From: Kurt Miller Subject: Re: NEW security/autopsy To: Sebastian Reitenbach Cc: ports Date: Wed, 14 Oct 2026 01:45:43 +0000 On Oct 13, 2026, at 2:40 PM, Sebastian Reitenbach wrote: > > Hi, > > based on feedback from kurt@ a new version, that: > > * uses jna from ports > * uses FULLDISTDIR to copy over the ranges.csv file > Thanks! I also suggested that files/autopsy include --jdkhome ${JAVA_HOME} and use SUBST on it when installing so that executing autopsy from the command line without a PATH that includes jdk-21 works. The crash on ‘Add Data Source’ cleared up for me when I updated my snapshot to Mon Oct 12 on aarch64. I think there was some recent work on auxv that was causing getenv(2) to segfault. After some more testing I noticed it is missing two build depends: archivers/unzip \ java/jna LIB_DEPENDS/RUN_DEPENDS and WANTLIB probably need some work but I okay with it going in now with the above changes and cleaning up any other depends/wantlib in tree. okay kurt@ > cheers, > Sebastian > > > On Tue, Oct 13, 2026 at 12:51 PM Sebastian Reitenbach wrote: > Hi, > > this version finally works with PORTS_PRIVSEP. > Initially I thought I could get all the dependencies added as additional distfiles, > but this ivy drove me crazy. Finally I switched to pre-create the .ivy2/cache > and loaded it up to GH. But even there, I had some headaches, because > some dependency in the cache, had a version range specified to jna, where > I was unable to do it without manual tweaking of the cache. See the README.md > I kept for some hints on what I did. > > To pre-fill the cache, I disabled network block for _pbuild user, then built the cache, > tarballed. then re-enabled firewall, saw it failing, tweaked it until it "just worked". > Is there an easier way I could achieve that without manual tweaking? > > As the other dependency ports, only tested on amd64, and as I mentioned, there > is this cosmetical segfault at the end of data source ingestion. There I have no clue, > where it comes from and what it is about. > If anyone is curious, test image here: https://github.com/buzzdeee/testfiles/tree/main/diskimages > > But when you then restart and reopen the just created case, the data source is > actually added, and you can run all these ingestion modules against ist. > > any testing/feedback etc. welcome. > > Sebastian > > > > > > > > On Mon, Oct 12, 2026 at 10:17 AM Sebastian Reitenbach wrote: > Hi, > > tests with PORTS_PRIVSEP reveals, there are a few dependencies missing it downloads. > I'm looking into that nowish. > > Sebastian > > > On Sun, Oct 11, 2026 at 11:18 PM Sebastian Reitenbach wrote: > Attached updated version contains a tiny fix to the autopsy script in /usr/local/bin > > > > On Sun, Oct 11, 2026 at 10:00 PM Sebastian Reitenbach wrote: > Hi, > > this is the so long talked about Autopsy port. > > cat pkg/DESCR: > Autopsy is a graphical interface to The Sleuth Kit and other open source > digital forensics tools. Autopsy 3 was a complete rewrite from Autopsy > 2 to make it Java-based. Autopsy 4 improves on Autopsy 3 by supporting > collaboration on a single case by multiple users. > > It requires a few recently added ports: archivers/sevenzipjbinding, databases/sqlite-jdbc, sysutils/py-prefetch-parser, and updated port: sysutils/sleuthkit, and not yet, but here on the m/l available graphics/openjfx/21 > > The "original" comes with a lot of bundled binaries and bundled jars, mainly targeting > Windows users. It's supposed to run on Linux as well, but less tested, and less modules work there. > > What works: > • > YARA Ingest Module: uses system YARA (original Autopsy only supports Windows) > • OpenCV: uses system OpenCV (original Autopsy uses OpenCV 2, OpenBSD has OpenCV 4) > • Plaso Ingest Module: uses system Plaso (original Autopsy only supports Windows) > • Embedded Files Module: works with sevenzipjbinding > • Use system TestDisk/PhotoRec > • Recent Activity Ingest Module: uses system prefetch-parser > • Timeline View: via OpenJFX port (WebKit component) > • Audio/Video Playback: via OpenJFX (media component) > • Solr: use bundled solr, (Keyword Indexer writes logs to ~/.solr/...) > > Pinning MODJAVA_VER to 21, as it depends on openjfx/21 which itself is pinned to JDK 21. > > Patching the autopsy.conf file in pre-build stage didn't work out, it kind of got re-generated, therefore this odd dance in pre-build: and do-install: > > There's one crasher I haven't figured out yet: it occurs at the end of adding a new datasource. Don't know yet how to get around it. But the case is created with the added datasource, so restarting and opening works. > In case anyone is up to look into it, I've two disk images for testing here: https://github.com/buzzdeee/testfiles/tree/main/diskimages > > any testing, feedback etc. welcome. > > Sebastian > > -- > https://buzzdeee.reitenba.ch > > > -- > https://buzzdeee.reitenba.ch > > > -- > https://buzzdeee.reitenba.ch > > > -- > https://buzzdeee.reitenba.ch > > > -- > https://buzzdeee.reitenba.ch