devel/gerrit: update to 3.14.5, fix pkg-message
The top-level pkg-message shadowed files/pkg-message.in, so users saw
literal %%DATADIR%% placeholders. Remove it and add the template to
SUB_FILES. Also substitute PORTVERSION in the documentation link.
Release notes: https://www.gerritcodereview.com/3.14.html
filesystems/ntfs: update NTFS-3G to version 2026.2.25
This release contains mostly bugfixes and small improvements.
CVE-2026-40706 didn't affect us because we configure the port
without the POSIX ACL support.
While here, make partition geometry detection work on FreeBSD
to allow creating bootable NTFS partitions.
PR: 294550
Submitted by: wulf
News flash: https://opennet.ru/65262-ntfs
devel/heimdall: Fix build on FreeBSD 14 and 15
The libusb_set_option() call only exists in base libusb 1.0.27 and
later. The 2.2.2 source uses it unguarded to opt into the UsbDk backend
and to set the libusb log level, so 14.x and 15.x fail to build.
Guard the UsbDk opt-in call which targets the Windows USB DriverKit
backend. It existed nowhere in 1.4.2 heimdall before this. Fall back to
libusb_set_debug() for the log level used before 1.0.27.
Approved by: arrowd (co-mentor)
(cherry picked from commit c1c8bc4a8ac5f6f2623402f1a5b06d3ff360ac60)
devel/heimdall: Fix build on FreeBSD 14 and 15
The libusb_set_option() call only exists in base libusb 1.0.27 and
later. The 2.2.2 source uses it unguarded to opt into the UsbDk backend
and to set the libusb log level, so 14.x and 15.x fail to build.
Guard the UsbDk opt-in call which targets the Windows USB DriverKit
backend. It existed nowhere in 1.4.2 heimdall before this. Fall back to
libusb_set_debug() for the log level used before 1.0.27.
Approved by: arrowd (co-mentor)
openssl: export only the engine entry points
Upstream links every dynamic engine with a version script,
engines/<name>.ld, that exports bind_engine and v_check and makes
everything else local. FreeBSD's engines had no version script, so
they exported every global symbol, including _init and _fini.
loader_attic.so compiles its own copy of crypto/pem/pvkfmt.c and so
also exported 21 of its functions; 14 of them (b2i_*, i2b_*) have the
same names as public libcrypto functions.
Add one Version.map for all engines, the same as upstream's, and use it
from engines/Makefile.inc.
The engines are loaded only with dlopen(), and libcrypto looks up only
bind_engine and v_check, so hiding the other symbols does not affect
any consumer.
Tested via tinderbox: capi.so, devcrypto.so and loader_attic.so link
with --no-undefined-version and export only bind_engine and v_check.
[8 lines not shown]
openssl: fix engine defines to match upstream
Two engine Makefiles define different macros from upstream's
engines/build.info:
- padlock: engines/e_padlock.c builds the engine only when PADLOCK_ASM
is defined. Upstream defines it on x86 and x86_64, but our Makefile
never did, so padlock.so has been a stub whose bind_engine() returns
0 and the e_padlock-x86*.S code it links was never called. Define
PADLOCK_ASM on amd64 and i386, where that asm is built.
- loader_attic: upstream defines OPENSSL_NO_PROVIDER_CODE; the Makefile
had OPENSSL_NO_PROVIDER_CORE. No source tests either name, so the
build does not change; this only follows upstream.
Found by comparing per-file compile flags against an upstream 3.5.9
build. Checked by preprocessing e_padlock.c for amd64 and i386:
COMPILE_PADLOCKENG is now defined.
[5 lines not shown]
tests/sys/file: add tests for the lowest fd after fork
fdcopy() skips plain kqueues and close-on-fork descriptors when it
copies the table into the child. Check that dup(2) in the child still
returns the lowest unused descriptor, both when the skipped descriptor
is the lowest free slot and when it sits above an existing hole.
Test cases:
kqueue_no_hole a plain kqueue is the lowest descriptor; the
child's dup() reuses its slot
kqueue_two two adjacent plain kqueues; the child's dup()
returns the lower one
kqueue_above_hole a plain kqueue sits above a closed descriptor;
the child's dup() returns the hole
kqueue_cponfork a KQUEUE_CPONFORK kqueue is copied; the child's
dup() returns the next slot
clofork_no_hole an O_CLOFORK descriptor is the lowest one; the
child's dup() reuses its slot
[14 lines not shown]
devel/got: update to 0.130.1
User-visible changes:
- default to using SHA256 object IDs in newly created repositories
The got-portable-0.130 release accidentally skipped some commits
from got 0.130.
(cherry picked from commit 734848d93cd26f5028d7fbc57e2d0b31a27bf9d2)
devel/got: Cherry-pick patches for shared locking
When operating on a worktree, got locks the tree in order to avoid
problems with concurrent operations. Until now, got always used
exclusive locks, which caused problems when e.g. two separate parts
of the FreeBSD release build ran 'got tree' at once.
This has been fixed upstream but the 15.2 release cycle needs the
changes urgently and can't wait for the next got-portable release,
so cherry-pick those patches.
Reviewed by: naddy
Sponsored by: Amazon
MFC after: 1 minute
Differential Revision: https://reviews.freebsd.org/D61327
(cherry picked from commit 31363b8551ac3b98eb991be84e7c8b2f8c5aaabf)
devel/got: update to 0.130
User-visible changes:
- default to using SHA256 object IDs in newly created repositories
(cherry picked from commit bacaa99e545873d253f31dc46f3b70da9356b749)
virtio_random: defer first enqueue until after DRIVER_OK
According to the virtio spec:
> The driver MUST NOT send any buffer available notifications to the
> device before setting DRIVER_OK.
DRIVER_OK isn't set until after attach completes, so defer the first
enqueue. We haven't found any problems as a result of this to the best
of my knowledge: q35 and other devices that we *have* been used with
will apparently check when we go DRIVER_OK.
Tested with q35 virtio-random, which still works.
Reported by: llm-postcr
Reviewed by: kfv, markj
Fixes: f1c5a2e3a62505 ("virtio_random: Pipeline fetching the data")
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
[2 lines not shown]
virtio_random: stop on detach, don't poll
If the device is hung, then polling will block the detach and hang us.
Stop it and drain the queue instead. This fixes a hang on detach in
some circumstances without the upcoming virtio_pci_modern fix.
Reviewed by: bnovkov, kfv
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
(cherry picked from commit cce522853aae3da45b131c2522dd2510edf083e7)
virtio_pci_modern: enable virtqueues before completing attach
Most of our drivers setup interrupt(s) and virtqueues are enabled at
that time, but nothing will currently enable them for devices that we're
only going to poll. This most notably affects virtio-random, and the
problem can be observed with qemu's q35 emulation and a random device
attached. The q35 implementation ignores the ring unless it's enabled,
so vtrnd_harvest() will consistently EAGAIN rather than contribute
anything of value, but with this patch it becomes functional.
This can be reproduced with a qemu invocation like so:
qemu-system-x86_64 -machine q35,accel=tcg -cpu max -smp 2 -m 2G \
-drive file=FreeBSD-16.0-CURRENT-amd64-ufs.qcow2,if=virtio \
-device pcie-root-port,id=rp1,bus=pcie.0,chassis=1 \
-object rng-random,id=rng0,filename=/dev/urandom \
-device virtio-rng-pci,rng=rng0,bus=rp1 \
-display curses
[5 lines not shown]
virtio_random: avoid using vtrnd_detach in the failure path
On the off chance that we discover more than one virtio-random device,
the second one will deregister the global instance or trip an invariant
when it fails to attach and calls vtrnd_detach().
We don't have that many resources to free, so just inline those. This
is purely a hygiene thing, we haven't seen an instance of this in the
wild (to my knowledge).
Reviewed by: bnovkov, kfv
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
(cherry picked from commit 26ba71f73e8914ecd9e5b1e7bb864fee41158d04)
