Action Required: Recent ports history has been rewritten

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

BACKGROUND
=============
On 2026-07-20, a 150MB binary file was committed to the ports tree, causing
mirroring to GitHub and possibly other Git forges to fail due to a hard file
size limit of 100MB. Additionally, it is unclear if the licensing of the binary
permits redistribution in this fashion.

On 2026-07-21, core@ became aware that mirroring was broken and requested the
suspension of pushes to the ports repository while we assessed the situation.
Discussions over the following hours among members of gitadm@, clusteradm@,
portmgr@, and core@ resulted in a tentative plan to rewrite the repository
history to remove the offending file, with the agreed constraint that the
resulting state must be reproducible by third parties and must not impose an
unreasonable burden on downstream consumers of the ports tree.

The decision that the resulting state be reproducible by third parties arose
from our shared view that we should not demand implicit trust, and that we
should make it easy for our users and downstreams to reflect the same values.
While `git rebase` can easily remove the offending commits, it imposes a greater
audit burden on our community because it rewrites committer names and
timestamps.  It also affects the downstream communities which have forks of the
ports tree. Providing a mechanism to repeat this operation has potential impact
that extends far beyond our own community, and we appreciate your understanding
and patience as we worked to get this right.


ACTION REQUIRED
=================
Commit hashes in `main` for commits after a70c5c3fd44b have changed as a result,
which may impact your use of the ports tree.  For all consumers of the ports
tree, it is expected that the reproduction script linked below will correct the
state of your repository to match the new state of the authoritative repository,
but this is not the only option.

For committers and contributors: pending pull requests and local branches will
need to be rebased on top of the new history.  For example:

git rebase --onto f9c90a4f96f0700 0a717e9c118aa6

Where "0a717e9c118aa6" should be replaced with the _old_ upstream commit hash
upon which your branch is based.

Patch files should not be affected as the rewrite in question was isolated to
the misc/github-copilot-cli port.

For downstreams: running the reproduction script below is advised, particularly
if you have local commits in your tree.  The script will strip any cryptographic
signatures on existing commits after the binary file commit to achieve
reproducibility.  Note that the script has two commit hashes embedded in it that
will need to be changed if your branch has local changes included that may
invalidate those; instructions for the replacement are included in the comments.


TRANSPARENCY
==============
The script used to rewrite commit history has been made available for
independent verification and reproduction of the resulting state:

https://www.freebsd.org/news/2026-ports-freeze/ports-reset.sh
SHA256 (ports-reset.sh) = 9f954e7e229a1f3f0c452a98c433d70a0dbd265fc528bca6d082068d154536e8

This script should be run from within a checkout of the ports tree.  Note that
it does not attempt to purge the previous version of your branch entirely.
Recovery by grabbing the previous commit hash from `git reflog` is possible if
your local version of the branch does not have a remote to restore it from.  Git
garbage collection will eventually clean up the old branch in your repository.


NEXT STEPS
===========
Commit notes will be added both to the rewritten commits in main and to the
commits in that range which were backported to 2026Q3, noting the old and new
commit hashes in the least invasive way.  We view the bar for rewriting a
security update branch as significantly higher, and we have opted to accept that
five commits will have incorrect commit messages referring to invalid
cherry-pick commit hashes.

Server-side hooks are being implemented in all three repositories to prevent
future incidents of this particular nature.  The exact shape hasn't been
completely finalized, but the expectation is that there will be a hard upper
file size limit with some lower soft limits that will require a --push-option or
approval from portmgr/srcmgr/doceng.  Separate hooks will be considered to
confirm the licensing of binary artifacts being introduced into the repository.


CONCLUSION
===========
Huge thanks to everyone involved in incident response for all of the time put
into ensuring that we perform this operation in a way that is auditable,
reproducible, and with consideration for the massive impact both of the
repository freeze and the impending rewrite.  Rewriting commit history is not a
decision that was made lightly, but it was agreed that taking the time to do
this right was the least-bad option both for the project and for external ports
trees that may have their own modifications following the commits in question.

Special thanks to clusteradm@ for agreeing with the plan to rewrite history
while staring at the long list of cluster infrastructure that will need to be
fixed as a result.

The ports tree will be thawed for regular operations in the coming hours, but
infrastructure repairs will be conducted over the following week.  Cluster
package builds will not be restarted immediately, but will resume by 2026-07-26
at the latest.

Signed,

René Ladan (on behalf of portmgr@)
Kyle Evans (on behalf of core@)

A copy of this message is available independently for verification at:
https://people.freebsd.org/~kevans/core/ports-freeze-final.txt.asc
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCAA5FiEE3gJfirmYjuaWFv4NEBT7qDq7aZYFAmpjlXEbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwzAAoJEBAU+6g6u2mWwTQQAIXO8QzaG5CfjJF9oSM8
1DNCUZFB59ifV9L7Bw9/Iakm1Iyy/YG/tkCUX+ZxePRkwrV567YsrFt3uAd4l8sR
vJjm0JHkJK6PqnftO6+inz5w0vV+t1SILO/Rn3SHKBvVYzSHb4uLQARPONeR1lP/
y0i3Np79tf1YTlfSPLVYvF8cj+SRoRm4HWQvt+TmkWYAbxtJ6bfRaoScHDOXWVDd
3BShIA7BxS4VjZYZ+dh/D9FNIq1aUqkkqKBaNsMyDkdK1IiI0JHE+6U5lulQ5zDH
4kDFZYiY5RA8n9/1fHdIUMNMavnb0CG78XS8SA0MRm3bgK7tpA6j9h1bxzTnkkNc
fPpi5tBwVtEmeY2jZRiZ7wyKP8DO5IqXTTu0uq7McF7jhYsHiHzthyYmUSicPzOE
0cbu6eHGq/OjalVaurg7R1CQ/8nsuJ0ICTHCMGlv71Ur2WzvNWmayTcd9Hy5LRu4
zatEQyrDLXk2QwtQ30k0Q6OI3tiscxQGDUG77d937pe7qYQPBjC5o0kZ4eYC8sMQ
4s0JFwnYuVruiLJZyfze4Y7yMGMcyW+DRxXkyPhCHh9B8s8ZUr9mdfvXywGkCnsl
/eb8//5G7dWbxoN7E1/BCIulrp2rXi4kQMJDHmcvvix8u1qZfIj/ZAEgteyjENyC
Co6NjrVjaupebUdc1GD0EgbV
=wsye
-----END PGP SIGNATURE-----