Hi ports@,

Updated tarballs attached for all four ports, refreshed to the current
upstream releases: serialize 1.6.0, reliable 1.4.0, netcode 1.4.3,
yojimbo 1.9.1.

The main reason for the refresh is security. netcode 1.4.0 fixed an
AEAD nonce-reuse issue: a server stopped and restarted in the same
process re-emitted global packets (connection challenge / denied) at
already-used sequence numbers under the same server-to-client key, and
netcode uses the packet sequence as the AEAD nonce — so a restart
voided confidentiality and integrity for those packets under
ChaCha20-Poly1305. The versions in my original submission (netcode
1.3.5, yojimbo 1.6.3) predate the fix; the attached ones carry it.
Advisories, no CVE assigned:

  https://github.com/mas-bandwidth/netcode/security/advisories/GHSA-3x95-24j9-7448
  https://github.com/mas-bandwidth/yojimbo/security/advisories/GHSA-hqp3-fj6v-hrpc

Port changes are minimal: VERSION bumps, distinfo regenerated, and
SHARED_LIBS minor-bumped per policy (0.0 -> 0.1 on reliable and
netcode, 0.0 -> 0.2 on yojimbo, which has moved two upstream feature
releases since the original submission). No new files installed by any
of the four; serialize stays header-only with PKG_ARCH=*. All four
build and their full test suites pass on arm64 on both 7.9-release and
-current (8.0-beta snapshot) as of 9 August 2026 — makesum, build,
test, port-lib-depends-check and portcheck all clean, distfiles
re-fetched from upstream and re-verified during the run.

On the earlier question about open-source users: beyond the upstream
example programs and test suites that ship in each library, there are
active third-party open-source ports built on these wire protocols — a
native JAI port of yojimbo (github.com/dbechrd/jai-yojimbo, by a
yojimbo contributor) and a C# reliability implementation derived from
reliable (github.com/GlaireDaggers/ReliableNetcode.NET), among others.
Most shipped uses are commercial games, which is the nature of the
domain — but the protocol-conformance and fuzz coverage described
earlier is what I would point to for "works as intended" on OpenBSD.

Happy to iterate on anything. If the updated set looks OK I'd
appreciate a commit.

cheers

Glenn


On Sun, Jul 12, 2026 at 10:22 AM Glenn Fiedler <glenn@networknext.com> wrote:
>
> Hi ports@,
>
> Attached are four new ports for a family of BSD-3-licensed game networking
> libraries I develop and maintain upstream (https://github.com/mas-bandwidth).
> I'm the upstream author and happy to be MAINTAINER for all four.
>
> - devel/serialize -- header-only C++ bitpacking serializer (PKG_ARCH=*)
> - net/reliable -- reliability layer (acks, fragmentation, connection stats)
>   for UDP-based protocols, plain C
> - net/netcode -- secure client/server connections over UDP with connect-token
>   authentication; encrypts with libsodium (uses security/libsodium, not the
>   vendored copy)
> - net/yojimbo -- C++ client/server library for real-time multiplayer games,
>   built on the three above (builds against the installed packages, no vendored
>   code in the package)
>
> Dependency order: serialize, reliable and netcode are independent of each
> other; yojimbo needs all three. Closest existing port in spirit is net/enet.
>
> All four build from GitHub release tarballs with the devel/cmake module and
> BUILD_SHARED_LIBS. Upstream supports OpenBSD as of netcode 1.3.5 and yojimbo
> 1.6.3, so no port patches are needed. Each port runs the upstream test suite
> in the test target; all tests pass on arm64 on both 7.9-release and the
> July 10 2026 -current snapshot (ports tree from the same date). portcheck
> and port-lib-depends-check are clean, and a demo program builds and runs
> against the installed yojimbo package.
>
> Comments and testing welcome. If it looks OK I'd appreciate a commit.
>
> Thanks!
> Glenn Fiedler
> glenn@mas-bandwidth.com

• reliable.tgz (1K)
• yojimbo.tgz (1K)
• serialize.tgz (1K)
• netcode.tgz (1K)