Thanks to the tireless work of among others Dave Voutila (dv@), development of the OpenBSD/amd64 virtualization system vmm(4)/vmd(8) continues to make progress.

Now breaking changes, but with with potential benefits in both process isolation and compartmentalization of functionality, are on the way. It almost goes without saying that this code needs testing.

In a message to the tech@ mailing list with the subject tests wanted: vmm(4)/vmd(8) fd-ification, Dave Voutila presents the code along with some explanation:

List:       openbsd-tech
Subject:    tests wanted: vmm(4)/vmd(8) fd-ification
From:       Dave Voutila <dv () sisu ! io>
Date:       2026-08-03 14:36:00
Message-ID: 87a4r3fezz.fsf () mars ! sisu ! io

Calling on vmm(4)/vmd(8) users to give this diff a test please!

This is a major breaking change I'm proposing to land soon. It changes
the vmm(4) design to create a new file type for each VM. When a VM is
created, the caller gets a new file descriptor for using ioctl(2) calls
against that VM.

Yes, you read that right. Modern development tools in the form of the LLVM compiler infrastructure is well on its way to supporting OpenBSD/sparc64 along with other more conventional architectures.

The support is now ready for testing, via a patch set presented by Kirill A. Korinsky (kirill@) in a message to the tech@ mailing list, with the subject LLVM toolchain for sparc64.

The message reads,

List:       openbsd-tech
Subject:    LLVM toolchain for sparc64
From:       Kirill A. Korinsky <kirill () korins ! ky>
Date:       2026-07-30 11:38:55
Message-ID: 87jyqcogfk.wl-kirill () korins ! ky

Folks,

I'd like to commit to devel/llvm/22 and gnu/llvm my cumulative patch for
support sparc64 by LLVM toolchain.

In a change likely to be widely welcomed, Rafael Sadowski (rsadowski@) committed support for custom HTTP headers in httpd(8). This obviates the need to use FastCGI support or relayd(8) to achieve things like adding SSL/TLS security headers.

The commit reads:

CVSROOT:	/cvs
Module name:	src
Changes by:	rsadowski@cvs.openbsd.org	2026/07/24 23:48:39

Modified files:
	usr.sbin/httpd : config.c httpd.c httpd.conf.5 httpd.h parse.y 
	                 server.c server_fcgi.c server_http.c 

Log message:
httpd: add custom HTTP header support

Up until quite recently, relayd(8) did not actually support ECDSA keys and certificates, as described in the Relayd doesn't like ecdsa thread on the tech@ mailing list.

The problem is now solved.

In this commit by Rafael Sadowski (rsadowski@), code that originated in smtpd(8) adds the previously lacking support.

The commit message reads,

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Rafael Sadowski <rsadowski () cvs ! openbsd ! org>>
Date:       2026-07-20 17:41:07
Message-ID: 17bfa7826d307ce0 () cvs ! openbsd ! org

CVSROOT:	/cvs
Module name:	src
Changes by:	rsadowski@cvs.openbsd.org	2026/07/20 11:41:07

Modified files:
	usr.sbin/relayd: ca.c relay.c relayd.h ssl.c 

Version 0.127 of Game of Trees has been released (and the port updated). Complete release notes are as follows:

OpenBSD is moving closer to adding WPA3 support.

Stefan Sperling (stsp@) posted a message with the subject add WPA3 support to the tech mailling list with a patch that implements WPA3 in OpenBSD's net80211 subsystem including ifconfig(8), asking for testing and feedback.

He also noted that this effort is supported by the NLNet Foundaton (as noted in an earlier article).

The message reads,

List:       openbsd-tech
Subject:    add WPA3 support
From:       Stefan Sperling <stsp () stsp ! name>
Date:       2026-07-18 11:40:08
Message-ID: altmGGN9mVtJ1Eqd () yumyan ! stsp ! name

The patch below adds support for WPA3 to the net80211 subsystem.

This effort is supported by the NLnet Foundation's NGI0 Commons Fund.
Without such support, I would not have been able to invest the time
required to work on this. I am very grateful to be given this opportunity.

OpenBSD development is an ever ongoing activity, and when the feature set of a new release has been set and the stabilization phase leading up to the release starts, -current becomes $NEXTRELEASE-beta.

The switch to 8.0-beta happened with this commit by Theo de Raadt (deraadt@):

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Theo de Raadt <deraadt () cvs ! openbsd ! org>
Date:       2026-07-16 6:21:10
Message-ID: 17bf9c846ef76761 () cvs ! openbsd ! org

CVSROOT:	/cvs
Module name:	src
Changes by:	deraadt@cvs.openbsd.org	2026/07/16 00:21:10

The OpenBSD/loongson hardware platform has been retired. The commit message by Miod Vallat (miod@) explains the reason(s).

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Miod Vallat <miod () cvs ! openbsd ! org>
Date:       2026-07-15 18:59:19
Message-ID: 17bf9b1b148f61fa () cvs ! openbsd ! org

CVSROOT:	/cvs
Module name:	src
Changes by:	miod@cvs.openbsd.org	2026/07/15 13:00:24

Modified files:
	.              : Makefile.cross 
	distrib        : Makefile 
	distrib/notes  : Makefile 
	distrib/special/installboot: Makefile 
	etc            : Makefile 
	lib/libarch/mips64: Makefile 
	regress/etc/MAKEDEV: Makefile 
	regress/usr.sbin/installboot: Makefile 
	share/man/man4 : Makefile 
	share/man/man8 : Makefile 
	sys            : Makefile 
	sys/kern       : Makefile 
	usr.sbin/apm   : Makefile 
	usr.sbin/apmd  : Makefile 
	usr.sbin/hotplugd: Makefile 
	usr.sbin/installboot: Makefile 
	usr.sbin/pcidump: Makefile 
	usr.sbin/wsfontload: Makefile 

Log message:
Unhook loongson from the build.

Sometimes I like to think of OpenBSD development as a form of spiritual discipline. The project is a decades-long painstaking labor of love with hackers carefully rearranging source code by hand. In Dutch you'd call this monnikenwerk. So what better place could there be for a hackathon than an actual monastery?

The g2k26 hackathon brought together 18 developers in the quaint village of Kloosterburen (its namesake stemming from there being a monastery) in the province of Groningen and was funded by the OpenBSD Foundation. I believe this was the first hackathon in the Netherlands!

It's like the monastics from way back when already knew what's up with creating the perfect environment for hacking. We were given simple domestic quarters a stone's throw away from the communal hackroom. Big windows provided views of the gardens to help contemplation. While the Dutch national weather forecasting service issued its first-ever code red for extreme heat, our proximity to the North Sea and the monastery's thick stone walls created an enjoyable cooling effect. This all allowed me to (surprise surprise!) focus on rpki-client(8).

A recent incident in the RPKI ecosystem helped me realize that our validator implementation doesn't need to try to synchronize to every broken endpoint on every run every time. To improve reliablity and reduce pressure on affected publication points, I implemented a mechanism to carry some state from one run to the next run to instrument a backoff retry strategy.

Rpki-client now keeps track of the moment in time a RPKI CA became non-functional, how many synchronization attempts were made since then, and when the last attempt was. With this information the program can progressively decrease the synchronization frequency for persistently non-functional CAs, eventually settling on retrying about once per day. As they say: once bitten, twice shy.

In closing, getting to spend time with other developers really is lovely. Special thanks to tb@ and claudio@ for their code review and feedback. Shoutout to caspar@ for helping organize this hackathon!