chrony is a pair of programs which are used to maintain the accuracy of the
system clock on a computer; the two programs are called chronyd and chronyc.
chronyd is a daemon which runs in background on the system. It obtains
measurements via the network of the system clock's offset relative to time
servers on other systems and adjusts the system time accordingly. For
isolated systems, the user can periodically enter the correct time by hand
(using chronyc). In either case, chronyd determines the rate at which the
computer gains or loses time, and compensates for this. chronyd implements
the NTP protocol and can act as either a client or a server.
chronyc provides a user interface to chronyd for monitoring its performance
and configuring various settings. It can do so while running on the same
computer as the chronyd instance it is controlling or a different computer.
===> The following configuration options are available for chrony-4.9:
DOCS=on: Build and/or install documentation
EXAMPLES=on: Build and/or install examples
HTMLDOCS=off: Build HTML docs (IMPLIES DOCS, needs ruby, asciidoctor)
NTS=on: Support Network Time Security (NTS, uses GnuTLS & Nettle)
USER=on: Run as user/group chronyd (unset: user/group ntpd)
====> Support for secure hash functions
NETTLE=on: Nettle crypto library support for secure hash and NTS
NSS=off: NSS-based support for more hashing algorithms
===> Use 'make config' to modify these settings
net/chrony: dns/dnsmasq: change rcfile ordering
Make sure that these services start in proper order, and sooner
such that chrony can synchronize time before other services need it.
Note that there is a circular dependency or bootstrapping problem
here in that the system time needs to be halfway correct if you
require your time servers to be looked up through DNS with DNSSEC
enabled because crypto usually needs correct clocks for expiration
checks on signatures to work so the name service needs a correct time,
and looking up the time server needs a working name service.
So be sure you can bootstrap with a skewed time.
Reported by: Lexi Winter
PR: 282566
I am not MFHing this, it's too intrusive.
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
net/chrony: option to use system ntpd user/group
USER_DESC was reworded to make purpose clearer.
While here, shuffle things a bit to appease portclippy.
PR: 246293
Submitted by: olivier@
net/chrony: fix regression, remove pidfile= from rc.d script
chrony handles its own pidfile, and still our status method works,
so avoid missing chrony's own lock management.
PR: 245399
Reported by: Peter Putzer
net/chrony: make NETTLE build robust, improve rc script, re-enable NSS
Changes by Colin T.:
* Always require pkgconfig instead of only requiring it for NSS,
because otherwise chrony does not link reliably to nettle. [1]
* Add pidfile to rc.d script to stop it from complaining when
stopping chronyd. [1]
* Document chronyd_* options in rc.d script. [1]
Changes by Matthias Andree:
* Move USES line up to please portlint.
* Add HTMLDOCS option, to build and install HTML docs. IMPLIES DOCS.
Needs textproc/asciidoctor (rubygem) as build requisite.
* Turn CRYPTLIB into a _RADIO to choose at most one from NSS + NETTLE.
* Under WITH_DEBUG, add --enable-debug to CONFIGURE_ARGS.
* Remove @ (silent) from Makefile commands.
* Remove NSS_BROKEN, chrony 3.5 appears to work with NSS. Updates [3].
PR: 244534 [1]
PR: 242510 [2]
PR: 223840 [3]
Submitted by: Colin T. <bugzilla@nulldir.e4ward.com> [1]
Reported by: Matt Smith <freebsd@xtaz.uk> [2]
Approved by: maintainer timeout (yonas@fizk.net, 36 days)
net/chrony: Fix chrony running as server and using bindaddress
On FreeBSD, sendmsg() fails when IP_SENDSRCADDR specifies a source
address on a socket that is bound to the address. This prevents a server
configured with the bindaddress directive from responding to clients.
Add a new variable to check whether the server IPv4 socket is not bound
before setting the source address.
PR: 233644
Submitted by: Colin T <bugzilla@nulldir.e4ward.com>
Reported by: ddrinnon@cdor.net
Approved by: maintainer timeout (> 3 weeks)
Obtained
from: https://git.tuxfamily.org/chrony/chrony.git/commit/?id=6af39d63aa9323b4b8c39efe24ae0c88c949a901
Remove redundant DOCS, NLS, EXAMPLES, and IPV6 from OPTIONS_DEFAULT as they
are put there by the framework (see line 200 of Mk/bsd.options.mk), except
for `finance/quantlib' which makes very unorthodoxal usage of port options.
net/chrony: Update to 3.3
- Add explicit DOCS, EXAMPLES options
- Replace %%PREFIX%% in sample files
- Make sure chronyc is really linked with libedit from ports
- Add support for security/nettle and use it by default since chrony crashes
on startup when built with NSS. [1]
PR: 227779, 223840 [1]
Submitted by: takefu@airport.fm
Approved by: maintainer
Makes the NSS dependency explicit, and perform cleanup
Bump PORTREVISION
Before this patch if nss is installed when crony is built, there's a silent lib
dependency on nss, and if nss is subsequently uninstalled chrony breaks.
NSS is now turned on by default adding support for a number of more modern
hashing algorithms than md5.
Cleanup:
- --infodir is not a valid configure option (since 2.3 I think)
- USES=localbase instead of LDFLAGS
- add explicit --without-tomcrypt [1]
- add support for passing chronyd_flags to chronyd in rc.d script
- fix some hard-coded /usr/local in examples
PR: 217691
Submitted by: John Hein <z7dr6ut7gs@snkmail.com>
Approved by: Yonas Yanfa <yonas@fizk.net> (maintainer)
Update net/chrony: enable privilege separation and other minor changes.
- enables privilege separation
- removes the build dependency on asciidoctor
- removes the runtime dependency on makeinfo and readline
- add a runtime dependency on libedit
- do not install the HTML documentation (in favour of man pages)
- update the post-install message (pkg-message) in light of privilege separation
- set the permission of /var/db/chrony to the new "chronyd" user and group
PR: 216737
Submitted by: maintainer
Approved by: mat (mentor)
Differential Revision: https://reviews.freebsd.org/D9570
Do not use post-stage. Use post-install instead.
The only reason to use post-stage is because the port needs to do
"things" at a later time, like some plist manipulation.
While there, fold post-install in do-install targets when they are
defined.
PR: 214780
Submitted by: mat
Exp-run by: antoine
Sponsored by: Absolight
- Remove ONLY_FOR_ARCHS restriction as chronyd(8) runs fine on PowerPC now
- Remove no-op OPTIONS_DEFAULT=IPV6, which was bogusly re-added in r416385
by pi@ after it was previously removed by amdmi3@ in r416447
- Sanitize `post-stage' target recipe (still needs more work to decouple
extra docs and examples properly and add them to OPTIONS_DEFINE)
Tested on: Mac mini G4 (powerpc)
net/chrony: 2.2 -> 2.3
- submitter becomes maintainer after repeated maintainer timeouts
Enhancements
- Add support for NTP and command response rate limiting
- Add support for dropping root privileges on Mac OS X, FreeBSD, Solaris
- Add require and trust options for source selection
- Enable logchange by default (1 second threshold)
- Set RTC on Mac OS X with rtcsync directive
- Allow binding to NTP port after dropping root privileges on NetBSD
- Drop CAP_NET_BIND_SERVICE capability on Linux when NTP port is disabled
- Resolve names in separate process when seccomp filter is enabled
- Replace old records in client log when memory limit is reached
- Don't reveal local time and synchronisation state in client packets
(Only the first 15 lines of the commit message are shown above )
Update to upstream version 2.2; general cleanup
Detailed log by submitter:
- Update net/chrony to latest upstream version - 2.2
- install info
- point to /var/db instead of /var/lib (per hier(7))
- use doc/install-docs target; install more docs (PORTDOCS)
- use @sample to a sample .conf file (not for .keys which will require
manual intervention); others in examples dir (use PORTEXAMPLES)
- rm old post-install target
- fix example files for freebsd/prefix paths & ntp server names, add
info regarding how to do log rotation if logging turned on.
PR: 204817
Submitted by: z7dr6ut7gs@snkmail.com
Approved by: maintainer timeout
