HardenedBSD/src 887df4dcddl/contrib/opensolaris/cmd/dtrace dtrace.1

Merge branch 'freebsd/14-stable/main' into hardened/14-stable/master
DeltaFile
+9-1cddl/contrib/opensolaris/cmd/dtrace/dtrace.1
+9-11 files

HardenedBSD/src a9ff197cddl/contrib/opensolaris/cmd/dtrace dtrace.1, lib/libpam/modules/pam_krb5 Makefile

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+1-39usr.sbin/inetd/inetd.8
+9-1cddl/contrib/opensolaris/cmd/dtrace/dtrace.1
+5-5lib/libpam/modules/pam_krb5/Makefile
+4-3lib/libpam/modules/pam_ssh/Makefile
+4-3lib/libpam/modules/pam_radius/Makefile
+4-3lib/libpam/modules/pam_ksu/Makefile
+27-5419 files not shown
+78-10525 files

HardenedBSD/ports 3aa258ddevel/electron39/files patch-chrome_browser_about__flags.cc, multimedia/ringrtc distinfo

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+2,765-2,475net-im/signal-desktop/files/pnpm-lock.yaml
+405-359net-im/libsignal-node/distinfo
+200-177net-im/libsignal-node/Makefile.crates
+216-148net-im/signal-desktop/files/package-lock.json
+59-97multimedia/ringrtc/distinfo
+39-39devel/electron39/files/patch-chrome_browser_about__flags.cc
+3,684-3,29585 files not shown
+4,224-3,89491 files

HardenedBSD/ports f654a58sysutils/py-hcloud distinfo Makefile

sysutils/py-hcloud: update to 2.11.1

Changes:        https://github.com/hetznercloud/hcloud-python/blob/v2.11.1/CHANGELOG.md
Reported by:    repology, portscout
DeltaFile
+3-3sysutils/py-hcloud/distinfo
+1-1sysutils/py-hcloud/Makefile
+4-42 files

HardenedBSD/ports d51f8b4multimedia/mlt7 Makefile, multimedia/mlt7-glaxnimate Makefile

multimedia/mlt7: Disable clang-scan-deps

This fixes build on 14.3, since clang-scan-deps is not in base. We don't
really need it here, so remove the complicated logic.

multimedia/mlt7-glaxnimate: Fix qt5 flavor

It was trying to build MOD_QT6 which wasn't explicitly disabled.

Remove unneeded deps from qt6 flavor.

Fixes:          4488884ee060 - multimedia/mlt7: Update to 7.34.1
DeltaFile
+3-12multimedia/mlt7/Makefile
+4-4multimedia/mlt7-glaxnimate/Makefile
+7-162 files

HardenedBSD/ports 6220ad6net-im/signal-desktop/files pnpm-lock.yaml package-lock.json

net-im/signal-desktop: Update to 7.79.0
DeltaFile
+2,765-2,475net-im/signal-desktop/files/pnpm-lock.yaml
+216-148net-im/signal-desktop/files/package-lock.json
+2-46net-im/signal-desktop/files/patch-package.json
+0-45net-im/signal-desktop/files/patch-ts_util_os_shared.ts
+45-0net-im/signal-desktop/files/patch-ts_util_os_shared.std.ts
+0-37net-im/signal-desktop/files/patch-app_main.ts
+3,028-2,75132 files not shown
+3,314-2,96538 files

HardenedBSD/ports 9be5c97multimedia/ringrtc distinfo Makefile.crates, multimedia/ringrtc/files patch-cargo-crates_cubeb-sys_build.rs

multimedia/ringrtc: Update to 2.59.4
DeltaFile
+59-97multimedia/ringrtc/distinfo
+27-46multimedia/ringrtc/Makefile.crates
+2-7multimedia/ringrtc/webrtc_fetch.sh
+4-4multimedia/ringrtc/Makefile
+2-2multimedia/ringrtc/files/patch-cargo-crates_cubeb-sys_build.rs
+1-1multimedia/ringrtc/update.txt
+95-1576 files

HardenedBSD/ports 7985df5net-im/libsignal-node distinfo Makefile.crates

net-im/libsignal-node: Update to 0.83.0
DeltaFile
+405-359net-im/libsignal-node/distinfo
+200-177net-im/libsignal-node/Makefile.crates
+1-2net-im/libsignal-node/Makefile
+606-5383 files

HardenedBSD/ports 0b95275sysutils/duplicity Makefile distinfo, sysutils/duplicity/files patch-pyproject.toml extra-patch-setup.py

sysutils/duplicity: Update to 3.0.6.1

- Remove GDOCS option that depends on expired www/py-pydrive2

ChangeLog:      https://duplicity.gitlab.io/stable/CHANGELOG.html
MFH:            2025Q4 (bugfixes)
DeltaFile
+5-3sysutils/duplicity/files/patch-pyproject.toml
+3-4sysutils/duplicity/Makefile
+3-3sysutils/duplicity/distinfo
+1-1sysutils/duplicity/files/extra-patch-setup.py
+12-114 files

HardenedBSD/ports 6b305b8audio/gbsplay distinfo Makefile

audio/gbsplay: Update to 0.0.102
DeltaFile
+3-3audio/gbsplay/distinfo
+1-1audio/gbsplay/Makefile
+4-42 files

HardenedBSD/src 4872b48sys/kern kern_prot.c

setcred(): Fix 32-bit compatibility copy-in

For 32-bit processes on 64-bit architectures, a difference of 'int'
pointers was wrongly used as a number of bytes to copy in a memcpy()
used to internally construct a 64-bit 'struct setcred' from the 32-bit
variant, leading to copying only part of the 32-bit structure, and thus
to requesting credentials with garbage IDs except for the real and
effective user IDs.

This bug was spotted by jhb@, who produced a slightly more invasive fix
in D53757 (a switch to using CP() on all fields).  In the interest of
minimizing the diff for possible inclusion in 15.0, the commit here just
limits itself to fixing the number of bytes to copy.

Tested successfully on a VM with 32-bit mdo(1) (and in passing also
tested that the same executable on a kernel without this change exhibits
the bug in practice, in the form of setcred() failing with EINVAL).

Reported by:    jhb

    [5 lines not shown]
DeltaFile
+2-2sys/kern/kern_prot.c
+2-21 files

HardenedBSD/src b1972bdlib/libpam/modules/pam_deny Makefile, lib/libpam/modules/pam_echo Makefile

libpam: Don't put man8 in the dev package

These are user-facing manpages, but were installed in the runtime-dev
package since the PAM modules use bsd.lib.mk.  Use MANNODEV instead of
MAN to put them in the base runtime package instead.

Fixes:  031e711647c3 ("packages: Install development manpages in the -dev package")
MFC after:      3 days
Reviewed by:    bapt
Sponsored by:   https://www.patreon.com/bsdivy
Differential Revision:  https://reviews.freebsd.org/D53601
DeltaFile
+5-5lib/libpam/modules/pam_krb5/Makefile
+4-3lib/libpam/modules/pam_ksu/Makefile
+4-3lib/libpam/modules/pam_radius/Makefile
+4-3lib/libpam/modules/pam_ssh/Makefile
+3-3lib/libpam/modules/pam_echo/Makefile
+3-3lib/libpam/modules/pam_deny/Makefile
+23-2017 files not shown
+68-6523 files

HardenedBSD/src 5c889c6usr.sbin/inetd inetd.8

inetd.8: Remove the enumeration of examples

The user can trivially see the list of examples in /etc/inetd.conf
by looking at the file, so there's no need to include an entire
paragraph in the manual enumerating the examples which are provided.

MFC after:      3 days
Reviewed by:    0mp
Sponsored by:   https://www.patreon.com/bsdivy
Differential Revision:  https://reviews.freebsd.org/D52740
DeltaFile
+1-39usr.sbin/inetd/inetd.8
+1-391 files

HardenedBSD/ports 923902adevel/electron39/files patch-chrome_browser_about__flags.cc patch-electron_spec_api-app-spec.ts

devel/electron39: Update to 39.2.0

Changelog:
- https://github.com/electron/electron/releases/tag/v39.1.2
- https://github.com/electron/electron/releases/tag/v39.2.0

Reported by:    GitHub (watch releases)
DeltaFile
+39-39devel/electron39/files/patch-chrome_browser_about__flags.cc
+14-14devel/electron39/files/patch-electron_spec_api-app-spec.ts
+13-13devel/electron39/files/patch-electron_spec_api-browser-window-spec.ts
+10-10devel/electron39/files/patch-electron_shell_browser_native__window__views.cc
+10-10devel/electron39/files/patch-electron_shell_browser_electron__browser__main__parts.cc
+9-9devel/electron39/files/patch-third__party_blink_renderer_platform_runtime__enabled__features.json5
+95-9524 files not shown
+168-17230 files

HardenedBSD/src 51184e3usr.sbin/bsdinstall Makefile FreeBSD-base.conf.in

bsdinstall: Use pkgbase.f.o for BETA/RC/RELEASE

For BETA/RC/RELEASE builds, fetch files from the appropriate repository
on pkgbase.freebsd.org, using the appropriate signing keys.  Note that
there is a separate repository for each BETA and RC; this ensures that
someone installing from e.g. a 15.0-RC1 ISO will get 15.0-RC1 bits and
not whatever happens to be the most recent build from releng/15.0.

With hat:       re
MFC after:      8 hours (needed in 15.0-RC1)
DeltaFile
+13-3usr.sbin/bsdinstall/Makefile
+2-2usr.sbin/bsdinstall/FreeBSD-base.conf.in
+15-52 files

HardenedBSD/src b05f382etc/mtree BSD.usr.dist, share/keys Makefile

Add pkgbase signing keys for FreeBSD 15

These keys were generated by cperciva@ using the AWS Key Management
Service.  They will not be used for signing anything other than
FreeBSD 15.x pkgbase repositories.

Keys will be generated for FreeBSD 16 at a later date, and likely in
a different way.

With hat:       re
MFC after:      8 hours (needed in 15.0-RC1)
Differential Revision:  https://reviews.freebsd.org/D53768
DeltaFile
+8-0share/keys/pkgbase-15/trusted/Makefile
+6-0etc/mtree/BSD.usr.dist
+3-0share/keys/pkgbase-15/Makefile
+1-1share/keys/Makefile
+2-0share/keys/pkgbase-15/trusted/awskms-15
+20-15 files

HardenedBSD/src 8e0b1a1usr.sbin/pkg FreeBSD.conf.latest FreeBSD.conf.quarterly

pkg: Add FreeBSD-base to /etc/pkg/FreeBSD.conf

On -CURRENT and -STABLE this gets bits from pkg.freebsd.org; but we get
base system bits from pkgbase.freebsd.org for BETA/RC/RELEASE.

Note that this repository is disabled by default, but can still be used
by explicitly specifying it, e.g. "pkg upgrade -r FreeBSD-base".

With hat:       re
MFC after:      8 hours (needed in 15.0-RC1)
DeltaFile
+9-0usr.sbin/pkg/FreeBSD.conf.latest
+9-0usr.sbin/pkg/FreeBSD.conf.quarterly
+9-0usr.sbin/pkg/FreeBSD.conf.quarterly-release
+27-03 files

HardenedBSD/src bdfc223usr.sbin/bsdinstall/scripts pkgbase.in

bsdinstall: Don't install FreeBSD-base.conf

When installing e.g. 15.0-RC1, we want to get files from the 15.0-RC1
pkgbase repository; but running 'pkg upgrade' after installation should
get the latest bits build from releng/15.0.

With hat:       re
MFC after:      8 hours (needed in 15.0-RC1)
DeltaFile
+2-10usr.sbin/bsdinstall/scripts/pkgbase.in
+2-101 files

HardenedBSD/src 6b0909fusr.sbin/bsdinstall/scripts pkgbase.in

bsdinstall: Copy in all keys

The keys used for pkgbase signing are going to be placed in
/usr/share/keys/pkgbase-N where N is the FreeBSD major version
number; as such it's not sufficient to copy /usr/share/keys/pkg
into the install chroot, but instead we need /usr/share/keys/*.

With hat:       re
MFC after:      8 hours (needed in 15.0-RC1)
Differential Revision:  https://reviews.freebsd.org/D53753
DeltaFile
+1-1usr.sbin/bsdinstall/scripts/pkgbase.in
+1-11 files

HardenedBSD/ports e04f3b5x11/autorandr Makefile distinfo, x11/autorandr/files patch-autorandr.py patch-contrib_autorandr__launcher_autorandr__launcher.c

x11/autorandr: update to 1.15

* contrib/autorandr_launcher patch was superseded by compiler define

PR:     291016
DeltaFile
+7-7x11/autorandr/files/patch-autorandr.py
+0-11x11/autorandr/files/patch-contrib_autorandr__launcher_autorandr__launcher.c
+4-6x11/autorandr/Makefile
+3-3x11/autorandr/distinfo
+14-274 files

HardenedBSD/src dc8adefcddl/contrib/opensolaris/cmd/dtrace dtrace.1

dtrace.1: Document DTRACE_DEBUG

Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D53627

(cherry picked from commit f811c0a555546e4154dfa159e8f56b3ba1c70d0d)
DeltaFile
+9-1cddl/contrib/opensolaris/cmd/dtrace/dtrace.1
+9-11 files

HardenedBSD/src c35cdf7cddl/contrib/opensolaris/cmd/dtrace dtrace.1

dtrace.1: Document DTRACE_DEBUG

Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D53627

(cherry picked from commit f811c0a555546e4154dfa159e8f56b3ba1c70d0d)
DeltaFile
+9-1cddl/contrib/opensolaris/cmd/dtrace/dtrace.1
+9-11 files

HardenedBSD/src 4712af6sys/arm/broadcom/bcm2835 bcm2835_audio.c, sys/contrib/vchiq/interface/vchiq_arm vchiq_arm.c vchiq_2835_arm.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+357-127sys/contrib/vchiq/interface/vchiq_arm/vchiq_arm.c
+137-15sys/arm/broadcom/bcm2835/bcm2835_audio.c
+125-20sys/contrib/vchiq/interface/vchiq_arm/vchiq_2835_arm.c
+121-0sys/contrib/vchiq/interface/vchiq_arm/vchiq_ioctl.h
+55-36sys/contrib/vchiq/interface/vchiq_arm/vchiq_core.c
+67-9sys/contrib/vchiq/interface/vchiq_arm/vchiq_kmod.c
+862-20713 files not shown
+951-24419 files

HardenedBSD/src ae31d26sys/arm/broadcom/bcm2835 bcm2835_audio.c, sys/contrib/vchiq/interface/vchiq_arm vchiq_arm.c vchiq_2835_arm.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+357-127sys/contrib/vchiq/interface/vchiq_arm/vchiq_arm.c
+137-15sys/arm/broadcom/bcm2835/bcm2835_audio.c
+125-20sys/contrib/vchiq/interface/vchiq_arm/vchiq_2835_arm.c
+121-0sys/contrib/vchiq/interface/vchiq_arm/vchiq_ioctl.h
+55-36sys/contrib/vchiq/interface/vchiq_arm/vchiq_core.c
+67-9sys/contrib/vchiq/interface/vchiq_arm/vchiq_kmod.c
+862-20713 files not shown
+951-24419 files

HardenedBSD/ports a39b065audio/TonieToolbox Makefile, devel/electron38/files patch-electron_spec_api-app-spec.ts patch-electron_spec_api-browser-window-spec.ts

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+14-14devel/electron38/files/patch-electron_spec_api-app-spec.ts
+28-0audio/TonieToolbox/Makefile
+13-13devel/electron38/files/patch-electron_spec_api-browser-window-spec.ts
+0-24www/rubygem-gon-rails61/Makefile
+0-24www/rubygem-gon-rails60/Makefile
+0-24www/rubygem-gon-rails70/Makefile
+55-9937 files not shown
+175-20143 files

HardenedBSD/ports 27ef4b5audio Makefile, audio/TonieToolbox Makefile pkg-descr

audio/TonieToolbox: added new port with version 0.6.5

Changes:        https://github.com/Quentendo64/TonieToolbox/blob/main/CHANGELOG.md
DeltaFile
+28-0audio/TonieToolbox/Makefile
+18-0audio/TonieToolbox/files/patch-pyproject.toml
+15-0audio/TonieToolbox/pkg-descr
+3-0audio/TonieToolbox/distinfo
+1-0audio/Makefile
+65-05 files

HardenedBSD/ports 12c710ewww/filebrowser-quantum Makefile distinfo

www/filebrowser-quantum: Update to 1.0.1 (stable)

Since version 1.0.0, filebrowser-quantum has been divided into two "flavors"
(although we call them "channels" to avoid confusion with port flavors):
beta and stable, and now this port uses the stable channel by default.
DeltaFile
+9-7www/filebrowser-quantum/Makefile
+7-7www/filebrowser-quantum/distinfo
+16-142 files

HardenedBSD/ports b6fcfc5www/filebrowser distinfo Makefile

www/filebrowser: Update to 2.46.0

ChangeLog: https://github.com/filebrowser/filebrowser/releases/tag/v2.46.0
DeltaFile
+7-7www/filebrowser/distinfo
+1-2www/filebrowser/Makefile
+8-92 files

HardenedBSD/ports 3d87d04devel/rubygem-CFPropertyList-gitlab Makefile distinfo

devel/rubygem-CFPropertyList-gitlab: update to 3.0.8

Changes:        https://github.com/ckruse/CFPropertyList/tags
DeltaFile
+4-5devel/rubygem-CFPropertyList-gitlab/Makefile
+3-3devel/rubygem-CFPropertyList-gitlab/distinfo
+7-82 files

HardenedBSD/ports f801fcasecurity/rubygem-gitlab-secret_detection distinfo Makefile

security/rubygem-gitlab-secret_detection: update to 0.38.1

Changes:        https://gitlab.com/gitlab-org/security-products/secret-detection/secret-detection-service/-/blob/main/CHANGELOG.md
DeltaFile
+3-3security/rubygem-gitlab-secret_detection/distinfo
+1-1security/rubygem-gitlab-secret_detection/Makefile
+4-42 files