David Uhden Collado wrote:
Hello,
Please find attached a patch that updates security/veracrypt from
version 1.25.9 to 1.26.29.
The upstream release notes and full comparison are available at:
https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29
https://github.com/veracrypt/VeraCrypt/compare/
VeraCrypt_1.25.9...VeraCrypt_1.26.29
The 1.26 series contains a substantial number of security, portability
and cryptographic improvements. Version 1.26.29 adds Argon2id as an
alternative memory-hard KDF for non-system volumes, hardens the XML and
TLV parsers against malformed input, and includes several fixes for CPU
feature detection and optimized cryptographic implementations.
The releases since 1.25.9 also add hardware acceleration improvements
for SHA-256 and AES on supported x86 and ARM64 systems, update
translations and documentation, and replace the old "dismount"
terminology with "unmount".
For the OpenBSD port, this update also contains several platform-
specific improvements.
VeraCrypt no longer depends on security/sudo on OpenBSD. I added
OpenBSD-specific privilege elevation support using the base system
doas(1). Since doas reads authentication input from its controlling
terminal rather than stdin, VeraCrypt creates a private pseudoterminal
and forwards the password entered through its user interface to doas
without placing it on the command line or in the environment.
A pkg-readme documents the required doas.conf rule and explains the
privileged operations performed by VeraCrypt, including vnd(4) setup,
filesystem mounting and formatting.
I also added native OpenBSD FFS support when creating volumes. FFS can
now be selected from the graphical and text interfaces or explicitly
with:
--filesystem=FFS
VeraCrypt invokes /sbin/newfs on the raw rvnd(4) character device when
formatting the new filesystem. Non-interactive volume creation keeps FAT
as the default so existing scripts do not unexpectedly require
privilege elevation.
The port also gains security/pcsc-lite support required by the current
upstream smart-card code.
There are two small build portability patches related to upstream's
reproducible-build support. One makes the source_date_epoch.sh awk code
compatible with OpenBSD awk, and another corrects an upstream release
date mismatch so the generated SOURCE_DATE_EPOCH can be calculated
properly.
The existing Makefile patch has been refreshed for the current build
system and Argon2 sources while continuing to preserve the compiler and
linker flags supplied by the ports infrastructure.
The old OpenBSD vndconfig "-c" patch has been removed because that
change is already present upstream.
Finally, the desktop file has been refreshed for the current upstream
version, the icon has changed from XPM to PNG, pkg/PLIST has been
updated, and distinfo has been regenerated for the 1.26.29 source
archive.
Thank you for your time and consideration.
Best regards,
David.
Hello,
sysutils/coreutils is not a runtime dependency of VeraCrypt.
I checked the code paths used at runtime, and they only invoke tools
provided either by the base system or by explicit ports dependencies.
On OpenBSD these include /sbin/vndconfig for attaching and detaching vnd
devices, /sbin/newfs for FFS, mount, umount, fsck and doas. The actual
RUN_DEPENDS are therefore:
devel/desktop-file-utils
security/pcsc-lite
There is no GNU utility used at runtime.
sysutils/coreutils was historically present in BUILD_DEPENDS because
VeraCrypt 1.25.9 had this in src/Build/Include/Makefile.inc:
ifeq "$(PLATFORM)" "OpenBSD"
OD_BIN := ggod -v -t u1 -A n
else
OD_BIN := od -v -t u1 -A n
endif
"ggod" is the GNU od installed by sysutils/coreutils on OpenBSD. The
port builds coreutils with a "g" prefix and additionally renames god to
ggod to avoid a name conflict.
OD_BIN is only used while building embedded resources such as the
generated *.xml.h, *.txt.h and *.bmp.h files, so coreutils was a build
dependency rather than a runtime dependency.
This is no longer necessary with VeraCrypt 1.26.29. The current
src/Build/Include/Makefile.inc uses:
ifeq "$(PLATFORM)" "OpenBSD"
OD_BIN := hexdump -v -e '1/1 "%u "'
else
OD_BIN := od -v -t u1 -A n
endif
hexdump is part of the OpenBSD base system, so sysutils/coreutils is now
just a leftover dependency from the older port.
There are some other GNU-specific commands in upstream build/install
rules, such as:
touch --no-dereference --date=@...
tar --sort=... --mtime=@...
readlink -f
but the OpenBSD port uses an empty ALL_TARGET and its own do-install
target, so the install/package paths containing those commands are not
executed. The relevant upstream checks are also probes which fall back
when those features are unavailable.
I've therefore removed sysutils/coreutils from BUILD_DEPENDS in the
revised patch.
Thanks,
David.
