README: point the build badge at SourceHut
Cirrus CI stopped running jobs on 2026-06-01 when Cirrus Labs joined OpenAI,
so the badge no longer renders and its link is dead. SourceHut has been
building poudriere since 2026-05-05 via .builds/freebsd.yml.
Fixes #1331
image: Use msg_n/done idiom for ESP image creation status
make_esp_file() reported "Creating ESP image" and "ESP Image created"
as two separate complete lines via msg(), even though makefs's own
output is redirected to /dev/null and the operation can take a
noticeable amount of time. Use the msg_n "...done" idiom used
elsewhere for silent, potentially slow operations (e.g. jail removal)
so it reads as a single in-progress status line instead of two
disconnected facts.
Add missing FLAVOR to stage-qa and check-plist calls
For example, `poudriere testport -NNi devel/freebsd-gcc15 at amd64`
will correctly build the amd64 flavor, but will attempt to
stage-qa and check-plist for the aarch64 flavor because it
becomes the default flavor through alphabetic sorting.
testport/bulk -i: Pass FLAVOR when looking up WRKDIR in interactive motd
The WRKDIR line queried `make -V WRKDIR` without FLAVOR, so a flavored
port always reported its default flavor's work directory instead of
the one actually built and installed -- e.g. audio/baresip built with
FLAVOR=nox11 showed work-default. run-depends and install-package
already pass ${flavor:+FLAVOR=${flavor}} a few lines above; do the
same here.
Reproduced on misc/py-polars-runtime (FLAVOR=64 showing work-compat)
and audio/baresip (FLAVOR=nox11 showing work-default); a port whose
single auto-generated flavor happens to match the default (e.g.
security/py-biscuit-python) masks the bug, which is likely why it
went unnoticed.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
jail, ports: Fix garbled output when checking out/updating with -v
The svn/git checkout and update paths in both ports.sh and jail.sh's
install_from_vcs() used msg_n() followed by the raw command's own
output and a glued-on " done", relying on the command producing no
output of its own. With -v that assumption is wrong: quiet mode is
disabled, so svn/git's own progress output gets appended directly
onto the unterminated header line, and " done" gets glued onto the
tool's own last output line instead of starting a new one.
Use msg() instead of msg_n() when not running quiet, so the header
gets its own line before the command's output, and drop the redundant
trailing "done" for that case since the tool's own output already
signals completion. Apply the same fix to jail.sh, which had the
identical pattern for fetching/updating jail sources, and add the
existing "!! Any changes here should be considered for ... too."
cross-reference comment to the svn cases in both files so the two
code paths stay in sync going forward.
[3 lines not shown]
poudriered: retain queue while listing it
The list operation passes the global queue to send_object(), which
consumes its argument. A subsequent list request can then release the
stale queue again and terminate the daemon.
Take a temporary queue reference for the response so the global queue
remains valid.
(cherry picked from commit dbabedc99030f7d13696a8dd4382c4756c31fb9d)
poudriered: retain queue while listing it
The list operation passes the global queue to send_object(), which
consumes its argument. A subsequent list request can then release the
stale queue again and terminate the daemon.
Take a temporary queue reference for the response so the global queue
remains valid.
Do not import symlinks from non-pkg package builds
The package phase lets the jail build user write to a host-backed
/.npkg directory. build_port() imported every file and symlink from
that directory into the host package repository. An absolute symlink
changes meaning at this boundary: it points inside the jail while
mounted but at the host after import.
Only the pkg bootstrap variants need package-manager compatibility
links. Process those links before their targets and reject any that
resolve outside staging. Import only regular files for other ports,
preventing their build output from introducing host-resolved symlinks
into the repository.
Reject untrusted poudriered log paths
Poudriered allowed any client-authorized command to specify a log
path. The root daemon created its parent directories and opened the
path with O_TRUNC.
Reject log fields on client requests. Preserve configured schedule
logs, use a root-owned /var/log fallback, and refuse to follow final
symlinks when opening logs.
(cherry picked from commit 01d5de2876a23701e41957826cd8115702c41684)
build.html: update "Failed Ports" title bar to match others
a63486e introduced a new title bar style, but failed_div seems to have have been missed. This brings failed_div into line with the others.
Reject untrusted poudriered log paths
Poudriered allowed any client-authorized command to specify a log
path. The root daemon created its parent directories and opened the
path with O_TRUNC.
Reject log fields on client requests. Preserve configured schedule
logs, use a root-owned /var/log fallback, and refuse to follow final
symlinks when opening logs.
Reject unsafe package names from ports metadata
PKGNAME is used to construct host-side package staging paths. A port
can supply traversal components and cause those paths to escape the
staging directory.
Validate package names when reading port metadata and before a build
worker uses one. This prevents path separators and dot traversal
components from reaching host filesystem operations.
