ports-mgmt/pkg-devel: update to 2.8.99.1
Changes:
- security: bound vulnerability database downloads and decompression; build a temporary database and atomically replace it only after validation
- security: bound repository archive downloads and extraction (1 GiB or half of free temporary storage, 1 MiB metadata) and reject duplicate members and oversized target members
- security: bound repository signature extraction (8 MiB callback response, at most 8 signature entries of 1 MiB each)
- security: drop to nobody before entering Capsicum in the sandboxed archive and signature callbacks
- security: enforce the signed package size while fetching, capping the stream even when the server omits a Content-Length
- security: reject invalid repository signature types; only pubkey, fingerprints and none are accepted
- repo: keep file lists out of the data catalog
- repo: open the catalogue read-only when checking its validity
- rwhich: store the compressed filesite as a standalone file
- rwhich: verify the repository signature and store the filesite as a raw compressed file
- rwhich: add a global and a per-repository configuration
- fix: report (added)/(removed) reinstall reasons only once
- fix: use-after-free during the additional SAT cycle
- fix: deferred rc script execution
- rcscript: add a dedicated PKG_EVENT_RC_SCRIPT event for rc.d script actions
- fix: remove leftover nested @dir parents on deinstall
[6 lines not shown]
ports-mgmt/pkg: update to 2.8.2
Changes:
- lots of security improvements
- repo: keep file lists out of the data catalog
- rwhich: store filesite as a compressed archive locally.
- rwhich add global and per repository configuration of the file
database
- fix deferred rc script execution
- fix duplicated reinstall reason
- fix UAF in additional SAT cycle
- fix SRV/HTTP mirror handling
- respect compression level for file database and metadata
devel/libbacktrace: update to 20250929 snapshot
This update required to allow Boost to be built with backtrace support and GIL/ZSTD support
With hat: office/boost
mail/exim: daemon fails to create notifier socket on start if no correct exit (+)
Since recent version (e.g. 4.98) exim successfully creates notifier socket file in FreeBSD.
But if file already exists during exim start it's just ignored with error message in log.
Without notifier socket exim cannot check if there is already running exim daemon
with e.g. such condition: ${if eq {$queue_size} {} }.
Add socket file removing before daemon start.
exim_notifier_socket variable is added for notifier_socket setting overriding in exim configuration.
PR: 281615
Notified by: vvd
databases/openldap27-server: fix patch target for ldap.map.in
In OpenLDAP 2.7.0, ldap.map was changed to a template (ldap.map.in)
that is processed during configure. Update the post-patch sed target
accordingly to fix build failure when DEBUG option is disabled.
Reported by: sunpoet
x11/lightdm: Update to 1.33.0
- Download distribution using GITHUB
- Stop limiting portscout to even versions
- Add QT6 support option, alternative to QT5
- Remove upstreamed patches
- Fix vt multiseat support [1]
Many thanks to tijl for help and testing and finding solution for
[1], which was causing regressions with polkit integration.
Reviewed by: tijl
Tested by: tijl
sysutils/omnibackup: convert OpenLDAP dependency to USES=ldap:server
Use ldap:server via the options framework instead of manually adding
the server RUN_DEPENDS.
Note that techinically omnibackup does not require the client library
anyway.
PR: ports/297403
Approved by: maintainer (Mamadou Babaei)
sysutils/bhyvemgrd: New port: privileged helper daemon for bhyvemgr
Bhyvemgrd exposes a JSON-based IPC interface over a UNIX domain socket,
allowing the bhyvemgr client to request privileged operations required for
bhyve virtual machines, execute system-level tasks, monitor VM process states,
and receive asynchronous state notifications.
