From: Chris Billington <emulti@disroot.org>
Subject: Re: new: security/browserpass-native: browser native messaging host for security/password-store
To: openbsd-ports Mailing List <ports@openbsd.org>
Cc: landry@openbsd.org
Date: Tue, 30 Jun 2026 10:12:34 +0800

landry@openbsd.org wrote:
> Le Mon, Jun 29, 2026 at 09:53:01PM +0800, Chris Billington a écrit :
>> Stuart Henderson wrote:
>>> On 2026/06/29 17:05, Chris Billington wrote:
>>> : * Chromium -> ${SYSCONFDIR}/chromium/unveil.main
>>> : * Firefox -> ${SYSCONFDIR}/firefox/unveil.main
>>> : * Iridium -> ${SYSCONFDIR}/iridium/unveil.main
>>> : * Ungoogled-chromium -> ${SYSCONFDIR}/ungoogled-chromium/unveil.main
>>>
>>> this is a total pain because now the user will have to manage the
>>> unveil files themselves and merge in any changes after updates to the
>>> browser ports. the pkg-readme would at least need to inform the user
>>> about this, but it would be better if these could be included in the
>>> relevant files directly in the browser ports (though 'r' for all of
>>> /usr/local/bin might be a bit much)...
>>>
>>
>> When browser updates are installed, there is a message about checking
>> unveil.content/unveil.main "which was modified" though I found this actually
>> refers to the package copy, not the local version, so any extra lines in the
>> local copy are preserved. Then use 'sysmerge -p' to bring in any updates to
>> the package version.
>>
>> Maybe I can add a note about 'sysmerge -p' to this README?  This could also
>> be added to keepassxc README as it's the same situation.
> 
> i dunno what is "the best way to document that" but people should
> definitely get used to run sysmerge -p as much as sysmerge for base.
> especially for those cases.
> 
> 
Draft addition to the first section of the README for browserpass-native:

---
As with all local adjustments to @sample files shipped with browser 
packages, 'pkg_add -u' will warn that the package file(s) may have been 
updated.

Run 'sysmerge -p' after updating to merge such changes with your local copy.
---

It could also be added to similar ports like keepassxc(-browser) or 
others that require changes to the @sample files.

The FAQ doesn't mention sysmerge -p at present.

https://www.openbsd.org/faq/upgrade79.html (Upgrading) currently has:

...
Finish up by upgrading the packages using pkg_add -u.

Possible update:

Finish up by upgrading the packages using 'pkg_add -u' then running 
'sysmerge -p' to merge any changes to package configuration files.


https://www.openbsd.org/faq/faq10.html (Security) has:

...
Updated binary packages for releases and -stable systems are provided to 
address security issues or for other major fixes. Simply call pkg_add(1) 
with the -u flag to get the new files.

Possible update:

Updated binary packages for releases and -stable systems are provided to 
address security issues or for other major fixes. Run 'pkg_add -u' to 
update packages, then 'sysmerge -p' to merge associated configuration 
file changes. See pkg_add(1) and sysmerge(8).

Regards
Chris