mail/protonmail-bridge: Add port: Proton Mail Bridge for e-mail clients
Use Proton Mail with your desktop email client.
Proton Mail Bridge adds end-to-end encryption to popular email apps,
including Outlook, Thunderbird, and Apple Mail. Secure email made
easy.
NOTE: Proton Mail Bridge is available only with a paid plan that
includes Proton Mail.
WWW: https://proton.me/mail/bridge
Force ACL application on app-owned ix-volume paths
## Problem
Enabling an ACL on an ix-volume of an installed app fails with `path contains existing data and 'force' was not specified`. The served schema hides the `force` flag for ix-volumes and defaults it to true, but clients can still submit an explicit false, and middleware then faithfully applies it - so the guard trips as soon as the app has written anything into its own volume, which is almost immediately after install. A false which has already been persisted is worse: on the next update validation rejects the config before normalization ever gets a chance to correct it.
## Solution
Add an `is_app_volume_path` helper and use it at the two places the same root cause surfaces.
**Normalization** - `normalize_acl` stamps `force` to true for paths inside the app's own volume directory, in place, so the dict which gets written back to the app config agrees with the ACL which was actually applied and a stored false heals itself. This is the single chokepoint for every ix-volume ACL apply; host path ACLs land in the same action dict and are distinguishable only by path, so they keep their default and their data-loss guard.
**Validation** - `validate_acl_entries` skips the existing-data probe for those paths, since forcing is implied for them. It only skips, never mutates. The exemption is permanent rather than transitional: a volume with its ACL disabled keeps a persisted path and whatever force value was stored with it, and normalization ignores it because it has no entries, so without the skip that config stays unsavable forever.
The app name is threaded from `normalize_and_validate_values` through validation rather than read off `app_data`, which is None on create - and on create the volume datasets do not exist yet, so probing a real path there would raise a spurious `path does not exist`.
flux2: Update to 2.9.4
Changes:
2.9.4
-----
Flux v2.9.4 is a patch release that ships various fixes to the Flux
controllers, covering source-watcher tarball extraction and glob
expansion limits, the refspecs accepted by ImageUpdateAutomation, the
HTTP request limits of the notification-controller servers, and Helm
repository index loading, OCI chart digest pinning, Bucket error
handling and GCS static authentication in source-controller. On the CLI
side, flux migrate -f now supports migrating repositories to Flux 2.9.
Users are encouraged to upgrade for the best experience.
Note that this release contains CRD schema changes for
ArtifactGenerator and ImageUpdateAutomation; both CRDs must be updated
along with the controllers.
www/wikid: import pkg
Feature-rich terminal wikipedia client.
Features
- rich launch dashboard: big ascii logo, live wikipedia metrics and a continue
reading section.
- tabs & splits: work with multiple articles side-by-side or in tabs.
- smart status bar: 3-segment layout with active history trails and contextual
action hints.
- vim-like navigation: intuitive keybindings for fast scrolling, jumping,
heading traversal and pane management.
- table of contents (o): pop-up outline modal with hierarchical section
numbering.
- zen mode (z): distraction-free reading canvas with no borders, tab bars, or
status indicators.
- personalized recommendation feed (F): article discovery feed tailored to
your reading history. inspired by xikipedia.
- random article discovery (r): instantly fetch and explore random wikipedia
[6 lines not shown]
biology/canu: Update to 2.3
Several bug fixes and enhancements
Changes: https://github.com/marbl/canu/releases
Should fix package build on arm64
Change WWW to something portscout can use
Reported by: pkg-fallout
[libunwind] Make Apple OS version XFAILs robust to patch-level versions (#218125)
We are seeing some failures since some of the Apple CI runners have been
updated to 26.5.2. That was caused by the regular expressions not
matching patch level version bumps.
amd_iommu: Bound IVHD device-entry parsing
Validate the IVRS table and every subtable length before using either
to form iterator bounds. Reject truncated typed IVHD blocks instead of
passing them to a type-specific callback.
Within each IVHD payload, correct the lower-bound comparison for
extended range entries and validate fixed-size entries, paired range
terminators, the fixed HID body, and the variable HID UID before
dereferencing or advancing. Malformed firmware can no longer drive
either iterator beyond its enclosing object.
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58724
bhyvectl: Generalize bhyve IPC code
Move the nvlist-based bhyve IPC code into a separate function.
No functional change intended.
Reviewed by: rew
Differential Revision: https://reviews.freebsd.org/D54652
bhyve: Generalize the IPC thread
Move the code for the snapshotting IPC thread into a separate file
and define macros for adding new IPC commands.
No functional change intended.
Reviewed by: rew
Differential Revision: https://reviews.freebsd.org/D54650
databases/mysql{80,84,97}-server: Add rc script and user for MySQL Router
All three server ports build and install MySQL Router, but it was never
usable out of the box: there is no mysqlrouter user, no rc script, no
configuration directory, and no log, runtime or data directory. The only
trace of an integration was etc/logrotate.d/mysqlrouter, whose
"create 600 mysqlrouter mysqlrouter" refers to an account that no port
creates, so logrotate(8) skipped that entry with an error and exited
non-zero.
Upstream names that account itself: scripts/CMakeLists.txt sets
MYSQLROUTER_USER to "mysqlrouter", the built-in help of mysqlrouter
suggests --user=mysqlrouter, and the systemd unit shipped for Linux runs
the service under it.
Add the user and group, an rc script, and a configuration sample in
etc/mysqlrouter. mysqlrouter does not detach itself, so it runs under
daemon(8), which also writes the PID file that the postrotate script in
etc/logrotate.d/mysqlrouter expects. The runtime, log and data
[9 lines not shown]
databases/mysql{80,84,97}-server: Add rc script and user for MySQL Router
All three server ports build and install MySQL Router, but it was never
usable out of the box: there is no mysqlrouter user, no rc script, no
configuration directory, and no log, runtime or data directory. The only
trace of an integration was etc/logrotate.d/mysqlrouter, whose
"create 600 mysqlrouter mysqlrouter" refers to an account that no port
creates, so logrotate(8) skipped that entry with an error and exited
non-zero.
Upstream names that account itself: scripts/CMakeLists.txt sets
MYSQLROUTER_USER to "mysqlrouter", the built-in help of mysqlrouter
suggests --user=mysqlrouter, and the systemd unit shipped for Linux runs
the service under it.
Add the user and group, an rc script, and a configuration sample in
etc/mysqlrouter. mysqlrouter does not detach itself, so it runs under
daemon(8), which also writes the PID file that the postrotate script in
etc/logrotate.d/mysqlrouter expects. The runtime, log and data
[9 lines not shown]
Fix TTL handling in cache.has_key and get_or_put
## Problem
`cache.has_key` returned True whenever the TDB record existed and never looked at the stored `timeout`, so it disagreed with `cache.get` — which expires the entry and raises `KeyError` — for any key that had expired but not yet been reaped. The only reaper is a 24h periodic with `run_on_start=False` whose timer is re-armed from scratch on every middlewared start, so on a box that restarts more often than daily it never runs at all and the wrong answer sticks around indefinitely.
Separately, `get_or_put` always stored `now + timeout`, so unlike `put` — where 0 means "never expires" — `get_or_put(key, 0, method)` stored an expiry of now and the entry was already expired on the very next read.
## Solution
`has_key` now delegates to `get()` and maps `KeyError` to False. Delegating rather than repeating the timeout comparison is deliberate: the bug existed because two methods independently decided what "expired" means, and this leaves only one. Expired entries are reaped on access as a side effect, which matters given how unreliable the periodic reaper is.
`get_or_put` stores a literal 0 when `timeout` is 0, matching `put`.
