Merge branch 'master' into lenovo-y480

- 用功能更强大的 WebDAV 代替掉 OWSS
- WebDAV 和 v2raya 服务都拆成单独的配置文件

.gitignore

@@ -1 +1,2 @@
 /.log/
+tmp/

ansible/ansible.cfg

@@ -0,0 +1,3 @@
+[defaults]
+inventory = ./inventory.ini
+roles_path = ./roles

ansible/group_vars/vps_debian.yml

@@ -0,0 +1,4 @@
+---
+ansible_user: zedhugh
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_port: 44444

ansible/inventory.ini

@@ -0,0 +1,2 @@
+[vps_debian]
+yunyoo-tokyo

ansible/playbooks/frps.yaml

@@ -0,0 +1,86 @@
+---
+- name: 配置 frps 服务端
+  hosts: vps_debian
+  gather_facts: false
+  become: true
+  vars:
+    frp_version: "0.71.0"
+    frp_download_url: "https://github.com/fatedier/frp/releases/download/v{{ frp_version }}/frp_{{ frp_version }}_linux_amd64.tar.gz"
+    frp_tmp_dir: "{{ playbook_dir }}/../tmp"
+    frp_local_archive: "{{ frp_tmp_dir }}/frp_{{ frp_version }}_linux_amd64.tar.gz"
+    frp_local_tmp_dir: "{{ frp_tmp_dir }}/frp_{{ frp_version }}_linux_amd64"
+    frp_install_dir: "/opt/frp"
+    frp_config_dir: "/etc/frp"
+  vars_files:
+    - ../vars/vault.yaml
+
+  tasks:
+    - name: 创建 frp 目录
+      file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0755'
+      loop:
+        - "{{ frp_install_dir }}"
+        - "{{ frp_config_dir }}"
+
+    - name: 检查本地是否已有该版本的压缩包
+      stat:
+        path: "{{ frp_local_archive }}"
+      register: local_archive
+      delegate_to: localhost
+      run_once: true
+
+    - name: 下载 frp 压缩包到本地
+      get_url:
+        url: "{{ frp_download_url }}"
+        dest: "{{ frp_local_archive }}"
+        timeout: 60
+      delegate_to: localhost
+      run_once: true
+      become: false
+      when: not local_archive.stat.exists
+
+    - name: 解压 frp 压缩包到本地
+      unarchive:
+        src: "{{ frp_local_archive }}"
+        dest: "{{ frp_tmp_dir }}"
+        creates: "{{ frp_local_tmp_dir }}"
+      delegate_to: localhost
+      run_once: true
+      become: false
+      when: not local_archive.stat.exists
+
+    - name: 复制 frps 二进制文件到目标机器
+      copy:
+        src: "{{ frp_local_tmp_dir }}/frps"
+        dest: "{{ frp_install_dir }}/frps"
+        mode: '0755'
+      notify: restart frps
+
+    - name: 生成 frps.toml 配置文件
+      template:
+        src: ../templates/frps.toml.j2
+        dest: "{{ frp_config_dir }}/frps.toml"
+        mode: '0644'
+      notify: restart frps
+
+    - name: 创建 frps 的 systemd 服务文件
+      template:
+        src: ../templates/frps.service.j2
+        dest: /etc/systemd/system/frps.service
+        mode: '0644'
+      notify: restart frps
+
+    - name: 启用并启动 frps 服务
+      systemd:
+        name: frps
+        enabled: true
+        state: started
+        daemon_reload: true
+
+  handlers:
+    - name: restart frps
+      systemd:
+        name: frps
+        state: restarted

ansible/playbooks/shadowsocks-libev.yaml

@@ -0,0 +1,34 @@
+---
+- name: 配置 shadowsocks-libev 服务器
+  hosts: vps_debian
+  become: true
+  vars_files:
+    - ../vars/vault.yaml
+
+  tasks:
+    - name: 安装 shadowsocks-libev
+      apt:
+        name: shadowsocks-libev
+        state: present
+        update_cache: true
+
+    - name: 配置 shadowsocks-libev 服务器
+      template:
+        src: ../templates/ss-config.json.j2
+        dest: /etc/shadowsocks-libev/config.json
+        owner: root
+        group: root
+        mode: '0644'
+      notify: restart shadowsocks-libev server
+
+    - name: 启动 shadowsocks-libev 服务器
+      systemd:
+        name: shadowsocks-libev
+        enabled: true
+        state: started
+
+  handlers:
+    - name: restart shadowsocks-libev server
+      systemd:
+        name: shadowsocks-libev
+        state: restarted

ansible/playbooks/vps_debian_provision.yaml

@@ -0,0 +1,91 @@
+---
+- name: 新机器初始化
+  hosts: vps_debian
+  gather_facts: yes
+
+  vars:
+    ansible_user: root
+    ansible_ssh_port: 22
+
+    admin_user: zedhugh
+    ssh_port: 44444
+    timezone: Asia/Shanghai
+    ssh_public_key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
+
+  roles:
+    - role: bbr
+
+  tasks:
+    - name: 设置时区
+      timezone:
+        name: "{{ timezone }}"
+
+    - name: 创建管理员用户
+      user:
+        name: "{{ admin_user }}"
+        shell: /bin/bash
+        create_home: yes
+        state: present
+
+    - name: 确保 sudo 已安装
+      apt:
+        name: sudo
+        state: present
+
+    - name: 确保 sudoers.d 目录存在
+      file:
+        path: /etc/sudoers.d
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+
+    - name: 配置 sudo 免密码
+      copy:
+        content: "{{ admin_user }} ALL=(ALL) NOPASSWD: ALL\n"
+        dest: "/etc/sudoers.d/{{ admin_user }}"
+        owner: root
+        group: root
+        mode: '0440'
+        validate: '/usr/sbin/visudo -cf %s'
+
+    - name: 复制 SSH 密钥
+      authorized_key:
+        user: "{{ admin_user }}"
+        key: "{{ ssh_public_key }}"
+        state: present
+
+    - name: 修改 SSH 端口
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?Port "
+        line: "Port {{ ssh_port }}"
+      notify: restart ssh
+
+    - name: 禁止 root 密码登录
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PermitRootLogin"
+        line: "PermitRootLogin prohibit-password"
+      notify: restart ssh
+
+    - name: 禁止密码认证
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PasswordAuthentication"
+        line: "PasswordAuthentication no"
+      notify: restart ssh
+
+    - name: 开启公钥认证
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PubkeyAuthentication"
+        line: "PubkeyAuthentication yes"
+      notify: restart ssh
+
+
+  handlers:
+    - name: restart ssh
+      systemd:
+        name: sshd
+        state: restarted

ansible/playbooks/xray-server.yaml

@@ -0,0 +1,45 @@
+---
+- name: 配置 xray 服务
+  hosts: vps_debian
+  become: true
+  gather_facts: false
+  vars:
+    xray_config_file: /usr/local/etc/xray/config.json
+    xray_bin: /usr/local/bin/xray
+  vars_files:
+    - ../vars/vault.yaml
+
+  tasks:
+    - name: 确保有 curl 软件包
+      apt:
+        name:
+          - curl
+        state: present
+        update_cache: true
+
+    - name: 安装 xray
+      shell: |
+        bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
+      notify: restart xray
+
+    - name: 生成 xray 配置
+      template:
+        src: ../templates/xray-config.json.j2
+        dest: "{{ xray_config_file }}"
+        owner: root
+        group: root
+        mode: '0644'
+      notify: restart xray
+
+    - name: 启动 xray 服务并添加开机启动
+      systemd:
+        name: xray
+        enabled: true
+        state: started
+        daemon_reload: true
+
+  handlers:
+    - name: restart xray
+      systemd:
+        name: xray
+        state: restarted

ansible/roles/bbr/README.org

@@ -0,0 +1,9 @@
+#+title: TCP 拥塞控制算法设置为 BBR
+
+这个 role 是为了将服务器上的 linux 系统的 TCP 拥塞控制算法设置为 BBR 以提供更好的网络环境，
+主要时提高吞吐量，降低延迟和提升弱网稳定性。
+
+最开始是使用 =ansible= 的 =sysctl= 模块实现的，配置是写入 =/etc/sysctl.conf= 的，但后面发现重启机器后配置未生效。
+
+查询原因发现是 =systemd-sysctl= 不会读取 =/etc/sysctl.conf= ，读取的是 =/etc/sysctl.d= 目录下的配置文件。
+因此配置方式改为手动写入配置文件，不再直接使用 ansible 的 sysctl 模块。

ansible/roles/bbr/handlers/main.yaml

@@ -0,0 +1,4 @@
+---
+- name: reload sysctl
+  command: sysctl --system
+  changed_when: false

ansible/roles/bbr/tasks/config.yaml

@@ -0,0 +1,15 @@
+---
+- name: 启用 BBR
+  copy:
+    dest: /etc/sysctl.d/bbr.conf
+    content: |
+      net.core.default_qdisc=fq
+      net.ipv4.tcp_congestion_control=bbr
+    mode: '0644'
+    owner: root
+    group: root
+  notify: reload sysctl
+
+- name: 应用 sysctl 配置
+  command: sysctl --system
+  changed_when: false

ansible/roles/bbr/tasks/main.yaml

@@ -0,0 +1,4 @@
+---
+- import_tasks: config.yaml
+- import_tasks: module.yaml
+- import_tasks: verify.yaml

ansible/roles/bbr/tasks/module.yaml

@@ -0,0 +1,13 @@
+---
+- name: 开机加载 tcp_bbr 模块
+  copy:
+    dest: /etc/modules-load.d/bbr.conf
+    content: "tcp_bbr\n"
+    mode: '0644'
+    owner: root
+    group: root
+
+- name: 立即加载 tcp_bbr 模块
+  modprobe:
+    name: tcp_bbr
+    state: present

ansible/roles/bbr/tasks/verify.yaml

@@ -0,0 +1,19 @@
+---
+- name: 获取可用的 TCP 拥塞控制算法列表
+  command: sysctl net.ipv4.tcp_available_congestion_control
+  register: available_cc
+  changed_when: false
+
+- name: 确认 bbr 在可用列表中
+  fail:
+    msg: "BBR 不在可用的 TCP 拥塞控制算法列表中"
+  when: "'bbr' not in available_cc.stdout"
+
+- name: 验证当前拥塞控制算法
+  command: sysctl net.ipv4.tcp_congestion_control
+  register: current_cc
+  changed_when: false
+
+- name: 打印当前 TCP 拥塞控制算法
+  debug:
+    msg: "当前 TPC 拥塞控制算法: {{ current_cc.stdout }}"

ansible/templates/frps.service.j2

@@ -0,0 +1,13 @@
+[Uint]
+Description=Frp Server Service
+After=network.target
+
+[Service]
+Type=simple
+Restart=on-failure
+RestartSec=5s
+ExecStart={{ frp_install_dir }}/frps -c {{ frp_config_dir }}/frps.toml
+LimitNOFILE=1048576
+
+[Install]
+WantedBy=multi-user.target

ansible/templates/frps.toml.j2

@@ -0,0 +1,13 @@
+bindPort = {{ vault_frps_bind_port }}
+
+vhostHTTPPort = {{ vault_frps_vhost_http_port }}
+
+auth.method = "token"
+auth.token = "{{ vault_frps_token }}"
+
+webServer.addr = "127.0.0.1"
+webServer.port = {{ vault_frps_dashboard_port }}
+webServer.user = "{{ vault_frps_dashboard_user }}"
+webServer.password = "{{ vault_frps_dashboard_password }}"
+
+log.to = "/var/log/frps.log"

ansible/templates/ss-config.json.j2

@@ -0,0 +1,9 @@
+{
+    "server": "0.0.0.0",
+    "mode": "{{ vault_ss_mode }}",
+    "server_port": {{ vault_ss_server_port }},
+    "local_port": {{ vault_ss_local_port }},
+    "password": "{{ vault_ss_password }}",
+    "timeout": 60,
+    "method": "{{ vault_ss_method }}"
+}

ansible/templates/xray-config.json.j2

@@ -0,0 +1,44 @@
+{
+  "log": {
+    "loglevel": "warning",
+    "access": "/var/log/xray/access.log",
+    "error": "/var/log/xray/error.log"
+  },
+  "inbounds": [
+    {
+      "listen": "0.0.0.0",
+      "port": {{ vault_xray_port }},
+      "protocol": "vless",
+      "settings": {
+        "clients": [
+          {
+            "id": "{{ vault_xray_uuid }}",
+            "flow": "xtls-rprx-vision"
+          }
+        ],
+        "decryption": "none",
+        "udp": true
+      },
+      "streamSettings": {
+        "network": "tcp",
+        "security": "reality",
+        "realitySettings": {
+          "dest": "dl.google.com:443",
+          "serverNames": ["dl.google.com"],
+          "privateKey": "{{ vault_xray_private_key }}",
+          "shortIds": ["{{ vault_xray_short_id }}"]
+        }
+      },
+      "sniffing": {
+        "enabled": true,
+        "destOverride": ["http", "tls", "quic"]
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "protocol": "freedom",
+      "tag": "direct"
+    }
+  ]
+}

ansible/vars/vault.yaml

@@ -0,0 +1,34 @@
+$ANSIBLE_VAULT;1.1;AES256
+31326665376531376630356363393661653431613931326234643966653463393735366564323734
+3730396363393537306239663835373062306633646264310a343665376130396339333637346439
+38396237326237363265616437653564636436313732303365376630643033356166336236383831
+3837356238653537380a633130376466623963613361653738353665376239323864323430623063
+39343862633838333834303936346365666236653731346532336132383461316162666666656565
+65643731353635383037353132313534376466653031366133646332383830336662636263373566
+65393466306639363439303165353032666635323131633536643862643533666463313839383361
+33363434666532366666633935353466383134643731376236346661653765643830326537386630
+31656437653935636130356566616436346564306364343538306138353364633135333565393462
+37353037343861346438613430643561666462663831303332376238386135636538653431636466
+39633033613166316465313462656262343032303430346133386663623930376237633065656263
+35313263316466346437353237373538383632326534656365376630396136646530653165316637
+61333262386361326562353136393433663633663362326564386238366333656330343561323730
+36383761313864316135353332306134636661383430316538326436653436386430333762656134
+33373234386365663836356430366633316262646538636237303636636635373335336534373630
+38363131373666613430373031393036636632626338326436323635366462396639396661306439
+35663138346163306561393262323366636264386130313165383836353936633634613930656133
+39323330373232313265366565353061663665613365396166373734386432353931313638333466
+65333732333133613866313363356133353965323966373132326535383464303262353665636537
+34333237353365303136366338613664363936613063636663303861383161616337613532363162
+63353066646563353964623734636236613530636564393537633461336263303565376337653435
+38626230666430383533646561396232356665623962663334393461633365633839323866343031
+30333239666437626439373236663535373664326337333864656237333963616139653031313430
+34306336663533313536383435626161336130623333303034666235393266343935363466313431
+36653566396535656434346132313165626264313236363734306531316438656666333532343638
+30613432343834373166313063663333663930386636306165346536636336393438323464396635
+34393263633266356635623834306239663634323430313765323635626666633337663936636465
+34316637623736353239343430383366343063656430346230393538653834633364343830336435
+37313461626334346130343766363364643636643865383931376635333532363165343932616632
+39663665383833646131326534643737323364343033633135383333643136616532323931333439
+61326338636637353266383463383365383364663330653565386566353434303232643738343037
+62613065333961383136656236636234623338343466333232363861323034633738343035633535
+3733

docker/README.org

@@ -0,0 +1,17 @@
+#+title: docker 配置说明
+
+每个及其需要用到的 docker 都通过 =docker-compose.yaml= 配置，避免每次升级都自己手动写命令行。
+
+* 文件用途
+
+| 文件                 | 说明                      |
+|----------------------+---------------------------|
+| v2raya.yaml          | V2rayA 代理客户端容器配置 |
+| V2RayA-RoutingA.conf | V2rayA 路由配置           |
+| webdav.yaml          | webdav 服务容器配置       |
+| webdav-config.yaml   | webdav 配置文件           |
+
+* docker 镜像对应的 git 仓库
+
+- https://github.com/hacdias/webdav
+- https://github.com/v2rayA/v2rayA

docker/v2raya.yaml

@@ -0,0 +1,17 @@
+services:
+  v2raya:
+    image: mzz2017/v2raya:latest
+    container_name: v2raya
+    restart: always
+    privileged: true
+    network_mode: host
+    volumes:
+      - /lib/modules:/lib/modules:ro
+      - /etc/resolv.conf:/etc/resolv.conf
+      - /etc/v2raya:/etc/v2raya
+    environment:
+      # V2RAYA_V2RAY_BIN: /usr/local/bin/v2ray # 老版本用这个，要开 xray 不设置这个环境变量
+      # V2RAYA_V2RAY_BIN: /usr/bin/v2raya_core # 新版本用这个，或者不设置这个环境变量
+      V2RAYA_LOG_FILE: /tmp/v2raya.log
+      V2RAYA_NFTABLES_SUPPORT: off
+      IPTABLES_MODE: legacy

docker/webdav-config.yaml

@@ -0,0 +1,36 @@
+address: 0.0.0.0
+port: 46065
+auth: true
+prefix: /
+tls: false
+behindProxy: true
+log:
+  format: console
+  colors: true
+  outputs:
+    - /logs/webdav.log
+logLevel: info
+
+directory: /data
+permissions: R
+
+users:
+  - username: zedhugh
+    password: "{bcrypt}$2a$10$nP6GQJidzLyhwkkQGQH/KOAQq2KjNW5Fbb.I/XD2OD2oxCxEoXbUO"
+    directory: /data
+    permissions: CRUD
+
+  - username: PT
+    password: "{bcrypt}$2a$10$cK9NWvSafxne2Fv6P6ZH7.Q/tVKk5M4pqXgsuOi2bF/zsCopFHsC2"
+    directory: /data/users/PT
+    permissions: CRUD
+
+  - username: v2rayNG
+    password: "{bcrypt}$2a$10$jvjejyOea8Xqsik8a9M71.rvC/0kdFah2WuMCTKHBQJ8PxGkdFmKC"
+    directory: /data/users/v2rayNG
+    permissions: CRUD
+
+  - username: guest
+    password: "guest"
+    directory: /data/public
+    permissions: R

docker/webdav.yaml

@@ -0,0 +1,36 @@
+x-data-volume: &data-volume
+  type: bind
+  source: /var/db/webDAV
+  target: /data
+
+x-user-dirs: &user-dirs
+  /data/users/PT
+  /data/users/v2rayNG
+  /data/public
+
+services:
+  WebDAV-init:
+    image: busybox:latest
+    container_name: webdav-init
+    restart: no
+    volumes:
+      - *data-volume
+    environment:
+      DIRS: *user-dirs
+    command: sh -c "mkdir -p $$DIRS"
+
+  WebDAV:
+    image: hacdias/webdav:latest
+    container_name: webdav
+    restart: always
+    depends_on:
+      WebDAV-init:
+        condition: service_completed_successfully
+    command: ["-c", "/config.yaml"]
+    network_mode: host
+    volumes:
+      - ./webdav-config.yaml:/config.yaml:ro
+      - /var/log:/logs
+      - *data-volume
+    environment:
+      TZ: Asia/Shanghai

dot/.bashrc.d/proxy.bash

@@ -1,4 +1,4 @@
-proxy_ip="192.168.0.104"
+proxy_ip="127.0.0.1"
 proxy_http_port="20172"
 # SOCKS_PROXY="socks5://${PROXY_IP}:20170"
 

dot/.mozilla/autoproxy.pac

@@ -1,5 +1,5 @@
 /* -*- mode: js; -*- */
-const proxy_ip = "192.168.0.104"
+const proxy_ip = "127.0.0.1"
 const PROXY = `SOCKS5 ${proxy_ip}:20170; HTTP ${proxy_ip}:20172; DIRECT`;
 const DIRECT = 'DIRECT';
 
@@ -7,6 +7,7 @@ const direct_ip_list = [
     ["192.168.0.0", "255.255.255.0"],
     ["192.168.1.0", "255.255.255.0"],
     ["192.168.2.0", "255.255.255.0"],
+    ["192.168.5.0", "255.255.255.0"],
     ["127.0.0.1", "255.255.255.0"],
 ];
 

gentoo_portage/make.conf

@@ -20,8 +20,12 @@ QUICKPKG_DEFAULT_OPTS="--include-config y"
 BINPKG_FORMAT="gpkg"
 EMERGE_DEFAULT_OPTS="--buildpkg --buildpkg-exclude \"virtual/* sys-kernel/*-sources */*-bin\" ${EMERGE_DEFAULT_OPTS}"
 
-# ccache and distcc
+# distcc
-FEATURES="distcc ccache ${FEATURES}"
+FEATURES="distcc ${FEATURES}"
+DISTCC_DIR="/var/tmp/distcc"
+
+# ccache
+FEATURES="ccache ${FEATURES}"
 CCACHE_DIR="/var/cache/ccache"
 CCACHE_UMASK="0002"
 
@@ -29,13 +33,12 @@ CCACHE_UMASK="0002"
 ALSA_CARDS="hda-intel"
 GRUB_PLATFORMS="efi-64"
 INPUT_DEVICES="libinput"
-VIDEO_CARDS="amdgpu dummy fbdev intel nouveau nvidia radeon radeonsi vesa"
+VIDEO_CARDS="amdgpu dummy fbdev intel nouveau radeon radeonsi vesa"
 
 GENTOO_MIRRORS="
 http://distfiles.gentoo.org/
 "
-MAKEOPTS="-j9 ${MAKEOPTS}"
 
-DESKTOP_USE="X alsa apng dbus fbcon ffmpeg flac fuse gif gtk gtk2 gtk3 http2 icu jack jpeg mp3 mp4 mpeg mtp nvidia ogg opengl pdf png pipewire pulseaudio svg tiff unicode vaapi vdpau webp xinerama xv xvmc"
+DESKTOP_USE="X alsa apng dbus fbcon ffmpeg flac fuse gif gtk gtk2 gtk3 http2 icu jack jpeg mp3 mp4 mpeg mtp nvidia ogg opengl pdf png pipewire pulseaudio svg tiff unicode vaapi vdpau vulkan webp xinerama xv xvmc"
 #USE="${USE} ${DESKTOP_USE} consolekit cups policykit pulseaudio truetype udev xft xcb xkb -bluetooth -gpm -libva -modemmanager"
 USE="${USE} ${DESKTOP_USE} bluetooth cups elogind policykit truetype udev xft xcb xkb -gpm -libva -modemmanager"

gentoo_portage/package.accept_keywords

@@ -20,8 +20,8 @@ dev-util/android-studio ~amd64
 net-vpn/frp ~amd64
 
 # firefox
-dev-libs/nspr ~amd64
+# dev-libs/nspr ~amd64
-dev-libs/nss ~amd64
+# dev-libs/nss ~amd64
 www-client/firefox ~amd64
 
 # wechat

gentoo_portage/package.license

@@ -16,7 +16,7 @@ media-tv/plex-media-server Plex
 net-analyzer/nmap NPSL
 net-im/deepin-wine-wechat Tencent
 net-im/dingtalk all-rights-reserved
-net-im/wechat all-rights-reserved
+net-im/wechat Tencent-Weixin
 net-im/wechat-universal-bwrap all-rights-reserved
 net-im/wemeet wemeet_license
 net-misc/anydesk AnyDesk-TOS

gentoo_portage/package.use

@@ -8,7 +8,7 @@ sys-libs/zlib minizip
 sys-devel/gcc lto pgo
 
 # kernel
-sys-kernel/installkernel grub
+sys-kernel/installkernel dracut grub
 
 # terminal
 x11-terms/xterm sixel xinerama
@@ -71,7 +71,7 @@ net-fs/samba client
 net-libs/ngtcp2 gnutls
 
 # mpv
-media-video/mpv bluray dvd nvenc pipewire -vulkan
+media-video/mpv bluray dvd nvenc pipewire
 
 # pdf-tools need poppler-glib library
 app-text/poppler cairo

gentoo_portage/patches/app-text/sdcv/0001-Fix-build-with-GCC-14-and-modern-glib-const-correctn.patch

@@ -0,0 +1,43 @@
+From 5887505185b9129a2de6c4b36f1dbac5fe4e6358 Mon Sep 17 00:00:00 2001
+From: Norayr Chilingarian <norayr@arnet.am>
+Date: Sun, 18 May 2025 13:39:02 +0400
+Subject: [PATCH] Fix build with GCC 14 and modern glib: const correctness and
+ deprecated API
+
+- Use 'const gchar*' for result of g_utf8_next_char() to satisfy GCC 14's stricter const rules
+- Remove incorrect g_free() on non-allocated pointer from g_utf8_next_char()
+- Replace deprecated g_pattern_match_string() with g_pattern_spec_match_string()
+---
+ src/stardict_lib.cpp | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/stardict_lib.cpp b/src/stardict_lib.cpp
+index 83fbc59..13cf779 100644
+--- a/src/stardict_lib.cpp
++++ b/src/stardict_lib.cpp
+@@ -989,7 +989,7 @@ bool Dict::LookupWithRule(GPatternSpec *pspec, glong *aIndex, int iBuffLen)
+     int iIndexCount = 0;
+ 
+     for (guint32 i = 0; i < narticles() && iIndexCount < (iBuffLen - 1); i++)
+-        if (g_pattern_match_string(pspec, get_key(i)))
++        if (g_pattern_spec_match_string(pspec, get_key(i)))
+             aIndex[iIndexCount++] = i;
+ 
+     aIndex[iIndexCount] = -1; // -1 is the end.
+@@ -1047,12 +1047,11 @@ bool Libs::LookupSimilarWord(const gchar *sWord, std::set<glong> &iWordIndices,
+         }
+         // Upper the first character and lower others.
+         if (!bFound) {
+-            gchar *nextchar = g_utf8_next_char(sWord);
++            const gchar *nextchar = g_utf8_next_char(sWord);
+             gchar *firstchar = g_utf8_strup(sWord, nextchar - sWord);
+             nextchar = g_utf8_strdown(nextchar, -1);
+             casestr = g_strdup_printf("%s%s", firstchar, nextchar);
+             g_free(firstchar);
+-            g_free(nextchar);
+             if (strcmp(casestr, sWord)) {
+                 if (oLib[iLib]->Lookup(casestr, iWordIndices))
+                     bFound = true;
+-- 
+2.55.0
+

gentoo_portage/patches/app-text/sdcv/0001-fix-memory-leak-instroduced-in-110.patch

@@ -0,0 +1,32 @@
+From 849f0ed1ac24b21530b2085ae17b85a98fa04a59 Mon Sep 17 00:00:00 2001
+From: "Evgeniy A. Dushistov" <dushistov@mail.ru>
+Date: Sun, 17 Aug 2025 13:43:07 +0300
+Subject: [PATCH] fix: memory leak instroduced in #110
+
+---
+ src/stardict_lib.cpp | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/stardict_lib.cpp b/src/stardict_lib.cpp
+index 13cf779..6b0d55c 100644
+--- a/src/stardict_lib.cpp
++++ b/src/stardict_lib.cpp
+@@ -1047,10 +1047,11 @@ bool Libs::LookupSimilarWord(const gchar *sWord, std::set<glong> &iWordIndices,
+         }
+         // Upper the first character and lower others.
+         if (!bFound) {
+-            const gchar *nextchar = g_utf8_next_char(sWord);
+-            gchar *firstchar = g_utf8_strup(sWord, nextchar - sWord);
+-            nextchar = g_utf8_strdown(nextchar, -1);
+-            casestr = g_strdup_printf("%s%s", firstchar, nextchar);
++            const gchar *rest = g_utf8_next_char(sWord);
++            gchar *firstchar = g_utf8_strup(sWord, rest - sWord);
++            gchar *rest_lowercase = g_utf8_strdown(rest, -1);
++            casestr = g_strdup_printf("%s%s", firstchar, rest_lowercase);
++            g_free(rest_lowercase);
+             g_free(firstchar);
+             if (strcmp(casestr, sWord)) {
+                 if (oLib[iLib]->Lookup(casestr, iWordIndices))
+-- 
+2.55.0
+