/dev/null is no longer implicitly permitted by some pledges, so explicitly
unveil it. fixes calendar -a. ok deraadt
calendar also needs to unveil cpp / sendmail, I forgot to make install
when I was testing :( from James J. Lippard
sendmail/cpp only need "x" no "rx" unveil; ok deraadt
from sthen@
this is errata/7.7/029_calendar.patch.sig
/dev/null is no longer implicitly permitted by some pledges, so explicitly
unveil it. fixes calendar -a. ok deraadt
calendar also needs to unveil cpp / sendmail, I forgot to make install
when I was testing :( from James J. Lippard
sendmail/cpp only need "x" no "rx" unveil; ok deraadt
from sthen@
this is errata/7.8/023_calendar.patch.sig
Update libexpat to version 2.7.5.
Relevant for OpenBSD are security fixes #1158 #1161 #1162 #1163,
other changes #1156 #1153. Library bump is not necessary.
CVE-2026-32776CVE-2026-32777CVE-2026-32778
tested and OK tb@
libcrypto: prefix EC_KEY methods with ec_key_
We received reports that the too generic internal ecdsa_{sign,verify}()
symbol names clash in some static links. The naming here is annoying
because the EC_KEY_METHOD amalgamated the no longer existing ECDH and
ECDSA methods which themselves had poorly chosen method names, still
reflected in public API.
There are various messes here. The ECDSA verify methods are declared
in ec_local.h, whereas the ECDSA sign methods are in ecdsa_local.h
(which is itself pretty useless and really only about EC_KEY_METHOD).
I therefore merged the ECDSA method declarations into ec_local.h and
deleted ecdsa_local.h since I see no real benefit to the latter.
ecdsa.c needs ec_local.h anyway. Having the method declarations next
to EC_KEY_METHOD seems sensible. I left the order as it was, matching
ecdsa.c. The eckey_compute_pubkey() prototype should probably be moved
down.
With one exception I just added an ec_key_ prefix. This leads to a
[10 lines not shown]
rework the way we reconsturct the object file order for syspatches
this change drops the exclude regex and just simply checks if the
object files are actually available and then constucts a response
file which we pass for linking and this seems to be good enough
to have reproducible make build output (which is what we want here)
ok tb@
Track counts of CH hash allocations and expose them via 'show rib mem'.
This is currently just one global sum of all hash table memory. The plan
is to do more but right now this is a good first step.
OK tb@
Our framebuffer might be in "stolen" memory that is lost (and filled with
garbage) after a hibernate. So clear it and redraw the framebuffer
contents.
ok jsg@
make ttm_device_prepare_hibernation() return early
kettenis reports the ttm_tm_swapout() change is not enough to fix
hibernate with amdgpu when X is running.
The call to ttm_device_prepare_hibernation()/ttm_tm_swapout() in the
hibernate path was added in a linux commit from 2025:
924dda024f3bea64be5f3ac067a075e466739dc9
drm/amdgpu: move GTT to shmem after eviction for hibernation
The linux reason for doing this (server cards with lots of VRAM) isn't
something that concerns us.
ok kettenis@