git: d2f494f00b95 - 2026Q3 - security/mkcert: New port

The branch 2026Q3 has been updated by kenrap:

URL: https://cgit.FreeBSD.org/ports/commit/?id=d2f494f00b95ef68898bf47ba273b792dcb54b31

commit d2f494f00b95ef68898bf47ba273b792dcb54b31
Author:     Hywel Andrews <owlandrews@protonmail.com>
AuthorDate: 2026-08-08 04:12:36 +0000
Commit:     Kenneth Raplee <kenrap@FreeBSD.org>
CommitDate: 2026-08-08 11:58:35 +0000

    security/mkcert: New port
    
    A simple tool for making locally-trusted development certificates. It
    requires no configuration.
    
    PR:             297301
    Co-authored-by: Kenneth Raplee <kenrap@FreeBSD.org>
    Approved by:    arrowd (co-mentor)
    
    (cherry picked from commit b48efd140a1e79606b928bb157eeef4f1fafcbaf)
---
 security/Makefile                           |  1 +
 security/mkcert/Makefile                    | 32 +++++++++++++
 security/mkcert/distinfo                    |  5 +++
 security/mkcert/files/truststore_freebsd.go | 69 +++++++++++++++++++++++++++++
 security/mkcert/pkg-descr                   | 12 +++++
 5 files changed, 119 insertions(+)

diff --git a/security/Makefile b/security/Makefile
index c0ef63895ea6..a41aa83ca575 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -398,6 +398,7 @@
     SUBDIR += mhash
     SUBDIR += mindterm-binary
     SUBDIR += minisign
+    SUBDIR += mkcert
     SUBDIR += mkp224o
     SUBDIR += modsecurity3
     SUBDIR += modsecurity3-nginx
diff --git a/security/mkcert/Makefile b/security/mkcert/Makefile
new file mode 100644
index 000000000000..c6abcc350d21
--- /dev/null
+++ b/security/mkcert/Makefile
@@ -0,0 +1,32 @@
+PORTNAME=	mkcert
+DISTVERSIONPREFIX=	v
+DISTVERSION=	1.4.4
+CATEGORIES=	security
+
+MAINTAINER=	owlandrews@protonmail.com
+COMMENT=	Simple tool for making locally-trusted development certificates
+WWW=		https://mkcert.dev
+
+LICENSE=	BSD3CLAUSE
+
+USES=		go:modules
+
+USE_GITHUB=	yes
+GH_ACCOUNT=	FiloSottile
+
+GO_MOD_DIST=	github
+GO_MODULE=	filippo.io/mkcert
+
+PLIST_FILES=	bin/${PORTNAME}
+PORTDOCS=	README.md
+
+OPTIONS_DEFINE=	DOCS
+
+pre-configure:
+	@${CP} ${FILESDIR}/truststore_freebsd.go ${WRKSRC}/truststore_freebsd.go
+
+do-install-DOCS-on:
+	        ${MKDIR} ${STAGEDIR}${DOCSDIR}
+		        ${INSTALL_DATA} ${WRKSRC}/${PORTDOCS} ${STAGEDIR}${DOCSDIR}/
+
+.include <bsd.port.mk>
diff --git a/security/mkcert/distinfo b/security/mkcert/distinfo
new file mode 100644
index 000000000000..7c9c5b8a2a61
--- /dev/null
+++ b/security/mkcert/distinfo
@@ -0,0 +1,5 @@
+TIMESTAMP = 1785949054
+SHA256 (go/security_mkcert/FiloSottile-mkcert-v1.4.4_GH0/go.mod) = 4b3d2a3c5b5a228638ee9b38587d43f4ee468dd0954d3cd58284431e81a86752
+SIZE (go/security_mkcert/FiloSottile-mkcert-v1.4.4_GH0/go.mod) = 287
+SHA256 (go/security_mkcert/FiloSottile-mkcert-v1.4.4_GH0/FiloSottile-mkcert-v1.4.4_GH0.tar.gz) = 32bd5519581bf0b03f53e5b22721692b99f39ab5b161dc27532c51eafa512ca9
+SIZE (go/security_mkcert/FiloSottile-mkcert-v1.4.4_GH0/FiloSottile-mkcert-v1.4.4_GH0.tar.gz) = 17604
diff --git a/security/mkcert/files/truststore_freebsd.go b/security/mkcert/files/truststore_freebsd.go
new file mode 100644
index 000000000000..c031e1162ff7
--- /dev/null
+++ b/security/mkcert/files/truststore_freebsd.go
@@ -0,0 +1,69 @@
+// Copyright 2018 The mkcert Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+var (
+	FirefoxProfiles = []string{os.Getenv("HOME") + "/.mozilla/firefox/*"}
+	NSSBrowsers = "Firefox and/or Chrome/Chromium"
+
+	SystemTrustFilename string
+	SystemTrustCommand  []string
+	CertutilInstallHelp string
+)
+
+func init() {
+	err := os.MkdirAll("/usr/local/etc/ssl/certs", 0755)
+	fatalIfErr(err, "/usr/local/etc/ssl/certs")
+
+	SystemTrustFilename = "/usr/local/etc/ssl/certs/%s.pem"
+	SystemTrustCommand = []string{"certctl", "rehash"}
+}
+
+func (m *mkcert) systemTrustFilename() string {
+	return fmt.Sprintf(SystemTrustFilename, strings.Replace(m.caUniqueName(), " ", "_", -1))
+}
+
+func (m *mkcert) installPlatform() bool {
+	cert, err := os.ReadFile(filepath.Join(m.CAROOT, rootName))
+	fatalIfErr(err, "failed to read root certificate")
+
+	err = os.WriteFile(m.systemTrustFilename(), cert, 0644)
+	fatalIfErr(err, "failed to write certificate")
+
+	cmd := commandWithSudo(SystemTrustCommand...)
+	out, err := cmd.CombinedOutput()
+	fatalIfCmdErr(err, strings.Join(SystemTrustCommand, " "), out)
+
+	return true
+}
+
+func (m *mkcert) uninstallPlatform() bool {
+	if SystemTrustCommand == nil {
+		return false
+	}
+
+	err := os.Remove(m.systemTrustFilename())
+	fatalIfErr(err, "os.Remove failed on "+m.systemTrustFilename())
+
+	// We used to install under non-unique filenames.
+	legacyFilename := fmt.Sprintf(SystemTrustFilename, "mkcert-rootCA")
+	if pathExists(legacyFilename) {
+		err := os.Remove(legacyFilename)
+		fatalIfErr(err, "os.Remove failed on "+legacyFilename)
+	}
+
+	cmd := commandWithSudo(SystemTrustCommand...)
+	out, err := cmd.CombinedOutput()
+	fatalIfCmdErr(err, strings.Join(SystemTrustCommand, " "), out)
+
+	return true
+}
diff --git a/security/mkcert/pkg-descr b/security/mkcert/pkg-descr
new file mode 100644
index 000000000000..f5aa8017f194
--- /dev/null
+++ b/security/mkcert/pkg-descr
@@ -0,0 +1,12 @@
+mkcert is a simple tool for making locally-trusted development certificates. It
+requires no configuration.
+
+Using certificates from real certificate authorities (CAs) for development can
+be dangerous or impossible (for hosts like example.test, localhost or
+127.0.0.1), but self-signed certificates cause trust errors. Managing your own
+CA is the best solution, but usually involves arcane commands, specialized
+knowledge and manual steps.
+
+mkcert automatically creates and installs a local CA in the system root store,
+and generates locally-trusted certificates.  mkcert does not automatically
+configure servers to use the certificates, though, that's up to you.