BSD Commit Log Search

   ether_extract_headers: double check ip versions

   suggested by bluhm
   tested by bluhm

   ok bluhm@

   add strip= to the output on a failed test as well

   tweak format on failed tests

   Unbreak with new libcamera.

   add a regress that tries to locate a Prereq in a page-sized file

   Update to libcamera-0.8.0.

   pass an explicit size to rev_in_string

   In "plan a" the file is a mmap(2)'ed region which might not end with a
   NUL character: rev_in_string() could then go reading out of bounds.

   reported by acts1631
   looks reasonable to millert@, okay kirill@

   set WRKDIST = ${WRKDIR}/${DISTNAME} to unbreak for now

   this was already commited by sthen@ and got overwritten by me

   call setusercontext with LOGIN_SETWSCONSGROUP instead of directly handling dev perms

   ld.so: skip RELOC_NONE in the fast path

   It distributes the fix on a crash from hppa across platforms

   OK: miod@, kettenis@

   replace login_fbtab with the wscons group if the users is on the glass console

   Historically login_fbtab(3) was called on user login to change permission
   of devices for the user logging in on the console or xdm and this mechanism
   had its quirks.

   In in effort to make this better, introduce the LOGIN_SETWSCONSGROUP flag for
   setusercontext(3), which will append the special wscons group to a user context
   if the user is logging in on the "glass" console.

   Callers of setusercontex(3) can also use the new login_wscons(const char *tty)
   libutil function to determine if the tty is appropriate for setting the group.

   The last part of this commit also changes the device node entries so that the
   wscons group has write access to a specific list of devices that were previously
   handled by fbtab, e.g. for amd64 (for other arches it might differ):

        /dev/console
        /dev/wskbd

    [14 lines not shown]

   Unbreak runtime.

   productivity/grisbi: update to 3.92.0

   Reject certificates that are not v3

   X509 v1 is bloody ancient. we continue to have nasty things lurking
   as corner cases to support it when there is really no need to.

   Sadly, it has been kept around for ages for "roots" because of people
   with old tests and nonsense that were generated for v1.  v3 is required
   by any modern certs.

   Rather than supporting "tests" that aren't really testing what the real
   world uses, stop the madness.

   x509v3_cache_extensions marks any certificate whose version is not v3
   invalid, so v1 and v2 certificates fail verification and purpose checks.

   This may break tests suites generated with old junk. (we had one in
   tree that I fixed before this).

   We will see if this change is too painful to support in ports right now.

    [4 lines not shown]

   Ignore the Netscape certificate type extension

   The 90's were amazing, but this is well past time to let it go.

   x509v3_cache_extensions no longer reads nsCertType, so it no longer
   makes a certificate a CA or restricts its purposes.  A critical
   nsCertType is now an unhandled critical extension.

   This is only an initial defang, code removal for this will follow

   ok tb@

   Reissue the cmstest CA and signer certificates as v3

   ok tb@

   Make openssl(1) always issue v3 certificates

   change req -x509, x509 -req and ca to make every certificate they issue v3,
   instead of issuing v1 when no extensions are configured.

   openssl changed this visit from the bad idea bears back in 3.0 and we
   never picked it up.

   ok tb@

   Update GStreamer to version 1.28.9.

   Update to opentofu-1.13.8.

   Restrict DMA map segments to MAXPHYS to prevent allocating too much memory
   for bounce buffers.

   ok deraadt@

   Update to py3-boto3-1.43.126.

   Update to py3-botocore-1.43.126.

   Update to libspelling-0.4.11.

   mail/meli: update to 0.9.0.

   see https://git.meli-email.org/meli/meli/releases/tag/v0.9.0
   replace broken HOMEPAGE, gyp the magic/patches to build against
   security/libnettle from security/sequoia-sq.

   tested working fine against dovecot, also reading /var/mail/$USER with
   prefer_mbox_type = "mboxo".

   em(4): indicate whether the BMC is reachable

   with tweaks from henning@ and deraadt@

   ok deraadt@

   Keep the descriptor rings allocated in DVACT_SUSPEND, so that they are
   still available in DVACT_RESUME.  This is neccessary because DVACT_RESUME
   cannot sleep during this new allocation.
   ok jan

   Add notes about audio and pipewire/pulseaudio to make wine audio work
   since the pulseaudio changes.

   ok brynet@

   add sysutils/slmenu

   ok bentley@

   Add some option-dependent pledge with unveil deferred until we can do it.
   millert suggests we test this in the user commnity ;)

   Initial revision