HardenedBSD/ports 18efd41mail/spmfilter/files patch-src_smf__trace.c

HBSD: Fix HARDCFLAGS for mail/spmfilter

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+14-0mail/spmfilter/files/patch-src_smf__trace.c
+14-01 files

HardenedBSD/ports c54474bgraphics/gracula Makefile

HBSD: Disable HARDCFLAGS for graphics/gracula

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+2-0graphics/gracula/Makefile
+2-01 files

HardenedBSD/ports b1c70d6Mk/Uses hardcflags.mk

HBSD: Add -Wformat for HARDCFLAGS

Some ports require that -Wformat is also specified with
-Werror=format-security.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+2-2Mk/Uses/hardcflags.mk
+2-21 files

HardenedBSD/ports 13c70d1emulators/libretro-reicast Makefile

HBSD: Fix HARDCFLAGS for emulators/libretro-reicast

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+2-1emulators/libretro-reicast/Makefile
+2-11 files

HardenedBSD/ports 28e6b55graphics/plotutils Makefile

HBSD: Disable HARDCFLAGS for graphics/plotutils

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+2-0graphics/plotutils/Makefile
+2-01 files

HardenedBSD/ports 0a64bcdaudio/libbs2b/files patch-src_bs2bconvert.c

HBSD: Fix HARDCFLAGS for audio/libbs2b

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+11-0audio/libbs2b/files/patch-src_bs2bconvert.c
+11-01 files

HardenedBSD/ports aa01eb7math/grace/files patch-src_utils.c patch-src_svgdrv.c

HBSD: Fix HARDCFLAGS for math/grace

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+17-0math/grace/files/patch-src_utils.c
+11-0math/grace/files/patch-src_svgdrv.c
+28-02 files

HardenedBSD/ports db53510security/rubygem-bcrypt_pbkdf/files patch-bcrypt__pbkdf.gemspec patch-ext_mri_utils.h

HBSD: Fix build of security/rubygem-bcrypt_pbkdf

Our libc contains explicit_bzero(3).

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+11-0security/rubygem-bcrypt_pbkdf/files/patch-bcrypt__pbkdf.gemspec
+10-0security/rubygem-bcrypt_pbkdf/files/patch-ext_mri_utils.h
+21-02 files

HardenedBSD/ports fb46ce5devel/omniORB Makefile

HBSD: Fix build for devel/omniORB

While here, enable PIE support. Its applications build fine as PIEs.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+1-1devel/omniORB/Makefile
+1-11 files

HardenedBSD/src 96185fflib/libpmc/pmu-events/arch/x86/emeraldrapids uncore-cache.json uncore-interconnect.json

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+6,248-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/uncore-cache.json
+6,199-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/uncore-interconnect.json
+3,617-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/uncore-io.json
+3,308-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/uncore-memory.json
+962-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/pipeline.json
+888-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/cache.json
+21,222-033 files not shown
+25,224-12839 files

HardenedBSD/ports a6128f9devel/libvirt pkg-plist, net/amnezia-tools/files patch-wg-quick_freebsd.bash

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+154-154net/keycloak/pkg-plist
+56-56science/linux-ai-ml-env/files/requirements.txt
+68-0security/vuxml/vuln/2025.xml
+37-14net/amnezia-tools/files/patch-wg-quick_freebsd.bash
+27-0sysutils/jmore/Makefile
+22-0devel/libvirt/pkg-plist
+364-22437 files not shown
+460-32543 files

HardenedBSD/src 27ff90ctests/sys/netinet carp.sh

tests/carp: make a 0.2 second pause before configuring second jail

for all scenarios where both jails have same priority/advskew.  There is a
tiny chance that on both sides carp_master_down() will be executed in
parallel and advertisements will also fly through the bridge(4) in
parallel, thus both sides will switch to MASTER before receiving the
announcement from peer.  This makes the test to fail.  So far this
flakyness was observed for carp:vrrp_v4 only, but in theory it is possible
for any of the patched scenarios.

Note that this sleep does not prolong execution of the tests, as the first
jail is already configured, and if we slept before configuring the second,
we would sleep less in wait_for_carp().
DeltaFile
+7-0tests/sys/netinet/carp.sh
+7-01 files

HardenedBSD/src e353cbftests/sys/netinet carp.sh

tests/carp: make sleep interval in the wait loop smaller

Makes tests to finish slightly faster.
DeltaFile
+1-1tests/sys/netinet/carp.sh
+1-11 files

HardenedBSD/src 2ace05b. ObsoleteFiles.inc, share/man/man9 pfind.9 Makefile

pfind(9): follow-up fixes and improvements

(Found on a branch from a year ago.)

- Adjust NAMEs
- MLINKS: add pfind_any.9, pfind_any_locked.9; remove old zpfind.9
- Reword the description of pfind_any() so that it doesn't imply only
  zombie processes are returned
- Fix a comma
- Use .Dv for the macro PRS_ZOMBIE
- Move the (logically separate) final statement to a new paragraph
- .Xr to pget(9)

Reviewed by:    0mp
Fixes:  07d78399eb79 ("pfind(9): Update to recent behavior")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D53548
DeltaFile
+17-17share/man/man9/pfind.9
+3-0ObsoleteFiles.inc
+2-1share/man/man9/Makefile
+22-183 files

HardenedBSD/ports 45b7bb1devel/p5-Sys-Virt distinfo Makefile

devel/p5-Sys-Virt: update to 11.10.0

Sponsored by:   The FreeBSD Foundation
DeltaFile
+3-3devel/p5-Sys-Virt/distinfo
+1-1devel/p5-Sys-Virt/Makefile
+4-42 files

HardenedBSD/src ca3e47blib/libpmc/pmu-events/arch/x86/alderlaken adln-metrics.json pipeline.json

pmc: add alderlaken model

This commit adds alderlaken CPU model to hwpmc/libpmc. JSON event
definitions are imported from Intel perfmon version 1.16.

Reviewed by:    mhorne
MFC after:      1 week
Sponsored by:   Stormshield
Differential Revision:  https://reviews.freebsd.org/D49229
DeltaFile
+583-0lib/libpmc/pmu-events/arch/x86/alderlaken/adln-metrics.json
+533-0lib/libpmc/pmu-events/arch/x86/alderlaken/pipeline.json
+330-0lib/libpmc/pmu-events/arch/x86/alderlaken/cache.json
+175-0lib/libpmc/pmu-events/arch/x86/alderlaken/uncore-memory.json
+81-0lib/libpmc/pmu-events/arch/x86/alderlaken/memory.json
+47-0lib/libpmc/pmu-events/arch/x86/alderlaken/virtual-memory.json
+1,749-07 files not shown
+1,870-013 files

HardenedBSD/src 51a01f3lib/libpmc/pmu-events/arch/x86/emeraldrapids uncore-cache.json uncore-interconnect.json

pmc: add emerald rapids model

This commit adds emerald rapids CPU model to hwpmc/libpmc. JSON event
definitions are imported from Intel perfmon version 1.06.

Reviewed by:    mhorne
MFC after:      1 week
Sponsored by:   Stormshield
Differential Revision:  https://reviews.freebsd.org/D49228
DeltaFile
+6,248-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/uncore-cache.json
+6,199-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/uncore-interconnect.json
+3,617-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/uncore-io.json
+3,308-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/uncore-memory.json
+962-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/pipeline.json
+888-0lib/libpmc/pmu-events/arch/x86/emeraldrapids/cache.json
+21,222-010 files not shown
+23,302-016 files

HardenedBSD/src 057dae3sys/dev/hwpmc hwpmc_intel.c

pmc: add alderlake model

The commit 601925180df4 added the models 6-B7, 6-BA, 6-BF to libpmc, but
they must also be added to the hwpmc module to allow pmc to work on
those CPUs.

Reviewed by:    mhorne
MFC after:      1 week
Fixes:          601925180df4 ("libpmc: add more alderlake models")
Sponsored by:   Stormshield
Differential Revision:  https://reviews.freebsd.org/D49255
DeltaFile
+3-0sys/dev/hwpmc/hwpmc_intel.c
+3-01 files

HardenedBSD/ports 2d7047fsecurity/vuxml/vuln 2025.xml

security/vuxml: Document Apache httpd vulnerabilities
DeltaFile
+32-0security/vuxml/vuln/2025.xml
+32-01 files

HardenedBSD/ports 1a1861cwww/nextcloud-calendar distinfo Makefile

www/nextcloud-calendar: Update to 6.1.1
DeltaFile
+3-3www/nextcloud-calendar/distinfo
+1-1www/nextcloud-calendar/Makefile
+4-42 files

HardenedBSD/ports ce7e036sysutils Makefile, sysutils/jmore Makefile pkg-descr

sysutils/jmore: Add new port

The jmore(8) is FreeBSD Jails listing and managing utility.

Covers classic and VNET Jails - also BastilleBSD ones.

Displays IP(s)/interfaces/CPU/RAM/dir/... etc.

WWW: https://github.com/vermaden/jmore
DeltaFile
+27-0sysutils/jmore/Makefile
+5-0sysutils/jmore/pkg-descr
+3-0sysutils/jmore/distinfo
+1-0sysutils/Makefile
+36-04 files

HardenedBSD/ports a215c0adevel/py-libvirt distinfo Makefile

devel/py-libvirt: update to 11.10.0

Sponsored by:   The FreeBSD Foundation
DeltaFile
+3-3devel/py-libvirt/distinfo
+1-1devel/py-libvirt/Makefile
+4-42 files

HardenedBSD/ports 16adc59devel/libvirt pkg-plist Makefile

devel/libvirt: update to 11.10.0

 - Update to 11.10.0
 - As this release adds SLIRP networking support for the bhyve driver,
   add the SLIRP option which register dependency on net/libslirp. It's
   enabled by default when the BHYVE option is enabled by default,
   and implies BHYVE.
 - Handle SHEBANG and plist entries for qemu's 'virt-qemu-qmp-proxy'
   and 'virt-qemu-sev-validate' scripts [1]

PR:             291283 [1] (based on)
Submitted by:   David Horn [1]
Sponsored by:   The FreeBSD Foundation
DeltaFile
+22-0devel/libvirt/pkg-plist
+13-6devel/libvirt/Makefile
+3-3devel/libvirt/distinfo
+38-93 files

HardenedBSD/ports c8fa124java/openjdk25 distinfo Makefile

java/openjdk25: Update to version 25.0.1

Reviewed-by:    fuz (mentor)
Approved by:    fuz (mentor)
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D53975
DeltaFile
+3-3java/openjdk25/distinfo
+2-2java/openjdk25/Makefile
+5-52 files

HardenedBSD/ports ee0205dwww/gitlab Makefile.common

www/gitlab: bump due to go update
DeltaFile
+1-1www/gitlab/Makefile.common
+1-11 files

HardenedBSD/src 575efcfsys/kern kern_sendfile.c, sys/sys socket.h

sendfile: remove SF_SYNC in FreeBSD 16.0

See d17cbe46983c for details.

PR:     287348
DeltaFile
+0-88sys/kern/kern_sendfile.c
+1-1sys/sys/socket.h
+1-892 files

HardenedBSD/ports 096b2bedevel/apache-commons-daemon distinfo Makefile, devel/apache-commons-daemon/files patch-native_arguments.c patch-native_help.c

devel/apache-commons-daemon: Upgrade port to 1.5.0

Approved by:    ale
Release Notes:  https://commons.apache.org/proper/commons-daemon/changes.html#a1.5.0
DeltaFile
+0-11devel/apache-commons-daemon/files/patch-native_arguments.c
+0-11devel/apache-commons-daemon/files/patch-native_help.c
+5-5devel/apache-commons-daemon/distinfo
+1-1devel/apache-commons-daemon/Makefile
+6-284 files

HardenedBSD/src 215c58asys/net pfvar.h, sys/netpfil/pf pf_ioctl.c

pf: make unhandled_af() inline

Otherwise you just can't include pfvar.h without compiling pf in.

Reviewed by:            kp
Differential Revision:  https://reviews.freebsd.org/D54064
DeltaFile
+5-1sys/net/pfvar.h
+0-6sys/netpfil/pf/pf_ioctl.c
+5-72 files

HardenedBSD/ports 69c1784security/trivy distinfo Makefile

security/trivy: update to 0.68.1

Changes:        https://github.com/aquasecurity/trivy/releases/tag/v0.68.1
DeltaFile
+5-5security/trivy/distinfo
+1-2security/trivy/Makefile
+6-72 files

HardenedBSD/ports 6d02ae4security/vuxml/vuln 2025.xml

security/vuxml: Add entry for go124, go125

 * CVE-2025-61729

PR:             291366
Reported by:    einar at isnic.is
DeltaFile
+36-0security/vuxml/vuln/2025.xml
+36-01 files