In D53964#1233038, @cperciva wrote:

In D53964#1233037, @bdrewery wrote:

In D53964#1232996, @philip wrote:

We could probably shave off several seconds for many people by replacing pkg+https with pkg+http. The TLS n-way handshake is a complete waste of time. I have made this observation about the other repositories as well but...

Windmills. Have to keep trying.

Agreed. All https buys us here is quieting an FAQ. It otherwise adds time and potentially has problems in some corporate setups.

It does provide a little bit of protection against rollback attacks. Not much, though; there's a reason I used HTTP for freebsd-update.

The main reason I used HTTPS here was because that's what the other repositories used and I wanted to minimize the number of bikesheds I had to paint.

In D53964#1232996, @philip wrote:

We could probably shave off several seconds for many people by replacing pkg+https with pkg+http. The TLS n-way handshake is a complete waste of time. I have made this observation about the other repositories as well but...

Windmills. Have to keep trying.

I'm not sure if this or SHLIB_REQUIRE_IGNORE_GLOB=* is the right path forward. The prebuilt binary wants a bunch of libraries that are not set as LIB_DEPENDS. It applies to all 3 of the bootstrap-openjdk ports.

Yep I see now that the libraries aren't bundled.

In D53723#1231867, @bapt wrote:

None of the libraries listed as required here are bundled, so it has done the right thing and the bootstrap now do not provide lib anymore so it will never be proposed instead of a regular openjdk

pkg_cleanup_shlibs_required(pkg, &internal_provided);

Seems it is supposed to just work, hm.

@bapt I'm not sure this did what I expected.
It added the annotation but it still marked all of the libs as required.

# pkg info -F bootstrap-openjdk17-17.0.1.12.1_2.pkg
bootstrap-openjdk17-17.0.1.12.1_2
Name           : bootstrap-openjdk17
Version        : 17.0.1.12.1_2
Origin         : java/bootstrap-openjdk17
Architecture   : FreeBSD:14:amd64
Prefix         : /usr/local
Categories     : devel java
Licenses       : GPLv2
Maintainer     : java@FreeBSD.org
WWW            : https://openjdk.java.net/
Comment        : Java Development Kit 17
Shared Libs required:
        libX11.so.6
        libXext.so.6
        libXi.so.6
        libXrender.so.1
        libXtst.so.6
        libasound.so.2
        libc++.so.1
        libc.so.7
        libcxxrt.so.1
        libdl.so.1
        libfontconfig.so.1
        libfreetype.so.6
        libgcc_s.so.1
        libgif.so.7
        libharfbuzz.so.0
        libjpeg.so.8
        liblcms2.so.2
        libm.so.5
        libpng16.so.16
        libthr.so.3
        libutil.so.9
        libz.so.6
Annotations    :
        FreeBSD_version: 1400097
        build_timestamp: 2025-11-13T00:01:02+00:00
        built_by       : poudriere-git-3.3.0-2420-g3a7024568
        no_provide_shlib: yes
        port_checkout_unclean: no
        ports_top_checkout_unclean: yes
        ports_top_git_hash: a5581322a5c3da107f83705f91c9900b8c219ae3
Flat size      : 252MiB
Description    :
OpenJDK is an open-source implementation of the Java Platform, Standard Edition.

Thank you

This one passes all of the Poudriere tests too (more read -t use than a bulk run). The previous problem was -t $n taking n seconds. bin/sh tests lack checking for duration on read -t.

Passes all of the poudriere tests. Thank you for looking at quickly. This change looks much better than my attempt.

Edited my comment with a more cleaned up version.

This works for me. It could be cleaned up more. Confirmed it prevents the original issue reported.

• check status == 1.
• handle -t 0 special, which avoids clock_gettime and doesn't sleep forever.

# echo yes | /usr/bin/time ./sh -c 'read -t 5 n; echo $n'
yes
        5.00 real         0.92 user         4.05 sys

should be 0. We may need another test case using timeout(1).

This passes the sh tests but times out on poudriere. Looking into why.

My intuition is we'll need a SIGALRM handler which is going to get tricky to not interfere with user traps. I haven't thought on it deeply.

Poudriere's test suite has more testing of this timeout and SIGALRM. It checks for timeout adjusting on [EINTR] and ensuring timeout runs within the period specified. If you want to try that you'll need to modify external/sh/miscbltin.c with the patch and then use make checkquick. Or I can check on the next patch.

Poudriere depends on these libraries being recorded properly. So I am adding PROXYDEPS_FATAL=1 to poudriere testport and poudriere bulk -t. Some attention will come to this check soon.

If it gets directly used in the ports tree we can just add a commit hook to block it. Probably should anyway.

I have the same use case and setup on my systems with meta packages. I had manually done pkg set -v1 on the packages but some recent change means I need to use this port flag now.

I have not reviewed each case but have been running it without problems and it looks reasonable.

Thanks for the quick fix! It passes my repro.

Testing this now.

sh: Avoid builtin cmdsubst forking in more cases.

Ah even an interactive shell doing a fork on $(fc -l) doesn't make sense. But I'm willing to skip that one.

I reviewed the cases. The only missing ones were the ones you mentioned. alias, alias NAME, hash, hash -v. readonly [-p] is covered by EXPORTCMD.

Closing this for now until I find time to finish it.

In D53499#1221657, @jilles wrote:

I'm only intending this to target $(alias) and $(alias --). I don't think it would be common but I've at least written some code that duplicates some aliases with different handling if they exist, and found $(alias) forking unexpectedly.
Is alias -= a thing?

Fix spelling :|

Maybe adding a flag for this makes sense? I don't know how important truss status is to people.

Do you have a single patch I can test? Or a poudriere bulk secrurity/openssh-portable@all successful build?

Thank you.