Disable Werror to calm down gcc3c3ac2d7a3
pkg -- vulnerability in libfetchentered 2020-01-29
Package manager
# pkg install pkg-develinstalls 2.8.99.4 from latest; from quarterly (2026Q4) 2.8.99.1# cd /usr/ports/ports-mgmt/pkg-devel && make install clean# make -C /usr/ports/ports-mgmt/pkg-devel config # change options first
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 2.8.99.4 | 2.8.99.1 | – |
| FreeBSD 15 | 2.8.99.4 | 2.8.99.2 | – |
| FreeBSD 14 | ✗ | 2.8.99.1 | ✗ |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 2.8.99.1 | 2.8.99.1 | – |
| FreeBSD 14 | 2.8.99.1 | 2.8.99.1 | 2.8.99.1 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
pkg audit for the packaged version 2.8.99.4.| PR | Summary | Status | Changed |
|---|---|---|---|
| 295389 | maintainer-feedback? ports-mgmt/pkg-devel: runs from cron simultaneously 9 hours and 7 hours | New | 2026-05-20 |
Disable Werror to calm down gcc3c3ac2d7a3
Update pkg to 1.4.0 Update pkg-devel to 1.4.99.0 (aka 1.5 pre-alpha0) Changes since pkg 1.3.0: Changes you can expect in pkg 1.4 are the following: - Loads of bug fixes - Stricter checking of the path passed via the plist - Removal of the bundled libyaml - new --raw-format to chose the output format for info -R and search -R - ABI (for freebsd, unchanged for dragonfly) is now follwing MACHINE_ARCH4126c83152
Update to 1.4.0 rc3 Changes: - More fixes to pkg fetch -o - Fix pkg delete removing too many directories - new pkg set -n (to change names) equivalent of pkg set -o - Run pkg set -n and -o understand transaction to speed up - Allow @dir to be a symlink825572a861
Update to 1.4.0 rc2 Changes: - Important bug fix in the solver in case an explicit conflict has been discovered in that case the solve should delete the old version then install the new version when it was deleting the old version then upgrading \ to the new version - Small cosmetic fixe8ac976874
Update to 1.4.0 rc1 Changes: - Print orphaned packages in pkg version when comparing with the INDEX file - Fix pkg upgrade leaving directories behind - Plug memory leaks when parsing plists - Remove some dead code - Improve documentation - file:// repository files are now fetched again into the cache to avoid problems in integrity check - The repository configuration files are now load in alphabe5bff64ac
Cleanup the @dirrm Reported by: marinoc7d4d6bd7e
Reroll the tarball I was mising some dfly only commits: - fix build with bundle libelf - keep ABI on dragonflyd938d9d96d
Update to 1.4.0.b2 - more fixes to multi repo - fix pkg autoremove recursivity337d98cc5d
Update to 1.4.0.b1 Changes: - Lots of documentation fixes - Lots of typos fixes in messages - Fix UI when a package is going to be downgraded - Cleanup is internal functions (removing useless accessors) - Do not allow to create packages in old format anymore (it was broken anyway) - allow ? and ! in pkg version limchar - New configuration option VERSION_SOURCE (to the version used to read INDEX) -92d05cd558
Update to 1.4.0.a4 Changes: - Reinstall packages if one of its dependency have change While hackish this allows seamless upgrade of perl5 and ruby2 - Fix pkg audit as used from ports - Reject chroot for unknown ABIs - Fix generating repos from 1.3 created packages - Allow to build out of the source tree - Fix ABI detection on armeb - Fix some left overs from Unique id migration - Fix pkg delete Thank you very much for all the testers and reports! Please keep testing!94fe893051
Update to 1.4.0 alpha3: - Fix pkg check -r to make it also compute checksums for symlinks - Fix pkg register in case the ancient arch as not already been definede139980a3f
Sorry I didn't checksum the right file9e24a2e4af
Update to 1.4.0.alpha2 Changes: - Change the default fetch site for vuxml - simplify some code - fix too small buffers - only add in provided shlibs the files starting with lib*b83cfef8c9
Update to pkg 1.4.0.alpha1 Changes: - Lots of cleanup in the API - Huge refactoring to avoid using hashes where not needed - add a new @config keyword for all files with such flags pkg will try automatically to merge the difference with newer version on upgrades a vanilla version of the file is kept in the db to allow 3 way merge this was the last blocker to be able to package base - new optcff7b12443
Update to 1.4.0.pre-alpha16 Changes: - Rework the job request processing - Fix pkg install/upgrade - Fix forced reinstall - Rework of integrity checking - The ABI is now defined using MACHINE_ARCH meaning freebsd:10:x86:64 is now FreeBSD:10:amd64 this is encoded in the package as "abi" the old "arch" key remains for compatibility and is translated to the old ABI - New option ALTABI represent the2303f42042
If not built with WITH_PKG=devel, depend on ports-mgmt/pkg. This will use the normal pkg for packaging pkg-devel. This is needed because the repo is expected to be only non-devel packages. This also fixes a poudriere crash when the repo is empty and both pkg and pkg-devel are built. When pkg-devel would finish first it would crash due to not having a pkg to use for caching various metadata from the package. Differential Revision: D809 With hat: portmgr Reviewed by: baptdc9116af30
Update to 1.4.0-alpha15 Changes: - pkg register checks conflicts before installing the files - do not provide any shlibs if the "no_provide_shlib" annotation is set - fix invalid free() in keywords arguments parsing - Add ability to select usage of IPv4/IPv6 via config, repository config or command line - some documentation fixes and improvements - If one of -P, -I or -R is not explicitly given on627d890c90
Update to 1.4.0-pre-alpha14 Changes: - New @dir keyword - @dirrm/@dirrmtry will now expose a warning in DEVELOPER_MODE - directories outside of PREFIX are now automatically handled - Determine the running OS version from /bin/sh not uname so that pkg doesn't think a jail running on a newer host is an OS upgrade - Remove libyaml - The plist now entirely default on owner root, group wheel - Add moref4afd32cb9
Update to 1.4.0-pre-alpha13: Changes: - @owner/@group without var reset to root/wheel - Do not accept @mode with '+-' like u+s or g-w - Integrate kyua with autools (make check now calls kyua) - Fix pkg annotate -y - Fix a regression in pkg_is_valid - Allow keywords define in ucl files '(Keywords/*.ucl)' to consider its argument as a command line argument (aka split it) - Completly ignore mtree -af46f5c511
Remove support for pkg_install Merge back bsd.pkgng.mk into bsd.port.mk Add a note about @stopdaemon not being supported anymore With hat: portmgr Differential Revision: https://reviews.freebsd.org/D693d96aa38d95
- Update to 1.4.0.pre-alpha12
Changes:
* Documentation updates
* Fix always refetching of file:// and ftp:// repositories
* pkg query -g: Fix handling of ranges such as 'name-[0-9]*' which
is used by ports CONFLICTS checking
* Fix crash when SIGNATURE_TYPE=PUBKEY but PUBKEY is not defined
* New output for UX testing/feedback:
* pkg add - Use a nested tree view due to how the job is handled
* pkg upgrade/install/delete - Show 'Installing' message separate
from Extracting or Deleting of files. This is so that any messages
from the package are shown after noting what is being done. Messages
were shown before "Installing" before.ac6d9a63e4Do not strip binaries at all this port is a developement ports and should remain with symbols While here remove remnant code from the pkg pre 1.3 build system.1f8915aaa8
Strip the proper file Reported by: dbn72333c50d5
- Update to 1.4.0.pre-alpha11
Users will see a "changed shlibs" reinstall for 'pkg upgrade' until:
1. _All_ packages on remote repositories are rebuilt with this version
of pkg.
2. 'pkg check -Ba' should be run after upgrading pkg but before upgrading
other packages. This requires #1 though, which is not happening until
1.3.7 is released. Running 'pkg check -Ba' before the remote repository
is fixed will just continue to propose reinstalling packages for 'changed
shlibs'.
Changes:
* pkg fetch -d: Fix crash (#955)
* Progress bar improvements/fixes
* Fix ETA for fetching (#943)
* Fix progressbar stalled support
* ETA progress: Account for TCP SLOW START and weigh the first few ticks less
* Rework 'pkg update' output slightly to clarify what it is doing.
* pkg check: Add progressbar when not using -v
* pkg check: Add job counter with using -v
* pkg clean: Add progressbar
* Fix hardlink calculations (#958)
* pkg backup: Add -q
* pkg backup: Remove docs for '-d -' as it does not work.
* pkg config: Fix output for arrays/objects (#971)
* Fix RC scripts being started on deinstall rather than stopped
* Add some more asserts
* pkg-fetch.8: Remove reference to removed mirror mode
* Fix a few typos in pkg.conf.5 (#969)
* Document new configuration options. (#969)d4000ab22c- Update to 1.4.0.pre-alpha10
Changes:
* Test suite fixes
* Fix pkg-devel self upgrade when remote repo defaults to non-devel
* pkg-rquery(8): Add a pointer to EXAMPLES in pkg-query(8)
* If opening the db in READ_ONLY give a warning if it is missing
* Give advice on how to recreate the database if auto-updating was skipped
* Remove pkg --check-activation. It is too tempting to use.
* Make it more clear that the 'Major version' change is non-fatal
* Jobs display: Avoid excessive newline before prompt and after unprompted usage
* Remove references to PACKAGESITE/MIRROR_TYPE/PUBKEY
* Support uppercase ENABLED in repo config.
* Avoid POLA, make PACKAGESITE/MIRROR_TYPE/PUBKEY in pkg.conf fatal
* Fix self upgrade loop with pkg upgrade -Fy
* Fix self upgrade not using the new pkg binary
* pkg-{delete,autoremove}: Use a readonly lock in dry run
* pkg-convert: Add locking. EXCLUSIVE by default, READONLY with -n
* pkg-convert: Check for proper db permissions for both real and dry_run mode
* pkg-convert -r: Only a readonly lock is required for converting from the db
* pkg-convert -r: Add common db access checks
* pkg convert -r: Don't crash if unable to create the package dir
* Revert stripping shlib versions from e127d91d4.
This will require rebuilding packages on the repository and then
running pkg check -Ba to fully utilize. Until packages are rebuilt
there may be false-positive shlib reinstalls.
* pkg {register, check -B}: Fix registering provided shlibs as required
* When analysing ELF files with DEVELOPER_MODE, don't bail on first error
* Fix pkg-ssh when SSH_RESTRICT_DIR is a symlink
* Fix size calculations with hardlinks
* Fix pkg-which glob7d5c5956acUpdate to 1.4.0.pre-alpha9 Changes: - Fix pkg-delete -q [1] - pkg-add: Respect locked packages on forced invocation [2] - Rework fields in manifests digests (based on [3]): added: * depends * shlib provides/requires * users * groups removed: * maintainer * www * message * comment - Fix forced repo update when checksum is changed - pkg-(add|install|upgrade): Respect locked packages on forced invocation. [2] - Fix autoremove -n - Remove dead case fallthrough in pkg_jobs_universe_process_item() - Remove dead PKG_FLAG_RECURSIVE handling code Submitted by: grembo [2] Maxim Ignatenko [3] Suggested by: az [1] With hat: pkg@de847b6e8d
Update to 1.4.0.pre-alpha8 Changes: - When filtering out shlib archs, compare wordsize first and then ABI arch string - Fix rquery -e - Fix install progress output for meta packages - Fix writing annotations to manifests - pkg-clean: Show files to delete first - Add a pkg_symlink_cksumat to fix pkg-delete - Add packages checksums to digest file to fix broken repo update - Unbreak pkg-ssh With hat: pkg@7cbb999106
Update to 1.4.0.pre-alpha7 Changes: - Fix crash on i386 (thanks to antoine@) - Ignore duplicates in require/provide - Add missed call to pkg_list_free for PKG_PROVIDES (thanks to Maxim Ignatenko) - Print error if we cannot parse manifest - Select the newest possible package to satisfy dependency - Check shared libraries architecture and ignore incompatible ones With hat: pkg@805b629918
Update to 1.4.0.pre-alpha6 Changes: - Print number of upgrade candidates - Fix request addition - Suggest manual resolution for UNSAT problems - Check repository and force update if it is not valid - Fix issue with seen packages not added to the request - Use plain .so for all shared libraries requires/provides With hat: pkg@c900975a34
Disable maintainer mode to make sure configure never tries to regenerate the configure and Makefiles0803b4afd9
Update to 1.4.0.pre-alpha5 Changes: - Use picosat SAT solver instead of the internal one: * production grade solver that is extensively tested * faster than internal one * has more flexible features - Fix issues with adding items to the universe - Fix forced operations With hat: pkg@acd3c19d08
Update to 1.4.0.pre-alpha4 Changes: - The solver and jobs interface were completely reworked: * multirepos have now better support * fix a number of issue with missed shared library dependencies * upgrade and install are now more clever about chosing repositories * implement package pinning to a repository * add heuristic to resolve conflicts between remote packages * removed tonns of old hacks * arrays are now used in many places instead of lists for performance * some hash tables are improved by using direct pointers hash - Minor fixes069cc7d61a
Update to 1.4.0.pre-alpha3. Changes: - Explicitly pass when passmode should be used with libarchive - Properly trim end spaces in plist for files and directories - Fix pkg ssh client - Fix pkg_env - Follow symlinks in fstatat otherwise it breaks repos created by poudriere - Fix sqlite on FS without proper locking mechanism - Fix pkg install -A - Do not distinguish anymore between dirrm and drirmtry - Fix options parsing by libucl - Rework repo update to avoid early repo destruction - Fix forced update - Update errors are now not fatal - Fix realpath usage - Fix pkg set -o - Fix progress bars when not in a tty to give output - Ignore sigpipe to avoid resources leak - Read lock is now no-op unles READ_LOCK option is turned on - Fix incremental repo updates (size missmatch error) - Add a rootfd to simplify handling of relocation - Implement a set of *at functions - Improve documentation - Tons of minor bugfixes With hat: pkg@1f2e788731
Update to pre-alpha2. This build includes all fixes from pkg 1.3.2 plus the following changes: - Fix an issue with pkg-repo that prevents from getting all packages in the archive - Fix an issue with manifests parsing on big-endian platforms - Add help messages for aliases (by admi3) - Fix linkage with sbuf (always use bundled sbuf) With hat: pkg@d8a2263b12
Prior to release 1.3 update pkg-devel to 1.4.0.pre-alpha1. This version is equal to pkg 1.3.0 tag. Changes from 1.3.0.rc4: - Use rename(2) to install symlink [1] - Link directly pkg frontend to libsbuf - Rework installation logic: If a file is found on the way do the following: 1) Append 12 chars random suffix to the filename; 2) Extract new file to that modified filename; 3) Rename new file to old file. - or - 3) Remove temporary file in case of error. - Fix reporting of locked packages [2] - Fix link with binutils 2.24 Reported by: bdrewery[1], az[2] With hat: pkg@392d6b7db9
Update to 1.3.0.rc4 Changes: - Fix output format when a dependency is missing - Fix typo (dbpath -> dbdir) - Create repo compatible with pkg 1.2 (path -> repopath) - Event pipe related fixes - Fetching now does not use mkstemp(2) to create files - Change permissions of files fetched to default ones - Fix fetching for reinstalled packages - Fix build on mips by proper checking of atomic builtins With hat: pkg@b9ef0484b7
Update to 1.3.0.rc3. Changes: - Fix bug in upgrade repos schemas from 1.2 [1] - Fix repos downgrade sql - Add -r (--recursive) flag to pkg-audit that makes pkg-audit to print all reverse dependencies of vulnerable packages. This allows users to upgrade or reinstall potentially vulnerable packages. - Rework pkg-audit to support pkg names without versions - pkg-audit now supports multiple patterns Found by: az [1] With hat: pkg@50e6275ec8
Update to rc2. Changes: - Fix critical bug in the solver caused not required packages being installed - Rework DPLL algorithm to solve tasks quicker by propagating units on each step - Fix bug with loading of package files and directories - If all files are downloaded then perform integrity check immediately without extra queries to a user - Removed incorrect error messages With hat: pkg@a79014ceac
Update to release candidate 1. Changes: - Fix repo ident for local packages [1] - Fix pkg-stat - Improve safety of 1.2 -> 1.3 database migration - Fix minor bugs in progress bar - Restart system calls on SIGALARM Submitted by: des[1] With hat: pkg@776a2caed6
Update to 1.3.0.b9 Changes: - Quit pkg ssh if an error occurs while reading - Fix critical issue with manifest fields (path->repopath) [1] - Set reponame for local packages [1] - Fix forced upgrade [1] - Fix packages count in pkg-delete - Allow override `enabled` state for repos - Fix message if a pattern has not been found - Move the pkg_keys[] array from private/pkg.h to pkg.c to reduce duplication [1] - Add package validation function - Fix local packages installation - Validate pkg when changing its uid - Rework solver initial guessing - Fix multirepos documentation - Fix issue with repository metafile updating - Fix issue with unnecessary fingerprints check - Fix meta loading Submitted by: des [1] With hat: pkg@5885a25654
Update to 1.3.0.b8. Changes: - Fix pkg-backup display issues - Fix UID changing when looking for upgrade candidates - Rework integritycheck procedure to use uids - Improve searching of local and remote packages - Lazy load of files and dirs for remote packages - Fix upgrades with UID changed - Fix actions count in jobs progress display - Fix serious bug in pkg-repo by moving to socketpairs from pipes - Detect SOCK_SEQPACKET support and fallback to SOCK_DGRAM (for 8.x) With hat: pkg@5e1f0868b9
Update to 1.3.0.b7 Changes: - Save repo type in the annotation. - Fix packages fetching for reinstallation - Convert pkg repo from threads to processes (no more pthread dependency) - Add progress indicators to repo create - Implement new repo style: * Add metafile * Use data from that metafile * Use advanced manifest digests format * Implement legacy repos creation - Fix symlinks checksums (reported by misha @ #pkgng) - Fix pkg backup -r messages - Now pkg is able to delete multiple versions of the same package (e.g. when some packages are merged into one another) - Fix repo schema upgrade - Do not try to re-fetch broken packages infinitely - Fix couple minor bugs and crashes With hat: pkg@2ecafe66a4
Update to 1.3.0 beta6. Changes: - fixed pkg-delete bug - fixed issues with progress displaying With hat: pkg@c2ff371b35
ports-mgmt/pkg-devel: Chase relocation of pkg.8 man page The pkg.8 manpage is edited by an extra patch on DragonFly due to differences in jail operation. The patch no longer applies both due to file relocation and regular bitrot. Regenerate the patch and change its name to reflect the new file location. This is a no-op on all releases of FreeBSD. Approved by: just-fix-it blanketcb4839820c
Update to 1.3.0 beta5 Changes: - repositories system has been reworked to support opaque repository operations - progress bar has been reworked and simplified - pkg backups generated by the distributed script are now plain sql files - fixed some visual issues while installing packages With hat: pkg@9b7cae180b
Update to 1.3.0.b4. With hat: pkg@cf38f40174
Change the maintainer of the development version of pkg to pkg@ instead of portmgr@ Approved by: portmgr (bapt, bdrewery) With hat: pkge6c4b05d8b
Fix regex, which fixes portmaster/portupgrade integration Reported by: kwm600d8ff67a
Fix loading of reverse dependencies913fc3d387
Update to 1.3.0 beta3 Changes: - Now unicity is made on the typle (origin, name) to allow sub packages but cannot be made to only name to break installation from prior sanitization of the names - Fix pkg stat - Fix speed regression - 411.pkg-backup does not hide errors anymore - Improve documentation - debug now print stacktrace on freebsd 10+ - globalize common variables - new option to allow pro6c35651f27