Re: packages building for arm [my reply was rejected by @jarasoft.net as "Sender address rejected: You are a spammer"]

From: Mark Millard <marklmi_at_yahoo.com>
Date: Thu, 22 Oct 2026 19:03:57 UTC
On 10/22/26 11:47, Mark Millard wrote:
> On 10/21/26 23:52, Jack Raats wrote:
>> Hi,
>>
>> Is there something wrong with the packages building for arm64?
>>
>> They are far beyond the amd64 building! 
>>
>> root@nl:~ # pkg audit -F
>> vulnxml file up-to-date
>> unbound-1.26.1 is vulnerable:
>>   Unbound -- Multiple vulnerabilities
>>   CVE: CVE-2026-97206
>>   CVE: CVE-2026-50106
>>   CVE: CVE-2026-96405
>>   CVE: CVE-2026-109125
>>   CVE: CVE-2026-35501
>>   WWW: https://vuxml.FreeBSD.org/freebsd/0be28489-
>> cd2f-11f1-8135-8447094a420f.html
>>
>> p5-DBI-1.655 is vulnerable:
>>   p5-DBI -- Prevent dbi_profile crash
>>   CVE: CVE-2026-108518
>>   WWW: https://vuxml.FreeBSD.org/freebsd/23eecf73-
>> cd85-11f1-97dc-40b034429ecf.html
>>
>> php84-8.4.26 is vulnerable:
>>   PHP -- Multiple vulnerabilities
>>   CVE: CVE-2026-109618
>>   CVE: CVE-2026-109619
>>   WWW: https://vuxml.FreeBSD.org/freebsd/d8e16d08-
>> cd2f-11f1-8135-8447094a420f.html
>>
>> roundcube-php84-1.7.4,1 is vulnerable:
>>   Roundcube -- Multiple vulnerabilities
>>   WWW: https://vuxml.FreeBSD.org/freebsd/69adacad-
>> cba3-11f1-8135-8447094a420f.html
>>
>> curl-8.22.0 is vulnerable:
>>   Curl -- Multiple vulnerabilities
>>   CVE: CVE-2026-107929
>>   CVE: CVE-2026-107928
>>   CVE: CVE-2026-94266
>>   CVE: CVE-2026-94265
>>   CVE: CVE-2026-92386
>>   CVE: CVE-2026-92387
>>   CVE: CVE-2026-92388
>>   CVE: CVE-2026-92389
>>   CVE: CVE-2026-92390
>>   CVE: CVE-2026-92391
>>   CVE: CVE-2026-92392
>>   CVE: CVE-2026-86410
>>   CVE: CVE-2026-86412
>>   CVE: CVE-2026-86413
>>   CVE: CVE-2026-86414
>>   CVE: CVE-2026-86415
>>   CVE: CVE-2026-87861
>>   CVE: CVE-2026-87862
>>   CVE: CVE-2026-87863
>>   CVE: CVE-2026-87865
>>   CVE: CVE-2026-87866
>>   WWW: https://vuxml.FreeBSD.org/freebsd/14dab969-c797-11f1-
>> a6ea-8447094a420f.html
>>
>> 5 problem(s) in 5 package(s) found.
>> root@nl:~ # 
>>
>> Thanks
>>
>> Gr.,
>> Jack Raats
>>
>>
> 
> Context: The oldest of those dates back to 2024-Oct-14. The others are
> noticeably more recent.
> 
> You did not specify latest vs. quarterly or 14.4 vs. 15.1 vs. main as
> the context at issue for you. The detailed status varies across the
> combinations that are built.
> 
> 
> main-arm64 (ampere2) started building on 13 Oct 2026 02:16:47 GMT and is
> not finished. (Implicitly latest, not quarterly. Also this context is a
> debug build that takes longer than the others.) 38889 port packages queued.
> 
> 
> latest (a.k.a. default) 144arm64 (ampere3) started building on 11 Oct
> 2026 01:11:37 GMT and finished. 20740 port packages queued.
> 
> latest (a.k.a. default) 144arm64 (ampere3) again started building on 18
> Oct 2026 01:06:52 GMT and is not finished. 38912 port packages queued.
> 
> 
> quarterly 151arm64 (ampere4) started building on 13 Oct 2026 01:05:26
> GMT and finished. But will, not rebuild again until after the following
> finishes. 7157 port packages queued.
> 
> quarterly 144arm64 (ampere4) started building on 18 Oct 2026 01:06:52
> GMT but is building from the same (now old) ports tree snapshot that
> latest 151arm64 built and is not done. 7152 port packages queued. This
> will not rebuild based on a newer port tree until after quarterly
> 151arm64 finishes its later build of a newer ports tree.
> 
> 
> latest (a.k.a. default) 151arm64 (ampere5) started building on Thu, 15
> Oct 2026 01:03:02 GMT and finished. 38902 port packages queued.
> 
> latest (a.k.a. default) 151arm64 (ampere5) again started building on 20
> Oct 2026 01:01:50 GMT and is not finished. 10645 port packages queued.
> 
> 
> ampere2 and ampere3 have 32 cores.
> ampere4 and ampere5 have 160 cores.
> 
> Distribution happens after building and takes time as well. That
> contributes to the the time between builds on the same machine.
> 
> 


-- 
===
Mark Millard
marklmi at yahoo.com