HardenedBSD/src debee88release Makefile.gce, sys/netpfil/pf pf.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+43-0tests/sys/netpfil/pf/divert-to.sh
+12-8sys/netpfil/pf/pf.c
+7-11usr.sbin/bsdinstall/scripts/pkgbase.in
+11-2release/Makefile.gce
+9-0usr.sbin/pkg/FreeBSD.conf.latest
+9-0usr.sbin/pkg/FreeBSD.conf.quarterly-release
+91-219 files not shown
+132-2715 files

HardenedBSD/src b3c5b5drelease/tools vmimage.subr, sys/netpfil/pf pf.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+43-0tests/sys/netpfil/pf/divert-to.sh
+12-8sys/netpfil/pf/pf.c
+8-1release/tools/vmimage.subr
+4-0usr.sbin/bsdinstall/scripts/pkgbase.in
+67-94 files

HardenedBSD/ports ce0c8e4lang/fpc-source Makefile

lang/fpc-source: pet stage-qa (+)

No need to put .git* files in package, as it already done for lang/fpc-devel-source

Reported by:    bulk -t
Approved by:    portmgr blanket
DeltaFile
+3-0lang/fpc-source/Makefile
+3-01 files

HardenedBSD/ports 205f13dsecurity/lxqt-sudo pkg-plist Makefile

security/lxqt-sudo: handle orphans in plist (+)

Reported by:    bulk -t
Approved by:    portmgr blanket
DeltaFile
+2-0security/lxqt-sudo/pkg-plist
+1-0security/lxqt-sudo/Makefile
+3-02 files

HardenedBSD/ports 61e766ax11-wm/lxqt-wayland-session Makefile

x11-wm/lxqt-wayland-session: pet stage-qa, lxqt-qdbus is a bash script (+)

====> Running Q/A tests (stage-qa)
Error: '/bin/bash' is an invalid shebang you need USES=shebangfix for 'bin/lxqt-qdbus'

Reported by:    bulk -t
Approved by:    portmgr blanket
DeltaFile
+6-2x11-wm/lxqt-wayland-session/Makefile
+6-21 files

HardenedBSD/ports a26ecb9net/libmateweather Makefile pkg-plist

net/libmateweather: handle orphans in plist (+)

Reported by:    bulk -t
Approved by:    portmgr blanket
DeltaFile
+1-0net/libmateweather/Makefile
+1-0net/libmateweather/pkg-plist
+2-02 files

HardenedBSD/ports db1d18bsecurity/opkssh Makefile, security/opkssh/files patch-main.go pkg-message.in

security/opkssh: New port: Tool which enables SSH to be used with OpenID Connect

opkssh is a tool which enables ssh to be used with OpenID Connect
allowing SSH access to be managed via identities like alice at example.com
instead of long-lived SSH keys. It does not replace SSH, but instead
generates SSH public keys containing PK Tokens and configures sshd
to verify them. These PK Tokens contain standard OpenID Connect ID
Tokens. This protocol builds on the OpenPubkey which adds user
public keys to OpenID Connect without breaking compatibility with
existing OpenID Provider.
DeltaFile
+91-0security/opkssh/files/patch-main.go
+50-0security/opkssh/Makefile
+20-0security/opkssh/files/pkg-message.in
+11-0security/opkssh/files/patch-commands_readhome.go
+11-0security/opkssh/files/patch-policy_enforcer.go
+11-0security/opkssh/files/patch-policy_policyloader.go
+194-05 files not shown
+210-211 files

HardenedBSD/ports 86acb17x11-wm/phoc distinfo Makefile

x11-wm/phoc: update to 0.51.0

Changes:        https://gitlab.gnome.org/World/Phosh/phoc/-/releases/v0.51.0
Reported by:    GitLab (notify releases)
DeltaFile
+3-3x11-wm/phoc/distinfo
+1-1x11-wm/phoc/Makefile
+4-42 files

HardenedBSD/ports 7b38136textproc/scdoc distinfo Makefile

textproc/scdoc: update to 1.11.4

Changes:        https://git.sr.ht/%7Esircmpwn/scdoc/refs/1.11.4
Reported by:    Repology
DeltaFile
+3-3textproc/scdoc/distinfo
+1-1textproc/scdoc/Makefile
+4-42 files

HardenedBSD/ports 633e338devel/jenkins-lts distinfo Makefile

devel/jenkins-lts: Update to 2.528.2

Sponsored by:   The FreeBSD Foundation
DeltaFile
+3-3devel/jenkins-lts/distinfo
+1-1devel/jenkins-lts/Makefile
+4-42 files

HardenedBSD/ports ddd9e80devel/forgejo-runner Makefile, devel/forgejo-runner/files act_runner.in

devel/forgejo-runner: Add supervisor mode for daemon(8)

If the server is not available when act_runner starts, act_runner
terminates.

Notes:
1. This is a breaking change - previously set act_runner_flags specified
   in rc.conf are applied to daemon(8), not act_runner. To pass
   parameters to act_runner, act_runner_args is used.
2. The system must be updated due to FreeBSD-EN-25:06.daemon.

While here fix build with non-default user/group and split long line.

PR:     288957
DeltaFile
+14-11devel/forgejo-runner/files/act_runner.in
+9-5devel/forgejo-runner/Makefile
+23-162 files

HardenedBSD/ports 6513afbnet-im/tg_owt distinfo Makefile

net-im/tg_owt: update to the recent snapshot
DeltaFile
+3-3net-im/tg_owt/distinfo
+2-2net-im/tg_owt/Makefile
+5-52 files

HardenedBSD/ports fe63e4fnet-im/telegram-desktop distinfo Makefile, net-im/telegram-desktop/files patch-Telegram_SourceFiles_platform_linux_specific__linux.cpp

net-im/telegram-desktop: update from 6.2.4 to 6.3.0

Patch obtained from:    https://cvsweb.openbsd.org/ports/net/tdesktop/patches/patch-Telegram_SourceFiles_platform_linux_specific_linux_cpp

Sponsored by:   tipi.work
DeltaFile
+56-0net-im/telegram-desktop/files/patch-Telegram_SourceFiles_platform_linux_specific__linux.cpp
+3-3net-im/telegram-desktop/distinfo
+1-2net-im/telegram-desktop/Makefile
+60-53 files

HardenedBSD/ports 0d0b5b5audio/lilv distinfo Makefile

audio/lilv: Update to 0.26.0

ChangeLog: https://drobilla.net/2025/11/12/lilv-0-26-0.html
DeltaFile
+3-3audio/lilv/distinfo
+1-1audio/lilv/Makefile
+4-42 files

HardenedBSD/ports 22074abdevel/R-cran-testthat Makefile distinfo

devel/R-cran-testthat: Update to 3.3.0

- Put tests as safe
  A custom do-test and UTF-8 env needed to be set so tests succeed

ChangeLog: https://cloud.r-project.org/web/packages/testthat/news/news.html
DeltaFile
+15-15devel/R-cran-testthat/Makefile
+3-3devel/R-cran-testthat/distinfo
+18-182 files

HardenedBSD/ports f3108c5math/intx distinfo Makefile

math/intx: Update to 0.14.0

ChangeLog: https://github.com/chfast/intx/releases/tag/v0.14.0
DeltaFile
+3-3math/intx/distinfo
+1-1math/intx/Makefile
+4-42 files

HardenedBSD/src e0c41afrelease/tools vmimage.subr

vmimage.subr: Enable FreeBSD-base repo if pkgbase

When creating a VM image using pkgbase, create a configuration file in
/usr/local/etc/pkg/repos/FreeBSD.conf which enables the FreeBSD-base
repository.  (This repository is defined in /etc/pkg/FreeBSD.conf as
being disabled by default.)

Reported by:    Mark Millard
MFC after:      immediately (needed for 15.0-RC1)
DeltaFile
+4-0release/tools/vmimage.subr
+4-01 files

HardenedBSD/src a96230eusr.sbin/bsdinstall/scripts pkgbase.in

bsdinstall: Enable FreeBSD-base repo when pkgbase

When performing a pkgbase install, create a configuration file in
/usr/local/etc/pkg/repos/FreeBSD.conf which enables the FreeBSD-base
repository.  (This repository is defined in /etc/pkg/FreeBSD.conf as
being disabled by default.)

Reported by:    Mark Millard
Reviewed by:    markj
MFC after:      immediately (needed for 15.0-RC1)
Differential Revision:  https://reviews.freebsd.org/D53777
DeltaFile
+4-0usr.sbin/bsdinstall/scripts/pkgbase.in
+4-01 files

HardenedBSD/src 10a4f2drelease/tools vmimage.subr

vmimage.subr: Log pkg/local.sqlite if pkgbase

We were doing this in vm_extra_install_packages but VM images without
any extra packages installed would not get this installed.  This
results in a pkgbase system which thinks it doesn't have any packages
installed (even though all the files are right there).

Add a "metalog_add_data ./var/db/pkg/local.sqlite" call to the pkgbase
install code path, and make the call from vm_extra_install_packages
conditional on !PKGBASE.

Reported by:    Michael Dexter
MFC after:      immediately (needed for 15.0-RC1)
DeltaFile
+4-1release/tools/vmimage.subr
+4-11 files

HardenedBSD/src 66f2f1csys/netpfil/pf pf.c, tests/sys/netpfil/pf divert-to.sh

pf: handle divert packets

In a divert setup pf_test_state() may return PF_PASS, but not set the state
pointer. We didn't handle that, and as a result crashed immediately afterwards
trying to dereference that NULL state pointer.

Add a test case to provoke the problem.

PR:             260867
MFC after:      2 weeks
Submitted by:   Phil Budne <phil.budne at gmail.com>
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+43-0tests/sys/netpfil/pf/divert-to.sh
+12-8sys/netpfil/pf/pf.c
+55-82 files

HardenedBSD/src 1f93581share/keys Makefile, usr.sbin/bsdinstall Makefile

HBSD: Resolve merge conflicts

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-24usr.sbin/bsdinstall/Makefile
+0-14usr.sbin/bsdinstall/scripts/pkgbase.in
+0-4share/keys/Makefile
+0-423 files

HardenedBSD/ports 87a27a9www/osticket Makefile

www/osticket: Remove defunct IGNORE_WITH_PHP

php80 has retired a couple of years ago and this line is defunct.

Approved by:    portmgr (blanket)
DeltaFile
+0-1www/osticket/Makefile
+0-11 files

HardenedBSD/src 895074crelease Makefile.gce, usr.sbin/bsdinstall Makefile

Merge remote-tracking branch 'internal/freebsd/current/main' into hardened/current/master

Conflicts:
        share/keys/Makefile (unresolved)
        usr.sbin/bsdinstall/Makefile (unresolved)
        usr.sbin/bsdinstall/scripts/pkgbase.in (unresolved)
DeltaFile
+24-0usr.sbin/bsdinstall/Makefile
+11-2release/Makefile.gce
+8-2usr.sbin/bsdinstall/scripts/pkgbase.in
+9-0usr.sbin/pkg/FreeBSD.conf.quarterly-release
+9-0usr.sbin/pkg/FreeBSD.conf.quarterly
+9-0usr.sbin/pkg/FreeBSD.conf.latest
+70-47 files not shown
+97-813 files

HardenedBSD/ports 758549fdevel/py-perceval-weblate Makefile

devel/py-perceval-weblate: Return to pool

Used in cluster and releasing so that others can update as necessary
without my intervention.

Changelog: https://github.com/chaoss/grimoirelab-perceval-weblate/releases/tag/${NEW_VERSION}
DeltaFile
+2-1devel/py-perceval-weblate/Makefile
+2-11 files

HardenedBSD/ports 2842015databases/clickhouse distinfo Makefile.submodules, databases/clickhouse/files patch-PreLoad.cmake

databases/clickhouse: Update version 24.5.1.1763=>25.10.2.65

Changelog: https://github.com/ClickHouse/ClickHouse/releases/tag/v25.10.2.65-stable

Sponsored by:   Nepustil
DeltaFile
+259-249databases/clickhouse/distinfo
+128-123databases/clickhouse/Makefile.submodules
+20-7databases/clickhouse/files/patch-PreLoad.cmake
+14-11databases/clickhouse/Makefile
+6-1databases/clickhouse/pkg-plist
+427-3915 files

HardenedBSD/ports 3f6fadfsecurity/sslproxy distinfo Makefile, security/sslproxy/files patch-src_filter.c

security/sslproxy: Update version 0.9.9=>0.9.10

Changelog: https://github.com/sonertari/SSLproxy/releases/tag/v0.9.10
DeltaFile
+0-39security/sslproxy/files/patch-src_filter.c
+3-3security/sslproxy/distinfo
+1-1security/sslproxy/Makefile
+4-433 files

HardenedBSD/ports c878a02lang/php85 distinfo Makefile

lang/php85: Update version 8.5.0RC4=>8.5.0RC5

Please DO NOT use this version in production, it is an early test
version.

Changelog: https://github.com/php/php-src/blob/php-8.5.0RC5/NEWS
DeltaFile
+3-3lang/php85/distinfo
+1-1lang/php85/Makefile
+4-42 files

HardenedBSD/ports 718990aemulators/qemu-devel distinfo Makefile

emulators/qemu-devel: Update version 10.1.20250930=>10.1.20251031
DeltaFile
+15-15emulators/qemu-devel/distinfo
+3-3emulators/qemu-devel/Makefile
+18-182 files

HardenedBSD/ports c671e22databases/freetds-devel distinfo Makefile

databases/freetds-devel: Update version 1.5.147=>1.5.151
DeltaFile
+3-3databases/freetds-devel/distinfo
+1-1databases/freetds-devel/Makefile
+4-42 files

HardenedBSD/src 29415dbsys/arm64/vmm vmm_arm64.c, sys/kern kern_prot.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+7-7sys/arm64/vmm/vmm_arm64.c
+2-2sys/kern/kern_prot.c
+9-92 files