Hello, Please find attached a patch that updates security/veracrypt from version 1.25.9 to 1.26.29. The upstream release notes and full comparison are available at: https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29 https://github.com/veracrypt/VeraCrypt/compare/VeraCrypt_1.25.9...VeraCrypt_1.26.29 The 1.26 series contains a substantial number of security, portability and cryptographic improvements. Version 1.26.29 adds Argon2id as an alternative memory-hard KDF for non-system volumes, hardens the XML and TLV parsers against malformed input, and includes several fixes for CPU feature detection and optimized cryptographic implementations. The releases since 1.25.9 also add hardware acceleration improvements for SHA-256 and AES on supported x86 and ARM64 systems, update translations and documentation, and replace the old "dismount" terminology with "unmount". For the OpenBSD port, this update also contains several platform-specific improvements. VeraCrypt no longer depends on security/sudo on OpenBSD. I added OpenBSD-specific privilege elevation support using the base system doas(1). Since doas reads authentication input from its controlling terminal rather than stdin, VeraCrypt creates a private pseudoterminal and forwards the password entered through its user interface to doas without placing it on the command line or in the environment. A pkg-readme documents the required doas.conf rule and explains the privileged operations performed by VeraCrypt, including vnd(4) setup, filesystem mounting and formatting. I also added native OpenBSD FFS support when creating volumes. FFS can now be selected from the graphical and text interfaces or explicitly with: --filesystem=FFS VeraCrypt invokes /sbin/newfs on the raw rvnd(4) character device when formatting the new filesystem. Non-interactive volume creation keeps FAT as the default so existing scripts do not unexpectedly require privilege elevation. The port also gains security/pcsc-lite support required by the current upstream smart-card code. There are two small build portability patches related to upstream's reproducible-build support. One makes the source_date_epoch.sh awk code compatible with OpenBSD awk, and another corrects an upstream release date mismatch so the generated SOURCE_DATE_EPOCH can be calculated properly. The existing Makefile patch has been refreshed for the current build system and Argon2 sources while continuing to preserve the compiler and linker flags supplied by the ports infrastructure. The old OpenBSD vndconfig "-c" patch has been removed because that change is already present upstream. Finally, the desktop file has been refreshed for the current upstream version, the icon has changed from XPM to PNG, pkg/PLIST has been updated, and distinfo has been regenerated for the 1.26.29 source archive. Thank you for your time and consideration. Best regards, David.
Index: security/veracrypt/Makefile
===================================================================
RCS file: /cvs/ports/security/veracrypt/Makefile,v
diff -u -p -u -p -r1.8 Makefile
--- security/veracrypt/Makefile 17 Dec 2024 05:49:59 -0000 1.8
+++ security/veracrypt/Makefile 19 Sep 2026 17:28:33 -0000
@@ -2,12 +2,11 @@ BROKEN-sparc64= relocation truncated to
COMMENT= free open source disk encryption software
-V= 1.25.9
+V= 1.26.29
DISTNAME= VeraCrypt_${V}_Source
PKGNAME= veracrypt-${V}
CATEGORIES= security
HOMEPAGE= https://www.veracrypt.fr/
-REVISION= 1
MAINTAINER= Tietoturvamies <main@tietoturvamies.fi>
@@ -18,7 +17,7 @@ SITES= https://launchpad.net/veracrypt
EXTRACT_SUFX= .tar.bz2
FIX_EXTRACT_PERMISSIONS=Yes
-# C++11
+# C++14
COMPILER= base-clang ports-gcc
CXXFLAGS_base-clang = -std=c++14
@@ -26,12 +25,13 @@ CXXFLAGS_base-clang = -std=c++14
WANTLIB += ${COMPILER_LIBCXX} c m fuse wx_baseu-3.2 wx_gtk3u_core-3.2
BUILD_DEPENDS= devel/yasm \
+ security/pcsc-lite \
sysutils/coreutils
LIB_DEPENDS= x11/wxWidgets
RUN_DEPENDS= devel/desktop-file-utils \
- security/sudo
+ security/pcsc-lite
WRKDIST= ${WRKDIR}/src
USE_GMAKE= Yes
@@ -58,7 +58,7 @@ do-install:
${INSTALL_DATA} ${WRKSRC}/Setup/FreeBSD/veracrypt.desktop \
${PREFIX}/share/applications
${INSTALL_DATA_DIR} ${PREFIX}/share/pixmaps/
- ${INSTALL_DATA} ${WRKSRC}/Resources/Icons/VeraCrypt-48x48.xpm \
- ${PREFIX}/share/pixmaps/veracrypt.xpm
+ ${INSTALL_DATA} ${WRKSRC}/Resources/Icons/VeraCrypt-48x48.png \
+ ${PREFIX}/share/pixmaps/veracrypt.png
.include <bsd.port.mk>
Index: security/veracrypt/distinfo
===================================================================
RCS file: /cvs/ports/security/veracrypt/distinfo,v
diff -u -p -u -p -r1.2 distinfo
--- security/veracrypt/distinfo 14 Mar 2022 11:07:46 -0000 1.2
+++ security/veracrypt/distinfo 19 Sep 2026 17:28:33 -0000
@@ -1,2 +1,2 @@
-SHA256 (VeraCrypt_1.25.9_Source.tar.bz2) = drbhgYS8IaQdKUn/Y9ch1JBUpxbO/zpL13tcNRC3lK8=
-SIZE (VeraCrypt_1.25.9_Source.tar.bz2) = 24438846
+SHA256 (VeraCrypt_1.26.29_Source.tar.bz2) = YIJnMeKYK0vSMeOTDoWkQ5EWljhnGhsgDFGPjItGyyo=
+SIZE (VeraCrypt_1.26.29_Source.tar.bz2) = 36302144
Index: security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh
===================================================================
RCS file: security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh
diff -N security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,22 @@
+SPDX-License-Identifier: Apache-2.0
+
+Continue the month_number ternary expression explicitly: OpenBSD's awk
+does not accept a bare newline after ':' as a line continuation, so the
+release date could not be derived from Common/Tcdefs.h.
+
+Index: Build/Tools/source_date_epoch.sh
+--- Build/Tools/source_date_epoch.sh.orig
++++ Build/Tools/source_date_epoch.sh
+@@ -60,9 +60,9 @@
+ RELEASE_EPOCH=$(awk '
+ function leap(y) { return ((y % 4 == 0 && y % 100 != 0) || (y % 400 == 0)) }
+ function month_number(name) {
+- return (name == "January" ? 1 : name == "February" ? 2 : name == "March" ? 3 :
+- name == "April" ? 4 : name == "May" ? 5 : name == "June" ? 6 :
+- name == "July" ? 7 : name == "August" ? 8 : name == "September" ? 9 :
++ return (name == "January" ? 1 : name == "February" ? 2 : name == "March" ? 3 : \
++ name == "April" ? 4 : name == "May" ? 5 : name == "June" ? 6 : \
++ name == "July" ? 7 : name == "August" ? 8 : name == "September" ? 9 : \
+ name == "October" ? 10 : name == "November" ? 11 : name == "December" ? 12 : 0);
+ }
+ function mdays(m, y) { return (m == 2 ? 28 + leap(y) : (m == 4 || m == 6 || m == 9 || m == 11 ? 30 : 31)) }
Index: security/veracrypt/patches/patch-Common_Tcdefs_h
===================================================================
RCS file: security/veracrypt/patches/patch-Common_Tcdefs_h
diff -N security/veracrypt/patches/patch-Common_Tcdefs_h
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Common_Tcdefs_h 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,18 @@
+SPDX-License-Identifier: Apache-2.0
+
+Set TC_STR_RELEASE_DATE to June 9, 2026, matching TC_RELEASE_DATE_DAY
+and the upstream "Set release date to June 9th 2026" commit. The awk
+helper in Build/Tools/source_date_epoch.sh requires both dates to agree.
+
+Index: Common/Tcdefs.h
+--- Common/Tcdefs.h.orig
++++ Common/Tcdefs.h
+@@ -73,7 +73,7 @@
+ #define VERSION_NUM 0x0126
+
+ // Release date
+-#define TC_STR_RELEASE_DATE L"June 8, 2026"
++#define TC_STR_RELEASE_DATE L"June 9, 2026"
+ #define TC_RELEASE_DATE_YEAR 2026
+ #define TC_RELEASE_DATE_MONTH 6
+ #define TC_RELEASE_DATE_DAY 9
Index: security/veracrypt/patches/patch-Core_Unix_CoreService_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Core_Unix_CoreService_cpp
diff -N security/veracrypt/patches/patch-Core_Unix_CoreService_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Core_Unix_CoreService_cpp 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,236 @@
+SPDX-License-Identifier: Apache-2.0
+
+Index: Core/Unix/CoreService.cpp
+--- Core/Unix/CoreService.cpp.orig
++++ Core/Unix/CoreService.cpp
+@@ -14,6 +14,14 @@
+ #include <fcntl.h>
+ #include <sys/wait.h>
+ #include <stdio.h>
++#ifdef TC_OPENBSD
++#include <errno.h>
++#include <stdlib.h>
++#include <string.h>
++#include <sys/ioctl.h>
++#include <termios.h>
++#include <unistd.h>
++#endif
+ #include "Platform/FileStream.h"
+ #include "Platform/MemoryStream.h"
+ #include "Platform/Serializable.h"
+@@ -28,6 +36,24 @@
+
+ namespace VeraCrypt
+ {
++#ifdef TC_OPENBSD
++ // doas(1) reads the password from its controlling terminal. A private
++ // pseudoterminal is used for that, so the elevated process does not need
++ // a terminal of its own and the password entered in the user interface
++ // can be forwarded without exposing it on the command line or in the
++ // environment.
++ static int DoasAuthTerminalFd = -1;
++
++ static void CloseDoasAuthTerminal ()
++ {
++ if (DoasAuthTerminalFd != -1)
++ {
++ close (DoasAuthTerminalFd);
++ DoasAuthTerminalFd = -1;
++ }
++ }
++#endif
++
+ #ifdef TC_MACOSX
+ static bool IsMacOSXDevicePathWithPrefix (const string &path, const string &prefix)
+ {
+@@ -149,6 +175,10 @@
+
+ void CoreService::ProcessRequests (int inputFD, int outputFD)
+ {
++#ifdef TC_OPENBSD
++ finally_do ({ CloseDoasAuthTerminal (); });
++#endif
++
+ try
+ {
+ Core = move_ptr(CoreDirect);
+@@ -415,7 +445,11 @@
+ // This approach also works on newer macOS versions (12.0 and later).
+ std::string errorMsg;
+
++#ifdef TC_OPENBSD
++ string sudoAbsolutePath = Process::FindSystemBinary("doas", errorMsg);
++#else
+ string sudoAbsolutePath = Process::FindSystemBinary("sudo", errorMsg);
++#endif
+ if (sudoAbsolutePath.empty())
+ throw SystemException(SRC_POS, errorMsg);
+
+@@ -507,6 +541,36 @@
+
+ void CoreService::StartElevated (const CoreServiceRequest &request)
+ {
++#ifdef TC_OPENBSD
++ CloseDoasAuthTerminal();
++
++ int authTerminalFd = -1;
++ string authTerminalPath;
++ bool authTerminalKept = false;
++
++ finally_do_arg2 (int *, &authTerminalFd, bool *, &authTerminalKept,
++ {
++ if (!*finally_arg2 && *finally_arg != -1)
++ {
++ close (*finally_arg);
++ *finally_arg = -1;
++ }
++ });
++
++ if (!request.FastElevation)
++ {
++ authTerminalFd = posix_openpt (O_RDWR | O_NOCTTY);
++ throw_sys_sub_if (authTerminalFd == -1, "posix_openpt");
++ throw_sys_if (fcntl (authTerminalFd, F_SETFD, FD_CLOEXEC) == -1);
++ throw_sys_if (grantpt (authTerminalFd) == -1);
++ throw_sys_if (unlockpt (authTerminalFd) == -1);
++
++ char *slavePath = ptsname (authTerminalFd);
++ throw_sys_sub_if (slavePath == nullptr, "ptsname");
++ authTerminalPath = slavePath;
++ }
++#endif
++
+ unique_ptr <Pipe> inPipe (new Pipe());
+ unique_ptr <Pipe> outPipe (new Pipe());
+ Pipe errPipe;
+@@ -522,7 +586,11 @@
+ {
+ // Throw exception if sudo is not found in secure locations
+ std::string errorMsg;
++#ifdef TC_OPENBSD
++ string sudoPath = Process::FindSystemBinary("doas", errorMsg);
++#else
+ string sudoPath = Process::FindSystemBinary("sudo", errorMsg);
++#endif
+ if (sudoPath.empty())
+ throw SystemException(SRC_POS, errorMsg);
+
+@@ -551,7 +619,51 @@
+ throw_sys_if (dup2 (outPipe->GetWriteFD(), STDOUT_FILENO) == -1);
+ throw_sys_if (dup2 (errPipe.GetWriteFD(), STDERR_FILENO) == -1);
+
++#ifdef TC_OPENBSD
++ const char *args[8];
++
++ if (!authTerminalPath.empty())
++ {
++ throw_sys_if (setsid () == -1);
++
++ int authFd = open (authTerminalPath.c_str(), O_RDWR);
++ throw_sys_sub_if (authFd == -1, authTerminalPath);
++
++ // Keep the admin password out of the terminal echo.
++ struct termios tios;
++ if (tcgetattr (authFd, &tios) == 0)
++ {
++ tios.c_lflag &= ~(ICANON | ECHO | ECHOE | ECHOK | ECHONL | ISIG | IEXTEN);
++ tios.c_iflag &= ~(BRKINT | ISTRIP | INLCR | IGNCR | ICRNL | IXON);
++ tios.c_cc[VMIN] = 1;
++ tios.c_cc[VTIME] = 0;
++ tcsetattr (authFd, TCSANOW, &tios);
++ }
++
++ if (ioctl (authFd, TIOCSCTTY, 0) == -1 && errno != EINVAL)
++ {
++ close (authFd);
++ throw SystemException (SRC_POS, "TIOCSCTTY");
++ }
++
++ close (authFd);
++
++ args[0] = sudoPath.c_str();
++ args[1] = appPath.c_str();
++ args[2] = TC_CORE_SERVICE_CMDLINE_OPTION;
++ args[3] = nullptr;
++ }
++ else
++ {
++ args[0] = sudoPath.c_str();
++ args[1] = "-n";
++ args[2] = appPath.c_str();
++ args[3] = TC_CORE_SERVICE_CMDLINE_OPTION;
++ args[4] = nullptr;
++ }
++#else
+ const char *args[] = { sudoPath.c_str(), "-S", "-p", "", appPath.c_str(), TC_CORE_SERVICE_CMDLINE_OPTION, nullptr };
++#endif
+ execvp (args[0], ((char* const*) args));
+ throw SystemException (SRC_POS, args[0]);
+ }
+@@ -601,7 +713,17 @@
+ #if defined(TC_LINUX )
+ Thread::Sleep (1000); // wait 1 second for the forked sudo to start
+ #endif
++#ifdef TC_OPENBSD
++ if (authTerminalFd != -1)
++ {
++ // Give doas(1) time to open its authentication terminal, then
++ // forward the admin password obtained by the user interface.
++ Thread::Sleep (1000);
++ if (write (authTerminalFd, &adminPassword.front(), adminPassword.size())) { } // Errors ignored
++ }
++#else
+ if (write (inPipe->GetWriteFD(), &adminPassword.front(), adminPassword.size())) { } // Errors ignored
++#endif
+
+ burn (&adminPassword.front(), adminPassword.size());
+
+@@ -667,7 +789,11 @@
+ Thread thread;
+ thread.Start (new WaitFunctor (forkedPid));
+
++#ifdef TC_OPENBSD
++ throw ElevationFailed (SRC_POS, "doas", 1, "");
++#else
+ throw ElevationFailed (SRC_POS, "sudo", 1, "");
++#endif
+ }
+
+ waitRes = waitpid (forkedPid, &status, 0);
+@@ -700,11 +826,18 @@
+ if (!errOutput.empty())
+ strErrOutput.insert (strErrOutput.begin(), errOutput.begin(), errOutput.end());
+
++#ifdef TC_OPENBSD
++ if (strErrOutput.find (" tty") != string::npos)
++ strErrOutput += "\nTo allow VeraCrypt to elevate privileges, add an appropriate rule for it to '/etc/doas.conf'.";
++
++ throw ElevationFailed (SRC_POS, "doas", exitCode, strErrOutput);
++#else
+ // sudo may require a tty even if -S is used
+ if (strErrOutput.find (" tty") != string::npos)
+ strErrOutput += "\nTo enable use of 'sudo' by applications without a terminal window, please disable 'requiretty' option in '/etc/sudoers'. Newer versions of sudo automatically determine whether a terminal is required ('requiretty' option is obsolete).";
+
+ throw ElevationFailed (SRC_POS, "sudo", exitCode, strErrOutput);
++#endif
+ }
+
+ throw_sys_if (fcntl (outPipe->GetReadFD(), F_SETFL, 0) == -1);
+@@ -718,6 +851,17 @@
+
+ AdminInputPipe = move_ptr(inPipe);
+ AdminOutputPipe = move_ptr(outPipe);
++
++#ifdef TC_OPENBSD
++ if (authTerminalFd != -1)
++ {
++ // Keep the authentication terminal open for the lifetime of the
++ // elevated service. Closing the master would hang up the service.
++ authTerminalKept = true;
++ DoasAuthTerminalFd = authTerminalFd;
++ authTerminalFd = -1;
++ }
++#endif
+ }
+
+ void CoreService::Stop ()
Index: security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp
diff -N security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp
--- security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp 25 Nov 2022 11:21:44 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,14 +0,0 @@
-The -c option is no more. https://github.com/veracrypt/VeraCrypt/pull/1002
-
-Index: Core/Unix/OpenBSD/CoreOpenBSD.cpp
---- Core/Unix/OpenBSD/CoreOpenBSD.cpp.orig
-+++ Core/Unix/OpenBSD/CoreOpenBSD.cpp
-@@ -69,8 +69,6 @@ namespace VeraCrypt
- if (freeVnd == -1)
- throw "couldn't find free vnd";
-
-- args.push_back ("-c");
--
- stringstream freePath;
- freePath << "vnd" << freeVnd;
- args.push_back (freePath.str());
Index: security/veracrypt/patches/patch-Core_VolumeCreator_h
===================================================================
RCS file: security/veracrypt/patches/patch-Core_VolumeCreator_h
diff -N security/veracrypt/patches/patch-Core_VolumeCreator_h
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Core_VolumeCreator_h 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,33 @@
+SPDX-License-Identifier: Apache-2.0
+
+Index: Core/VolumeCreator.h
+--- Core/VolumeCreator.h.orig
++++ Core/VolumeCreator.h
+@@ -55,7 +55,8 @@
+ Btrfs,
+ MacOsExt,
+ APFS,
+- UFS
++ UFS,
++ FFS
+ };
+
+ static Enum GetPlatformNative ()
+@@ -68,6 +69,8 @@
+ return VolumeCreationOptions::FilesystemType::MacOsExt;
+ #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
+ return VolumeCreationOptions::FilesystemType::UFS;
++#elif defined (TC_OPENBSD)
++ return VolumeCreationOptions::FilesystemType::FFS;
+ #else
+ return VolumeCreationOptions::FilesystemType::FAT;
+ #endif
+@@ -90,6 +93,8 @@
+ case VolumeCreationOptions::FilesystemType::APFS: return "newfs_apfs";
+ #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
+ case VolumeCreationOptions::FilesystemType::UFS: return "newfs" ;
++ #elif defined (TC_OPENBSD)
++ case VolumeCreationOptions::FilesystemType::FFS: return "/sbin/newfs" ;
+ #endif
+ default: return NULL;
+ }
Index: security/veracrypt/patches/patch-Main_CommandLineInterface_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_CommandLineInterface_cpp
diff -N security/veracrypt/patches/patch-Main_CommandLineInterface_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_CommandLineInterface_cpp 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,15 @@
+SPDX-License-Identifier: Apache-2.0
+
+Index: Main/CommandLineInterface.cpp
+--- Main/CommandLineInterface.cpp.orig
++++ Main/CommandLineInterface.cpp
+@@ -415,6 +415,9 @@
+ ArgFilesystem = VolumeCreationOptions::FilesystemType::NTFS;
+ else if (str.IsSameAs (L"exFAT", false))
+ ArgFilesystem = VolumeCreationOptions::FilesystemType::exFAT;
++#elif defined (TC_OPENBSD)
++ else if (str.IsSameAs (L"FFS", false))
++ ArgFilesystem = VolumeCreationOptions::FilesystemType::FFS;
+ #endif
+ else
+ throw_err (LangString["UNKNOWN_OPTION"] + L": " + str);
Index: security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp
diff -N security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,19 @@
+SPDX-License-Identifier: Apache-2.0
+
+Index: Main/Forms/VolumeCreationWizard.cpp
+--- Main/Forms/VolumeCreationWizard.cpp.orig
++++ Main/Forms/VolumeCreationWizard.cpp
+@@ -870,6 +870,13 @@
+ if (!useElevatedAPFSFormatter)
+ PrepareMacOSXFormatterDevice (virtualDevice, changedDeviceOwners);
+ #else
++#ifdef TC_OPENBSD
++ // newfs(8) requires the raw character device; the block
++ // device exposed by the loop device driver cannot be used.
++ string virtualDeviceStr = virtualDevice;
++ if (virtualDeviceStr.find ("/dev/vnd") == 0)
++ virtualDevice = "/dev/r" + virtualDeviceStr.substr (5);
++#endif
+ UserId origDeviceOwner ((uid_t) -1);
+
+ try
Index: security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp
diff -N security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,22 @@
+SPDX-License-Identifier: Apache-2.0
+
+Index: Main/Forms/VolumeFormatOptionsWizardPage.cpp
+--- Main/Forms/VolumeFormatOptionsWizardPage.cpp.orig
++++ Main/Forms/VolumeFormatOptionsWizardPage.cpp
+@@ -52,6 +52,8 @@
+ FilesystemTypeChoice->Append (L"APFS", (void *) VolumeCreationOptions::FilesystemType::APFS);
+ #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
+ FilesystemTypeChoice->Append (L"UFS", (void *) VolumeCreationOptions::FilesystemType::UFS);
++#elif defined (TC_OPENBSD)
++ FilesystemTypeChoice->Append (L"FFS", (void *) VolumeCreationOptions::FilesystemType::FFS);
+ #endif
+
+ if (!disable32bitFilesystems && filesystemSize <= TC_MAX_FAT_SECTOR_COUNT * sectorSize)
+@@ -94,6 +96,7 @@
+ case VolumeCreationOptions::FilesystemType::MacOsExt: FilesystemTypeChoice->SetStringSelection (L"Mac OS Extended"); break;
+ case VolumeCreationOptions::FilesystemType::APFS: FilesystemTypeChoice->SetStringSelection (L"APFS"); break;
+ case VolumeCreationOptions::FilesystemType::UFS: FilesystemTypeChoice->SetStringSelection (L"UFS"); break;
++ case VolumeCreationOptions::FilesystemType::FFS: FilesystemTypeChoice->SetStringSelection (L"FFS"); break;
+
+ default:
+ throw ParameterIncorrect (SRC_POS);
Index: security/veracrypt/patches/patch-Main_TextUserInterface_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_TextUserInterface_cpp
diff -N security/veracrypt/patches/patch-Main_TextUserInterface_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_TextUserInterface_cpp 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,42 @@
+SPDX-License-Identifier: Apache-2.0
+
+Index: Main/TextUserInterface.cpp
+--- Main/TextUserInterface.cpp.orig
++++ Main/TextUserInterface.cpp
+@@ -930,7 +930,13 @@
+ {
+ if (Preferences.NonInteractive)
+ {
++#ifdef TC_OPENBSD
++ // Preserve the historical OpenBSD batch default. Native FFS
++ // formatting requires elevation, so scripts should opt in.
++ options->Filesystem = VolumeCreationOptions::FilesystemType::FAT;
++#else
+ options->Filesystem = VolumeCreationOptions::FilesystemType::GetPlatformNative();
++#endif
+ }
+ else
+ {
+@@ -971,6 +977,8 @@
+ }
+ #elif defined (TC_FREEBSD) || defined (TC_SOLARIS)
+ ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "UFS")); filesystems.push_back (VolumeCreationOptions::FilesystemType::UFS);
++#elif defined (TC_OPENBSD)
++ ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "FFS")); filesystems.push_back (VolumeCreationOptions::FilesystemType::FFS);
+ #endif
+
+ ssize_t defaultFilesystem = fatAvailable ? 2 : 1;
+@@ -1133,6 +1141,13 @@
+ if (!useElevatedAPFSFormatter)
+ PrepareMacOSXFormatterDevice (virtualDevice, changedDeviceOwners);
+ #else
++#ifdef TC_OPENBSD
++ // newfs(8) requires the raw character device; the block device
++ // exposed by the loop device driver cannot be used.
++ string virtualDeviceStr = virtualDevice;
++ if (virtualDeviceStr.find ("/dev/vnd") == 0)
++ virtualDevice = "/dev/r" + virtualDeviceStr.substr (5);
++#endif
+ UserId origDeviceOwner ((uid_t) -1);
+
+ try
Index: security/veracrypt/patches/patch-Main_UserInterface_cpp
===================================================================
RCS file: security/veracrypt/patches/patch-Main_UserInterface_cpp
diff -N security/veracrypt/patches/patch-Main_UserInterface_cpp
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/patches/patch-Main_UserInterface_cpp 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,17 @@
+SPDX-License-Identifier: Apache-2.0
+
+Index: Main/UserInterface.cpp
+--- Main/UserInterface.cpp.orig
++++ Main/UserInterface.cpp
+@@ -40,7 +40,11 @@
+ public:
+ virtual void operator() (string &str)
+ {
++#ifdef TC_OPENBSD
++ throw ElevationFailed (SRC_POS, "doas", 1, "");
++#else
+ throw ElevationFailed (SRC_POS, "sudo", 1, "");
++#endif
+ }
+ };
+
Index: security/veracrypt/patches/patch-Makefile
===================================================================
RCS file: /cvs/ports/security/veracrypt/patches/patch-Makefile,v
diff -u -p -u -p -r1.3 patch-Makefile
--- security/veracrypt/patches/patch-Makefile 14 Mar 2022 11:07:46 -0000 1.3
+++ security/veracrypt/patches/patch-Makefile 19 Sep 2026 17:28:33 -0000
@@ -1,19 +1,21 @@
+SPDX-License-Identifier: Apache-2.0
+
- don't hardcode -O2
- inject port infrastructure' cflags/cxxflags
Index: Makefile
--- Makefile.orig
+++ Makefile
-@@ -47,7 +47,7 @@ export CFLAGS := -Wall
+@@ -50,7 +50,7 @@
export CXXFLAGS := -Wall -Wno-unused-parameter
- C_CXX_FLAGS := -MMD -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES -I$(BASE_DIR) -I$(BASE_DIR)/Crypto
+ C_CXX_FLAGS := -MMD -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES -I$(BASE_DIR) -I$(BASE_DIR)/Crypto -DARGON2_NO_THREADS -I$(BASE_DIR)/Crypto/Argon2/include
export ASFLAGS := -D __GNUC__ -D __YASM__
-export LFLAGS :=
+export LFLAGS ?=
+ export PKG_CONFIG ?= pkg-config
export PKG_CONFIG_PATH ?= /usr/local/lib/pkgconfig
-
-@@ -109,7 +109,7 @@ endif
+@@ -111,7 +111,7 @@
ifeq "$(TC_BUILD_CONFIG)" "Release"
@@ -22,7 +24,7 @@ Index: Makefile
export WX_BUILD_DIR ?= $(BASE_DIR)/wxrelease
WX_CONFIGURE_FLAGS += --disable-debug_flag --disable-debug_gdb --disable-debug_info
-@@ -441,8 +441,8 @@ endif
+@@ -585,8 +585,8 @@
#------ Common configuration ------
@@ -32,4 +34,4 @@ Index: Makefile
+CXXFLAGS := $(C_CXX_FLAGS) $(CXXFLAGS) $(TC_EXTRA_CXXFLAGS) $(PORT_CXXFLAGS)
LFLAGS := $(LFLAGS) $(TC_EXTRA_LFLAGS)
- WX_CONFIGURE_FLAGS += --enable-unicode -disable-shared --disable-dependency-tracking --enable-exceptions --enable-std_string --enable-dataobj --enable-mimetype
+ #------ Reproducible build configuration ------
Index: security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop
===================================================================
RCS file: /cvs/ports/security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop,v
diff -u -p -u -p -r1.2 patch-Setup_FreeBSD_veracrypt_desktop
--- security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop 11 Mar 2022 19:54:08 -0000 1.2
+++ security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop 19 Sep 2026 17:28:33 -0000
@@ -1,12 +1,14 @@
+SPDX-License-Identifier: Apache-2.0
+
Index: Setup/FreeBSD/veracrypt.desktop
--- Setup/FreeBSD/veracrypt.desktop.orig
+++ Setup/FreeBSD/veracrypt.desktop
-@@ -3,7 +3,7 @@ Encoding=UTF-8
- Name=VeraCrypt
- GenericName=VeraCrypt
- Comment=VeraCrypt
--Exec=/usr/bin/veracrypt
-+Exec=${TRUEPREFIX}/bin/veracrypt
+@@ -4,7 +4,7 @@
+ GenericName=VeraCrypt volume manager
+ Comment=Create and mount VeraCrypt encrypted volumes
Icon=veracrypt
+-Exec=/usr/bin/veracrypt %f
++Exec=${TRUEPREFIX}/bin/veracrypt %f
+ Categories=Security;Utility;Filesystem
+ Keywords=encryption,filesystem
Terminal=false
- Type=Application
Index: security/veracrypt/pkg/PLIST
===================================================================
RCS file: /cvs/ports/security/veracrypt/pkg/PLIST,v
diff -u -p -u -p -r1.2 PLIST
--- security/veracrypt/pkg/PLIST 11 Mar 2022 19:54:08 -0000 1.2
+++ security/veracrypt/pkg/PLIST 19 Sep 2026 17:28:33 -0000
@@ -1,5 +1,6 @@
@bin bin/veracrypt
share/applications/veracrypt.desktop
+share/doc/pkg-readmes/${PKGSTEM}
share/pixmaps/
-share/pixmaps/veracrypt.xpm
+share/pixmaps/veracrypt.png
@tag update-desktop-database
Index: security/veracrypt/pkg/README
===================================================================
RCS file: security/veracrypt/pkg/README
diff -N security/veracrypt/pkg/README
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ security/veracrypt/pkg/README 19 Sep 2026 17:28:33 -0000
@@ -0,0 +1,29 @@
++-------------------------------------------------------------------------------
+| Running ${PKGSTEM} on OpenBSD
++-------------------------------------------------------------------------------
+
+Privilege elevation
+===================
+
+VeraCrypt runs its privileged core service through doas(1). Add a rule to
+/etc/doas.conf before mounting, creating or formatting volumes:
+
+ permit :wheel cmd ${TRUEPREFIX}/bin/veracrypt
+
+The rule can be restricted further with the "args" option, but it must cover
+both the normal invocation and the "--core-service" mode used internally by
+VeraCrypt. Do not use "permit nopass" unless you accept passwordless
+elevation for every user allowed by the rule.
+
+The core service is used for operations that require root privileges, such as
+configuring vnd(4) loop devices, mounting and unmounting filesystems,
+changing ownership of mount points and device nodes, and running newfs(8)
+when an OpenBSD FFS filesystem is created inside a volume.
+
+Filesystem creation
+===================
+
+OpenBSD FFS filesystems can be created inside a new volume by selecting the
+"FFS" filesystem in the volume creation wizard or by passing
+"--filesystem=FFS" on the command line. The filesystem is created with
+newfs(8) on the raw vnd(4) character device.
No comments:
Post a Comment