From 38abb34b4ec67409d52c110f248ab2eb8a3273ce Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Wed, 23 Aug 2017 15:21:52 +0200
Subject: [PATCH] Framework: partially sync with upstream

Taken from: HardenedBSD
---
 GIDs               |  2 +-
 MOVED              |  5 ++++-
 Mk/Uses/gnustep.mk |  4 ++--
 Mk/Uses/objc.mk    | 16 +++++++++-------
 Mk/bsd.port.mk     | 14 ++++++++++++++
 UIDs               |  2 +-
 6 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/GIDs b/GIDs
index ea0f953cf8c..41e9ba7c0d5 100644
--- a/GIDs
+++ b/GIDs
@@ -712,7 +712,7 @@ bopm:*:717:
 # free: 768
 # free: 769
 postgres:*:770:
-# free: 771
+cockroach:*:771:
 # free: 772
 # free: 773
 # free: 774
diff --git a/MOVED b/MOVED
index 91e2b9b00da..b617ef471f5 100644
--- a/MOVED
+++ b/MOVED
@@ -9502,4 +9502,7 @@ devel/hs-syb-with-class-instances-text||2017-08-08|Upstream is unmaintained
 textproc/hs-citeproc-hs||2017-08-08|Upstream is unmaintained, use pandoc-citeproc instead
 sysutils/chvt||2017-08-10|Functionality available in base, using vidcontrol(1)
 graphics/rawtherapee-devel|graphics/rawtherapee|2017-08-12|Removed test release in favor of the newer stable release
-audio/py-jack|audio/py-py-jack|2017-08-20|Renamed to py-py-jack to match PyPI package name.
+audio/py-jack|audio/py-py-jack|2017-08-20|Renamed to py-py-jack to match PyPI package name
+lang/whitespace||2017-08-21|Has expired: Mastersite disappeared
+databases/sqlitebrowser-qt5|databases/sqlitebrowser|2017-08-22|sqlitebrowser now uses QT5
+misc/lr|misc/lazyread|2017-08-22|Renamed to reflect upstream name
diff --git a/Mk/Uses/gnustep.mk b/Mk/Uses/gnustep.mk
index 9749ac5cadc..225bf46b13b 100644
--- a/Mk/Uses/gnustep.mk
+++ b/Mk/Uses/gnustep.mk
@@ -63,12 +63,12 @@ LIB_DEPENDS+=	libgnustep-base.so:lang/gnustep-base
 
 .  if ${USE_GNUSTEP:Mbuild}
 PATH:=	${GNUSTEP_SYSTEM_TOOLS}:${GNUSTEP_LOCAL_TOOLS}:${PATH}
-MAKE_ENV+=	PATH="${PATH}" GNUSTEP_MAKEFILES="${GNUSTEP_MAKEFILES}" GNUSTEP_SYSTEM_ROOT="${GNUSTEP_SYSTEM_ROOT}"
+MAKE_ENV+=	PATH="${PATH}" GNUSTEP_MAKEFILES="${GNUSTEP_MAKEFILES}"
 # All GNUstep things installed from ports should be in the System domain.
 # Things installed from source can then freely live in the Local domain without
 # conflicts.
 MAKE_ENV+=	GNUSTEP_INSTALLATION_DOMAIN=SYSTEM
-CONFIGURE_ENV+=	PATH="${PATH}" GNUSTEP_MAKEFILES="${GNUSTEP_MAKEFILES}" GNUSTEP_SYSTEM_ROOT="${GNUSTEP_SYSTEM_ROOT}"
+CONFIGURE_ENV+=	PATH="${PATH}" GNUSTEP_MAKEFILES="${GNUSTEP_MAKEFILES}"
 BUILD_DEPENDS+=	gnustep-make>0:devel/gnustep-make
 .include "${USESDIR}/objc.mk"
 .  endif
diff --git a/Mk/Uses/objc.mk b/Mk/Uses/objc.mk
index c055378a63b..490e302a9e9 100644
--- a/Mk/Uses/objc.mk
+++ b/Mk/Uses/objc.mk
@@ -10,6 +10,8 @@
 .if !defined(_INCLUDE_USES_OBJC_MK)
 _INCLUDE_USES_OBJC_MK=	yes
 
+OBJC_CLANG_VERSION=40
+
 objc_ARGS?=
 .if !empty(objc_ARGS) && ! ${objc_ARGS:Mcompiler}
 IGNORE=	USES=objc only accepts no arguments or 'compiler'
@@ -39,17 +41,17 @@ ALT_COMPILER_TYPE=	clang
 ALT_COMPILER_TYPE=	gcc
 .endif
 
-# We do always need clang
-.if ${COMPILER_TYPE} != clang
-.if ${ALT_COMPILER_TYPE} == clang
+# We do always need clang and prefer a recent version
+.if (${COMPILER_TYPE} == clang && ${COMPILER_VERSION} < ${OBJC_CLANG_VERSION}) || ${COMPILER_TYPE} != clang
+.if ${ALT_COMPILER_TYPE} == clang && ${ALT_COMPILER_VERSION} >= ${OJBC_CLANG_VERSION}
 CC=	/usr/bin/clang
 CPP=	/usr/bin/clang-cpp
 CXX=	/usr/bin/clang++
 .else
-BUILD_DEPENDS+=	${LOCALBASE}/bin/clang34:lang/clang34
-CPP=	${LOCALBASE}/bin/clang-cpp34
-CC=	${LOCALBASE}/bin/clang34
-CXX=	${LOCALBASE}/bin/clang++34
+BUILD_DEPENDS+=	${LOCALBASE}/bin/clang${OBJC_CLANG_VERSION}:devel/llvm${OBJC_CLANG_VERSION}
+CPP=	${LOCALBASE}/bin/clang-cpp${OBJC_CLANG_VERSION}
+CC=	${LOCALBASE}/bin/clang${OBJC_CLANG_VERSION}
+CXX=	${LOCALBASE}/bin/clang++${OBJC_CLANG_VERSION}
 .endif
 .endif
 
diff --git a/Mk/bsd.port.mk b/Mk/bsd.port.mk
index ca1b21dcf77..24bbef8b240 100644
--- a/Mk/bsd.port.mk
+++ b/Mk/bsd.port.mk
@@ -1752,6 +1752,20 @@ PKG_DEPENDS+=	${LOCALBASE}/sbin/pkg:${PKG_ORIGIN}
 .include "${PORTSDIR}/Mk/bsd.gcc.mk"
 .endif
 
+_TEST_LD=/usr/bin/ld
+.if defined(LLD_UNSAFE) && ${_TEST_LD:tA} == "/usr/bin/ld.lld"
+LDFLAGS+=	-fuse-ld=bfd
+.  if !defined(USE_BINUTILS)
+.    if exists(/usr/bin/ld.bfd)
+LD=	/usr/bin/ld.bfd
+CONFIGURE_ENV+=	LD=${LD}
+MAKE_ENV+=	LD=${LD}
+.    else
+USE_BINUTILS=	yes
+.    endif
+.  endif
+.endif
+
 .if defined(USE_BINUTILS) && !defined(DISABLE_BINUTILS)
 BUILD_DEPENDS+=	${LOCALBASE}/bin/as:devel/binutils
 BINUTILS?=	ADDR2LINE AR AS CPPFILT GPROF LD NM OBJCOPY OBJDUMP RANLIB \
diff --git a/UIDs b/UIDs
index 19304927108..37b67bd8558 100644
--- a/UIDs
+++ b/UIDs
@@ -718,7 +718,7 @@ _dnscrypt-wrapper:*:718:65534::0:0:dnscrypt-wrapper user:/var/empty:/usr/sbin/no
 # free: 768
 # free: 769
 postgres:*:770:770::0:0:PostgreSQL Daemon:/var/db/postgres:/bin/sh
-# free: 771
+cockroach:*:771:771::0:0:CockroachDB Daemon:/var/db/cockroach:/usr/sbin/nologin
 # free: 772
 # free: 773
 # free: 774