thanks - just checking, are you happy this is ok with the most recent 
pledge commits?

-- 
  Sent from a phone, apologies for poor formatting.

On 27 March 2026 19:42:29 "Alvar Penning" <post@0x21.biz> wrote:

> Hi ports@,
> Hi Stuart,
>
> A diff to update net/icinga/icingadb to its latest release 1.5.1
> together with a small patch for pledge(2) and unveil(2) support follows.
>
> Best,
> Alvar
>
>
> diff --git Makefile Makefile
> index 204ee608d41..8e970d1d741 100644
> --- Makefile
> +++ Makefile
> @@ -1,7 +1,7 @@
> COMMENT= configuration and state database for Icinga
>
> GH_PROJECT= icingadb
> -GH_TAGNAME= v1.5.0
> +GH_TAGNAME= v1.5.1
>
> MODGO_MODNAME= github.com/icinga/icingadb
> MODGO_VERSION= ${GH_TAGNAME}
> @@ -18,6 +18,9 @@ MODULES= lang/go
>
> .include "modules.inc"
>
> +# for patches to apply
> +WRKDIST = ${WRKSRC}
> +
> post-install:
>  ${INSTALL_DATA_DIR} ${PREFIX}/share/doc/icingadb/markdown
>  ${INSTALL_DATA} ${WRKSRC}/{AUTHORS,LICENSE,*.md} ${PREFIX}/share/doc/icingadb
> diff --git distinfo distinfo
> index 89bca181e4f..35d7cce3e8d 100644
> --- distinfo
> +++ distinfo
> @@ -38,8 +38,8 @@ SHA256 
> (go_modules/github.com/google/go-cmp/@v/v0.7.0.mod) = Mch0odKhjmKwVQ+CPOe
> SHA256 (go_modules/github.com/google/go-cmp/@v/v0.7.0.zip) = 
> ZKnOBG8sMg43g/ug0fShX4oY8LAJtnvyf3YwkZ2z9Tk=
> SHA256 (go_modules/github.com/google/uuid/@v/v1.6.0.mod) = 
> c9pHtjOLAKCC/UUao1oyc9OtwJuOm7qY2rAQkeQCr24=
> SHA256 (go_modules/github.com/google/uuid/@v/v1.6.0.zip) = 
> 0PAvN3IX9CcC4lloTgZEHtv1FA3dzDS6m+pWA4s4pu0=
> -SHA256 (go_modules/github.com/icinga/icinga-go-library/@v/v0.8.1.mod) = 
> TuBy+Tlxexr7Zaw8o3K8RRWunQx3rkzixq9qDRaDTeQ=
> -SHA256 (go_modules/github.com/icinga/icinga-go-library/@v/v0.8.1.zip) = 
> FgJRtm+KhVjJsmXmzllXmh45ZvPh6fSnmaVRrIuIxCU=
> +SHA256 (go_modules/github.com/icinga/icinga-go-library/@v/v0.8.2.mod) = 
> 62kZelhlLe0QB3ERRyX7e2NIxWW2FbX/t4YsfgvbBwU=
> +SHA256 (go_modules/github.com/icinga/icinga-go-library/@v/v0.8.2.zip) = 
> fyA6SxKRwcqi0ezK8q8uG9XaBgPV6m65fGhdg4lAcYc=
> SHA256 (go_modules/github.com/jessevdk/go-flags/@v/v1.6.1.mod) = 
> XXfNPd0IYZ25q3vITtJAlbDicioz7d4iGzJlEMKwH/w=
> SHA256 (go_modules/github.com/jessevdk/go-flags/@v/v1.6.1.zip) = 
> I97Ou1pRFK8aaH++1k1qZ08el25wsrTNwn9S0LAgy0s=
> SHA256 (go_modules/github.com/jmoiron/sqlx/@v/v1.4.0.mod) = 
> TK1YPczEsJNGdNt/yFycLDIu5YeTNmhgqupYL2WRmU0=
> @@ -66,8 +66,8 @@ SHA256 (go_modules/github.com/pkg/errors/@v/v0.9.1.mod) = 
> 3yjGqCPxgddheWlxd8DFlD
> SHA256 (go_modules/github.com/pkg/errors/@v/v0.9.1.zip) = 
> 1MNri80GFikKORMhXg9TuTG9bgBnBZbylg3xtEryvQc=
> SHA256 (go_modules/github.com/pmezard/go-difflib/@v/v1.0.0.mod) = 
> dLLnZushU3eGTVh7rfV+lVIfaS0qeGCzx3WQk/nJvsI=
> SHA256 (go_modules/github.com/pmezard/go-difflib/@v/v1.0.0.zip) = 
> 3gTOzBpLjVPkNXBRAmeUvLxU8uaiYM+sUIzmnV1kV6A=
> -SHA256 (go_modules/github.com/redis/go-redis/v9/@v/v9.16.0.mod) = 
> bVq+RIntf4jVi2SnFPH2zfBcKeRzKyNMMocJK0LzJrg=
> -SHA256 (go_modules/github.com/redis/go-redis/v9/@v/v9.16.0.zip) = 
> 6/q95nlTIIKBKBCdXNiwrhNvyTnzNSYbFgK725Mhalw=
> +SHA256 (go_modules/github.com/redis/go-redis/v9/@v/v9.17.2.mod) = 
> bVq+RIntf4jVi2SnFPH2zfBcKeRzKyNMMocJK0LzJrg=
> +SHA256 (go_modules/github.com/redis/go-redis/v9/@v/v9.17.2.zip) = 
> tu9N6wgWD5rO+KrMK3g47iQkBFzRyrGq0oZoT4/b+wE=
> SHA256 (go_modules/github.com/rivo/uniseg/@v/v0.1.0.mod) = 
> bHMYonqNVHOo62YedfsAUoF24O/FkxDtJ3yhO9EqU/E=
> SHA256 (go_modules/github.com/rivo/uniseg/@v/v0.2.0.mod) = 
> bHMYonqNVHOo62YedfsAUoF24O/FkxDtJ3yhO9EqU/E=
> SHA256 (go_modules/github.com/rivo/uniseg/@v/v0.2.0.zip) = 
> MZnZS+UChBQiIGYso7AOGd3R3r5OgN3HRf9CA+y2AcA=
> @@ -86,8 +86,8 @@ SHA256 (go_modules/go.uber.org/goleak/@v/v1.3.0.zip) = 
> cO3vDOfYMNmS8CTlJ/00Ugabi
> SHA256 (go_modules/go.uber.org/multierr/@v/v1.10.0.mod) = 
> WKMN3nMKuldXZxXZCEF3T2NEqHn+xWM6LGazfsMMEfA=
> SHA256 (go_modules/go.uber.org/multierr/@v/v1.11.0.mod) = 
> WKMN3nMKuldXZxXZCEF3T2NEqHn+xWM6LGazfsMMEfA=
> SHA256 (go_modules/go.uber.org/multierr/@v/v1.11.0.zip) = 
> Ikm10v3OYfbuZhpnnYVSWZrwhKdhy7yHHad2Qb3c4MM=
> -SHA256 (go_modules/go.uber.org/zap/@v/v1.27.0.mod) = 
> rYBZREWaFDYO6wZ3t8b8T/ep2oD7A3ZK+n2RzwLihcc=
> -SHA256 (go_modules/go.uber.org/zap/@v/v1.27.0.zip) = 
> uZS5b/C7UEo9WCiKuIufPGYEaJ6hr7adJbUJdpcFpsI=
> +SHA256 (go_modules/go.uber.org/zap/@v/v1.27.1.mod) = 
> rYBZREWaFDYO6wZ3t8b8T/ep2oD7A3ZK+n2RzwLihcc=
> +SHA256 (go_modules/go.uber.org/zap/@v/v1.27.1.zip) = 
> OHYCJxQtODaQaTdMAFcHvGs8Jwp180+j8XxIyGMUPNw=
> SHA256 (go_modules/golang.org/x/crypto/@v/v0.28.0.mod) = 
> hn0KUX9LRzf6NCERYOtqiNt+Qjne9HIYFrA+dB2+rPU=
> SHA256 (go_modules/golang.org/x/crypto/@v/v0.28.0.zip) = 
> lZrL41FEMMLACdyT8n5B3a1P7heKTGgMdTvAm10ud9A=
> SHA256 
> (go_modules/golang.org/x/exp/@v/v0.0.0-20240506185415-9bf2ced13842.mod) = 
> 5Bjsbat5ooeOZoZlE8Yfh7+BePhfy3h1Zwjv1jVYDKA=
> @@ -96,8 +96,8 @@ SHA256 (go_modules/golang.org/x/mod/@v/v0.17.0.mod) = 
> XErAMQolMwdXA5zPOpjnX+/by3
> SHA256 (go_modules/golang.org/x/mod/@v/v0.17.0.zip) = 
> py/lt5VUqJk9+VEtBeI3kI060LSAAcGrkrf6Uzns9EA=
> SHA256 (go_modules/golang.org/x/net/@v/v0.30.0.mod) = 
> cyMeKp5Xhgaj/n4ODJP/qWMavCAh96v6RCWGA4ZpCW8=
> SHA256 (go_modules/golang.org/x/net/@v/v0.30.0.zip) = 
> w1e3ec3AjQlS97rUxFzoQiO3xgBdd1gioXkBro9lu7o=
> -SHA256 (go_modules/golang.org/x/sync/@v/v0.18.0.mod) = 
> 0zPFS3SviguOx0jTfFly0nudCIueRci/XDq1INIRMJA=
> -SHA256 (go_modules/golang.org/x/sync/@v/v0.18.0.zip) = 
> k5oaVzzYPfVoNrY3BSpF9qYPeLhqWjdfwMbCmKhooU0=
> +SHA256 (go_modules/golang.org/x/sync/@v/v0.19.0.mod) = 
> 0zPFS3SviguOx0jTfFly0nudCIueRci/XDq1INIRMJA=
> +SHA256 (go_modules/golang.org/x/sync/@v/v0.19.0.zip) = 
> JSEf4s/9gCC7QFua23qQ9eBnYPKBi4+y50qqohpm7Z4=
> SHA256 (go_modules/golang.org/x/sync/@v/v0.7.0.mod) = 
> cA5dsA3SaqGaF9zl/FUkNtYPaMVgbIW4IfJMPWByoVE=
> SHA256 
> (go_modules/golang.org/x/sys/@v/v0.0.0-20210514084401-e8d321eab015.mod) = 
> 8DMzMJb+GY8xUd7tk/LeunTlC7/nc5E0BFvDt85KUCQ=
> SHA256 
> (go_modules/golang.org/x/sys/@v/v0.0.0-20220811171246-fbc7d0a398ab.mod) = 
> 8DMzMJb+GY8xUd7tk/LeunTlC7/nc5E0BFvDt85KUCQ=
> @@ -114,7 +114,7 @@ SHA256 
> (go_modules/gopkg.in/check.v1/@v/v0.0.0-20161208181325-20d25e280405.mod)
> SHA256 
> (go_modules/gopkg.in/check.v1/@v/v0.0.0-20161208181325-20d25e280405.zip) = 
> ThgX+WTKNOVFuBr9oDJaXonPWN4uQT2CB8Cv3dD9wVw=
> SHA256 (go_modules/gopkg.in/yaml.v3/@v/v3.0.1.mod) = 
> IVeYYKIDBvz0OxvSNNH7oxlJnHdhG3HAX5vzupDauTk=
> SHA256 (go_modules/gopkg.in/yaml.v3/@v/v3.0.1.zip) = 
> qrj7xOYwDqCOav4crqGKIckMefSJ9SxT4vIEMfGpoBU=
> -SHA256 (icingadb-1.5.0.zip) = sXqboDonPhhP1sNA9p9sIxdzAHa4cPjzPs/zet8Vtr4=
> +SHA256 (icingadb-1.5.1.zip) = tDQbm5nIRuP21PS8J9VwvbN1gxdLHSOpEpF957IWOlI=
> SIZE (go_modules/filippo.io/edwards25519/@v/v1.1.0.mod) = 40
> SIZE (go_modules/filippo.io/edwards25519/@v/v1.1.0.zip) = 55809
> SIZE (go_modules/github.com/!vivid!cortex/ewma/@v/v1.2.0.mod) = 44
> @@ -155,8 +155,8 @@ SIZE 
> (go_modules/github.com/google/go-cmp/@v/v0.7.0.mod) = 41
> SIZE (go_modules/github.com/google/go-cmp/@v/v0.7.0.zip) = 130179
> SIZE (go_modules/github.com/google/uuid/@v/v1.6.0.mod) = 30
> SIZE (go_modules/github.com/google/uuid/@v/v1.6.0.zip) = 31981
> -SIZE (go_modules/github.com/icinga/icinga-go-library/@v/v0.8.1.mod) = 1245
> -SIZE (go_modules/github.com/icinga/icinga-go-library/@v/v0.8.1.zip) = 130783
> +SIZE (go_modules/github.com/icinga/icinga-go-library/@v/v0.8.2.mod) = 1245
> +SIZE (go_modules/github.com/icinga/icinga-go-library/@v/v0.8.2.zip) = 130821
> SIZE (go_modules/github.com/jessevdk/go-flags/@v/v1.6.1.mod) = 79
> SIZE (go_modules/github.com/jessevdk/go-flags/@v/v1.6.1.zip) = 78585
> SIZE (go_modules/github.com/jmoiron/sqlx/@v/v1.4.0.mod) = 157
> @@ -183,8 +183,8 @@ SIZE (go_modules/github.com/pkg/errors/@v/v0.9.1.mod) = 29
> SIZE (go_modules/github.com/pkg/errors/@v/v0.9.1.zip) = 17866
> SIZE (go_modules/github.com/pmezard/go-difflib/@v/v1.0.0.mod) = 37
> SIZE (go_modules/github.com/pmezard/go-difflib/@v/v1.0.0.zip) = 12433
> -SIZE (go_modules/github.com/redis/go-redis/v9/@v/v9.16.0.mod) = 635
> -SIZE (go_modules/github.com/redis/go-redis/v9/@v/v9.16.0.zip) = 584449
> +SIZE (go_modules/github.com/redis/go-redis/v9/@v/v9.17.2.mod) = 635
> +SIZE (go_modules/github.com/redis/go-redis/v9/@v/v9.17.2.zip) = 5104265
> SIZE (go_modules/github.com/rivo/uniseg/@v/v0.1.0.mod) = 39
> SIZE (go_modules/github.com/rivo/uniseg/@v/v0.2.0.mod) = 39
> SIZE (go_modules/github.com/rivo/uniseg/@v/v0.2.0.zip) = 45731
> @@ -203,8 +203,8 @@ SIZE (go_modules/go.uber.org/goleak/@v/v1.3.0.zip) = 37573
> SIZE (go_modules/go.uber.org/multierr/@v/v1.10.0.mod) = 228
> SIZE (go_modules/go.uber.org/multierr/@v/v1.11.0.mod) = 228
> SIZE (go_modules/go.uber.org/multierr/@v/v1.11.0.zip) = 25681
> -SIZE (go_modules/go.uber.org/zap/@v/v1.27.0.mod) = 312
> -SIZE (go_modules/go.uber.org/zap/@v/v1.27.0.zip) = 287887
> +SIZE (go_modules/go.uber.org/zap/@v/v1.27.1.mod) = 312
> +SIZE (go_modules/go.uber.org/zap/@v/v1.27.1.zip) = 289619
> SIZE (go_modules/golang.org/x/crypto/@v/v0.28.0.mod) = 190
> SIZE (go_modules/golang.org/x/crypto/@v/v0.28.0.zip) = 1790287
> SIZE 
> (go_modules/golang.org/x/exp/@v/v0.0.0-20240506185415-9bf2ced13842.mod) = 179
> @@ -213,8 +213,8 @@ SIZE (go_modules/golang.org/x/mod/@v/v0.17.0.mod) = 84
> SIZE (go_modules/golang.org/x/mod/@v/v0.17.0.zip) = 165172
> SIZE (go_modules/golang.org/x/net/@v/v0.30.0.mod) = 155
> SIZE (go_modules/golang.org/x/net/@v/v0.30.0.zip) = 1842318
> -SIZE (go_modules/golang.org/x/sync/@v/v0.18.0.mod) = 36
> -SIZE (go_modules/golang.org/x/sync/@v/v0.18.0.zip) = 25708
> +SIZE (go_modules/golang.org/x/sync/@v/v0.19.0.mod) = 36
> +SIZE (go_modules/golang.org/x/sync/@v/v0.19.0.zip) = 25714
> SIZE (go_modules/golang.org/x/sync/@v/v0.7.0.mod) = 34
> SIZE 
> (go_modules/golang.org/x/sys/@v/v0.0.0-20210514084401-e8d321eab015.mod) = 33
> SIZE 
> (go_modules/golang.org/x/sys/@v/v0.0.0-20220811171246-fbc7d0a398ab.mod) = 33
> @@ -231,4 +231,4 @@ SIZE 
> (go_modules/gopkg.in/check.v1/@v/v0.0.0-20161208181325-20d25e280405.mod) =
> SIZE 
> (go_modules/gopkg.in/check.v1/@v/v0.0.0-20161208181325-20d25e280405.zip) = 
> 39844
> SIZE (go_modules/gopkg.in/yaml.v3/@v/v3.0.1.mod) = 95
> SIZE (go_modules/gopkg.in/yaml.v3/@v/v3.0.1.zip) = 104623
> -SIZE (icingadb-1.5.0.zip) = 3370896
> +SIZE (icingadb-1.5.1.zip) = 3371200
> diff --git modules.inc modules.inc
> index b685a740c69..7d91dbdb84b 100644
> --- modules.inc
> +++ modules.inc
> @@ -18,7 +18,7 @@ MODGO_MODULES = \
>  github.com/goccy/go-yaml v1.13.0 \
>  github.com/google/go-cmp v0.7.0 \
>  github.com/google/uuid v1.6.0 \
> - github.com/icinga/icinga-go-library v0.8.1 \
> + github.com/icinga/icinga-go-library v0.8.2 \
>  github.com/jessevdk/go-flags v1.6.1 \
>  github.com/jmoiron/sqlx v1.4.0 \
>  github.com/kr/text v0.2.0 \
> @@ -31,7 +31,7 @@ MODGO_MODULES = \
>  github.com/okzk/sdnotify v0.0.0-20180710141335-d9becc38acbd \
>  github.com/pkg/errors v0.9.1 \
>  github.com/pmezard/go-difflib v1.0.0 \
> - github.com/redis/go-redis/v9 v9.16.0 \
> + github.com/redis/go-redis/v9 v9.17.2 \
>  github.com/rivo/uniseg v0.2.0 \
>  github.com/ssgreg/journald v1.0.0 \
>  github.com/stretchr/objx v0.5.2 \
> @@ -39,12 +39,12 @@ MODGO_MODULES = \
>  github.com/vbauerster/mpb/v6 v6.0.4 \
>  go.uber.org/goleak v1.3.0 \
>  go.uber.org/multierr v1.11.0 \
> - go.uber.org/zap v1.27.0 \
> + go.uber.org/zap v1.27.1 \
>  golang.org/x/crypto v0.28.0 \
>  golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 \
>  golang.org/x/mod v0.17.0 \
>  golang.org/x/net v0.30.0 \
> - golang.org/x/sync v0.18.0 \
> + golang.org/x/sync v0.19.0 \
>  golang.org/x/sys v0.26.0 \
>  golang.org/x/text v0.19.0 \
>  golang.org/x/tools v0.21.0 \
> diff --git patches/patch-cmd_icingadb_main_go 
> patches/patch-cmd_icingadb_main_go
> new file mode 100644
> index 00000000000..846d0acbaab
> --- /dev/null
> +++ patches/patch-cmd_icingadb_main_go
> @@ -0,0 +1,21 @@
> +Index: cmd/icingadb/main.go
> +--- cmd/icingadb/main.go.orig
> ++++ cmd/icingadb/main.go
> +@@ -39,6 +39,8 @@ func main() {
> + }
> +
> + func run() int {
> ++ initialPrivDrop()
> ++
> + cmd := command.New()
> +
> + logs, err := logging.NewLoggingFromConfig(utils.AppName(), 
> cmd.Config.Logging)
> +@@ -54,6 +56,8 @@ func run() int {
> + defer func() { _ = logger.Sync() }()
> +
> + logger.WithOptions(logs.ForceLog()).Infof("Starting Icinga DB daemon 
> (%s)", internal.Version.Version)
> ++
> ++ privDrop(cmd, logger)
> +
> + db, err := cmd.Database(logs.GetChildLogger("database"))
> + if err != nil {
> diff --git patches/patch-cmd_icingadb_openbsd_go 
> patches/patch-cmd_icingadb_openbsd_go
> new file mode 100644
> index 00000000000..839afae5168
> --- /dev/null
> +++ patches/patch-cmd_icingadb_openbsd_go
> @@ -0,0 +1,87 @@
> +Index: cmd/icingadb/openbsd.go
> +--- cmd/icingadb/openbsd.go.orig
> ++++ cmd/icingadb/openbsd.go
> +@@ -0,0 +1,83 @@
> ++package main
> ++
> ++import (
> ++ "fmt"
> ++ "maps"
> ++ "slices"
> ++ "strings"
> ++
> ++ "github.com/icinga/icinga-go-library/logging"
> ++ "github.com/icinga/icinga-go-library/utils"
> ++ "github.com/icinga/icingadb/internal/command"
> ++ "go.uber.org/zap"
> ++ "golang.org/x/sys/unix"
> ++)
> ++
> ++// initialPrivDrop applies a first pledge(2) promise.
> ++//
> ++// This function should be called first in main to start with restricted
> ++// privileges. After parsing the configuration, privDrop should be called to
> ++// perform further restrictions.
> ++func initialPrivDrop() {
> ++ // all possible promises which can be used later in privDrop, plus unveil.
> ++ promises := "stdio rpath inet unix dns unveil error"
> ++ if err := unix.PledgePromises(promises); err != nil {
> ++ panic(fmt.Sprintf("initial pledge(2) failed, %q: %v", promises, err))
> ++ }
> ++}
> ++
> ++// privDrop should be called after parsing command.Command.
> ++func privDrop(c *command.Command, l *logging.Logger) {
> ++ pledgePromises := map[string]struct{}{
> ++ "stdio": struct{}{},
> ++ "inet":  struct{}{},
> ++ "dns":   struct{}{},
> ++ "error": struct{}{},
> ++ }
> ++
> ++ unveilPaths := map[string]string{
> ++ // Special paths for the "dns" pledge promise from before OpenBSD 7.9.
> ++ "/etc/resolv.conf": "r",
> ++ "/etc/hosts":       "r",
> ++ "/etc/services":    "r",
> ++ "/etc/protocols":   "r",
> ++ }
> ++
> ++ for _, host := range []string{c.Config.Database.Host, c.Config.Redis.Host} {
> ++ if !utils.IsUnixAddr(host) {
> ++ continue
> ++ }
> ++
> ++ pledgePromises["rpath"] = struct{}{}
> ++ pledgePromises["unix"] = struct{}{}
> ++ unveilPaths[host] = "rw"
> ++ }
> ++
> ++ if c.Flags.DatabaseAutoImport {
> ++ pledgePromises["rpath"] = struct{}{}
> ++ unveilPaths[c.Flags.DatabaseSchemaDir] = "r"
> ++ }
> ++
> ++ for path, permissions := range unveilPaths {
> ++ if err := unix.Unveil(path, permissions); err != nil {
> ++ l.Fatalw("Cannot unveil(2)",
> ++ zap.String("path", path),
> ++ zap.String("permissions", permissions),
> ++ zap.Error(err))
> ++ }
> ++ }
> ++ if err := unix.UnveilBlock(); err != nil {
> ++ l.Fatalw("Cannot block unveil(2)", zap.Error(err))
> ++ }
> ++
> ++ promises := strings.Join(slices.Collect(maps.Keys(pledgePromises)), " ")
> ++ if err := unix.PledgePromises(promises); err != nil {
> ++ l.Fatalw("Cannot pledge(2)",
> ++ zap.String("promises", promises),
> ++ zap.Error(err))
> ++ }
> ++
> ++ l.Infow("Dropped privileges with pledge(2) and unveil(2)",
> ++ zap.String("pledge", promises),
> ++ zap.Any("unveil", unveilPaths))
> ++}