From: Christoph Liebender <christoph@liebender.dev>
Subject: Re: update: umurmur
To: ports@openbsd.org
Date: Fri, 10 Jul 2026 18:28:09 +0200

On 6/29/26 20:52, Andrew Kloet wrote:
> Update umurmur 0.2.20 -> v0.3.1
> 
> Tested running a server and connected to it with mumble client.
> 
> OK?
> 
> Andrew
Hey! Actually, I have the same bump, but with pledge and unveil patches 
lying around here. submitted that a while ago but the thread died. It 
even got a tester back then (apart from me!)

Dropped MAINTAINER though, which was part of my original patch. Not 
using mumble anymore ...

Maybe you can build on that?
diff --git a/audio/umurmur/Makefile b/audio/umurmur/Makefile
index b6cb7299906..109d3dcc273 100644
--- a/audio/umurmur/Makefile
+++ b/audio/umurmur/Makefile
@@ -11,6 +11,7 @@ HOMEPAGE =		https://umurmur.net/
 # BSD
 PERMIT_PACKAGE =	Yes
 
+# uses pledge() and unveil()
 WANTLIB =		c config crypto protobuf-c>=1.0 ssl
 
 MODULES =		devel/cmake
@@ -18,6 +19,11 @@ MODULES =		devel/cmake
 LIB_DEPENDS =		devel/libconfig \
 			devel/protobuf-c>=1.0.1
 
+CONFIGURE_ARGS =	-DSSL=openssl
+MODCMAKE_POLICY_VERSION_OVERRIDE = Yes
+
+NO_TEST =		Yes
+
 pre-configure:
 	${SUBST_CMD} ${WRKSRC}/src/conf.c ${WRKSRC}/src/config.h.in \
 		${WRKSRC}/umurmur.conf.example
diff --git a/audio/umurmur/patches/patch-src_main_c b/audio/umurmur/patches/patch-src_main_c
new file mode 100644
index 00000000000..125aa40d63c
--- /dev/null
+++ b/audio/umurmur/patches/patch-src_main_c
@@ -0,0 +1,67 @@
+Index: src/main.c
+--- src/main.c.orig
++++ src/main.c
+@@ -313,7 +313,7 @@ int main(int argc, char **argv)
+ 					break;
+ 			}
+ 		}
+-
++			
+ 		if (testconfig) {
+ 			if (!Conf_ok(conffile))
+ 				exit(1);
+@@ -321,6 +321,8 @@ int main(int argc, char **argv)
+ 				exit(0);
+ 		}
+ 
++		pledge("stdio rpath wpath cpath inet id proc unveil", "");
++
+ 		/* Initialize the config subsystem early;
+ 		 * switch_user() will need to read some config variables as well as logging.
+ 		 */
+@@ -336,6 +338,28 @@ int main(int argc, char **argv)
+ 		}
+ 		else Log_init(true);
+ 
++		{
++			const char *p;
++
++			if ((p = getStrConf(CERTIFICATE)) != NULL)
++				unveil(p, file_exists(p) ? "r" : "rwc");
++			if ((p = getStrConf(KEY)) != NULL)
++				unveil(p, file_exists(p) ? "r" : "rwc");
++			if ((p = getStrConf(CAPATH)) != NULL)
++				unveil(p, "r");
++			if ((p = getStrConf(LOGFILE)) != NULL)
++				unveil(p, file_exists(p) ? "w" : "wc");
++			if ((p = getStrConf(BANFILE)) != NULL)
++				unveil(p, file_exists(p) ? "rw" : "rwc");
++			if (pidfile)
++				unveil(pidfile, "rwc");
++			
++			unveil("/etc/pwd.db", "r");
++			unveil("/etc/group", "r");
++		}
++		
++		pledge("stdio rpath wpath cpath inet id", "");
++
+ #ifdef POSIX_PRIORITY_SCHEDULING
+ 		/* Set the scheduling policy, has to be called after daemonizing
+ 		 * but before we drop privileges */
+@@ -377,12 +401,16 @@ int main(int argc, char **argv)
+ 		/* SSL and scheduling is setup, we can drop privileges now */
+ 		switch_user();
+ 
++		pledge("stdio rpath wpath cpath inet", "");
++
+ 		if(!nodaemon) {
+ 			/* Reopen log file. If user switch results in access denied, we catch
+ 			 * it early.
+ 			 */
+ 			Log_reset();
+ 		}
++
++		pledge(getStrConf(BANFILE) ? "stdio wpath cpath inet" : "stdio inet", "");
+ 
+ 		Server_run();
+ 
diff --git a/audio/umurmur/patches/patch-src_ssl_h b/audio/umurmur/patches/patch-src_ssl_h
new file mode 100644
index 00000000000..4eb3de01d0c
--- /dev/null
+++ b/audio/umurmur/patches/patch-src_ssl_h
@@ -0,0 +1,12 @@
+Index: src/ssl.h
+--- src/ssl.h.orig
++++ src/ssl.h
+@@ -101,6 +101,8 @@ typedef gnutls_session_t SSL_handle_t;
+ 
+ typedef SSL SSL_handle_t;
+ 
++bool_t file_exists(const char *);
++
+ #endif
+ 
+ void SSLi_init(void);
diff --git a/audio/umurmur/patches/patch-src_ssli_openssl_c b/audio/umurmur/patches/patch-src_ssli_openssl_c
new file mode 100644
index 00000000000..f42abbf4ff7
--- /dev/null
+++ b/audio/umurmur/patches/patch-src_ssli_openssl_c
@@ -0,0 +1,12 @@
+Index: src/ssli_openssl.c
+--- src/ssli_openssl.c.orig
++++ src/ssli_openssl.c
+@@ -206,7 +206,7 @@ err_out:
+ 	return NULL;
+ }
+ 
+-static bool_t file_exists(const char *filename)
++bool_t file_exists(const char *filename)
+ {
+        return (access(filename, F_OK) == 0);
+ }
diff --git a/audio/umurmur/patches/patch-src_version_h b/audio/umurmur/patches/patch-src_version_h
new file mode 100644
index 00000000000..212b289008b
--- /dev/null
+++ b/audio/umurmur/patches/patch-src_version_h
@@ -0,0 +1,12 @@
+Index: src/version.h
+--- src/version.h.orig
++++ src/version.h
+@@ -1,7 +1,7 @@
+ #ifndef VERSION_H_989876
+ #define VERSION_H_989876
+ 
+-#define UMURMUR_VERSION "0.3.0"
++#define UMURMUR_VERSION "0.3.1-OpenBSD"
+ #define UMURMUR_CODENAME "Loopy"
+ 
+ #endif
diff --git a/audio/umurmur/pkg/umurmurd.rc b/audio/umurmur/pkg/umurmurd.rc
index 5e36e9b7d30..f77bc746dfa 100644
--- a/audio/umurmur/pkg/umurmurd.rc
+++ b/audio/umurmur/pkg/umurmurd.rc
@@ -4,6 +4,10 @@ daemon="${TRUEPREFIX}/sbin/umurmurd"
 
 . /etc/rc.d/rc.subr
 
+rc_configtest() {
+	rc_exec "${daemon} -t ${daemon_flags}"
+}
+
 rc_reload=NO
 
 rc_cmd $1