On 2026/07/22 16:16, David Uhden Collado wrote:
> Stuart Henderson wrote:
> > On 2026/07/22 15:25, David Uhden Collado wrote:
> > > Stuart Henderson wrote:
> > > > we are pretty conservative in what is automatically run by pkg_add,
> > > > to my eye this is too much.
> > > >
> > > > I wouldn't object to installing a script and asking the user to run it,
> > > > though I think by default it should just print the operations needed so
> > > > the user can review (maybe with a flag to run them automatically after
> > > > checking).
> > > >
> > > > there should not be an @bin marker for scripts.
> > > >
> > > > the revised pledge still feels like shoehorning it into a program
> > > > which has not been designed to actually work with it. big clue
> > > > is having file access and network access in the same process.
> > > > (sure, there's worse in ports, and it's not a total blocker, but
> > > > it does make me wonder how well tested it's been, because clearly
> > > > there hasn't been too much careful thought about how to use this
> > > > prior to it being committed uptream..)
> > > >
> > > Hello Stuart,
> > >
> > > Earlier, you mentioned that users would not normally make these changes
> > > themselves, so the migration should be automated and made as robust as
> > > possible. That is what I have tried to implement.
> >
> > I think you refer to this that I wrote earlier?
> >
> > +-----
> > | > @newgroup _i2pd:838
> > | > -@newuser _i2pd:838:838::i2pd
> > account:${LOCALSTATEDIR}/lib/i2pd:/sbin/nologin
> > | > +@newuser _i2pd:838:838::i2pd
> > account:${LOCALSTATEDIR}/i2pd:/sbin/nologin
> > |
> > | This will not get changed for users with existing installs
> > | so there will need to be some documentation about how to do that.
> > +-----
> >
> > What I mean is: pkg_add will not automatically change this if the user
> > has previously installed an old version. (We generally consider this
> > too risky if the user changed something in a way that pkg_add / the
> > package doesn't expect).
> >
> > We normally don't make changes like this in ports because of the extra
> > hassle for upgrading users. However if it is unavoidable then there must
> > be information for users to follow. I didn't say anything about
> > automating it (and actually making the changes automatically without
> > user review first seems risky in the same way it would be for pkg_add
> > to update /etc/passwd lines directly).
> >
> Hello Stuart,
>
> Thanks for the clarification. I misunderstood your earlier comment and
> assumed that the migration should be performed without first asking the
> user.
>
> I have now added an @ask-update entry so that pkg_add explains the directory
> migration and asks the user for confirmation before running the migration
> script. The script itself remains non-interactive.
>
> The migration only runs during an update from an older i2pd package. It
> copies existing .dat files without overwriting destination files, leaves the
> original files under /var/lib/i2pd untouched, and changes the _i2pd home
> directory only if it is still set to the old default.
>
> I have attached the revised patch.
>
> Best regards,
> David.
> ? patches
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/net/i2pd/Makefile,v
> diff -u -p -u -r1.33 Makefile
> --- Makefile 21 Feb 2026 14:20:20 -0000 1.33
> +++ Makefile 22 Jul 2026 16:09:34 -0000
> @@ -2,7 +2,7 @@ COMMENT = client for the I2P anonymous n
>
> GH_ACCOUNT = PurpleI2P
> GH_PROJECT = i2pd
> -GH_TAGNAME = 2.59.0
> +GH_TAGNAME = 2.61.0
>
> CATEGORIES = net
> HOMEPAGE = https://i2pd.website
> @@ -12,9 +12,10 @@ MAINTAINER = SystemFailure <openbsd@syst
> # BSD
> PERMIT_PACKAGE = Yes
>
> +# uses pledge() and unveil()
> WANTLIB += ${COMPILER_LIBCXX}
> WANTLIB += boost_filesystem-mt boost_program_options-mt
> -WANTLIB += boost_atomic-mt c crypto m miniupnpc ssl z
> +WANTLIB += boost_atomic-mt boost_container-mt c crypto m miniupnpc ssl z
>
> COMPILER = base-clang ports-gcc
> MODULES = devel/cmake
> @@ -29,6 +30,8 @@ CONFIGURE_ARGS = -DWITH_UPNP=ON
> WRKSRC = ${WRKDIST}/build
>
> post-install:
> + ${INSTALL_DATA_DIR} ${PREFIX}/libexec
> + ${INSTALL_SCRIPT} ${FILESDIR}/i2pd-migrate
> ${PREFIX}/libexec/i2pd-migrate
> ${INSTALL_DATA_DIR} ${PREFIX}/include/i2pd
> ${INSTALL_DATA} ${WRKDIST}/libi2pd{,_client}/*.h \
> ${PREFIX}/include/i2pd
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/net/i2pd/distinfo,v
> diff -u -p -u -r1.26 distinfo
> --- distinfo 21 Feb 2026 14:20:20 -0000 1.26
> +++ distinfo 22 Jul 2026 16:09:34 -0000
> @@ -1,2 +1,2 @@
> -SHA256 (i2pd-2.59.0.tar.gz) = Dr6wXk82qzgJRJVhoJXcdnrYIaxqYclWI6tJvk/9OYs=
> -SIZE (i2pd-2.59.0.tar.gz) = 743516
> +SHA256 (i2pd-2.61.0.tar.gz) = QJzTwCV0kShmEatqr2kJQMckj7iYN3wT+ttlqDbioKs=
> +SIZE (i2pd-2.61.0.tar.gz) = 779272
> Index: files/i2pd-migrate
> ===================================================================
> RCS file: files/i2pd-migrate
> diff -N files/i2pd-migrate
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ files/i2pd-migrate 22 Jul 2026 16:09:34 -0000
> @@ -0,0 +1,94 @@
> +#!/bin/ksh
> +
> +# Copy the old package data directory before changing the _i2pd home.
> +# This script is run by pkg_add, not while the package is being built.
> +
> +old=/var/lib/i2pd
> +new=/var/i2pd
> +
> +failed()
> +{
> + printf '%s\n' "$2" >>"$1"
> + printf 'i2pd migration: unable to copy %s\n' "$2" >&2
> +}
> +
> +copy_dat()
> +{
> + status_file=$1
> + src=$2
> + rel=${src#"$old"/}
> + dst=$new/$rel
> + dir=${dst%/*}
> +
> + if [ -e "$dst" ] || [ -L "$dst" ]; then
> + if [ -f "$dst" ] && [ ! -L "$dst" ]; then
> + printf 'i2pd migration: leaving existing file
> unchanged: %s\n' \
> + "$dst" >&2
> + return 0
> + fi
> + failed "$status_file" "$src (destination is not a regular file)"
> + return 1
> + fi
> +
> + if ! mkdir -p "$dir" || ! chown _i2pd:_i2pd "$dir" || \
> + ! chmod 0750 "$dir"; then
> + failed "$status_file" "$src (cannot prepare $dir)"
> + return 1
> + fi
> + if ! cp -p "$src" "$dst" || ! chown _i2pd:_i2pd "$dst"; then
> + failed "$status_file" "$src -> $dst"
> + return 1
> + fi
> + printf 'i2pd migration: copied %s -> %s\n' "$src" "$dst"
> +}
> +
> +if [ "$1" = --copy ]; then
> + copy_dat "$2" "$3"
> + exit $?
> +fi
> +
> +if [ ! -d "$old" ]; then
> + exit 0
> +fi
> +
> +if [ -L "$old" ]; then
> + printf 'i2pd migration: refusing to follow symbolic-link directory:
> %s\n' \
> + "$old" >&2
> + exit 1
> +fi
> +
> +status=$(mktemp -d /tmp/i2pd-migrate.XXXXXXXX) || exit 1
> +trap 'rm -rf "$status"' EXIT
> +
> +if ! mkdir -p "$new" || ! chown _i2pd:_i2pd "$new" || \
> + ! chmod 0750 "$new"; then
> + printf 'i2pd migration: unable to prepare %s\n' "$new" >&2
> + exit 1
> +fi
> +
> +if [ -d "$old" ]; then
> + if ! find "$old" -type f -name '*.dat' -exec "$0" \
> + --copy "$status/status" {} \;; then
> + printf 'i2pd migration: error while searching %s\n' "$old" >&2
> + exit 1
> + fi
> + if [ -s "$status/status" ]; then
> + printf 'i2pd migration: one or more files were not copied;
> keeping _i2pd home unchanged\n' >&2
> + exit 1
> + fi
> +fi
> +
> +entry=$(getent passwd _i2pd) || {
> + printf 'i2pd migration: cannot inspect _i2pd account; keeping home
> unchanged\n' >&2
> + exit 1
> +}
> +home=$(printf '%s\n' "$entry" | cut -d: -f6)
> +if [ "$home" = /var/lib/i2pd ]; then
> + if ! usermod -d /var/i2pd _i2pd; then
> + printf 'i2pd migration: unable to change _i2pd home
> directory\n' >&2
> + exit 1
> + fi
> + printf 'i2pd migration: changed _i2pd home to /var/i2pd\n'
> +fi
> +
> +exit 0
> Index: pkg/PLIST
> ===================================================================
> RCS file: /cvs/ports/net/i2pd/pkg/PLIST,v
> diff -u -p -u -r1.18 PLIST
> --- pkg/PLIST 21 Feb 2026 14:20:20 -0000 1.18
> +++ pkg/PLIST 22 Jul 2026 16:09:34 -0000
> @@ -1,7 +1,9 @@
> @newgroup _i2pd:838
> -@newuser _i2pd:838:838::i2pd account:${LOCALSTATEDIR}/lib/i2pd:/sbin/nologin
> +@newuser _i2pd:838:838::i2pd account:${LOCALSTATEDIR}/i2pd:/sbin/nologin
> @rcscript ${RCDIR}/i2pd
> @bin bin/i2pd
> +@ask-update i2pd-<2.61.0 The i2pd data directory has moved from
> /var/lib/i2pd to /var/i2pd. Existing .dat files will be copied without
> overwriting files.
> +@bin libexec/i2pd-migrate
> include/i2pd/
> include/i2pd/AddressBook.h
> include/i2pd/BOB.h
> @@ -29,6 +31,7 @@ include/i2pd/I2NPProtocol.h
> include/i2pd/I2PEndian.h
> include/i2pd/I2PService.h
> include/i2pd/I2PTunnel.h
> +include/i2pd/IdentMetrics.h
> include/i2pd/Identity.h
> include/i2pd/KadDHT.h
> include/i2pd/LeaseSet.h
> @@ -54,6 +57,7 @@ include/i2pd/Socks5.h
> include/i2pd/Streaming.h
> include/i2pd/Tag.h
> include/i2pd/Timestamp.h
> +include/i2pd/Torrents.h
> include/i2pd/TransitTunnel.h
> include/i2pd/TransportSession.h
> include/i2pd/Transports.h
> @@ -69,14 +73,17 @@ include/i2pd/util.h
> include/i2pd/version.h
> @static-lib lib/libi2pd.a
> @static-lib lib/libi2pdclient.a
> +@mode 0750
> @owner _i2pd
> @group _i2pd
> @sample ${SYSCONFDIR}/i2pd/
> -@sample ${LOCALSTATEDIR}/lib/i2pd/
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/router/
> +@mode
> +@sample ${LOCALSTATEDIR}/i2pd/
> +@exec-update %D/libexec/i2pd-migrate
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/family/
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/router/
> @owner
> @group
> @static-lib lib/libi2pdlang.a
> @@ -87,139 +94,150 @@ share/examples/i2pd/certificates/family/
> share/examples/i2pd/certificates/family/gostcoin.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/gostcoin.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/family/gostcoin.crt
> @owner
> @group
> share/examples/i2pd/certificates/family/i2p-dev.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/i2p-dev.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/family/i2p-dev.crt
> @owner
> @group
> share/examples/i2pd/certificates/family/i2pd-dev.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/i2pd-dev.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/family/i2pd-dev.crt
> @owner
> @group
> share/examples/i2pd/certificates/family/mca2-i2p.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/mca2-i2p.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/family/mca2-i2p.crt
> @owner
> @group
> share/examples/i2pd/certificates/family/stormycloud.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/stormycloud.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/family/stormycloud.crt
> @owner
> @group
> share/examples/i2pd/certificates/family/volatile.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/volatile.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/family/volatile.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/
> +share/examples/i2pd/certificates/reseed/acetone_at_mail.i2p.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/acetone_at_mail.i2p.crt
> @owner
> @group
> -share/examples/i2pd/certificates/reseed/acetone_at_mail.i2p.crt
> +share/examples/i2pd/certificates/reseed/admin_at_likogan.dev.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/acetone_at_mail.i2p.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/admin_at_likogan.dev.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/admin_at_stormycloud.org.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/admin_at_stormycloud.org.crt
> +@sample
> ${LOCALSTATEDIR}/i2pd/certificates/reseed/admin_at_stormycloud.org.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/creativecowpat_at_mail.i2p.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/creativecowpat_at_mail.i2p.crt
> +@sample
> ${LOCALSTATEDIR}/i2pd/certificates/reseed/creativecowpat_at_mail.i2p.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/diyarciftci_at_protonmail.com.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/diyarciftci_at_protonmail.com.crt
> +@sample
> ${LOCALSTATEDIR}/i2pd/certificates/reseed/diyarciftci_at_protonmail.com.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/echelon3_at_mail.i2p.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/echelon3_at_mail.i2p.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/echelon3_at_mail.i2p.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/hankhill19580_at_gmail.com.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/hankhill19580_at_gmail.com.crt
> +@sample
> ${LOCALSTATEDIR}/i2pd/certificates/reseed/hankhill19580_at_gmail.com.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/i2p-reseed_at_mk16.de.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/i2p-reseed_at_mk16.de.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/i2p-reseed_at_mk16.de.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/igor_at_novg.net.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/igor_at_novg.net.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/igor_at_novg.net.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/lazygravy_at_mail.i2p.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/lazygravy_at_mail.i2p.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/lazygravy_at_mail.i2p.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/orignal_at_mail.i2p.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/orignal_at_mail.i2p.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/orignal_at_mail.i2p.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
> +@sample
> ${LOCALSTATEDIR}/i2pd/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/rambler_at_mail.i2p.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/rambler_at_mail.i2p.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/rambler_at_mail.i2p.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/reseed_at_diva.exchange.crt
> @owner _i2pd
> @group _i2pd
> -@sample
> ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/reseed_at_diva.exchange.crt
> +@sample
> ${LOCALSTATEDIR}/i2pd/certificates/reseed/reseed_at_diva.exchange.crt
> @owner
> @group
> share/examples/i2pd/certificates/reseed/sahil_at_mail.i2p.crt
> @owner _i2pd
> @group _i2pd
> -@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/sahil_at_mail.i2p.crt
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/sahil_at_mail.i2p.crt
> @owner
> @group
> -share/examples/i2pd/i2pd.conf
> +share/examples/i2pd/certificates/reseed/vserod1488_at_proton.me.crt
> @owner _i2pd
> @group _i2pd
> +@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/vserod1488_at_proton.me.crt
> +@owner
> +@group
> +share/examples/i2pd/i2pd.conf
> +@mode 0640
> +@owner root
> +@group _i2pd
> @sample ${SYSCONFDIR}/i2pd/i2pd.conf
> +@mode
> @owner
> @group
> share/examples/i2pd/tunnels.conf
> -@owner _i2pd
> +@mode 0640
> +@owner root
> @group _i2pd
> @sample ${SYSCONFDIR}/i2pd/tunnels.conf
> +@mode
> @owner
> @group
> share/examples/login.conf.d/i2pd
> Index: pkg/README
> ===================================================================
> RCS file: /cvs/ports/net/i2pd/pkg/README,v
> diff -u -p -u -r1.4 README
> --- pkg/README 16 Apr 2024 15:22:32 -0000 1.4
> +++ pkg/README 22 Jul 2026 16:09:34 -0000
> @@ -5,7 +5,7 @@
> Resource Limits: File Descriptors
> =================================
>
> -${PKGSTEM} needs to open a lot of file descriptors.
> +i2pd needs to open a lot of file descriptors.
>
> For a regular node, you should raise the system-wide maxfiles limit to
> 8192:
> @@ -24,3 +24,67 @@ and also edit /etc/login.conf.d/i2pd:
> :openfiles-cur=8192:\
> :openfiles-max=8192:\
> :tc=daemon:
> +
> +
> +The HTTP interface
> +==================
> +
> +On OpenBSD, i2pd's HTTP interface is disabled by default, because it
> +allows any user on the system to perform actions on the daemon, such
> +as shutting it down, or access private data, such as the router
> +identity and the tunnels' B32 addresses.
> +
> +If you want to use this interface anyway, you can reenable it in
> +${SYSCONFDIR}/i2pd/i2pd.conf under the [http] section.
> +
> +
> +Data directory migration
> +=========================
> +
> +When this package is installed or upgraded, any .dat files found under
> +/var/lib/i2pd are copied to the same relative paths under /var/i2pd.
> +Existing destination files are never overwritten. The old files and
> +/var/lib/i2pd are not deleted. The _i2pd home directory is changed to
> +/var/i2pd only when it still has the old package default,
> +/var/lib/i2pd. Administrators should verify the migration before
> +manually removing /var/lib/i2pd.
> +
> +
> +Graceful shutdown
> +=================
> +
> +It is good practice to shutdown the i2pd daemon gracefully, to avoid
> +immediately severing all connections, which would disconnect all
> +your peers and affect the overall operation of the I2P network.
> +
> +You can initiate a graceful shutdown without the HTTP interface by
> +sending a signal to the i2pd daemon like this:
> +
> + kill -INT $(cat /var/i2pd/i2pd.pid)
> +
> +When it shuts down gracefully, the i2pd daemon waits for all transit
> +tunnels to expire, which usually takes 10 minutes.
> +
> +
> +Logging
> +=======
> +
> +By default, this package sends its log messages to
> +syslogd(8), which writes them to the /var/log/daemon file.
> +
> +The default log level of i2pd ("warn") can be very verbose. You
> +may want to reduce this log verbosity by changing the "loglevel"
> +parameter in ${SYSCONFDIR}/i2pd/i2pd.conf.
> +
> +If you want log messages to be written to another file, e.g.
> +${LOCALSTATEDIR}/i2pd/i2pd.log, you can change the "log" and "logfile"
> +parameters in ${SYSCONFDIR}/i2pd/i2pd.conf. To have this log file
> +rotated automatically, you can add an entry to /etc/newsyslog.conf using the
> i2pd pid
> +file so that newsyslog(8) can send SIGHUP to the daemon after rotation.
> +
> +For example:
> +
> + ${LOCALSTATEDIR}/i2pd/i2pd.log _i2pd:_i2pd 644 6 * $D13 Z
> ${LOCALSTATEDIR}/i2pd/i2pd.pid
> +
> +Sending SIGHUP is enough for log rotation, and also makes i2pd reload
> +its tunnel configuration and rotate transient keys.
> Index: pkg/i2pd.rc
> ===================================================================
> RCS file: /cvs/ports/net/i2pd/pkg/i2pd.rc,v
> diff -u -p -u -r1.4 i2pd.rc
> --- pkg/i2pd.rc 11 Mar 2022 19:46:04 -0000 1.4
> +++ pkg/i2pd.rc 22 Jul 2026 16:09:34 -0000
> @@ -2,7 +2,12 @@
>
> daemon="${TRUEPREFIX}/bin/i2pd --daemon"
> daemon_user="_i2pd"
> -daemon_flags="--service --datadir=${LOCALSTATEDIR}/lib/i2pd
> --conf=${SYSCONFDIR}/i2pd/i2pd.conf --tunconf=${SYSCONFDIR}/i2pd/tunnels.conf
> --tunnelsdir=${SYSCONFDIR}/i2pd/tunnels.d"
> +daemon_flags="--service \
> + --datadir=${LOCALSTATEDIR}/i2pd \
> + --conf=${SYSCONFDIR}/i2pd/i2pd.conf \
> + --tunconf=${SYSCONFDIR}/i2pd/tunnels.conf \
> + --tunnelsdir=${SYSCONFDIR}/i2pd/tunnels.d \
> + --certsdir=${LOCALSTATEDIR}/i2pd/certificates"
>
> . /etc/rc.d/rc.subr
>
> Index: patches/patch-daemon_Daemon_cpp
> ===================================================================
> RCS file: patches/patch-daemon_Daemon_cpp
> diff -N patches/patch-daemon_Daemon_cpp
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-daemon_Daemon_cpp 22 Jul 2026 16:09:35 -0000
> @@ -0,0 +1,13 @@
> +Use only the pledge promises required by i2pd. It forks when daemonizing
> +and locks its pidfile, but does not use the other promises from upstream's
> +default set.
> +
> +Index: daemon/Daemon.cpp
> +--- daemon/Daemon.cpp.orig
> ++++ daemon/Daemon.cpp
> +@@ -115,4 +115,3 @@
> + LogPrint(eLogDebug, "Use default pledge
> values");
> +- // TODO: remove that not need
> +- pledge("stdio rpath wpath cpath inet dns unix
> recvfd sendfd proc error mcast chown flock",nullptr);
> ++ pledge("stdio rpath wpath cpath inet dns unix
> proc flock", nullptr);
> + } else {
When I say "user review" I mean "actual review of the changes that it
intends to make", not "is it ok if I do some stuff as root from a shell
script that I'm not going to show you first"
