This status report covers both June and July 2026. It has been a rather chaotic couple of months for me.
I am going to use quite the number of backticks (`) in this status report. I apologize in advance. Think of then as used in Markdown to convey a command or static text.
In my announcement about force pushing the ports branch: I neglected to clarify the underlying issue and who is impacted. So, a non-malicious less-than-desireable commit made its way to the FreeBSD ports tree. FreeBSD needed to effectively remove the offending commit from the history due to licensing issues (there could be additional factors to which I am not privvy.) Since further commits made it to the tree, this made recovering from that state
a bit more difficult.
This naturally caused a chain reaction downstream for us. In addition to FreeBSD's commits, I had made multiple commits to migrate some of our ports entries to Radicle. This means that, we, too, have to break git commit history.
Those downstream from HardenedBSD, even, could be further impacted in a similar fashion. Those impacted primarily are those who maintain their own patches atop our ports tree. HardenedBSD uses a merge-based workflow for bringing in changes from upstream. I recognize that there may be downstream users who use a different workflow. I cannot advise you in that case--I'm most familiar with a merge-based workflow and haven't been sufficiently motivated to try others.
What I did was `git reset --hard` the tree back to the HardenedBSD auto-sync merge commit just prior to the offending commit from upstream. Afterwards, I merged the new freebsd main HEAD commit to our hardenedbsd/main branch.
If the last time you updated your ports tree was in the period we accepted the bad commit and our subsequent rollback, but you do NOT carry patches, you might find yourself in a weird state. I'm unsure what to tell users who use `git pull`, since I use a `git fetch && git merge` model. So, if you use the same, you can simply `git reset --hard rad/hardenedbsd/main` (after fetching `rad` of course).
I did run into issues with Radicle: primarily issues with mental models for this kind of situation. Previously, I consdiered the `rad` remote (which Radicle sets up by default) to be okay to use for both fetching and pushing. I used it like I would any normal git remote with push access.
Instead, I really should have considered the `rad` remote as read-only: use it only for fetching. I instructed Radicle to create a new remote, pointed to my own Radicle node: `rad remote add --name self $(rad self --did)`. I should push to this new remote, named `self`. For a more nuanced discussion, please see Appendix A below.
I haven't forgotten about re-establishing our GitHub mirror. I have other higher priority tasking at the moment, but I just wanted to say it is not forgotten. (And, I'm somewhat glad that our GitHub mirror hasn't been updated, since it hasn't been updated in so long, it didn't see the bad ports commit.)
In src:
- Robert set the default VMSIZE to 80gb for release VM images
- Shawn Webb: Harden the new security.bsd.allow_tiocsti sysctl node
- Shawn Webb: rc.conf(5): Support custom values for KLD prohibition value (hbsd_late_kld_prohibition_value, default: 1)
- Shawn Webb: Harden security.bsd.unprivileged_kenv_read
- Shawn Webb: Enable stack auto-init to zero for the linuxulator
- Shawn Webb: jail(8): Use safer memory management APIs
- Shawn Webb: Enable -ftrivial-var-auto-init=zero for linuxkpi_{hdmi,video}
-
Shawn Webb: HBSD: Harden new sysctl nodes and reorganize PTrace hardening
- Harden vm.phys_fictitious_segs sysctl node with CTLFLAG_ROOTONLY
- Harden ptrace(PT_SET_SC_RET) in the same fashion as ptrace(PT_SC_REMOTE)
- Shawn Webb: Enable trivial var auto-init for uvideo(4)
- Shawn Webb: Enable -ftrivial-var-auto-init=zero for opensolaris.ko
- Shawn Webb: Garbage collect unused sysctl node
- Shawn Webb: Harden the GEOM and related control interfaces
In ports:
- Robert added a new port: misc/robert
- Robert migrated misc/robert to Radicle
- Robert updated the misc/robert port a few times, currently sitting at version 0.10.0.
- Robert migrated hardenedbsd/ctrl to Radicle
-
Shawn Webb disabled COMPAT32 for the following ports:
- misc/compat13x
- misc/compat14x
- misc/compat15x
- Shawn Webb fixed the build of graphics/mesa-libs
- Shawn Webb fixed the build of graphics/mesa-dri
- Shawn Webb fixed the python version used with net-p2p/reticulum
- Shawn Webb fixed the build of lang/zig015 (which has, as of this writing, is broken again and on my queue to figure out.)
- Default devel/wasi-libc to llvm 21
- Migrate the default llvm version to 21 globally now that 15-STABLE LLVM in base has been updated to llvm 21
- Update ports-mgmt/pkg to 2.8.1
- Migrate hardenedbsd/liblattutil to Radicle
- Migrate hardenedbsd/hbsdmon to Radicle
- Migrate net/libpushover to Radicle
- Migrate sysutils/vm-bhyve-hbsd to Radicle and update to 1.7.4 (from 1.5.0)
Appendix A
Note: Relevant Zulip discussion
It is suggested that if you plan to contribute to a repository, you create a new remote called `self`: `rad remote add --name self $(rad self --did)`. Fetch from `rad`, push to `self`.
Treat `rad` as a virtual peer/contributor that tracks the network consensus and `self` is where you do all your own work.
Your `self` is what others see when they `rad remote add` you, and vice versa, so they're good for ad-hoc sharing. `rad` looks around at everybody and gathers up the crefs that satisfy sig requirements, so it's where you fetch canonical state from. As a convenience, `rad` also gathers up all the open patches so you don't have to hunt them down in the specific remote they came from.
