BSD Weekly, Issue 302

FuguIta 8.0 test version, LibreSSL 4.4.0, Wine port for OpenBSD and more.

Releases

First Test Version of FuguIta 8.0 Available: FuguIta has released its first test version based on OpenBSD 8.0 for i386, incorporating OpenBSD 8.0 errata patches up to 005.

BSDSec

LibreSSL 4.3.4 and 4.2.3 released: LibreSSL 4.3.4 and 4.2.3 remove the eMudhra emSign ECC Root CA - G3 certificate from cert.pem due to weak subordinate CA keys while adding uncompromised intermediates for interoperability.

LibreSSL 4.4.0 released: LibreSSL 4.4.0 is the first stable release of the 4.4.x branch, shipping with OpenBSD 8.0. Key changes include removing a root CA with weak keys, fixing an OCSP responder authorization bypass in libtls, improving DTLS and TLS 1.3 handling, and updating portable builds for FreeBSD, NetBSD, macOS, and Windows.

OpenBSD Errata: October 23, 2026 (dbupdate): OpenBSD has released errata patches containing a new dbupdate tool and updated cert.pem file for OpenBSD 7.9 and 8.0, with binary updates available via syspatch on amd64, arm64, and i386.

eMudhra TLS/SSL CA compromise: NetBSD shipped eMudhra CA certificates by default and now revokes trust in them due to compromise, with instructions to run certctl untrust for affected certs on NetBSD 10+ and guidance for pkgsrc mozilla-rootcerts users.

FreeBSD Security Advisory FreeBSD-SA-26:73.caroot: FreeBSD has updated its caroot root certificate bundle to mark the emSign ECC Root CA - G3 certificate as untrusted following the public disclosure of compromised eMudhra intermediate keys.

As always, it’s worth following BSDSec. RSS feed available.

News

Valuable News – 2026/10/26: Highlights include the release of OpenBSD 8.0 and LibreSSL 4.4.0, a port of Wine to OpenBSD, running FreeBSD ARM64 on Apple Silicon with Cube, and configuring encrypted root on NetBSD 11. Additional items cover the bob pkgsrc package builder, running Signal Desktop on FreeBSD, and NetBSD’s eMudhra CA compromise.

BSD Now 686: Yell in your Shell: Episode 686 covers shell exclamation mark usage, OpenBSD adding the rtrd(8) networking daemon and multi-processor VM support in vmm/vmd, OpenBGPD 9.3, running BSD on Lenovo ThinkCentre hardware, and more.

emulators/wine (re)entering OpenBSD ports: Thomas Frohwein submitted a proposal for a new emulators/wine port to run Windows binaries on OpenBSD, alongside a supplementary emulators/wine-extras port for winetricks and wine-steam.

dbupdate(8) Added to OpenBSD -current: OpenBSD -current has added dbupdate(8), a new utility for updating signed zoneinfo and cert.pem databases from cdn.openbsd.org. Designed to run via root cron, it provides a way to update timezone and CA certificate files without relying on sequential syspatch updates.

Tutorials

Your AI Configured Your ZFS. Are You Sure That’s Right?: Klara Systems examines common pitfalls in AI-generated ZFS configurations, such as wrong ashift values, disabled synchronous writes, and feature upgrades that break host compatibility. It highlights commands for verifying drive sector sizes and pool properties before applying generated scripts.

Did we miss anything?

This newsletter is made from your content on DiscoverBSD and BSDSec. Submit the stuff we missed so it can appear next time.

Do you have an OSS BSD-related project that you would like to showcase in BSD Weekly? Reply to sender and we can showcase you as a sponsor of an issue (for free).

Do you know anyone who would like this newsletter? Consider forwarding and tell them to subscribe.

Thanks for reading and see you next week! Stay safe!