Using ports overlay with poudriere

K

kjpetrie

I have a VM which builds the packages I need for my servers every morning using Poudriere. For the last week it has been building an old insecure version of ftp/curl. It seems there is some problem preventing the port being upgraded. The last comment in Bugzilla reads "If anyone needs an overlay addressing multiple issues, https://github.com/diizzyy/ports-overlay/tree/main/ftp/curl". This looks as if it includes the upgrade.

Can I use that with Poudriere and if so how and would it be wise?
 
kjpetrie said:
Can I use that with Poudriere and if so how and would it be wise?
Click to expand...
Code: 
     -O overlay
	      Specify an extra poudriere-ports(8) tree to  use	as  an	overlay.
	      Multiple -O overlay arguments may be specified to stack them.
poudriere-bulk(8)

Never used it myself, but the principle is that you have a 'regular' (full) ports tree and use an additional (partial) ports tree overlayed on top of it. The idea here is that you can overlay a ports tree with custom ports on top of a regular ports tree (for dependencies for example).
 
SirDice said:
Code: 
     -O overlay
          Specify an extra poudriere-ports(8) tree to  use    as  an    overlay.
          Multiple -O overlay arguments may be specified to stack them.
poudriere-bulk(8)

Never used it myself, but the principle is that you have a 'regular' (full) ports tree and use an additional (partial) ports tree overlayed on top of it. The idea here is that you can overlay a ports tree with custom ports on top of a regular ports tree (for dependencies for example).
Click to expand...
If you always build ports via poudriere only, it sanely works.

Note that additional definition of ports tree on poudriere using poudriere-ports(8) just like you've created main ports tree for poudriere, with different name (the name cannot contain "-" at least when I've first tried), is mandatory. The option -O requires this name.

I've described how I did to use overlays on poudriere here.

Note that, if you want to use overlays (regardless the same ones for poudriere or not) on bare-metal builds like using ports-mgmt/pkg_replace (and/or using PORTS_MODULES make variable to build kmods in conjunction with kernel, with overlays applied), you need to guard OVERLAYS make variable in your /etc/make.conf with
.ifndef POUDRIERE_BUILD_TYPE
and
.endif as I've described here.
 
I use overlay to upgrade one of the ports that can't be merged into the canonical repo because of some other blocking ports (it does not really matter for my case):

Code: 
freebsd 15.1 op@pkgbuild:~ % poudriere ports -l
PORTSTREE METHOD    TIMESTAMP           PATH
default   git+https 2026-10-20 08:51:58 /usr/local/poudriere/ports/default
lab       null      2026-10-20 08:52:03 /usr/local/poudriere/ports/lab/ports

freebsd 15.1 op@pkgbuild:~ % poudriere jail -l
JAILNAME VERSION         OSVERSION ARCH  METHOD  TIMESTAMP           PATH
151amd64 15.1-RELEASE-p5 1501000   amd64 pkgbase 2026-10-20 08:52:05 /usr/local/poudriere/jails/151amd64

I prefer to have my own git-clone(1) of the overlay repository and then add it with:

Code: 
poudriere -c -M /usr/local/poudriere/ports/lab/ports -m null -p lab

You may let poudriere git-clone(1) the repo and then update it via poudriere with something like:

Code: 
poudriere ports -u lab

To build a package using the overlay, use the command:

Code: 
poudriere bulk -j 151amd64 -O lab ports-mgmt/pkg

It will overlay lab-ports on top of default-ports and pick up the latest version of the package to build. So, if lab-overlay has modified version of ports-mgmt/pkg, poudriere will pick it up.
 
Yes, and it's very simple :-)
Keep in mind that you need to preserve paths to the main tree.

Presumably you have a ports tree defined such as:
Code: 
poudriere ports -l
PORTSTREE    METHOD TIMESTAMP           PATH
default      null   2023-11-12 21:05:50 /vault4/poudriere/ports

clone the repo somewhere, if you just want ftp/curl remove everything else in the cloned repo (there likely will be some breakage for http3 by doing so otherwise keep it as is).

Add it as another repo to poudriere ports

Just use the -O option to add it as overlay.

Code: 
poudriere ports -l
PORTSTREE    METHOD TIMESTAMP           PATH
default      null   2023-11-12 21:05:50 /vault4/poudriere/ports
portsoverlay null   2025-08-02 02:19:20 /home/diizzy/repos/ports-overlay

Examples:
Code: 
poudriere testport -j 144i386-dev -O portsoverlay -o ftp/curl
poudriere bulk -j 151amd64-dev -t -O portsoverlay -f build-list
 
Thanks for all the helpful information. Yes, I was aware contributors were arguing about priorities and one was trying to use the need for a security upgrade to hold the port to ransom against his wishlist.

I was trying to sign back up to the bugzilla (still unsuccessfully and after being removed for no reason I can think of) to make the point someone else made - that security upgrades must take priority over working on normal bugs. If the normal bugs aren't also fixed by the upgrade they'll still be there to be worked on after the upgrade but too many times I've seen FreeBSD developers/packagers failing to appreciate that. This is not the first time it's happened and we've been exposed to multiple vulnerabilities for a whole week longer than necessary because of this failure.

Fortunately, we've now been overtaken by events. Someone has taken charge and knocked some heads together and the secured curl is now in ports, but I'll bookmark this thread for the next time this sort of thing happens.
 
You must log in or register to reply here.
Back
Top