BSD Commit Log Search

   Update lang/ruby module documentation for the removal of Ruby 3.3

   Add quirk for Ruby 3.3 removal

   Send Ruby 3.3 to the Attic

   OK tb@

   Unhook Ruby 3.3

   Remove support for building ruby33-* packages for Ruby ports

   OK tb@

   archivers/zpaqfranz: update to 65.8

   From maintainer tux0r, thanks!

   update to wine 11.20. Tested by Andrii and me.

   dlls/ntdll/unix/file.c has undergone a refactor upstream; we may need
   to fix a few things upon further review, but things run well enough to
   not delay this update.

   Reminder for users to look at README. Expect to be called out for not
   having read it when reporting about 32-bit software not running.

   This is still early days for the port, so not all 64-bit software runs.

   security/mitmproxy: update to 12.3.0

   security/py-mitmproxy_rs: update to 0.12.15

   MFC: Block compromised eMudhra certificates to address CVE-2026-91403
   by installing an updated blocked.certs file provided in:
   https://openjdk.org/groups/vulnerability/advisories/2026-10-21
   See also:
   https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
   ok tb@
   from kurt@

   fix distinfo (committed the version from a test)

   +retex

   Initial revision

   Block compromised eMudhra certificates to address CVE-2026-91403
   by installing an updated blocked.certs file provided in:
   https://openjdk.org/groups/vulnerability/advisories/2026-10-21
   See also:
   https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
   ok tb@

   Prioritise previously confirmed certification paths

   Duplicate SKI might appear because of reuse of a keypair (a poor CA
   practise, but not illegal) or because of 'public key stealing', i.e.,
   an adversarial CA issues a certificate containing the victim CA's SPKI
   and SIA. Because SKI might not be globally unique, certificates have
   been tracked by an internal identifier since 2024.

   Jacobsen et al., 2026, reported that rpki-client's certification path
   loop protection might be exploited if an adversary can race the victim.
   This race can happen in the discovery of the logical certification
   topology, unrelated to racing repository loading over the network. Any
   payload carrying objects (ROAs, ASPAs, etc) discovered through the
   adversary's certification path will fail resource containment checks and
   the loop guard (entity_process()->filepath_add()) necessarily enforces
   each object to be accessed only once. The result is that if the race is
   lost, the victim's payloads disappear from view.

   Some people incorrectly assert that RPKI resource certificates cannot

    [31 lines not shown]

   + ferrofin

   Initial revision

   reuse 657 _ircd-seven from 2016 as _ferrofin for multimedia/ferrofin;  OK bket

   remove abandonded security/gringotts

   This is an abandonded "secure" notes manager in GTK+2 on live support.
   setuid-root just mlockall(2) which doesn't need root on OpenBSD.

   pea@ maintainer timeout three years ago

   drop setgid/kmem, obsolete since 2015 kvm(3) -> getifaddrs(3) patch; OK sthen

   Handle the Emudhra intermediate cert compromise.
   See https://emudhra.we-have-a-problem.com/
   While likely all of Emudrha will be distrusted soon, currently
   a lot of India is using them. 8 intermediates under their CA3
   have publicly discoverable keys. the 9 others sign many sites.
   For now, remove CA3 from the trust store, thus distrusting all
   the intermediates it has signed, then add back the remaining
   9 uncompromised intermediates by "promoting" to a root, the
   usual intermediate elision technique.
   This enables real sites in india using these intermediates
   to still work. Assuming Emudhra ends up widely distrusted
   soon, we can remove these and the other roots after sites
   have had time to get new certificates.
   from beck@; OK tb@ sthen@

   dbupdate: Be consistent with name in messages.
   from dgl@; OK deraadt@

   force umask

    [45 lines not shown]

   Handle the Emudhra intermediate cert compromise.
   See https://emudhra.we-have-a-problem.com/
   While likely all of Emudrha will be distrusted soon, currently
   a lot of India is using them. 8 intermediates under their CA3
   have publicly discoverable keys. the 9 others sign many sites.
   For now, remove CA3 from the trust store, thus distrusting all
   the intermediates it has signed, then add back the remaining
   9 uncompromised intermediates by "promoting" to a root, the
   usual intermediate elision technique.
   This enables real sites in india using these intermediates
   to still work. Assuming Emudhra ends up widely distrusted
   soon, we can remove these and the other roots after sites
   have had time to get new certificates.
   from beck@; OK tb@ sthen@

   update cert.pem based on newer mozilla ca root store
   from sthen@; OK tb@

   dbupdate: Be consistent with name in messages.

    [48 lines not shown]

   devel/rebar3: Update to 3.28.0

   Fixes CVE-2026-96596
   This release also drops the bundled Certifi package and relies on the
   system certificate store instead.

   Update for Nextcloud to 34.0.5

   https://github.com/nextcloud-releases/server/releases/tag/v34.0.5

   OK sthen

   Update for Nextcloud to 35.0.2

   https://github.com/nextcloud-releases/server/releases/tag/v35.0.2

   OK sthen

   devel/rebar3: Update to 3.28.0

   Fixes CVE-2026-96596
   This release also drops the bundled Certifi package and relies on the
   system certificate store instead.

   devel/glib2: fix build on archs with unsigned chars (damn you -Werror)

   reported by/ok phessler, "go ahead" aja (maintainer)

   update distinfo

   www/yt-dlp: update to 2026.10.21

   from byteskeptical <ports at byteskeptical.com>

   MFC: Update to pizauth 1.1.1, from maintainer/upstream

   Removes dep on webpki-roots and switches to the native PlatformVerifier