masters = gentoo
thin-manifests = true
sign-manifests = false
manifest-hashes = BLAKE2B SHA512
manifest-required-hashes = BLAKE2B
cache-formats = md5-dict

# Allow RESTRICT="network-sandbox" in this overlay. It is a valid Portage
# RESTRICT (see ebuild(5)) but absent from gentoo's restrict-allowed because the
# manpage discourages it in the main tree. Some live ebuilds here legitimately
# need build-time network (e.g. claude-desktop fetches the latest release,
# shellcheck builds via cabal). pkgcheck unions this with the masters' list.
restrict-allowed = network-sandbox