David Uhden Collado wrote: > David Uhden Collado wrote: >> Hello, >> >> Please find attached a patch that updates security/veracrypt from >> version 1.25.9 to 1.26.29. >> >> The upstream release notes and full comparison are available at: >> >> https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29 >> https://github.com/veracrypt/VeraCrypt/compare/ >> VeraCrypt_1.25.9...VeraCrypt_1.26.29 >> >> The 1.26 series contains a substantial number of security, portability >> and cryptographic improvements. Version 1.26.29 adds Argon2id as an >> alternative memory-hard KDF for non-system volumes, hardens the XML and >> TLV parsers against malformed input, and includes several fixes for CPU >> feature detection and optimized cryptographic implementations. >> >> The releases since 1.25.9 also add hardware acceleration improvements >> for SHA-256 and AES on supported x86 and ARM64 systems, update >> translations and documentation, and replace the old "dismount" >> terminology with "unmount". >> >> For the OpenBSD port, this update also contains several platform- >> specific improvements. >> >> VeraCrypt no longer depends on security/sudo on OpenBSD. I added >> OpenBSD-specific privilege elevation support using the base system >> doas(1). Since doas reads authentication input from its controlling >> terminal rather than stdin, VeraCrypt creates a private pseudoterminal >> and forwards the password entered through its user interface to doas >> without placing it on the command line or in the environment. >> >> A pkg-readme documents the required doas.conf rule and explains the >> privileged operations performed by VeraCrypt, including vnd(4) setup, >> filesystem mounting and formatting. >> >> I also added native OpenBSD FFS support when creating volumes. FFS can >> now be selected from the graphical and text interfaces or explicitly >> with: >> >> --filesystem=FFS >> >> VeraCrypt invokes /sbin/newfs on the raw rvnd(4) character device when >> formatting the new filesystem. Non-interactive volume creation keeps FAT >> as the default so existing scripts do not unexpectedly require >> privilege elevation. >> >> The port also gains security/pcsc-lite support required by the current >> upstream smart-card code. >> >> There are two small build portability patches related to upstream's >> reproducible-build support. One makes the source_date_epoch.sh awk code >> compatible with OpenBSD awk, and another corrects an upstream release >> date mismatch so the generated SOURCE_DATE_EPOCH can be calculated >> properly. >> >> The existing Makefile patch has been refreshed for the current build >> system and Argon2 sources while continuing to preserve the compiler and >> linker flags supplied by the ports infrastructure. >> >> The old OpenBSD vndconfig "-c" patch has been removed because that >> change is already present upstream. >> >> Finally, the desktop file has been refreshed for the current upstream >> version, the icon has changed from XPM to PNG, pkg/PLIST has been >> updated, and distinfo has been regenerated for the 1.26.29 source >> archive. >> >> Thank you for your time and consideration. >> >> Best regards, >> David. > > Hello, > > sysutils/coreutils is not a runtime dependency of VeraCrypt. > > I checked the code paths used at runtime, and they only invoke tools > provided either by the base system or by explicit ports dependencies. > On OpenBSD these include /sbin/vndconfig for attaching and detaching vnd > devices, /sbin/newfs for FFS, mount, umount, fsck and doas. The actual > RUN_DEPENDS are therefore: > > devel/desktop-file-utils > security/pcsc-lite > > There is no GNU utility used at runtime. > > sysutils/coreutils was historically present in BUILD_DEPENDS because > VeraCrypt 1.25.9 had this in src/Build/Include/Makefile.inc: > > ifeq "$(PLATFORM)" "OpenBSD" > OD_BIN := ggod -v -t u1 -A n > else > OD_BIN := od -v -t u1 -A n > endif > > "ggod" is the GNU od installed by sysutils/coreutils on OpenBSD. The > port builds coreutils with a "g" prefix and additionally renames god to > ggod to avoid a name conflict. > > OD_BIN is only used while building embedded resources such as the > generated *.xml.h, *.txt.h and *.bmp.h files, so coreutils was a build > dependency rather than a runtime dependency. > > This is no longer necessary with VeraCrypt 1.26.29. The current > src/Build/Include/Makefile.inc uses: > > ifeq "$(PLATFORM)" "OpenBSD" > OD_BIN := hexdump -v -e '1/1 "%u "' > else > OD_BIN := od -v -t u1 -A n > endif > > hexdump is part of the OpenBSD base system, so sysutils/coreutils is now > just a leftover dependency from the older port. > > There are some other GNU-specific commands in upstream build/install > rules, such as: > > touch --no-dereference --date=@... > tar --sort=... --mtime=@... > readlink -f > > but the OpenBSD port uses an empty ALL_TARGET and its own do-install > target, so the install/package paths containing those commands are not > executed. The relevant upstream checks are also probes which fall back > when those features are unavailable. > > I've therefore removed sysutils/coreutils from BUILD_DEPENDS in the > revised patch. > > Thanks, > David. ping
Index: security/veracrypt/Makefile
===================================================================
RCS file: /cvs/ports/security/veracrypt/Makefile,v
diff -u -p -u -p -r1.8 Makefile
--- security/veracrypt/Makefile 17 Dec 2024 05:49:59 -0000 1.8
+++ security/veracrypt/Makefile 28 Sep 2026 16:24:49 -0000
@@ -2,12 +2,11 @@ BROKEN-sparc64= relocation truncated to
COMMENT= free open source disk encryption software
-V= 1.25.9
+V= 1.26.29
DISTNAME= VeraCrypt_${V}_Source
PKGNAME= veracrypt-${V}
CATEGORIES= security
HOMEPAGE= https://www.veracrypt.fr/
-REVISION= 1
MAINTAINER= Tietoturvamies <main@tietoturvamies.fi>
@@ -18,7 +17,7 @@ SITES= https://launchpad.net/veracrypt
EXTRACT_SUFX= .tar.bz2
FIX_EXTRACT_PERMISSIONS=Yes
-# C++11
+# C++14
COMPILER= base-clang ports-gcc
CXXFLAGS_base-clang = -std=c++14
@@ -26,12 +25,12 @@ CXXFLAGS_base-clang = -std=c++14
WANTLIB += ${COMPILER_LIBCXX} c m fuse wx_baseu-3.2 wx_gtk3u_core-3.2
BUILD_DEPENDS= devel/yasm \
- sysutils/coreutils
+ security/pcsc-lite
LIB_DEPENDS= x11/wxWidgets
RUN_DEPENDS= devel/desktop-file-utils \
- security/sudo
+ security/pcsc-lite
WRKDIST= ${WRKDIR}/src
USE_GMAKE= Yes
@@ -58,7 +57,7 @@ do-install:
${INSTALL_DATA} ${WRKSRC}/Setup/FreeBSD/veracrypt.desktop \
${PREFIX}/share/applications
${INSTALL_DATA_DIR} ${PREFIX}/share/pixmaps/
- ${INSTALL_DATA} ${WRKSRC}/Resources/Icons/VeraCrypt-48x48.xpm \
- ${PREFIX}/share/pixmaps/veracrypt.xpm
+ ${INSTALL_DATA} ${WRKSRC}/Resources/Icons/VeraCrypt-48x48.png \
+ ${PREFIX}/share/pixmaps/veracrypt.png
.include <bsd.port.mk>
Index: security/veracrypt/distinfo
===================================================================
RCS file: /cvs/ports/security/veracrypt/distinfo,v
diff -u -p -u -p -r1.2 distinfo
--- security/veracrypt/distinfo 14 Mar 2022 11:07:46 -0000 1.2
+++ security/veracrypt/distinfo 28 Sep 2026 16:24:49 -0000
@@ -1,2 +1,2 @@
-SHA256 (VeraCrypt_1.25.9_Source.tar.bz2) = drbhgYS8IaQdKUn/Y9ch1JBUpxbO/zpL13tcNRC3lK8=
-SIZE (VeraCrypt_1.25.9_Source.tar.bz2) = 24438846
+SHA256 (VeraCrypt_1.26.29_Source.tar.bz2) = YIJnMeKYK0vSMeOTDoWkQ5EWljhnGhsgDFGPjItGyyo=
+SIZE (VeraCrypt_1.26.29_Source.tar.bz2) = 36302144
Index: security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh
===================================================================
RCS file: security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh
diff -N security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,20 @@
+Continue the month_number ternary expression explicitly: OpenBSD's awk
+does not accept a bare newline after ':' as a line continuation, so the
+release date could not be derived from Common/Tcdefs.h.
+
+Index: Build/Tools/source_date_epoch.sh
+--- Build/Tools/source_date_epoch.sh.orig
++++ Build/Tools/source_date_epoch.sh
+@@ -60,9 +60,9 @@
+ RELEASE_EPOCH=$(awk '
+ function leap(y) { return ((y % 4 == 0 && y % 100 != 0) || (y % 400 == 0)) }
+ function month_number(name) {
+- return (name == "January" ? 1 : name == "February" ? 2 : name == "March" ? 3 :
+- name == "April" ? 4 : name == "May" ? 5 : name == "June" ? 6 :
+- name == "July" ? 7 : name == "August" ? 8 : name == "September" ? 9 :
++ return (name == "January" ? 1 : name == "February" ? 2 : name == "March" ? 3 : \
++ name == "April" ? 4 : name == "May" ? 5 : name == "June" ? 6 : \
++ name == "July" ? 7 : name == "August" ? 8 : name == "September" ? 9 : \
+ name == "October" ? 10 : name == "November" ? 11 : name == "December" ? 12 : 0);
+ }
+ function mdays(m, y) { return (m == 2 ? 28 + leap(y) : (m == 4 || m == 6 || m == 9 || m == 11 ? 30 : 31)) }
Index: security/veracrypt/patches/patch-Common_Tcdefs_h
===================================================================
RCS file: security/veracrypt/patches/patch-Common_Tcdefs_h
diff -N security/veracrypt/patches/patch-Common_Tcdefs_h
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Common_Tcdefs_h 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,16 @@
+Set TC_STR_RELEASE_DATE to June 9, 2026, matching TC_RELEASE_DATE_DAY
+and the upstream "Set release date to June 9th 2026" commit. The awk
+helper in Build/Tools/source_date_epoch.sh requires both dates to agree.
+
+Index: Common/Tcdefs.h
+--- Common/Tcdefs.h.orig
++++ Common/Tcdefs.h
+@@ -73,7 +73,7 @@
+ #define VERSION_NUM 0x0126
+
+ // Release date
+-#define TC_STR_RELEASE_DATE L"June 8, 2026"
++#define TC_STR_RELEASE_DATE L"June 9, 2026"
+ #define TC_RELEASE_DATE_YEAR 2026
+ #define TC_RELEASE_DATE_MONTH 6
+ #define TC_RELEASE_DATE_DAY 9
Index: security/veracrypt/patches/patch-Core_Unix_CoreService_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Core_Unix_CoreService_cpp
diff -N security/veracrypt/patches/patch-Core_Unix_CoreService_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Core_Unix_CoreService_cpp 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,234 @@
+Index: Core/Unix/CoreService.cpp
+--- Core/Unix/CoreService.cpp.orig
++++ Core/Unix/CoreService.cpp
+@@ -14,6 +14,14 @@
+ #include <fcntl.h>
+ #include <sys/wait.h>
+ #include <stdio.h>
++#ifdef TC_OPENBSD
++#include <errno.h>
++#include <stdlib.h>
++#include <string.h>
++#include <sys/ioctl.h>
++#include <termios.h>
++#include <unistd.h>
++#endif
+ #include "Platform/FileStream.h"
+ #include "Platform/MemoryStream.h"
+ #include "Platform/Serializable.h"
+@@ -28,6 +36,24 @@
+
+ namespace VeraCrypt
+ {
++#ifdef TC_OPENBSD
++ // doas(1) reads the password from its controlling terminal. A private
++ // pseudoterminal is used for that, so the elevated process does not need
++ // a terminal of its own and the password entered in the user interface
++ // can be forwarded without exposing it on the command line or in the
++ // environment.
++ static int DoasAuthTerminalFd = -1;
++
++ static void CloseDoasAuthTerminal ()
++ {
++ if (DoasAuthTerminalFd != -1)
++ {
++ close (DoasAuthTerminalFd);
++ DoasAuthTerminalFd = -1;
++ }
++ }
++#endif
++
+ #ifdef TC_MACOSX
+ static bool IsMacOSXDevicePathWithPrefix (const string &path, const string &prefix)
+ {
+@@ -149,6 +175,10 @@
+
+ void CoreService::ProcessRequests (int inputFD, int outputFD)
+ {
++#ifdef TC_OPENBSD
++ finally_do ({ CloseDoasAuthTerminal (); });
++#endif
++
+ try
+ {
+ Core = move_ptr(CoreDirect);
+@@ -415,7 +445,11 @@
+ // This approach also works on newer macOS versions (12.0 and later).
+ std::string errorMsg;
+
++#ifdef TC_OPENBSD
++ string sudoAbsolutePath = Process::FindSystemBinary("doas", errorMsg);
++#else
+ string sudoAbsolutePath = Process::FindSystemBinary("sudo", errorMsg);
++#endif
+ if (sudoAbsolutePath.empty())
+ throw SystemException(SRC_POS, errorMsg);
+
+@@ -507,6 +541,36 @@
+
+ void CoreService::StartElevated (const CoreServiceRequest &request)
+ {
++#ifdef TC_OPENBSD
++ CloseDoasAuthTerminal();
++
++ int authTerminalFd = -1;
++ string authTerminalPath;
++ bool authTerminalKept = false;
++
++ finally_do_arg2 (int *, &authTerminalFd, bool *, &authTerminalKept,
++ {
++ if (!*finally_arg2 && *finally_arg != -1)
++ {
++ close (*finally_arg);
++ *finally_arg = -1;
++ }
++ });
++
++ if (!request.FastElevation)
++ {
++ authTerminalFd = posix_openpt (O_RDWR | O_NOCTTY);
++ throw_sys_sub_if (authTerminalFd == -1, "posix_openpt");
++ throw_sys_if (fcntl (authTerminalFd, F_SETFD, FD_CLOEXEC) == -1);
++ throw_sys_if (grantpt (authTerminalFd) == -1);
++ throw_sys_if (unlockpt (authTerminalFd) == -1);
++
++ char *slavePath = ptsname (authTerminalFd);
++ throw_sys_sub_if (slavePath == nullptr, "ptsname");
++ authTerminalPath = slavePath;
++ }
++#endif
++
+ unique_ptr <Pipe> inPipe (new Pipe());
+ unique_ptr <Pipe> outPipe (new Pipe());
+ Pipe errPipe;
+@@ -522,7 +586,11 @@
+ {
+ // Throw exception if sudo is not found in secure locations
+ std::string errorMsg;
++#ifdef TC_OPENBSD
++ string sudoPath = Process::FindSystemBinary("doas", errorMsg);
++#else
+ string sudoPath = Process::FindSystemBinary("sudo", errorMsg);
++#endif
+ if (sudoPath.empty())
+ throw SystemException(SRC_POS, errorMsg);
+
+@@ -551,7 +619,51 @@
+ throw_sys_if (dup2 (outPipe->GetWriteFD(), STDOUT_FILENO) == -1);
+ throw_sys_if (dup2 (errPipe.GetWriteFD(), STDERR_FILENO) == -1);
+
++#ifdef TC_OPENBSD
++ const char *args[8];
++
++ if (!authTerminalPath.empty())
++ {
++ throw_sys_if (setsid () == -1);
++
++ int authFd = open (authTerminalPath.c_str(), O_RDWR);
++ throw_sys_sub_if (authFd == -1, authTerminalPath);
++
++ // Keep the admin password out of the terminal echo.
++ struct termios tios;
++ if (tcgetattr (authFd, &tios) == 0)
++ {
++ tios.c_lflag &= ~(ICANON | ECHO | ECHOE | ECHOK | ECHONL | ISIG | IEXTEN);
++ tios.c_iflag &= ~(BRKINT | ISTRIP | INLCR | IGNCR | ICRNL | IXON);
++ tios.c_cc[VMIN] = 1;
++ tios.c_cc[VTIME] = 0;
++ tcsetattr (authFd, TCSANOW, &tios);
++ }
++
++ if (ioctl (authFd, TIOCSCTTY, 0) == -1 && errno != EINVAL)
++ {
++ close (authFd);
++ throw SystemException (SRC_POS, "TIOCSCTTY");
++ }
++
++ close (authFd);
++
++ args[0] = sudoPath.c_str();
++ args[1] = appPath.c_str();
++ args[2] = TC_CORE_SERVICE_CMDLINE_OPTION;
++ args[3] = nullptr;
++ }
++ else
++ {
++ args[0] = sudoPath.c_str();
++ args[1] = "-n";
++ args[2] = appPath.c_str();
++ args[3] = TC_CORE_SERVICE_CMDLINE_OPTION;
++ args[4] = nullptr;
++ }
++#else
+ const char *args[] = { sudoPath.c_str(), "-S", "-p", "", appPath.c_str(), TC_CORE_SERVICE_CMDLINE_OPTION, nullptr };
++#endif
+ execvp (args[0], ((char* const*) args));
+ throw SystemException (SRC_POS, args[0]);
+ }
+@@ -601,7 +713,17 @@
+ #if defined(TC_LINUX )
+ Thread::Sleep (1000); // wait 1 second for the forked sudo to start
+ #endif
++#ifdef TC_OPENBSD
++ if (authTerminalFd != -1)
++ {
++ // Give doas(1) time to open its authentication terminal, then
++ // forward the admin password obtained by the user interface.
++ Thread::Sleep (1000);
++ if (write (authTerminalFd, &adminPassword.front(), adminPassword.size())) { } // Errors ignored
++ }
++#else
+ if (write (inPipe->GetWriteFD(), &adminPassword.front(), adminPassword.size())) { } // Errors ignored
++#endif
+
+ burn (&adminPassword.front(), adminPassword.size());
+
+@@ -667,7 +789,11 @@
+ Thread thread;
+ thread.Start (new WaitFunctor (forkedPid));
+
++#ifdef TC_OPENBSD
++ throw ElevationFailed (SRC_POS, "doas", 1, "");
++#else
+ throw ElevationFailed (SRC_POS, "sudo", 1, "");
++#endif
+ }
+
+ waitRes = waitpid (forkedPid, &status, 0);
+@@ -700,11 +826,18 @@
+ if (!errOutput.empty())
+ strErrOutput.insert (strErrOutput.begin(), errOutput.begin(), errOutput.end());
+
++#ifdef TC_OPENBSD
++ if (strErrOutput.find (" tty") != string::npos)
++ strErrOutput += "\nTo allow VeraCrypt to elevate privileges, add an appropriate rule for it to '/etc/doas.conf'.";
++
++ throw ElevationFailed (SRC_POS, "doas", exitCode, strErrOutput);
++#else
+ // sudo may require a tty even if -S is used
+ if (strErrOutput.find (" tty") != string::npos)
+ strErrOutput += "\nTo enable use of 'sudo' by applications without a terminal window, please disable 'requiretty' option in '/etc/sudoers'. Newer versions of sudo automatically determine whether a terminal is required ('requiretty' option is obsolete).";
+
+ throw ElevationFailed (SRC_POS, "sudo", exitCode, strErrOutput);
++#endif
+ }
+
+ throw_sys_if (fcntl (outPipe->GetReadFD(), F_SETFL, 0) == -1);
+@@ -718,6 +851,17 @@
+
+ AdminInputPipe = move_ptr(inPipe);
+ AdminOutputPipe = move_ptr(outPipe);
++
++#ifdef TC_OPENBSD
++ if (authTerminalFd != -1)
++ {
++ // Keep the authentication terminal open for the lifetime of the
++ // elevated service. Closing the master would hang up the service.
++ authTerminalKept = true;
++ DoasAuthTerminalFd = authTerminalFd;
++ authTerminalFd = -1;
++ }
++#endif
+ }
+
+ void CoreService::Stop ()
Index: security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp
diff -N security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp
--- security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp 25 Nov 2022 11:21:44 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,14 +0,0 @@
-The -c option is no more. https://github.com/veracrypt/VeraCrypt/pull/1002
-
-Index: Core/Unix/OpenBSD/CoreOpenBSD.cpp
---- Core/Unix/OpenBSD/CoreOpenBSD.cpp.orig
-+++ Core/Unix/OpenBSD/CoreOpenBSD.cpp
-@@ -69,8 +69,6 @@ namespace VeraCrypt
- if (freeVnd == -1)
- throw "couldn't find free vnd";
-
-- args.push_back ("-c");
--
- stringstream freePath;
- freePath << "vnd" << freeVnd;
- args.push_back (freePath.str());
Index: security/veracrypt/patches/patch-Core_VolumeCreator_h
===================================================================
RCS file: security/veracrypt/patches/patch-Core_VolumeCreator_h
diff -N security/veracrypt/patches/patch-Core_VolumeCreator_h
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Core_VolumeCreator_h 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,31 @@
+Index: Core/VolumeCreator.h
+--- Core/VolumeCreator.h.orig
++++ Core/VolumeCreator.h
+@@ -55,7 +55,8 @@
+ Btrfs,
+ MacOsExt,
+ APFS,
+- UFS
++ UFS,
++ FFS
+ };
+
+ static Enum GetPlatformNative ()
+@@ -68,6 +69,8 @@
+ return VolumeCreationOptions::FilesystemType::MacOsExt;
+ #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
+ return VolumeCreationOptions::FilesystemType::UFS;
++#elif defined (TC_OPENBSD)
++ return VolumeCreationOptions::FilesystemType::FFS;
+ #else
+ return VolumeCreationOptions::FilesystemType::FAT;
+ #endif
+@@ -90,6 +93,8 @@
+ case VolumeCreationOptions::FilesystemType::APFS: return "newfs_apfs";
+ #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
+ case VolumeCreationOptions::FilesystemType::UFS: return "newfs" ;
++ #elif defined (TC_OPENBSD)
++ case VolumeCreationOptions::FilesystemType::FFS: return "/sbin/newfs" ;
+ #endif
+ default: return NULL;
+ }
Index: security/veracrypt/patches/patch-Main_CommandLineInterface_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_CommandLineInterface_cpp
diff -N security/veracrypt/patches/patch-Main_CommandLineInterface_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_CommandLineInterface_cpp 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,13 @@
+Index: Main/CommandLineInterface.cpp
+--- Main/CommandLineInterface.cpp.orig
++++ Main/CommandLineInterface.cpp
+@@ -415,6 +415,9 @@
+ ArgFilesystem = VolumeCreationOptions::FilesystemType::NTFS;
+ else if (str.IsSameAs (L"exFAT", false))
+ ArgFilesystem = VolumeCreationOptions::FilesystemType::exFAT;
++#elif defined (TC_OPENBSD)
++ else if (str.IsSameAs (L"FFS", false))
++ ArgFilesystem = VolumeCreationOptions::FilesystemType::FFS;
+ #endif
+ else
+ throw_err (LangString["UNKNOWN_OPTION"] + L": " + str);
Index: security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp
diff -N security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,17 @@
+Index: Main/Forms/VolumeCreationWizard.cpp
+--- Main/Forms/VolumeCreationWizard.cpp.orig
++++ Main/Forms/VolumeCreationWizard.cpp
+@@ -870,6 +870,13 @@
+ if (!useElevatedAPFSFormatter)
+ PrepareMacOSXFormatterDevice (virtualDevice, changedDeviceOwners);
+ #else
++#ifdef TC_OPENBSD
++ // newfs(8) requires the raw character device; the block
++ // device exposed by the loop device driver cannot be used.
++ string virtualDeviceStr = virtualDevice;
++ if (virtualDeviceStr.find ("/dev/vnd") == 0)
++ virtualDevice = "/dev/r" + virtualDeviceStr.substr (5);
++#endif
+ UserId origDeviceOwner ((uid_t) -1);
+
+ try
Index: security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp
diff -N security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,20 @@
+Index: Main/Forms/VolumeFormatOptionsWizardPage.cpp
+--- Main/Forms/VolumeFormatOptionsWizardPage.cpp.orig
++++ Main/Forms/VolumeFormatOptionsWizardPage.cpp
+@@ -52,6 +52,8 @@
+ FilesystemTypeChoice->Append (L"APFS", (void *) VolumeCreationOptions::FilesystemType::APFS);
+ #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
+ FilesystemTypeChoice->Append (L"UFS", (void *) VolumeCreationOptions::FilesystemType::UFS);
++#elif defined (TC_OPENBSD)
++ FilesystemTypeChoice->Append (L"FFS", (void *) VolumeCreationOptions::FilesystemType::FFS);
+ #endif
+
+ if (!disable32bitFilesystems && filesystemSize <= TC_MAX_FAT_SECTOR_COUNT * sectorSize)
+@@ -94,6 +96,7 @@
+ case VolumeCreationOptions::FilesystemType::MacOsExt: FilesystemTypeChoice->SetStringSelection (L"Mac OS Extended"); break;
+ case VolumeCreationOptions::FilesystemType::APFS: FilesystemTypeChoice->SetStringSelection (L"APFS"); break;
+ case VolumeCreationOptions::FilesystemType::UFS: FilesystemTypeChoice->SetStringSelection (L"UFS"); break;
++ case VolumeCreationOptions::FilesystemType::FFS: FilesystemTypeChoice->SetStringSelection (L"FFS"); break;
+
+ default:
+ throw ParameterIncorrect (SRC_POS);
Index: security/veracrypt/patches/patch-Main_TextUserInterface_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_TextUserInterface_cpp
diff -N security/veracrypt/patches/patch-Main_TextUserInterface_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_TextUserInterface_cpp 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,40 @@
+Index: Main/TextUserInterface.cpp
+--- Main/TextUserInterface.cpp.orig
++++ Main/TextUserInterface.cpp
+@@ -930,7 +930,13 @@
+ {
+ if (Preferences.NonInteractive)
+ {
++#ifdef TC_OPENBSD
++ // Preserve the historical OpenBSD batch default. Native FFS
++ // formatting requires elevation, so scripts should opt in.
++ options->Filesystem = VolumeCreationOptions::FilesystemType::FAT;
++#else
+ options->Filesystem = VolumeCreationOptions::FilesystemType::GetPlatformNative();
++#endif
+ }
+ else
+ {
+@@ -971,6 +977,8 @@
+ }
+ #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
+ ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "UFS")); filesystems.push_back (VolumeCreationOptions::FilesystemType::UFS);
++#elif defined (TC_OPENBSD)
++ ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "FFS")); filesystems.push_back (VolumeCreationOptions::FilesystemType::FFS);
+ #endif
+
+ ssize_t defaultFilesystem = fatAvailable ? 2 : 1;
+@@ -1133,6 +1141,13 @@
+ if (!useElevatedAPFSFormatter)
+ PrepareMacOSXFormatterDevice (virtualDevice, changedDeviceOwners);
+ #else
++#ifdef TC_OPENBSD
++ // newfs(8) requires the raw character device; the block device
++ // exposed by the loop device driver cannot be used.
++ string virtualDeviceStr = virtualDevice;
++ if (virtualDeviceStr.find ("/dev/vnd") == 0)
++ virtualDevice = "/dev/r" + virtualDeviceStr.substr (5);
++#endif
+ UserId origDeviceOwner ((uid_t) -1);
+
+ try
Index: security/veracrypt/patches/patch-Main_UserInterface_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_UserInterface_cpp
diff -N security/veracrypt/patches/patch-Main_UserInterface_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_UserInterface_cpp 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,15 @@
+Index: Main/UserInterface.cpp
+--- Main/UserInterface.cpp.orig
++++ Main/UserInterface.cpp
+@@ -40,7 +40,11 @@
+ public:
+ virtual void operator() (string &str)
+ {
++#ifdef TC_OPENBSD
++ throw ElevationFailed (SRC_POS, "doas", 1, "");
++#else
+ throw ElevationFailed (SRC_POS, "sudo", 1, "");
++#endif
+ }
+ };
+
Index: security/veracrypt/patches/patch-Makefile
===================================================================
RCS file: /cvs/ports/security/veracrypt/patches/patch-Makefile,v
diff -u -p -u -p -r1.3 patch-Makefile
--- security/veracrypt/patches/patch-Makefile 14 Mar 2022 11:07:46 -0000 1.3
+++ security/veracrypt/patches/patch-Makefile 28 Sep 2026 16:24:49 -0000
@@ -1,19 +1,21 @@
+SPDX-License-Identifier: Apache-2.0
+
- don't hardcode -O2
- inject port infrastructure' cflags/cxxflags
Index: Makefile
--- Makefile.orig
+++ Makefile
-@@ -47,7 +47,7 @@ export CFLAGS := -Wall
+@@ -50,7 +50,7 @@
export CXXFLAGS := -Wall -Wno-unused-parameter
- C_CXX_FLAGS := -MMD -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES -I$(BASE_DIR) -I$(BASE_DIR)/Crypto
+ C_CXX_FLAGS := -MMD -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES -I$(BASE_DIR) -I$(BASE_DIR)/Crypto -DARGON2_NO_THREADS -I$(BASE_DIR)/Crypto/Argon2/include
export ASFLAGS := -D __GNUC__ -D __YASM__
-export LFLAGS :=
+export LFLAGS ?=
+ export PKG_CONFIG ?= pkg-config
export PKG_CONFIG_PATH ?= /usr/local/lib/pkgconfig
-
-@@ -109,7 +109,7 @@ endif
+@@ -111,7 +111,7 @@
ifeq "$(TC_BUILD_CONFIG)" "Release"
@@ -22,7 +24,7 @@ Index: Makefile
export WX_BUILD_DIR ?= $(BASE_DIR)/wxrelease
WX_CONFIGURE_FLAGS += --disable-debug_flag --disable-debug_gdb --disable-debug_info
-@@ -441,8 +441,8 @@ endif
+@@ -585,8 +585,8 @@
#------ Common configuration ------
@@ -32,4 +34,4 @@ Index: Makefile
+CXXFLAGS := $(C_CXX_FLAGS) $(CXXFLAGS) $(TC_EXTRA_CXXFLAGS) $(PORT_CXXFLAGS)
LFLAGS := $(LFLAGS) $(TC_EXTRA_LFLAGS)
- WX_CONFIGURE_FLAGS += --enable-unicode -disable-shared --disable-dependency-tracking --enable-exceptions --enable-std_string --enable-dataobj --enable-mimetype
+ #------ Reproducible build configuration ------
Index: security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop
===================================================================
RCS file: /cvs/ports/security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop,v
diff -u -p -u -p -r1.2 patch-Setup_FreeBSD_veracrypt_desktop
--- security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop 11 Mar 2022 19:54:08 -0000 1.2
+++ security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop 28 Sep 2026 16:24:49 -0000
@@ -1,12 +1,14 @@
+SPDX-License-Identifier: Apache-2.0
+
Index: Setup/FreeBSD/veracrypt.desktop
--- Setup/FreeBSD/veracrypt.desktop.orig
+++ Setup/FreeBSD/veracrypt.desktop
-@@ -3,7 +3,7 @@ Encoding=UTF-8
- Name=VeraCrypt
- GenericName=VeraCrypt
- Comment=VeraCrypt
--Exec=/usr/bin/veracrypt
-+Exec=${TRUEPREFIX}/bin/veracrypt
+@@ -4,7 +4,7 @@
+ GenericName=VeraCrypt volume manager
+ Comment=Create and mount VeraCrypt encrypted volumes
Icon=veracrypt
+-Exec=/usr/bin/veracrypt %f
++Exec=${TRUEPREFIX}/bin/veracrypt %f
+ Categories=Security;Utility;Filesystem
+ Keywords=encryption,filesystem
Terminal=false
- Type=Application
Index: security/veracrypt/pkg/PLIST
===================================================================
RCS file: /cvs/ports/security/veracrypt/pkg/PLIST,v
diff -u -p -u -p -r1.2 PLIST
--- security/veracrypt/pkg/PLIST 11 Mar 2022 19:54:08 -0000 1.2
+++ security/veracrypt/pkg/PLIST 28 Sep 2026 16:24:49 -0000
@@ -1,5 +1,6 @@
@bin bin/veracrypt
share/applications/veracrypt.desktop
+share/doc/pkg-readmes/${PKGSTEM}
share/pixmaps/
-share/pixmaps/veracrypt.xpm
+share/pixmaps/veracrypt.png
@tag update-desktop-database
Index: security/veracrypt/pkg/README
===================================================================
RCS file: security/veracrypt/pkg/README
diff -N security/veracrypt/pkg/README
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/pkg/README 28 Sep 2026 16:24:49 -0000
@@ -0,0 +1,29 @@
++-------------------------------------------------------------------------------
+| Running ${PKGSTEM} on OpenBSD
++-------------------------------------------------------------------------------
+
+Privilege elevation
+===================
+
+VeraCrypt runs its privileged core service through doas(1). Add a rule to
+/etc/doas.conf before mounting, creating or formatting volumes:
+
+ permit :wheel cmd ${TRUEPREFIX}/bin/veracrypt
+
+The rule can be restricted further with the "args" option, but it must cover
+both the normal invocation and the "--core-service" mode used internally by
+VeraCrypt. Do not use "permit nopass" unless you accept passwordless
+elevation for every user allowed by the rule.
+
+The core service is used for operations that require root privileges, such as
+configuring vnd(4) loop devices, mounting and unmounting filesystems,
+changing ownership of mount points and device nodes, and running newfs(8)
+when an OpenBSD FFS filesystem is created inside a volume.
+
+Filesystem creation
+===================
+
+OpenBSD FFS filesystems can be created inside a new volume by selecting the
+"FFS" filesystem in the volume creation wizard or by passing
+"--filesystem=FFS" on the command line. The filesystem is created with
+newfs(8) on the raw vnd(4) character device.
