question, pkg-static is simply similar pkg but statically built with all libs built-in ?

yessir

awesome

thanks !

I saved ...

acidantly run `freebsd-update install` twice and pkg is not starting

pkg-static bootstrap -f - savior

Thanks to whom make this possible

one of the first devs that made that same choice :)

The bright person!

nerozero: there's also a statically linked copy of most base utilities in /rescue, in case you break the entire system somehow

ivy, yah, helped me A LOT of time

thank you

mostly on bsd4 on fail mount of ufs

irssi capsicum mode is somewhat annoying... you can't save the configuration, which i can understand (although being able to save it to a temporary file would be nice) but you also can't reload the configuration after editing it on disk

hm, why doesn't it keep a fd for the configuration dir and some temp dir? openat(2) is still allowed in capsicum mode

nimaje: well, you wouldn't want an attacker to be able to overwrite your configuration because then they could just disable capsicum mode

ah, yeah, can you restrict dirfds that files can only be opened for reading from it? that would solve reloading

For your non-compression viewing pleasure: dan.langille.org/2026/05/10/newsysl…ing-it-not-to-compress-for-anything

hm, I would suggest letting the shell do the sorting instead of parsing ls, but no idea if shells other then zsh have that feature, with zsh you would add (om) at the end of the glob and get the file list sorted by modification time and there wouldn't be any problem with strange filenames

ivy, mason: thanks for ur help yesterday. i nearly got the thing working but one small issue: to control transmission remotely, it listens on a certain port. it seems that using fib, that port becomes inaccessible due to the vpn. downloading with the torrent seems to work but i can't control it remotely this way... is there a way to work around this?

hmjsp, is this about transmission in a fibbed jail?

you should explicitly do

setfib $fib route add $jail_ip -interface $main_jail_iface

e.g. for me it's

setfib 1 route add 192.168.36.100 -interface igb2

and then transmission-remote and incoming ssh should work

I usually do this from the host, after the vpn is set up and jail is running. Don't know if it's sensitive to order.

futune_: it's transmission fibbed on its own, no jail

perhaps jail is the only way to do this then

hmjsp: how about using a unix domain socket for transmission?

im unsure what you mean

hmjsp, I suspect my method can be modified to work outside a jail, too. But I have never tried it.

the point is that fib 1 is probably lacking a self route to localhost

perhaps you could make a paste of your fib's routing table on some paste site?

oh yeah, i can definitely just route the local ips back to the non vpn interface

but i dont want to access transmission from just lan, i also want to be able to access it remotely

hence needing to somehow route just one port

okay. Then I think you're looking at routing + firewall

current fib is very basic

you could have transmission put its rpc socket on the file system, specify it as unix:<some path>

nimaje: how would i let an external client access that local socket tho?

i added local ip range to route table and i can access from another machine on lan

it's good enough for now ig, and i can just ssh and use transmission locally if i really need to, tho it would be ideal if i can just forward just that one port to the local interface

hmjsp, do you run pf?

i do indeed

I think it should be fib aware, although I haven't tried to use it

hmm

you could possibly have a rewrite rule for outgoing packets on that port and that fib

potentially

i'll keep that in mind, but for now im sick of dealing with that thing xD

im just gonna use it on lan only for now

okay! Enjoy!

and set up other stuff i need to and come back to later since it's lower priority

thanks!

hmjsp, just to add... maybe the reply-to directive in pf does exactly what you want.

i did try a setup before with only route-to (not reply-to) and i couldn't get it to work, hence getting advice here to use fibs

i also just realised that my vpn setup might be wonky anyhow because it drops way too many packets for no reason

hm, what was the problem with running transmission-remote via setfib?

nimaje, he wants to do it from an external host. the problem is the reply.

on BETA2. is it expected that intel gpu firmware packages all show 2 versions? 20250109.1500068 and .1501000? and that pkg leaves both installed?

ah, disregard, misread the output. all is well. nothing to see here. :)

fwiw, there are two versions in the repo as stated, but the correct one gets installed. pkg incorrectly states (via pkg version) that the installed version is ahead of the repo version.

hmmm

the vulnerable python is making it difficult to build ports

I lost my notes. . . where's a good guide for upgrading FreeBSD via src with git? Once I have the source, I know how to build/install/merge everything.

CrtxReavr: is this what you are looking for? docs.freebsd.org/en/books/handbook/…dex.html#updating-src-obtaining-src

CrtxReavr: the above, but the tldr is "make buildworld buildkernel" to populate /usr/obj, then "make installkernel" *reboot* "etcupdate -p; make installworld; etcupdate -B" *reboot* done!

note: snapshot first

Hello, all. How come thttpd running as user www can bind to system port 80, but mtg running as the same user cannot bind to system port 443 (permission denied)?

ant-x: setuid-root?

Gedge, don't know what that is. Is that specified in the service's rc file?

it's a permissions setting on the binary

ps shows both thttpd and mtg running as www.

The sticky bit?

allows an app to 1. start as root, 2. grab port 80, 3. drop uid to www

setuid(1) is a utility to run a command as a different user. It does not mention any permissions settings...

ant-x: are you from an alternate universe?

LXGHTNXNG, I might be.

did you fribble some kernel modules and sysctls in order to be able to do this re: thttpd and mtg?

doas ls -ld $(which thttpd) shows nothing special: -r-xr-xr-x 1 root wheel

LXGHTNXNG, nothing like that at all! I just installed thttpd and mtg from the packages.

ls -ld $(which mtg) shows exactly the same permissions.

where does setuid(1) come from‽

i don't have it here

Not the command, it's a file-permission thing

I have it nether, as a command.

ls -l /usr/bin/passwd

-r-sr-xr-x 1 root wheel

see `-r-s... root...` = setuid-root

^ I see. Neither mtg nor httpd have that sticky bit.

(it is not the sticky bit)

Beg pardon.

The correct mnemonic user- and group- [s]pecial .

And I see nothing in /usr/local/etc/rc.d/thttpd that might give it rights to bind port 80 .

...Looks like thttpd starts as root, and then drops to www (as per its own config), whereas mtg starts as www, but I am not sure yet.

^ Very likely so, but I can't figure out what the lines like ``: ${mtg_enable:="NO"}'' do. The assing a default value, but why is the initial colon required for the assignment to work?

ant-x: it's a shell idiom

Yes, but it does answer my question. Why is the initial colon required for the assignment?

how would you set the var? anything else is longer

`var=${var:-NO}` is longer that `: ${var:=NO}` so the latter idiom is used

s/that/than/

Why does ${var:=NO} fail?

it fails?

Ah! Becuase it is the expantion, and not the assignment?

Yes.

${a:=b} fails with: -sh: b: not found, because the whole things is interpreted as b at the end, and : prevents that.

^ as I (now) understand it.

So, the : is just a way to swallow the arguments.

Because ${a:=b} not only sets a to b, but also expands to string b

`${a:=b}` (without the `:`) will expand *and* *be* *used* *as* *a* *command*

Right.

As can be demonstrated by: echo ${a:=b}

whereas the `:` says "throw away the result"

(but still assign it)

glad you're not testing `${oops:=shutdown}` ;)

Bourne Supremancy -- the title of a book on shell programming.

I see the value in that.

Would need doas, though.

<imgs.xkcd.com/comics/sandwich.png>

thoughts? i'd like to see how the project reponds to this

mjp, if you take utmost care to dissect it into so many support requests in <bugs.freebsd.org/bugzilla> ...