HardenedBSD/src b42367blib/libbe be.c, sbin/bectl bectl.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+86-0usr.sbin/etcupdate/tests/empty_file_test.sh
+65-0sys/dev/tpm/tpm20.c
+50-14lib/libbe/be.c
+58-0tools/build/mk/OptionalObsoleteFiles.inc
+3-14sys/powerpc/aim/moea64_native.c
+14-2sbin/bectl/bectl.c
+276-3017 files not shown
+342-5023 files

HardenedBSD/src 4d6dc2csys/fs/nfs nfs_commonsubs.c nfs_commonacl.c, sys/fs/nfsclient nfs_clrpcops.c nfs_clvnops.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+250-31sys/fs/nfs/nfs_commonsubs.c
+194-3sys/fs/nfs/nfs_commonacl.c
+82-22sys/fs/nfsserver/nfs_nfsdport.c
+70-29sys/fs/nfsclient/nfs_clrpcops.c
+66-24sys/fs/nfsserver/nfs_nfsdserv.c
+45-15sys/fs/nfsclient/nfs_clvnops.c
+707-1249 files not shown
+831-15915 files

HardenedBSD/ports 155bf7bcad/librepcb distinfo Makefile, misc/timr-tui distinfo Makefile

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+1,421-3cad/librepcb/distinfo
+725-8cad/librepcb/Makefile
+385-305misc/timr-tui/distinfo
+192-153misc/timr-tui/Makefile
+69-75textproc/py-jiter/distinfo
+57-53sysutils/mise/distinfo
+2,849-59743 files not shown
+3,062-77149 files

HardenedBSD/ports c5946f3math/R-cran-carData distinfo Makefile

math/R-cran-carData: Update to 3.0.6
DeltaFile
+3-3math/R-cran-carData/distinfo
+1-2math/R-cran-carData/Makefile
+4-52 files

HardenedBSD/ports 056eb4alang/python-doc-html distinfo, lang/python313 pkg-plist distinfo

lang/python313: update to 3.13.12

Changelog: https://docs.python.org/3.13/whatsnew/changelog.html#python-3-13-12-final

Security: bfe9adc8-0224-11f1-8790-c5fb948922ad
DeltaFile
+21-0lang/python313/pkg-plist
+5-5lang/python-doc-html/distinfo
+3-3lang/python313/distinfo
+1-1lang/python313/Makefile.version
+30-94 files

HardenedBSD/ports 8c60dd3math/R-cran-car distinfo Makefile

math/R-cran-car: Update to 3.1.5
DeltaFile
+3-3math/R-cran-car/distinfo
+1-2math/R-cran-car/Makefile
+4-52 files

HardenedBSD/ports 4d6becalang/python-doc-html distinfo Makefile

lang/python-doc-html: populate 3.13
DeltaFile
+5-1lang/python-doc-html/distinfo
+1-1lang/python-doc-html/Makefile
+6-22 files

HardenedBSD/ports 5e61a90. MOVED, lang/python-doc-html distinfo Makefile

lang/python-doc-pdf-a4: remove

No longer provided since 3.13
DeltaFile
+0-8lang/python-doc-html/distinfo
+0-4lang/python-doc-pdf-a4/Makefile
+2-1MOVED
+1-1lang/python-doc-html/Makefile
+3-144 files

HardenedBSD/ports 84e04belang/python311 distinfo Makefile

lang/python311: pull in upstream commits addressing vuxml entries

Security: bfe9adc8-0224-11f1-8790-c5fb948922ad
DeltaFile
+11-1lang/python311/distinfo
+7-2lang/python311/Makefile
+18-32 files

HardenedBSD/src 8880678sys/dev/e1000 if_em.c

e1000: Fix setting the promiscuous mode

The variable reg_rctl stores the value read from reg E1000_RCTL. It
may contain bits E1000_RCTL_VFE and E1000_RCTL_CFIEN which control
VLAN hardware filter feature. The promiscuous mode implies all tagged
or untagged packets should be accepted, so the VLAN hardware filter
feature should be disabled when enabling the promiscuous mode.
Calling em_if_vlan_filter_disable() did the task, but later writing
the value of reg_rctl back to the reg E1000_RCTL may restore the
feature.

Move the calling of em_if_vlan_filter_disable() after writing the reg
to fix that.

PR:             292759
Reviewed by:    kbowling
Tested by:      vova at zote.me
Fixes:          2796f7cab107 e1000: Fix up HW vlan ops
MFC after:      3 days

    [3 lines not shown]
DeltaFile
+1-1sys/dev/e1000/if_em.c
+1-11 files

HardenedBSD/src cc702c7sys/dev/acpica acpi.c

Unbreak the build

Add the missing comma in the `device_printf` statement.

MFC after:      1 week
MFC with:       9c666de5b
Fixes:  9c666de5b ("Make message added for Darwin OSI quirk more terse")
DeltaFile
+1-1sys/dev/acpica/acpi.c
+1-11 files

HardenedBSD/src abf911ausr.sbin/pkg pkg.c config.c

pkg: Fix mirror type parsing and service discovery

Signed-off-by: Pavel Knoblokh <info at software-advisory.com.au>
Reviewed by:    emaste, imp, kevans
Fixes:          dc4581589a3 ("pkg: clean support for repositories")
Closes:         https://github.com/freebsd/freebsd-src/pull/1989
DeltaFile
+6-0usr.sbin/pkg/pkg.c
+2-1usr.sbin/pkg/config.c
+8-12 files

HardenedBSD/src 2e020c8lib/libbe be.c libbe.3, lib/libbe/tests target_prog.c be_create.sh

bectl: Add -E flag to create an empty boot environment

Signed-off-by: Pat Maddox <pat at patmaddox.com>
Reviewed by:    kevans
MFC after:      1 week
Closes:         https://github.com/freebsd/freebsd-src/pull/1975
DeltaFile
+50-14lib/libbe/be.c
+14-2sbin/bectl/bectl.c
+13-1sbin/bectl/bectl.8
+7-4lib/libbe/tests/target_prog.c
+8-1lib/libbe/libbe.3
+9-0lib/libbe/tests/be_create.sh
+101-223 files not shown
+111-239 files

HardenedBSD/ports 2667fbeconverters/R-cran-base64enc distinfo Makefile

converters/R-cran-base64enc: Update to 0.1-6

Reported by:    portscout
DeltaFile
+3-3converters/R-cran-base64enc/distinfo
+1-2converters/R-cran-base64enc/Makefile
+4-52 files

HardenedBSD/src 4f7336ausr.sbin/etcupdate etcupdate.sh, usr.sbin/etcupdate/tests empty_file_test.sh Makefile

etcupdate: Do not ignore empty files.

PR:             bin/292773
Reviewed by:    markj
MFC after:      1 week

Differential Revision: https://reviews.freebsd.org/D54935
DeltaFile
+86-0usr.sbin/etcupdate/tests/empty_file_test.sh
+0-4usr.sbin/etcupdate/etcupdate.sh
+1-0usr.sbin/etcupdate/tests/Makefile
+87-43 files

HardenedBSD/src c1a339bsys/powerpc/aim moea64_native.c

powerpc64/pmap: No need to use r0 anymore in tlbie

The only use of `tlbie %rN, 0` is now explicit and covered in the block
above.  Since there's no need for an explicit `tlbie %rN, 0` now, drop
this convoluted piece and let the compiler decide.

While here, a trivial optimization of the old-style tlbie block, by
clearing tlbie_lock and returning, instead of going to the end which
checks again if the lock is needed.  Since it's already known to be
needed, there's no need to check again.
DeltaFile
+3-14sys/powerpc/aim/moea64_native.c
+3-141 files

HardenedBSD/src e54a1efshare/man/man1 builtin.1 Makefile

builtin.1: Command list maintenance

+ link to return(1) like the other exclusive builtins
+ fix alphabetical sorting of list in rendered manual

MFC after:      3 days
DeltaFile
+1-1share/man/man1/builtin.1
+1-0share/man/man1/Makefile
+2-12 files

HardenedBSD/src 38a4995sys/dev/tpm tpm20.c tpm20.h

tpm20: fix suspend/resume and entropy harvesting

There were a few problem here:
  - TPM2_Shutdown results in a response that we need to either process
    or ignore, otherwise any tpm20_write or tpm20_harvest call will
    trivially hang on an `sc->pending_data_length != 0`
  - We should have a matching TPM2_Startup upon resume to restore any
    state that should have persisted
  - We must drain the harvest task before we suspend to avoid problems
    there

This commit is sufficient to avoid breaking suspend/resume.

PR:             291067
Fixes:  a2d5ed9442bb ("Introduce driver for TPM 2.0 in CRB and [...]")
Fixes:  4ee7d3b0118c ("Allow using TPM as entropy source.")
Co-authored-by: markj (D53835)
Tested by:      garga
Differential Revision:  https://reviews.freebsd.org/D55074
DeltaFile
+65-0sys/dev/tpm/tpm20.c
+1-0sys/dev/tpm/tpm20.h
+1-0sys/dev/tpm/tpm_crb.c
+1-0sys/dev/tpm/tpm_tis_core.c
+68-04 files

HardenedBSD/src 5c9d988tools/build/mk OptionalObsoleteFiles.inc

OptionalObsoleteFiles: Add etc/zfs/compatibility.d

If the world is built and installed with WITHOUT_ZFS, then make
-DBATCH_DELETE_OLD_FILES delete-old-dirs will give the error:

> rmdir: /etc/zfs: Directory not empty

because /etc/zfs/compatibility.d is still there.  While we're here,
clean out /usr/share/zfs as well.

Co-authored-by: kevans
Differential Revision:  https://reviews.freebsd.org/D54758
DeltaFile
+58-0tools/build/mk/OptionalObsoleteFiles.inc
+58-01 files

HardenedBSD/ports 8dc716bcad/librepcb distinfo Makefile

cad/librepcb: update 1.3.0 → 2.0.0
DeltaFile
+1,421-3cad/librepcb/distinfo
+725-8cad/librepcb/Makefile
+6-2cad/librepcb/pkg-plist
+2,152-133 files

HardenedBSD/ports 52a3b80deskutils/skim distinfo Makefile

deskutils/skim: update 2.0.1 → 2.0.2

Reported by:    portscout
DeltaFile
+5-5deskutils/skim/distinfo
+2-2deskutils/skim/Makefile
+7-72 files

HardenedBSD/ports 55048e9devel/py-uv distinfo Makefile, devel/uv distinfo Makefile.crates

devel/{,py-}uv: update 0.9.28 → 0.9.30
DeltaFile
+9-9devel/uv/distinfo
+3-3devel/py-uv/distinfo
+3-3devel/uv/Makefile.crates
+1-1devel/py-uv/Makefile
+1-1devel/uv/Makefile
+17-175 files

HardenedBSD/ports 16b3d81devel/py-uv-build distinfo Makefile

devel/py-uv-build: update 0.9.28 → 0.9.30
DeltaFile
+3-3devel/py-uv-build/distinfo
+1-1devel/py-uv-build/Makefile
+4-42 files

HardenedBSD/ports 6a5f5e0misc/timr-tui distinfo Makefile

misc/timr-tui: update 1.6.1 → 1.7.0

Reported by:    portscout
DeltaFile
+385-305misc/timr-tui/distinfo
+192-153misc/timr-tui/Makefile
+577-4582 files

HardenedBSD/ports a0b45c0sysutils/mise distinfo Makefile

sysutils/mise: update 2026.2.0 → 2026.2.3

Reported by:    portscout
DeltaFile
+57-53sysutils/mise/distinfo
+28-26sysutils/mise/Makefile
+85-792 files

HardenedBSD/ports 20b5e7bmisc/crush distinfo Makefile

misc/crush: Update to 0.39.1

Changelog:
- https://github.com/charmbracelet/crush/releases/tag/v0.38.0
- https://github.com/charmbracelet/crush/releases/tag/v0.38.1
- https://github.com/charmbracelet/crush/releases/tag/v0.39.0
- https://github.com/charmbracelet/crush/releases/tag/v0.39.1

Reported by:    GitHub (watch releases)
DeltaFile
+5-5misc/crush/distinfo
+1-1misc/crush/Makefile
+6-62 files

HardenedBSD/ports fb363fcmath/R-cran-LearnBayes Makefile distinfo

math/R-cran-LearnBayes: Update to 2.15.2

Reported by:    portscout
DeltaFile
+4-3math/R-cran-LearnBayes/Makefile
+3-3math/R-cran-LearnBayes/distinfo
+7-62 files

HardenedBSD/ports 461975fnet/tigervnc-viewer Makefile

net/tigervnc-viewer: Explicitly enable H.264 decoder

not to rely on autodetect. It is enabled via autodetect by ffmpeg
dependency though.
DeltaFile
+5-1net/tigervnc-viewer/Makefile
+5-11 files

HardenedBSD/ports c5dcdc1net/tigervnc-server Makefile

net/tigervnc-server: Explicitly disable Wayland (w0vncserver)

The default is AUTO, which attempts to build with Wayland if it is
installed in the build environment. This may result in
non-reproducible builds depending on the build environment.

In addition, w0vncserver currently fails to build. This is on my TODO
list but disabled for the time being.

While here, explicitly enable pwquality and declare a dependency on
security/libpwquality.

PR:             292938
Reported by:    Paul Boehmer
DeltaFile
+9-3net/tigervnc-server/Makefile
+9-31 files

HardenedBSD/src 9c666desys/dev/acpica acpi.c

Make message added for Darwin OSI quirk more terse

The verbose message was way too verbose. Make it terse.

MFC after:      1 week
MFC with:       052a791b00 ("acpi: add Darwin OSI quirk for Apple Mac hardware")
Requested by:   kib
DeltaFile
+6-8sys/dev/acpica/acpi.c
+6-81 files