HardenedBSD/src e367917sys/cam/nvme nvme_da.c, sys/dev/nvd nvd.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+51-25sys/cam/nvme/nvme_da.c
+44-1sys/dev/nvd/nvd.c
+19-9sys/dev/nvme/nvme_sim.c
+12-2sys/dev/nvme/nvme_ctrlr.c
+6-3sys/dev/nvme/nvme_ns.c
+5-2sys/dev/nvme/nvme.h
+137-425 files not shown
+153-4511 files

HardenedBSD/src 8335780sys/cam/nvme nvme_da.c, sys/dev/nvd nvd.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+51-25sys/cam/nvme/nvme_da.c
+44-1sys/dev/nvd/nvd.c
+19-9sys/dev/nvme/nvme_sim.c
+12-2sys/dev/nvme/nvme_ctrlr.c
+6-3sys/dev/nvme/nvme_ns.c
+5-2sys/dev/nvme/nvme.h
+137-422 files not shown
+145-438 files

HardenedBSD/ports 4f49155lang/spidermonkey140 pkg-plist Makefile, lang/spidermonkey91 pkg-plist Makefile

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+683-611security/kanidm/distinfo
+341-305security/kanidm/Makefile.crates
+379-0lang/spidermonkey140/pkg-plist
+0-300lang/spidermonkey91/pkg-plist
+0-95lang/spidermonkey91/Makefile
+75-0lang/spidermonkey140/Makefile
+1,478-1,311131 files not shown
+2,022-1,754137 files

HardenedBSD/ports d12083bfilesystems/openzfs pkg-plist distinfo

filesystems/openzfs: update to 2.3.5

Changelog:      https://github.com/openzfs/zfs/releases/tag/zfs-2.3.5
DeltaFile
+9-10filesystems/openzfs/pkg-plist
+3-3filesystems/openzfs/distinfo
+2-2filesystems/openzfs/Makefile
+14-153 files

HardenedBSD/ports 4186c58filesystems/openzfs-kmod distinfo Makefile

filesystems/openzfs-kmod: update to 2.3.5

Changelog:      https://github.com/openzfs/zfs/releases/tag/zfs-2.3.5
DeltaFile
+3-3filesystems/openzfs-kmod/distinfo
+2-2filesystems/openzfs-kmod/Makefile
+5-52 files

HardenedBSD/ports 46cee31www Makefile, www/wp-cli Makefile distinfo

www/wp-cli: New port: Command line interface for WordPress

WP-CLI is the command-line interface for WordPress.
You can update plugins, configure multisite installations and much more,
without using a web browser.

Co-authored-by: Vladimir Druzenko <vvd at FreeBSD.org>
Co-authored-by: takefu at airport.fm
Co-authored-by: avkarenow at o2.pl

PR:     257679
DeltaFile
+39-0www/wp-cli/Makefile
+5-0www/wp-cli/distinfo
+3-0www/wp-cli/pkg-descr
+1-0www/Makefile
+48-04 files

HardenedBSD/ports 8189c90devel/oci-cli Makefile distinfo

devel/oci-cli: Update 3.68.1 => 3.71.0

Changelogs:
https://github.com/oracle/oci-cli/releases/tag/v3.69.0
https://github.com/oracle/oci-cli/releases/tag/v3.70.0
https://github.com/oracle/oci-cli/releases/tag/v3.70.1
https://github.com/oracle/oci-cli/releases/tag/v3.71.0

PR:     291073
DeltaFile
+3-4devel/oci-cli/Makefile
+3-3devel/oci-cli/distinfo
+6-72 files

HardenedBSD/ports 3aad8abdevel/py-oci distinfo Makefile

devel/py-oci: Update 2.161.1 => 2.164.0

Changelog:
https://github.com/oracle/oci-python-sdk/releases/tag/v2.162.0
https://github.com/oracle/oci-python-sdk/releases/tag/v2.163.0
https://github.com/oracle/oci-python-sdk/releases/tag/v2.163.1
https://github.com/oracle/oci-python-sdk/releases/tag/v2.164.0

PR:     291073
DeltaFile
+3-3devel/py-oci/distinfo
+2-3devel/py-oci/Makefile
+5-62 files

HardenedBSD/ports 868421csysutils/kopia distinfo Makefile

sysutils/kopia: Update to 0.22.0

ChangeLog: https://github.com/kopia/kopia/releases/tag/v0.22.0
DeltaFile
+5-5sysutils/kopia/distinfo
+1-2sysutils/kopia/Makefile
+6-72 files

HardenedBSD/ports 83f446adevel/R-cran-future Makefile distinfo

devel/R-cran-future: Update to 1.68.0

- Use only RUN_DEPENDS since port doesn't compile

ChangeLog: https://cran.r-project.org/web/packages/future/news/news.html
DeltaFile
+2-4devel/R-cran-future/Makefile
+3-3devel/R-cran-future/distinfo
+5-72 files

HardenedBSD/ports e5dd3bcdns/blocky distinfo Makefile

dns/blocky: Update to 0.28.2

ChangeLog:      https://github.com/0xERR0R/blocky/releases/tag/v0.28.2
MFH:            2025Q4
DeltaFile
+5-5dns/blocky/distinfo
+1-1dns/blocky/Makefile
+6-62 files

HardenedBSD/ports cbc6a3bdevel/R-cran-TH.data distinfo Makefile

devel/R-cran-TH.data: Update to 1.1-5

ChangeLog: https://github.com/cran/TH.data/compare/1.1-4...1.1-5
DeltaFile
+3-3devel/R-cran-TH.data/distinfo
+1-1devel/R-cran-TH.data/Makefile
+4-42 files

HardenedBSD/ports df85d01deskutils/pinot distinfo Makefile

deskutils/pinot: upgrade to v1.23

Fix for Curl 8.16.
DeltaFile
+3-3deskutils/pinot/distinfo
+2-2deskutils/pinot/Makefile
+1-0deskutils/pinot/pkg-plist
+6-53 files

HardenedBSD/ports 1f30ce8devel/wasm-server-runner/files patch-powerpc64le

devel/wasm-server-runner: fix build on powerpc64le

  /wrkdirs/usr/ports/devel/wasm-server-runner/work/wasm-server-runner-1.0.0/cargo-crates/aws-lc-sys-0.27.1/aws-lc/crypto/fipsmodule/cpucap/cpu_ppc64le.c:72:28: error: call to undeclared function 'getauxval'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
  [ 32%] Building C object aws-lc/crypto/CMakeFiles/crypto_objects.dir/ec_extra/ec_derive.c.o
  [ 32%] Building C object aws-lc/crypto/CMakeFiles/crypto_objects.dir/ec_extra/hash_to_curve.c.o
     72 |   OPENSSL_ppc64le_hwcap2 = getauxval(AT_HWCAP2);
        |                            ^
DeltaFile
+20-0devel/wasm-server-runner/files/patch-powerpc64le
+20-01 files

HardenedBSD/ports fbd745fgraphics/libskiasharp/files patch-src_core_SkRasterPipeline.h

graphics/libskiasharp: fix build on powerpc64le

../src/opts/SkRasterPipeline_opts.h:3304:1: error: 'musttail' attribute for this call is impossible because indirect calls can not be tail called on PPC
DeltaFile
+11-0graphics/libskiasharp/files/patch-src_core_SkRasterPipeline.h
+11-01 files

HardenedBSD/src bd769e7sys/dev/nvd nvd.c

nvd: handle namespace changes

Signal the new media size when the namespace changes size.

Reviewed by:            imp
Differential Revision:  https://reviews.freebsd.org/D33032
DeltaFile
+44-1sys/dev/nvd/nvd.c
+44-11 files

HardenedBSD/src 4640f50sys/dev/nvme nvme_sim.c

nvme_sim: signal namespace depature

Signal when the namespace is gone so we can tear down the disk when a
nvme drive is removed.

Reviewed by:            imp
Differential Revision:  https://reviews.freebsd.org/D33032
DeltaFile
+19-9sys/dev/nvme/nvme_sim.c
+19-91 files

HardenedBSD/ports f670d2blang/spidermonkey102 Makefile

lang/spidermonkey102: deprecate and expire EOY
DeltaFile
+3-0lang/spidermonkey102/Makefile
+3-01 files

HardenedBSD/ports b178aeclang/erlang-runtime22 Makefile, lang/erlang-runtime27 Makefile

lang/erlang-runtime2[27]: move couchdb3 comment

...to erlang-runtime27, couchdb3 no longer uses 22.
DeltaFile
+0-1lang/erlang-runtime22/Makefile
+1-0lang/erlang-runtime27/Makefile
+1-12 files

HardenedBSD/src dffd882sys/cam/nvme nvme_da.c

nvme: Refactor geom setting to function.

Refactor setting of geometry for the disk to its own function. No
functional changes.

Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D33032
DeltaFile
+31-16sys/cam/nvme/nvme_da.c
+31-161 files

HardenedBSD/src 86d3ec3sys/cam/nvme nvme_da.c nvme_xpt.c

nda: React to namespace change events

Register for AC_GETDEV_CHANGED. When we receive a namespace
notification, we only create a new device if it was unconfigured. If it
was configured, generate this async event. Rely on the fact that we
reconstruct namespace to just get the data from the identify data and
call disk_resised.

Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D33032
DeltaFile
+20-9sys/cam/nvme/nvme_da.c
+2-0sys/cam/nvme/nvme_xpt.c
+22-92 files

HardenedBSD/src 20e9495sys/dev/nvme nvme_ctrlr.c nvme_ns.c

nvme: Notify namespace changes better

When we get a namespace notification, we have to reconstrut the
namespace to get the new identification data from the namespace. For
each namespace in the AEN, we will reconstrict it before we call the
notification. We also flag it as changed for the duration of the change
callback (prior versions of the patch needed to keep track, but we no
longer do, so this bit may be removed). Note when we've seen the
namespace so we can notify when it goes away.

Co-authored-by: imp
Differential Revision: https://reviews.freebsd.org/D33032
DeltaFile
+11-1sys/dev/nvme/nvme_ctrlr.c
+6-3sys/dev/nvme/nvme_ns.c
+5-2sys/dev/nvme/nvme.h
+22-63 files

HardenedBSD/ports f3737f1Mk bsd.hardening.mk, Mk/Uses hardcflags.mk

HBSD: Add "general compilation hardening" USES

This commit introduces a general catch all for compiler hardening flags
that aren't paired with a specific feature (unlike CFI, for example).
The USES for this is "hardcflags" and the USE_HARDENING flag is
"HARDCFLAGS".

We also enable this by default, though we will most likely need to fix a
number of ports (possibly a large number.) The biggest issue will likely
be the -Wformat-security compilation flag.

As of this writing, the HardenedBSD infrastructure lacks a server that
can perform experimental builds. So we need to apply a broad stroke
initially and resolve failed ports.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+29-1Mk/bsd.hardening.mk
+20-0Mk/Uses/hardcflags.mk
+49-12 files

HardenedBSD/ports 30c5636security/kanidm distinfo Makefile.crates, security/kanidm/files patch-rust-1.89.0 kanidmd.in

security/kanidm: Upgrade to 1.8.0

- Add kanidmd_config parameter to rc script.
- Fix server flavor.
- Fix missing Web UI.
- Improve pkg-descr (also fixes warning in portlint).

ChangeLogs:

- https://github.com/kanidm/kanidm/releases/tag/v1.7.4
- https://github.com/kanidm/kanidm/releases/tag/v1.8.0

PR:             290372
Reported by:    brad at facefault.org
Approved by:    bofh at freebsd.org (maintainer-timeout)
DeltaFile
+683-611security/kanidm/distinfo
+341-305security/kanidm/Makefile.crates
+39-0security/kanidm/pkg-plist.server
+0-10security/kanidm/files/patch-rust-1.89.0
+5-3security/kanidm/files/kanidmd.in
+5-3security/kanidm/Makefile
+1,073-9321 files not shown
+1,076-9337 files

HardenedBSD/ports 88e0ee1lang/spidermonkey91 pkg-plist Makefile, lang/spidermonkey91/files patch-modules_fdlibm_src_math__private.h patch-config_gcc__hidden.h

lang/spidermonkey91: Remove expired port

lang/spidermonkey91 has no users in the ports tree, so let's remove
before someone adds a museum software port that depends on it.

We have more than enough newer versions available to start new projects.
DeltaFile
+0-300lang/spidermonkey91/pkg-plist
+0-95lang/spidermonkey91/Makefile
+0-46lang/spidermonkey91/files/patch-modules_fdlibm_src_math__private.h
+0-17lang/spidermonkey91/files/patch-config_gcc__hidden.h
+0-14lang/spidermonkey91/files/patch-js_src_jit_ExecutableAllocator.h
+0-14lang/spidermonkey91/files/patch-js_src_wasm_WasmSignalHandlers.cpp
+0-4869 files not shown
+1-55515 files

HardenedBSD/src 27481c2sys/dev/nvme nvme_ctrlr.c

nvme: Fix backwards sense of error condition

b21e67875bf0c tested for the good condition, not the error condition, so
we'd never do anything else in this function. This was causing certain
logging not to happen, and also prevented forthcoming namespace size
change code from working as well.

Fixes: b21e67875bf0c
Sponsored by: Netflix
DeltaFile
+1-1sys/dev/nvme/nvme_ctrlr.c
+1-11 files

HardenedBSD/ports a44ed48databases/pecl-redis Makefile distinfo

databases/pecl-redis: Update 6.2.0 => 6.3.0, add default options zstd and lz4

Changelog:
https://pecl.php.net/package-info.php?package=redis&version=6.3.0
https://github.com/phpredis/phpredis/releases/tag/6.3.0

PR:             290853
Approved by:    Mateusz Wiącek <wiacek.m at witia.com.pl> (maintainer)
DeltaFile
+13-9databases/pecl-redis/Makefile
+3-3databases/pecl-redis/distinfo
+16-122 files

HardenedBSD/ports d9499e8www/firefox distinfo Makefile

www/firefox: update to 145.0.1

Release Notes:
  https://www.firefox.com/en-US/firefox/145.0.1/releasenotes/
DeltaFile
+3-3www/firefox/distinfo
+2-3www/firefox/Makefile
+5-62 files

HardenedBSD/ports d3a4d98security/nss distinfo Makefile

security/nss: update to 3.118.1

Release Notes:
  https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/fYE17ts2diI
  https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/6sTmNA3ELk8
DeltaFile
+3-3security/nss/distinfo
+1-1security/nss/Makefile
+4-42 files

HardenedBSD/ports f26f347lang/spidermonkey140 pkg-plist Makefile, lang/spidermonkey140/files patch-config_gcc__hidden.h patch-js_src_jit_ExecutableAllocator.h

lang/spidermonkey140: add
DeltaFile
+379-0lang/spidermonkey140/pkg-plist
+75-0lang/spidermonkey140/Makefile
+17-0lang/spidermonkey140/files/patch-config_gcc__hidden.h
+14-0lang/spidermonkey140/files/patch-js_src_jit_ExecutableAllocator.h
+12-0lang/spidermonkey140/files/patch-build_moz.configure_init.configure
+12-0lang/spidermonkey140/files/patch-js_src_jit_ProcessExecutableMemory.h
+509-05 files not shown
+536-011 files