From nobody Tue Jun 30 17:48:33 2026 X-Original-To: freebsd-pkgbase@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVxh5skgz6jbkY for ; Tue, 30 Jun 2026 17:48:40 +0000 (UTC) (envelope-from marquis@roble.com) Received: from mx5.roble.com (mx5.roble.com [209.237.23.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mx5.roble.com", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVxh2J3Gz3cb3; Tue, 30 Jun 2026 17:48:40 +0000 (UTC) (envelope-from marquis@roble.com) Authentication-Results: mx1.freebsd.org; none Received: from roble.com (roble.com [209.237.23.50]) by mx5.roble.com (Postfix) with ESMTP id 4317819312; Tue, 30 Jun 2026 10:48:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=roble.com; s=rs060402; t=1782841713; bh=O5YRvCaAyrd+84OLEMNEJqk/EHJmwT01msEZTsxbJhQ=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=nbCQEAunWhhoBo+tHT+lRItLWGZeJq0A7pjhuCAOzQojpoiy5H8ZgYPSRcZ+qvLCx TwTtPOcjumY6fy2DIR0vL/s1CBzLSXwhfDZ09Uwgu2A6TnxkDivst2oOMAg9PLAHTs T65dCVf2LcT875g8MeGfsB2tUc3DigA/ru12h4hE= Date: Tue, 30 Jun 2026 10:48:33 -0700 (PDT) From: Roger Marquis To: Alexander Ziaee cc: Larry Fahnoe , Mark Millard , vermaden , Lexi Winter , freebsd-pkgbase Subject: Re: None of "man freebsd-base" (or "man pkgbase"), "man pkg-upgrade", or "man pkg-install" deal with documenting .pkgsave and/or .pkgnew behavior or how to handle such In-Reply-To: Message-ID: <6nrn78o7-0448-qoq3-6681-n5qoq07n3n6r@> References: List-Id: Packaging the FreeBSD base system List-Archive: https://lists.freebsd.org/archives/freebsd-pkgbase List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pkgbase@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:17403, ipnet:209.237.0.0/18, country:US] X-Rspamd-Queue-Id: 4gqVxh2J3Gz3cb3 X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated On Tue, 30 Jun 2026, Alexander Ziaee wrote: >> the *.pkgnew and *.pkgsave files as they seem a bit less intuitive >> than on the other platforms. For some it may be natural to go looking >> for these leftover telltales but they may represent important but >> neglected potential time-bombs for the less familiar. > > OpenVMS and Linux do create these files. OpenVMS increments the version > (;2 or ;3) or drops a TEMPLATE file. Linux uses .dpkg-dist and .dpkg-old > or .rpmnew and .rpmsave. However, it is a not a ticking time bomb, so > they do not tell you and you have not noticed. Any CVE-related .pkgsave is a ticking time bomb in so far as it unnecessarily increases the OS' attack surface. These files are not only easy to find but in the path (shell and lib). This is the similar to the installation and preservation of unused but vulnerable kernel modules (Linux' Dirty Frag et al: CVE-2026-43284, CVE-2026-43500, ...). IMO any Ops, SecOps or DevSecOps worth their salary will detect and encrypt or remove these files from their systems. Roger Marquis