Hello Stuart, Thanks for the review. I have attached a revised patch that attempts to address your comments. For existing installations, the package now installs a small migration script that is executed by pkg_add. It checks the current home directory of the _i2pd account and changes it from /var/lib/i2pd to /var/i2pd only if it is still set to the old package default. If the administrator has already changed the home directory, the script leaves it untouched. The migration script also searches recursively for .dat files under /var/lib/i2pd and copies them to the corresponding relative paths under /var/i2pd. These files can include the private identities used by configured tunnels, whose loss would change their .b32.i2p addresses. Existing destination files are never overwritten, symbolic links are not followed, and the original files and old directory are not removed. If a file cannot be copied, the script reports the error and leaves the _i2pd home directory unchanged. I have also documented this behavior in the package README so administrators know that they should verify the migration before manually removing /var/lib/i2pd. Following your other recommendations, the configuration files are now installed with mode 0640 and ownership root:_i2pd, since the daemon does not need to modify them. I also corrected the README terminology, paths, spelling, and newsyslog.conf example, and made the certificate and runtime data paths consistent with the new /var/i2pd layout. Please let me know if this approach is suitable or if the migration should be handled through a different package mechanism. Best regards, David.
? patches
Index: Makefile
===================================================================
RCS file: /cvs/ports/net/i2pd/Makefile,v
diff -u -p -u -r1.33 Makefile
--- Makefile 21 Feb 2026 14:20:20 -0000 1.33
+++ Makefile 22 Jul 2026 14:14:08 -0000
@@ -2,7 +2,7 @@ COMMENT = client for the I2P anonymous n
GH_ACCOUNT = PurpleI2P
GH_PROJECT = i2pd
-GH_TAGNAME = 2.59.0
+GH_TAGNAME = 2.61.0
CATEGORIES = net
HOMEPAGE = https://i2pd.website
@@ -12,9 +14,10 @@ MAINTAINER = SystemFailure <openbsd@syst
# BSD
PERMIT_PACKAGE = Yes
+# uses pledge() and unveil()
WANTLIB += ${COMPILER_LIBCXX}
WANTLIB += boost_filesystem-mt boost_program_options-mt
-WANTLIB += boost_atomic-mt c crypto m miniupnpc ssl z
+WANTLIB += boost_atomic-mt boost_container-mt c crypto m miniupnpc ssl z
COMPILER = base-clang ports-gcc
MODULES = devel/cmake
@@ -29,6 +32,8 @@ CONFIGURE_ARGS = -DWITH_UPNP=ON
WRKSRC = ${WRKDIST}/build
post-install:
+ ${INSTALL_DATA_DIR} ${PREFIX}/libexec
+ ${INSTALL_SCRIPT} ${FILESDIR}/i2pd-migrate ${PREFIX}/libexec/i2pd-migrate
${INSTALL_DATA_DIR} ${PREFIX}/include/i2pd
${INSTALL_DATA} ${WRKDIST}/libi2pd{,_client}/*.h \
${PREFIX}/include/i2pd
Index: distinfo
===================================================================
RCS file: /cvs/ports/net/i2pd/distinfo,v
diff -u -p -u -r1.26 distinfo
--- distinfo 21 Feb 2026 14:20:20 -0000 1.26
+++ distinfo 22 Jul 2026 14:14:08 -0000
@@ -1,2 +1,2 @@
-SHA256 (i2pd-2.59.0.tar.gz) = Dr6wXk82qzgJRJVhoJXcdnrYIaxqYclWI6tJvk/9OYs=
-SIZE (i2pd-2.59.0.tar.gz) = 743516
+SHA256 (i2pd-2.61.0.tar.gz) = QJzTwCV0kShmEatqr2kJQMckj7iYN3wT+ttlqDbioKs=
+SIZE (i2pd-2.61.0.tar.gz) = 779272
Index: files/i2pd-migrate
===================================================================
RCS file: files/i2pd-migrate
diff -N files/i2pd-migrate
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ files/i2pd-migrate 22 Jul 2026 14:14:08 -0000
@@ -0,0 +1,90 @@
+#!/bin/ksh
+
+# Copy the old package data directory before changing the _i2pd home.
+# This script is run by pkg_add, not while the package is being built.
+
+old=/var/lib/i2pd
+new=/var/i2pd
+
+failed()
+{
+ printf '%s\n' "$2" >>"$1"
+ printf 'i2pd migration: unable to copy %s\n' "$2" >&2
+}
+
+copy_dat()
+{
+ status_file=$1
+ src=$2
+ rel=${src#"$old"/}
+ dst=$new/$rel
+ dir=${dst%/*}
+
+ if [ -e "$dst" ] || [ -L "$dst" ]; then
+ if [ -f "$dst" ] && [ ! -L "$dst" ]; then
+ printf 'i2pd migration: leaving existing file unchanged: %s\n' \
+ "$dst" >&2
+ return 0
+ fi
+ failed "$status_file" "$src (destination is not a regular file)"
+ return 1
+ fi
+
+ if ! mkdir -p "$dir" || ! chown _i2pd:_i2pd "$dir" || \
+ ! chmod 0750 "$dir"; then
+ failed "$status_file" "$src (cannot prepare $dir)"
+ return 1
+ fi
+ if ! cp -p "$src" "$dst" || ! chown _i2pd:_i2pd "$dst"; then
+ failed "$status_file" "$src -> $dst"
+ return 1
+ fi
+ printf 'i2pd migration: copied %s -> %s\n' "$src" "$dst"
+}
+
+if [ "$1" = --copy ]; then
+ copy_dat "$2" "$3"
+ exit $?
+fi
+
+status=$(mktemp -d /tmp/i2pd-migrate.XXXXXXXX) || exit 1
+trap 'rm -rf "$status"' EXIT
+
+if ! mkdir -p "$new" || ! chown _i2pd:_i2pd "$new" || \
+ ! chmod 0750 "$new"; then
+ printf 'i2pd migration: unable to prepare %s\n' "$new" >&2
+ exit 1
+fi
+
+if [ -L "$old" ]; then
+ printf 'i2pd migration: refusing to follow symbolic-link directory: %s\n' \
+ "$old" >&2
+ exit 1
+fi
+
+if [ -d "$old" ]; then
+ if ! find "$old" -type f -name '*.dat' -exec "$0" \
+ --copy "$status/status" {} \;; then
+ printf 'i2pd migration: error while searching %s\n' "$old" >&2
+ exit 1
+ fi
+ if [ -s "$status/status" ]; then
+ printf 'i2pd migration: one or more files were not copied; keeping _i2pd home unchanged\n' >&2
+ exit 1
+ fi
+fi
+
+entry=$(getent passwd _i2pd) || {
+ printf 'i2pd migration: cannot inspect _i2pd account; keeping home unchanged\n' >&2
+ exit 1
+}
+home=$(printf '%s\n' "$entry" | cut -d: -f6)
+if [ "$home" = /var/lib/i2pd ]; then
+ if ! usermod -d /var/i2pd _i2pd; then
+ printf 'i2pd migration: unable to change _i2pd home directory\n' >&2
+ exit 1
+ fi
+ printf 'i2pd migration: changed _i2pd home to /var/i2pd\n'
+fi
+
+exit 0
Index: pkg/PLIST
===================================================================
RCS file: /cvs/ports/net/i2pd/pkg/PLIST,v
diff -u -p -u -r1.18 PLIST
--- pkg/PLIST 21 Feb 2026 14:20:20 -0000 1.18
+++ pkg/PLIST 22 Jul 2026 14:14:08 -0000
@@ -1,5 +1,5 @@
@newgroup _i2pd:838
-@newuser _i2pd:838:838::i2pd account:${LOCALSTATEDIR}/lib/i2pd:/sbin/nologin
+@newuser _i2pd:838:838::i2pd account:${LOCALSTATEDIR}/i2pd:/sbin/nologin
@rcscript ${RCDIR}/i2pd
@bin bin/i2pd
include/i2pd/
@@ -29,6 +29,7 @@ include/i2pd/I2NPProtocol.h
include/i2pd/I2PEndian.h
include/i2pd/I2PService.h
include/i2pd/I2PTunnel.h
+include/i2pd/IdentMetrics.h
include/i2pd/Identity.h
include/i2pd/KadDHT.h
include/i2pd/LeaseSet.h
@@ -54,6 +55,7 @@ include/i2pd/Socks5.h
include/i2pd/Streaming.h
include/i2pd/Tag.h
include/i2pd/Timestamp.h
+include/i2pd/Torrents.h
include/i2pd/TransitTunnel.h
include/i2pd/TransportSession.h
include/i2pd/Transports.h
@@ -69,17 +71,21 @@ include/i2pd/util.h
include/i2pd/version.h
@static-lib lib/libi2pd.a
@static-lib lib/libi2pdclient.a
+@mode 0750
@owner _i2pd
@group _i2pd
@sample ${SYSCONFDIR}/i2pd/
-@sample ${LOCALSTATEDIR}/lib/i2pd/
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/router/
+@mode
+@sample ${LOCALSTATEDIR}/i2pd/
+@exec ${TRUEPREFIX}/libexec/i2pd-migrate
+@sample ${LOCALSTATEDIR}/i2pd/certificates/
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/
+@sample ${LOCALSTATEDIR}/i2pd/certificates/router/
@owner
@group
@static-lib lib/libi2pdlang.a
+@bin libexec/i2pd-migrate
share/doc/pkg-readmes/${PKGSTEM}
share/examples/i2pd/
share/examples/i2pd/certificates/
@@ -87,139 +93,154 @@ share/examples/i2pd/certificates/family/
share/examples/i2pd/certificates/family/gostcoin.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/gostcoin.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/gostcoin.crt
@owner
@group
share/examples/i2pd/certificates/family/i2p-dev.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/i2p-dev.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/i2p-dev.crt
@owner
@group
share/examples/i2pd/certificates/family/i2pd-dev.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/i2pd-dev.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/i2pd-dev.crt
@owner
@group
share/examples/i2pd/certificates/family/mca2-i2p.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/mca2-i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/mca2-i2p.crt
@owner
@group
share/examples/i2pd/certificates/family/stormycloud.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/stormycloud.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/stormycloud.crt
@owner
@group
share/examples/i2pd/certificates/family/volatile.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/volatile.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/volatile.crt
@owner
@group
share/examples/i2pd/certificates/reseed/
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/
@owner
@group
share/examples/i2pd/certificates/reseed/acetone_at_mail.i2p.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/acetone_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/acetone_at_mail.i2p.crt
+@owner
+@group
+share/examples/i2pd/certificates/reseed/admin_at_likogan.dev.crt
+@owner _i2pd
+@group _i2pd
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/admin_at_likogan.dev.crt
@owner
@group
share/examples/i2pd/certificates/reseed/admin_at_stormycloud.org.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/admin_at_stormycloud.org.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/admin_at_stormycloud.org.crt
@owner
@group
share/examples/i2pd/certificates/reseed/creativecowpat_at_mail.i2p.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/creativecowpat_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/creativecowpat_at_mail.i2p.crt
@owner
@group
share/examples/i2pd/certificates/reseed/diyarciftci_at_protonmail.com.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/diyarciftci_at_protonmail.com.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/diyarciftci_at_protonmail.com.crt
@owner
@group
share/examples/i2pd/certificates/reseed/echelon3_at_mail.i2p.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/echelon3_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/echelon3_at_mail.i2p.crt
@owner
@group
share/examples/i2pd/certificates/reseed/hankhill19580_at_gmail.com.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/hankhill19580_at_gmail.com.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/hankhill19580_at_gmail.com.crt
@owner
@group
share/examples/i2pd/certificates/reseed/i2p-reseed_at_mk16.de.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/i2p-reseed_at_mk16.de.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/i2p-reseed_at_mk16.de.crt
@owner
@group
share/examples/i2pd/certificates/reseed/igor_at_novg.net.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/igor_at_novg.net.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/igor_at_novg.net.crt
@owner
@group
share/examples/i2pd/certificates/reseed/lazygravy_at_mail.i2p.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/lazygravy_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/lazygravy_at_mail.i2p.crt
@owner
@group
share/examples/i2pd/certificates/reseed/orignal_at_mail.i2p.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/orignal_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/orignal_at_mail.i2p.crt
@owner
@group
share/examples/i2pd/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
@owner
@group
share/examples/i2pd/certificates/reseed/rambler_at_mail.i2p.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/rambler_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/rambler_at_mail.i2p.crt
@owner
@group
share/examples/i2pd/certificates/reseed/reseed_at_diva.exchange.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/reseed_at_diva.exchange.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/reseed_at_diva.exchange.crt
@owner
@group
share/examples/i2pd/certificates/reseed/sahil_at_mail.i2p.crt
@owner _i2pd
@group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/sahil_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/sahil_at_mail.i2p.crt
@owner
@group
-share/examples/i2pd/i2pd.conf
+share/examples/i2pd/certificates/reseed/vserod1488_at_proton.me.crt
@owner _i2pd
@group _i2pd
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/vserod1488_at_proton.me.crt
+@owner
+@group
+share/examples/i2pd/i2pd.conf
+@mode 0640
+@owner root
+@group _i2pd
@sample ${SYSCONFDIR}/i2pd/i2pd.conf
+@mode
@owner
@group
share/examples/i2pd/tunnels.conf
-@owner _i2pd
+@mode 0640
+@owner root
@group _i2pd
@sample ${SYSCONFDIR}/i2pd/tunnels.conf
+@mode
@owner
@group
share/examples/login.conf.d/i2pd
Index: pkg/README
===================================================================
RCS file: /cvs/ports/net/i2pd/pkg/README,v
diff -u -p -u -r1.4 README
--- pkg/README 16 Apr 2024 15:22:32 -0000 1.4
+++ pkg/README 22 Jul 2026 14:14:08 -0000
@@ -5,7 +5,7 @@
Resource Limits: File Descriptors
=================================
-${PKGSTEM} needs to open a lot of file descriptors.
+i2pd needs to open a lot of file descriptors.
For a regular node, you should raise the system-wide maxfiles limit to
8192:
@@ -24,3 +24,67 @@ and also edit /etc/login.conf.d/i2pd:
:openfiles-cur=8192:\
:openfiles-max=8192:\
:tc=daemon:
+
+
+The HTTP interface
+==================
+
+On OpenBSD, i2pd's HTTP interface is disabled by default, because it
+allows any user on the system to perform actions on the daemon, such
+as shutting it down, or access private data, such as the router
+identity and the tunnels' B32 addresses.
+
+If you want to use this interface anyway, you can reenable it in
+${SYSCONFDIR}/i2pd/i2pd.conf under the [http] section.
+
+
+Data directory migration
+=========================
+
+When this package is installed or upgraded, any .dat files found under
+/var/lib/i2pd are copied to the same relative paths under /var/i2pd.
+Existing destination files are never overwritten. The old files and
+/var/lib/i2pd are not deleted. The _i2pd home directory is changed to
+/var/i2pd only when it still has the old package default,
+/var/lib/i2pd. Administrators should verify the migration before
+manually removing /var/lib/i2pd.
+
+
+Graceful shutdown
+=================
+
+It is good practice to shutdown the i2pd daemon gracefully, to avoid
+immediately severing all connections, which would disconnect all
+your peers and affect the overall operation of the I2P network.
+
+You can initiate a graceful shutdown without the HTTP interface by
+sending a signal to the i2pd daemon like this:
+
+ kill -INT $(cat /var/i2pd/i2pd.pid)
+
+When it shuts down gracefully, the i2pd daemon waits for all transit
+tunnels to expire, which usually takes 10 minutes.
+
+
+Logging
+=======
+
+By default, this package sends its log messages to
+syslogd(8), which writes them to the /var/log/daemon file.
+
+The default log level of i2pd ("warn") can be very verbose. You
+may want to reduce this log verbosity by changing the "loglevel"
+parameter in ${SYSCONFDIR}/i2pd/i2pd.conf.
+
+If you want log messages to be written to another file, e.g.
+${LOCALSTATEDIR}/i2pd/i2pd.log, you can change the "log" and "logfile"
+parameters in ${SYSCONFDIR}/i2pd/i2pd.conf. To have this log file
+rotated automatically, you can add an entry to /etc/newsyslog.conf using the i2pd pid
+file so that newsyslog(8) can send SIGHUP to the daemon after rotation.
+
+For example:
+
+ ${LOCALSTATEDIR}/i2pd/i2pd.log _i2pd:_i2pd 644 6 * $D13 Z ${LOCALSTATEDIR}/i2pd/i2pd.pid
+
+Sending SIGHUP is enough for log rotation, and also makes i2pd reload
+its tunnel configuration and rotate transient keys.
Index: pkg/i2pd.rc
===================================================================
RCS file: /cvs/ports/net/i2pd/pkg/i2pd.rc,v
diff -u -p -u -r1.4 i2pd.rc
--- pkg/i2pd.rc 11 Mar 2022 19:46:04 -0000 1.4
+++ pkg/i2pd.rc 22 Jul 2026 14:14:08 -0000
@@ -2,7 +2,12 @@
daemon="${TRUEPREFIX}/bin/i2pd --daemon"
daemon_user="_i2pd"
-daemon_flags="--service --datadir=${LOCALSTATEDIR}/lib/i2pd --conf=${SYSCONFDIR}/i2pd/i2pd.conf --tunconf=${SYSCONFDIR}/i2pd/tunnels.conf --tunnelsdir=${SYSCONFDIR}/i2pd/tunnels.d"
+daemon_flags="--service \
+ --datadir=${LOCALSTATEDIR}/i2pd \
+ --conf=${SYSCONFDIR}/i2pd/i2pd.conf \
+ --tunconf=${SYSCONFDIR}/i2pd/tunnels.conf \
+ --tunnelsdir=${SYSCONFDIR}/i2pd/tunnels.d \
+ --certsdir=${LOCALSTATEDIR}/i2pd/certificates"
. /etc/rc.d/rc.subr
Index: patches/patch-daemon_Daemon_cpp
===================================================================
RCS file: patches/patch-daemon_Daemon_cpp
diff -N patches/patch-daemon_Daemon_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-daemon_Daemon_cpp 22 Jul 2026 14:14:10 -0000
@@ -0,0 +1,13 @@
+Use only the pledge promises required by i2pd. It forks when daemonizing
+and locks its pidfile, but does not use the other promises from upstream's
+default set.
+
+Index: daemon/Daemon.cpp
+--- daemon/Daemon.cpp.orig
++++ daemon/Daemon.cpp
+@@ -115,4 +115,3 @@
+ LogPrint(eLogDebug, "Use default pledge values");
+- // TODO: remove that not need
+- pledge("stdio rpath wpath cpath inet dns unix recvfd sendfd proc error mcast chown flock",nullptr);
++ pledge("stdio rpath wpath cpath inet dns unix proc flock", nullptr);
+ } else {
No comments:
Post a Comment