We would like to cover the following topics. This is not an exhaustive list and if you feel there is something missing that you want to talk about, contact the session chair and your topic will be included here.

Please send talks, brain storm topics, or other proposals to the session leader, ErwinLansing.

• Package set policy
• Security branch
• pkg_* removal

(Add a list or attach slides detailing the achieved results here.)

Announcement: We now have INDEX-10 from portsnap

Packages sets would take mirrors weeks to upload.

pkgng: the master needs to be atomic. If the pkg checksum doesn't match will fall back to alternative

New high bandwidth master and using myCDN

rsync –delay-update in two passes (files, then sym-links)

zfs replication. using zxfer.

zfs-snapshot-mgmt – avoid having to resync the entire dataset even if offline for a few days. zxfer – hasn't been touched since FreeBSD 8.2. Fails on later ZFS. Forked on github with many fixes, error checking, extra options To integrate: fdpv for progress bar animation

Buildfarm only has 5Mbps – is uploading constantly. Servers sync last 15mins of traffic within seconds. Staggered updates across servers.

Automatic mirror selection. GSLB from ScaleEngine. LB checks mirrors for freshness on images and drops them from the real hosts.

Conclusion: ZFS make replication easier and allows atomicity.

PCBSD servers pull about 36TiB per day – iso.cdn about 1 TiB/day, pkg.cdn ~85 GiB/day of that.

bapt: want to look at this for FreeBSD pkg repo and steal any applicable ideas.

Need to get pkg signing working – need signing server.

Compare portsnap is about 5TiB per month

Reprise of what was in the security session.

SSP mitigation fro stack based overflows. First appeared in FreeBSD 8, only in base system. Finally is here for ports.

The first 99% is easy. Easiest path simply to patch CFLAGS.

Needs a lot of polishing and testing before it can be default.

Showstoppers:

on i386 gcc special symbols addressed in specific way and needs to link binary in special way. Some ports do not honour LDFLAGS. Solution: turned libc.so into an ldscript: Propose libssp_nonshared for linking in 10.x. Now enabled by default for i386/amd64 in 10.x amd64 usable on 9.x by adding WITH_SSP_PORT knob (doesn't do anything on i386). Idea is to activate by default for official packages but not yet.

New archs need work.

New knob for port maintainers: SSP_UNSAFE – for ports that do weird things or for kernel modules.

Mirrors show new files 15min after upload from buildfarm completes.