FreeBSD/HardenedBSD Ports Force Pushed

[Shawn Webb]

Hey all,

IMPORTANT NOTE: If you use the HardenedBSD ports tree, this message is
especially important for you. It will require adjustments downstream from us.
FreeBSD and HardenedBSD have both force-pushed to their ports git repositories.

On Wednesday, 22 Jul 2026, FreeBSD announced[1] a freeze of the ports
repository. They needed to resolve a less-than-desireable commit, rewriting
commit history. This impacted us.

Shortly after receiving notice of a potential issue, I had disabled the
auto-sync until both FreeBSD had applied their fix upstream and I had time to
address things on our end.

FreeBSD released another announcement[2] providing a few details. I took the
time today to investigate the issue today. This second announcement from FreeBSD
assumed a linear workflow, rather than a merge-based workflow as we use in
HardenedBSD. The offending commit was identified by other folks as commit
bb14266f00bb1bac62900477b93e5a7be984cd2f.

So, these are the steps that I followed. You'll notice reference to an
OriginalCommitterNode. That is a reference to the node on which I performed the
set of instructions immediately following this paragraph.

1. changed to our freebsd/main branch
2. git fetch upstream
3. git reset --hard upstream/main # this effectively brings us forward to
# today's corrected state of the ports repo since their fix involved a force
# push.
4. git push -f self freebsd/main

I then went to a few of my nodes, and used `rad sync --seed
OriginalCommitterNode`. On each of my developer nodes, I ran the following:

1. rad sync -f --sed OriginalCommitterNodeNID
2. git fetch OriginalCommitterNode
3. git log -n 1 OriginalCommitterNode/hardenedbsd/main # Verify that it's at the
# right commit
4. git reset --hard OriginalCommitterNode/hardenedbsd/main
5. git push -f self hardenedbsd/main

Now that quite a few nodes explicitly listed as delegates have agreed on the
same state of things, the changes should propigate through the Radicle network
like normal from now on. I have re-enabled the auto-sync for ports.

I will keep my eye on things, make sure they're progressing as I think they
should. One sync cycle has completed successfully.

Please let me know if you have any questions, comments, or concerns.

As of this writing, the HEAD of the hardenedbsd/main branch is this commit:

==== BEGIN LOG ====
commit 3bb5e1af5e398462bfe2099dd7761173b90869e7 (rad/hardenedbsd/main, rad/HEAD)
Good "git" signature with ED25519 key SHA256:5p/1Ld4i4e6MpU014a5JbDlvtJ+KUbdOYvmk58vcXCw
No principal matched.
Merge: 09aa85517d69 b5533b53ae5e
Author: HardenedBSD Sync Services <d...@hardenedbsd.org>
Date: Sat Jul 25 18:00:19 2026 -0600

Merge branch 'freebsd/main' into hardenedbsd/main
==== END LOG ====

[1]: https://lists.freebsd.org/archives/freebsd-announce/2026-July/000294.html
[2]: https://lists.freebsd.org/archives/freebsd-announce/2026-July/000295.html

Thanks,

--
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

Signal Username: shawn_webb.74
Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27
https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc