security/openpgp-card-tools: [NEW PORT] CLI tool for interacting with OpenPGP
cards
The openpgp-card-tools package provides 'oct', a command-line tool for
interacting with OpenPGP cards (YubiKey, Nitrokey and other
OpenPGP-compliant smart cards and security tokens). It supports listing
card information, managing PINs, generating and importing keys, and
performing cryptographic operations directly on the hardware.
WWW: https://codeberg.org/openpgp-card/openpgp-card-tools
PR: 293960
Co-authored-by: alven@
[NEW PORT] security/mkcacerts: Generate a Java PKCS#12 truststore from
certctl(8)'s truststore
mkcacerts reads the trusted certificates maintained by certctl(8) and
generates a Java-compatible PKCS#12 truststore from them, so that a Java
Virtual Machine's default truststore can be derived from the system
truststore without invoking a JVM or keytool to build it.
WWW: https://github.com/michael-o/freebsd-mkcacerts
security/tailcat: New port: Like netcat, over Tailscale's data plane, no control
plane
Tailcat is a remix of Tailscale open source pieces to act like
netcat, but over Tailscale's data plane, without Tailscale's control
plane. Tailscale's data plane (magicsock, internally) gives you
point-to-point WireGuard-encrypted tunnels between two machines
with DERP as the NAT-hole-punching communication side channel and
the ultimate relay-of-last-resort if NAT traversal fails. Instead
of using the Tailscale control plane, all tailcat connection metadata
is exchanged out of band, however you want.
WWW: https://tailscale.com/tailcat
security/py-pysequoia: new port
This library provides OpenPGP facilities in Python through the Sequoia PGP
library. If you need to work with encryption and digital signatures using an
IETF standardized protocol, this package is for you!
PR: 298498
Reported by: Polarian <polarian@polarian.dev>
cleanup: Remove expired barnyard ports:
2026-09-30 security/barnyard2: Upstream has been abandoned, and the project is
no longer maintained
2026-09-30 security/barnyard2-sguil: Upstream has been abandoned, and the
project is no longer maintained
security/openssl: Security upgrade to 3.5.9
OpenSSL 3.0 is end-of-life and has known vulnerabilities.
Upgrade port to OpenSSL 3.5 by renaming security/openssl35
Security: 0d183075-bcb5-11f1-b09d-8447094a420
MFH: 2026Q3
security/openssl30: Resurrect OpenSSL 3.0 port
For FreeBSD 14, expires 2028-11-30
Has known vulnerabilities, users are encouraged to move
to OpenSSL 3.5 from security/openssl
security/x11appjail: New port: Tool for creating, verifying, installing, and
running AppJails
x11appjail is a specialized tool for creating, verifying, installing,
and running AppJails. An AppJail is a CLI, TUI or X11 application
that runs inside a FreeBSD jail but is perceived by the end user
as identical (or at least very similar) to an application running
directly on the host system.
This tool makes extensive use of appjail(1) as its engine; however,
unlike the latter, the primary user in x11appjail is neither root
nor a privileged user, but rather an unprivileged user. The fundamental
goal of this project is to grant the user limited access to the
jail, restricted solely to the execution of a CLI, TUI or X11
application.
WWW: https://github.com/DtxdF/x11appjail
security/py-nettacker: New port: Automated penetration testing and
information-gathering framework
- Submitter becomes maintainer
OWASP Nettacker is an open-source, Python-based automated penetration testing
and information-gathering framework designed to help cyber security
professionals and ethical hackers perform reconnaissance, vulnerability
assessments, and network security audits efficiently.
Nettacker automates tasks like port scanning, service detection, subdomain
enumeration, network mapping, vulnerability scanning, credential brute-force
testing making it a powerful tool for identifying weaknesses in networks, web
applications, IoT devices and APIs.
WWW: https://owasp.org/nettacker
PR: 297892
security/globalprotect-openconnect: Remove expired port
2026-08-31 security/globalprotect-openconnect: This version has a vulnerability
(CVE-2021-45810)
security/pass-cli: Add port: Command-line interface for Proton Pass
The Proton Pass CLI allows you to manage your Proton Pass vaults and
items directly from the command line, bringing the power of secure
secret management to your terminal workflow. With the CLI, you can
create, list, view, and delete vaults and items seamlessly, making it
an great tool for developers and system administrators who prefer
working in the command line.
Beyond basic vault management, the CLI allows you to inject secrets
into your applications through environment variables or template
files, enabling easy integration with your deployment workflows. The
tool also provides comprehensive SSH integration, allowing you to use
your SSH keys stored in Proton Pass with your existing SSH workflows.
WWW: https://protonpass.github.io/pass-cli/
WWW: https://github.com/protonpass/pass-cli
security/py-biscuit-auth: Convert build to use PEP 517 and rename to PyPI name
* Rename port to PyPI name according to Python policy
* Move build completely to PEP 517
* Bump consumers: www/bunkerweb/Makefile
* Simplify Python discovery; the build frontend will pass the interpreter
New name: security/py-biscuit-python
Co-authored-by: Jochen Neumeister <joneum@FreeBSD.org>
PR: 297823
Approved by: joneum (maintainer)
Differential Revision: https://reviews.freebsd.org/D59133
[NEW PORT] security/open-vulnerability-cli: CLI to query various online
vulnerability sources
The open-vulnerability-cli is a command line utility that can be
used to query various online vulnerability sources such as the NVD
or GHSA. The CLI and docker images can be used to mirror the NVD.
Note that the CLI is called vulnz because open-vulnerability-cli
is cumbersome. vulnz is a spring-boot command line utility built
with picocli.
Co-authored-by: Michael Osipov <michaelo@FreeBSD.org>
PR: 296276
security/mkcert: New port
A simple tool for making locally-trusted development certificates. It
requires no configuration.
PR: 297301
Co-authored-by: Kenneth Raplee <kenrap@FreeBSD.org>
Approved by: arrowd (co-mentor)
ssecurity/pam_ssh_agent: New port
pam_ssh_agent is a PAM module for authenticating using ssh-agent.
A PAM authentication module determining the identity of a user based
on a signature request and response sent via the ssh-agent protocol to
a potentially remote ssh-agent.
This project is a re-implementation of the pam_ssh_agent_auth module
but does not share any code with that project. We are pretty close to
covering all the features of the original implementation, along with
some additional features such as authentication using SSH
Certificates.
See also: security/pam_rssh security/pam_ssh_agent_auth
security/py-social-auth-core4: New port
This is the core component of the python-social-auth ecosystem, it
implements the common interface to define new authentication backends
to third parties services, implement integrations with web frameworks
and storage solutions.
PR: 297152
security/py-pyxmpp2_scram: New port
SCRAM implementation from PyXMPP2.
This project contains pyxmpp2.sasl.scram from PyXMPP2, packaged as a
standalone library.
WWW: https://github.com/ProgVal/pyxmpp2-scram/
security/dogtag-jss: Add new Port
Java Security Services provides a Java interface to Mozilla NSS.
It includes a Java security provider and native JNI libraries for
cryptographic operations, certificate handling, and symmetric-key
operations used by Dogtag PKI.
WWW: https://github.com/dogtagpki/jss
Sponsored by: Netzkommune GmbH
Required for: FreeIPA server port
security/gssproxy: Add new Port
GSS Proxy allows processes to perform GSSAPI operations, such as
Kerberos authentication, through a privileged daemon. This separates
credential handling from the application and lets services access
keytabs and credential caches without holding the privileges directly.
WWW: https://github.com/gssapi/gssproxy
Sponsored by: Netzkommune GmbH
Required for: FreeIPA server port
security/py-utls: Add py-utls 2026.5.30
Drop-in replacement for the ssl stdlib with a Fingerprint API for Chrome
impersonation. Built on stock BoringSSL through boring-sys - no vendored
patches, no curl-impersonate, no Go runtime at import time. Use it with any
known Python http client you like or used to.
security/py-rtls: Add py-rtls 2026.5.30
Ever dreamed of getting rid of OpenSSL within CPython without creating a custom
build of CPython for this? Tired of waiting half a decade for a solid and
up-to-date TLS experience, shipping Post-quantum, and ECH support by default?
Then rtls is made for you.
It's a drop-in replacement for the ssl stdlib! Support CPython 3.7 onward.
Including freethreaded.
security/py-kdcproxy: Add new Port
kdcproxy is a WSGI module for proxying Kerberos KDC requests over
HTTP and HTTPS. It is required by the upcoming FreeIPA server port.
WWW: https://github.com/latchset/kdcproxy
Sponsored by: Netzkommune GmbH
security/dogtag-pki: Add new Port
Dogtag PKI is an enterprise-class open source certificate system
providing Certificate Authority, Key Recovery Authority, OCSP,
and other PKI services.
This port installs the Dogtag PKI Python client and server modules.
It is required by the upcoming net/freeipa-server port.
WWW: https://www.dogtagpki.org/
Sponsored by: Netzkommune GmbH
security/ocaml-digestif: New port
Digestif is a hashing library for OCaml supporting the following
algorithm: BLAKE2B, BLAKE2S, Keccak-256, MD5, RIPEMD160, SHA1, SHA224,
SHA256, SHA3, SHA384, SHA512 and WHIRLPOOL.
This library permits to link against one of the two provided
implementations: the pure OCaml implementation ("digestif.ocaml"), or
one written in the C language ("digestif.c").
WWW: https://github.com/mirage/digestif
security/p5-Crypt-SysRandom-XS: Add p5-Crypt-SysRandom-XS 0.011
Crypt::SysRandom::XS uses whatever C interface is available to procure
cryptographically random data from the system.
security/cryptopp-modern: New port: C++ class library of cryptographic
algorithms and schemes
- Add CONFLICTS_INSTALL to security/cryptopp
Actively maintained fork of Crypto++ library which features multiple
algorithms and schemes such as:
ChaCha20-Poly1305, AES, Camellia, Blowfish, Threefish, Triple-DES, block
mode chipers, BLAKE2s, BLAKE3, GMAC, HMAC, SHA*, RSA, DSA, DH, ed25519,
x25519, Argon2, ML-KEM ML-DSA to name a few.
It acts as a drop-in API/ABI compatible replacement for the original
Crypto++ library
WWW: https://github.com/cryptopp-modern/cryptopp-modern
Reviewed by: diizzy
security/p5-Auth-GoogleAuth: Add new port
Auth::GoogleAuth is a Perl module providing an abstraction for the TOTP
(Time-based One-Time Password) algorithm as used by Google Authenticator
and compatible applications (RFC 6238).
It supports generating and verifying TOTP codes, producing otpauth:// URIs,
and generating QR code URLs suitable for enrollment in authenticator apps.
PR: 295883
security/infisical-cli: add new port for the official Infisical CLI
The Infisical CLI is a powerful command-line tool for secret management
that allows you to:
- Inject secrets into applications and development workflows
- Scan for secret leaks in your codebase and git history
- Export secrets to various formats (dotenv, JSON, YAML)
- Authenticate with Infisical Cloud or self-hosted instances
- Integrate with CI/CD pipelines and Docker containers
security/py-privleap: New port: Limited Privilege Escalation Framework
privleap is a privilege escalation framework similar in purpose to
sudo and doas, but very different conceptually. It is designed to
allow user-level applications to run very specific operations as
root without allowing full root control of the machine. Unlike
directly executable privilege escalation frameworks like sudo,
privleap runs as a background service that listens for signals from
other applications. Each signal can request a particular, pre-configured
action to be taken. Signals are authenticated, and each action is
taken only if the signal passes authentication. Any console output
from the action is then returned to the caller. This system allows
privleap to function without being SUID-root, and avoids a lot of
the potential pitfalls of sudo, doas, run0, etc.
WWW: https://www.kicksecure.com/wiki/Privleap
security/py-PAM: new port: Python interface to the PAM library
This module makes the PAM (Pluggable Authentication Modules) functions
available in Python 3. With this module you can write Python 3
applications that implement authentication services using PAM.
WWW: https://packages.debian.org/sid/python3-pam
security/rubygem-auth-sanitizer: Add rubygem-auth-sanitizer 0.1.2
auth-sanitizer provides small, dependency-light helpers for keeping OAuth and
authentication secrets out of object inspection and log output.
The gem is intentionally narrow in scope. It does not change HTTP requests,
token objects, persistence, or application configuration for you. Instead, it
gives host gems and applications two reusable redaction surfaces:
- Auth::Sanitizer::FilteredAttributes redacts selected instance variables from
#inspect.
- Auth::Sanitizer::SanitizedLogger wraps an existing logger and redacts
sensitive values from string log messages.
security/rbw: New port: Unofficial bitwarden cli
rbw is an unofficial command line client for Bitwarden. Although
Bitwarden does come with its own command line client, it is limited
by being stateless - to use it, you're required to manually lock
and unlock the client, and pass the temporary keys around in
environment variables, which makes it very difficult to use. rbw
avoids this problem by maintaining a background process which is
able to hold the keys in memory, similar to the way that ssh-agent
or gpg-agent work. This allows the client to be used in a much
simpler way, with the background agent taking care of maintaining
the necessary state.
WWW: https://github.com/doy/rbw/
security/py-himitsu-keyring: New port: GTK4-based prompter implementation for
Himitsu
Keyring is a graphical frontend for managing a Himitsu key store.
WWW: https://himitsustore.org
security/hiprompt-gtk: New port: GTK4-based prompter implementation for Himitsu
hiprompt-gtk is a GTK4-based prompter implementation for Himitsu.
WWW: https://himitsustore.org
security/py-shodan: Revert "security/py-shodan: New port: Python library and
command-line utility for Shodan"
This reverts commit 98f2446834b21a4f645c889016ac5f08fe68f899.
Reported by: Antoine Brodin <antoine@freebsd.org>
security/cdxgen: New port
cdxgen generates CycloneDX SBOMs for multiple programming
languages and ecosystems.
It supports scanning source code, containers, and binaries
to produce Software Bill of Materials outputs.
Project page:
https://github.com/CycloneDX/cdxgen
Sponsored by: OTTRIA
security/syft: New port
Syft is a CLI tool and library for generating a Software Bill of Materials
(SBOM) from container images and filesystems.
It supports multiple SBOM formats including CycloneDX and SPDX and can scan
containers, directories, and archives to identify installed packages.
Syft is developed by Anchore and is commonly used in software supply-chain
security workflows.
Sponsored by: OTTRIA
security/openssl40: Add new OpenSSL ECH capable port
* This is ALPHA level software, for testing only
* Adds Encrypted Client Hello feature
* Removes SSLv3
security/rubygem-doorkeeper-i18n{,-rails72}: Add new port.
Internationalization files for Doorkeeper OAuth2 provider
While I'm there, also add a variant of rubygem-doorkeeper for use
with rails72.
security/owasp-dependency-check: Remove expired port
2026-02-28 security/owasp-dependency-check: This port is 9 major versions and
almost 8 years behind on upstream. No maintainer. No users in the ports tree.
Does not compile with jdk11+.
security/py-unicode-show: New port: Detect and annotate suspicious Unicode
characters in text or files
unicode-show is a utility that reads text input (from standard input
or files) and highlights suspicious Unicode characters, such as
those outside the safe ASCII range. This tool is useful for identifying
potentially malicious or misleading Unicode characters in source
code, logs, or user input.
WWW: https://www.kicksecure.com/wiki/Unicode-show
security/py-serpico: New port: Security scanner for FreeBSD packages and
releases
serpico is a security scanner for FreeBSD packages and releases
that compares the versions against a list of versions marked as
vulnerable, then displays vulnerability information in a JSON-compact
format for easy analysis by other security tools.
WWW: https://github.com/DtxdF/serpico
security/himitsu: create new port
Himitsu is a secure secret storage system for Unix-like systems. It provides an
arbitrary key/value store (where values may be secret) and a query language for
manipulating the key store.
WWW: https://himitsustore.org
PR: 292475
security/p5-Digest-SipHash: new port
Perl XS interface to the SipHash algorithm.
This module does only one thing - calculates the SipHash value
of the given string.
security/pam_worker: new port
PAM-modules is a collection of useful PAM modules and command line
utilities for checking PAM authentication and other management groups.
