml ]] ; then
-		mv -f "${WORKDIR}/package2.xml" "${S}"
-		if has_version '>=dev-php/PEAR-PEAR-1.7.0' ; then
-			local WWW_DIR="/usr/share/webapps/${PN}/${PVR}/htdocs"
-			peardev -d php_bin="${PHP_BIN}" -d www_dir="${WWW_DIR}" -d metadata_dir="/usr/share/php" \
-				install --force --loose --nodeps --offline --packagingroot="${D}" \
-				"${S}/package2.xml" || die "Unable to install PEAR package"
-		else
-			peardev -d php_bin="${PHP_BIN}" install --force --loose --nodeps --offline --packagingroot="${D}" \
-				"${S}/package2.xml" || die "Unable to install PEAR package"
-		fi
-	else
-		mv -f "${WORKDIR}/package.xml" "${S}"
-		if has_version '>=dev-php/PEAR-PEAR-1.7.0' ; then
-			local WWW_DIR="/usr/share/webapps/${PN}/${PVR}/htdocs"
-			peardev -d php_bin="${PHP_BIN}" -d www_dir="${WWW_DIR}" -d metadata_dir="/usr/share/php" \
-				install --force --loose --nodeps --offline --packagingroot="${D}" \
-				"${S}/package.xml" || die "Unable to install PEAR package"
-		else
-			peardev -d php_bin="${PHP_BIN}" install --force --loose --nodeps --offline --packagingroot="${D}" \
-				"${S}/package.xml" || die "Unable to install PEAR package"
-		fi
-	fi
-
-	rm -Rf "${D}/usr/share/php/.channels" \
-	"${D}/usr/share/php/.depdblock" \
-	"${D}/usr/share/php/.depdb" \
-	"${D}/usr/share/php/.filemap" \
-	"${D}/usr/share/php/.lock" \
-	"${D}/usr/share/php/.registry"
-}
diff --git a/eclass/postgres.eclass b/eclass/postgres.eclass
index 2f89da15c937..221b53dea4d7 100644
--- a/eclass/postgres.eclass
+++ b/eclass/postgres.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 
 inherit user
@@ -26,7 +26,7 @@ esac
 # @DESCRIPTION:
 # List of versions to reverse sort POSTGRES_COMPAT slots
 
-_POSTGRES_ALL_VERSIONS=( 11 10 9.6 9.5 9.4 9.3 9.2 )
+_POSTGRES_ALL_VERSIONS=( 12 11 10 9.6 9.5 9.4 9.3 9.2 )
 
 
 
diff --git a/eclass/python-r1.eclass b/eclass/python-r1.eclass
index 8a8adb449cc3..097a965272d8 100644
--- a/eclass/python-r1.eclass
+++ b/eclass/python-r1.eclass
@@ -810,6 +810,7 @@ python_replicate_script() {
 		python_export PYTHON_SCRIPTDIR
 
 		(
+			exeopts -m 0755
 			exeinto "${PYTHON_SCRIPTDIR#${EPREFIX}}"
 			doexe "${files[@]}"
 		)
diff --git a/eclass/python-utils-r1.eclass b/eclass/python-utils-r1.eclass
index 3a462e34614a..ab4db71422d2 100644
--- a/eclass/python-utils-r1.eclass
+++ b/eclass/python-utils-r1.eclass
@@ -789,6 +789,7 @@ python_newexe() {
 
 	(
 		dodir "${wrapd}"
+		exeopts -m 0755
 		exeinto "${d}"
 		newexe "${f}" "${newfn}" || return ${?}
 	)
@@ -920,6 +921,7 @@ python_domodule() {
 	fi
 
 	(
+		insopts -m 0644
 		insinto "${d}"
 		doins -r "${@}" || return ${?}
 	)
@@ -954,6 +956,7 @@ python_doheader() {
 	d=${PYTHON_INCLUDEDIR#${EPREFIX}}
 
 	(
+		insopts -m 0644
 		insinto "${d}"
 		doins -r "${@}" || return ${?}
 	)
diff --git a/eclass/scons-utils.eclass b/eclass/scons-utils.eclass
index 5335968bc52e..615e00e314ad 100644
--- a/eclass/scons-utils.eclass
+++ b/eclass/scons-utils.eclass
@@ -9,6 +9,14 @@
 # This eclass provides a set of function to help developers sanely call
 # dev-util/scons and pass parameters to it.
 #
+# As of dev-util/scons-3.0.1-r100, SCons supports Python 3.  Since
+# SCons* files in build systems are written as Python, all packages
+# need to explicitly verify which versions of Python are supported
+# and use appropriate Python suite eclass to select the implementation.
+# The eclass needs to be inherited before scons-utils, and scons-utils
+# will automatically take advantage of it. For more details, please see:
+# https://wiki.gentoo.org/wiki/Project:Python/scons-utils_integration
+#
 # Please note that SCons is more like a 'build system creation kit',
 # and requires a lot of upstream customization to be used sanely.
 # You will often need to request fixes upstream and/or patch the build
@@ -26,7 +34,8 @@
 #
 # @EXAMPLE:
 # @CODE
-# inherit scons-utils toolchain-funcs
+# PYTHON_COMPAT=( python2_7 )
+# inherit python-any-r1 scons-utils toolchain-funcs
 #
 # EAPI=5
 #
@@ -93,7 +102,7 @@
 # -- EAPI support check --
 
 case ${EAPI:-0} in
-	0|1|2|3|4|5|6) ;;
+	0|1|2|3|4|5|6|7) ;;
 	*) die "EAPI ${EAPI} unsupported."
 esac
 
@@ -102,9 +111,38 @@ inherit multiprocessing
 # -- ebuild variables setup --
 
 if [[ -n ${SCONS_MIN_VERSION} ]]; then
-	BDEPEND=">=dev-util/scons-${SCONS_MIN_VERSION}"
+	SCONS_DEPEND=">=dev-util/scons-${SCONS_MIN_VERSION}"
 else
-	BDEPEND="dev-util/scons"
+	SCONS_DEPEND="dev-util/scons"
+fi
+
+if [[ ${_PYTHON_ANY_R1} ]]; then
+	# when using python-any-r1, use any-of dep API
+	BDEPEND="$(python_gen_any_dep "${SCONS_DEPEND}[\${PYTHON_USEDEP}]")"
+
+	scons-utils_python_check_deps() {
+		has_version "${SCONS_DEPEND}[${PYTHON_USEDEP}]"
+	}
+	python_check_deps() { scons-utils_python_check_deps; }
+elif [[ ${_PYTHON_SINGLE_R1} ]]; then
+	# when using python-single-r1, use plain PYTHON_USEDEP API
+	BDEPEND="${SCONS_DEPEND}[${PYTHON_USEDEP}]
+		${PYTHON_DEPS}"
+elif [[ ${EAPI:-0} == [0123456] ]]; then
+	# in older EAPIs, just force Python 2.7
+	BDEPEND="${SCONS_DEPEND}[python_targets_python2_7]"
+elif [[ ${_PYTHON_R1} ]]; then
+	# when using python-r1, you need to depend on scons yourself
+	# (depending on whether you need any-r1 or full -r1 API)
+	# -- since this is a breaking API change, it applies to EAPI 7+ only
+	BDEPEND=""
+elif [[ ${EAPI:-0} != [0123456] ]]; then
+	# in EAPI 7+, require appropriate eclass use
+	eerror "Using scons-utils.eclass without any python-r1 suite eclass is not supported."
+	eerror "Please make sure to configure and inherit appropriate -r1 eclass."
+	eerror "For more information and examples, please see:"
+	eerror "    https://wiki.gentoo.org/wiki/Project:Python/scons-utils_integration"
+	die "Invalid use of scons-utils.eclass"
 fi
 
 if [[ ${EAPI:-0} == [0123456] ]]; then
@@ -124,6 +162,24 @@ escons() {
 
 	debug-print-function ${FUNCNAME} "${@}"
 
+	if [[ ! ${EPYTHON} ]]; then
+		if [[ ${EAPI:-0} != [0123456] ]]; then
+			eerror "EPYTHON is unset while calling escons. This most likely means that"
+			eerror "the ebuild did not call the appropriate eclass function before calling scons."
+			if [[ ${_PYTHON_ANY_R1} ]]; then
+				eerror "Please ensure that python-any-r1_pkg_setup is called in pkg_setup()."
+			elif [[ ${_PYTHON_SINGLE_R1} ]]; then
+				eerror "Please ensure that python-single-r1_pkg_setup is called in pkg_setup()."
+			else # python-r1
+				eerror "Please ensure that python_setup is called before escons, or that escons"
+				eerror "is used within python_foreach_impl as appropriate."
+			fi
+			die "EPYTHON unset in escons"
+		else
+			local -x EPYTHON=python2.7
+		fi
+	fi
+
 	# Use myesconsargs in EAPI 5 and older
 	if [[ ${EAPI} == [012345] ]]; then
 		set -- "${myesconsargs[@]}" "${@}"
diff --git a/eclass/systemd.eclass b/eclass/systemd.eclass
index 6dda4353064a..72f4845efc45 100644
--- a/eclass/systemd.eclass
+++ b/eclass/systemd.eclass
@@ -151,6 +151,7 @@ systemd_dounit() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	(
+		insopts -m 0644
 		insinto "$(_systemd_get_systemunitdir)"
 		doins "${@}"
 	)
@@ -165,6 +166,7 @@ systemd_newunit() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	(
+		insopts -m 0644
 		insinto "$(_systemd_get_systemunitdir)"
 		newins "${@}"
 	)
@@ -179,6 +181,7 @@ systemd_douserunit() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	(
+		insopts -m 0644
 		insinto "$(_systemd_get_userunitdir)"
 		doins "${@}"
 	)
@@ -193,6 +196,7 @@ systemd_newuserunit() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	(
+		insopts -m 0644
 		insinto "$(_systemd_get_userunitdir)"
 		newins "${@}"
 	)
@@ -222,6 +226,7 @@ systemd_install_serviced() {
 	[[ ${service} == *.d ]] && die "Service must not have .d suffix"
 
 	(
+		insopts -m 0644
 		insinto /etc/systemd/system/"${service}".d
 		newins "${src}" 00gentoo.conf
 	)
@@ -241,6 +246,7 @@ systemd_dotmpfilesd() {
 	done
 
 	(
+		insopts -m 0644
 		insinto /usr/lib/tmpfiles.d/
 		doins "${@}"
 	)
@@ -258,6 +264,7 @@ systemd_newtmpfilesd() {
 		|| die 'tmpfiles.d files need to have .conf suffix.'
 
 	(
+		insopts -m 0644
 		insinto /usr/lib/tmpfiles.d/
 		newins "${@}"
 	)
@@ -320,6 +327,7 @@ systemd_enable_ntpunit() {
 	done
 
 	(
+		insopts -m 0644
 		insinto "$(_systemd_get_utildir)"/ntp-units.d
 		doins "${T}"/${ntpunit_name}.list
 	)
diff --git a/eclass/tmpfiles.eclass b/eclass/tmpfiles.eclass
index 746225784128..2a6e7ce8866a 100644
--- a/eclass/tmpfiles.eclass
+++ b/eclass/tmpfiles.eclass
@@ -76,6 +76,7 @@ dotmpfiles() {
 	done
 
 	(
+		insopts -m 0644
 		insinto /usr/lib/tmpfiles.d
 		doins "$@"
 	)
@@ -93,6 +94,7 @@ newtmpfiles() {
 	fi
 
 	(
+		insopts -m 0644
 		insinto /usr/lib/tmpfiles.d
 		newins "$@"
 	)
diff --git a/eclass/udev.eclass b/eclass/udev.eclass
index 5e5df0738805..b7c6461dd8ff 100644
--- a/eclass/udev.eclass
+++ b/eclass/udev.eclass
@@ -82,6 +82,7 @@ udev_dorules() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	(
+		insopts -m 0644
 		insinto "$(_udev_get_udevdir)"/rules.d
 		doins "${@}"
 	)
@@ -96,6 +97,7 @@ udev_newrules() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	(
+		insopts -m 0644
 		insinto "$(_udev_get_udevdir)"/rules.d
 		newins "${@}"
 	)