Hi again, Thanks for picking up the slack on these ports, where I dropped off. I tested on amd64 for a few hours of use and briefly on macppc as well. Things seem to be working quite nicely. My old emwm{,-utils} config(s) carried over nicely. Also, following the pkg-readme's recommendation to cross-reference the system config, I was able to integrate the new workspace paging features into my config easily. Here's some other stuff I ran after compiling and `make update`'ing the ports: /usr/ports/x11/emwm git:(master*) $ make port-lib-depends-check /usr/ports/x11/emwm git:(master*) $ portcheck x11/emwm /usr/ports/x11/emwm git:(master*) $ cd ../emwm-utils /usr/ports/x11/emwm-utils git:(master*) $ make port-lib-depends-check /usr/ports/x11/emwm-utils git:(master*) $ portcheck x11/emwm-utils Good work! It is deeply appreciated. I really hope these get imported, you did an excellent job. Appreciated, On Fri, 28 Aug 2026 00:59:00 +0000 David Uhden Collado <daviduhden@gmail.com> wrote: > izzy Meyer wrote: > > Hi, > > > > I used to maintain these packages. Does the 2.0 version of > > emwm-utils fix needing SUID root for lock/unlock & > > suspend/reboot/poweroff functionality? I dropped maintainership due > > to the development burden of maintaining patches that I couldn't > > upstream that made it use bsd-auth instead as the ports tree > > strips SUID root by default. > > > > If this update does not fix it, please consider updating my patches > > to work in those areas again, as this would be beneficial to users > > of this port. > > > > Thanks. > > > > Hi iz, > > Thanks for pointing this out. > > I checked the 2.0 sources more closely, and upstream still expects > xmsm to be setuid root for screen authentication and for privileged > system operations. So no, upstream 2.0 does not solve this by itself. > > My first revision of the update did not correctly carry forward all of > the existing OpenBSD-specific privilege and BSD Authentication work. > I've fixed that in the new patches attached to this mail. > > The updated emwm-utils patch now refreshes the existing BSD > Authentication support for the 2.0 source. On OpenBSD, screen > unlocking uses auth_userokay(3) with the auth-xmsm authentication > style rather than reading password hashes through getpwnam_shadow(3) > and crypt(3). > > As a result, xmsm does not need to be setuid root. It remains > installed setgid auth, as in the existing OpenBSD port, which gives > BSD Authentication the access it requires without giving the whole > session manager root privileges. > > I also restored the unprivileged shutdown model. emwm-utils is built > with UNPRIVILEGED_SHUTDOWN, so shutdown/reboot/suspend commands > execute with the invoking user's privileges rather than temporarily > regaining root privileges. The OpenBSD patch uses shutdown(8), > matching the _shutdown group authorization mechanism. For suspend, > the existing OpenBSD setup using zzz(8), apmd(8), and wheel > membership is retained and documented in pkg-readme. > > I also patched the upstream install rule and xmsm(1) documentation so > they no longer describe or install xmsm as setuid root on OpenBSD. The > manual page now documents the BSD Authentication/setgid-auth model and > the fact that system commands run with the user's privileges. > > There were a few related cleanup changes as well. The OpenBSD makefile > now preserves the ports framework CFLAGS instead of replacing them, > and -lcrypt is disabled because crypt(3) is part of libc on OpenBSD > and the OpenBSD authentication path no longer uses it directly. > > The second revision also includes some additional material distributed > by the EMWM project: tellmwm for runtime workspace control, the > application icon set, the core-hr Xcursor theme, alternative Motif > dialog icons, and example X resources and GTK 2/3 configuration. These > are installed as data/examples rather than modifying user > configuration automatically. > > For the emwm port itself, I made a smaller follow-up adjustment. I > added a pkg-readme explaining that users upgrading from EMWM 1.x may > need to update an existing ~/.emwmrc to get the workspace menu and > key bindings restored in EMWM 2.x. I also cleaned up the OpenBSD > build patch so it preserves the compiler flags supplied by the ports > infrastructure. > > So the new revision should preserve the important security properties > of your previous OpenBSD patches while adapting them to the current > 2.0 codebase. > > Thanks for bringing this up; it caught an important omission in my > first version of the update. > > Best regards, > David. -- iz (she/her) > I say mundane things > so the uninteresting > just might get noticed. izder456 (dot) neocities (dot) org
Thursday, September 17, 2026
Re: NEW: security/cosign
On Thu Aug 20, 2026 at 02:12:01AM +0000, Lucas Raab wrote: > On Tue, Aug 04, 2026 at 05:15:14PM +0200, Rafael Sadowski wrote: > > On Tue Aug 04, 2026 at 05:04:46PM +0200, Rafael Sadowski wrote: > > > OK to import cosign-3.1.2? > > > > > > Comment: > > > sigstore signing tool > > > > > > Description: > > > Signing OCI containers (and other artifacts) using Sigstore. > > > > > > Cosign supports: > > > > > > - "Keyless signing" with the Sigstore public good Fulcio certificate authority > > > and Rekor transparency log (default) > > > - Hardware and KMS signing > > > - Signing with a cosign generated encrypted private/public keypair > > > - Container Signing, Verification and Storage in an OCI registry > > > - Bring-your-own PKI > > > > > > Maintainer: Rafael Sadowski <rsadowski@openbsd.org> > > > > > > WWW: https://www.sigstore.dev/ > > > > > > > > > > Now with attachment, submitting new ports does involve this extra task ;) > > Warning: cosign-3.1.2 conflicts with xmlrpc-epi-0.54.1p1 (net/xmlrpc-epi):/usr/local/bin/sample > > Drop bin/sample if it's only intended to be a test file? > OK with bin/cosign only and the others comment out?