openbsd/ports

…ithub.com/rwatson/chromium-capsicum https://www.freshports.org/www/chromium/ https://cgit.freebsd.org/ports/log/www/chromium/Makefile?qt=grep&q=capsicum No browsers on FreeBSD today use Capsicum. Compare that instead to OpenBSD, where the Chromium port has used pledge(2) since January 2016, and unveil(2) since 2018. Enabled by default. The Mozilla Firefox ports also use both pledge and unveil since 2018-2019, and this work has even been accepted upstream. https://marc.info/?l=openbsd-ports-cvs&m=145211683609002&w=2 https://github.com/openbsd/ports/blob/master/www/chromium/patches/patch-sandbox_policy_openbsd_sandbox_openbsd_cc https://github.com/openbsd/ports/tree/master/www/chromium/…

I quite like the OpenBSD approach to Go and Rust projects in ports. They store all the dependencies and their hashes in the build recipe, not trusting the project ones. And they’re more readable. Here is jujutsu’s list of dependencies[0] and their hashes[1]. As an aside, that’s why I don’t like those packages managers. Something like Python’s numpy or lib curl, get sliced into atomic portions. [0]: https://github.com/openbsd/ports/blob/master/devel/jujutsu/crates.inc [1]: https://github.com/openbsd/ports/blob/master/devel/jujutsu/distinfo