8000 netcat 1.239 (new), libbsd 0.12.2 (new), libmd 1.3.0 (new): OpenBSD nc by norrietaylor · Pull Request #1342 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

netcat 1.239 (new), libbsd 0.12.2 (new), libmd 1.3.0 (new): OpenBSD nc - #1342

Merged
norrietaylor merged 1 commit into
mainfrom
fix/bugbash-16-netcat
Nov 6, 2026
Merged

netcat 1.239 (new), libbsd 0.12.2 (new), libmd 1.3.0 (new): OpenBSD nc#1342
norrietaylor merged 1 commit into
mainfrom
fix/bugbash-16-netcat

Conversation

@norrietaylor
@norrietaylor norrietaylor commented Nov 5, 2026 •
edited by coderabbitai Bot
Loading
Copy link
Copy Markdown
Member

Root cause

The registry has no netcat package (socat is available). A tester reported this during a bug bash, and the decision was to add one. There is no existing issue.

Fix

Adds three new packages. The OpenBSD nc is the only one that is user-facing.

  • netcat 1.239: OpenBSD nc, built from Debian's netcat-openbsd source. The upstream tarball is OpenBSD source and does not build on Linux. Debian's patch series (applied in build.sh) ports it to libbsd and drops TLS. Installs /usr/bin/nc, a netcat symlink, and the man page. There is no -e/-c and no TLS in this build.
  • libbsd 0.12.2 (new): runtime dependency of nc.
  • libmd 1.3.0 (new): dependency of libbsd.

Both netcat source hashes are the ones in Debian's signed .dsc. A comment in build.ncl notes that this pin can go stale silently, because version checks follow the upstream version rather than the Debian revision.

Tests in the package: smoketest (/usr/bin/nc -h) and loopback (listener on 127.0.0.1 receives a client's data).

Test plan

  • bash -n on the three new build.sh files: syntax OK (run).
  • No other command was run. The repo's min config check and package build are provided by the in-sandbox helper, which was not available in the environment this PR was prepared in. The nickel binary was not available either.
  • Needed before merge: the config check on netcat, libbsd and libmd, a build of netcat, and the smoketest and loopback tests, plus CI.

Not verified

  • Nothing was evaluated or built: the Nickel specs, the build, output globs, and both tests are unverified.
  • The loopback test uses a fixed port (39817) and a sleep 1. Whether that is reliable in the test sandbox is unconfirmed.
  • -march=x86-64-v3 flags for libmd/libbsd/netcat follow other packages' convention but were not checked against a build.
  • Whether Debian's current patch series differs from the pinned 1.239-1 was not checked.

Summary by CodeRabbit

  • New Features
    • Added OpenBSD netcat, providing the nc and netcat commands for basic network connections and loopback testing.
    • Added the libbsd and libmd libraries and their development files.
    • This netcat build does not support -e/-c options or TLS.

@norrietaylor
libmd 1.3.0 (new), libbsd 0.12.2 (new), netcat 1.239 (new): OpenBSD nc
cb1f74f 
The catalog had no package shipping `nc`; socat and inetutils do not
provide it. This adds OpenBSD netcat as Debian packages it, plus the
libbsd and libmd it needs on Linux.

No -e/-c and no TLS in this build: Debian's series drops TLS.

libbsd.so is a linker script, so its libs output sets allow_data.
Extraction loses the tarballs' mtimes, so libmd and libbsd give the
tree one mtime before configure or make reruns the autotools.

Sources use the upstream and Debian pool https URLs, not the gs://
mirror. Debian drops superseded revisions from the pool, so mirroring
the netcat pair is a follow-up.
@norrietaylor
norrietaylor requested a review from a team as a code owner November 5, 2026 22:55
@coderabbitai
coderabbitai Bot commented Nov 5, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Explain Change →

Walkthrough

The change adds build specifications and scripts for libmd 1.3.0, libbsd 0.12.2, and OpenBSD netcat 1.239-1. It also adds netcat smoke and loopback tests.

Changes: Package additions

Layer / File(s) Summary
libmd package
packages/libmd/build.ncl, packages/libmd/build.sh		 Adds the libmd build specification and script. They define the source archive and checksum, dependencies, package outputs, architecture flags, build steps, and installation behavior.
libbsd package
packages/libbsd/build.ncl, packages/libbsd/build.sh		 Adds the libbsd build specification and script. They define the source archive and checksum, dependencies, package outputs, architecture flags, build steps, and installation behavior.
netcat package
packages/netcat/build.ncl, packages/netcat/build.sh		 Adds a Debian-patched netcat build with pinned sources, package outputs, and a build script that applies the patch series. Adds nc -h and loopback tests. The package comments state that this Linux build omits -e/-c and TLS.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: mitodrummer

Merge Risk: Minimal · up to cb1f7

No confirmed issue blocks merging after normal package-build and test checks.

Pre-merge checks: Passed 5

Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title identifies OpenBSD netcat and its two new dependencies.
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 3 files. (3 skipped: 3 unsupported.)

Finishing Touches

Generate docstrings

  • Commit to this branch
  • Create a new PR
Generate unit tests (beta)

  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

bryan-minimal
bryan-minimal approved these changes Nov 5, 2026
View reviewed changes
@bryan-minimal bryan-minimal left a comment
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving. Provenance and the port look right:

  • Both netcat sha256s match Debian's PGP-signed netcat-openbsd_1.239-1.dsc, and 1.239-1 is Debian's newest revision.
  • The patched Makefile sets CFLAGS with a plain assignment and links pkg-config --libs libbsd, so overriding CFLAGS on the make line is safe. Debian's rules do the same.
  • The output globs are narrow, so these packages avoid the usr/lib64 trap fixed in #1341.

One fix before merge: the man page is never installed. outputs.mans is usr/share/man/** and the body says the man page is installed, but build.sh only installs nc and the netcat symlink. As it stands the mans output matches nothing. nc.1 is in the source tree:

install -Dm644 nc.1 "$OUTPUT_DIR/usr/share/man/man1/nc.1"

Two things to watch on the first build, not blocking:

  • loopback uses a fixed port (39817) and sleep 1, and standalone tests run with network_plan=isolated. If it flakes, polling for the listener would be sturdier than the fixed sleep.
  • libbsd installs libbsd-ctor.a despite --disable-static. ARFLAGS=Drc on its make would keep that archive byte-reproducible.

coderabbitai[bot]
coderabbitai Bot reviewed Nov 5, 2026
View reviewed changes
@coderabbitai coderabbitai Bot left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional comments: 1

packages/netcat/build.ncl-43-43: 1

43-43: Major · Maintainability & Code Quality · Quick win

Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Add detbuild to the build dependencies.

The build runs make without staging or preloading detbuild. Add detbuild here, then preload only the offline make command in packages/netcat/build.sh. The repository rule requires: “Add detbuild to build_deps” and “Preload one command.” Without the dependency, the build can succeed without the required pinned build environment. (raw.githubusercontent.com)

As per coding guidelines, every package must build byte-reproducibly, and the preload must apply to one command rather than the whole script.

Source: Coding guidelines

Review info

Run configuration

Commits

Reviewing files that changed from the base of the PR and between b79dd65 and cb1f74f.

Files selected for processing: 6

  • packages/libbsd/build.ncl
  • packages/libbsd/build.sh
  • packages/libmd/build.ncl
  • packages/libmd/build.sh
  • packages/netcat/build.ncl
  • packages/netcat/build.sh

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

@norrietaylor
norrietaylor added this pull request to the merge queue Nov 6, 2026
Merged via the queue into main with commit 83dd1e2 Nov 6, 2026
15 checks passed
@norrietaylor
norrietaylor deleted the fix/bugbash-16-netcat branch November 6, 2026 02:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments
@bryan-minimal bryan-minimal bryan-minimal approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@norrietaylor @bryan-minimal
0