Game of Trees 0.127 released
Contributed by græy on from the not as many -Vs as Trogdor yet --version functions too! dept.
Version 0.127 of Game of Trees has been released (and the port updated). Complete release notes are as follows:
WPA3 support coming to OpenBSD
Contributed by Peter N. M. Hansteen on from the iwx, iwm, qwx, even WiFier! dept.
OpenBSD is moving closer to adding WPA3 support.
Stefan Sperling (stsp@) posted a message with the subject
add WPA3 support
to the tech mailling list with a patch that implements WPA3 in OpenBSD's net80211 subsystem including ifconfig(8), asking for testing and feedback.
He also noted that this effort is supported by the NLNet Foundaton (as noted in an earlier article).
The message reads,
List: openbsd-tech Subject: add WPA3 support From: Stefan Sperling <stsp () stsp ! name> Date: 2026-07-18 11:40:08 Message-ID: altmGGN9mVtJ1Eqd () yumyan ! stsp ! name The patch below adds support for WPA3 to the net80211 subsystem. This effort is supported by the NLnet Foundation's NGI0 Commons Fund. Without such support, I would not have been able to invest the time required to work on this. I am very grateful to be given this opportunity.
OpenBSD moves to 8.0-beta in -current and snapshots
Contributed by Peter N. M. Hansteen on from the 8.0-beta, betcha dept.
OpenBSD development is an ever ongoing activity, and when the feature set of a new release has been set and the stabilization phase leading up to the release starts,
-current becomes $NEXTRELEASE-beta.
The switch to 8.0-beta happened with this commit by Theo de Raadt (deraadt@):
List: openbsd-cvs Subject: CVS: cvs.openbsd.org: src From: Theo de Raadt <deraadt () cvs ! openbsd ! org> Date: 2026-07-16 6:21:10 Message-ID: 17bf9c846ef76761 () cvs ! openbsd ! org CVSROOT: /cvs Module name: src Changes by: deraadt@cvs.openbsd.org 2026/07/16 00:21:10
OpenBSD/loongson hardware platform retired
Contributed by rueda on from the soloong dept.
The
OpenBSD/loongson
hardware platform has been retired.
The
commit message by Miod Vallat (miod@)
explains the reason(s).
List: openbsd-cvs Subject: CVS: cvs.openbsd.org: src From: Miod Vallat <miod () cvs ! openbsd ! org> Date: 2026-07-15 18:59:19 Message-ID: 17bf9b1b148f61fa () cvs ! openbsd ! org CVSROOT: /cvs Module name: src Changes by: miod@cvs.openbsd.org 2026/07/15 13:00:24 Modified files: . : Makefile.cross distrib : Makefile distrib/notes : Makefile distrib/special/installboot: Makefile etc : Makefile lib/libarch/mips64: Makefile regress/etc/MAKEDEV: Makefile regress/usr.sbin/installboot: Makefile share/man/man4 : Makefile share/man/man8 : Makefile sys : Makefile sys/kern : Makefile usr.sbin/apm : Makefile usr.sbin/apmd : Makefile usr.sbin/hotplugd: Makefile usr.sbin/installboot: Makefile usr.sbin/pcidump: Makefile usr.sbin/wsfontload: Makefile Log message: Unhook loongson from the build.
g2k26 Hackathon Report: Job Snijders (job@) on rpki-client(8) progress
Contributed by Job Snijders on from the Puffy with a pearl earring dept.
Sometimes I like to think of OpenBSD development as a form of spiritual discipline. The project is a decades-long painstaking labor of love with hackers carefully rearranging source code by hand. In Dutch you'd call this monnikenwerk. So what better place could there be for a hackathon than an actual monastery?
The g2k26 hackathon brought together 18 developers in the quaint village of Kloosterburen (its namesake stemming from there being a monastery) in the province of Groningen and was funded by the OpenBSD Foundation. I believe this was the first hackathon in the Netherlands!
It's like the monastics from way back when already knew what's up with creating the perfect environment for hacking. We were given simple domestic quarters a stone's throw away from the communal hackroom. Big windows provided views of the gardens to help contemplation. While the Dutch national weather forecasting service issued its first-ever code red for extreme heat, our proximity to the North Sea and the monastery's thick stone walls created an enjoyable cooling effect. This all allowed me to (surprise surprise!) focus on rpki-client(8).
A recent incident in the RPKI ecosystem helped me realize that our validator implementation doesn't need to try to synchronize to every broken endpoint on every run every time. To improve reliablity and reduce pressure on affected publication points, I implemented a mechanism to carry some state from one run to the next run to instrument a backoff retry strategy.
Rpki-client now keeps track of the moment in time a RPKI CA became non-functional, how many synchronization attempts were made since then, and when the last attempt was. With this information the program can progressively decrease the synchronization frequency for persistently non-functional CAs, eventually settling on retrying about once per day. As they say: once bitten, twice shy.
In closing, getting to spend time with other developers really is lovely. Special thanks to tb@ and claudio@ for their code review and feedback. Shoutout to caspar@ for helping organize this hackathon!
OpenBSD's pledge(2) and unveil(2) are developer-friendly, study finds
Contributed by Peter N. M. Hansteen on from the pledge+unveil for much goodness dept.
Academic studies of OpenBSD's features and their practical impact on security are somewhat rare, but we were pleasantly surprised to see the recent paper A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System, by Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari (all at University of Southern Denmark).
The paper studies the adoption of the pledge(2) and unveil(2) in the OpenBSD base system and packages over time, and finds that the features provided actually seem to facilitate adoption of secure coding practices.
The paper's abstracts concludes,
All in all, the measurement results indicate that the adoption of system call minimization and sandboxing techniques is not necessarily as troublesome as has often been discussed in the literature.
The full text of the paper is available too, as PDF, HTML, or TeX source, for your advocacy use and pleasure.
OpenSSH 10.4/10.4p1 released!
Contributed by grey on from the PQ now with draft-miller ML-DSA 44 and Ed25519 support dept.
relayd(8) and httpd(8) TLS settings update.
Contributed by Janne Johansson on from the is it secret, is it safe? dept.
Both
relayd(8)
and
httpd(8)
now have the "secure" list of allowed crypto methods for
HTTPS, which include
TLSv1.3 and the TLSv1.2 AEAD cipher suites.
The previous list was "HIGH:!aNULL" which contain non-perfect-forward-security
methods and this change may cause old clients to not be able to connect.
OpenBSD/amd64 kernel virtual address space is now 512GB
Contributed by Peter N. M. Hansteen on from the where-would-sir-like-his-640kB? dept.
We almost missed this in a flurry of commits by Jonathan gray (
jsg@), but following this commit, OpenBSD/amd64 kernels now have a 512GB address space.
The commit message innocently reads,
List: openbsd-cvs Subject: CVS: cvs.openbsd.org: src From: Jonathan Gray <jsg () cvs ! openbsd ! org> Date: 2026-06-22 0:27:33 Message-ID: 162f075352ec66cd () cvs ! openbsd ! org CVSROOT: /cvs Module name: src Changes by: jsg@cvs.openbsd.org 2026/06/21 18:27:33 Modified files: sys/arch/amd64/include: vmparam.h Log message: raise the size of amd64 kernel virtual address space from 4G to 512G
