On Wed, Nov 11, 2026 at 11:24:46AM +0000, Stuart Henderson wrote: > On 2026/11/11 11:09, Stuart Henderson wrote: > > On 2026/11/11 10:45, Antoine Jacoutot wrote: > > > Hi. > > > > > > This diff updates audio/lame to version 4.1beta1. > > > 4.1 is scheduled to come out soonish. > > > > > > I'd appreciate tests on !amd64. > > > > size does not match, they rerolled the distfile > > > > (will test aarch64 soon, i386 after i have sorted out a bunch of fs > > corruption after panics) > > > > I regen'd distinfo, added cmocka BDEP and --enable-unit-tests. Thanks, I'll include that. Weird for distinfo because I just re-fetched and it's fine... > amd64: total 53, pass 52, fail: test_short_mp3 > aarch64: total 51, pass 50, fail: test_short_mp3 > > the failing test wants head -c, but with either ghead symlinked into > WRKDIR/bin/head, or with jca's diff for base, it still fails. not sure > if that's important. > > FAIL: test_short_mp3 > ==================== > > FAIL control: the whole file: exit 0, WAV data size 3488, not 4000 > PASS --decode of the short file writes a WAV of no samples and fails > PASS --mp3input of the short file writes an MP3 of no samples and fails > FAIL test_short_mp3.sh (exit status: 1) > -- Antoine
Wednesday, November 11, 2026
[update] www/librewolf 160.0-1
Stable-8.0/amd64. Runs fine in sway. Leah could you give it a gander please? To make sure I did not miss a config change. Comments, concerns, testing, and/or okays welcome. Thanks to Landry and Leah for maintaining the mozilla based browsers and the ports team for the ease of making coherent patches. -- yaydn Hope this helps; happy hacking everyone! $ cd /usr/ports/distfiles/mozilla/ && sq verify --signature-file=librewolf-160.0-1.source.tar.gz.sig librewolf-160.0-1.source.tar.gz ;sha512 -c librewolf-160.0-1.source.tar.gz.sha512sum ;cat librewolf-160.0-1.source.tar.gz.sha512sum Authenticating 662E3CDD6FE329002D0CA5BB40339DD82B12EF16 (LibreWolf Maintainers <gpg@librewolf.net>) using the web of trust: Fully authenticated (120 of 120) 662E3CDD6FE329002D0CA5BB40339DD82B12EF16, LibreWolf Maintainers <gpg@librewolf.net> ◯─┬ A629B716FBCB64C87477BC775525083E97A93CAA │ └ (Local Trust Root) │ │ certified the following binding on 2026‑05‑13 │ └─┬ 662E3CDD6FE329002D0CA5BB40339DD82B12EF16 └ LibreWolf Maintainers <gpg@librewolf.net> Authenticated signature made by 662E3CDD6FE329002D0CA5BB40339DD82B12EF16 (LibreWolf Maintainers <gpg@librewolf.net>) 1 authenticated signature. (SHA512) librewolf-160.0-1.source.tar.gz: OK 68ee74571c0cbc7bd52f8eecbb98d19634cf8d80756d65f6dd887130d27dca7cdd64f678e414d2087a5686c4cf36ab1595ef5408d1483eccf7c4369c9d915d66 librewolf-160.0-1.source.tar.gz -- Index: Makefile =================================================================== RCS file: /cvs/ports/www/librewolf/Makefile,v diff -u -p -u -p -r1.20.2.3 Makefile --- Makefile 5 Nov 2026 06:11:53 -0000 1.20.2.3 +++ Makefile 10 Nov 2026 23:20:39 -0000 @@ -13,7 +13,7 @@ ONLY_FOR_ARCHS = amd64 aarch64 riscv64 # If upstream adds revision number -x, it will become plx in OpenBSD, e.g. # librewolf-149.0.2-2 (upstream) becomes librewolf-149.0.2pl2 (patch level 2) -MOZILLA_DIST_VERSION = 159.0.1-1 +MOZILLA_DIST_VERSION = 160.0-1 MOZILLA_VERSION = ${MOZILLA_DIST_VERSION:C/-([0-9]+)$/pl\1/} MOZILLA_PROJECT = librewolf @@ -22,13 +22,13 @@ MAINTAINER = Leah Rowe <leah@libreboot. # LibreWolf doesn't provide PGO data, but we use the data # provided by FireFox releases, re-using the OpenBSD distfile -MOZILLA_PROFDATA_TASKID = SicCS5fzTJiaYOJUEpSAWg +MOZILLA_PROFDATA_TASKID = dRRnDxMKQ3-FPOlXeY_FWA FFVERSION = ${MOZILLA_DIST_VERSION:C/-([0-9]+)$//} FFDIST = firefox-${FFVERSION}.source DISTFILES.profdata = ${FFDIST}-profdata.tar.xz{profdata.tar.xz} HOMEPAGE = https://librewolf.net/ -SO_VERSION = 7.0 +SO_VERSION = 8.0 # Bump minor ver if shlibs deleted in components dir to avoid pkg_add -r issues MOZILLA_LIBS = mozavcodec mozavutil mozgtk mozinference mozwayland xul \ clearkey gkcodecs lgpllibs mozsqlite3 Index: distinfo =================================================================== RCS file: /cvs/ports/www/librewolf/distinfo,v diff -u -p -u -p -r1.15.2.3 distinfo --- distinfo 5 Nov 2026 06:11:53 -0000 1.15.2.3 +++ distinfo 10 Nov 2026 23:20:39 -0000 @@ -1,4 +1,4 @@ -SHA256 (mozilla/firefox-159.0.1.source-profdata.tar.xz) = aRw8g13wFXINA+cTEI23+yzSHTJ8sLF8fc8L/N68FhM= -SHA256 (mozilla/librewolf-159.0.1-1.source.tar.gz) = lVpRBj0VYSJg2ZP7cHlNwoqMbjPQOAGT6RzkRXDuP/M= -SIZE (mozilla/firefox-159.0.1.source-profdata.tar.xz) = 19060064 -SIZE (mozilla/librewolf-159.0.1-1.source.tar.gz) = 1183409460 +SHA256 (mozilla/firefox-160.0.source-profdata.tar.xz) = YWSXD/4l2Ba0D8KedUVhgSHnNxAPFW+QDahxhaHHyZM= +SHA256 (mozilla/librewolf-160.0-1.source.tar.gz) = opAc4hHc5sJQy+BKEyTyOfm7mdh7KIz6jgnaIG5oTjg= +SIZE (mozilla/firefox-160.0.source-profdata.tar.xz) = 19180056 +SIZE (mozilla/librewolf-160.0-1.source.tar.gz) = 1189768011 Index: patches/patch-python_mozbuild_mozbuild_rust_commands_py =================================================================== RCS file: /cvs/ports/www/librewolf/patches/patch-python_mozbuild_mozbuild_rust_commands_py,v diff -u -p -u -p -r1.1.2.1 patch-python_mozbuild_mozbuild_rust_commands_py --- patches/patch-python_mozbuild_mozbuild_rust_commands_py 31 Oct 2026 07:32:23 -0000 1.1.2.1 +++ patches/patch-python_mozbuild_mozbuild_rust_commands_py 10 Nov 2026 23:20:39 -0000 @@ -5,7 +5,7 @@ https://bugzilla.mozilla.org/show_bug.cg Index: python/mozbuild/mozbuild/rust_commands.py --- python/mozbuild/mozbuild/rust_commands.py.orig +++ python/mozbuild/mozbuild/rust_commands.py -@@ -418,7 +418,7 @@ def _rustc_flags(cmd, substs, invocation): +@@ -434,7 +434,7 @@ def _rustc_flags(cmd, substs, invocation): flags += substs.get("MOZ_RUST_LIBRARY_RUSTCFLAGS") if applies_library_lto(cmd.kind, cmd.lto, substs): Index: patches/patch-security_certverifier_NSSCertDBTrustDomain_cpp =================================================================== RCS file: patches/patch-security_certverifier_NSSCertDBTrustDomain_cpp diff -N patches/patch-security_certverifier_NSSCertDBTrustDomain_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-security_certverifier_NSSCertDBTrustDomain_cpp 10 Nov 2026 23:20:40 -0000 @@ -0,0 +1,157 @@ +revert part of https://github.com/mozilla-firefox/firefox/commit/272a98f89f78d1c9949c0370a0f5c6f87778578f to fix build with nss 3.130 + +Index: security/certverifier/NSSCertDBTrustDomain.cpp +--- security/certverifier/NSSCertDBTrustDomain.cpp.orig ++++ security/certverifier/NSSCertDBTrustDomain.cpp +@@ -429,51 +429,6 @@ void HashTrustParams(EndEntityOrCA endEntityOrCA, cons + sha512Hash.emplace(std::move(result)); + } + +-void GetCertTrustFromNSS(EndEntityOrCA endEntityOrCA, +- const CertPolicyId& policy, SECTrustType trustType, +- Input cert, /*out*/ TrustLevel& trustLevel) { +- trustLevel = TrustLevel::InheritsTrust; +- +- // NB: CERT_GetDERCertTrust returns SECFailure if no trust records were +- // found, in which case the assumption is that the certificate inherits its +- // trust. +- SECItem certItem = UnsafeMapInputToSECItem(cert); +- CERTCertTrust trust = {0, 0, 0}; +- if (CERT_GetDERCertTrust(&certItem, &trust) != SECSuccess) { +- return; +- } +- +- uint32_t flags = SEC_GET_TRUST_FLAGS(&trust, trustType); +- +- // For DISTRUST, we use the CERTDB_TRUSTED or CERTDB_TRUSTED_CA bit, +- // because we can have active distrust for either type of cert. Note +- // that CERTDB_TERMINAL_RECORD means "stop trying to inherit trust" so +- // if the relevant trust bit isn't set then that means the cert must +- // be considered distrusted. +- uint32_t relevantTrustBit = endEntityOrCA == EndEntityOrCA::MustBeCA +- ? CERTDB_TRUSTED_CA +- : CERTDB_TRUSTED; +- if (((flags & (relevantTrustBit | CERTDB_TERMINAL_RECORD))) == +- CERTDB_TERMINAL_RECORD) { +- trustLevel = TrustLevel::ActivelyDistrusted; +- return; +- } +- +- // For TRUST, we use the CERTDB_TRUSTED_CA bit. +- if (flags & CERTDB_TRUSTED_CA) { +- if (policy.IsAnyPolicy()) { +- trustLevel = TrustLevel::TrustAnchor; +- return; +- } +- +- nsTArray<uint8_t> certBytes(cert.UnsafeGetData(), cert.GetLength()); +- if (CertIsAuthoritativeForEVPolicy(certBytes, policy)) { +- trustLevel = TrustLevel::TrustAnchor; +- return; +- } +- } +-} +- + Result NSSCertDBTrustDomain::GetCertTrust(EndEntityOrCA endEntityOrCA, + const CertPolicyId& policy, + Input candidateCertDER, +@@ -544,14 +499,95 @@ Result NSSCertDBTrustDomain::GetCertTrust(EndEntityOrC + return Success; + } + +- GetCertTrustFromNSS(endEntityOrCA, policy, mCertDBTrustType, candidateCertDER, +- trustLevel); ++ // Synchronously dispatch a task to the socket thread to construct a ++ // CERTCertificate and get its trust from NSS. This involves querying NSS ++ // structures and databases, so it should be done on the socket thread. ++ Result result = Result::FATAL_ERROR_LIBRARY_FAILURE; ++ RefPtr<Runnable> getTrustTask = ++ NS_NewRunnableFunction("NSSCertDBTrustDomain::GetCertTrust", [&]() { ++ if (AppShutdown::IsInOrBeyond(ShutdownPhase::AppShutdownConfirmed)) { ++ result = Result::FATAL_ERROR_LIBRARY_FAILURE; ++ return; ++ } ++ // This would be cleaner and more efficient if we could get the trust ++ // information without constructing a CERTCertificate here, but NSS ++ // doesn't expose it in any other easy-to-use fashion. The use of ++ // CERT_NewTempCertificate to get a CERTCertificate shouldn't be a ++ // performance problem for certificates already known to NSS because NSS ++ // will just find the existing CERTCertificate in its in-memory cache ++ // and return it. For certificates not already in NSS (namely ++ // third-party roots and intermediates), we want to avoid calling ++ // CERT_NewTempCertificate repeatedly, so we've already checked if the ++ // candidate certificate is a third-party certificate, above. ++ SECItem candidateCertDERSECItem = ++ UnsafeMapInputToSECItem(candidateCertDER); + +- if (sha512Hash.isSome()) { ++ UniqueCERTCertificate candidateCert(CERT_NewTempCertificate( ++ CERT_GetDefaultCertDB(), &candidateCertDERSECItem, nullptr, false, ++ true)); ++ if (!candidateCert) { ++ result = MapPRErrorCodeToResult(PR_GetError()); ++ return; ++ } ++ // NB: CERT_GetCertTrust seems to be abusing SECStatus as a boolean, ++ // where SECSuccess means that there is a trust record and SECFailure ++ // means there is not a trust record. I looked at NSS's internal uses of ++ // CERT_GetCertTrust, and all that code uses the result as a boolean ++ // meaning "We have a trust record." ++ ++ CERTCertTrust trust; ++ if (CERT_GetCertTrust(candidateCert.get(), &trust) == SECSuccess) { ++ uint32_t flags = SEC_GET_TRUST_FLAGS(&trust, mCertDBTrustType); ++ ++ // For DISTRUST, we use the CERTDB_TRUSTED or CERTDB_TRUSTED_CA bit, ++ // because we can have active distrust for either type of cert. Note ++ // that CERTDB_TERMINAL_RECORD means "stop trying to inherit trust" so ++ // if the relevant trust bit isn't set then that means the cert must ++ // be considered distrusted. ++ uint32_t relevantTrustBit = endEntityOrCA == EndEntityOrCA::MustBeCA ++ ? CERTDB_TRUSTED_CA ++ : CERTDB_TRUSTED; ++ if (((flags & (relevantTrustBit | CERTDB_TERMINAL_RECORD))) == ++ CERTDB_TERMINAL_RECORD) { ++ trustLevel = TrustLevel::ActivelyDistrusted; ++ result = Success; ++ return; ++ } ++ ++ // For TRUST, we use the CERTDB_TRUSTED_CA bit. ++ if (flags & CERTDB_TRUSTED_CA) { ++ if (policy.IsAnyPolicy()) { ++ trustLevel = TrustLevel::TrustAnchor; ++ result = Success; ++ return; ++ } ++ ++ nsTArray<uint8_t> certBytes(candidateCert->derCert.data, ++ candidateCert->derCert.len); ++ if (CertIsAuthoritativeForEVPolicy(certBytes, policy)) { ++ trustLevel = TrustLevel::TrustAnchor; ++ result = Success; ++ return; ++ } ++ } ++ } ++ trustLevel = TrustLevel::InheritsTrust; ++ result = Success; ++ }); ++ nsCOMPtr<nsIEventTarget> socketThread( ++ do_GetService(NS_SOCKETTRANSPORTSERVICE_CONTRACTID)); ++ if (!socketThread) { ++ return Result::FATAL_ERROR_LIBRARY_FAILURE; ++ } ++ nsresult rv = SyncRunnable::DispatchToThread(socketThread, getTrustTask); ++ if (NS_FAILED(rv)) { ++ return Result::FATAL_ERROR_LIBRARY_FAILURE; ++ } ++ if (result == Success && sha512Hash.isSome()) { + uint8_t trust = static_cast<uint8_t>(trustLevel); + trust_cache_insert(mTrustCache, sha512Hash.ref().Elements(), trust); + } +- return Success; ++ return result; + } + + Result NSSCertDBTrustDomain::DigestBuf(Input item, DigestAlgorithm digestAlg, Index: patches/patch-security_manager_ssl_nsNSSCertificateDB_cpp =================================================================== RCS file: patches/patch-security_manager_ssl_nsNSSCertificateDB_cpp diff -N patches/patch-security_manager_ssl_nsNSSCertificateDB_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-security_manager_ssl_nsNSSCertificateDB_cpp 10 Nov 2026 23:20:40 -0000 @@ -0,0 +1,158 @@ +revert part of https://github.com/mozilla-firefox/firefox/commit/272a98f89f78d1c9949c0370a0f5c6f87778578f to fix build with nss 3.130 + +Index: security/manager/ssl/nsNSSCertificateDB.cpp +--- security/manager/ssl/nsNSSCertificateDB.cpp.orig ++++ security/manager/ssl/nsNSSCertificateDB.cpp +@@ -217,34 +217,28 @@ nsresult nsNSSCertificateDB::getCertsFromPackage( + // When using the sql-backed softoken, trust settings are authenticated using a + // key in the secret database. Thus, if the user has a password, we need to + // authenticate to the token in order to be able to change trust settings. +-nsresult ChangeCertTrustWithPossibleAuthentication( ++SECStatus ChangeCertTrustWithPossibleAuthentication( + const UniqueCERTCertificate& cert, CERTCertTrust& trust, void* ctx) { + MOZ_ASSERT(cert, "cert must be non-null"); + if (!cert) { +- return NS_ERROR_INVALID_ARG; ++ PR_SetError(SEC_ERROR_LIBRARY_FAILURE, 0); ++ return SECFailure; + } + +- PRBool isTemp = PR_FALSE; +- // This only fails if `cert` is null, which was checked above. +- (void)CERT_GetCertIsTemp(cert.get(), &isTemp); +- // Gecko does not support altering the trust of temporary certificates. +- if (isTemp) { +- return NS_ERROR_INVALID_ARG; +- } +- + RefPtr<SharedCertVerifier> certVerifier(GetDefaultCertVerifier()); + if (!certVerifier) { +- return NS_ERROR_FAILURE; ++ PR_SetError(SEC_ERROR_LIBRARY_FAILURE, 0); ++ return SECFailure; + } + + // NSS ignores the first argument to CERT_ChangeCertTrust + SECStatus srv = CERT_ChangeCertTrust(nullptr, cert.get(), &trust); + if (srv != SECSuccess && PR_GetError() != SEC_ERROR_TOKEN_NOT_LOGGED_IN) { +- return MapSECStatus(srv); ++ return SECFailure; + } + if (srv == SECSuccess) { + certVerifier->ClearTrustCache(); +- return NS_OK; ++ return SECSuccess; + } + + // CERT_ChangeCertTrust failed with SEC_ERROR_TOKEN_NOT_LOGGED_IN, so +@@ -259,15 +253,15 @@ nsresult ChangeCertTrustWithPossibleAuthentication( + srv = PK11_Authenticate(internalSlot.get(), PR_TRUE, ctx); + } + if (srv != SECSuccess) { +- return MapSECStatus(srv); ++ return srv; + } + srv = CERT_ChangeCertTrust(nullptr, cert.get(), &trust); + if (srv != SECSuccess) { +- return MapSECStatus(srv); ++ return srv; + } + + certVerifier->ClearTrustCache(); +- return NS_OK; ++ return SECSuccess; + } + + static nsresult ImportCertsIntoPermanentStorage( +@@ -410,10 +404,10 @@ nsresult nsNSSCertificateDB::handleCACertDownload(NotN + if (srv != SECSuccess) { + return MapSECStatus(srv); + } +- rv = ++ srv = + ChangeCertTrustWithPossibleAuthentication(tmpCert, trust.GetTrust(), ctx); +- if (NS_FAILED(rv)) { +- return rv; ++ if (srv != SECSuccess) { ++ return MapSECStatus(srv); + } + + // Import additional delivered certificates that can be verified. +@@ -704,13 +698,13 @@ nsNSSCertificateDB::DeleteCertificate(nsIX509Cert* aCe + // For certificates that can't be deleted (e.g. built-in roots), un-set + // all trust bits. + nsNSSCertTrust trust(0, 0); +- rv = ChangeCertTrustWithPossibleAuthentication(cert, trust.GetTrust(), +- nullptr); +- if (NS_FAILED(rv)) { +- return rv; ++ SECStatus srv = ChangeCertTrustWithPossibleAuthentication( ++ cert, trust.GetTrust(), nullptr); ++ if (srv != SECSuccess) { ++ return NS_ERROR_FAILURE; + } + if (!PK11_IsReadOnly(cert->slot)) { +- SECStatus srv = SEC_DeletePermCertificate(cert.get()); ++ srv = SEC_DeletePermCertificate(cert.get()); + if (srv != SECSuccess) { + return NS_ERROR_FAILURE; + } +@@ -753,8 +747,9 @@ nsNSSCertificateDB::SetCertTrust(nsIX509Cert* cert, ui + } + + UniqueCERTCertificate nsscert(cert->GetCert()); +- return ChangeCertTrustWithPossibleAuthentication(nsscert, trust.GetTrust(), +- nullptr); ++ SECStatus srv = ChangeCertTrustWithPossibleAuthentication( ++ nsscert, trust.GetTrust(), nullptr); ++ return MapSECStatus(srv); + } + + NS_IMETHODIMP +@@ -768,17 +763,12 @@ nsNSSCertificateDB::IsCertTrusted(nsIX509Cert* cert, u + return rv; + } + +- nsTArray<uint8_t> certDER; +- rv = cert->GetRawDER(certDER); +- if (NS_FAILED(rv)) { +- return rv; +- } +- SECItem certItem = {siBuffer, certDER.Elements(), +- static_cast<unsigned int>(certDER.Length())}; ++ SECStatus srv; ++ UniqueCERTCertificate nsscert(cert->GetCert()); + CERTCertTrust nsstrust; +- SECStatus srv = CERT_GetDERCertTrust(&certItem, &nsstrust); ++ srv = CERT_GetCertTrust(nsscert.get(), &nsstrust); + if (srv != SECSuccess) { +- // CERT_GetDERCertTrust returns SECFailure if given a temporary cert that ++ // CERT_GetCertTrust returns SECFailure if given a temporary cert that + // doesn't have any trust information yet. This isn't an error. + return NS_OK; + } +@@ -1126,10 +1116,10 @@ nsNSSCertificateDB::AddCert(const nsACString& aCertDER + if (srv != SECSuccess) { + return MapSECStatus(srv); + } +- rv = ChangeCertTrustWithPossibleAuthentication(tmpCert, trust.GetTrust(), +- nullptr); +- if (NS_FAILED(rv)) { +- return rv; ++ srv = ChangeCertTrustWithPossibleAuthentication(tmpCert, trust.GetTrust(), ++ nullptr); ++ if (srv != SECSuccess) { ++ return MapSECStatus(srv); + } + newCert.forget(addedCertificate); + return NS_OK; +@@ -1148,7 +1138,8 @@ nsNSSCertificateDB::SetCertTrustFromString(nsIX509Cert + } + UniqueCERTCertificate nssCert(cert->GetCert()); + +- return ChangeCertTrustWithPossibleAuthentication(nssCert, trust, nullptr); ++ srv = ChangeCertTrustWithPossibleAuthentication(nssCert, trust, nullptr); ++ return MapSECStatus(srv); + } + + NS_IMETHODIMP nsNSSCertificateDB::AsPKCS7Blob( Index: patches/patch-security_manager_ssl_nsNSSCertificateDB_h =================================================================== RCS file: patches/patch-security_manager_ssl_nsNSSCertificateDB_h diff -N patches/patch-security_manager_ssl_nsNSSCertificateDB_h --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-security_manager_ssl_nsNSSCertificateDB_h 10 Nov 2026 23:20:40 -0000 @@ -0,0 +1,14 @@ +revert part of https://github.com/mozilla-firefox/firefox/commit/272a98f89f78d1c9949c0370a0f5c6f87778578f to fix build with nss 3.130 + +Index: security/manager/ssl/nsNSSCertificateDB.h +--- security/manager/ssl/nsNSSCertificateDB.h.orig ++++ security/manager/ssl/nsNSSCertificateDB.h +@@ -64,4 +64,8 @@ class nsNSSCertificateDB final : public nsIX509CertDB + 0x4783, \ + {0xb3, 0x2c, 0x80, 0x12, 0x46, 0x93, 0xd8, 0x71}} + ++SECStatus ChangeCertTrustWithPossibleAuthentication( ++ const mozilla::UniqueCERTCertificate& cert, CERTCertTrust& trust, ++ void* ctx); ++ +