Index: security/veracrypt/Makefile =================================================================== RCS file: /cvs/ports/security/veracrypt/Makefile,v diff -u -p -u -p -r1.8 Makefile --- security/veracrypt/Makefile 17 Dec 2024 05:49:59 -0000 1.8 +++ security/veracrypt/Makefile 19 Sep 2026 17:28:33 -0000 @@ -2,12 +2,11 @@ BROKEN-sparc64= relocation truncated to COMMENT= free open source disk encryption software -V= 1.25.9 +V= 1.26.29 DISTNAME= VeraCrypt_${V}_Source PKGNAME= veracrypt-${V} CATEGORIES= security HOMEPAGE= https://www.veracrypt.fr/ -REVISION= 1 MAINTAINER= Tietoturvamies @@ -18,7 +17,7 @@ SITES= https://launchpad.net/veracrypt EXTRACT_SUFX= .tar.bz2 FIX_EXTRACT_PERMISSIONS=Yes -# C++11 +# C++14 COMPILER= base-clang ports-gcc CXXFLAGS_base-clang = -std=c++14 @@ -26,12 +25,13 @@ CXXFLAGS_base-clang = -std=c++14 WANTLIB += ${COMPILER_LIBCXX} c m fuse wx_baseu-3.2 wx_gtk3u_core-3.2 BUILD_DEPENDS= devel/yasm \ + security/pcsc-lite \ sysutils/coreutils LIB_DEPENDS= x11/wxWidgets RUN_DEPENDS= devel/desktop-file-utils \ - security/sudo + security/pcsc-lite WRKDIST= ${WRKDIR}/src USE_GMAKE= Yes @@ -58,7 +58,7 @@ do-install: ${INSTALL_DATA} ${WRKSRC}/Setup/FreeBSD/veracrypt.desktop \ ${PREFIX}/share/applications ${INSTALL_DATA_DIR} ${PREFIX}/share/pixmaps/ - ${INSTALL_DATA} ${WRKSRC}/Resources/Icons/VeraCrypt-48x48.xpm \ - ${PREFIX}/share/pixmaps/veracrypt.xpm + ${INSTALL_DATA} ${WRKSRC}/Resources/Icons/VeraCrypt-48x48.png \ + ${PREFIX}/share/pixmaps/veracrypt.png .include Index: security/veracrypt/distinfo =================================================================== RCS file: /cvs/ports/security/veracrypt/distinfo,v diff -u -p -u -p -r1.2 distinfo --- security/veracrypt/distinfo 14 Mar 2022 11:07:46 -0000 1.2 +++ security/veracrypt/distinfo 19 Sep 2026 17:28:33 -0000 @@ -1,2 +1,2 @@ -SHA256 (VeraCrypt_1.25.9_Source.tar.bz2) = drbhgYS8IaQdKUn/Y9ch1JBUpxbO/zpL13tcNRC3lK8= -SIZE (VeraCrypt_1.25.9_Source.tar.bz2) = 24438846 +SHA256 (VeraCrypt_1.26.29_Source.tar.bz2) = YIJnMeKYK0vSMeOTDoWkQ5EWljhnGhsgDFGPjItGyyo= +SIZE (VeraCrypt_1.26.29_Source.tar.bz2) = 36302144 Index: security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh =================================================================== RCS file: security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh diff -N security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/patches/patch-Build_Tools_source_date_epoch_sh 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,22 @@ +SPDX-License-Identifier: Apache-2.0 + +Continue the month_number ternary expression explicitly: OpenBSD's awk +does not accept a bare newline after ':' as a line continuation, so the +release date could not be derived from Common/Tcdefs.h. + +Index: Build/Tools/source_date_epoch.sh +--- Build/Tools/source_date_epoch.sh.orig ++++ Build/Tools/source_date_epoch.sh +@@ -60,9 +60,9 @@ + RELEASE_EPOCH=$(awk ' + function leap(y) { return ((y % 4 == 0 && y % 100 != 0) || (y % 400 == 0)) } + function month_number(name) { +- return (name == "January" ? 1 : name == "February" ? 2 : name == "March" ? 3 : +- name == "April" ? 4 : name == "May" ? 5 : name == "June" ? 6 : +- name == "July" ? 7 : name == "August" ? 8 : name == "September" ? 9 : ++ return (name == "January" ? 1 : name == "February" ? 2 : name == "March" ? 3 : \ ++ name == "April" ? 4 : name == "May" ? 5 : name == "June" ? 6 : \ ++ name == "July" ? 7 : name == "August" ? 8 : name == "September" ? 9 : \ + name == "October" ? 10 : name == "November" ? 11 : name == "December" ? 12 : 0); + } + function mdays(m, y) { return (m == 2 ? 28 + leap(y) : (m == 4 || m == 6 || m == 9 || m == 11 ? 30 : 31)) } Index: security/veracrypt/patches/patch-Common_Tcdefs_h =================================================================== RCS file: security/veracrypt/patches/patch-Common_Tcdefs_h diff -N security/veracrypt/patches/patch-Common_Tcdefs_h --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/patches/patch-Common_Tcdefs_h 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,18 @@ +SPDX-License-Identifier: Apache-2.0 + +Set TC_STR_RELEASE_DATE to June 9, 2026, matching TC_RELEASE_DATE_DAY +and the upstream "Set release date to June 9th 2026" commit. The awk +helper in Build/Tools/source_date_epoch.sh requires both dates to agree. + +Index: Common/Tcdefs.h +--- Common/Tcdefs.h.orig ++++ Common/Tcdefs.h +@@ -73,7 +73,7 @@ + #define VERSION_NUM 0x0126 + + // Release date +-#define TC_STR_RELEASE_DATE L"June 8, 2026" ++#define TC_STR_RELEASE_DATE L"June 9, 2026" + #define TC_RELEASE_DATE_YEAR 2026 + #define TC_RELEASE_DATE_MONTH 6 + #define TC_RELEASE_DATE_DAY 9 Index: security/veracrypt/patches/patch-Core_Unix_CoreService_cpp =================================================================== RCS file: security/veracrypt/patches/patch-Core_Unix_CoreService_cpp diff -N security/veracrypt/patches/patch-Core_Unix_CoreService_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/patches/patch-Core_Unix_CoreService_cpp 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,236 @@ +SPDX-License-Identifier: Apache-2.0 + +Index: Core/Unix/CoreService.cpp +--- Core/Unix/CoreService.cpp.orig ++++ Core/Unix/CoreService.cpp +@@ -14,6 +14,14 @@ + #include + #include + #include ++#ifdef TC_OPENBSD ++#include ++#include ++#include ++#include ++#include ++#include ++#endif + #include "Platform/FileStream.h" + #include "Platform/MemoryStream.h" + #include "Platform/Serializable.h" +@@ -28,6 +36,24 @@ + + namespace VeraCrypt + { ++#ifdef TC_OPENBSD ++ // doas(1) reads the password from its controlling terminal. A private ++ // pseudoterminal is used for that, so the elevated process does not need ++ // a terminal of its own and the password entered in the user interface ++ // can be forwarded without exposing it on the command line or in the ++ // environment. ++ static int DoasAuthTerminalFd = -1; ++ ++ static void CloseDoasAuthTerminal () ++ { ++ if (DoasAuthTerminalFd != -1) ++ { ++ close (DoasAuthTerminalFd); ++ DoasAuthTerminalFd = -1; ++ } ++ } ++#endif ++ + #ifdef TC_MACOSX + static bool IsMacOSXDevicePathWithPrefix (const string &path, const string &prefix) + { +@@ -149,6 +175,10 @@ + + void CoreService::ProcessRequests (int inputFD, int outputFD) + { ++#ifdef TC_OPENBSD ++ finally_do ({ CloseDoasAuthTerminal (); }); ++#endif ++ + try + { + Core = move_ptr(CoreDirect); +@@ -415,7 +445,11 @@ + // This approach also works on newer macOS versions (12.0 and later). + std::string errorMsg; + ++#ifdef TC_OPENBSD ++ string sudoAbsolutePath = Process::FindSystemBinary("doas", errorMsg); ++#else + string sudoAbsolutePath = Process::FindSystemBinary("sudo", errorMsg); ++#endif + if (sudoAbsolutePath.empty()) + throw SystemException(SRC_POS, errorMsg); + +@@ -507,6 +541,36 @@ + + void CoreService::StartElevated (const CoreServiceRequest &request) + { ++#ifdef TC_OPENBSD ++ CloseDoasAuthTerminal(); ++ ++ int authTerminalFd = -1; ++ string authTerminalPath; ++ bool authTerminalKept = false; ++ ++ finally_do_arg2 (int *, &authTerminalFd, bool *, &authTerminalKept, ++ { ++ if (!*finally_arg2 && *finally_arg != -1) ++ { ++ close (*finally_arg); ++ *finally_arg = -1; ++ } ++ }); ++ ++ if (!request.FastElevation) ++ { ++ authTerminalFd = posix_openpt (O_RDWR | O_NOCTTY); ++ throw_sys_sub_if (authTerminalFd == -1, "posix_openpt"); ++ throw_sys_if (fcntl (authTerminalFd, F_SETFD, FD_CLOEXEC) == -1); ++ throw_sys_if (grantpt (authTerminalFd) == -1); ++ throw_sys_if (unlockpt (authTerminalFd) == -1); ++ ++ char *slavePath = ptsname (authTerminalFd); ++ throw_sys_sub_if (slavePath == nullptr, "ptsname"); ++ authTerminalPath = slavePath; ++ } ++#endif ++ + unique_ptr inPipe (new Pipe()); + unique_ptr outPipe (new Pipe()); + Pipe errPipe; +@@ -522,7 +586,11 @@ + { + // Throw exception if sudo is not found in secure locations + std::string errorMsg; ++#ifdef TC_OPENBSD ++ string sudoPath = Process::FindSystemBinary("doas", errorMsg); ++#else + string sudoPath = Process::FindSystemBinary("sudo", errorMsg); ++#endif + if (sudoPath.empty()) + throw SystemException(SRC_POS, errorMsg); + +@@ -551,7 +619,51 @@ + throw_sys_if (dup2 (outPipe->GetWriteFD(), STDOUT_FILENO) == -1); + throw_sys_if (dup2 (errPipe.GetWriteFD(), STDERR_FILENO) == -1); + ++#ifdef TC_OPENBSD ++ const char *args[8]; ++ ++ if (!authTerminalPath.empty()) ++ { ++ throw_sys_if (setsid () == -1); ++ ++ int authFd = open (authTerminalPath.c_str(), O_RDWR); ++ throw_sys_sub_if (authFd == -1, authTerminalPath); ++ ++ // Keep the admin password out of the terminal echo. ++ struct termios tios; ++ if (tcgetattr (authFd, &tios) == 0) ++ { ++ tios.c_lflag &= ~(ICANON | ECHO | ECHOE | ECHOK | ECHONL | ISIG | IEXTEN); ++ tios.c_iflag &= ~(BRKINT | ISTRIP | INLCR | IGNCR | ICRNL | IXON); ++ tios.c_cc[VMIN] = 1; ++ tios.c_cc[VTIME] = 0; ++ tcsetattr (authFd, TCSANOW, &tios); ++ } ++ ++ if (ioctl (authFd, TIOCSCTTY, 0) == -1 && errno != EINVAL) ++ { ++ close (authFd); ++ throw SystemException (SRC_POS, "TIOCSCTTY"); ++ } ++ ++ close (authFd); ++ ++ args[0] = sudoPath.c_str(); ++ args[1] = appPath.c_str(); ++ args[2] = TC_CORE_SERVICE_CMDLINE_OPTION; ++ args[3] = nullptr; ++ } ++ else ++ { ++ args[0] = sudoPath.c_str(); ++ args[1] = "-n"; ++ args[2] = appPath.c_str(); ++ args[3] = TC_CORE_SERVICE_CMDLINE_OPTION; ++ args[4] = nullptr; ++ } ++#else + const char *args[] = { sudoPath.c_str(), "-S", "-p", "", appPath.c_str(), TC_CORE_SERVICE_CMDLINE_OPTION, nullptr }; ++#endif + execvp (args[0], ((char* const*) args)); + throw SystemException (SRC_POS, args[0]); + } +@@ -601,7 +713,17 @@ + #if defined(TC_LINUX ) + Thread::Sleep (1000); // wait 1 second for the forked sudo to start + #endif ++#ifdef TC_OPENBSD ++ if (authTerminalFd != -1) ++ { ++ // Give doas(1) time to open its authentication terminal, then ++ // forward the admin password obtained by the user interface. ++ Thread::Sleep (1000); ++ if (write (authTerminalFd, &adminPassword.front(), adminPassword.size())) { } // Errors ignored ++ } ++#else + if (write (inPipe->GetWriteFD(), &adminPassword.front(), adminPassword.size())) { } // Errors ignored ++#endif + + burn (&adminPassword.front(), adminPassword.size()); + +@@ -667,7 +789,11 @@ + Thread thread; + thread.Start (new WaitFunctor (forkedPid)); + ++#ifdef TC_OPENBSD ++ throw ElevationFailed (SRC_POS, "doas", 1, ""); ++#else + throw ElevationFailed (SRC_POS, "sudo", 1, ""); ++#endif + } + + waitRes = waitpid (forkedPid, &status, 0); +@@ -700,11 +826,18 @@ + if (!errOutput.empty()) + strErrOutput.insert (strErrOutput.begin(), errOutput.begin(), errOutput.end()); + ++#ifdef TC_OPENBSD ++ if (strErrOutput.find (" tty") != string::npos) ++ strErrOutput += "\nTo allow VeraCrypt to elevate privileges, add an appropriate rule for it to '/etc/doas.conf'."; ++ ++ throw ElevationFailed (SRC_POS, "doas", exitCode, strErrOutput); ++#else + // sudo may require a tty even if -S is used + if (strErrOutput.find (" tty") != string::npos) + strErrOutput += "\nTo enable use of 'sudo' by applications without a terminal window, please disable 'requiretty' option in '/etc/sudoers'. Newer versions of sudo automatically determine whether a terminal is required ('requiretty' option is obsolete)."; + + throw ElevationFailed (SRC_POS, "sudo", exitCode, strErrOutput); ++#endif + } + + throw_sys_if (fcntl (outPipe->GetReadFD(), F_SETFL, 0) == -1); +@@ -718,6 +851,17 @@ + + AdminInputPipe = move_ptr(inPipe); + AdminOutputPipe = move_ptr(outPipe); ++ ++#ifdef TC_OPENBSD ++ if (authTerminalFd != -1) ++ { ++ // Keep the authentication terminal open for the lifetime of the ++ // elevated service. Closing the master would hang up the service. ++ authTerminalKept = true; ++ DoasAuthTerminalFd = authTerminalFd; ++ authTerminalFd = -1; ++ } ++#endif + } + + void CoreService::Stop () Index: security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp =================================================================== RCS file: security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp diff -N security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp --- security/veracrypt/patches/patch-Core_Unix_OpenBSD_CoreOpenBSD_cpp 25 Nov 2022 11:21:44 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,14 +0,0 @@ -The -c option is no more. https://github.com/veracrypt/VeraCrypt/pull/1002 - -Index: Core/Unix/OpenBSD/CoreOpenBSD.cpp ---- Core/Unix/OpenBSD/CoreOpenBSD.cpp.orig -+++ Core/Unix/OpenBSD/CoreOpenBSD.cpp -@@ -69,8 +69,6 @@ namespace VeraCrypt - if (freeVnd == -1) - throw "couldn't find free vnd"; - -- args.push_back ("-c"); -- - stringstream freePath; - freePath << "vnd" << freeVnd; - args.push_back (freePath.str()); Index: security/veracrypt/patches/patch-Core_VolumeCreator_h =================================================================== RCS file: security/veracrypt/patches/patch-Core_VolumeCreator_h diff -N security/veracrypt/patches/patch-Core_VolumeCreator_h --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/patches/patch-Core_VolumeCreator_h 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,33 @@ +SPDX-License-Identifier: Apache-2.0 + +Index: Core/VolumeCreator.h +--- Core/VolumeCreator.h.orig ++++ Core/VolumeCreator.h +@@ -55,7 +55,8 @@ + Btrfs, + MacOsExt, + APFS, +- UFS ++ UFS, ++ FFS + }; + + static Enum GetPlatformNative () +@@ -68,6 +69,8 @@ + return VolumeCreationOptions::FilesystemType::MacOsExt; + #elif defined (TC_FREEBSD) || defined (TC_SOLARIS) + return VolumeCreationOptions::FilesystemType::UFS; ++#elif defined (TC_OPENBSD) ++ return VolumeCreationOptions::FilesystemType::FFS; + #else + return VolumeCreationOptions::FilesystemType::FAT; + #endif +@@ -90,6 +93,8 @@ + case VolumeCreationOptions::FilesystemType::APFS: return "newfs_apfs"; + #elif defined (TC_FREEBSD) || defined (TC_SOLARIS) + case VolumeCreationOptions::FilesystemType::UFS: return "newfs" ; ++ #elif defined (TC_OPENBSD) ++ case VolumeCreationOptions::FilesystemType::FFS: return "/sbin/newfs" ; + #endif + default: return NULL; + } Index: security/veracrypt/patches/patch-Main_CommandLineInterface_cpp =================================================================== RCS file: security/veracrypt/patches/patch-Main_CommandLineInterface_cpp diff -N security/veracrypt/patches/patch-Main_CommandLineInterface_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/patches/patch-Main_CommandLineInterface_cpp 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,15 @@ +SPDX-License-Identifier: Apache-2.0 + +Index: Main/CommandLineInterface.cpp +--- Main/CommandLineInterface.cpp.orig ++++ Main/CommandLineInterface.cpp +@@ -415,6 +415,9 @@ + ArgFilesystem = VolumeCreationOptions::FilesystemType::NTFS; + else if (str.IsSameAs (L"exFAT", false)) + ArgFilesystem = VolumeCreationOptions::FilesystemType::exFAT; ++#elif defined (TC_OPENBSD) ++ else if (str.IsSameAs (L"FFS", false)) ++ ArgFilesystem = VolumeCreationOptions::FilesystemType::FFS; + #endif + else + throw_err (LangString["UNKNOWN_OPTION"] + L": " + str); Index: security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp =================================================================== RCS file: security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp diff -N security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/patches/patch-Main_Forms_VolumeCreationWizard_cpp 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,19 @@ +SPDX-License-Identifier: Apache-2.0 + +Index: Main/Forms/VolumeCreationWizard.cpp +--- Main/Forms/VolumeCreationWizard.cpp.orig ++++ Main/Forms/VolumeCreationWizard.cpp +@@ -870,6 +870,13 @@ + if (!useElevatedAPFSFormatter) + PrepareMacOSXFormatterDevice (virtualDevice, changedDeviceOwners); + #else ++#ifdef TC_OPENBSD ++ // newfs(8) requires the raw character device; the block ++ // device exposed by the loop device driver cannot be used. ++ string virtualDeviceStr = virtualDevice; ++ if (virtualDeviceStr.find ("/dev/vnd") == 0) ++ virtualDevice = "/dev/r" + virtualDeviceStr.substr (5); ++#endif + UserId origDeviceOwner ((uid_t) -1); + + try Index: security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp =================================================================== RCS file: security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp diff -N security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/patches/patch-Main_Forms_VolumeFormatOptionsWizardPage_cpp 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,22 @@ +SPDX-License-Identifier: Apache-2.0 + +Index: Main/Forms/VolumeFormatOptionsWizardPage.cpp +--- Main/Forms/VolumeFormatOptionsWizardPage.cpp.orig ++++ Main/Forms/VolumeFormatOptionsWizardPage.cpp +@@ -52,6 +52,8 @@ + FilesystemTypeChoice->Append (L"APFS", (void *) VolumeCreationOptions::FilesystemType::APFS); + #elif defined (TC_FREEBSD) || defined (TC_SOLARIS) + FilesystemTypeChoice->Append (L"UFS", (void *) VolumeCreationOptions::FilesystemType::UFS); ++#elif defined (TC_OPENBSD) ++ FilesystemTypeChoice->Append (L"FFS", (void *) VolumeCreationOptions::FilesystemType::FFS); + #endif + + if (!disable32bitFilesystems && filesystemSize <= TC_MAX_FAT_SECTOR_COUNT * sectorSize) +@@ -94,6 +96,7 @@ + case VolumeCreationOptions::FilesystemType::MacOsExt: FilesystemTypeChoice->SetStringSelection (L"Mac OS Extended"); break; + case VolumeCreationOptions::FilesystemType::APFS: FilesystemTypeChoice->SetStringSelection (L"APFS"); break; + case VolumeCreationOptions::FilesystemType::UFS: FilesystemTypeChoice->SetStringSelection (L"UFS"); break; ++ case VolumeCreationOptions::FilesystemType::FFS: FilesystemTypeChoice->SetStringSelection (L"FFS"); break; + + default: + throw ParameterIncorrect (SRC_POS); Index: security/veracrypt/patches/patch-Main_TextUserInterface_cpp =================================================================== RCS file: security/veracrypt/patches/patch-Main_TextUserInterface_cpp diff -N security/veracrypt/patches/patch-Main_TextUserInterface_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/patches/patch-Main_TextUserInterface_cpp 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,42 @@ +SPDX-License-Identifier: Apache-2.0 + +Index: Main/TextUserInterface.cpp +--- Main/TextUserInterface.cpp.orig ++++ Main/TextUserInterface.cpp +@@ -930,7 +930,13 @@ + { + if (Preferences.NonInteractive) + { ++#ifdef TC_OPENBSD ++ // Preserve the historical OpenBSD batch default. Native FFS ++ // formatting requires elevation, so scripts should opt in. ++ options->Filesystem = VolumeCreationOptions::FilesystemType::FAT; ++#else + options->Filesystem = VolumeCreationOptions::FilesystemType::GetPlatformNative(); ++#endif + } + else + { +@@ -971,6 +977,8 @@ + } + #elif defined (TC_FREEBSD) || defined (TC_SOLARIS) + ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "UFS")); filesystems.push_back (VolumeCreationOptions::FilesystemType::UFS); ++#elif defined (TC_OPENBSD) ++ ShowInfo (wxString::Format (L" %li) %s", filesystems.size() + 1, "FFS")); filesystems.push_back (VolumeCreationOptions::FilesystemType::FFS); + #endif + + ssize_t defaultFilesystem = fatAvailable ? 2 : 1; +@@ -1133,6 +1141,13 @@ + if (!useElevatedAPFSFormatter) + PrepareMacOSXFormatterDevice (virtualDevice, changedDeviceOwners); + #else ++#ifdef TC_OPENBSD ++ // newfs(8) requires the raw character device; the block device ++ // exposed by the loop device driver cannot be used. ++ string virtualDeviceStr = virtualDevice; ++ if (virtualDeviceStr.find ("/dev/vnd") == 0) ++ virtualDevice = "/dev/r" + virtualDeviceStr.substr (5); ++#endif + UserId origDeviceOwner ((uid_t) -1); + + try Index: security/veracrypt/patches/patch-Main_UserInterface_cpp =================================================================== RCS file: security/veracrypt/patches/patch-Main_UserInterface_cpp diff -N security/veracrypt/patches/patch-Main_UserInterface_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/patches/patch-Main_UserInterface_cpp 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,17 @@ +SPDX-License-Identifier: Apache-2.0 + +Index: Main/UserInterface.cpp +--- Main/UserInterface.cpp.orig ++++ Main/UserInterface.cpp +@@ -40,7 +40,11 @@ + public: + virtual void operator() (string &str) + { ++#ifdef TC_OPENBSD ++ throw ElevationFailed (SRC_POS, "doas", 1, ""); ++#else + throw ElevationFailed (SRC_POS, "sudo", 1, ""); ++#endif + } + }; + Index: security/veracrypt/patches/patch-Makefile =================================================================== RCS file: /cvs/ports/security/veracrypt/patches/patch-Makefile,v diff -u -p -u -p -r1.3 patch-Makefile --- security/veracrypt/patches/patch-Makefile 14 Mar 2022 11:07:46 -0000 1.3 +++ security/veracrypt/patches/patch-Makefile 19 Sep 2026 17:28:33 -0000 @@ -1,19 +1,21 @@ +SPDX-License-Identifier: Apache-2.0 + - don't hardcode -O2 - inject port infrastructure' cflags/cxxflags Index: Makefile --- Makefile.orig +++ Makefile -@@ -47,7 +47,7 @@ export CFLAGS := -Wall +@@ -50,7 +50,7 @@ export CXXFLAGS := -Wall -Wno-unused-parameter - C_CXX_FLAGS := -MMD -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES -I$(BASE_DIR) -I$(BASE_DIR)/Crypto + C_CXX_FLAGS := -MMD -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES -I$(BASE_DIR) -I$(BASE_DIR)/Crypto -DARGON2_NO_THREADS -I$(BASE_DIR)/Crypto/Argon2/include export ASFLAGS := -D __GNUC__ -D __YASM__ -export LFLAGS := +export LFLAGS ?= + export PKG_CONFIG ?= pkg-config export PKG_CONFIG_PATH ?= /usr/local/lib/pkgconfig - -@@ -109,7 +109,7 @@ endif +@@ -111,7 +111,7 @@ ifeq "$(TC_BUILD_CONFIG)" "Release" @@ -22,7 +24,7 @@ Index: Makefile export WX_BUILD_DIR ?= $(BASE_DIR)/wxrelease WX_CONFIGURE_FLAGS += --disable-debug_flag --disable-debug_gdb --disable-debug_info -@@ -441,8 +441,8 @@ endif +@@ -585,8 +585,8 @@ #------ Common configuration ------ @@ -32,4 +34,4 @@ Index: Makefile +CXXFLAGS := $(C_CXX_FLAGS) $(CXXFLAGS) $(TC_EXTRA_CXXFLAGS) $(PORT_CXXFLAGS) LFLAGS := $(LFLAGS) $(TC_EXTRA_LFLAGS) - WX_CONFIGURE_FLAGS += --enable-unicode -disable-shared --disable-dependency-tracking --enable-exceptions --enable-std_string --enable-dataobj --enable-mimetype + #------ Reproducible build configuration ------ Index: security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop =================================================================== RCS file: /cvs/ports/security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop,v diff -u -p -u -p -r1.2 patch-Setup_FreeBSD_veracrypt_desktop --- security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop 11 Mar 2022 19:54:08 -0000 1.2 +++ security/veracrypt/patches/patch-Setup_FreeBSD_veracrypt_desktop 19 Sep 2026 17:28:33 -0000 @@ -1,12 +1,14 @@ +SPDX-License-Identifier: Apache-2.0 + Index: Setup/FreeBSD/veracrypt.desktop --- Setup/FreeBSD/veracrypt.desktop.orig +++ Setup/FreeBSD/veracrypt.desktop -@@ -3,7 +3,7 @@ Encoding=UTF-8 - Name=VeraCrypt - GenericName=VeraCrypt - Comment=VeraCrypt --Exec=/usr/bin/veracrypt -+Exec=${TRUEPREFIX}/bin/veracrypt +@@ -4,7 +4,7 @@ + GenericName=VeraCrypt volume manager + Comment=Create and mount VeraCrypt encrypted volumes Icon=veracrypt +-Exec=/usr/bin/veracrypt %f ++Exec=${TRUEPREFIX}/bin/veracrypt %f + Categories=Security;Utility;Filesystem + Keywords=encryption,filesystem Terminal=false - Type=Application Index: security/veracrypt/pkg/PLIST =================================================================== RCS file: /cvs/ports/security/veracrypt/pkg/PLIST,v diff -u -p -u -p -r1.2 PLIST --- security/veracrypt/pkg/PLIST 11 Mar 2022 19:54:08 -0000 1.2 +++ security/veracrypt/pkg/PLIST 19 Sep 2026 17:28:33 -0000 @@ -1,5 +1,6 @@ @bin bin/veracrypt share/applications/veracrypt.desktop +share/doc/pkg-readmes/${PKGSTEM} share/pixmaps/ -share/pixmaps/veracrypt.xpm +share/pixmaps/veracrypt.png @tag update-desktop-database Index: security/veracrypt/pkg/README =================================================================== RCS file: security/veracrypt/pkg/README diff -N security/veracrypt/pkg/README --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ security/veracrypt/pkg/README 19 Sep 2026 17:28:33 -0000 @@ -0,0 +1,29 @@ ++------------------------------------------------------------------------------- +| Running ${PKGSTEM} on OpenBSD ++------------------------------------------------------------------------------- + +Privilege elevation +=================== + +VeraCrypt runs its privileged core service through doas(1). Add a rule to +/etc/doas.conf before mounting, creating or formatting volumes: + + permit :wheel cmd ${TRUEPREFIX}/bin/veracrypt + +The rule can be restricted further with the "args" option, but it must cover +both the normal invocation and the "--core-service" mode used internally by +VeraCrypt. Do not use "permit nopass" unless you accept passwordless +elevation for every user allowed by the rule. + +The core service is used for operations that require root privileges, such as +configuring vnd(4) loop devices, mounting and unmounting filesystems, +changing ownership of mount points and device nodes, and running newfs(8) +when an OpenBSD FFS filesystem is created inside a volume. + +Filesystem creation +=================== + +OpenBSD FFS filesystems can be created inside a new volume by selecting the +"FFS" filesystem in the volume creation wizard or by passing +"--filesystem=FFS" on the command line. The filesystem is created with +newfs(8) on the raw vnd(4) character device.