HardenedBSD/src 0fd89e9 — sbin/nvmecontrol nvmecontrol.8 passthru.c, share/examples/sound oss.h

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+138-9sbin/nvmecontrol/format.c
+74-27tools/boot/boot-test.sh
+49-13sys/dev/nvme/nvme_ctrlr.c
+15-26share/examples/sound/oss.h
+25-8sbin/nvmecontrol/passthru.c
+26-2sbin/nvmecontrol/nvmecontrol.8
+327-856 files not shown
+392-10112 files

HardenedBSD/src 8bf8f39 — sbin/nvmecontrol nvmecontrol.8 passthru.c, share/examples/sound oss.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+138-9sbin/nvmecontrol/format.c
+74-27tools/boot/boot-test.sh
+49-13sys/dev/nvme/nvme_ctrlr.c
+15-26share/examples/sound/oss.h
+25-8sbin/nvmecontrol/passthru.c
+26-2sbin/nvmecontrol/nvmecontrol.8
+327-856 files not shown
+392-10112 files

HardenedBSD/ports 9600d7f — audio/songrec distinfo, devel/llvm13 pkg-plist

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+353-379shells/starship/distinfo
+0-545devel/llvm14/pkg-plist
+0-538devel/llvm13/pkg-plist
+220-254japanese/mozc-server/Makefile
+176-190shells/starship/Makefile
+181-175audio/songrec/distinfo
+930-2,081268 files not shown
+5,936-4,786274 files

HardenedBSD/ports cf3dd66 — devel/llvm14 pkg-plist Makefile, devel/llvm14/files gold-off-llvm_tools_CMakeLists.txt patch-llvm_include_tools_CMakeLists.txt

devel/llvm14: remove GOLD support

binutils will remove gold in upcoming releases so drop support preemptively.
DeltaFile
+9-14devel/llvm14/Makefile
+0-10devel/llvm14/files/gold-off-llvm_tools_CMakeLists.txt
+10-0devel/llvm14/files/patch-llvm_include_tools_CMakeLists.txt
+0-1devel/llvm14/pkg-plist
+19-254 files

HardenedBSD/ports 84e4d6a — devel/llvm14 Makefile

devel/llvm14: remove FLANG and MLIR from the default build

It would be surprising if anyone was using these ancient versions so
stop wasting build time for most people.
DeltaFile
+1-1devel/llvm14/Makefile
+1-11 files

HardenedBSD/ports a0bde6a — devel/llvm14 Makefile.MAN1SRCS Makefile.COMMANDS

devel/llvm14: Remove the LLDB option and fix plist with DOCS

LLDB's Python script interpreter fails to build with Python 3.13
(_Py_IsFinalizing was removed), which blocks switching the default
Python version to 3.13.  Rather than patching an old debugger, remove
the LLDB option as discussed in PR 292105: LLDB remains available
from devel/llvm18 and later and from the base system.

This also drops the swig build dependency and the lua53 and libedit
library dependencies.

While here, fix the plist with DOCS enabled: the openmp and flang
HTML documentation leaves an empty _sources directory behind, and
check-plist fails with orphaned directories.  Remove them;
devel/llvm12 does the same for openmp (a4f732450dd3).

PR:             299422
DeltaFile
+0-544devel/llvm14/pkg-plist
+10-29devel/llvm14/Makefile
+0-7devel/llvm14/Makefile.COMMANDS
+0-3devel/llvm14/Makefile.MAN1SRCS
+10-5834 files

HardenedBSD/ports 339f7b4 — devel/llvm13 Makefile

devel/llvm13: remove FLANG and MLIR from the default build

It would be surprising if anyone was using these ancient versions so
stop wasting build time for most people.
DeltaFile
+1-1devel/llvm13/Makefile
+1-11 files

HardenedBSD/ports daff097 — devel/llvm13 pkg-plist Makefile, devel/llvm13/files gold-off-llvm_tools_CMakeLists.txt patch-llvm_include_tools_CMakeLists.txt

devel/llvm13: remove GOLD support

binutils will remove gold in upcoming releases so drop support preemptively.
DeltaFile
+10-15devel/llvm13/Makefile
+0-10devel/llvm13/files/gold-off-llvm_tools_CMakeLists.txt
+10-0devel/llvm13/files/patch-llvm_include_tools_CMakeLists.txt
+0-1devel/llvm13/pkg-plist
+20-264 files

HardenedBSD/ports 6a0f728 — devel/llvm19/files patch-flang_runtime_io-api-minimal.cpp patch-flang_runtime_Float128Math_math-entries.h

devel/llvm19: fix build with flang and libc++ 21

Also "fix" build on aarch64 by stubbing out a few quad float symbols.
DeltaFile
+50-0devel/llvm19/files/patch-flang_runtime_Float128Math_math-entries.h
+24-0devel/llvm19/files/patch-flang_runtime_io-api-minimal.cpp
+74-02 files

HardenedBSD/ports e957aac — devel/llvm13 Makefile.MAN1SRCS Makefile.COMMANDS

devel/llvm13: Remove the LLDB option and fix plist with DOCS

LLDB's Python script interpreter fails to build with Python 3.13
(PyEval_ThreadsInitialized was removed), which blocks switching the
default Python version to 3.13.  Rather than patching an old debugger,
remove the LLDB option as discussed in PR 292105: LLDB remains available
from devel/llvm18 and later and from the base system.

This also drops the swig build dependency and the lua53 and libedit
library dependencies.

While here, fix the plist with DOCS enabled: the openmp and flang
HTML documentation leaves an empty _sources directory behind, and
check-plist fails with orphaned directories.  Remove them;
devel/llvm12 does the same for openmp (a4f732450dd3).

PR:             299421
DeltaFile
+0-537devel/llvm13/pkg-plist
+10-27devel/llvm13/Makefile
+0-7devel/llvm13/Makefile.COMMANDS
+0-3devel/llvm13/Makefile.MAN1SRCS
+10-5744 files

HardenedBSD/ports 908f468 — security/vuxml/vuln 2026.xml

security/vuxml: Document Roundcube vulnerabilities
DeltaFile
+50-0security/vuxml/vuln/2026.xml
+50-01 files

HardenedBSD/ports e48e965 — databases/datui Makefile

databases/datui: Use USES=sqlite

Replace the hand-written LIB_DEPENDS on databases/sqlite3 with the
sqlite USES helper.

Reported by:    diizzy
DeltaFile
+2-3databases/datui/Makefile
+2-31 files

HardenedBSD/ports 230591a — lang/swift6 Makefile pkg-plist, lang/swift6/files patch-swift-build_Sources_SWBUtil_Architecture.swift patch-swift_lib_IRGen_GenOpaque.cpp

lang/swift6: add powerpc64le support

Two bootstrap tarballs are needed because the long double ABI changed in
16.0: freebsd14 works on 14.x and on 15.x with misc/compat14x, freebsd16 is
for 16.0 and newer. Both were built with the port's own BOOTSTRAP_MODE.

PR:             299357
Approved by:    tagattie (maintainer)
DeltaFile
+60-60lang/swift6/pkg-plist
+103-0lang/swift6/files/patch-swift_lib_IRGen_IRGenSIL.cpp
+36-8lang/swift6/Makefile
+34-0lang/swift6/files/patch-swift-corelibs-libdispatch_src_queue.c
+31-0lang/swift6/files/patch-swift_lib_IRGen_GenOpaque.cpp
+22-0lang/swift6/files/patch-swift-build_Sources_SWBUtil_Architecture.swift
+286-6813 files not shown
+469-6819 files

HardenedBSD/ports c0a54d5 — Mk/Uses fpc.mk

Mk/Uses/fpc.mk: use powerpc64 as FPC_ARCH on powerpc64le

fpc doesn't have a separate powerpc64le CPU, it's powerpc64 for both
endians. lang/fpc-devel already handles it, but ports using USES=fpc got
rtl/freebsd/powerpc64le and failed to patch.
DeltaFile
+1-1Mk/Uses/fpc.mk
+1-11 files

HardenedBSD/ports 8837f44 — www/py-bokeh pkg-message distinfo, www/py-bokeh/files patch-pyproject.toml patch-setup.py

www/py-bokeh: Update 2.4.3 => 3.10.1

bokeh 2.4.3 uses np.bool8, which numpy 2 removed, so
"import bokeh.plotting" fails with the numpy 2.4 in the tree.  It is
also too old for its consumers: dask[diagnostics] and the distributed
dashboard need bokeh>=3.1, arviz-plots needs bokeh>=3.4 and hits needs
bokeh>=3.2.

- Switch to PEP 517; the sdist ships the prebuilt BokehJS, so no node
  is needed
- Add RUN_DEPENDS on narwhals and xyzservices; drop python-dateutil,
  six and typing-extensions; tornado>=6.2
- Patch pyproject.toml for setuptools 63 (requires, PEP 639 license)
  and do not install the stray top-level "typings" stub package
- Guard the setuptools>=64-only editable_wheel import in setup.py
- Requires Python 3.12+

Changelog:      https://docs.bokeh.org/en/latest/docs/releases.html
DeltaFile
+38-0www/py-bokeh/files/patch-setup.py
+33-0www/py-bokeh/files/patch-pyproject.toml
+14-12www/py-bokeh/Makefile
+3-3www/py-bokeh/distinfo
+3-0www/py-bokeh/pkg-message
+91-155 files

HardenedBSD/ports 943322c — lang/nim distinfo Makefile, lang/nim/files patch-c__code_5__2__msemfold.nim.c patch-lib_pure_concurrency_cpuinfo.nim

lang/nim: fix on powerpc64

countProcessors() reads the 4-byte hw.ncpu into an 8-byte int, which puts
it in the high word on big-endian, so any nim c without --parallelBuild
tried to size its build state for 2^38 CPUs and got OOM-killed. That is
also why DOCS was turned off on powerpc64 in 2020, so enable it again.
Also take the upstream fix for the shr constant folding on big-endian and
apply it to the pre-generated bootstrap compiler too.
DeltaFile
+25-0lang/nim/files/patch-lib_pure_concurrency_cpuinfo.nim
+22-0lang/nim/files/patch-c__code_5__2__msemfold.nim.c
+4-1lang/nim/Makefile
+3-1lang/nim/distinfo
+54-24 files

HardenedBSD/ports a065499 — graphics/photocraft Makefile distinfo

graphics/photocraft: update to 0.10.0

Changelog:      https://github.com/storytold/photocraft/releases/tag/v0.10.0
DeltaFile
+7-5graphics/photocraft/distinfo
+4-3graphics/photocraft/Makefile
+11-82 files

HardenedBSD/ports 834e8e1 — math/scs Makefile

math/scs: don't build with -march=native

Packages must not depend on the build host's CPU, and clang doesn't accept
-march on powerpc anyway.
DeltaFile
+4-1math/scs/Makefile
+4-11 files

HardenedBSD/ports 7256f19 — textproc/redisearch2/files patch-deps_VectorSimilarity_src_VecSim_spaces_spaces.h

textproc/redisearch2: fix build on powerpc64*

VectorSimilarity falls back to the x86 cpu_features types on anything that
isn't aarch64. Add a generic fallback for everything else.
DeltaFile
+20-0textproc/redisearch2/files/patch-deps_VectorSimilarity_src_VecSim_spaces_spaces.h
+20-01 files

HardenedBSD/ports 537561c — multimedia/vvenc Makefile

multimedia/vvenc: fix build on powerpc64

clang 19 crashes on v4f32 froundeven in the SIMDe x86 emulation
(llvm/llvm-project#121390), so turn the x86 SIMD code off here too.
DeltaFile
+2-1multimedia/vvenc/Makefile
+2-11 files

HardenedBSD/ports cb8adc8 — net/dot1ag-utils/files patch-src_ieee8021ag.h

net/dot1ag-utils: fix build on powerpc64

IS_TAGGED() compared one byte of the frame with htons(0x8100), which only
works on little-endian by accident and makes clang's -Werror unhappy on
big-endian. Read the TPID through struct cfmencap instead.
DeltaFile
+11-0net/dot1ag-utils/files/patch-src_ieee8021ag.h
+11-01 files

HardenedBSD/src f190090 — sys/kern sched_ule.c sched_4bsd.c

sched: INVARIANTS: Check sched_preempt() is called on 'curthread'

sched_preempt() does not support operating on a remote thread.  If you
are looking to influence CPU allocation on another thread, see, e.g.,
cpuset_setthread(), which in the end calls sched_affinity().

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-0sys/kern/sched_ule.c
+1-0sys/kern/sched_4bsd.c
+2-02 files

HardenedBSD/src 79ca9f7 — sys/kern sched_ule.c

sched_ule: Use TDQ_CPU() macro instead of fiddling with DPCPU

No functional change (intended).

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-1sys/kern/sched_ule.c
+1-11 files

HardenedBSD/src ea1da6a — sys/kern sched_ule.c

sched_ule: tdq_notify(): Fix a typo in a comment

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-1sys/kern/sched_ule.c
+1-11 files

HardenedBSD/src a1fe7f0 — sys/kern sched_ule.c

sched_ule: sched_affinity(): Delineate steps

No functional change (intended).

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
DeltaFile
+4-2sys/kern/sched_ule.c
+4-21 files

HardenedBSD/src d5e9c64 — sys/kern sched_ule.c

sched_ule: tdq_runq_add(): Scope variables, delineate the different steps

For better readability.

No functional change (intended).

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
DeltaFile
+5-3sys/kern/sched_ule.c
+5-31 files

HardenedBSD/ports cbc3df9 — dns/p5-Domain-PublicSuffix pkg-descr Makefile, dns/p5-Domain-PublicSuffix/files patch-t_01-core.t patch-t_04-legacy.t

dns/p5-Domain-PublicSuffix: New port

A perl module to parse a domain down to the root TLD utilizing the
Mozilla Public Suffix List.
This module utilizes the "public_suffix_list.dat" or "effective_tld_names.dat"
provided by Mozilla as a way to effectively reduce a fully qualified
domain name down to the absolute root. The Mozilla PublicSuffix file
is an open source, fully documented format that shows absolute root
TLDs, primarily for Mozilla's browser products to be able to determine
how far a cookie's security boundaries go.

Approved by:    hrs (mentor)
DeltaFile
+85-0dns/p5-Domain-PublicSuffix/files/patch-lib_Domain_PublicSuffix.pm
+36-0dns/p5-Domain-PublicSuffix/files/patch-t_77-freebsd-ports-test.t
+30-0dns/p5-Domain-PublicSuffix/Makefile
+11-0dns/p5-Domain-PublicSuffix/files/patch-t_01-core.t
+11-0dns/p5-Domain-PublicSuffix/files/patch-t_04-legacy.t
+9-0dns/p5-Domain-PublicSuffix/pkg-descr
+182-03 files not shown
+192-09 files

HardenedBSD/src d3aa926 — share/examples/sound oss.h

sound examples: trigger dsp devices via syncgroup

Triggering is only needed if device is in mmap mode, and in mmap example
the device is triggered as part of syncgroup. For non-mmap mode,
triggering is not needed at all. Triggering mmap'ed device too early
would start the IPTR/OPTR counters and that would cause those pointers
to be out of sync, so let syncgroup do the triggering once the device is
fully configured and ready for capture and playback.

MFC after:      1 week
Reviewed by:    christos
Differential Revision:  https://reviews.freebsd.org/D60839
DeltaFile
+15-26share/examples/sound/oss.h
+15-261 files

HardenedBSD/ports 83ef61a — security/openssl-oqsprovider Makefile distinfo

security/openssl-oqsprovider: Update to 0.12.0

PR:             299497
Reported by:    Herbert J. Skuhra <herbert gojira at>
DeltaFile
+3-3security/openssl-oqsprovider/distinfo
+1-1security/openssl-oqsprovider/Makefile
+4-42 files

HardenedBSD/ports 08f51f9 — security/rustls-ffi Makefile Makefile.crates

security/rustls-ffi: Update to 0.15.5
DeltaFile
+27-25security/rustls-ffi/distinfo
+12-11security/rustls-ffi/Makefile.crates
+1-2security/rustls-ffi/Makefile
+40-383 files