https://www.openbsd.org/72.html
OpenBSD 7.2
Released Oct 20, 2022. (53rd OpenBSD release)
Copyright 1997-2022, Theo de Raadt.
Artwork by Jon Chad.
* See the information on the FTP page for a list of mirror
machines.
* Go to the pub/OpenBSD/7.2/ directory on one of the mirror sites.
* Have a look at the 7.2 errata page for a list of bugs and
One Fish, workarounds.
Two Fish, * See a detailed log of changes between the 7.1 and 7.2 releases.
Blowfish...
* signify(1) pubkeys for this release:
openbsd-72-base.pub: RWQTKNnK3CZZ8Lid7/kWPO1WxjEsTeuxiXbJSSg6RDir9OJmV+t7GrOo
openbsd-72-fw.pub: RWRvwsB/ZxwZxiQBgNVhuCnEacKE1MhrcDX25jFccqaj0pxsY9oIPJq4
openbsd-72-pkg.pub: RWSyNc+EwQQo5bZ5XtDpnk0FUl8NrIl+Ocq4FV/5VTvP9rOgHzKEnBx0
openbsd-72-syspatch.pub: RWQuBB7PRAc2Zy+C7VAynLuan8WDVtQ9R4xLpl8yjf1zxfqEBRRJ+66w
All applicable copyrights and credits are in the src.tar.gz,
sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the files
fetched via ports.tar.gz.
---------------------------------------------------------------------
What's New
This is a partial list of new features and systems included in
OpenBSD 7.2. For a comprehensive list, see the changelog leading to
7.2.
* New/extended platforms:
+ Added support for Ampere Altra
+ Added support for Apple M2
+ Added support for Lenovo ThinkPad x13s and other machines
using the Qualcomm Snapdragon 8cx Gen 3 (SC8280XP) SoC.
* Various kernel improvements:
+ Allowed bsd.rd and bsd/bsd.mp to boot on Oracle Cloud amd64
instances.
+ Added support for switching from glass console to serial
console on arm64 systems that default to glass console.
+ pf(4) automatically allows IGMP and ICMP6 MLD packets with
the router alert option. Special allow-opts rules are no
longer needed for multicast discovery.
+ Fixed a pf(4) NULL dereference panic triggered by relayd(8).
+ Implement "show all routes" to print routing tables in ddb(4)
.
+ Added a method (ESC D) to enter ddb(4) on serial drivers that
do not have a true BREAK mechanism.
+ Added "show all routes" and the ability to show individual
routes (e.g. "show route 0xfffffd807e9b0000") to ddb(4).
+ Added a "show swap" command to ddb(4) to help debugging.
+ Count dropped network packets due to low memory in netstat(1)
.
+ Simplified machine command handling in ddb(4).
+ Changed to a simpler formula to calculate a default
kern.maxthread value: 2*NPROCESS.
+ Enabled kstat(4), a device that exports kernel statistics
that can be read by kstat(1).
+ Added CPU frequency sensors for each core on CPUs that have
MPERF/APERF support.
+ Merged the UVM swap-backed and object-backed inactive page
lists.
+ Fixed rwlock(9) implementation to be fair to writers.
Previously, readers could grab the lock even if writers were
waiting first.
+ Made the CPU frequency scaling duration relative to the load
when in automatic mode on battery.
+ Fixed luna88k MULTIPROCESSOR kernels booting with CPU modules
installed in arbitrary slots.
+ Added a missing kqueue(2) wakeup, found by a Go testcase
hang.
+ Bumped the maximum number of supported CPUs to 256 on arm64.
+ Ensure uvm_swap_io() can succeed, even in out of memory
situations, by reserving a second segment for the page
daemon.
+ Ensured progress in the swapper by pre-allocating pages in a
DMA-reachable region.
+ Made the page daemon consider pmemrange regions when trying
to free pages from the inactive list. Previously the page
daemon could use a lot of CPU without freeing a page because
the global limits were satisfied.
+ Ensured that uvm_swap_get() will always sleep rather than
returning an error. Previously an error could be returned to
the fault handler which would result in processes dying when
a system was under a lot of memory pressure.
+ Added support for using non-standard UARTs (such as the
Synopsys DesignWare UART) as an early console.
+ Remove NexGen CPU identification code as the kernel cannot
run on these CPUs anyway.
+ Remove Rise CPU identification code.
+ Dropped detection code for 386sx/386dx CPUs. OpenBSD/i386
hasn't actually supported running on either for some time.
+ Dropped detection code for Cyrix CPUs older than the Cyrix
M2.
+ Implemented the fundamentals for suspend/resume on arm64.
+ Simplified TSC synchronization testing on amd64.
+ Corrected sparc64 ofwboot to default to the softraid(4)
volume on the boot device to make root on softraid work out
of the box on sparc64 and be more consistent with softraid
boot on other architectures.
+ Removed the obsolete kern.nselcoll sysctl(2).
+ Changed mips64, octeon, and loongson to trigger deferred
clock interrupts from splx(9). This isolates the clock
interrupt schedule from the MD clock interrupt code.
+ Fixed a potential kernel panic when an msdos partition is out
of space by fixing instances where msdosfs passed a NULL proc
pointer to detrunc().
+ Add a delay_init() function that helps on i386 and amd64
architectures in setting up delay_func for different timers
and switching between them depending on their quality
properties. This improves how timers backing delay(9) are
managed.
+ Ensured disklabel(5) is is read from/written to disk only
from/to unused space or an OpenBSD partition.
+ Ensured GPT header data is not used until all validity checks
are passed.
+ Corrected handling of GPT usable LBA start/end values,
preventing incorrect fallback to MBR partitioning.
+ Ignored size of OpenBSD GPT partition when searching for the
disklabel(5), as has always been done for MBR OpenBSD
partition.
* SMP Improvements
+ Make route timer MP safe and use rttimer pool.
+ Use kernel lock to protect parts of ARP, ND6 and PPPoE that
are not MP safe. Lookup of existing ARP entries is MP safe
and can run in parallel.
+ Start up to 4 softnet tasks to run IP input and forwarding in
parallel on multiple cores.
+ Run IPv4 packet reassembly in parallel.
+ Run IPv6 hop-by-hop options processing in parallel.
+ Add a mutex to rate limiting functions to make them MP safe.
+ Introduce mutex and reference counter for internet protocol
control block.
+ Protect UDP, raw IP, and divert packet input routines with a
per-socket mutex.
+ Protect recv(2) system call for UDP and raw IP packets with a
per-socket mutex and shared netlock. Allows to receive
packets while forwarding in parallel.
+ Protect multicast deliver loop for UDP and raw IP sockets
with rwlock.
+ Only grab netlock in IGMP and MLD timer when necessary.
+ TCP slow timer runs without netlock.
+ Rework rwlock so that a writer will get the lock eventually.
Readers cannot share the lock forever. This prevents
starvation of the writer.
+ Run interface media ioctl with shared netlock so packets can
be processed while running ifconfig(8).
+ btrace(8) can be used to debug reference counting.
+ Use MP safe refcount for interface addresses.
+ Unlocked kbind(2).
+ Unlocked the pledge(2) system call.
+ Made UNIX domain sockets locking per-socket rather than
coarse locking of the entire domain sockets layer.
* Direct Rendering Manager and graphics drivers
+ Updated drm(4) to Linux 5.15.69
+ inteldrm(4): support for Alder Lake, Raptor Lake
+ Reimplemented the TTM page allocation code using bus_dma(9)
APIs to make sure DMA addresses are translated properly on
architectures with an IOMMU. This fixed amdgpu(4) and
radeondrm(4) on powerpc64, sparc64, and arm64 machines with
SMMU.
+ Implemented support for framebuffers that don't start on a
page boundary (like those on the 2021 14" and 16" MacBook
Pro).
+ Added handling for framebuffers where the first pixel isn't
page-aligned to wsfb(4).
+ Fixed Xorg(1) when using the luna88k 1bpp framebuffer
hardware.
* VMM/VMD improvements
+ Improved error handling and logging in vmd(8)
+ Unify all internal structures and interfaces between vmd(8),
vmctl(8) and vmm(4) to use bytes for memory and disk sizes.
+ Fix rebooting a received VM in vmd(8).
+ Have vmd(8) provide a copy of bios at 4g boundary. SeaBIOS
and newer Linux kernels expect it there.
+ In vmd(8), fix off by one in VM memory range check.
+ In vmd(8), add support for MMIO assist. In vmm(4), send all
port I/O emulation to userland.
+ Have vmd(8) compute i8254 read-back command latch from
singular timestamp.
+ Improve the command line parsing in vmctl(8).
+ Let vmm(4) allow reading MSR_TSC on Intel hosts.
+ In vmm(4), reference count VMs and VCPUs.
+ In vmm(4), zero virtual addresses of VCPU state pages after
freeing.
+ Fix `vmctl send` on Intel hosts by load the vmcs before
reading VCPU registers in vmm(4).
+ Fix `vmctl receive` on Intel hosts by adding an additional
fault type in vmm(4).
+ Add additional dt(4) tracepoints in various vmm(4) codepaths.
+ Add snmpd(8) AgentX support based around VM-MIB (RFC7666).
* Various new userland features:
+ Replaced rc.d(8) $rcexec variable with an rc_exec function.
This will require a mechanical change from ${rcexec} to
rc_exec in rc.d scripts. Kept compatibility to give people a
chance to fix their custom scripts.
+ Introduced a new daemon_execdir variable to rc.d(8) for
changing to a specified directory before running rc_exec.
+ Added ts(1), a timestamp utility.
+ Add a new configtest action to rc.d(8) and rcctl(8) to check
configuration syntax of a daemon.
+ Added forest (-f) mode to ps(1).
* Various bugfixes and tweaks in userland:
+ Fixed openrsync(1) on sparc64 by eliminating a redundant
second conversion of the int value from little to host
endian.
+ Added connection timeout functionality to openrsync(1) via
the --contimeout option.
+ Set the default openrsync(1) connection timeout that
rpki-client(8) uses to 15 seconds.
+ Made use of the fact that repositories are unique objects in
pkg_add(1) and annotated the quirks repository as cached,
allowing for a large speed increase.
+ Enabled pkg_add(1) caching by default.
+ Changed the tied algorithm in pkg_add(1) to prevent O(n^2)
behavior when packages contain several hundred copies of the
same file.
+ Added a "processing" message for when pkg_add(1) is
transferring data to inform the user that pkg_add is still
working.
+ Added missing uuid_dec_le() to init_gp() so fdisk(8) -A works
on big-endian architectures.
+ Aligned fdisk(8) logic with that used in the kernel to allow
the protective EFI GPT partition to be in MBR partitions 0-3,
not just 0.
+ Prevented use of "-u" when fdisk(8) is operating on GPT
formatted disks.
+ Stopped telling fdisk(8) that macppc HAS_MBR.
+ Made fdisk(8) reject input of excessive length.
+ Fixed an fdisk(8) regression to allow editing an MBR of all
zeroes.
+ Changed fdisk(8) to restrict user actions if neither GPT nor
MBR structures can be found on the disk.
+ Made fdisk(8) print a warning when an MBR partition starts or
extends past the end of the device.
+ Made fdisk(8) print a warning when a GPT partition start or
end is outside the usable LBA area of the device.
+ Made fdisk(8) display "Microsoft basic data" instead of
"FAT12" for GPT_UUID_MSDOS partitions.
+ Made fdisk(8) print GPT attributes in verbose output.
+ Made fdisk(8) use the correct GPT bootable attribute bit.
+ Made fdisk(8) not spoof GPT partitions with the attribute
REQUIRED.
+ Made fdisk(8) ensure GPT headers, table entries and usable
area don't overlap each other.
+ Removed disklabel(8) ability to edit disk geometry
information.
+ Removed disklabel(8) and disktab(5) support for 'bs'
(bootblock size) and 'sb' (superblock size) attributes.
+ Added keyword 'raid' to disklabel(8) template files, allowing
auto-allocation of RAID partitions.
+ Removed disklabel(8) support for disktab(5) 'd[0-4]' (drive
data) attributes.
+ Installed useful btrace(8) scripts in /usr/share/btrace.
+ Made btrace(8) execute the END probe upon receiving a SIGTERM
signal.
+ Moved the wait for autoconf interfaces from rc(8) to netstart
(8) to fix tunnel interfaces that depend on working autoconf
interfaces.
+ Made netstart(8) create virtual interfaces up front if
specified on the command line.
+ Changed rc.subr(8) to copy the message to stdout when using
logger(1) to avoid needing to check syslog when running in
debug mode.
+ Fixed kbd(8) so it doesn't fail silently when executed by a
regular user.
+ In the sndio library, added the function sio_flush(3) to stop
playback immediately. Altered sndiod(8) to wait until the
buffer is drained before closing the device.
+ Made xterm(1) use a much safer FD-passing idiom for updating
utmp(5).
+ Prevented a crash in vi(1) when cursor key support is
disabled.
+ Updated vi(1) to apply expandtab to the output of a !
command.
+ Made mg(1) automatically delete trailing whitespace on RET in
c-mode and auto-indent-mode.
+ Made grep(1) provide full context when using match count (-m)
+ Added the --null flag to grep(1) which makes grep print an
ASCII NUL byte after the file name to make the output
unambiguous.
+ Fixed multiple memory leaks in awk(1).
+ Changed compress(1) to print a more accurate message when -v
is used with -k.
+ Fixed gzip(1) byte counts with 32-bit integers.
+ Fixed the growth check in compress(1) and gzip(1) in cases of
small files or files with sufficiently random data.
+ Made timeout(1) -s accept HUP like kill(1) and GNU timeout(1)
do.
+ Updated capitals and countries in the game quiz(6).
+ Set default sleep value of ico(1) to 10ms.
+ Fixed a bug in cron(8) where it could exit silently if ppoll
(2) exited. Now it will log to syslog(3) instead of stderr.
+ Added llvm-profdata(1) to base so that ports can benefit from
profiled builds.
+ Changed rc(8) to only attempt to set the yp(8) domainname if
it has not been set yet.
+ Raised the "staff" login class data-size-cur on arm64 to be
the same as that for amd64 in login.conf(5) (1536M).
+ Fixed patch(1) locate-hunk in empty files.
+ Fixed patch(1) in the case of reversing a patch that creates
a file.
+ Added seconds to the uptime display of top(1).
+ Made putenv(3) return an error if the string starts with the
'=' character. This matches the behavior on FreeBSD and
NetBSD.
+ Fixed overflow of the number of errors in renice(8) by
setting error instead of incrementing it.
+ Removed the "-c" compatibility option from vnconfig(8).
+ Stopped vnconfig(8) from printing the device name on failure.
+ Print a message when ld.so(1) fails inside execve(2) to
clarify the failure mode when a dynamic executable is run
while /usr isn't mounted.
+ Improved bioctl(8) RAID level parsing to check numeric levels
before checking single character levels. This allows
recognition of RAID 10 as a valid but unsupported level.
+ Fixed installboot(8) messaging when verbose (-v) and dry-run
(-n) modes are combined with softraid(4).
+ Sped up wc(1) word counting.
* Improved hardware support and driver bugfixes, including:
+ New aplaudio(4) driver for Apple audio subsystem.
+ New aplmca(4) driver for Apple MCA controller.
+ New aplsart(4) driver for Apple SART address filter.
+ New alpdc, apldchidev, apldckbd, apldcms, and aplrtk drivers
for keyboard and trackpad on Apple M2 laptops.
+ New qcgpio(4) driver for Qualcomm Snapdragon GPIO controller.
+ New qciic(4) driver for Qualcomm Snapdragon GENI I2C
controller.
+ New sfgpio(4) driver for SiFive GPIO controller.
+ New stfclock(4) driver for StarFive JH7100 clock controller.
+ New stfpinctrl(4) driver for StarFive JH7100 pin
configuration.
+ New stftemp driver for StarFive JH7100 temperature sensor.
+ New sxirintc(4) driver for Allwinner wakeup interrupt
controller.
+ New gpiorestart driver for system reset via GPIO pin.
+ Added support for more power sensors to ipmi(4).
+ Added support for the ehci(4) controller on Marvell 3720
boards.
+ Extended ksmn(4) to show CCD temperatures if available.
+ Fixed missing interrupts for trackpads on some machines after
resume by making sure amdgpio(4) restores pin configuration
on resume.
+ Added FIFO support and allow baud rate changes to pluart(4).
+ Added support for the Synopsys DesignWare UART found on the
Ryzen Embedded V1000 SoCs to com(4).
+ Added xhci(4) support for the dual role controllers
integrated on the Qualcomm Snapdragon 8cx gen 3 SoC.
+ Added support for using the power button to wake up from
suspend to axppmic(4).
+ Modified pms(4) to discard relative movement packets outside
of the [-127, 127] range to prevent cursor jumps when using
the trackpoint on some Lenovo laptops.
+ Allowed spdmem(4) to attach to gdiumiic(4).
+ Make spdmem(4) attach on 2F-based loongson systems.
+ Added power button support to aplsmc(4).
+ Changed the mfii(4) RAID controller driver to allow the
firmware more time to transition out of the UNDEFINED state.
+ Added Wacom One S (CTL-472) support to uwacom(4).
* New or improved network hardware support:
+ Increased rx buffer size on uaq(4) to 62kB.
+ Repaired rge(4) hardware VLAN tagging.
+ Provide statistics via kstats for mvneta(4).
+ Enabled aq(4) on arm64.
+ Implemented and enabled IPv4, TCP, and UDP checksum
offloading for igc(4).
+ Fixed a panic triggered by ifconfig bnxt0 down by changing
bnxt(4) devices to not run rx and tx interrupt handlers when
the interface is not running.
+ Introduced Large Receive Offloading of TCP segment offloading
in ix(4). Also added a tso option to ifconfig(8) to enable
and disable this feature.
* Added or improved wireless network drivers:
+ Made device matching in iwx(4) more similar to Linux iwlwifi
in order to recognize more devices.
+ Added support for AX210/AX211 devices to iwx(4).
+ Fixed iwx(4) setting of HT/VHT bits in rate flags of the Tx
command that could cause a firmware panic.
+ Added handling of 9k devices which do not support antenna B
to iwm(4).
+ Fixed bwfm(4) ifconfig media display on devices with sta_info
command version 3.
+ Fixed a bwfm(4) crash during USB detach.
+ Fixed detection of the Rx data rate on rtl8192eu urtwn(4)
devices.
+ Fixed integer overflows in the iwm(4) and iwx(4) firmware
file parsers.
* IEEE 802.11 wireless stack improvements and bugfixes:
+ Make sure drivers initialize all of ieee80211_rxinfo struct.
* Installer, upgrade and bootloader improvements:
+ Fixed the watchdog in the installer so that it is reset after
each download and each set installation.
+ Ensured that running sysupgrade(8) on -stable will move to
the next release, not -current.
+ Added the -b option to sysupgrade(8) to set an alternative
base directory to which the installation files will be
downloaded.
+ Increased the disklabel(8) auto partitioner's maximum size
for /usr to 30G.
+ Altered installer behavior so the vlan(4) question won't be
asked unless another network interface exists.
+ Added support for wildcards in fw_update(8) patterns.
+ Added support for booting from RAID 1C softraid(4) volumes on
amd64, sparc64 and arm64.
+ Added NFS client support to the luna88k RAMDISK kernel.
+ Made the EFI bootloader provide the extra parameters
necessary to use non-standard UARTs on the AMD Ryzen Embedded
V1000 SoCs as console.
+ Switched bootloaders to the extended BOOTARG_CONSDEV struct.
+ Added UFS2 support to landisk boot blocks.
+ Removed "force CHS" capabilty from biosboot(8)
* Security improvements:
+ Implemented privilege separation in xlock(1).
+ Added privilege separation to snmpd(8).
+ The TZ environment variable no longer supports absolute
paths, to fit better into the pledge(2) bypass model.
+ AF_UNIX socket bind(2) and connect(2) now follow unveil(2)
configuration.
+ New ypconnect(2) system call creates a socket based upon the
IP address encoded directly in a locked ypbinding file,
thereby removing a horrible hack to support YP lookups in
programs using strong pledge(2) rules.
+ Processes that pledge("vminfo") may now use the read-only
swapctl(2) operations SWAP_NSWAP and SWAP_STATS providing
information on swap devices.
+ Randomized the rekey interval of arc4random(3).
+ Reduce the attack surface by introducing a 'local bind' mode
to ypldap(8). In this mode ypldap binds its RPC sockets to
loopback, so YP services are only available to the host it's
running on. ypldap writes the YP binding file in /var/yp/
binding itself and replaces ypbind(8) and ypserv(8). This
also implies that portmap(8) doesn't need to be running
anymore when local bind mode is used.
+ Changed the /sbin daemons dhcpleased(8), mountd(8), nfsd(8),
pflogd(8), resolvd(8), slaacd(8), and unwind(8) to be
dynamically linked to allow them to benefit from all the
additional mitigations that dynamically linked executables
gain. NFS mounting of /usr must now use statically configured
IP addresses.
* Changes in the network stack:
+ Added the recvmmsg(2) system call that allows receiving
multiple msghdrs at once, and the sendmmsg syscall that
allows sending multiple msghdrs at once.
+ Relaxed address availability check for multicast(4) binds so
processes listening for the same multicast address do not
need to be the same UID.
+ Introduced dedicated link entries for snapshots to pfsync(4).
+ Changed pf(4) handling of IGMP and ICMP6 MLD packets to allow
multicast control packets to work by default.
+ Made pf(4) more paranoid about IGMP/MLD messages.
+ Fixed a logic bug in pf_find_state() that could cause pf(4)
to incorrectly block a packet.
+ Fixed pf(4) syncookies during fast TCP port reuse.
+ Fixed a bug in pf(4) where a pool defined like "172.16.0.0/
16" would count as a pool size of one address. Also fixed
random selection of source address to be uniform across the
whole pool.
+ Fixed a kernel panic in pf(4) if IP options with an ICMP
payload were truncated. Such packets will now be dropped
instead.
+ Allow forwarding to and from IPs in the 240/4 range.
+ Corrected the Virtual Ethernet Bridge veb(4) to avoid calling
if_enqueue from an smr critical section.
+ Reworked the kroute rttimer code to fix icmp_pmtu_timeout
crashes.
+ Fixed an interrupt storm upon suspend on Amlogic arm64
boards.
+ Fixed a race between pflow_output_process() and
pflow_clone_destroy() in pflow(4).
+ Added a missing input validation step to pipex(4) MPPE
keylenbits.
* Routing daemons and other userland network improvements:
+ IPsec support was improved:
o Made iked(8) ignore any CERT payload after the first
rather than failing the exchange when more than one CERT
payload is received.
o Added iked(8) support for sending certificate chains with
intermediate CAs in multiple CERT payloads.
o Added an OpenIKED Vendor ID payload in the iked(8)
initial handshake to make it easier to handle
interoperability problems with older versions in the
future.
o Added iked(8) connection statistics for successful and
failed connections, error types, and other events that
can be printed with "ikectl show stats".
+ In bgpd(8),
o Implement max-communities filter to limit the number of
allowed communities, ext-communities and
large-communities.
o Fix insertion of additional non-transitive extended
communities when sending out prefixes.
o Relax IP address limitation by allowing prefixes in 240/
4.
o Implement RFC 9234 - Route Leak Prevention and Detection
Using Roles in UPDATE and OPEN Messages.
o Full support for RFC 7911 - Advertisement of Multiple
Paths in BGP (ADD-PATH).
o Improve FIB code, handle IPv6 scoped addresses properly.
o Add bgplgd(8), a FastCGI server providing a REST API to
execute bgpctl(8) commands.
o Bugfix: bgpd(8) could fail to invalidate nexthops and
incorrectly leave them in the FIB or Adj-RIB-Out.
o Speedup bgpctl show rib 10/8 or-longer and show rib 10/8
or-shorter
o Switch various static hash tables to RB trees improving
performance on large systems
o Export per neighbor pending update and withdraw
statistics
o Fix race between a neighbor session reset and its update
message backlog
o Improve handling of nexthop reachability state changes
o Made sure only one bgpd(8) roa softreconfig runner is run
at any time.
+ rpki-client(8) saw some changes:
o Allowed more than one CRL URI in certificates.
o Do not apply timezone offsets when converting X509 times.
X509 times are in UTC and comparing them to times in
different timezones would cause validity problems.
o Add support for an operator-configurable skiplist
facility. Operators can specify a list of FQDNs which
should not be contacted when synchronizing the local
cache to the network.
o Emit a warning when a RRDP session serial number
decreases.
o DER decoding functions were refactored to leverage ASN.1
templates.
o Add support to validate & inspect .sig files containing
RPKI Signed Checklists in filemode (-f).
(draft-ietf-sidrops-rpki-rsc-08)
o Print various statistics after the completion of the main
process.
o Add support to decode & print TAL (RFC 8630) details in
filemode (-f).
o Emit objects in Concatenated JSON format when filemode
(-f) and the JSON output flag (-j) are combined.
o Add support for validating Autonomous System Provider
Authorization (ASPA) objects conforming to
draft-ietf-sidrops-aspa-profile-10. Validated ASPA
payloads are visible in JSON and filemode (-f) output.
o Set rsync(1) connection I/O idle timeout to 15 seconds.
o Unify the maximum idle I/O and connect timeouts for rsync
(1) & HTTPS.
o rpki-client(8) now performs stricter EE certificate
validation:
# Disallow AS Resources extensions in ROA EE
certificates.
# Disallow Subject Information Access (SIA) extensions
in RPKI Signed Checklist (RSC) EE certs.
# Check the resources in ROAs and RSCs against EE
certs.
o Improve readability and add various information being
printed in verbose mode.
o Extend filemode (-f) output and print X.509 certificates
in PEM format when increased verbosity (-vv) is
specified.
o Shorten the RRDP I/O idle timeout.
o Introduce a deadline timer that aborts all repository
synchronization after seven eights of timeout (-s). With
this rpki-client has improved chances to complete and
produce an output even when a CA is excessively slow.
o Abort a currently running RRDP request process when the
per-repository timeout is reached.
o Permit multiple AccessDescription entries in SIA X.509
extensions. While fetching from secondary locations is
not yet supported, rpki-client will not treat occurrence
as a fatal error.
o Resolve a potential for a race condition in non-atomic
RRDP deltas.
o Fix some memory leaks.
o Improve compliance with the HTTP protocol specification.
+ In snmpd(8),
o Allow object names to be used in addition to OIDs in
snmpd.conf(5).
o Better type hinting for debug logging.
o Introduce a blocklist feature, which removes subtrees
from view.
o Reintroduce AgentX master support.
o Move non-SNMP related metrics to their own AgentX based
backend.
o The snmpe process is now pledged stdio recvfd inet unix.
o Imported snmpd_metrics(8). This allows those who need to
use net-snmpd the ability to access base snmpd(8)
metrics.
+ In ldapd(8), match password schemas case sensitive.
+ In ospfd(8), relax the limitations on what is an acceptable
unicast IP. There are no more experiments in IPv4 and so
there is less reason for network daemons to deny formerly
experimental IP space. Multicast IPs (224/4) and loopback
(127/8) are still disallowed.
+ Added check to acme-client(1) to ensure the challenge token
is turned into a filename that is base64url encoded.
+ Added RFC 9234 "BGP Role" support to tcpdump(8)
+ Have tcpdump(8) print ASnumbers in 'asplain' format instead
of the old 'asdot' format.
+ Fixed a crash in libpcap when it would walk off the end of
the array performing frees.
+ Made -X connect SOCKS work with IPv6 addresses in nc(1).
+ Introduced a blocklist backend and keyword to snmpd(8), this
deprecates filter-pf-addresses.
+ Changed dhclient(8) to defer to dhcpleased(8) by doing execve
ifconfig and providing syslog warnings about deprecated
options.
+ Implemented dig(1) support for SVCB and HTTPS record types.
+ Made resolvd(8) write /etc/resolv.conf in a more atomic
manner.
+ Added a slowcgi(8) -t flag to change the request timeout.
+ Corrected handling of an abnormal FastCGI termination in
httpd(8).
+ Made newer MIME type definitions take precedence over
existing ones in httpd(8).
+ Moved the relayd(8) daemon(3) call to just before forking the
children so the parent disassociates from its controlling
terminal and shell, but not from its children.
+ Changed ftp(1) to use non-blocking connect(2) with ppoll(2)
and timeout instead of alarm(3). This allows failing over to
another IP address for hosts that have more than one.
* tmux(1) improvements and bug fixes:
+ Added an ACL list for multiple users attaching to the tmux(1)
socket.
+ Ensured cursor remains on selected item on menu.
+ Added support for OSC 8 hyperlinks.
+ Added support for hyperlinks with capture-pane -e and a
mouse_hyperlink format.
+ Added an "all" state to allow-passthrough to work even in
invisible panes.
+ Fixed a crash when searching for .* with extremely long
lines.
+ Added vi(1) Home/End bindings.
+ Added a Nobr terminfo capability to tell tmux(1) the terminal
does not use bright colors for bold.
+ Added a notification when a paste buffer is deleted.
+ Fixed window size reporting.
* LibreSSL version 3.6.0
+ New features
o EVP API for HKDF ported from OpenSSL and subsequently
cleaned up.
o The security level API (SSL_{,CTX}_{get,set}
_security_level()) is now available. Callbacks and
ex_data are not supported. Sane software will not be
using this.
o Experimental support for the BoringSSL QUIC API.
o Add initial support for TS ESSCertIDv2 verification.
o LibreSSL now uses the Baillie-PSW primality test instead
of Miller-Rabin.
+ Compatibility changes
o The ASN.1 time parser has been refactored and rewritten
using CBS. It has been made stricter in that it now
enforces the rules from RFC 5280.
o ASN1_AFLG_BROKEN was removed.
o Error check tls_session_secret_cb() like OpenSSL.
o Added ASN1_INTEGER_{get,set}_{u,}int64()
o Move leaf certificate checks to the last thing after
chain validation.
o Added -s option to openssl(1) ciphers that only shows the
ciphers supported by the specified protocol.
o Use TLS_client_method(3) instead of TLSv1_client_method
(3) in the openssl(1) ciphers command.
o Validate the protocols in SSL{_CTX,}_set_alpn_protos().
o Made TS and PKCS12 opaque.
o Per RFC 7292, safeContentsBag is a SEQUENCE OF, not a SET
OF.
o Align PKCS12_key_gen_uni() with OpenSSL
o Various PKCS12 and TS accessors were added. In
particular, the TS_RESP_CTX_set_time_cb() function was
added back.
o Allow a NULL header in PEM_write{,_bio}()
o Allow empty attribute sets in CSRs.
o Adjust signatures of BIO_ctrl functions.
o Provide additional defines for EVP AEAD.
o Provide OPENSSL_cleanup().
o Make BIO_info_cb() identical to bio_info_cb().
+ Bug fixes
o Avoid use of uninitialized in BN_mod_exp_recp().
o Fix X509_get_extension_flags() by ensuring that
EXFLAG_INVALID is set on X509_get_purpose() failure.
o Fix HMAC() with NULL key.
o Add ERR_load_{COMP,CT,KDF}_strings() to
ERR_load_crypto_strings().
o Avoid strict aliasing violations in BN_nist_mod_*().
o Do not return X509_V_ERR_UNSPECIFIED from X509_check_ca()
. No return value of X509_check_ca() indicates failure.
Application code should therefore issue a checked call to
X509_check_purpose() before calling X509_check_ca().
o Rewrite and fix X509v3_asid_subset() to avoid segfaults
on some valid input.
o Call the ASN1_OP_D2I_PRE callback after ASN1_item_ex_new
().
o Fix d2i_ASN1_OBJECT to advance the *der_in pointer
correctly.
o Avoid use of uninitialized in ASN1_STRING_to_UTF8().
o Do not pass uninitialized pointer to ASN1_STRING_to_UTF8
().
o Do not refuse valid IPv6 addresses in nc(1)'s HTTP
CONNECT proxy.
o Do not reject primes in trial divisions.
o Error out on negative shifts in BN_{r,l}shift() instead
of accessing arrays out of bounds.
o Fix URI name constraints, allow for URIs with no host
part.
o Fix the legacy verifier callback behaviour for untrusted
certs.
o Correct serfver-side handling of TLSv1.3 key updates.
o Plug leak in PKCS12_setup_mac().
o Plug leak in X509V3_add1_i2d().
o Only print X.509 versions we know about.
o Avoid signed integer overflow due to unary negation
o Initialize readbytes in BIO_gets().
o Plug memory leak in CMS_add_simple_smimecap().
o Plug memory leak in X509_REQ_print_ex().
o Check HMAC() return value to avoid a later use of
uninitialized.
o Avoid potential NULL dereference in ssl_set_pkey().
o Check return values in ssl_print_tmp_key().
o Switch loop bounds from size_t to int in check_hosts().
o Avoid division by zero if no connection was made in
s_time.c.
o Check sk_SSL_CIPHER_push() return value
o Avoid out-of-bounds read in ssl_cipher_process_rulestr().
o Use LONG_MAX as the limit for ciphers with long based
APIs.
+ Internal improvements
o Avoid expensive RFC 3779 checks during cert verification.
o The templated ASN.1 decoder has been cleaned up,
refactored, modernized with parts rewritten using CBB and
CBS.
o The ASN.1 time parser has been rewritten.
o Rewrite and fix ASN1_STRING_to_UTF8().
o Use asn1_abs_set_unused_bits() rather than inlining it.
o Simplify ec_asn1_group2curve().
o First pass at a clean up of ASN1_item_sign_ctx()
o ssl_txt.c was cleaned up.
o Internal function arguments and struct member have been
changed to size_t.
o Lots of missing error checks of EVP API were added.
o Clean up and clarify BN_kronecker().
o Simplify ASN1_INTEGER_cmp()
o Rewrite ASN1_INTEGER_{get,set}() using CBS and CBB and
reuse the ASN1_INTEGER functions for ASN1_ENUMERATED.
o Use ASN1_INTEGER to parse and build {Z,}LONG_it
o Refactored and cleaned up group (elliptic curve) handling
in t1_lib.c.
o Simplify certificate list handling code in the legacy
server.
o Make CBB_finish() fail if *out_data is not NULL.
o Remove tls_buffer_set_data() and remove/revise callers.
o Rewrite SSL{_CTX,}_set_alpn_protos() using CBS.
o Simplify tlsext_supported_groups_server_parse().
o Remove redundant length checks in tlsext parse functions.
o Simplify tls13_server_encrypted_extensions_recv().
o Add read and write support to tls_buffer.
o Convert TLS transcript from BUF_MEM to tls_buffer.
o Clear key on exit in PKCS12_gen_mac().
o Minor fixes in PKCS12_parse().
o Provide and use a primitive clear function for BIGNUM_it.
o Use ASN1_INTEGER to encode/decode BIGNUM_it.
o Add stack frames to AES-NI x86_64 assembly.
o Use named initialisers for BIGNUMs.
o Tidy up some of BN_nist_mod_*.
o Expand BLOCK_CIPHER_* and related macros.
o Avoid shadowing the cbs function parameter in
tlsext_alpn_server_parse()
o Deduplicate peer certificate chain processing code.
o Make it possible to signal an error from an i2c_*
function.
o Rewrite i2c_ASN1_INTEGER() using CBB/CBS.
o Remove UINT32_MAX limitation on ChaCha() and
CRYPTO_chacha_20().
o Remove bogus length checks from
EVP_aead_chacha20_poly1305().
o Reworked DSA_size() and ECDSA_size().
o Stop using CBIGNUM_it internal to libcrypto.
o Provide c2i_ASN1_ENUMERATED_cbs() and call it from
asn1_c2i_primitive().
o Ensure ASN.1 types are appropriately encoded.
o Avoid recycling ASN1_STRINGs when decoding ASN.1.
o Tidy up asn1_c2i_primitive() slightly.
o Mechanically expand IMPLEMENT_BLOCK_CIPHER,
IMPLEMENT_CFBR, BLOCK_CIPHER and the looney M_do_cipher
macros.
o Use correct length for EVP CFB mode ciphers.
o Provide a version of ssl_msg_callback() that takes a CBS.
o Use CBS to parse TLS alerts in the legacy stack.
o Increment the input and output position for EVP AES CFB1.
o Ensure there is no trailing data for a CCS received by
the TLSv1.3 stack.
o Use CBS when procesing a CCS message in the legacy stack.
o Be stricter with middlebox compatibility mode in the
TLSv1.3 server.
* OpenSSH 9.1
+ Security
o ssh-keyscan(1): fix a one-byte overflow in SSH banner
processing
o ssh-keygen(1): fix double free() in error path of signing
/verify code
o ssh-keysign(8): fix double-free in error path introduced
in OpenSSH 8.9.
+ Potentially-incompatible changes
o ssh(1), sshd(8): SetEnv directives in ssh_config and
sshd_config are now first-match-wins to match other
directives. Previously if an environment variable was
multiply specified the last set value would have been
used.
o ssh-keygen(8): ssh-keygen -A (generate all default host
key types) will no longer generate DSA keys, as these are
insecure and have not been used by default for some
years.
o ssh(1), sshd(8): add a RequiredRSASize directive to set a
minimum RSA key length. Keys below this length will be
ignored for user authentication and for host
authentication in sshd(8).
ssh(1) will terminate a connection if the server offers
an RSA key that falls below this limit, as the SSH
protocol does not include the ability to retry a failed
key exchange
o sftp-server(8): add a users-groups-by-id@openssh.com
extension request that allows the client to obtain user/
group names that correspond to a set of uids/gids.
o sftp(1): use users-groups-by-id@openssh.com sftp-server
extension (when available) to fill in user/group names
for directory listings.
o sftp-server(8): support the home-directory extension
request defined in
draft-ietf-secsh-filexfer-extensions-00. This overlaps a
bit with the existing "expand-path@openssh.com", but some
other clients support it.
o ssh-keygen(1), sshd(8): allow certificate validity
intervals, sshsig verification times and authorized_keys
expiry-time options to accept dates in the UTC time zone
in addition to the default of interpreting them in the
system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times
will be interpreted as UTC if suffixed with a 'Z'
character.
Also allow certificate validity intervals to be specified
in raw seconds-since-epoch as hex value, e.g. -V
0x1234:0x4567890. This is intended for use by regress
tests and other tools that call ssh-keygen as part of a
CA workflow.
o sftp(1): allow arguments to the sftp -D option, e.g. sftp
-D /usr/libexec/sftp-server -el debug3.
o ssh-keygen(1): allow the existing -U (use agent) flag to
work with -Y sign operations, where it will be
interpreted to require that the private keys is hosted in
an agent.
+ Bugfixes
o ssh-keygen(1): implement the "verify-required"
certificate option. This was already documented when
support for user-verified FIDO keys was added, but the
ssh-keygen(1) code was missing.
o ssh-agent(1): hook up the restrict_websafe command-line
flag; previously the flag was accepted but never actually
used.
o sftp(1): improve filename tab completions: never try to
complete names to non-existent commands, and better match
the completion type (local or remote filename) against
the argument position being completed.
o ssh-keygen(1), ssh(1), ssh-agent(1): several fixes to
FIDO key handling, especially relating to keys that
request user-verification. These should reduce the number
of unnecessary PIN prompts for keys that support
intrinsic user verification.
o ssh-keygen(1): when enrolling a FIDO resident key, check
if a credential with matching application and user ID
strings already exists and, if so, prompt the user for
confirmation before overwriting the credential.
o sshd(8): improve logging of errors when opening
authorized_keys files.
o ssh(1): avoid multiplexing operations that could cause
SIGPIPE from causing the client to exit early. bz3454
o ssh_config(5), sshd_config(5): clarify that the
RekeyLimit directive applies to both transmitted and
received data.
o ssh-keygen(1): avoid double fclose() in error path.
o sshd(8): log an error if pipe() fails while accepting a
connection.
o ssh(1), ssh-keygen(1): fix possible NULL deref when built
without FIDO support.
o ssh-keyscan(1): add missing *-sk types to ssh-keyscan
manpage.
o sshd(8): ensure that authentication passwords are cleared
from memory in error paths.
o ssh(1), ssh-agent(1): avoid possibility of notifier code
executing kill(-1).
o ssh_config(5): note that the ProxyJump directive also
accepts the same tokens as ProxyCommand.
o scp(1): do not not ftruncate(3) files early when in sftp
mode. The previous behaviour of unconditionally
truncating the destination file would cause scp ~/foo
localhost: and scp localhost:foo ~/ to delete all the
contents of their destination.
o ssh-keygen(1): improve error message when ssh-keygen -Y
sign is unable to load a private key.
o sftp(1), scp(1): when performing operations that glob(3)
a remote path, ensure that the implicit working directory
used to construct that path escapes glob(3) characters.
This prevents glob characters from being processed in
places they shouldn't, e.g. cd /tmp/a*/, get *.txt should
have the get operation treat the path /tmp/a* literally
and not attempt to expand it.
o ssh(1), sshd(8): be stricter in which characters will be
accepted in specifying a mask length; allow only 0-9.
o ssh-keygen(1): avoid printing hash algorithm twice when
dumping a KRL.
o ssh(1), sshd(8): continue running local I/O for open
channels during SSH transport rekeying. This should make
~-escapes work in the client (e.g. to exit) if the
connection happened to have stalled during a rekey event.
o ssh(1), sshd(8): avoid potential poll() spin during
rekeying
o Further hardening for sshbuf internals: disallow
"reparenting" a hierarchical sshbuf and zero the entire
buffer if reallocation fails.
* mandoc 1.14.6 plus some new features and many bugfixes,
including:
+ Significantly improved accessibility of mandoc(1) -T html and
man.cgi(8) output by using semantically better HTML elements
in several places and by adding ARIA and DPUB-ARIA roles and
aria-label attributes to several HTML elements.
+ Got rid of archaic HTML table markup for header and footer
lines in favor of flexbox CSS. Rendering now adapts to
browser windows of arbitrary narrowness.
+ Prevented -T html output from turning breakable hyphens into
underscores in URI fragment identifiers.
+ Improved the roff(7) escape sequence parser in several
fundamental ways regarding output correctness and groff
compatibility.
+ Corrected output that depends on the order of evaluation of
roff(7) escape sequences by parsing them left-to-right rather
than right-to-left.
+ Significantly improved -T lint diagnostics regarding syntax
errors in roff(7) escape sequences and in their arguments.
+ Stopped emitting vertical space before the tbl(7) .TS (table
start) macro for compatibility with the same change in groff.
This implies .PP or .Pp macros may need to be inserted before
.TS in some (but not all!) places in some manual pages using
tbl(7).
+ Stopped skipping vertical space after the tbl(7) .TE (table
end) macro of boxed tables for compatibility with the same
change in groff. This implies .sp requests may need to be
removed after .TE in some manual pages using tbl(7).
+ Corrected the calculation of the width of spanned tbl(7)
columns.
+ Improved the handling of literal tab characters in filled
text in multiple ways for compatibility with groff and
Heirloom troff.
+ Plus bugfixes for two segfaults, two infinite loops, and
several assertion failures.
* Ports and packages:
Many pre-built packages for each architecture:
+ aarch64: 11261
+ amd64: 11451
+ arm: XXXX
+ i386: 10225
+ mips64: 8759
+ powerpc: XXXX
+ powerpc64: XXXX
+ riscv64: 9808
+ sparc64: 9275
Some highlights:
+ Asterisk 16.28.0, 18.14.0 and 19.6.0
+ Audacity 2.4.2
+ CMake 3.24.2
+ Chromium 105.0.5195.125
+ Emacs 28.2
+ FFmpeg 4.4.2
+ GCC 8.4.0 and 11.2.0
+ GHC 9.2.4
+ GNOME 42.4
+ Go 1.19.1
+ JDK 8u342, 11.0.16 and 17.0.4
+ KDE Applications 22.08.1
+ KDE Frameworks 5.98.0
+ Krita 5.1.1
+ LLVM/Clang 13.0.0
+ LibreOffice 7.4.1.2
+ Lua 5.1.5, 5.2.4 and 5.3.6
+ MariaDB 10.9.3
+ Mono 6.12.0.182
+ Mozilla Firefox 105.0.1 and ESR 102.3.0
+ Mozilla Thunderbird 102.3.0
+ Mutt 2.2.7 and NeoMutt 20220429
+ Node.js 16.17.1
+ OCaml 4.12.1
+ OpenLDAP 2.6.3
+ PHP 7.4.30, 8.0.23 and 8.1.10
+ Postfix 3.7.2
+ PostgreSQL 14.5
+ Python 2.7.18, 3.9.14 and 3.10.7
+ Qt 5.15.6 and 6.3.1
+ R 4.2.1
+ Ruby 2.7.6, 3.0.4 and 3.1.2
+ Rust 1.63.0
+ SQLite 3.39.3
+ Shotcut 22.06.23
+ Sudo 1.9.11.2
+ Suricata 6.0.6
+ Tcl/Tk 8.5.19 and 8.6.12
+ TeX Live 2021
+ Vim 9.0.0192 and Neovim 0.7.2
+ Xfce 4.16
* As usual, steady improvements in manual pages and other
documentation.
* The system includes the following major components from outside
suppliers:
+ Xenocara (based on X.Org 7.7 with xserver 21.1.4 + patches,
freetype 2.12.1, fontconfig 2.13.94, Mesa 22.1.7, xterm 372,
xkeyboard-config 2.20, fonttosfnt 1.2.2 and more)
+ LLVM/Clang 13.0.0 (+ patches)
+ GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
+ Perl 5.32.1 (+ patches)
+ NSD 4.6.0
+ Unbound 1.16.3
+ Ncurses 5.7
+ Binutils 2.17 (+ patches)
+ Gdb 6.3 (+ patches)
+ Awk September 12, 2022
+ Expat 2.4.9
---------------------------------------------------------------------
How to install
Please refer to the following files on the mirror site for extensive
details on how to install OpenBSD 7.2 on your machine:
* .../OpenBSD/7.2/alpha/INSTALL.alpha
* .../OpenBSD/7.2/amd64/INSTALL.amd64
* .../OpenBSD/7.2/arm64/INSTALL.arm64
* .../OpenBSD/7.2/armv7/INSTALL.armv7
* .../OpenBSD/7.2/hppa/INSTALL.hppa
* .../OpenBSD/7.2/i386/INSTALL.i386
* .../OpenBSD/7.2/landisk/INSTALL.landisk
* .../OpenBSD/7.2/loongson/INSTALL.loongson
* .../OpenBSD/7.2/luna88k/INSTALL.luna88k
* .../OpenBSD/7.2/macppc/INSTALL.macppc
* .../OpenBSD/7.2/octeon/INSTALL.octeon
* .../OpenBSD/7.2/powerpc64/INSTALL.powerpc64
* .../OpenBSD/7.2/riscv64/INSTALL.riscv64
* .../OpenBSD/7.2/sparc64/INSTALL.sparc64
---------------------------------------------------------------------
Quick installer information for people familiar with OpenBSD, and the
use of the "disklabel -E" command. If you are at all confused when
installing OpenBSD, read the relevant INSTALL.* file as listed above!
OpenBSD/alpha:
If your machine can boot from CD, you can write install72.iso or
cd72.iso to a CD and boot from it. Refer to INSTALL.alpha for more
details.
OpenBSD/amd64:
If your machine can boot from CD, you can write install72.iso or
cd72.iso to a CD and boot from it. You may need to adjust your BIOS
options first.
If your machine can boot from USB, you can write install72.img or
miniroot72.img to a USB stick and boot from it.
If you can't boot from a CD, floppy disk, or USB, you can install
across the network using PXE as described in the included
INSTALL.amd64 document.
If you are planning to dual boot OpenBSD with another OS, you will
need to read INSTALL.amd64.
OpenBSD/arm64:
Write install72.img or miniroot72.img to a disk and boot from it
after connecting to the serial console. Refer to INSTALL.arm64 for
more details.
OpenBSD/armv7:
Write a system specific miniroot to an SD card and boot from it after
connecting to the serial console. Refer to INSTALL.armv7 for more
details.
OpenBSD/hppa:
Boot over the network by following the instructions in INSTALL.hppa
or the hppa platform page.
OpenBSD/i386:
If your machine can boot from CD, you can write install72.iso or
cd72.iso to a CD and boot from it. You may need to adjust your BIOS
options first.
If your machine can boot from USB, you can write install72.img or
miniroot72.img to a USB stick and boot from it.
If you can't boot from a CD, floppy disk, or USB, you can install
across the network using PXE as described in the included
INSTALL.i386 document.
If you are planning on dual booting OpenBSD with another OS, you will
need to read INSTALL.i386.
OpenBSD/landisk:
Write miniroot72.img to the start of the CF or disk, and boot
normally.
OpenBSD/loongson:
Write miniroot72.img to a USB stick and boot bsd.rd from it or boot
bsd.rd via tftp. Refer to the instructions in INSTALL.loongson for
more details.
OpenBSD/luna88k:
Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the
bootloader from the PROM, and then bsd.rd from the bootloader. Refer
to the instructions in INSTALL.luna88k for more details.
OpenBSD/macppc:
Burn the image from a mirror site to a CDROM, and power on your
machine while holding down the C key until the display turns on and
shows OpenBSD/macppc boot.
Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /
7.2/macppc/bsd.rd
OpenBSD/octeon:
After connecting a serial port, boot bsd.rd over the network via DHCP
/tftp. Refer to the instructions in INSTALL.octeon for more details.
OpenBSD/powerpc64:
To install, write install72.img or miniroot72.img to a USB stick,
plug it into the machine and choose the OpenBSD install menu item in
Petitboot. Refer to the instructions in INSTALL.powerpc64 for more
details.
OpenBSD/riscv64:
To install, write install72.img or miniroot72.img to a USB stick, and
boot with that drive plugged in. Make sure you also have the microSD
card plugged in that shipped with the HiFive Unmatched board. Refer
to the instructions in INSTALL.riscv64 for more details.
OpenBSD/sparc64:
Burn the image from a mirror site to a CDROM, boot from it, and type
boot cdrom.
If this doesn't work, or if you don't have a CDROM drive, you can
write floppy72.img or floppyB72.img (depending on your machine) to a
floppy and boot it with boot floppy. Refer to INSTALL.sparc64 for
details.
Make sure you use a properly formatted floppy with NO BAD BLOCKS or
your install will most likely fail.
You can also write miniroot72.img to the swap partition on the disk
and boot with boot disk:b.
If nothing works, you can boot over the network as described in
INSTALL.sparc64.
---------------------------------------------------------------------
How to upgrade
If you already have an OpenBSD 7.1 system, and do not want to
reinstall, upgrade instructions and advice can be found in the
Upgrade Guide.
---------------------------------------------------------------------
Notes about the source code
src.tar.gz contains a source archive starting at /usr/src. This file
contains everything you need except for the kernel sources, which are
in a separate archive. To extract:
# mkdir -p /usr/src
# cd /usr/src
# tar xvfz /tmp/src.tar.gz
sys.tar.gz contains a source archive starting at /usr/src/sys. This
file contains all the kernel sources you need to rebuild kernels. To
extract:
# mkdir -p /usr/src/sys
# cd /usr/src
# tar xvfz /tmp/sys.tar.gz
Both of these trees are a regular CVS checkout. Using these trees it
is possible to get a head-start on using the anoncvs servers as
described here. Using these files results in a much faster initial
CVS update than you could expect from a fresh checkout of the full
OpenBSD source tree.
---------------------------------------------------------------------
Ports Tree
A ports tree archive is also provided. To extract:
# cd /usr
# tar xvfz /tmp/ports.tar.gz
Go read the ports page if you know nothing about ports at this point.
This text is not a manual of how to use ports. Rather, it is a set of
notes meant to kickstart the user on the OpenBSD ports system.
The ports/ directory represents a CVS checkout of our ports. As with
our complete source tree, our ports tree is available via AnonCVS.
So, in order to keep up to date with the -stable branch, you must
make the ports/ tree available on a read-write medium and update the
tree with a command like:
# cd /usr/ports
# cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_7_2
[Of course, you must replace the server name here with a nearby
anoncvs server.]
Note that most ports are available as packages on our mirrors.
Updated ports for the 7.2 release will be made available if problems
arise.
If you're interested in seeing a port added, would like to help out,
or just would like to know more, the mailing list ports@openbsd.org
is a good place to know.