git: 8edaf92e48 - main - Status/2026Q3/x11appjail.adoc: Add report

The branch main has been updated by salvadore:

URL: https://cgit.FreeBSD.org/doc/commit/?id=8edaf92e485a57715837d291abf10d788b90cdec

commit 8edaf92e485a57715837d291abf10d788b90cdec
Author:     Jesús Daniel Colmenares Oviedo <dtxdf@FreeBSD.org>
AuthorDate: 2026-10-20 15:27:37 +0000
Commit:     Lorenzo Salvadore <salvadore@FreeBSD.org>
CommitDate: 2026-10-20 16:04:45 +0000

    Status/2026Q3/x11appjail.adoc: Add report
---
 .../status/report-2026-07-2026-09/x11appjail.adoc  | 51 ++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/website/content/en/status/report-2026-07-2026-09/x11appjail.adoc b/website/content/en/status/report-2026-07-2026-09/x11appjail.adoc
new file mode 100644
index 0000000000..b0e630bd97
--- /dev/null
+++ b/website/content/en/status/report-2026-07-2026-09/x11appjail.adoc
@@ -0,0 +1,51 @@
+=== x11appjail: Tool for creating, verifying, installing, and running AppJails
+
+Links: +
+link:https://github.com/DtxdF/x11appjail[x11appjail on GitHub] URL: link:https://github.com/DtxdF/x11appjail[] +
+Contact: Jesús Daniel Colmenares Oviedo <dtxdf@FreeBSD.org>
+
+*x11appjail* is a specialized tool for creating, verifying, installing, and running AppJails.
+An AppJail is a CLI, TUI or X11 application that runs inside a FreeBSD jail but is perceived by the end user as identical (or at least very similar) to an application running directly on the host system.
+
+This tool makes extensive use of man:appjail[1] as its engine; however, unlike the latter, the primary user in *x11appjail* is neither root nor a privileged user, but rather an unprivileged user.
+The fundamental goal of this project is to grant the user limited access to the jail, restricted solely to the execution of a CLI, TUI or X11 application.
+
+This project began months ago as a prototype to establish a workflow leveraging man:appjail-x11[1]; however, starting with version 1.0.0, it was rewritten from scratch into a unified tool that integrates all its projects, such as package:sysutils/appjail[], package:sysutils/unixexec[], package:archivers/appscript[], and package:sysutils/jtransfer[], among others.
+Even better, it allows for the execution of not only X11 applications but also CLI and TUI programs.
+
+The most relevant project for man:x11appjail[1] is not only man:appjail[1], but also man:appscript[1].
+My goal with man:appscript[1] is to create an ultra-lightweight alternative to AppImage for FreeBSD that does not depend on FUSE, thus eliminating the need to configure `vfs.usermount=1`.
+man:appscript[1] allows you to create an man:elf[5] executable that contains everything necessary to run a self-contained executable.
+
+The most significant changes and improvements for man:appscript[1] and man:x11appjail[1] are:
+
+* Executables created by man:appscript[1] extract the payload cooperatively: the leader process extracts the payload once using an exclusive lock, while other processes (if any) wait using a shared lock.
+Unlike previous versions, where the payload was extracted to a random directory upon every execution, this significantly improves performance by extracting the payload only once; furthermore, the resulting directory is removed by the last remaining process once no running processes remain.
+
+* man:appscript-verify[1] is a new command installed by package:archivers/appscript[] to verify executables signed with man:signify[1]; it is particularly relevant to man:x11appjail[1]'s `veriexec` (see below).
+
+* man:x11appjail[1]'s `veriexec` is an internal tool used by man:x11appjail[1] to run an AppJail in portable mode only if it is signed with a trusted key.
+This tool is unrelated to NetBSD's `veriexec`.
+
+* Both tools support the classic, battle-tested SHA-256 algorithm and the faster yet secure BLAKE3 algorithm.
+When package:sysutils/b3sum[] is available (the default if man:x11appjail[1] was installed from ports), BLAKE3 is the default choice, unless SHA-256 is explicitly specified in man:rc.conf[5].
++
+The checksum algorithm is fundamental to both man:x11appjail[1] and man:appscript[1].
+In the case of man:x11appjail[1], the algorithm is used in internal operations such as `veriexec`, whereas man:appscript[1] uses it to verify executables.
+BLAKE3 has been selected as the default option because it offers greater speed without compromising security.
+
+* Attributes have been implemented in man:x11appjail[1] as a means for both the user and the system operator to manipulate the behavior of an AppJail.
+For example, a system operator can create the system attribute *users*.[.underline]#uid#.*perms*, the content of which might be "*enable_3d* *sound* *usb* *webcam*".
+An unprivileged user can create the user attributes [.underline]#appname:profile#.*allow*.*enable_3d* and [.underline]#appname:profile#.*allow*.*sound*.
+Subsequently, when executing an AppJail, devices become visible or remain hidden depending on whether the user holds the corresponding permission and has authorized those permissions for the jail being created.
+In this case, the hardware acceleration and sound devices will become visible, provided the AppJail has incorporated the necessary logic to make them visible.
+
+Another notable change worth mentioning for man:x11appjail[1] are the examples added in `$\{EXAMPLESDIR}/Apps`: `badwolf`, `chromium`, `evince`, `feh`, `firefox`, `htop`, `linux-brave`, `mpv`, `nanonote`, `telegram-desktop` and `thunderbird`.
+Beyond the applications themselves, the key factor is the deployment method.
+`htop` is an example of a CLI application, `linux-brave` is a Linux application, and the others are X11 applications.
+Web browsers, Mpv, and Thunderbird are the most interesting examples, as they demonstrate how an AppJail can use VirtualGL to properly enable hardware acceleration within a FreeBSD jail, something that would not normally be possible given that Xephyr is the backend used by man:appjail-x11[1].
+Best of all, from the end-user's perspective, all of this is transparent.
+
+Demo video: https://youtu.be/EBSMHBC0Phc
+
+Sponsor: https://www.patreon.com/appjail