Re: [UPDATE] devel/github-cli 2.101.0 -> 2.102.0 (security)

David Uhden Collado wrote: > Hello, > > Please find attached a patch updating devel/github-cli from 2.101.0 to > 2.102.0. > > This is primarily a security update. Upstream fixes four vulnerabilities > and recommends updating to 2.102.0 as soon as possible: > > https://github.com/cli/cli/releases/tag/v2.102.0 > https://github.com/cli/cli/compare/v2.101.0...v2.102.0 > > The issues include unsafe handling of symbolic links when writing > downloaded files, two attestation verification weaknesses, and option > injection through interactive skill search results. > > For the port, I updated MODGO_VERSION to v2.102.0 and regenerated > modules.inc and distinfo. The dependency changes are limited to > bubbletea 2.0.10 and klauspost/compress 1.20.1. > > Given the security fixes, I would appreciate it if this update could be > considered before OpenBSD 8.0 is released. > > Thank you. > > Best regards, > David. ping

Index: devel/github-cli/Makefile
===================================================================
RCS file: /cvs/ports/devel/github-cli/Makefile,v
diff -u -p -u -p -r1.82 Makefile
--- devel/github-cli/Makefile	21 Sep 2026 22:58:28 -0000	1.82
+++ devel/github-cli/Makefile	30 Sep 2026 13:55:42 -0000
@@ -1,6 +1,6 @@
 COMMENT =	command-line access to github pull requests, issues and more
 
-V =		2.101.0
+V =		2.102.0
 MODGO_MODNAME =	github.com/cli/cli/v${V:R:R}
 MODGO_VERSION =	v${V}
 
Index: devel/github-cli/distinfo
===================================================================
RCS file: /cvs/ports/devel/github-cli/distinfo,v
diff -u -p -u -p -r1.73 distinfo
--- devel/github-cli/distinfo	21 Sep 2026 22:58:28 -0000	1.73
+++ devel/github-cli/distinfo	30 Sep 2026 13:55:42 -0000
@@ -1,5 +1,5 @@
 SHA256 (bsdmp-survey-vv2.3.8.tar.gz) = fPcSUSZ4Kkovs52dRmmAtg+lX8R/EDkhLaLMZJCphMU=
-SHA256 (cli-v2.101.0.zip) = SLs5klYDMaHMpiu5/IT/75+4b1K7A0YikzdUo/9sM60=
+SHA256 (cli-v2.102.0.zip) = IoKDxfAnwGfxMo4/UihYiSbc+qZg/gtgX1pvUFrFnK4=
 SHA256 (go_modules/bitbucket.org/creachadair/shell/@v/v0.0.8.mod) = p5DeefOWpGgRzfiXR7IMnJJZnIfIuiXfICeZ+ODldMk=
 SHA256 (go_modules/bitbucket.org/creachadair/shell/@v/v0.0.8.zip) = KW2htHeMHqh5EXGvsVathbPZsI2eiI1Wh66jJt2/wyo=
 SHA256 (go_modules/cel.dev/expr/@v/v0.25.1.mod) = Z0UnUNV+zK4mM7F05mRotyYy7edErdtN4sCybd04qOE=
@@ -8,10 +8,10 @@ SHA256 (go_modules/cel.dev/expr/@v/v0.25
 SHA256 (go_modules/charm.land/bubbles/v2/@v/v2.0.0.mod) = fer7gLMyfm9LIuG/S9s8aSv5mTDHMsS/6ApaZsYNaCk=
 SHA256 (go_modules/charm.land/bubbles/v2/@v/v2.2.1.mod) = qzZu1icdy66GueleeDbw6GCPtgmwFsJ6bBT5w0A4qi0=
 SHA256 (go_modules/charm.land/bubbles/v2/@v/v2.2.1.zip) = ZCks3JZeTN2B+ue5sm93ztF5MhqwFPSaRCtHiQeLACQ=
+SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.10.mod) = T95wwv5L3vlEyonR+oREf5ygpnc3ksYRi6JW4o7zttk=
+SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.10.zip) = pvPj7Jl7Wb2g772ROc8+Xm7A9WHmsX+uMeNXkbqGnWQ=
 SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.2.mod) = VIJQr7oHkxyBdbB3y4ywaLy2scmaZ3o3J5q3p6rJWIE=
 SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.8.mod) = dRBJwCbv1oF75kPfKov8TdRZBI6tgabbn5dI5SC/1ZU=
-SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.9.mod) = dRBJwCbv1oF75kPfKov8TdRZBI6tgabbn5dI5SC/1ZU=
-SHA256 (go_modules/charm.land/bubbletea/v2/@v/v2.0.9.zip) = UBryKsWiINONYwUhnBf9ybGcDhtrBTBbwKGHjSHLuf8=
 SHA256 (go_modules/charm.land/huh/v2/@v/v2.0.3.mod) = xZruS0ERraCE7smIQkEdnxCr1uAcpAgvRg73HMiBT0M=
 SHA256 (go_modules/charm.land/huh/v2/@v/v2.0.3.zip) = NrZ4gS/ALUjs0dnqwjLu8Hq85EJbn90T7KG19P6r7IM=
 SHA256 (go_modules/charm.land/lipgloss/v2/@v/v2.0.1.mod) = QsYUvDZv0g7TRSNV+8ydEBU/tBpxNSkrsO0X9DG4//8=
@@ -692,8 +692,8 @@ SHA256 (go_modules/github.com/keybase/go
 SHA256 (go_modules/github.com/keybase/go-keychain/@v/v0.0.1.zip) = lRSmjaCNOdYKR2QL7wSeRMgpqrXbvd0D0nLpJSA5pcc=
 SHA256 (go_modules/github.com/klauspost/compress/@v/v1.18.1.mod) = YlytjEr1C/rbG8hlpLHdju2q7EAS6E+38XJRUQ/ojWU=
 SHA256 (go_modules/github.com/klauspost/compress/@v/v1.19.2.mod) = DWbWBp2eL7h1xbRk0VssgCMs/ImR5viDNs5GHKgQ4M8=
-SHA256 (go_modules/github.com/klauspost/compress/@v/v1.20.0.mod) = DU6Q2ZrLwZ7qVwbnOQ+MklsmsfWGE4W7TxMh1FSh1Iw=
-SHA256 (go_modules/github.com/klauspost/compress/@v/v1.20.0.zip) = oEZU0EmjyvM7y2DuRe/YzOyruT64vogEXtAAOw7LV3M=
+SHA256 (go_modules/github.com/klauspost/compress/@v/v1.20.1.mod) = DU6Q2ZrLwZ7qVwbnOQ+MklsmsfWGE4W7TxMh1FSh1Iw=
+SHA256 (go_modules/github.com/klauspost/compress/@v/v1.20.1.zip) = 7ttY1+SmVmn5opBTZkbL/kGIESNoQktWqMdc/a2yfeo=
 SHA256 (go_modules/github.com/klauspost/pgzip/@v/v1.2.6.mod) = eDUaQK92F5X2bGSneooGn40VKaALsyo4HqRIFCY6iRA=
 SHA256 (go_modules/github.com/klauspost/pgzip/@v/v1.2.6.zip) = isUI6Tsi3KGnMaOkySG1fF7R2up7Nimiz4XDt1MN2oQ=
 SHA256 (go_modules/github.com/kr/pretty/@v/v0.3.1.mod) = hPPkCAOx69SoAuVXlLmZffCxc8SAnoVy/5BC7FWMobw=
@@ -1311,7 +1311,7 @@ SHA256 (go_modules/sigs.k8s.io/yaml/@v/v
 SHA256 (go_modules/software.sslmate.com/src/go-pkcs12/@v/v0.4.0.mod) = +/Vbaah9WjkQgv2brl5MdYEEH+Cbi7k7D+Fs3f6FzpU=
 SHA256 (go_modules/software.sslmate.com/src/go-pkcs12/@v/v0.4.0.zip) = VQGaOR5TAqUbpi6YkJ4AYiS4EgeGbakL6vWC7A3uA28=
 SIZE (bsdmp-survey-vv2.3.8.tar.gz) = 125803
-SIZE (cli-v2.101.0.zip) = 16062085
+SIZE (cli-v2.102.0.zip) = 16148922
 SIZE (go_modules/bitbucket.org/creachadair/shell/@v/v0.0.8.mod) = 89
 SIZE (go_modules/bitbucket.org/creachadair/shell/@v/v0.0.8.zip) = 8712
 SIZE (go_modules/cel.dev/expr/@v/v0.25.1.mod) = 96
@@ -1320,10 +1320,10 @@ SIZE (go_modules/cel.dev/expr/@v/v0.25.2
 SIZE (go_modules/charm.land/bubbles/v2/@v/v2.0.0.mod) = 1275
 SIZE (go_modules/charm.land/bubbles/v2/@v/v2.2.1.mod) = 1225
 SIZE (go_modules/charm.land/bubbles/v2/@v/v2.2.1.zip) = 159166
+SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.10.mod) = 1006
+SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.10.zip) = 87902
 SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.2.mod) = 1079
 SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.8.mod) = 1006
-SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.9.mod) = 1006
-SIZE (go_modules/charm.land/bubbletea/v2/@v/v2.0.9.zip) = 85761
 SIZE (go_modules/charm.land/huh/v2/@v/v2.0.3.mod) = 1466
 SIZE (go_modules/charm.land/huh/v2/@v/v2.0.3.zip) = 78759
 SIZE (go_modules/charm.land/lipgloss/v2/@v/v2.0.1.mod) = 1046
@@ -2004,8 +2004,8 @@ SIZE (go_modules/github.com/keybase/go-k
 SIZE (go_modules/github.com/keybase/go-keychain/@v/v0.0.1.zip) = 2381161
 SIZE (go_modules/github.com/klauspost/compress/@v/v1.18.1.mod) = 137
 SIZE (go_modules/github.com/klauspost/compress/@v/v1.19.2.mod) = 201
-SIZE (go_modules/github.com/klauspost/compress/@v/v1.20.0.mod) = 201
-SIZE (go_modules/github.com/klauspost/compress/@v/v1.20.0.zip) = 40063352
+SIZE (go_modules/github.com/klauspost/compress/@v/v1.20.1.mod) = 201
+SIZE (go_modules/github.com/klauspost/compress/@v/v1.20.1.zip) = 40331560
 SIZE (go_modules/github.com/klauspost/pgzip/@v/v1.2.6.mod) = 34
 SIZE (go_modules/github.com/klauspost/pgzip/@v/v1.2.6.zip) = 127679
 SIZE (go_modules/github.com/kr/pretty/@v/v0.3.1.mod) = 117
Index: devel/github-cli/modules.inc
===================================================================
RCS file: /cvs/ports/devel/github-cli/modules.inc,v
diff -u -p -u -p -r1.64 modules.inc
--- devel/github-cli/modules.inc	21 Sep 2026 22:58:28 -0000	1.64
+++ devel/github-cli/modules.inc	30 Sep 2026 13:55:42 -0000
@@ -2,7 +2,7 @@ MODGO_MODULES =	\
 	bitbucket.org/creachadair/shell								 v0.0.8 \
 	cel.dev/expr										 v0.25.2 \
 	charm.land/bubbles/v2									 v2.2.1 \
-	charm.land/bubbletea/v2									 v2.0.9 \
+	charm.land/bubbletea/v2									 v2.0.10 \
 	charm.land/huh/v2									 v2.0.3 \
 	charm.land/lipgloss/v2									 v2.0.6 \
 	cloud.google.com/go									 v0.123.0 \
@@ -264,7 +264,7 @@ MODGO_MODULES =	\
 	github.com/jonboulle/clockwork								 v0.5.0 \
 	github.com/kballard/go-shellquote							 v0.0.0-20180428030007-95032a82bc51 \
 	github.com/keybase/go-keychain								 v0.0.1 \
-	github.com/klauspost/compress								 v1.20.0 \
+	github.com/klauspost/compress								 v1.20.1 \
 	github.com/klauspost/pgzip								 v1.2.6 \
 	github.com/kr/pretty									 v0.3.1 \
 	github.com/kr/text									 v0.2.0 \

Re: [IMPROVEMENT] Integrate the app server daemon into devel/codex.

Mike Larkin wrote: > On Tue, Oct 13, 2026 at 07:59:00PM +0000, David Uhden Collado wrote: >> Kirill A. Korinsky wrote: >>> On Tue, 13 Oct 2026 20:42:00 +0200, >>> David Uhden Collado <daviduhden@gmail.com> wrote: >>>> >>>> Please find attached a patch proposing proper integration of the Codex >>>> app-server daemon with the OpenBSD package system. >>>> >>>> The port already includes the daemon functionality, but upstream >>>> normally expects a complete standalone installation and may try to >>>> install another Codex executable under ~/.codex/packages. This is >>>> unsuitable for a package managed by pkg_add. >>>> >>>> The proposed changes address this without disabling the daemon or >>>> rewriting its lifecycle management. >>>> >>> >>> Sorry, you tried to ship way more than only this changes. >>> >>> You had touched many patches and reformat port's Makefile. >>> >>>> [2 codex-0.162.1p0.diff <text/x-patch; UTF-8 (base64)>] >>>> ? devel/codex/files >>>> ? devel/codex/patches/patch-codex-rs_app-server-daemon_src_backend_pid_rs >>>> ? devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs >>>> ? devel/codex/patches/patch-codex-rs_app-server-daemon_src_managed_install_rs >>>> ? devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs >>>> ? devel/codex/patches/patch-codex-rs_modcargo-crates_v8-150_4_0_build_config_clang_clang_gni >>>> ? devel/codex/patches/patch-codex-rs_modcargo-crates_v8-150_4_0_build_detect_host_arch_py >>>> ? devel/codex/patches/patch-codex-rs_modcargo-crates_v8-150_4_0_third_party_libunwind_src_src_AddressSpace_hpp >>>> ? devel/codex/patches/patch-codex-rs_modcargo-crates_v8-150_4_0_third_party_libunwind_src_src_EHHeaderParser_hpp >>>> ? devel/codex/patches/patch-codex-rs_modcargo-crates_v8-150_4_0_third_party_libunwind_src_src_UnwindCursor_hpp >>>> ? devel/codex/patches/patch-codex-rs_modcargo-crates_v8-150_4_0_v8_gni_v8_gni >>>> ? devel/codex/patches/patch-codex-rs_modcargo-crates_v8-150_4_0_v8_src_wasm_stacks_cc >>>> ? devel/codex/patches/patch-codex-rs_tui_src_app_daemon_menu_rs >>> >>> I thunk you also forgot quite a few patches. >>> >>> Can you resend your diff to minimal version which adds support of that codex daemon? >>> >> Hello Kirill, >> >> You're right. The previous diff included more than the daemon integration, >> and I should have made that clearer. Sorry for the confusion. >> >> I've attached a revised diff against the current CVS tree, including the >> previously missing patch files. >> >> The daemon integration itself is relatively small. It reuses the existing >> Codex executable as the app-server daemon, installs it with the required >> package manifest under libexec/codex, and makes the daemon resolver use that >> executable instead of downloading or copying another one into >> ~/.codex/packages. >> >> The existing upstream process management, Unix sockets, IPC, and >> start/stop/restart functionality remain unchanged. Only internal >> installation and self-update mechanisms are disabled, since pkg_add owns the >> executable. >> >> I also included some V8 portability improvements. These are independent of >> the daemon integration, but I think they are worth considering because Codex >> builds its own V8 150.4.0 and uses it for code-mode functionality. >> >> Several changes are adapted from the OpenBSD www/chromium port patches: >> >> - Prevent Linux-specific Clang module configuration from being enabled on >> BSD. >> - Correct OpenBSD arm64 host architecture detection. >> - Improve libunwind handling of DW_EH_PE_omit and reuse cached unwind >> sections. >> - Enable OpenBSD support in the WASM interpreter platform checks. >> - Use MAP_STACK for the usable WASM stack region while preserving its guard >> pages. >> >> These changes address OpenBSD-specific portability and runtime behavior >> rather than daemon management. Keeping the relevant V8 fixes consistent with >> Chromium should also make future updates easier to maintain. >> >> Thanks, >> David. > > the right way to do this is to get this work upstreamed rather than keep > 2500+ lines of patches locally. someone is going to need to make sure that these > thousands of lines of diffs keep working when upstream makes changes, and you > yourself have pointed out that the churn there is incredible. this is going > to add a ton of work moving forward for whoever is the maintainer. > > you made one specific thing work for this specific version only. it's gonna > fall apart fast and we're gonna end up with thousand line diffs that patch > other thousand line diffs. but if you take the time to land this upstream then > we stand a better chance of making this continue to work. The upstream Codex repository maintained by OpenAI restricts pull requests to project collaborators and does not accept external code contributions. On the other hand, additional patches would still be needed to enable Codex's currently disabled sandbox on OpenBSD and integrate it with the operating system's native pledge and unveil security mechanisms.