FreeBSD Ports Tree Frozen Over a 150-Megabyte File

The FreeBSD Project has issued a statement about the ports repository, which has now been frozen for several days. For anyone who's worried, we hasten to reassure you: this isn't about a malicious compromise, but merely about an excessively large commit that upset the usual order of things.

What happened

The freeze has been in effect since 21 July. A 150 MB binary file was committed to the ports tree, after which the core@ team decided to temporarily halt incoming changes in order to sort things out. The problematic commit broke the mirroring of the ports tree to github.com, which enforces a hard 100 MB file-size limit. On top of that, a binary “blob” of dubious licensing cleanliness had made its way into the repository's history.

Since the GitHub mirror matters to the community, the developers are now actively removing the offending commits and restoring synchronization with external services. The freeze was introduced precisely in order to limit the number of commits that will have to be rewritten when the repository is brought back to a correct state — the fewer of them that pile up on top of the mistake, the easier everything is to fix.

Transparency and guarantees

The project stresses that the ports tree was never at risk from a security standpoint. The team promises to prepare a reproducible and robust way of fixing the problem, along with instructions that users with existing local copies will need to follow in order to “catch up” with the changes that were made.

Separately, the developers promise full transparency: they will publish a procedure allowing anyone who wishes to verify that the official repository changes are limited to exactly the scope claimed — and nothing more. To keep this from happening again, they are introducing server-side hooks that will cut off oversized files in advance.

Work on dealing with the fallout is still ongoing. But, as observers note with some relief, this time there was no malicious intent — unlike the recent affair with the Arch Linux AUR, where the incident was of a far more unpleasant nature.

Source: Phoronix