From: David Uhden Collado <daviduhden@gmail.com>
Subject: Re: [UPDATE] net/i2pd: update to 2.61.0
To: ports@openbsd.org, openbsd@systemfailure.net, lucas@sexy.is
Date: Wed, 22 Jul 2026 11:33:00 +0000

David Uhden Collado wrote:
> Hello,
> 
> Please consider the attached patch to update net/i2pd from 2.59.0 to
> 2.61.0. This supersedes the maintainer's previously submitted 2.60.0
> update and includes all of its port changes.
> 
> The upstream changes relevant to OpenBSD include:
> 
> * Add post-quantum cryptography support with LibreSSL.
> * Use ML-KEM-768 as the default SSU2 cryptographic type when supported
>    by the cryptographic backend.
> * Add an option to disable pledge and unveil for configurations that
>    require access to additional system resources.
> * Add support for binding to IPv6 ULA addresses.
> * Fix issues affecting post-quantum sessions, offline signatures,
>    proxy handling, streaming connections, and tunnel recreation after
>    the router has been offline.
> * Update the reseed servers and certificates.
> 
> The port changes carried over from the 2.60.0 update include:
> 
> * Add boost_container to WANTLIB.
> * Remove the obsolete boost_system test dependency.
> * Disable the HTTP console by default.
> * Use syslog for logging by default.
> * Store configuration files under /etc/i2pd and runtime data under
>    /var/i2pd.
> * Update the rc script, PLIST, and package README for the new paths and
>    defaults.
> 
> The PLIST has also been updated for the headers and reseed certificates
> added in 2.61.0, and distinfo contains the checksum and size of the new
> distfile.
> 
> The port preserves the intended OpenBSD service defaults: syslog
> logging, the HTTP console disabled unless explicitly enabled,
> configuration under /etc/i2pd, and runtime data under /var/i2pd.
> 
> The port applies cleanly, and the normal package build completes
> successfully. Regression tests were started, but the complete test run
> was not finished because the upstream test target performs a separate
> and lengthy build of the test suite.
> 
> Regards,
> David.
Hello,

The unveil support added in the latest i2pd release does not account for 
the fact that OpenBSD commonly uses /var instead of /var/lib.

I had to make a small code change so that unveil works correctly with 
the default paths used by the OpenBSD port.

I have attached the updated patch to this email.

Best regards,
David.
? patches
Index: Makefile
===================================================================
RCS file: /cvs/ports/net/i2pd/Makefile,v
diff -u -p -u -p -r1.33 Makefile
--- Makefile	21 Feb 2026 14:20:20 -0000	1.33
+++ Makefile	22 Jul 2026 11:24:47 -0000
@@ -2,7 +2,7 @@ COMMENT =	client for the I2P anonymous n
 
 GH_ACCOUNT =	PurpleI2P
 GH_PROJECT =	i2pd
-GH_TAGNAME =	2.59.0
+GH_TAGNAME =	2.61.0
 
 CATEGORIES =	net
 HOMEPAGE =	https://i2pd.website
@@ -12,9 +12,10 @@ MAINTAINER =	SystemFailure <openbsd@syst
 # BSD
 PERMIT_PACKAGE = Yes
 
+# uses pledge() and unveil()
 WANTLIB += ${COMPILER_LIBCXX}
 WANTLIB += boost_filesystem-mt boost_program_options-mt
-WANTLIB += boost_atomic-mt c crypto m miniupnpc ssl z
+WANTLIB += boost_atomic-mt boost_container-mt c crypto m miniupnpc ssl z
 
 COMPILER =	base-clang ports-gcc
 MODULES =	devel/cmake
Index: distinfo
===================================================================
RCS file: /cvs/ports/net/i2pd/distinfo,v
diff -u -p -u -p -r1.26 distinfo
--- distinfo	21 Feb 2026 14:20:20 -0000	1.26
+++ distinfo	22 Jul 2026 11:24:47 -0000
@@ -1,2 +1,2 @@
-SHA256 (i2pd-2.59.0.tar.gz) = Dr6wXk82qzgJRJVhoJXcdnrYIaxqYclWI6tJvk/9OYs=
-SIZE (i2pd-2.59.0.tar.gz) = 743516
+SHA256 (i2pd-2.61.0.tar.gz) = QJzTwCV0kShmEatqr2kJQMckj7iYN3wT+ttlqDbioKs=
+SIZE (i2pd-2.61.0.tar.gz) = 779272
Index: pkg/PLIST
===================================================================
RCS file: /cvs/ports/net/i2pd/pkg/PLIST,v
diff -u -p -u -p -r1.18 PLIST
--- pkg/PLIST	21 Feb 2026 14:20:20 -0000	1.18
+++ pkg/PLIST	22 Jul 2026 11:24:47 -0000
@@ -1,5 +1,5 @@
 @newgroup _i2pd:838
-@newuser _i2pd:838:838::i2pd account:${LOCALSTATEDIR}/lib/i2pd:/sbin/nologin
+@newuser _i2pd:838:838::i2pd account:${LOCALSTATEDIR}/i2pd:/sbin/nologin
 @rcscript ${RCDIR}/i2pd
 @bin bin/i2pd
 include/i2pd/
@@ -27,6 +27,7 @@ include/i2pd/HTTPProxy.h
 include/i2pd/I2CP.h
 include/i2pd/I2NPProtocol.h
 include/i2pd/I2PEndian.h
+include/i2pd/IdentMetrics.h
 include/i2pd/I2PService.h
 include/i2pd/I2PTunnel.h
 include/i2pd/Identity.h
@@ -54,6 +55,7 @@ include/i2pd/Socks5.h
 include/i2pd/Streaming.h
 include/i2pd/Tag.h
 include/i2pd/Timestamp.h
+include/i2pd/Torrents.h
 include/i2pd/TransitTunnel.h
 include/i2pd/TransportSession.h
 include/i2pd/Transports.h
@@ -69,14 +71,16 @@ include/i2pd/util.h
 include/i2pd/version.h
 @static-lib lib/libi2pd.a
 @static-lib lib/libi2pdclient.a
+@mode 0750
 @owner _i2pd
 @group _i2pd
 @sample ${SYSCONFDIR}/i2pd/
-@sample ${LOCALSTATEDIR}/lib/i2pd/
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/router/
+@mode
+@sample ${LOCALSTATEDIR}/i2pd/
+@sample ${LOCALSTATEDIR}/i2pd/certificates/
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/
+@sample ${LOCALSTATEDIR}/i2pd/certificates/router/
 @owner
 @group
 @static-lib lib/libi2pdlang.a
@@ -87,139 +91,155 @@ share/examples/i2pd/certificates/family/
 share/examples/i2pd/certificates/family/gostcoin.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/gostcoin.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/gostcoin.crt
 @owner
 @group
 share/examples/i2pd/certificates/family/i2p-dev.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/i2p-dev.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/i2p-dev.crt
 @owner
 @group
 share/examples/i2pd/certificates/family/i2pd-dev.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/i2pd-dev.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/i2pd-dev.crt
 @owner
 @group
 share/examples/i2pd/certificates/family/mca2-i2p.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/mca2-i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/mca2-i2p.crt
 @owner
 @group
 share/examples/i2pd/certificates/family/stormycloud.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/stormycloud.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/stormycloud.crt
 @owner
 @group
 share/examples/i2pd/certificates/family/volatile.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/family/volatile.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/family/volatile.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/
+@sample ${LOCALSTATEDIR}/
 @owner
 @group
 share/examples/i2pd/certificates/reseed/acetone_at_mail.i2p.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/acetone_at_mail.i2p.crt 
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/acetone_at_mail.i2p.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/admin_at_stormycloud.org.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/admin_at_stormycloud.org.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/admin_at_stormycloud.org.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/creativecowpat_at_mail.i2p.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/creativecowpat_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/creativecowpat_at_mail.i2p.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/diyarciftci_at_protonmail.com.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/diyarciftci_at_protonmail.com.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/diyarciftci_at_protonmail.com.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/echelon3_at_mail.i2p.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/echelon3_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/echelon3_at_mail.i2p.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/hankhill19580_at_gmail.com.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/hankhill19580_at_gmail.com.crt 
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/hankhill19580_at_gmail.com.crt 
 @owner
 @group
 share/examples/i2pd/certificates/reseed/i2p-reseed_at_mk16.de.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/i2p-reseed_at_mk16.de.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/i2p-reseed_at_mk16.de.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/igor_at_novg.net.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/igor_at_novg.net.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/igor_at_novg.net.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/lazygravy_at_mail.i2p.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/lazygravy_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/lazygravy_at_mail.i2p.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/orignal_at_mail.i2p.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/orignal_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/orignal_at_mail.i2p.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/r4sas-reseed_at_mail.i2p.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/rambler_at_mail.i2p.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/rambler_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/rambler_at_mail.i2p.crt
 @owner
 @group
 share/examples/i2pd/certificates/reseed/reseed_at_diva.exchange.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/reseed_at_diva.exchange.crt 
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/reseed_at_diva.exchange.crt 
 @owner
 @group
 share/examples/i2pd/certificates/reseed/sahil_at_mail.i2p.crt
 @owner _i2pd
 @group _i2pd
-@sample ${LOCALSTATEDIR}/lib/i2pd/certificates/reseed/sahil_at_mail.i2p.crt
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/sahil_at_mail.i2p.crt
+@owner
+@group
+share/examples/i2pd/certificates/reseed/admin_at_likogan.dev.crt
+@owner _i2pd
+@group _i2pd
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/admin_at_likogan.dev.crt
+@owner
+@group
+share/examples/i2pd/certificates/reseed/vserod1488_at_proton.me.crt
+@owner _i2pd
+@group _i2pd
+@sample ${LOCALSTATEDIR}/i2pd/certificates/reseed/vserod1488_at_proton.me.crt
 @owner
 @group
 share/examples/i2pd/i2pd.conf
+@mode 0640
 @owner _i2pd
 @group _i2pd
 @sample ${SYSCONFDIR}/i2pd/i2pd.conf
+@mode
 @owner
 @group
 share/examples/i2pd/tunnels.conf
+@mode 0640
 @owner _i2pd
 @group _i2pd
 @sample ${SYSCONFDIR}/i2pd/tunnels.conf
+@mode
 @owner
 @group
 share/examples/login.conf.d/i2pd
Index: pkg/README
===================================================================
RCS file: /cvs/ports/net/i2pd/pkg/README,v
diff -u -p -u -p -r1.4 README
--- pkg/README	16 Apr 2024 15:22:32 -0000	1.4
+++ pkg/README	22 Jul 2026 11:24:47 -0000
@@ -24,3 +24,56 @@ and also edit /etc/login.conf.d/i2pd:
 		:openfiles-cur=8192:\
 		:openfiles-max=8192:\
 		:tc=daemon:
+
+
+The HTTP interface
+==================
+
+On OpenBSD, i2pd's HTTP interface is disabled by default, because it
+allows any user on the system to perform actions on the daemon, such
+as shutting it down, or access private data, such as the router
+identity and the tunnels' B32 addresses.
+
+If you want to use this interface anyway, you can reenable it in
+/etc/i2pd/i2pd.conf under the [http] section.
+
+
+Graceful shutdown
+=================
+
+It is good practice to shutdown the i2pd daemon gracefully, to avoid
+immediatly severing all connections, which would disconnect all
+your peers and affect the overall operation of the I2P network.
+
+You can initiate a graceful shutdown without the HTTP interface by
+sending a signal to the i2pd daemon like this:
+
+	kill -INT $(cat /var/i2pd/i2pd.pid)
+
+When it shuts down gracefully, the i2pd daemon waits for all transit
+tunnels to expire, which usually takes 10 minutes.
+
+
+Logging
+=======
+
+By default, the OpenBSD port of ${PKGSTEM} sends its log messages to
+syslogd(8), which writes them to the /var/log/daemon file.
+
+The default log level of ${PKGSTEM} ("warn") can be very verbose. You
+may want to reduce this log verbosity by changing the "loglevel"
+parameter in /etc/i2pd/i2pd.conf.
+
+If you want log messages to be written to another file, e.g.
+/var/i2pd/i2pd.log, you can change the "log" and "logfile" parameters
+in /etc/i2pd/i2pd.conf. To have this log file rotated automatically,
+you can add an entry to /etc/newsyslog.conf using the i2pd pid
+file so that newsyslog(8) can send SIGHUP to the daemon after rotation.
+
+For example:
+
+	/var/i2pd/i2pd.log  _i2pd:_i2pd  644  6  *  $D13  Z 
+/var/i2pd/i2pd.pid
+
+Sending SIGHUP is enough for log rotation, and also makes i2pd reload
+its tunnel configuration and rotate transient keys.
Index: pkg/i2pd.rc
===================================================================
RCS file: /cvs/ports/net/i2pd/pkg/i2pd.rc,v
diff -u -p -u -p -r1.4 i2pd.rc
--- pkg/i2pd.rc	11 Mar 2022 19:46:04 -0000	1.4
+++ pkg/i2pd.rc	22 Jul 2026 11:24:47 -0000
@@ -2,7 +2,12 @@
 
 daemon="${TRUEPREFIX}/bin/i2pd --daemon"
 daemon_user="_i2pd"
-daemon_flags="--service --datadir=${LOCALSTATEDIR}/lib/i2pd --conf=${SYSCONFDIR}/i2pd/i2pd.conf --tunconf=${SYSCONFDIR}/i2pd/tunnels.conf --tunnelsdir=${SYSCONFDIR}/i2pd/tunnels.d"
+daemon_flags="--service \
+	--datadir=${LOCALSTATEDIR}/i2pd \
+	--conf=${SYSCONFDIR}/i2pd/i2pd.conf \
+	--tunconf=${SYSCONFDIR}/i2pd/tunnels.conf \
+	--tunnelsdir=${SYSCONFDIR}/i2pd/tunnels.d \
+	--certsdir=${LOCALSTATEDIR}/i2pd/certificates"
 
 . /etc/rc.d/rc.subr
 
Index: patches/patch-contrib_i2pd_conf
===================================================================
RCS file: patches/patch-contrib_i2pd_conf
diff -N patches/patch-contrib_i2pd_conf
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ patches/patch-contrib_i2pd_conf	22 Jul 2026 11:24:49 -0000
@@ -0,0 +1,34 @@
+Use OpenBSD paths and defaults for the configuration and logging.
+
+Index: contrib/i2pd.conf
+--- contrib/i2pd.conf.orig
++++ contrib/i2pd.conf
+@@ -8,13 +8,13 @@
+ 
+ ## Tunnels config file
+ ## Default: ~/.i2pd/tunnels.conf or /var/lib/i2pd/tunnels.conf
+-# tunconf = /var/lib/i2pd/tunnels.conf
++tunconf = /etc/i2pd/tunnels.conf
+ 
+ ## Tunnels config files path
+ ## Use that path to store separated tunnels in different config files.
+ ## Default: ~/.i2pd/tunnels.d or /var/lib/i2pd/tunnels.d
+-# tunnelsdir = /var/lib/i2pd/tunnels.d
++tunnelsdir = /etc/i2pd/tunnels.d
+ 
+ ## Path to certificates used for verifying .su3, families
+ ## Default: ~/.i2pd/certificates or /var/lib/i2pd/certificates
+-# certsdir = /var/lib/i2pd/certificates
++certsdir = /etc/i2pd/certificates
+@@ -30,4 +30,4 @@
+ ##  * stdout - print log entries to stdout
+ ##  * file - log entries to a file
+ ##  * syslog - use syslog, see man 3 syslog
+-# log = file
++log = syslog
+@@ -122,4 +122,4 @@
+ [http]
+ ## Web Console settings
+ ## Enable the Web Console (default: true)
+-# enabled = true
++enabled = false
Index: patches/patch-libi2pd_FS_cpp
===================================================================
RCS file: patches/patch-libi2pd_FS_cpp
diff -N patches/patch-libi2pd_FS_cpp
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ patches/patch-libi2pd_FS_cpp	22 Jul 2026 11:24:49 -0000
@@ -0,0 +1,8 @@
+Use /var/i2pd as the service data directory on OpenBSD.
+
+Index: libi2pd/FS.cpp
+--- libi2pd/FS.cpp.orig
++++ libi2pd/FS.cpp
+@@ -117,1 +117,1 @@
+-			dataDir = "/var/lib/" + appName;
++			dataDir = "/var/" + appName;
Index: patches/patch-test_Makefile
===================================================================
RCS file: patches/patch-test_Makefile
diff -N patches/patch-test_Makefile
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ patches/patch-test_Makefile	22 Jul 2026 11:24:49 -0000
@@ -0,0 +1,12 @@
+The tests no longer require boost_system.
+
+Index: tests/Makefile
+--- tests/Makefile.orig
++++ tests/Makefile
+@@ -18,6 +18,5 @@ ifneq (, $(findstring mingw, $(SYS))$(findstring windo
+ endif
+ 
+ LDLIBS = \
+-	-lboost_system$(BOOST_SUFFIX) \
+ 	-lboost_program_options$(BOOST_SUFFIX) \
+ 	-lssl \