filesystems/ltfs: Fix portscout version detection
GitHub tags are vX.Y.Z.W-NNNNN. Portscout normalizes the IBM
build suffix as an extra version component and reports the
current tag as a new release. Skip that tag in both forms.
net/freeipa-server: Update to 4.13.2
Upstream moved to Codeberg, follow it in MASTER_SITES.
Use the samba framework instead of a hardcoded samba416 dependency [1].
Require sssd2 2.13.1_2 or newer. Earlier revisions leave ${prefix}
unexpanded in SSSDConfig, which makes ipa-server-install fail.
Own the HTTP keytab by www. httpd runs with GSS_USE_PROXY=no and reads
the keytab itself, so a root-owned one left mod_auth_gssapi without
server credentials.
Keep the rc(8) program paths of the Kerberos services in place so a
running kadmind stays visible to rc(8) while it is disabled. Without
them ipactl reported it as stopped and ipactl restart waited forever.
Make the D-Bus system bus a prerequisite of certmonger and oddjobd.
Without it certmonger does not start and oddjobd retries forever, which
[11 lines not shown]
security/dogtag-jss: Update to 5.10.1
Switch to Java 21.
Disable ML-DSA and ML-KEM: JSS otherwise declares more SSL
authentication types than security/nss provides, which trips a static
assertion at runtime.
Changes: https://github.com/dogtagpki/jss/releases
Sponsored by: Netzkommune GmbH
security/dogtag-pki: Update to 11.10.1
Switch to Java 21.
Adapt the FreeBSD parts to the reworked upstream tree: guard the SELinux
import and its call sites, replace the remaining runuser call with
subprocess privilege switching, and pass APP_SERVER_CM through the
environment, which 11.10 reads instead of the CMake define.
Give pki-tomcatd a bounded stop. jsvc records the pid of its child in
the pidfile while the parent handles SIGTERM, and Tomcat can deadlock in
JSS while closing LDAP connections, so rc(8) would wait forever and
stall the system shutdown.
Changes: https://github.com/dogtagpki/pki/releases
Sponsored by: Netzkommune GmbH
