HardenedBSD/src a8cd7f4lib/virtual_oss Makefile.inc Makefile, lib/virtual_oss/bt Makefile

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+4-5usr.sbin/virtual_oss/virtual_oss/Makefile
+6-2lib/virtual_oss/Makefile.inc
+1-5lib/virtual_oss/sndio/Makefile
+1-5lib/virtual_oss/bt/Makefile
+2-3lib/virtual_oss/Makefile
+0-5lib/virtual_oss/null/Makefile
+14-256 files not shown
+21-3412 files

HardenedBSD/ports ac18e28devel/py-rich-click Makefile, math/form/files patch-configure.ac

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+0-63www/tomcat-native2/files/patch-src_ssl.c
+35-0textproc/R-cran-vroom/files/patch-fix-tests
+26-0security/vuxml/vuln/2026.xml
+6-15math/form/files/patch-configure.ac
+14-4devel/py-rich-click/Makefile
+0-15www/freenginx-devel/files/extra-patch-xss-nginx-module-config
+81-9738 files not shown
+189-22544 files

HardenedBSD/ports 34d98d7www/freenginx-devel distinfo Makefile.extmod, www/freenginx-devel/files extra-patch-xss-nginx-module-config

www/freenginx-devel: third-party modules management (+)

- update xss module its recent snapshot
- remove a needless patch

Bump PORTREVISION.

Sponsored by:   tipi.work
DeltaFile
+0-15www/freenginx-devel/files/extra-patch-xss-nginx-module-config
+3-3www/freenginx-devel/distinfo
+1-2www/freenginx-devel/Makefile.extmod
+1-1www/freenginx-devel/Makefile
+5-214 files

HardenedBSD/ports 849fb89math/octave-forge-llms Makefile

math/octave-forge-llms: Ignore for arm64.
DeltaFile
+1-1math/octave-forge-llms/Makefile
+1-11 files

HardenedBSD/src 245157fsys/kern kern_synch.c kern_ktrace.c, sys/sys ktrace.h

ktrcsw(): should not be called when the thread is owning interlock or on sleepq

The issue is that for ktrcsw() we lock the ktrace_mtx mutex while owning
the interlock from a subsystem that called msleep().  In particular, the
VM subsystem might call msleep() if page allocation failed.  This
establishes order VM locks (e.g. domain free queue lock) -> ktrace_mtx.
Calling free() while owning ktrace_mtx gives the reverse order.

Worse, msleep_spin_sbt() call s ktrcsw() while the thread is put on
sleep queue.  Then, since the mutex might be contested, the thread needs
to be put on turnstil, which cannot work.

Move the ktrcsw() call for switch-out after the wakeup, when the thread
does not yet re-obtained any locks.  From there, we call a special
version of ktrcsw(), which is passed the actual time when the context
switch occured.

The drawback is that the switch-out record is only written in the
ktrace.out file after the switch-in occurred, but this is probably not

    [7 lines not shown]
DeltaFile
+11-15sys/kern/kern_synch.c
+16-2sys/kern/kern_ktrace.c
+1-0sys/sys/ktrace.h
+28-173 files

HardenedBSD/ports e826eb2devel/py-rich-click Makefile distinfo

devel/py-rich-click: Update to 1.9.6

Many enhancements since 1.6.1
Changes: https://github.com/ewels/rich-click/releases
Run-tested under py-multiqc
Pip pkg for py-litestar uses 1.9.6

PR:             292776
Reported by:    nivit
DeltaFile
+14-4devel/py-rich-click/Makefile
+3-3devel/py-rich-click/distinfo
+17-72 files

HardenedBSD/src bda8028release/pkg_repos release-dvd.conf, release/scripts pkg-stage.sh

release: Ship firmware from kmods repo on DVD

The packages for X.Y-RELEASE are a snapshot of the quarterly branch
for stable/X, i.e. typically built on X.(Y-1)-RELEASE.  (The case of
Y=0 is an exception for obvious reasons.)  This works for most ports
but not for kernel modules, which may need to be built on the release
in question; this is why we have a separate "kmods" repository.

Make sure that we put the packages from the kmods repository onto the
mini-pkg-repo on the DVD rather than shipping unusable firmware.

Reviewed by:    bz
MFC after:      1 week
Sponsored by:   https://www.patreon.com/cperciva
Differential Revision:  https://reviews.freebsd.org/D52581
DeltaFile
+18-7release/scripts/pkg-stage.sh
+7-0release/pkg_repos/release-dvd.conf
+25-72 files

HardenedBSD/ports 99c91e9www/tomcat-native2 distinfo Makefile, www/tomcat-native2/files patch-src_ssl.c patch-src_sslutils.c

www/tomcat-native2: Upgrade port to 2.0.12

This release finally drops backported OpenSSL 1.1.1 support, thus FreeBSD 13
support because the patches fail to apply due to upstream changes to those files.

MFH:            2026Q1
Changelog:      https://tomcat.apache.org/native-doc/miscellaneous/changelog.html#Changes_in_2.0.12
DeltaFile
+0-63www/tomcat-native2/files/patch-src_ssl.c
+0-14www/tomcat-native2/files/patch-src_sslutils.c
+0-12www/tomcat-native2/files/patch-include_ssl__private.h
+3-3www/tomcat-native2/distinfo
+3-2www/tomcat-native2/Makefile
+6-945 files

HardenedBSD/src 93d3ac1sys/arm64/arm64 vfp.c

arm64: Fix kernel panic in get_arm64_sve during core dump

The coredump logic calls get_arm64_sve twice: once to get the note size,
and once to get the data. The note size calculation depended on the
volatile `PCB_FP_SVEVALID` flag. If this flag was cleared between the
two calls (e.g., due to a context switch clearing the flag to comply
with the ABI), the second call would expect a smaller buffer size than
the first, triggering a KASSERT panic ("invalid size").

Fix this by ensuring the SVE state is saved to the PCB before we decide
whether to use SVE or VFP.

PR: 292195
Reviewed by: andrew
Differential Revision: https://reviews.freebsd.org/D54532
DeltaFile
+3-3sys/arm64/arm64/vfp.c
+3-31 files

HardenedBSD/src 78274fd. Makefile.inc1

native-xtools: use static LLVM libraries

Set the MK_LLVM_LINK_STATIC_LIBRARIES knob to "yes" when building the
native-xtools target. This reverts to the behaviour prior to
2e47f35be5dc.

This avoids a build failure that occurs otherwise, where compilation
fails looking for a libllvmprivate.so that was not built.

It is unclear if this addresses the issue in all instances---some
replies in the PRs indicate otherwise. Still, some report success, and
in my own testing this fixed creation of a cross-compiled poudriere
jail. Commit this while we continue to investigate...

PR:             286710, 291409
Tested by:      marck, rdunkle at smallcatbrain.com
Reviewed by:    emaste
MFC after:      3 days
Fixes:  2e47f35be5dc ("Convert libllvm, libclang and liblldb into private shared libraries").

    [4 lines not shown]
DeltaFile
+1-0Makefile.inc1
+1-01 files

HardenedBSD/ports 914fdd0www/gohugo distinfo Makefile

www/gohugo: Update to 0.155.1

ChangeLog: https://github.com/gohugoio/hugo/releases/tag/v0.155.1

 * Fix image DecodeConfig regression of WebP images from file cache
 * resources/images: Fix WebP useSharpYuv being ignored
 * tpl/tplimpl: Remove failing Twitter tests
DeltaFile
+5-5www/gohugo/distinfo
+1-1www/gohugo/Makefile
+6-62 files

HardenedBSD/ports 972cee2security/netbird distinfo Makefile

security/netbird: Update to 0.64.3

PR:             292826
DeltaFile
+5-5security/netbird/distinfo
+1-1security/netbird/Makefile
+6-62 files

HardenedBSD/src 3eac385share/man/man5 src.conf.5

src.conf.5: Regen after addition of MK_SOUND

A description for WITHOUT_SOUND is still missing though.

(cherry picked from commit 3f2f3c52e6f192df435bdb5861018402ec1167d0)
DeltaFile
+6-0share/man/man5/src.conf.5
+6-01 files

HardenedBSD/src 33c49c3libexec/rc rc.conf

Set virtual_oss_enable="NO" in /etc/defaults/rc.conf

This prevents 'service -e' from emitting (/var/log/messages):

/usr/sbin/service: WARNING: $virtual_oss_enable is not set properly - see rc.conf(5)

Pull Request:   https://github.com/freebsd/freebsd-src/pull/1987
Reviewed by:    christos
Signed-off-by:  eborisch at gmail.com
MFC after:      1 week

(cherry picked from commit 1b2d495a24c36d81b14178a2f898025946bff2d8)
DeltaFile
+1-0libexec/rc/rc.conf
+1-01 files

HardenedBSD/src dcdb18bsys/netgraph/bluetooth/include ng_hci.h

bluetooth: Don't use a non-string to initialize NG_HCI_BDADDR_ANY

Explicitly use an array of 6 zeroes instead of a C string containing
nul characters.  GCC 15 warns about the truncation, but this is
cleaner regardless.

In file included from /usr/obj/.../amd64.amd64/tmp/usr/include/bluetooth.h:51,
                 from usr.sbin/virtual_oss/virtual_bt_speaker/bt_speaker.c:45:
usr.sbin/virtual_oss/virtual_bt_speaker/bt_speaker.c: In function 'register_sdp':
usr.sbin/virtual_oss/virtual_bt_speaker/bt_speaker.c:96:13: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (7 chars into 6 available) [-Werror=unterminated-string-initialization]
   96 |             NG_HCI_BDADDR_ANY, (const uint8_t *)&record, sizeof(record),
      |             ^~~~~~~~~~~~~~~~~

Reviewed by:    dim
Differential Revision:  https://reviews.freebsd.org/D54869

(cherry picked from commit 72a6991b80c6e6c47a3b84337f62f0a02bd30391)
DeltaFile
+2-2sys/netgraph/bluetooth/include/ng_hci.h
+2-21 files

HardenedBSD/src f388826lib/virtual_oss Makefile.inc, lib/virtual_oss/bt Makefile

lib/virtual_oss: don't (over)link to libsamplerate

These plugins require samplerate.h due to virtual_oss's int.h including
it, but don't use any symbols directly so don't link to the library.

Centralize adding the include path.

Reviewed by:    christos
Sponsored by:   DARPA, AFRL
Differential Revision:  https://reviews.freebsd.org/D54705

(cherry picked from commit d78291b0e9736f39f22c55c163978c1b92e601e4)
(cherry picked from commit c88f012faa13c39f13efdcef88d3141253a300ab)
DeltaFile
+1-3lib/virtual_oss/sndio/Makefile
+1-2lib/virtual_oss/bt/Makefile
+0-3lib/virtual_oss/null/Makefile
+0-3lib/virtual_oss/oss/Makefile
+2-0lib/virtual_oss/Makefile.inc
+4-115 files

HardenedBSD/src 00964aalib/virtual_oss Makefile, usr.sbin/virtual_oss Makefile

virtual_oss: build commands/libs in parallel

Reviewed by:    christos
Sponsored by:   DARPA, AFRL
Differential Revision:  https://reviews.freebsd.org/D54703

(cherry picked from commit adab1dd6a70e9f2d7ac4500b186e7231afd02e04)
DeltaFile
+2-0lib/virtual_oss/Makefile
+2-0usr.sbin/virtual_oss/Makefile
+4-02 files

HardenedBSD/src 9be3ccdlib/virtual_oss Makefile.inc, lib/virtual_oss/bt Makefile

virtual_oss: build system tidying

general:
 - find libsamplerate's headers in the temporary sysroot instead of
   digging in the source tree.
 - use LIBADD where possible

lib/virtual_oss:
 - centralize SHLIBDIR define
 - centralize include path for internal headers
 - don't try to find libsamplerate directly in .OBJDIR

No functional changes.

Reviewed by:    christos
Sponsored by:   DARPA, AFRL
Differential Revision:  https://reviews.freebsd.org/D54704

(cherry picked from commit 373c72ad5044d5f84b7f3fa169d37e7214729f74)
DeltaFile
+4-5usr.sbin/virtual_oss/virtual_oss/Makefile
+2-5lib/virtual_oss/bt/Makefile
+4-2lib/virtual_oss/Makefile.inc
+1-3lib/virtual_oss/null/Makefile
+1-3lib/virtual_oss/oss/Makefile
+1-3lib/virtual_oss/sndio/Makefile
+13-212 files not shown
+14-248 files

HardenedBSD/src 352d405lib/virtual_oss Makefile, usr.sbin/virtual_oss Makefile

virtual_oss: remove needless .include in intermediate Makefile

It doesn't define anything we use.

Reviewed by:    christos
Sponsored by:   DARPA, AFRL
Differential Revision:  https://reviews.freebsd.org/D54702

(cherry picked from commit 497a13601fb74c264e28eff7cd3f9ac74f0f212b)
DeltaFile
+0-1lib/virtual_oss/Makefile
+0-1usr.sbin/virtual_oss/Makefile
+0-22 files

HardenedBSD/src c88f012lib/virtual_oss/sndio Makefile

lib/virtual_oss/sndio: Remove trailing backslash

Fixes:          d78291b0e973 ("lib/virtual_oss: don't (over)link to libsamplerate")
Reported by:    pkg-fallout
Sponsored by:   The FreeBSD Foundation
MFC after:      2 days
DeltaFile
+1-1lib/virtual_oss/sndio/Makefile
+1-11 files

HardenedBSD/src b928974share/mk src.opts.mk

src.opts: Remove MK_SOUND artifact

Fixes:          f74f891581bc ("src.opts: Introduce MK_SOUND")
PR:             291853
Sponsored by:   The FreeBSD Foundation
MFC after:      4 days
DeltaFile
+0-5share/mk/src.opts.mk
+0-51 files

HardenedBSD/ports 0bbce05devel/aws-c-io distinfo Makefile

devel/aws-c-io: Update to 0.26.1

ChangeLog: https://github.com/awslabs/aws-c-io/releases/tag/v0.26.1
DeltaFile
+3-3devel/aws-c-io/distinfo
+1-1devel/aws-c-io/Makefile
+4-42 files

HardenedBSD/ports d9d38datextproc/R-cran-vroom Makefile, textproc/R-cran-vroom/files patch-fix-tests

textproc/R-cran-vroom: Really fix tests

Apply upstream patch that solves tests failure using other logic instead
of port workaround.
DeltaFile
+35-0textproc/R-cran-vroom/files/patch-fix-tests
+0-9textproc/R-cran-vroom/Makefile
+35-92 files

HardenedBSD/ports e2e2bbfmath/intx distinfo Makefile

math/intx: Update to 0.15.0

ChangeLog: https://github.com/chfast/intx/releases/tag/v0.15.0
DeltaFile
+3-3math/intx/distinfo
+1-1math/intx/Makefile
+4-42 files

HardenedBSD/src 1539a65tests/sys/netinet6 test_ip6_output.py

ip6_output tests: Remove an unused import

No functional change intended.

MFC after:      1 week
Sponsored by:   Stormshield
Sponsored by:   Klara, Inc.
DeltaFile
+0-1tests/sys/netinet6/test_ip6_output.py
+0-11 files

HardenedBSD/src a03eabfsys/netinet6 ip6_mroute.c

ip6_mroute: Mark functions as static

No functional change intended.

MFC after:      2 weeks
Sponsored by:   Stormshield
Sponsored by:   Klara, Inc.
DeltaFile
+10-10sys/netinet6/ip6_mroute.c
+10-101 files

HardenedBSD/ports 9939124security/interactsh distinfo Makefile

security/interactsh: Update to 1.3.0

Changelog:
https://github.com/projectdiscovery/interactsh/releases/tag/v1.3.0
DeltaFile
+5-5security/interactsh/distinfo
+1-2security/interactsh/Makefile
+6-72 files

HardenedBSD/ports c944604www/gohugo distinfo Makefile

www/gohugo: Update to 0.155.0

ChangeLog: https://github.com/gohugoio/hugo/releases/tag/v0.155.0

Bug fixes

 * Fix data race when clearing cache in cachebusters
 * resources/images: Fix comment for Quality field in ImageConfig
 * Fix panic reported in discourse
 * Fix recently introduced partial rendering bug
 * tpl: Fix partial decorator panic when partial returns falsy
 * resources: Fix race condition in test helper
 * Fix cascade draft panic
 * hugolib: Fix multilingual alias generation
 * Fix file mount specifity issue within the same module
 * warpc: Fix typed nil return in Start
 * hugolib: Fix relative alias generation

Improvements

    [21 lines not shown]
DeltaFile
+5-5www/gohugo/distinfo
+1-2www/gohugo/Makefile
+6-72 files

HardenedBSD/ports e2ddf6amath/form Makefile distinfo, math/form/files patch-configure.ac

math/form: Update to 5.0.0
DeltaFile
+6-15math/form/files/patch-configure.ac
+7-7math/form/Makefile
+3-3math/form/distinfo
+16-253 files

HardenedBSD/ports 9b4cf5faudio/ocp distinfo Makefile

audio/ocp: Update to 3.1.2
DeltaFile
+3-3audio/ocp/distinfo
+1-1audio/ocp/Makefile
+4-42 files