ensure tempoary variables are unique within the for/endfor block

sorted!

remove extraneous Makefile target

avoid re-using variables in loops

sub plist and use DISTVERSION

use upstream tag, thanks lga.

update rc.d

merge commits

polish plist

thanks @diizzy I'm just using this as a glorified pastebin while hopping between systems. I'll be happy to add reviewers when it works - this port needs both rust and go to build, the pain is existential.

more go snakes and ladders

use system flua not dch's flua

switch to flua for json handling, this is 1000x nicer than sed

committed in https://cgit.freebsd.org/ports/commit/?id=c613b7f7c133

Is this enough for including as a block comment in the Makefile outlining the process?
I'm likely to write a blog post with more detail, I can include that future markdown
somehere in releng repo if thats useful.

if GITREV is blank (e.g. during releases) then skip it and a preceding -

• switch out jq for sed
• use qemu-nox11 temporarily, I sent bofh@ a patch to allow use to use qemu-tools instead
• switch to bsd tar with gnutar format
• by switching back to sed, we have to keep the JSON blobs in their raw unreadable format
• remove the tmpdir cleanups, rely on CLEANDIRS for that

hi Moin, I'd like this for releng so we only need emulators/qemu-tools on the builder machines. It allows us to
reduce size of generated OCI images with qcow2 significantly - from 6GiB with default compression down to 1.6GiB with zstd:

switch to qemu-nox11 as tools flavor doesnt support zstd

add portinstall target

re-push with missing commits

dont print out PAR_URL as info, its supposed to be a secret

wx needs to use same OTP version as erlang

thanks Moin for the info on sorting. I'll do this inside a jail in future across my ports. I think we are ready to commit this then?

fixed sorting inside a jail. No amount of LC_ALL and related settings makes it work outside. thanks!

use jailed sorting

In D48245#1100054, @bofh wrote:

I don't think this is the correct approach for dns/p5-Zonemaster-Backend port. This port should have flavors; if not at least options to configure DB backends like sqlite, mysql and pgsql. A quick example for flavors might be postfix or freeradius.

The rest looks alright to me.

while testing jls output with new tags, I noted that the manpage says " Each jail is represented by one row which contains space-separated values of the listed parameter". Which is not quite the case as many parameters could have an embedded new line, that's not trimmed out.

In D47668#1095802, @igoro wrote:

In D47668#1095800, @jamie wrote:

In D47668#1095796, @igoro wrote:

• The allowed chars for each buffer are very limited by default, it covers Base64, k=v\n format, and some extra bytes. It can be changed via security.jail.meta_allowedchars sysctl. For convenience (as it seems to me for now), setting it to an empty string allows everything.

Why is this a kernel issue? Aside from NUL, because it preserves the C-string nature, allowed characters would seem only to be a concern on the user side.

Yes, that's a good point. Indeed, it feels like a user-land concern by default. If we agree to limit it by default for extra security, then having it in a single place covers all use cases and entry points: jail(8), flua, libjail, direct syscall, and so on -- it seems preferable to addressing it separately for each existing and future syscall consumer. What do you think? Does this approach offer additional benefits for us?