git: 304389c257e0 - main - www/pomerium-envoy-custom: update to 1.37.0.20261001

Go to: [ bottom of page ] [ top of archives ] [ this month ]
From: Xin LI <delphij_at_FreeBSD.org>
Date: Fri, 09 Oct 2026 07:23:54 UTC
The branch main has been updated by delphij:

URL: https://cgit.FreeBSD.org/ports/commit/?id=304389c257e02b07c431a44ea9d196edfe4ff677

commit 304389c257e02b07c431a44ea9d196edfe4ff677
Author:     Xin LI <delphij@FreeBSD.org>
AuthorDate: 2026-10-05 01:22:56 +0000
Commit:     Xin LI <delphij@FreeBSD.org>
CommitDate: 2026-10-09 07:23:44 +0000

    www/pomerium-envoy-custom: update to 1.37.0.20261001
    
    Update to envoy-custom commit 8b998d0f6ff3, which moves the bundled
    Envoy from 1.38.2 to 1.38.5, as required by pomerium 0.33.4.
    
    While here, link the envoy binary as a position-independent
    executable so that it benefits from ASLR.
---
 www/pomerium-envoy-custom/Makefile              | 19 +++++++++----------
 www/pomerium-envoy-custom/distinfo              | 22 +++++++++++-----------
 www/pomerium-envoy-custom/files/patch-BUILD     | 11 ++++++-----
 www/pomerium-envoy-custom/files/patch-WORKSPACE |  6 +++---
 4 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/www/pomerium-envoy-custom/Makefile b/www/pomerium-envoy-custom/Makefile
index ba034f31f426..7420bfec9cb4 100644
--- a/www/pomerium-envoy-custom/Makefile
+++ b/www/pomerium-envoy-custom/Makefile
@@ -1,7 +1,6 @@
 PORTNAME=	pomerium-envoy-custom
 DISTVERSIONPREFIX=
-DISTVERSION=	1.37.0.20260618
-PORTREVISION=	4
+DISTVERSION=	1.37.0.20261001
 CATEGORIES=	www
 MASTER_SITES+=	https://github.com/envoyproxy/envoy/archive/:envoy_src \
 		https://github.com/openssh/openssh-portable/archive/:openssh_portable \
@@ -15,7 +14,7 @@ MASTER_SITES+=	https://github.com/envoyproxy/envoy/archive/:envoy_src \
 		https://github.com/bazelbuild/rules_proto/archive/refs/tags/:envoy_api_rules_proto \
 		https://github.com/bufbuild/buf/releases/download/v1.61.0/:envoy_api_buf \
 		https://github.com/google/cel-spec/archive/:envoy_api_dev_cel \
-		https://github.com/envoyproxy/toolshed/releases/download/bazel-v0.3.35/:envoy_api_toolshed
+		https://github.com/envoyproxy/toolshed/releases/download/bazel-v0.4.13.post0/:envoy_api_toolshed
 DISTFILES+=	${ENVOY_SRC_COMMIT}.zip:envoy_src \
 		V_10_3_P1.tar.gz:openssh_portable \
 		v0.9.8.tar.gz:magic_enum \
@@ -28,7 +27,7 @@ DISTFILES+=	${ENVOY_SRC_COMMIT}.zip:envoy_src \
 		7.1.0.tar.gz:envoy_api_rules_proto \
 		buf-Linux-x86_64.tar.gz:envoy_api_buf \
 		v0.25.1.tar.gz:envoy_api_dev_cel \
-		toolshed-bazel-v0.3.35.tar.gz:envoy_api_toolshed
+		toolshed-bazel-v0.4.13.post0.tar.gz:envoy_api_toolshed
 DIST_SUBDIR=	${PORTNAME}
 
 MAINTAINER=	delphij@FreeBSD.org
@@ -67,12 +66,12 @@ USES=		cmake:indirect compiler:c++20-lang gmake go:no_targets \
 		java:build ninja:build python:build
 USE_GITHUB=	yes
 
-ENVOY_SRC_COMMIT=	f387231af8dd7274e37c5ae2cc797cb09a948818
+ENVOY_SRC_COMMIT=	4be7862a2a6d9a7867f576385d545bb0b47b9181
 ZLIBBASE=		${LOCALBASE:H}
 
 GH_ACCOUNT=	pomerium
 GH_PROJECT=	envoy-custom
-GH_TAGNAME=	16ede7a56f2f2c4de7011337193495e32d57ce3b
+GH_TAGNAME=	8b998d0f6ff30a8243296168125a783c35772141
 
 # Bazel-managed dependencies (GitHub archive format).
 # These are fetched by Bazel as http_archive during the build, sourced from
@@ -112,7 +111,7 @@ GH_TUPLE+=	grailbio:bazel-compilation-database:40864791135333e1446a04553b63cbe74
 		confluentinc:librdkafka:v2.6.0:confluentinc_librdkafka \
 		cython:cython:0.29.35:cython \
 		envoyproxy:examples:v0.2.3:envoy_examples \
-		envoyproxy:toolshed:bazel-v0.3.35:envoy_toolshed \
+		envoyproxy:toolshed:bazel-v0.4.13.post0:envoy_toolshed \
 		fastfloat:fast_float:v7.0.0:fast_float \
 		ninja-build:ninja:v1.13.1:fips_ninja \
 		google:gurl:dd4080fec0b443296c0ed0036e1e776df8813aa7:googleurl \
@@ -138,7 +137,7 @@ GH_TUPLE+=	grailbio:bazel-compilation-database:40864791135333e1446a04553b63cbe74
 		protocolbuffers:utf8_range:de0b4a8ff9b5d4c98108bdfe723291a33c52c54f:utf8_range \
 		v8:v8:14.6.202.10:v8 \
 		bytecodealliance:wasm-micro-runtime:WAMR-2.4.4:com_github_wamr \
-		bytecodealliance:wasmtime:v24.0.7:com_github_wasmtime \
+		bytecodealliance:wasmtime:v24.0.9:com_github_wasmtime \
 		intel:ittapi:a3911fff01a775023a06af8754f9ec1e5977dd97:intel_ittapi
 
 JAVA_VERSION=	21+
@@ -974,11 +973,11 @@ pre-build:
 	${CP} ${FILESDIR}/sys_repos_prometheus_metrics_model.BUILD.bazel \
 		${WRKDIR}/sys_repos/prometheus_metrics_model/BUILD.bazel
 # envoy_toolshed: extract the real toolshed from the GH_TUPLE archive.
-# The archive has toolshed-bazel-v0.3.35/{bazel/,...}; the Bazel repo root
+# The archive has toolshed-bazel-v0.4.13.post0/{bazel/,...}; the Bazel repo root
 # is the bazel/ subdirectory (contains WORKSPACE, BUILD, versions.bzl, etc.).
 # --override_repository points to ${WRKDIR}/sys_repos/envoy_toolshed/bazel.
 	@${MKDIR} ${WRKDIR}/sys_repos/envoy_toolshed
-	@${TAR} -xzf ${DISTDIR}/${DIST_SUBDIR}/envoyproxy-toolshed-bazel-v0.3.35_GH0.tar.gz \
+	@${TAR} -xzf ${DISTDIR}/${DIST_SUBDIR}/envoyproxy-toolshed-bazel-v0.4.13.post0_GH0.tar.gz \
 		--strip-components=1 \
 		-C ${WRKDIR}/sys_repos/envoy_toolshed
 # yq: envoy_repo uses @yq to parse CI config YAML.  aspect_bazel_lib's
diff --git a/www/pomerium-envoy-custom/distinfo b/www/pomerium-envoy-custom/distinfo
index b954dfea015e..9affdf950f21 100644
--- a/www/pomerium-envoy-custom/distinfo
+++ b/www/pomerium-envoy-custom/distinfo
@@ -1,6 +1,6 @@
-TIMESTAMP = 1785735825
-SHA256 (pomerium-envoy-custom/f387231af8dd7274e37c5ae2cc797cb09a948818.zip) = 21c213c424514b6304ec6baa12e92c39ba6a85fcdbf261477d11ce2b32ad564d
-SIZE (pomerium-envoy-custom/f387231af8dd7274e37c5ae2cc797cb09a948818.zip) = 54629711
+TIMESTAMP = 1791140031
+SHA256 (pomerium-envoy-custom/4be7862a2a6d9a7867f576385d545bb0b47b9181.zip) = d62b8cefeac5960ea72333c26c67afc0d17c60d92ea848256c7b31685fa8a39b
+SIZE (pomerium-envoy-custom/4be7862a2a6d9a7867f576385d545bb0b47b9181.zip) = 54718648
 SHA256 (pomerium-envoy-custom/V_10_3_P1.tar.gz) = c1a4420b1a25ba7336f62afd42ed5974d93455a2ab8c769b5e8e0c8ff8eedadc
 SIZE (pomerium-envoy-custom/V_10_3_P1.tar.gz) = 1970973
 SHA256 (pomerium-envoy-custom/v0.9.8.tar.gz) = 1e54959a3f3cb675938d858603ad69d0f3f7c82439fc2bf86d7232daec2bd10e
@@ -23,8 +23,8 @@ SHA256 (pomerium-envoy-custom/buf-Linux-x86_64.tar.gz) = 16253b6702dd447ef941b01
 SIZE (pomerium-envoy-custom/buf-Linux-x86_64.tar.gz) = 21887919
 SHA256 (pomerium-envoy-custom/v0.25.1.tar.gz) = 13583c5a312861648449845b709722676a3c9b43396b6b8e9cbe4538feb74ad2
 SIZE (pomerium-envoy-custom/v0.25.1.tar.gz) = 196469
-SHA256 (pomerium-envoy-custom/toolshed-bazel-v0.3.35.tar.gz) = 5179bc3f912d9c2dd5a6e5215e98222abe088847f021eba9f0f2e9a006deacaa
-SIZE (pomerium-envoy-custom/toolshed-bazel-v0.3.35.tar.gz) = 84491
+SHA256 (pomerium-envoy-custom/toolshed-bazel-v0.4.13.post0.tar.gz) = 0485886f4d2aa3b666540e752d7a2e8eed9b79f6840f8f1cfad3b41f135cdb76
+SIZE (pomerium-envoy-custom/toolshed-bazel-v0.4.13.post0.tar.gz) = 186791
 SHA256 (pomerium-envoy-custom/v3.2.tar.gz) = 9dcb3d8ce0a41b2a48ac8baa54b51a9f1b6a2c52dd374e28cc713bab0568ec98
 SIZE (pomerium-envoy-custom/v3.2.tar.gz) = 123731
 SHA256 (pomerium-envoy-custom/bazel-lib-v2.21.2.tar.gz) = 53cadea9109e646a93ed4dc90c9bbcaa8073c7c3df745b92f6a5000daf7aa3da
@@ -163,8 +163,8 @@ SHA256 (pomerium-envoy-custom/v0.38.0.zip) = dacd7c9aa2b298f966822da214c6d601da0
 SIZE (pomerium-envoy-custom/v0.38.0.zip) = 2002991
 SHA256 (pomerium-envoy-custom/v0.0.0-20191204190536-9bdfabe68543.zip) = a93010abd3c4f483710c37fb87511a776942f709b4c1820a28d099d448680390
 SIZE (pomerium-envoy-custom/v0.0.0-20191204190536-9bdfabe68543.zip) = 22282
-SHA256 (pomerium-envoy-custom/pomerium-envoy-custom-1.37.0.20260618-16ede7a56f2f2c4de7011337193495e32d57ce3b_GH0.tar.gz) = e40fc709d8689da8c6a6186de96db67a0db6ca8ffbbb28bcec76b87abfcba7e7
-SIZE (pomerium-envoy-custom/pomerium-envoy-custom-1.37.0.20260618-16ede7a56f2f2c4de7011337193495e32d57ce3b_GH0.tar.gz) = 533536
+SHA256 (pomerium-envoy-custom/pomerium-envoy-custom-1.37.0.20261001-8b998d0f6ff30a8243296168125a783c35772141_GH0.tar.gz) = abcbe8615010c896beed1f57cc69ef549d33602c55a9a3ce3cc9191f17cd1217
+SIZE (pomerium-envoy-custom/pomerium-envoy-custom-1.37.0.20261001-8b998d0f6ff30a8243296168125a783c35772141_GH0.tar.gz) = 533603
 SHA256 (pomerium-envoy-custom/grailbio-bazel-compilation-database-40864791135333e1446a04553b63cbe744d358d0_GH0.tar.gz) = acd2a9eaf49272bb1480c67d99b82662f005b596a8c11739046a4220ec73c4da
 SIZE (pomerium-envoy-custom/grailbio-bazel-compilation-database-40864791135333e1446a04553b63cbe744d358d0_GH0.tar.gz) = 16066
 SHA256 (pomerium-envoy-custom/bazelbuild-bazel-toolchains-v5.1.2_GH0.tar.gz) = 02e4f3744f1ce3f6e711e261fd322916ddd18cccd38026352f7a4c0351dbda19
@@ -233,8 +233,8 @@ SHA256 (pomerium-envoy-custom/cython-cython-0.29.35_GH0.tar.gz) = a2da56cc22be82
 SIZE (pomerium-envoy-custom/cython-cython-0.29.35_GH0.tar.gz) = 2115190
 SHA256 (pomerium-envoy-custom/envoyproxy-examples-v0.2.3_GH0.tar.gz) = a0fc7991a346333c1e3d17ab6d8a68bc3d0a4e76a6f6adf83b51eab9e7103bd8
 SIZE (pomerium-envoy-custom/envoyproxy-examples-v0.2.3_GH0.tar.gz) = 4515787
-SHA256 (pomerium-envoy-custom/envoyproxy-toolshed-bazel-v0.3.35_GH0.tar.gz) = ec94ac25ea5f8535552b088fb70134be461f2a3b03c31739fcaed9d279f3238e
-SIZE (pomerium-envoy-custom/envoyproxy-toolshed-bazel-v0.3.35_GH0.tar.gz) = 3592430
+SHA256 (pomerium-envoy-custom/envoyproxy-toolshed-bazel-v0.4.13.post0_GH0.tar.gz) = 9aa56955047082227a2a09ebe86eb482c0c694d3bfdb8ec63b21afbdc98c1204
+SIZE (pomerium-envoy-custom/envoyproxy-toolshed-bazel-v0.4.13.post0_GH0.tar.gz) = 6846335
 SHA256 (pomerium-envoy-custom/fastfloat-fast_float-v7.0.0_GH0.tar.gz) = d2a08e722f461fe699ba61392cd29e6b23be013d0f56e50c7786d0954bffcb17
 SIZE (pomerium-envoy-custom/fastfloat-fast_float-v7.0.0_GH0.tar.gz) = 103358
 SHA256 (pomerium-envoy-custom/ninja-build-ninja-v1.13.1_GH0.tar.gz) = f0055ad0369bf2e372955ba55128d000cfcc21777057806015b45e4accbebf23
@@ -285,7 +285,7 @@ SHA256 (pomerium-envoy-custom/v8-v8-14.6.202.10_GH0.tar.gz) = 09c3d9f796a671fb96
 SIZE (pomerium-envoy-custom/v8-v8-14.6.202.10_GH0.tar.gz) = 31916890
 SHA256 (pomerium-envoy-custom/bytecodealliance-wasm-micro-runtime-WAMR-2.4.4_GH0.tar.gz) = 03ad51037f06235577b765ee042a462326d8919300107af4546719c35525b298
 SIZE (pomerium-envoy-custom/bytecodealliance-wasm-micro-runtime-WAMR-2.4.4_GH0.tar.gz) = 5969196
-SHA256 (pomerium-envoy-custom/bytecodealliance-wasmtime-v24.0.7_GH0.tar.gz) = 2cf72451e5031d8072623c4c3003699ee65ccc94edfab1d8b664744a8c611d4f
-SIZE (pomerium-envoy-custom/bytecodealliance-wasmtime-v24.0.7_GH0.tar.gz) = 23509372
+SHA256 (pomerium-envoy-custom/bytecodealliance-wasmtime-v24.0.9_GH0.tar.gz) = 2185c520f495e299770b12273fbe8aefc99c95687db9e015ce33ca43212898fd
+SIZE (pomerium-envoy-custom/bytecodealliance-wasmtime-v24.0.9_GH0.tar.gz) = 23511993
 SHA256 (pomerium-envoy-custom/intel-ittapi-a3911fff01a775023a06af8754f9ec1e5977dd97_GH0.tar.gz) = 1d0dddfc5abb786f2340565c82c6edd1cff10c917616a18ce62ee0b94dbc2ed4
 SIZE (pomerium-envoy-custom/intel-ittapi-a3911fff01a775023a06af8754f9ec1e5977dd97_GH0.tar.gz) = 128827
diff --git a/www/pomerium-envoy-custom/files/patch-BUILD b/www/pomerium-envoy-custom/files/patch-BUILD
index 896246feb1ba..9e5dfe6d28b5 100644
--- a/www/pomerium-envoy-custom/files/patch-BUILD
+++ b/www/pomerium-envoy-custom/files/patch-BUILD
@@ -1,4 +1,4 @@
---- BUILD.orig	2026-06-18 18:08:19 UTC
+--- BUILD.orig	2026-10-01 21:17:51 UTC
 +++ BUILD
 @@ -2,9 +2,7 @@ load(
      "@envoy//bazel:envoy_build_system.bzl",
@@ -10,17 +10,18 @@
  
  package(default_visibility = ["//visibility:public"])
  
-@@ -25,6 +23,9 @@ envoy_cc_binary(
+@@ -25,6 +23,10 @@ envoy_cc_binary(
              # https://github.com/bazelbuild/bazel/pull/16414
              "-Wl,-undefined,error",
          ],
 +        "@platforms//os:freebsd": [
 +            "-fPIE",
++            "-pie",
 +        ],
          "//conditions:default": [
              "-fPIE",
              "-Wl,-E",
-@@ -48,6 +49,7 @@ envoy_cc_binary(
+@@ -48,6 +50,7 @@ envoy_cc_binary(
      name = "envoy.static",
      features = select({
          "@platforms//os:macos": [],
@@ -28,7 +29,7 @@
          "@envoy//bazel:asan_build": [],
          "@envoy//bazel:tsan_build": [],
          "//conditions:default": ["fully_static_link"],
-@@ -59,30 +61,6 @@ envoy_cc_binary(
+@@ -59,30 +62,6 @@ envoy_cc_binary(
      ],
  )
  
@@ -59,7 +60,7 @@
  configure_make(
      name = "openssh_config_h",
      autoreconf = True,
-@@ -109,14 +87,4 @@ configure_make(
+@@ -109,14 +88,4 @@ configure_make(
          "@envoy//bazel:crypto",
          "@envoy//bazel:ssl",
      ],
diff --git a/www/pomerium-envoy-custom/files/patch-WORKSPACE b/www/pomerium-envoy-custom/files/patch-WORKSPACE
index 7ca6de89178f..c6625cfed7a8 100644
--- a/www/pomerium-envoy-custom/files/patch-WORKSPACE
+++ b/www/pomerium-envoy-custom/files/patch-WORKSPACE
@@ -1,4 +1,4 @@
---- WORKSPACE.orig	2026-06-18 18:08:19 UTC
+--- WORKSPACE.orig	2026-10-01 21:17:51 UTC
 +++ WORKSPACE
 @@ -2,31 +2,7 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "
  
@@ -29,7 +29,7 @@
 -
 -hedron_compile_commands_setup_transitive_transitive_transitive()
 -
- envoy_version = "f387231af8dd7274e37c5ae2cc797cb09a948818"
+ envoy_version = "4be7862a2a6d9a7867f576385d545bb0b47b9181"  # v1.38.5
  
  openssh_version = "V_10_3_P1"
 @@ -35,8 +11,6 @@ readerwriterqueue_version = "1.0.7"
@@ -42,7 +42,7 @@
      name = "envoy_build_config",
      path = "bazel/envoy_build_config",
 @@ -106,6 +80,8 @@ external_http_archive(
-         "@envoy_toolshed//:patches/toolchains_llvm.patch",
+         "@envoy//bazel/foreign_cc:toolchains_llvm_stdc++.patch",
          # linux->darwin cross-compile support
          "//patches/toolchains_llvm:0002-darwin.patch",
 +        # FreeBSD OS support in toolchains_llvm