/usr/portage/distfiles/hg-src is currently labeled portage_ebuild_t by default but it needs to be labeled portage_srcrepo_t for mercurial to work. Right now, this causes ebuilds that fetch their source using mercurial.eclass to fail with "Permission denied" errors from mercurial.
Thanks. This has been committed to our policy repository. You can temporarily enable this manually through the following command if you can't wait for the new policy release: ~# semanage fcontext -a -t portage_srcrepo_t "/usr/portage/hg-src(/.*)?"
r4 now in tree, ~arch
stable