Thank you Jose and Tom.

FYI, when I was testing, I set WITH_SUBVERSION_VER to lts instead of LTS and it wasn't handled as would be expected after a look in devel/subversion/Makefile.addons.

This work was incorporated into Bjoern's 8f79c11c717126a42a6f17f30a193cf1da866831.

In D46643#1064092, @diizzy wrote:

Autogenerated archives changes over time which will break any kind of checksum verification and aren't necessarily reproducable so that doesn't add much if any value.

In D46643#1063864, @diizzy wrote:

Any reason as to why we're not using upstream release archive?
https://github.com/msktutil/msktutil/releases/download/1.2.2/msktutil-1.2.2.tar.bz2

As you say, this shouldn't hurt anything and we'll see if it eliminates the sporadic 503 errors on the official package builders.

Fix commit log header

Remove unintended changes

lgtm assuming all the necessary poudriere runs pass and @pi has no objections.

Build succeeds.

Good eye. It's even less evident because on the AMD disclosure site the date beside, e.g., 0x0800126f is 2024-05-03 and not 2024-08-10. Maybe the earlier date was some kind of internal release date. In any case, I'll commit this along with a vuxml entry. Thanks again.

Thanks! I don't see anything in the commit log of https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=091bd5adf19c7ab01214c64689952acb483 that the update addresses the vulnerabilities. Do you have a reference for that point?

Should add portmgr as a reviewer? There may be a server-side git hook to ensure commits under Mk/ are approved by them.

Understood. Here is another attempt, which fixes the build on FreeBSD main and restores the detection of mempcpy in string.h.

In D46055#1050309, @rnagy wrote:

I'd rather much prefer third_party/nasm/BUILD.gn to be fixed.

Tweak commit message.

Sorry, I should have also removed this patch in the other commit/review.

Also remove patch-third__party_nasm_BUILD.gn.

Also remove patch-third__party_nasm_BUILD.gn.

In D45915#1046880, @imp wrote:

Re [1]: We have a lot of SPDX-License-Identifier files that ALSO have the boilerplate. Those show up as false positives in how [1] was computed. The vast majority of these files won't have the boilerplate removed ever. I think we only have about 1000 files that have only the SPDX lines w/o the license statement.

I'll leave others to sort this out then and share what I found in case it's helpful. Some of this is repeated, but it might be easier to have it all in one place so if we do decide that the Copyright should go first, these are the places we need to fix.

In D45915#1046724, @mhorne wrote:

Note the duplicated info at https://www.freebsd.org/internal/software-license/

Update related text and tweak some wording.

The current SPDX documentation is somewhat vague and says, "The SPDX-License-Identifier tag declares the license the file is under and should be placed at or near the top of the file in a comment." [1]

In D45915#1046724, @mhorne wrote:

Note the duplicated info at https://www.freebsd.org/internal/software-license/