David Uhden Collado wrote:
> David Uhden Collado wrote:
>> David Uhden Collado wrote:
>>> Hello,
>>>
>>> Please find attached a patch that updates security/veracrypt from
>>> version 1.25.9 to 1.26.29.
>>>
>>> The upstream release notes and full comparison are available at:
>>>
>>> https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29
>>> https://github.com/veracrypt/VeraCrypt/compare/ 
>>> VeraCrypt_1.25.9...VeraCrypt_1.26.29
>>>
>>> The 1.26 series contains a substantial number of security, portability
>>> and cryptographic improvements. Version 1.26.29 adds Argon2id as an
>>> alternative memory-hard KDF for non-system volumes, hardens the XML and
>>> TLV parsers against malformed input, and includes several fixes for CPU
>>> feature detection and optimized cryptographic implementations.
>>>
>>> The releases since 1.25.9 also add hardware acceleration improvements
>>> for SHA-256 and AES on supported x86 and ARM64 systems, update
>>> translations and documentation, and replace the old "dismount"
>>> terminology with "unmount".
>>>
>>> For the OpenBSD port, this update also contains several platform- 
>>> specific improvements.
>>>
>>> VeraCrypt no longer depends on security/sudo on OpenBSD. I added
>>> OpenBSD-specific privilege elevation support using the base system
>>> doas(1). Since doas reads authentication input from its controlling
>>> terminal rather than stdin, VeraCrypt creates a private pseudoterminal
>>> and forwards the password entered through its user interface to doas
>>> without placing it on the command line or in the environment.
>>>
>>> A pkg-readme documents the required doas.conf rule and explains the
>>> privileged operations performed by VeraCrypt, including vnd(4) setup,
>>> filesystem mounting and formatting.
>>>
>>> I also added native OpenBSD FFS support when creating volumes. FFS can
>>> now be selected from the graphical and text interfaces or explicitly
>>> with:
>>>
>>> --filesystem=FFS
>>>
>>> VeraCrypt invokes /sbin/newfs on the raw rvnd(4) character device when
>>> formatting the new filesystem. Non-interactive volume creation keeps FAT
>>> as the default so existing scripts do not unexpectedly require
>>> privilege elevation.
>>>
>>> The port also gains security/pcsc-lite support required by the current
>>> upstream smart-card code.
>>>
>>> There are two small build portability patches related to upstream's
>>> reproducible-build support. One makes the source_date_epoch.sh awk code
>>> compatible with OpenBSD awk, and another corrects an upstream release
>>> date mismatch so the generated SOURCE_DATE_EPOCH can be calculated
>>> properly.
>>>
>>> The existing Makefile patch has been refreshed for the current build
>>> system and Argon2 sources while continuing to preserve the compiler and
>>> linker flags supplied by the ports infrastructure.
>>>
>>> The old OpenBSD vndconfig "-c" patch has been removed because that
>>> change is already present upstream.
>>>
>>> Finally, the desktop file has been refreshed for the current upstream
>>> version, the icon has changed from XPM to PNG, pkg/PLIST has been
>>> updated, and distinfo has been regenerated for the 1.26.29 source
>>> archive.
>>>
>>> Thank you for your time and consideration.
>>>
>>> Best regards,
>>> David.
>>
>> Hello,
>>
>> sysutils/coreutils is not a runtime dependency of VeraCrypt.
>>
>> I checked the code paths used at runtime, and they only invoke tools
>> provided either by the base system or by explicit ports dependencies.
>> On OpenBSD these include /sbin/vndconfig for attaching and detaching vnd
>> devices, /sbin/newfs for FFS, mount, umount, fsck and doas. The actual
>> RUN_DEPENDS are therefore:
>>
>>      devel/desktop-file-utils
>>      security/pcsc-lite
>>
>> There is no GNU utility used at runtime.
>>
>> sysutils/coreutils was historically present in BUILD_DEPENDS because
>> VeraCrypt 1.25.9 had this in src/Build/Include/Makefile.inc:
>>
>>      ifeq "$(PLATFORM)" "OpenBSD"
>>      OD_BIN := ggod -v -t u1 -A n
>>      else
>>      OD_BIN := od -v -t u1 -A n
>>      endif
>>
>> "ggod" is the GNU od installed by sysutils/coreutils on OpenBSD. The
>> port builds coreutils with a "g" prefix and additionally renames god to
>> ggod to avoid a name conflict.
>>
>> OD_BIN is only used while building embedded resources such as the
>> generated *.xml.h, *.txt.h and *.bmp.h files, so coreutils was a build
>> dependency rather than a runtime dependency.
>>
>> This is no longer necessary with VeraCrypt 1.26.29. The current
>> src/Build/Include/Makefile.inc uses:
>>
>>      ifeq "$(PLATFORM)" "OpenBSD"
>>      OD_BIN := hexdump -v -e '1/1 "%u "'
>>      else
>>      OD_BIN := od -v -t u1 -A n
>>      endif
>>
>> hexdump is part of the OpenBSD base system, so sysutils/coreutils is now
>> just a leftover dependency from the older port.
>>
>> There are some other GNU-specific commands in upstream build/install
>> rules, such as:
>>
>>      touch --no-dereference --date=@...
>>      tar --sort=... --mtime=@...
>>      readlink -f
>>
>> but the OpenBSD port uses an empty ALL_TARGET and its own do-install
>> target, so the install/package paths containing those commands are not
>> executed. The relevant upstream checks are also probes which fall back
>> when those features are unavailable.
>>
>> I've therefore removed sysutils/coreutils from BUILD_DEPENDS in the
>> revised patch.
>>
>> Thanks,
>> David.
> ping

The maintainer isn't responding because their email address is 
unreachable. I should clean up the license markers and add explanatory 
comments to the remaining patches, but I'm leaving it as it is for now 
because this is urgent.

The reality is that some people genuinely depend on this tool to keep 
their data secure across different platforms, and it's completely 
unacceptable that an outdated version with known security 
vulnerabilities is still being built and distributed.

Support for FFS and doas can be left for later, once there are people 
willing to actually test those changes. But at least update the base 
version.