From owner-svn-doc-all@freebsd.org Sun Sep 17 20:45:13 2017
Return-Path: The 64-bit inode project was completed and merged into
- &os; 12 on May 23, 2017. It extends the ino_t,
+ &os; 12 on May 23, 2017. It extends the ino_t,
dev_t, and nlink_t types to be 64-bit
integers. It modifies the struct dirent layout to
add a d_off field, increases the size of
@@ -137,10 +143,10 @@
struct stat as parameters are broken in backward- and
forward-incompatible ways. The ABI for kinfo sysctl MIBs is changed in a
+ The ABI for kinfo-consuming sysctl MIBs is changed in a
backward-compatible way, but there is no general mechanism to
handle other sysctl MIBS which return structures where the
- layout has changed. It was considered that the breakage is
+ layout has changed. In our consideration, this breakage is
either in management interfaces, where we usually allow ABI
slippage, or is not important.
FRRouting (FRR), a Quagga fork, is an IP routing protocol
suite for Linux and Unix platforms which includes protocol
- daemons for BGP, IS-IS, OSPF and RIP (LPD and PIM need to be
+ daemons for BGP, IS-IS, OSPF and RIP (LPD and PIM support needs to be
fixed on &os;). FRR is a Linux Foundation Collaborative
Project with contributors including 6WIND, Architecture
Technology Corporation, Big Switch Networks, Cumulus Networks,
@@ -258,6 +264,7 @@
Postmaster handles the mail flow for the &os;
- project. Postmaster handles the mail flow for the &os; project. Clusteradm provides us with four jails: mailman, mailarchive,
- mx1 and mx2. In addition, there is some part of the setup
+ mx1, and mx2. In addition, there is some part of the setup
running on freefall.FreeBSD.org. The system uses
- postfix, mailman, spamassassin and
- some other tools from the ports tree to handle the mailflow.
+ postfix, mailman, spamassassin, and
+ some other tools from the ports tree to handle the mail flow.
We use a very small, non-public Subversion repository for
parts of the configuration. Thanks to Florian for his long service in that role! David
Wolfskill is planning to leave the role as soon as the new
team members are settled. Vsevolod Stakhov plans to provide
- us with support to integrate rspamd into the setup.
The workload for the Postmaster Team is not high, but the complexity of the setup has its own demands.
@@ -402,7 +413,7 @@ desired functionality.LLD is now used as the default system linker for - &os;/arm64 and can link a working kernel, modules, and + &os;/arm64 and can link a working kernel, kernel modules, and userland for &os;/amd64. LLD can also link a working kernel and modules (but not userland) for &os;/arm and &os;/i386.
@@ -411,7 +422,7 @@ as the system linker (either by fixing the port, or configuring the port to be linked by GNU ld). -For &os; 12.0 we expect to use LLD as the system linker for +
For &os; 12.0 we expect to use LLD as the system linker for the same set of architectures that use Clang by default: 32- and 64-bit arm and x86.
@@ -423,7 +434,7 @@ command line arguments as for GNU ld and gold. -The in-tree DTC (Device Tree Compilator) was switched to use the +
The in-tree DTC (Device Tree Compiler) was switched to use the BSD-licensed version by default. (The previous default DTC is licensed under the GPL.) The current version supports overlays - and is able to compile every DTS used by the &os; arm + and is able to compile every DTS (Device Tree Source) used by the &os; arm releases. The ports GPL version was updated to the latest release (1.4.4). The in-tree GPL version is still present but the goal is to remove it before &os; 12.0.
@@ -522,7 +533,7 @@ bulk build output (the "Ignored ports" portion, in particular) and see quickly what ports are failing to build and why. Previously, finding the exact reason why a build - failed needed some research (portsmon only models + failed needed some research (portsmon only analyzes failure messages on amd64). Additionally, it is extremely difficult to work through several hundred logs that simply say "failed to compile", "failed to link", and @@ -537,7 +548,7 @@ output, I have begun reworking some existing BROKEN/NOT_FOR/ONLY_FOR messages so that they will sort more easily. This includes sorting the - order of the ARCH definitions. + order in which architectures appear in the lists.Many people have been doing great work on fixing the individual ports. I hope that my work makes their jobs @@ -571,11 +582,11 @@
-ENA (Elastic Network Adapter) is a 25G SmartNIC developed by +
The ENA (Elastic Network Adapter) is a 25G SmartNIC developed by Annapurna Labs and is based on a custom ARMv8 chip. This is a - high performance networking card available in the AWS offering. + high-performance networking card available in the AWS offerings. It introduces enhancements in network utilization scalability - on EC2 machines under control of various operating systems, in + on EC2 machines under the control of various operating systems, in particular &os;.
The goal of &os; enablement is to provide top performance and @@ -587,7 +598,7 @@
I'm working on a third edition of Absolute &os;. This will be a nearly complete rewrite, thanks to the addition of little details like ZFS, GPT, dma, GELI, new boot - stuff, disk labeling, pkg(8), blacklistd, + procedures, disk labeling, pkg(8), blacklistd, jails, etc..
My current (delusional) plan is to have a first draft @@ -678,7 +689,7 @@ "layout" in use specifies how the division occurs, with metadata operations occurring against the main server, and bulk data operations (read/write/setattr/etc.) occurring via - a layout-specific scheme between the client and data + a layout-specific scheme between the client and the data servers.
My first attempt at a pNFS server using GlusterFS was a dud. @@ -686,7 +697,7 @@ usable. This attempt that I call "Plan B", only uses &os;, with one &os; server handling the metadata operations and multiple &os; servers configured to serve - data and is now ready for third party testing. If testing by + data, is now ready for third-party testing. If testing by third parties goes well, I anticipate the code will be merged into &os; head in time for &os; 12. Fairly recent &os; or Linux systems should be usable as pNFS @@ -701,7 +712,7 @@
The patched &os; sources may now be accessed for testing via either Subversion or download of a gzipped tarball. - They consist of a patched kernel plus nfsd daemon and can be + They consist of a patched kernel and nfsd and can be used on any &os; 11 or later system.
@@ -730,8 +741,8 @@ -&os; supports the Xen hypervisor, with DomU support since - &os; 8.0 and Dom0 available since &os; 11.0. The +
&os; supports the Xen hypervisor, with DomU (guest) support since + &os; 8.0 and Dom0 (host) available since &os; 11.0. The &os; Handbook was lacking instructions on how to run a Xen host and VMs. The steps were outlined in the &os; wiki, but needed some extra bits of text from the upstream Xen wiki in @@ -743,7 +754,7 @@
Reviewers Nikolai Lifanov, Roger Pau Monné, and Warren Block provided valuable feedback on the initial version in - Phabricator. Additional corrections were found by Björn + Phabricator. Additional corrections were made by Björn Heidotting while translating the section into German.
@@ -816,11 +827,11 @@ href="https://bugs.FreeBSD.org/bugzilla/show_bug.cgi?id=220290">PR220290) -We have created new Subversion tag (4.13) in order - to follow the unstable releases (due to changes in USES= - xfce infrastucture, and not backward compatible new API - in xfconf). Ports following unstable release - are:
+We have created a new Subversion tag (4.13) in order + to follow the unstable releases. The separate tag was + necessary in order to support changes in the USES=xfce + infrastucture, and due to some incompatible changes to the + xfconf API. Ports following the unstable release are:
This quarter started with the update of GTK+ 3 to 3.22.15, and the underlying libraries to their latest stable @@ -925,7 +937,7 @@ Unfortunately, GDM is blocking the update because of a "handoff" bug to the session after login.
I started looking into Ceph because the HAST solution with CARP and ggate did not really do what I was looking - for. But I aim to run a Ceph storage cluster of storage nodes - that are running ZFS. User stations would be running + for. I aim to run a Ceph storage cluster of storage nodes + that are running ZFS, with user workstations running bhyve on RBD disks that are stored in Ceph.
Compiling for &os; will now build most of the tools @@ -1093,9 +1105,9 @@
Looking forward, the next official release of Ceph is called +
The next forthcoming official release of Ceph is called Luminous (v12.1.0). As soon as it is available from upstream, - a port will be made provided for &os;.
+ a port will be provided for &os;.To get things running on a &os; system, run pkg install
net/ceph-devel or clone
Work proceeds to finalize the upstreaming process of support - for the Marvell Armada38x platform to &os;-HEAD.
+Work proceeds to finalize the process of bringing support + for the Marvell Armada38x platform into &os;-HEAD.
-The most important bits of the recent effort are:
+The most important parts of the recent effort are:
A short selection of ports that now support sndio in +
Here's a short selection of ports that now support sndio in the &os; Ports Collection:
The KDE on &os; team focuses on packaging and making sure - that the experience of KDE and Qt on &os; is as good as +
The KDE on &os; team focuses on packaging KDE and Qt, and making sure + that their experience on &os; is as good as possible.
This quarter, in addition to the regular updates to the KDE, - Qt and related ports, there have also been some changes behind + Qt, and related ports, there have also been some changes behind the scenes: our development repository has moved to GitHub, and &os; is now part of KDE's official continuous integration (CI infrastructure).
@@ -1409,8 +1421,8 @@ from KDE's git repositories. There is strong commitment from upstream and the downstream KDE-&os; team to reduce the amount of patching in the KDE ports to as little as possible. The - first effects are being felt in expanding unittests to - &os;-specific situations, and in extending Qt to handle &os; + first effects are being felt in expanding the set of unit tests to + include &os;-specific situations, and in extending Qt to handle &os; filesystems better. In addition to the KDE sysadmins, we would also like to extend our thanks to Adriaan de Groot, who is both a KDE committer and part of our KDE on &os; team, for @@ -1422,7 +1434,7 @@I plan to test on all supported &os; versions, so you only
@@ -1524,7 +1536,7 @@
Coming up with a solution for this is quite important for me,
as I am currently working on making CloudABI work on top of
@@ -1601,9 +1613,9 @@
This quarter, 2017Q2, broke the 30,000 ports landmark for the
- first time. The PR count is currently just under 2,500 with
+ first time. The PR count is currently just under 2,500, with
almost 600 of them unassigned. This quarter saw almost 7,400
commits from 171 committers. More PRs got closed this
quarter, but also more PRs got sent in, both of which are good
@@ -1637,7 +1649,7 @@
binaries using the cargo command (also covered
separately in this report).
The default linker on arm64 is now lld. This - means &os; is able to build itself with just the components + means that &os; is able to build itself with just the components in the base system, a big milestone!
@@ -1768,7 +1780,7 @@HardenedBSD is a derivative of &os; that gives special attention to - security related enhancements and exploit-mitigation - technologies. The project started with Address Space Layout - Randomization (ASLR) as an initial focal point and is now - implementing further exploit mitigation techniques.
+ security-related enhancements and exploit-mitigation + technologies. From an initial focus on Address Space Layout + Randomization (ASLR), it has now branched out to explore + additional exploit mitigation techniques. -It has been a long while since HardenedBSD's last appearance - in a quarterly status report, with the last status report - being from December of 2015. Accordingly, this status report - will be a long one!
+It has been a long while since HardenedBSD's last entry + in a quarterly status report, back in 2015Q4. The + intervening year saw HardenedBSD gain new developers + Bernard Spil and Franco Fichtner, import LibreSSL and + OpenNTPd into base as the default crypto library and NTP + client, respectively, and introduce the hbsd-update + binary update mechanism for the base system. The + secadm application got a rewrite and Trusted Path + Execution (TPE). PIE is now enabled for the base system for + arm64 and amd64 as well as the bulk of the ports tree, and the + ports tree also gained RELRO and BIND_NOW. Integriforce + (similar to NetBSD's verified exec, veriexec) was + introduced for the base system, as well as SafeStack, a + technology for protection against stack-based buffer + overflows that's developed by the Clang/LLVM community. + SafeStack relies and builds on top of Address Space Layout + Randomization (ASLR), and is strengthened by the presence of + PaX NOEXEC. Certain high-profile ports also have SafeStack + enabled.
-HardenedBSD has gained Bernard Spil and Franco Fichtner - as developers on the project. Bernard has imported both - LibreSSL and OpenNTPd into base. OpenNTPd and LibreSSL have - been set as the default ntp daemon and crypto library - respectively on HardenedBSD 12-CURRENT. Franco has given the - ports hardening framework a much-needed refactor.
+Extremely generous hardware donations from G2, Inc. have + provided for dedicated package building and binary update + servers, as well as development and test servers.
-We introduced a new secure binary update mechanism for the - base system, hbsd-update. Our secadm - application was rewritten to be made more efficient — it - now includes a feature called Integriforce, which is similar - in scope as NetBSD's verified exec (veriexec). - Trusted Path Execution (TPE) was also introduced into - secadm.
- -Through extremely generous donations from G2, Inc, - HardenedBSD has a dedicated package building server, a - dedicated binary update publishing server, and several - development and test servers.
- -In April of 2016, we introduced full PIE support for the base - system on arm64 and amd64. In June of 2016, we started - shipping Integriforce rules for the base system in the binary - updates distributed via hbsd-update. In August of - 2016, PIE, RELRO, and BIND_NOW were enabled for the entire - ports tree, with the exception of a number of ports that have - one or more of those features explicitly disabled.
- -In November of 2016, we introduced SafeStack into the base - system. SafeStack is an exploit mitigation technique that - helps protect against stack-based buffer overflows. It is - developed by the Clang/LLVM community and is included, but not - used, in &os;. In order to be effective, SafeStack relies and - builds on top of Address Space Layout Randomization (ASLR). - Additionally, SafeStack is made stronger with HardenedBSD's - port of PaX NOEXEC. SafeStack is also enabled by default for - a number of high-profile ports in HardenedBSD's ports - tree.
-In March of 2017, we added Control Flow Integrity (CFI) to the base system. CFI is an exploit mitigation technique that helps prevent attackers from modifying the behavior of a @@ -1957,7 +1949,7 @@ all DSOs in a process. Currently only the former is implemented, but we are working hard to enable cross-DSO CFI. As is the case for SafeStack, cross-DSO CFI requires both ASLR - and PaX NOEXEC in order to be effective. If the attacker + and PaX NOEXEC in order to be effective. If an attacker knows the memory layout of an application, the attacker might be able to craft a data-only attack, modifying the CFI control data.
@@ -1991,7 +1983,7 @@The default version of GCC in the Ports Collection (the one requested by USE_GCC=yes and various - USES=compiler invocations) has been updated from from + USES=compiler invocations) has been updated from GCC 4.9.4 to GCC 5.4.
This new major version brings many new capabilities and improvements, as well as some changes that may require - adjustments, including many new compiler warnings, significant + adjustments. The latter category includes many new compiler + warnings, significant improvements to inter-procedural optimizations, and link-time optimization.
@@ -2052,9 +2046,9 @@ binaries.This is the end of a long journey establishing this infrastructure, - which is now similar that of the python ports, for example. - Having the new infrastructure makes upgrading the default as - well as locally adjusting the default version a lot + which is now similar that used by the python ports, for example. + Having the new infrastructure makes upgrading the default, as + well as locally adjusting the default version, a lot easier.
gcc8-devel has been added, and armv6hf support removed, @@ -2153,12 +2147,12 @@ not to me. In fairness, the removal of version strings from the FDP Primer alone is a small change in a tiny corner of the project. Looking at it another way, it might be that some - things that seem to be necessary are more about comfort in + things that seem to be necessary are more about the comfort of familiarity than actual utility.
At present, this is strictly a change to the documentation build toolchain and a single documentation book. However, there - do not appear to be any reasons it could not be extended to the + do not appear to be any reason why it could not be extended to the rest of the documents. It might even serve as tiny test of whether the expansion of $FreeBSD$ tags is needed throughout the rest of the &os; tree.
@@ -2212,7 +2206,7 @@Q2 Development Projects Summary
-The hard work continues into the 2nd quarter on 2017. +
Our hard work continues into the 2nd quarter on 2017. Please take a look at the highlights from our more recent Development Projects summaries.
@@ -2252,7 +2246,7 @@The proposal submission deadline was July 14, 2017, but as mentioned above, people are welcome to submit proposals at - anytime.
+ any time.Although proposals may address any &os; subsystem or infrastructure, we are particularly interested in receiving @@ -2260,22 +2254,22 @@
More details can be found at Please do not hesitate to contact proposals@FreeBSDfoundation.org with any questions.
-Announcing New Partnership Program (contributed by Deb +
Announcing the New Partnership Program (contributed by Deb Goodkin)
I'm excited to announce our new FreeBSD Foundation @@ -2324,8 +2318,8 @@ providing &os; education and training, and recruiting more contributors to the Project. We can only provide the above support with your donations, and we need your help to - connect us with your companies. Please consider sharing our - new Partnership Program with your organization and helping + connect us with your companies. Please consider alerting + your organization to our new Partnership Program and helping to connect us with the appropriate contacts at your company.
@@ -2447,7 +2441,7 @@ assistance with travel expenses for attending conferences related to &os; development and advocacy. Please note: the travel grant policy has been recently updated. Please - carefully review before submitting your application. + carefully review it before submitting your application.More information about travel grants is available at: https://www.FreeBSDfoundation.org/what-we-do/grants/travel-grants/.
@@ -2529,7 +2523,7 @@ with the Project, if not become more deeply involved.The naming for the new group of non-committer Project members - took a few tries to get right: having tried, and rejected + took a few tries to get right: having tried, and rejected, "Contributor" and then "Associate", Core took the view that since what they were offerring was formal Project Membership, then that was the right thing to call it. @@ -2610,7 +2604,7 @@
It is always unsettling when one of the Project's founder +
It is always unsettling when one of the Project's founding members decides to move on, but Jordan's interests have migrated away from &os; related projects and he has decided to hang up his bit once and for all.