Action Required: Recent ports history has been rewritten

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 BACKGROUND ============= On 2026-07-20, a 150MB binary file was committed to the ports tree, causing mirroring to GitHub and possibly other Git forges to fail due to a hard file size limit of 100MB. Additionally, it is unclear if the licensing of the binary permits redistribution in this fashion. On 2026-07-21, core@ became aware that mirroring was broken and requested the suspension of pushes to the ports repository while we assessed the situation. Discussions over the following hours among members of gitadm@, clusteradm@, portmgr@, and core@ resulted in a tentative plan to rewrite the repository history to remove the offending file, with the agreed constraint that the resulting state must be reproducible by third parties and must not impose an unreasonable burden on downstream consumers of the ports tree. The decision that the resulting state be reproducible by third parties arose from our shared view that we should not demand implicit trust, and that we should make it easy for our users and downstreams to reflect the same values. While `git rebase` can easily remove the offending commits, it imposes a greater audit burden on our community because it rewrites committer names and timestamps. It also affects the downstream communities which have forks of the ports tree. Providing a mechanism to repeat this operation has potential impact that extends far beyond our own community, and we appreciate your understanding and patience as we worked to get this right. ACTION REQUIRED ================= Commit hashes in `main` for commits after a70c5c3fd44b have changed as a result, which may impact your use of the ports tree.  For all consumers of the ports tree, it is expected that the reproduction script linked below will correct the state of your repository to match the new state of the authoritative repository, but this is not the only option. For committers and contributors: pending pull requests and local branches will need to be rebased on top of the new history.  For example: git rebase --onto f9c90a4f96f0700 0a717e9c118aa6 Where "0a717e9c118aa6" should be replaced with the _old_ upstream commit hash upon which your branch is based. Patch files should not be affected as the rewrite in question was isolated to the misc/github-copilot-cli port. For downstreams: running the reproduction script below is advised, particularly if you have local commits in your tree.  The script will strip any cryptographic signatures on existing commits after the binary file commit to achieve reproducibility.  Note that the script has two commit hashes embedded in it that will need to be changed if your branch has local changes included that may invalidate those; instructions for the replacement are included in the comments. TRANSPARENCY ============== The script used to rewrite commit history has been made available for independent verification and reproduction of the resulting state: https://www.freebsd.org/news/2026-ports-freeze/ports-reset.sh SHA256 (ports-reset.sh) = 9f954e7e229a1f3f0c452a98c433d70a0dbd265fc528bca6d082068d154536e8 This script should be run from within a checkout of the ports tree. Note that it does not attempt to purge the previous version of your branch entirely. Recovery by grabbing the previous commit hash from `git reflog` is possible if your local version of the branch does not have a remote to restore it from.  Git garbage collection will eventually clean up the old branch in your repository. NEXT STEPS =========== Commit notes will be added both to the rewritten commits in main and to the commits in that range which were backported to 2026Q3, noting the old and new commit hashes in the least invasive way.  We view the bar for rewriting a security update branch as significantly higher, and we have opted to accept that five commits will have incorrect commit messages referring to invalid cherry-pick commit hashes. Server-side hooks are being implemented in all three repositories to prevent future incidents of this particular nature.  The exact shape hasn't been completely finalized, but the expectation is that there will be a hard upper file size limit with some lower soft limits that will require a --push-option or approval from portmgr/srcmgr/doceng.  Separate hooks will be considered to confirm the licensing of binary artifacts being introduced into the repository. CONCLUSION =========== Huge thanks to everyone involved in incident response for all of the time put into ensuring that we perform this operation in a way that is auditable, reproducible, and with consideration for the massive impact both of the repository freeze and the impending rewrite.  Rewriting commit history is not a decision that was made lightly, but it was agreed that taking the time to do this right was the least-bad option both for the project and for external ports trees that may have their own modifications following the commits in question. Special thanks to clusteradm@ for agreeing with the plan to rewrite history while staring at the long list of cluster infrastructure that will need to be fixed as a result. The ports tree will be thawed for regular operations in the coming hours, but infrastructure repairs will be conducted over the following week. Cluster package builds will not be restarted immediately, but will resume by 2026-07-26 at the latest. Signed, René Ladan (on behalf of portmgr@) Kyle Evans (on behalf of core@) A copy of this message is available independently for verification at: https://people.freebsd.org/~kevans/core/ports-freeze-final.txt.asc -----BEGIN PGP SIGNATURE----- iQJPBAEBCAA5FiEE3gJfirmYjuaWFv4NEBT7qDq7aZYFAmpjlXEbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwzAAoJEBAU+6g6u2mWwTQQAIXO8QzaG5CfjJF9oSM8 1DNCUZFB59ifV9L7Bw9/Iakm1Iyy/YG/tkCUX+ZxePRkwrV567YsrFt3uAd4l8sR vJjm0JHkJK6PqnftO6+inz5w0vV+t1SILO/Rn3SHKBvVYzSHb4uLQARPONeR1lP/ y0i3Np79tf1YTlfSPLVYvF8cj+SRoRm4HWQvt+TmkWYAbxtJ6bfRaoScHDOXWVDd 3BShIA7BxS4VjZYZ+dh/D9FNIq1aUqkkqKBaNsMyDkdK1IiI0JHE+6U5lulQ5zDH 4kDFZYiY5RA8n9/1fHdIUMNMavnb0CG78XS8SA0MRm3bgK7tpA6j9h1bxzTnkkNc fPpi5tBwVtEmeY2jZRiZ7wyKP8DO5IqXTTu0uq7McF7jhYsHiHzthyYmUSicPzOE 0cbu6eHGq/OjalVaurg7R1CQ/8nsuJ0ICTHCMGlv71Ur2WzvNWmayTcd9Hy5LRu4 zatEQyrDLXk2QwtQ30k0Q6OI3tiscxQGDUG77d937pe7qYQPBjC5o0kZ4eYC8sMQ 4s0JFwnYuVruiLJZyfze4Y7yMGMcyW+DRxXkyPhCHh9B8s8ZUr9mdfvXywGkCnsl /eb8//5G7dWbxoN7E1/BCIulrp2rXi4kQMJDHmcvvix8u1qZfIj/ZAEgteyjENyC Co6NjrVjaupebUdc1GD0EgbV =wsye -----END PGP SIGNATURE-----