David Uhden Collado wrote:
Stuart Henderson wrote:
On 2026/10/21 15:50, David Uhden Collado wrote:
Hello,
Please find attached a patch updating net/i2pd from 2.61.0 to 3.0.0.
https://github.com/PurpleI2P/i2pd/releases/tag/3.0.0
Besides the version update, the patch includes:
- LibreSSL compatibility fixes, including ML-KEM, Ed25519ph and
OpenSSL 3 API detection.
- Improved cryptographic error handling in NTCP2, SSU2 and ECIES.
- OpenBSD pledge/unveil initialization using resolved paths and
the effective configuration.
the strongest of the pledges in here is:
stdio rpath wpath cpath fattr inet dns unix flock
what's the point?
- SSU2 MTU detection using getifaddrs().
and afaik this is only because pledge
You're right that the pledge is fairly broad, since i2pd needs access to
the filesystem, network and Unix sockets to work properly.
Even so, it still prevents i2pd from executing other programs, creating
new processes after daemonization, passing file descriptors and
accessing unrelated system interfaces.
The initial pledge allows "proc" during startup, but that permission is
removed once daemonization is complete.
- Synchronous signal handling to avoid unsafe configuration reloads.
- UDP tunnel cleanup and shutdown fixes.
- Updated PLIST, configuration samples and rc.d integration.
the configuration samples change undoes my work that was specifically
to remove a common issue when people add new certs and forget the
@sample. and guess what...you added 5 certs and 1 dir and forgot the
@sample for them.
you also undid some patches that were changing /etc to ${SYSCONFDIR}.
i think you should probably stop sending diffs for a bit.
I didn't pay attention to the latest changes. That makes sense. I've
attached the corrected patch.
I'd like to take over maintenance of this port and continue maintaining
its patches. I'm actually running i2pd in production and using my own
custom-built packages, so if something breaks, I'll likely notice it and
fix it quickly.
Here's a website I'm hosting using httpd + i2pd on OpenBSD 8.0-current:
http://poy7mv4bgjnjgxq73hck72x5lnspvev4pnsiea2gdyegt7xpeg3q.b32.i2p/
