installs 2.8.4 from latest; from quarterly (2026Q4) 2.8.4
Port
# cd /usr/ports/ports-mgmt/pkg && make install clean
# make -C /usr/ports/ports-mgmt/pkg config # change options first
Size
13 MiB download · 52 MiB installed
Depends on
nothing
License
BSD2CLAUSE
Options
1 of 1 on in the package: DOCS
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
2.8.4
2.8.4
–
FreeBSD 15
2.8.4
2.8.4
–
FreeBSD 14
2.8.4
2.8.4
2.8.4
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
2.8.4
2.8.4
–
FreeBSD 14
2.8.4
2.8.4
2.8.4
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by pkg audit for the packaged version 2.8.4.
Fixed (2)
Show 2 fixed
VuXML entries whose affected range the packaged version has left.
maintainer-feedback? ports-mgmt/pkg: does not show a dependency for a package, but removing it wants to remove many others; autoremove trying to remove a manually installed package
ports-mgmt/pkg: pkg -r fails to run post install script.
In Progress
2020-05-11
Commits (349)
Baptiste Daroussin (bapt) · 1.20.7
ports-mgmt/pkg: update to 1.20.7
Changes from 1.20.6 to 1.20.7
- improve sql traces in debug mode
- fix autoremove issue leading to 100% of CPU consumed almost forever
- don't complain about Last-modified http header being absent in case the DL
failed
- plug memory leaks in pkg autoremove
- fix build with lld >= 17
ports-mgmt/pkg: update to 1.20.5
Changes:
- fix a regression introduce with switch to libcurl which results in
the remote db mtime being badly set
- fix a regression which makes pkg query report twice some packages
when configured in multirepository mode.
- fix a compatibility issue with http_proxy env var (lowercase)
- update libcurl to latest version
pkg*: new regression fixes release
Changes:
- speed up pkg add again, and greatly reduce its memory footprint
- more compatibility with libfetch (SSL_* variables)
- fixed FETCH_TIMEOUT adaptation to libcurl
pkg*: fix regressions from 1.20 release
- reduce memory usage for pkg add
- fix regression in url parsing for ssh
- fix some more compatibility with libfetch
- update pkg-triggers manpage
ports-mgmt/pkg: release 1.20.0
Changes:
- update libucl to latest version
- update sqlite to latest version
- remove support for pkg_* tools backward compatibility
- add and autoremove command now respects provides/requires and shlibs provides/requires
- improve SRV and HTTP mirroring: reducing the number of round trips
- replace bundled libfetch with a stripped down bundled libcurl (only used for http(s))
- new COMPRESSION_FORMAT configuration entry in pkg.conf
- periodic script: Use locale-agnostic (ISO 8601)
- Add support for openssl3
ports-mgmt/pkg: update to 1.19.2
This release only deals with RSA signature for people using the PUBKEY
mechanism.
With openssl3 the signature had to change, in this release we make pkg
accept both the new signatures and the old ones.
if built with openssl 1 (aka freebsd 12 and 13) pkg will continue issueing
the usual signatures aka no changes.
if built with openssl 3 (aka freebsd 14) pkg will issue a new format of
signature.
The version of pkg older than 1.19.2 will not be able to use a signature
issued witg pkg running on freebsd 14
All system running 1.19.2 and above will be able to accept any of the
signatures.
If a user get stuck, for any reason, pkg bootstrap -f will fix the
situation as long as it installs 1.19.2 and above.
Note that is only concens PUBKEY which is not the default.
No changes at all for users of the official FreeBSD repositories.
pkg: revert openssl3 support
This change makes pkg generate a signature that is incompatible with
previous keys, it is better to have pkg broken for openssl3 and die
instead of having a backward incompatibility
ports-mgmt/pkg: fix regression in pkg-static and version number
When adding the support for static PIE, we masked the actually
STATIC_ARGS making pkg-static a dynamic binary in all other cases.
While here fix the version numbering which was not updated properly
during the release process.
ports-mgmt/pkg: update to 1.19.1
Changes:
- fix regression in pkg autoremove
- fix regression preventing tracking files with path longer than 64
chars
- fix build out of tree
- fix spelling issues in pkg-trigger(8)
ports-mgmt/pkg: update to 1.19.0
Changes:
- rework file extraction to solve edge cases happening sometime when a file
in a package becomes a directory in a new package or vice versa
- update bundled lua to 5.4.4 and sqlite to 3.40 and linenoise to latest
versionautoremove will not remove anything anymore which is required
by another installed package via provides or via shlibs_provides.
- Accept '~' in the version or the name of a package
- delete now handles properly provides/requires (and shlibs equivalent)
- (r)query now have new operators: =~ ==~ and !=~ (case insensitivity)
- (r)query is now stricter regarding command line validation
- pkg-backup command has been removed (prefer pkg shell ".dump" instead)
- fix regressions in pkg lock
- fix pkg annotate --modify
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
ports-mgmt/pkg: update to 1.18.4
Changes from 1.18.3 to 1.18.4
- fix querying licenses
- fix "ambiguous colomn name
- fix packaging the lua deinstall scripts
- add pkg.symlink to allow creating symlinks from lua scripts
- performance improvements
- sync libfetch with base bringing in socks proxy support
security/base-audit: Remove port
* Remove port as 405.pkg-base-audit, core file of the port, is merged
into ports-mgmt/pkg with pkg 1.18.1.
* Add entry to MOVED
PR: 264878
Approved by: maintainer
ports-mgmt/pkg: update to 1.18.3
Changes from 1.18.2 to 1.18.3
- allow to deal with 240 character long filenames
- fix an issue when disabling a repository resulting in breakage
of the repository list
ports-mgmt/pkg: update to 1.18.0
Changes:
- add support for category and flavor in all queries (<category>/<portname>[@<flavor>]
- new tcp protocol to support inetd/spiped
- end of ftp support
- allow filtering out files at install time
- improvements on triggers
- plenty of bug and doc fixes
ports-mgmt/pkg-*: fix symbol collisions
while we fixed the symbol collision between libmd and libcrypto long
ago in dynamic linked program, the collision is still there somehow for
statically build programs.
The manual check for liblzma_libs for static linking that was added long
ago brings in a link to libmd before a link to libcrypto (this is since
FreeBSD 13.0+
This manual check is not necessary anymore anyway, so let's drop it.
Reported by: Franco Fitchner (from Opnsense)
ports-mgmt/pkg: update to 1.17.5
Changes from 1.17.4 to 1.17.5
- pkg add: only runs triggers at the end of the equivalent of a transaction
- pkg search: fix the combinaison of -q and -o
- pkg fetch: correctly exit with error on fetch failures
- Improve error message when failing to drop privileges
ports-mgmt/pkg: update to 1.17.3
Changes:
- revert 2 regressions,
* periodic script for audit which reduced verbosity
* the fallback on version mismatch on pkg add
- prevent an endless recursion on the solver
- make fingerprint signature validation respect rootdir
MFH after: 1 week
ports-mgmt/pkg: update to 1.17.2
- make audit.h c++ friendly
- fix build with libressl
- autoremove now respects -q
- version: reports error if INDEX file does not exists but is expected
- periodic audit:
* Allow user to specify which jail not to audit
* New option to ignore deprecation and expiration warnings
* Reduce verbosity of the report
* Add a script to audit base
- register: implement -N to actually not register in the database
- fetch: do not count cached package in the list to be fetched
- query: -e is not supported as additional condition
- fix pkg not finding its db when run from a directory which does not exists
anymore
- De-prioritize upgrade-removals in the solver
- triggers:
* run them for pkg register and pkg add
* Add pkg.readdir lua function
* Add documentation for the triggers
security/base-audit: Add the ability to specify ignored jails
security_status_baseaudit_jails_ignore is a space delimited list of jails
to ignore.
If non-empty, the code iterates over security_status_baseaudit_jails_ignore
to avoid partial matches (i.e. ignore foo.bar, but not foo). If there is a
better way to do that without looping, please let me know.
Example use case: I have jails which purposely are older vulnerable versions
for testing.
PR: 257685
Approved by: 000.fbsd@quip.cz (maintainer)
ports-mgmt/pkg: retag the release
The tag was put on the wrong version of the release, (missing the NEWS
update and the internal version update)
retag it
ports-mgmt/pkg: release 1.17.1
Changes from 1.17.0 to 1.17.1
- by default only create .txz symlinks for metadata
- only consider the .pkg when creating a repository
add an option REPO_ACCEPT_LEGACY_PKG to keep index old pkg
- Reduce usage of memory stack
ports-mgmt/pkg*: Release 1.17.0
TL;DR: new uniq package file extension: '.pkg'
Full changelog for pkg:
- add a new "snap" prefix, to deal with pkg base snapshots
- pkg repo now accepts packages with different compression formats
- pkg now have a single extension: ".pkg" and a backward compatible
symlink is created when the package is created to help transitioning
- Default compression level for zstd is now set to 19
- the default compression level is now a configuration option
- plenty of portability fixes
- fix plenty of typos
- expose the name of the package to lua and shell scripts
- plist:
remove internal support for @*exec (this is now in the ports tree)
remove support for @ignore
remove support for @dirrm/@dirrmtry
remove support for @pkgdep
remove stub support for @stopdaemon
remove stub support for @display
remove stub support for @mtree
remove stub support for @conflict
- VUXML: fetch .xz compressed version of the file by default
- triggers are deferred to later command (firstboot is planned) if run
with pkg -r
- pkg triggers commands has been added and can execute the deferred
triggers for example at firstboot
Changes in the framework:
- Add a backward compatibility layer, so people are not forced to move
to pkg 1.17 yet (new quarter we will enforce the switch for triggers
anyway, but it gives time to people to switch)
- Introduce a new PKG_COMPRESSION_FORMAT for users to specify the
compression format they are willing to use when creating packages:
txz, tar, tgz, tbz, tzst are the valid ones (note that tzst is only
usable on FreeBSD 13 and 14)
- Add a backward compatibility for people who specified the compression
format already via PKG_SUFX and issue a warning to tell them about the
deprecation of PKG_SUFX
ports-mgmt/pkg: Update to 1.16.2
Changes from 1.16.1 to 1.16.2
- libpkg: add a snap(shot) version prefix
- libpkg: only upgrade installed packages with pattern matches
- Document pkg-lock(8) accepts a list of packages
Approved by: bapt (implicit)
ports-mgmt/pkg: Update WWW
The pkg wiki entry (https://wiki.freebsd.org/pkgng) says "The content of this
page was outdated and misleading so it has been deleted." Instead, point to
the upstream github repo where truths about pkg can be found.
Approved by: pkg (bapt)
update to 1.16.0
Main highlights:
- Add support for RISC-V
- plist now supports '@include <anotherfile>'
- Keywords can now validate the plist syntax at packaging time
validation is done via a lua script
- Keywords can issue a deprecation warning if needed
- Add support for triggers (lua and shell scripts possible)
- pkg create -e now will create a package with a readable MANIFEST
but also:
- pkg-query now supports %X to print the internal package checksum
- remove usage of utstring
- lua scripts can now take real arguments
- get rid of sysexits
- improve performances for pkg query -F
- Fix an issue with metalog duplicated entries
- Relax keywords attributes syntax by allowing spaces
- Fix a crash when pkg is told to package a directory as a file
- pkg upgrade -n does not run anymore the "prior" test for self pkg upgrade
but instead prints everything that will be upgraded including pkg
- pkg info now print the installed timestamp and repository in --raw output
- print all missing packages not only the first one encountered
- All commands are now consistently using --no-scripts
- pkg audit now accepts a -R/--raw option for parseable output
- some fixes in the solver
PR: 251696
Update to 1.15.8
Fixes a typo which results in pkg ignoring some lua script in some particular
circumpstancies: shell script also available in certain types
ports-mgmt/pkg: Update to 1.15.5
Changes from 1.15.4 to 1.15.5
- Add powerpc64le arch
- Fix query '%X' to not use the version
Approved by: bapt (implicit)