On Oct 13, 2026, at 2:40 PM, Sebastian Reitenbach
<[email protected]> wrote:
>
> Hi,
>
> based on feedback from kurt@ a new version, that:
>
> * uses jna from ports
> * uses FULLDISTDIR to copy over the ranges.csv file
>
Thanks!
I also suggested that files/autopsy include --jdkhome ${JAVA_HOME}
and use SUBST on it when installing so that executing autopsy from the
command line without a PATH that includes jdk-21 works.
The crash on ‘Add Data Source’ cleared up for me when I updated
my snapshot to Mon Oct 12 on aarch64. I think there was some recent
work on auxv that was causing getenv(2) to segfault.
After some more testing I noticed it is missing two build depends:
archivers/unzip \
java/jna
LIB_DEPENDS/RUN_DEPENDS and WANTLIB probably need some work but I
okay with it going in now with the above changes and cleaning up
any other depends/wantlib in tree.
okay kurt@
> cheers,
> Sebastian
>
>
> On Tue, Oct 13, 2026 at 12:51 PM Sebastian Reitenbach
> <[email protected]> wrote:
> Hi,
>
> this version finally works with PORTS_PRIVSEP.
> Initially I thought I could get all the dependencies added as additional
> distfiles,
> but this ivy drove me crazy. Finally I switched to pre-create the .ivy2/cache
> and loaded it up to GH. But even there, I had some headaches, because
> some dependency in the cache, had a version range specified to jna, where
> I was unable to do it without manual tweaking of the cache. See the README.md
> I kept for some hints on what I did.
>
> To pre-fill the cache, I disabled network block for _pbuild user, then built
> the cache,
> tarballed. then re-enabled firewall, saw it failing, tweaked it until it
> "just worked".
> Is there an easier way I could achieve that without manual tweaking?
>
> As the other dependency ports, only tested on amd64, and as I mentioned, there
> is this cosmetical segfault at the end of data source ingestion. There I have
> no clue,
> where it comes from and what it is about.
> If anyone is curious, test image here:
> https://github.com/buzzdeee/testfiles/tree/main/diskimages
>
> But when you then restart and reopen the just created case, the data source
> is
> actually added, and you can run all these ingestion modules against ist.
>
> any testing/feedback etc. welcome.
>
> Sebastian
>
>
>
>
>
>
>
> On Mon, Oct 12, 2026 at 10:17 AM Sebastian Reitenbach
> <[email protected]> wrote:
> Hi,
>
> tests with PORTS_PRIVSEP reveals, there are a few dependencies missing it
> downloads.
> I'm looking into that nowish.
>
> Sebastian
>
>
> On Sun, Oct 11, 2026 at 11:18 PM Sebastian Reitenbach
> <[email protected]> wrote:
> Attached updated version contains a tiny fix to the autopsy script in
> /usr/local/bin
>
>
>
> On Sun, Oct 11, 2026 at 10:00 PM Sebastian Reitenbach
> <[email protected]> wrote:
> Hi,
>
> this is the so long talked about Autopsy port.
>
> cat pkg/DESCR:
> Autopsy is a graphical interface to The Sleuth Kit and other open source
> digital forensics tools. Autopsy 3 was a complete rewrite from Autopsy
> 2 to make it Java-based. Autopsy 4 improves on Autopsy 3 by supporting
> collaboration on a single case by multiple users.
>
> It requires a few recently added ports: archivers/sevenzipjbinding,
> databases/sqlite-jdbc, sysutils/py-prefetch-parser, and updated port:
> sysutils/sleuthkit, and not yet, but here on the m/l available
> graphics/openjfx/21
>
> The "original" comes with a lot of bundled binaries and bundled jars, mainly
> targeting
> Windows users. It's supposed to run on Linux as well, but less tested, and
> less modules work there.
>
> What works:
> •
> YARA Ingest Module: uses system YARA (original Autopsy only supports Windows)
> • OpenCV: uses system OpenCV (original Autopsy uses OpenCV 2, OpenBSD has
> OpenCV 4)
> • Plaso Ingest Module: uses system Plaso (original Autopsy only supports
> Windows)
> • Embedded Files Module: works with sevenzipjbinding
> • Use system TestDisk/PhotoRec
> • Recent Activity Ingest Module: uses system prefetch-parser
> • Timeline View: via OpenJFX port (WebKit component)
> • Audio/Video Playback: via OpenJFX (media component)
> • Solr: use bundled solr, (Keyword Indexer writes logs to ~/.solr/...)
>
> Pinning MODJAVA_VER to 21, as it depends on openjfx/21 which itself is pinned
> to JDK 21.
>
> Patching the autopsy.conf file in pre-build stage didn't work out, it kind of
> got re-generated, therefore this odd dance in pre-build: and do-install:
>
> There's one crasher I haven't figured out yet: it occurs at the end of adding
> a new datasource. Don't know yet how to get around it. But the case is
> created with the added datasource, so restarting and opening works.
> In case anyone is up to look into it, I've two disk images for testing here:
> https://github.com/buzzdeee/testfiles/tree/main/diskimages
>
> any testing, feedback etc. welcome.
>
> Sebastian
>
> --
> https://buzzdeee.reitenba.ch
>
>
> --
> https://buzzdeee.reitenba.ch
>
>
> --
> https://buzzdeee.reitenba.ch
>
>
> --
> https://buzzdeee.reitenba.ch
>
>
> --
> https://buzzdeee.reitenba.ch<autopsy.tar.gz>
