These keys were generated by cperciva@ using the AWS Key Management
Service. They will not be used for signing anything other than
FreeBSD 15.x pkgbase repositories.
Keys will be generated for FreeBSD 16 at a later date, and likely in
a different way.
With hat: re
MFC after: 8 hours (needed in 15.0-RC1)
Differential Revision: https://reviews.freebsd.org/D53768
Historically, lam(1) closes stdin once we've hit EOF the first time,
which would stop it from doing anything else on subsequent gatherline()
calls with another openfile. However, this doesn't seem to be strictly
necessary- the EOF flag on FILEs is quite sticky, so we can assume that
a subsequent fgetc(stdin) will flag EOF properly.
This 'fixes' the below-referenced commit in the sense that it surfaced
this problem as a fatal error, but the issue was pre-existing. If we
do `lam - -`, then one gatherline() will fclose(stdin) and set `ip->eof`
for *that* openfile, while the next one will then observe that
STDIN_FILENO has been closed and turn it into an EBADF.
Add a few tests that were easy to snipe while I'm here, but I haven't
aimed for anything close to exhaustive because I think re@ would prefer
this fix go in sooner rather than later to land in 15.0.
Minor style adjustment for the previous commit while we're here.
Reported by: cperciva
Discussed with: jrtc27
Reviewed by: des, jlduran
Fixes: 4472fd66d0 ("lam: fail on I/O errors")
MFC after: 3 days (tentative)
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D53750
This change moves files between packages so, until we have a proper
policy on how to handle this in release/stable branches, it should
not be MFC'd.
MFC after: never
Reviewed by: manu, dim
Sponsored by: https://www.patreon.com/bsdivy
Differential Revision: https://reviews.freebsd.org/D53608
termcap and tabset are currently in runtime, but since ncurses is the
only thing which uses them, they belong in the ncurses package.
curses without termcap is not very useful, so put them in the -lib
subpackage rather than ncurses itself, so that installing ncurses-lib
provides a working curses.
This change moves files between packages so, until we have a proper
policy on how to handle this in release/stable branches, it should
not be MFC'd.
MFC after: never
Discussed with: kevans
Reviewed by: manu, kevans
Sponsored by: https://www.patreon.com/bsdivy
Differential Revision: https://reviews.freebsd.org/D53610
This package only exists on amd64, which means on other platforms we
produce an empty package containing nothing but this directory, and
without a base package (libipt) that package fails to install due to
a missing dependency.
For now, fix this by removing the libipt-dev package tag, which moves
this directory to clibs.
Fixes: 436618a427 ("etc/mtree: Add package tags for /usr/include")
Reported by: cperciva
MFC after: 3 seconds
Set the default package to clibs-dev, since that's where the vast
majority of include files comes from. Add explicit package tags
for the directories which are installed in their own package.
MFC after: 1 day
Reviewed by: emaste
Sponsored by: https://www.patreon.com/bsdivy
Differential Revision: https://reviews.freebsd.org/D53577
ATM support for netgraph was removed in af0cc0b223 ("NgATM: Remove
netgraph ATM support")
Remove the directory from the mtree specification.
Reviewed by: emaste
Fixes: 21735dfaeb ("include: Remove no longer existing netgraph/atm")
MFC after: 5 days
Differential Revision: https://reviews.freebsd.org/D53260
To facilitate the task, we change the comparison function so that users
with equal filesystem usage are sorted by UID, and add an undocumented
option that prevents quot from replacing numerical UIDs with names. We
also switch from getfsfile(3) to getmntpoint(3) so the first line is
identical regardless of whether we pass quot a mountpoint or a device.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D53133
This change adds a simple smoke test for the legacy provider to ensure
that the provider doesn't break in the future when performing updates.
This is not a functional or system test; the OpenSSL test suite does a
much better job at doing this than we can.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D53045
This more accurately reflects its purpose, and its contents, since
everything in the package is prefixed with "local-".
While here, add a message on upgrade about regenerating the config.
MFC after: 3 seconds
Requested by: des
Reviewed by: des
Sponsored by: https://www.patreon.com/bsdivy
Differential Revision: https://reviews.freebsd.org/D53056
This fixes some missing directories, notably /boot/modules. Other
directories are not missing because they contain other files, but
they should still have their own METALOG entries and be placed in
the correct package.
MFC after: 3 days
Reported by: bdrewery
Reviewed by: cperciva, imp
Sponsored by: https://www.patreon.com/bsdivy
Differential Revision: https://reviews.freebsd.org/D52958
This change simplifies integration of gdb python scripts with our kernel
debugging infrastructure. Rather than putting debugging scripts in
/usr/libexec/kgdb, move them to <path-to-kernel-debug-symbols>/gdb, and
add a kernel-gdb.py which automatically loads modules from that
directory. kernel-gdb.py will be automatically executed by kgdb when
loading kernel debug symbols (assuming a default configuration), so one
no longer needs to do anything to use these modules.
The change also adds a couple of new modules, vnet.py and pcpu.py, for
conveniently accessing VNET symbols and PCPU/DPCPU fields, respectively.
Note that these require a change to the kernel linker when accessing
symbols from a loadable kernel module.
sys/tools/gdb/README.txt describes the scheme in more detail and
provides some rudiementary documentation for the commands and functions
added by these modules. It should be updated when adding new features.
sys/tools/gdb/selftest.py can be used to do some primitive testing of
the modules. All it does is execute a number of gdb commands making use
of commands and functions added by these modules. The developer is
expected to verify that the commands complete without errors and that
the output looks sane.
Discussed with: kp, avg, jhb, glebius
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D50825
The Makefile logic for /etc/aliases, /var/yp/Makefile and /etc/unbound
tries to avoid creating the symlink if it already exists in the target,
but this breaks with pkgbase since the symlink won't be installed (and
therefore won't be added to METALOG) if building with an existing
worldstage, meaning it's missing from the generated package.
Change the logic to forcibly install the symlink if NO_ROOT is defined,
but keep the existing logic for non-package builds to avoid trashing
the user's custom symlinks on non-pkgbase installworld.
MFC after: 3 seconds
Reported by: cperciva
Reviewed by: cperciva, emaste
Sponsored by: https://www.patreon.com/bsdivy
Differential Revision: https://reviews.freebsd.org/D52834
This patch diverges quite a bit from the current upstream [1] in a few
ways:
1. virtual_oss(8), virtual_bt_speaker(8) and virtual_oss_cmd(8) are
actually separate programs.
2. Backends (lib/virtual_oss) are built as separate shared libraries and
we dlopen() them in virtual_oss(8) and virtual_bt_speaker(8) on
demand.
3. virtual_equalizer(8) and the sndio and bluetooth backends are built
as ports, because they depend on third-party libraries.
4. Use newer libav API in bluetooth backend (see HAVE_LIBAV ifdefs) to
address compiler errors.
[1] https://github.com/freebsd/virtual_oss
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D52308
This ensures the normally-empty directories /proc, /net, /media and /mnt
are created on a fresh pkgbase install.
Put /proc, /mnt and /media in -runtime since those are basic directories
that should always exist. /net is only used by the automounter, so put
that in -autofs. While here, also tag /rescue in -rescue, since nothing
else installs there.
Reported by: Graham Perrin <grahamperrin@gmail.com>
PR: 289654
MFC after: 3 days
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D52622
Fixes the following warnings:
ld: error: relocation R_X86_64_32S cannot be used against local symbol; recompile with -fPIC
>>> defined in /usr/obj/usr/src/amd64.amd64/lib/libsamplerate/libsamplerate.a(samplerate.o)
>>> referenced by samplerate.c:498 (/usr/src/contrib/libsamplerate/samplerate.c:498)
>>>
>>> samplerate.o:(src_new) in archive /usr/obj/usr/src/amd64.amd64/lib/libsamplerate/libsamplerate.a
Related discussion: https://reviews.freebsd.org/D52306
Sponsored by: The FreeBSD Foundation
Reviewed by: fuz
Differential Revision: https://reviews.freebsd.org/D52307
In base 8f0a6a9aad, usr/share/examples/drivers was cleaned up,
because it contained unmaintained scripts. The directory itself is
cleaned up by ObsoleteFiles.inc, but there was still an entry in
BSD.usr.dist that re-created the directory. Remove it.
Fixes: 8f0a6a9aad
MFC after: 3 days
etc/mail/Makefile includes bsd.own.mk, which includes bsd.compiler.mk,
which fails with an error if it can't locate a C compiler. Set
_WITHOUT_SRCCONF=yes before including bsd.own.mk to disable this
behaviour.
Reviewed by: gshapiro
Differential Revision: https://reviews.freebsd.org/D52134
* /etc/zfs needs to exist for the zfs cache and exports files
* /etc/ssl/certs and /etc/ssl/untrusted need to exist for caroot
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D52123
We now build compile_et from krb5/util/compile_et. The compile_et make
target runs compile_et.sh through a preprocessor that does some
substitution on the script, in particular it defines the directory where
compile_et can find et_h.awk and et_c.awk.
We build compile_et as a bootstrap tool since it's used to build krb5.
It also gets installed by installworld, presumably because we did that
with Heimdal Kerberos too and there's some chance that third-party
projects are using it.
There are two problems, both fixed by this patch:
First, we don't actually install those awk scripts anywhere, so
/usr/sbin/compile_et isn't usable on an installed system. Let's simply
install them to /usr/share/et, which is where upstream puts them.
Second, compile_et is a bootstrap tool and gets installed into WORLDTMP
during the bootstrap phase of the build. At that point we preprocess it
to set the directory where it can find those awk scripts. That
directory is currently set with `KRB5_ETDIR?= ${DESTDIR}/usr/share/et`,
but DESTDIR points into the object directory, so this value is bogus.
Since all build-time invocations of compile_et explicitly specify the
script directory with the -d option, let's just update the path to point
to the installed script directory. In particular, avoid fixing DESTDIR
in the script, since we don't do that generally.
PR: 288929
Reviewed by: ivy, cy
Sponsored by: The FreeBSD Foundation
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D52004
Notable changes include:
* We no longer forget manually untrusted certificates when rehashing.
* Rehash will now scan the existing directory and progressively replace
its contents with those of the new trust store. The trust store as a
whole is not replaced atomically, but each file within it is.
* We no longer attempt to link to the original files, but we don't copy
them either. Instead, we write each certificate out in its minimal
form.
* We now generate a trust bundle in addition to the hashed diretory.
This also contains only the minimal DER form of each certificate.
This allows e.g. Unbound to preload the bundle before chrooting.
* The C version is approximately two orders of magnitude faster than the
sh version, with rehash taking ~100 ms vs ~5-25 s depending on whether
ca_root_nss is installed.
* We now also have tests.
Reviewed by: kevans, markj
Differential Revision: https://reviews.freebsd.org/D42320
Differential Revision: https://reviews.freebsd.org/D51896
The reimplementation of certctl, while much needed, broke the release
build and 72 hours later corrections are still under review (D51896).
This revert should be reverted once that is ready to land; I just need
this out of the tree temporarily because breakage is interfering with
release engineering for the upcoming 15.0-RELEASE.
Unsquashed reversions:
Revert "etc: add missing mtree entry for certctl tests"
This reverts commit f751757259.
Revert "certctl: Fix bootstrap build"
This reverts commit c989e3cc3d.
Revert "certctl: Reimplement in C"
This reverts commit 81d8827ad8.
With hat: re@
Otherwise we'll fail to create the appropriate hierarchy and blow up
when we go to actually install the test.
Reported by: np
Fixes: 81d8827ad8 ("certctl: Reimplement in C")
parse_ports has been broken ever since 7b35b4d, and it's a sufficiently
complicated function that it really deserves some unit tests. Fix it,
and add tests. Refactor the code a little bit to facilitate unit tests.
Chiefly, split the tested functions out of main.c into sockstat.c .
PR: 288731
Fixes: 7b35b4d ("sockstat: add libxo support")
Sponsored by: ConnectWise
PR: https://github.com/freebsd/freebsd-src/pull/1807
Reviewed by: rido
lib/libgssapi is based on Heimdal. As on Linux systems, the MIT
libgssapi_krb5 replaces it. With both gssapi libraries and header files
installed results in broken buildworld (gssd) and ports that will not
build without modifications to support the MIT gssapi in an alternate
location.
73ed0c7992 removed the MIT GSSAPI headers from /usr/include. Apps using
MIT KRB5 gssapi functions and structures will fail to build without this
patch.
This patch includes a temporary patch to usr.sbin/gssd to allow it
to build with this patch. rmacklem@ has a patch for this and for
kgssapi that uses this patch to resolve kgssapi issues for NFS with
Kerberos.
This patch is an updated version of D51661 to allow it to build following
additional patchs to the tree.
This should have been implmented with 7e35117eb0.
Fixes: 7e35117eb0, 73ed0c7992
Differential Revision: https://reviews.freebsd.org/D51661
Summary:
Although fstab(5) suggests usage of md(4) and an .eli suffix in the same
paragraph, the combination did not work.
This patch adds a bit of parsing, creates the md device and then passes
that device to the *_geli function.
Add unit tests.
PR: 186252
Approved by: delphij
MFC after: 2 weeks
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D48874
From Cirrus-CI
su user -c "/usr/libexec/flua tools/pkgbase/metalog_reader.lua \
-c /usr/obj/$(pwd -P)/${TARGET}.${TARGET_ARCH}/worldstage/METALOG"
error: ./etc/gss/mech file repeated with same meta: line 2127,40175
error: ./etc/gss/qop file repeated with same meta: line 2128,40176
Prior to 1b735665f4 the Heimdal versions were installed via
distribution:
${_+_}cd ${.CURDIR}/gss; ${MAKE} install
1b735665f4 added a conditional for MK_MITKRB5 but also added gss or
gss-krb5 to SUBDIRS, causing these files to be installed twice.
Fixes: 1b735665f4 ("etc/gss: Add MIT GSS glue")
Event: Kitchener-Waterloo Hackathon 202506
Sponsored by: The FreeBSD Foundation
The MIT GSS uses different library names. And MIT KRB5 supports more
OIDs than our ancient Heimdal does.
The intention is to remove etc/gss when Heimdal is finally retired and
rename etc/gss-krb5 to etc/gss.
Sponsored by: The FreeBSD Foundation
Differential revision: https://reviews.freebsd.org/D50812
Test that tpool_dispatch returns an error if it cannot start even one
worker. Previously, it would hang. The test must reside here rather
than in the OpenZFS repo because the latter has no infrastructure for
writing libtpool tests.
https://github.com/openzfs/zfs/issues/16172
MFC after: 2 weeks
Sponsored by: Axcient
Differential Revision: https://reviews.freebsd.org/D45587
release/packages/runtime.ucl manually adds "/tmp" and "/dev" to the
"directories" key, which causes them to be included in the manifest
with the user/group owner of whoever built the package repository:
drwxr-xr-x 7 ivy wheel 512 Jun 1 17:24 /dev
drwxrwxrwt 10 ivy wheel 10 Jun 1 17:42 /tmp
Remove the manual entries and instead put an explicit package tag
in etc/mtree/BSD.root.dist. This also means /tmp gets the right
mode by default and we can remove the chmod from the post-install
script.
Reviewed by: manu, kevans, emaste
Approved by: kevans (mentor)
Differential Revision: https://reviews.freebsd.org/D50636
add some basic tests for traceroute. this covers most of the flags we
can easily test; in some cases we use tcpdump to ensure the correct
packets are actually being sent.
to run the tests, we create three jails: one for the source host, one
for the destination host, and one to route packets betweem them. this
ensures we're actually testing traceroute across a routed network and
not just sending probe packets to a directly connected host.
no tests for traceroute6 are in this commit since the traceroute6 merge
into traceroute is in progress elsewhere.
Reviewed by: des, adrian
Approved by: des (mentor)
Differential Revision: https://reviews.freebsd.org/D49838
this prevents the file being overwritten every time FreeBSD-runtime is
upgraded.
Reviewed by: des
Approved by: des (mentor)
Differential Revision: https://reviews.freebsd.org/D49907
The cases are ordered in such a way that we naturally progress through
the functionality, with the earliest failures perhaps shedding light on
any later failures.
sysutils/porch is used for one test if it's available, just to cleanly
check that SIGINT is being ignored properly.
Reviewed by: des, emaste
Differential Revision: https://reviews.freebsd.org/D48195
If we have multiple simultaneous readers on a single /dev/bpf fd it's possible
for the assertion after the bpf_uiomove() in bpfread() to fail.
Note that the bpf_uiomove() is done outside of the BPFD_LOCK, because uiomove
may sleep. As a result it's possible for another thread to have already
reclaimed toe bd_hbuf, thus causing us to fail the assertion.
Even without INVARIANTS this may provoke panics.
That results (with INVARIANTS) in a panic such as:
login: panic: bpfread: lost bd_hbuf
cpuid = 13
time = 1740567635
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe003972db10
vpanic() at vpanic+0x136/frame 0xfffffe003972dc40
panic() at panic+0x43/frame 0xfffffe003972dca0
bpfread() at bpfread+0x2e8/frame 0xfffffe003972dce0
devfs_read_f() at devfs_read_f+0xe4/frame 0xfffffe003972dd40
dofileread() at dofileread+0x80/frame 0xfffffe003972dd90
sys_read() at sys_read+0xb7/frame 0xfffffe003972de00
amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe003972df30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe003972df30
--- syscall (3, FreeBSD ELF64, read), rip = 0x302787166afa, rsp = 0x302782638a78, rbp = 0x302782638aa0 ---
Also add a test case replicating the known trigger for this panic.
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D49135
Colin Percival