På tirsdag 30. juni 2026 kl. 21:04, skrev Igor Zornik <[email protected]>:
> Hello, ports. > > Been using this on my router for a couple of weeks without issues. Build > and quick test done on today’s amd64 snap. QP-encoded diff below the > changelog. > > Changelog: > - Dashboard HTML pages are no longer cached, preventing stale content from > being > served after upgrades. > - The IP allow/block plugins now support CIDR ranges in addition to single > addresses and prefix matching. > - Forwarding rules now support '$RESOLVCONF:<file>' to pick up upstream > resolvers from a resolv.conf-style file, complementing the existing '$DHCP' > syntax. > - Recursive cloaking rules are now rejected at load time instead of being > detected only when a matching query arrives. > - Servers that hit a transient high RTT could previously stay penalized > forever > and never come back into rotation; their RTT estimate now decays so they can > recover. > - Servers are no longer penalized for slow responses when the response is > actually being served from the stale cache. > - HTTP/3 probing now consults a negative cache before retrying, avoiding > repeated probes against servers known not to support it. > - The HTTP transport now handles 'Alt-Svc: clear' properly and reuses HTTP > connections more aggressively. > - The cache TTL is now an explicit, configurable parameter rather than being > derived implicitly. > - Log entries now include the relay name when a query was sent through an > anonymized DNS or ODoH relay. > - A new 'tls_prefer_rsa option' has been added to prefer RSA cipher suites > during the TLS handshake, useful on systems without hardware AES. > - The 'tls_cipher_suite' option is now a no-op. Modern TLS stacks no longer > expose cipher suite selection in a meaningful way, and the option had become > misleading. > - The '-resolve' command now reports incomplete DNSSEC support instead of > silently treating partial signatures as a success. > - ODoH: the 401 key-refresh path has been hardened against panics, races and > bad > server state, refreshes are now coalesced, and the blocking sleep on refresh > has been removed. > - A log size of 0 no longer means "unlimited"; it now correctly disables > rotation by size. > - 'jsdelivr' is now offered as an alternative source URL for resolver lists, > providing more redundancy when the primary mirrors are unreachable. > > Detailed changelog is available at > https://github.com/DNSCrypt/dnscrypt-proxy/releases/tag/2.1.16 > Built/tested on current/amd64 with privsep. Build date: 1782827771 - Tue Jun 30 13:56:11 UTC 2026 Did: // Applied patch $ cd /usr/ports/net/dnscrypt-proxy/ && patch -l -p0 -E < /tmp/dnscrypt-proxy-2.1.16.patch // Built and ran test/checks $ cd /usr/ports/net/dnscrypt-proxy/ && make build package test ; make port-lib-depends-check check-shlib-syms ===> Regression tests for dnscrypt-proxy-2.1.16 cd /usr/ports/pobj/dnscrypt-proxy-2.1.16/go/src/github.com/DNSCrypt/dnscrypt-proxy/dnscrypt-proxy && /usr/bin/env -i GO386=softfloat GOCACHE="/usr/ports/pobj/dnscrypt-proxy-2.1.16/go-cache" GOTOOLCHAIN=local TMPDIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/build-amd64" GOPROXY=invalid://ports.should.not.fetch.at.buildtime/ GO111MODULE=off GOPATH="/usr/ports/pobj/dnscrypt-proxy-2.1.16/go:/usr/local/go-pkg" PORTSDIR="/usr/ports" LIBTOOL="/usr/bin/libtool" PATH='/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/X11R6/bin' PREFIX='/usr/local' LOCALBASE='/usr/local' X11BASE='/usr/X11R6' CFLAGS='-O2 -pipe' TRUEPREFIX='/usr/local' DESTDIR='' HOME='/dnscrypt-proxy-2.1.16_writes_to_HOME' PICFLAG="-fpic" BINGRP=bin BINOWN=root BINMODE=755 NONBINMODE=644 DIRMODE=755 INSTALL_COPY=-c INSTALL_STRIP= MANGRP=bin MANOWN=root MANMODE=644 BSD_INSTALL_PROGRAM="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -c -m 755" BSD_INSTALL_SCRIPT="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -c -m 755" BSD_INSTALL_DATA="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -c -m 644" BSD_INSTALL_MAN="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -c -m 644" BSD_INSTALL_PROGRAM_DIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -d -m 755" BSD_INSTALL_SCRIPT_DIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -d -m 755" BSD_INSTALL_DATA_DIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -d -m 755" BSD_INSTALL_MAN_DIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -d -m 755" go test PASS checks: 2009 passed 0 todo 0 failed (total) ok github.com/DNSCrypt/dnscrypt-proxy/dnscrypt-proxy 122.469s -- // port-lib-depends-check check-shlib-syms had no problems // Updated # TRUSTED_PKG_PATH=/usr/ports/packages/amd64/all/ pkg_add -Dsnap -u dnscrypt-proxy-2.1.15->2.1.16: ok -- Looks fine and have been running this for a few hours. No regressions so far. Hope this helps! May you have a good one. -- yaydn > Index: Makefile > =================================================================== > RCS file: /cvs/ports/net/dnscrypt-proxy/Makefile,v > retrieving revision 1.73 > diff -u -p -u -p -r1.73 Makefile > --- Makefile 11 Mar 2026 21:11:33 -0000 1.73 > +++ Makefile 30 Jun 2026 17:32:19 -0000 > @@ -2,7 +2,7 @@ COMMENT = flexible DNS proxy with suppor > > GH_ACCOUNT = DNSCrypt > GH_PROJECT = dnscrypt-proxy > -GH_TAGNAME = 2.1.15 > +GH_TAGNAME = 2.1.16 > > CATEGORIES = net > > Index: distinfo > =================================================================== > RCS file: /cvs/ports/net/dnscrypt-proxy/distinfo,v > retrieving revision 1.42 > diff -u -p -u -p -r1.42 distinfo > --- distinfo 11 Mar 2026 21:11:33 -0000 1.42 > +++ distinfo 30 Jun 2026 17:32:19 -0000 > @@ -1,2 +1,2 @@ > -SHA256 (dnscrypt-proxy-2.1.15.tar.gz) = > V9qR3So5kqFSjnZLz+m0gIjGPJM8DFcaLKw9J6yMdUY= > -SIZE (dnscrypt-proxy-2.1.15.tar.gz) = 4058547 > +SHA256 (dnscrypt-proxy-2.1.16.tar.gz) = > e6WqdtP9xvu2Z2iboT2Kw+Zr4nZVaVqdQS5a1K/jT40= > +SIZE (dnscrypt-proxy-2.1.16.tar.gz) = 3595664 > >
