From 02870305bc58ecb26380456dde3e45eb4569fde6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Gruszczy=C5=84ski?=
 <mateusz.gruszczynski@firma.interia.pl>
Date: Wed, 7 Oct 2026 10:07:46 +0200
Subject: [PATCH] opn

---
 Dockerfile                                    |   2 +-
 README.md                                     |   4 +++
 .../generate-opnsense-repo.cpython-313.pyc    | Bin 0 -> 8144 bytes
 scripts/apply-freebsd-patches.sh              |  25 +++++++++++++-----
 4 files changed, 23 insertions(+), 8 deletions(-)
 create mode 100644 scripts/__pycache__/generate-opnsense-repo.cpython-313.pyc

diff --git a/Dockerfile b/Dockerfile
index 964aca0..17fb89c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,7 +30,7 @@ ARG APTLY_ZIP_SHA256=535ed24eb706bc25a316b59d709a7e74e10165f2ffab8552097ba7e4816
 RUN dnf -y install --allowerasing \
   bash binutils ca-certificates clang cmake coreutils createrepo_c curl file findutils \
   gcc gcc-c++ git gnupg2 gzip libarchive lld llvm make openssl pkgconf-pkg-config \
-  python3 python3.11 rpm rsync shadow-utils sqlite-devel tar unzip xz bzip2 zstd bsdtar \
+  python3 python3.11 rpm rsync shadow-utils sqlite-devel tar unzip xz bzip2 zstd \
   && dnf clean all \
   && rm -rf /var/cache/dnf
 
diff --git a/README.md b/README.md
index 1205c3d..cef34f8 100644
--- a/README.md
+++ b/README.md
@@ -202,3 +202,7 @@ data/state/last_opnsense_commit
 ```
 
 Jeżeli istnieje starsze `last_commit` oraz poprawne APT/RPM dla tego SHA, zostanie ono potraktowane jako stan gałęzi Linux. Brak repo OPNsense uruchomi wyłącznie gałąź OPNsense. Po udanym OPNsense kolejny cykl nie będzie ponownie kompilował FreeBSD, nawet jeśli testy Linux nadal nie przechodzą.
+
+## FreeBSD patch version detection
+
+The OPNsense branch reuses the Cargo package `VERSION` already detected by the main build pipeline. If `apply-freebsd-patches.sh` is run manually, it falls back to `RUST_PROXY_PYTHON` (`/usr/bin/python3.11`) so Rocky Linux 9's default Python 3.9 does not cause a missing `tomllib` error.
diff --git a/scripts/__pycache__/generate-opnsense-repo.cpython-313.pyc b/scripts/__pycache__/generate-opnsense-repo.cpython-313.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..0f8074127f59f6804283755dfc9b5276932efdd4
GIT binary patch
literal 8144
zcmai3T~HfWmcFfSNv%I5koXghErT&uY_J`JJqF@2#>T&37mYGh;Y2H>1{8#(y)8Mm
zvb!NOwH5HB20U4><s?-mHK`5RnuqMmu3u-SwknTO<OEHJ+4Af><!R-`Ri5#_>^WEJ
z7GN^D(D&ZH|9$T{-}&y*hQnbc5FY=}f4&*4CFD=|q6JeWvtj25xl1G>ahC}#ryS+j
zyMY>5%2S@D0u@+lq(+vSsEMU!YKGKsS-fPS79WnmU$$PdQ5)n1$#~R2?UG3{L+X&k
z>o&=9y{21`tX}e_K%J6}mAIh9&Pr-4ZR()J!Ajgx&2?M1L2|M;kL0>u4`X0`Eh}k|
z>R=4_^%}`@y|LRQ)w9wj?1gQiT>~p=mKwc;dat)gO}*oUghWEFds|6QWh;DSnw#eQ
z&EMhsh@Vq!5qT<<j-?{ea0*_9YoXN4b1@Q1g}Rcn)6bpBP<S>pEi2KKj0G8MER>R!
z6w5azlunvfQc0S)d8@Npp$bVDMKw`5m8S79Y`z}wNO*WQ>Y(%u{w|r&t40laR?k!y
z9_IpN)TmeJ8HwwujBg-w{DfJn2=LvUWPmLZCBCOJvYTA+5E3^8xKWGNu9^l6+DJY!
z+(3wpuw#a!*82Mh^t4rbXgO_j_mREi5IImOj=;L63_h|4#`)o%ukw4y6z3O4R0Ew1
zYa?Td+vSF5V?RWvxVvPGjKa{{Lv<te5x-$1N{EZ#fl@gXfs~t4u+zM{R|(T-GNl}z
zmg6#o!|Y5X<BAObom5UHx{|k4u|F1?n~a1`sZGjE=#`%1UH!2{I22P(L8e>-`$&`;
zi2giJR`!0j|C9ZzEst7zHgHuG^pN;Xs(B`)%*3LTs;NARDkPF}Topi+sA@_lLC9p)
zG9%xNL_xq(eu3iYsoace49}$Fv(y2viU5(%=Q~YtHi{d;BAi2+ga{U}E;^TLZr2pV
zrul)Q#j(`9*u32R{+{f>dVTXFZ_gLXH}!oB=Zbd6(uKtf%Yk29eZrH5{%1U~HkV8U
ziu)G(e*S7sXnJObqWAY~Eqt!vk+1p({QPhH)-xuv%7Y?ok!nz~vQ)=lj{#^nkhFUs
zY1|J<w`7p`30<lKM3cY(cUaieR|7JbMhly2arSKiA?c(5l5QAf@VK>FG9ffXKr4m=
zgg_hn)_Q!?r5Iby5Hf+=&%&rn%T?3X?-^wj&ud$d%-UCKsRCNEkLlY)z1A4C9dvMe
zs3DSgOxIJH^IJyzhD`0j!K=g91_sB1!viB1ht5f38OuQ}tC}X2NGe1#Lg&q^Q$v0p
z#4!~~q*E-FDMe|M!?P4Y;<+)Mn(F*frlZ$47gdyKeA@TI*uKL)eQ>{BwJPaJ0Kl-U
zC@N3Wag|q66maz7wR5WZ?77!Q0#~l6)(R9RA~Jmm=23+=l|)=M#uA~3qM9Od7;04e
zXgZ#X&dKK}O~4TG(46e&sTbRu=H$6aP#Z3(ARd51Fnv%RsNTW3P&_&XDnz@Wt{EO>
z0it>GZC&?*Y2DtiG;({S=%`=5@v*XU?4z5j4LSRfb@xm6ethT0kgU1e^X~RyUE>pr
z(P3TSN_NzV{>A?6(XVa0R%$<M`mE`brgeAYz20B;W<w8V?$10(+)u1d7j_>nxKDg#
zKk=lNxO<+~5nE%n?ZJWj2eRH=+ofFN<%0D}PPoGGV2i%sC*ZRoFnxiu-T}}wRDG4x
zWHIz6d^v&EcvRbh#PwbvWK-L*N?XK_ZDB&!r#_f>Q=i_y(nr(=+1AJR{e5<_6_PH!
z+E*O}+4u7!8G+eUu`4x~#2f->R0&Q+V=_o;dTJ_qlOBXMsE)ybv4JaB&j*JtUO6YJ
z_A3KpAo0PGfnj(P<#<GSE1H_|a|}%x=vQQ=28K(9ZlTNtVFHR9j5b9HK{QVui}oe^
zqW$MJ&xl|-T(rBEE-zlr9?#qNKI5U_F%(=}y!i3!dHc)Hj8Fh5>8NEz*YkG&Gcy*6
zq_+N^<&I^|)tYy;uJjgMU61TtC7a1;Vp4$SD4EzI3y6M97S6(1+$Dz*H6d3HaMoD2
zEmTdNh9H2q@1SMhgrzU+Gs8Q;mrWc&ZxiPM1$W{EIwJ3MmYReHc*)QKYlJb-WNiyt
zt5F?6s|}zhk3A>QoUu@4Ay6l<QMsK^biA!wUp?@ZcguVwz=13oM>58jQH09&)C@T#
znvnsR(sO<*2vdTl<cMmd)3L-PlLCets*TFP;i5O>U@D=CArO{?61}MkN-C66%}OeW
zqcG#EnnFo1<q<I1$6?i~sIkQIjG~4|n(?j(pevk+#pG}bq_9jX=^*qz0*~?wh~`Pr
zSv!AW-PN$1x|g|=S?MS=zWj~r;DWI3d?_1QbGGH3ZNImB*4@4pPr<!^K`gfHS!+3%
zZ#lSnw$O5Pt)(~L(pzZhUl5lY@?ukQck6@b{pd%tYrBu;cOQk)=DgUl?uFhT9fG&|
zMQ2fTEjbsRSx>I%z&E1*iIdbGD!GW=Gk>)#uNDAq89+G^4{rt?Bq~g3KV(81-~fIA
zJVNj`ZK#Uxgx*IJR4~av<}M5nl7_lucYq(=0iXiHD9*4gNIbOGVW?WE(bH~2+&JEj
z`m~d<j(2Yn7}$A6a1C+OUl&_g?NE8OY{fU@mVjl{S)E<WNrIP1M#*&2;3MOABqHE<
zwpYHhcQ=8x>q4&eA)D?ck}+<Y(CLC?4)8VPm;pu<al~QJ1YGYhfIOxF6O!!-q@gUB
zNeK24$@XwR&~8$p)0Pot)`u8!Zh;*<8Jukcngi?vfV8ol<JfRpB3*&?)2voAuFdA~
z8|W!0S8bpub7;kbaRvD|u-&;$C`@td)HXRjm7rlcsEgN&6dS&jDENWEup_HSKbih4
z_DSql@wNS@zuJGAN#~f~pz^cwE!9lr8!}boOxwg3GXJ_yAHNr}bBP;r#P>O;8mD4u
zWyWu#D8s4{iz>i|k|7F`uJY4z3Uywdqo=Xf$UXo{05yQM$79j>tZGcsD738|0_!xA
zNDU>@@d#rrFy;XCqGz$IX__X|Nriy|J%h!Uuoza$R-&2#2-uv)AaWhm4D-{dtf&^9
z(J<}}Y)1=a)>He!_R-g2<X7QQ3J?L3m|e>QKl_KG)3feq`q)!&?4BR`*4w&RvmiWn
zx|iNwd^>yL!Ik@0RvW(X{73V@H5YdE<!bsD_@Y>|Xj>D#dC{9an`=4vjd<vZnY6T(
zti<V=KVNJ=_}TSOuK&v$d2ufw%tB+fqX?G|Fq`@2(_ijeu;<0A#Xb91GKD>_EM8qW
zTQV3O^+lKGp6!n9pBzQ+?q&13t3KD%_wek)<GF@2U+#P4y1HQ@zGF{}WPf+5j@aGv
zBY%EsB%byS!a3?ym#4%-`dq1l@A|EK&zXMVxBb>ZtNC{p4q}y$z}eZ#?69(n6&oMM
z!_|TgSdT!!QQUW8T;Ip6I$;zY!1xJJv~n2Ld6ZT{2;2m~8g6Q{17Jz~N!~!>!lqU`
z+)`j9{cayOPUx0(lZ7<KbeNQcfH9`eRRxkNM2zZSv3a$ca%<lQqv$t$fMF!l+d{xN
zfs~wu(Op`un&MqZ8%=}e7d;6RyR{ypJ}p;GTgmv5YTs${{eFd!_6pR2)fbREs@z)u
zJ0^gaIWXp*!g2d+RSQx=CLU!DX@(0CGE0hkqFS#Fj0cCVjt&ousphc|y$Il>@-e)t
zGvXl3;q8P+jTaEvR3ig8)f|dM7(X>c6RP>lEpQB7ys8=!3aWTA77ELL6MX|_ph1lO
z2It~&iH6h^03*zzpahk5yR6wj9cF=lgebiMH4;3^KSKlxZFMYlE_P=52jYEk<#@iy
zU$DMBKe%pjE$zC!YdM@f_UT(|9Vhc0C%>}vKAc>4HY~k!`<?9D1t;<cPh-~n!IcH!
zeM`~PjLCXEpu&UZ51T(~Db%+^iM1$Nm#mA{<?fH`9(X_WuADD4A9^HqKC=;P-%~p=
zn%}$h(@P7=*We{^K+)Hh-scL+<Zt+a6NAnC@0zWH9p)`00ly7(aHGg{u1X84_k3Wi
zx|WXb)lU2Xbixn<N!+<tz~CmY@vjLAf0!tczW{o`%yV}@xMmmzCW}TgZjAGBLE?7w
zn}KgEV07ySSd&;V!n#)PL^fK1p&y2x65j><lo@<}C%RF+<;TsNbQkXLo$ytXC1C2Q
ze7TQoskgFvTfkhcm+Wy7473AlzK?zcM9D1GAXS*q{S%{zncD(r*0SWpk+j{09`#xy
z$u-fa<pV}-Pr&O?dyJRrBsY#f4Lj~53hZp0pCW$G2(!go$OWR(F?cp8L~U>qh`4Y{
z0Hi<c69O^`WJEHY<aazbUR#wUATHk^ca1=c4wp}S+IWHoFQVylgUTIJx!xhjSQQz}
zY$%nWifRWxUz*CnkP?nYsSlS3vPrBX;AiN7jB1Re=aS%&kmKl)0DfWUI-+uO3Q`}<
z=V0ka*Wt}1J*9f7JeiKhBAeKYRu_RD3Zm<GpuHu+x0wFB*1It9lqcY!v);BYA6@Z2
zY|o3Q*TnOA@%)$Of_N<_jejGKtF_+0u$#kAdrok$u%F<<Trgpj%5Zbl?hXS`Om9In
zME?%6K8#RyGcK(SI<0So=3*47ohqPLJM-_zlz`9o`i}Nlu^~8lf@QSq^|b=>wDwu`
z`wNt8A8T`UFhs*MaADfo3|in!P>4z8ZBx@qDIzDj)uA2BLPM=+Q)8_v<Cv4dCm&A4
zrx4`<;^C?fX9TOySoEq)^NR!!4=B~^%h-ICPdT9Y$LJN<5x<>Xz!-M|k5nQWXF@>d
zp^m<b5rVL4eT%{}gDLrDivBH@qEyoWMl%rkt?UxWC?6w#Di>sIPqpa#sM<DdBYh8g
zsRAyVDv(vs_?L|U#$`hQ7KBL_U4lxqA<F+j1ioJ9o)w|sY=?WIxhdPUX70?JJJ;Q9
zD`yLC|AP3(&YnlE<NrE-e>NNXpy~7R`HOki@nT*5y#sd+JV7D+W36|?2<Zml-KP1=
zPelTLjo#b6MR)z`D-TcR#dAgXOT~Kc6SH79Jrjx9@$S^ZPkxptS%}escEGVPmh-gd
z9qqY}lMnkI3Fp@Z`@-1rrMzSJifL7NBy^TcW=ltjhxR28u{oFb<gLE>!J=S(Z{*#P
z<?fY^`H{Tv^15IuTa;{H-n0La(6KI9a`yI5!>j&Z#dGaFUrgkz17CUy!pL7XPLSFY
z3d-=WYX<k5!jRDeLJbekh7T0^hks6Cz{16m0OEMt0yv{}@MkV$p1Iq0YH6C#$rb>w
zC|OPltStcR_MlNL_z8#G$<@5mZBp-pF6<rdjgl4qYz*$*+I-`CccOSzn4boLAITg(
zgMj4=`OvKq4f}?uET56i`oK#9S0r?K08-xag+X;=iRrWqng+j-m47q=*kH1rac*i!
z6NwZ6rI5OnlvQCyjwLg;PWUaQ;y3sXr8{%9f;x(CR!*jTNttTeczEE<#XjE=UnHu8
zCIJzANpK>ARs-<;5_+oU$`5q(19-z5pSgT#QUCyM!o@9^nDyJhT|=j#T#?n90Xm(Y
zgPYVfe5I-#NE+Ztxr_=h2%W`o0sEjHYm~AR2Q*Ge#BLzFn~g*%Q#_{B=rU)G!6&UZ
z-|B`I=0X4-D=;p?hVu6ifvP&{*Btx4a_q|;oy<GJ^Fu|!x+XN{g~qJu)3Mx<fgHY^
zsg^o^J@~LLcP7osZxn5{Yqni^+pdCb_x#z%Hs{jG#gm&#ih}swrFSnar&c2Km-52F
zb-}i9_FmVWuCIl?%p|K~5blxDcrfVSMYFIZihO`3FhXNj2D81GlQD`xq}nPzDmZGT
zd_9K!PT|j3<-L0aTOPxx4I>mjFf8!nY1xM+OePYsvQKRg>v5~g_-dR)e#{WHytOOX
z6_$us-(c|b^3P@!7TgbvI~|ix(a)g~C^k|43nI7)a@?PY^IKB$EwOw{Y%H#2ueLvs
zwm*=j$F(iFm%4JU!}E@!YgcafiJbFC^Y)U-$Tcr}N(7Q@+fz(RE-N?8EvHHZ(-q+<
zOG{oeXUalDNLKbe#iZo1a-M8A)_Y1`H|JhGRw9sm0Y#9M4v8@Iz7m0CMPkVpJx}qi
q)ZpW;a#)4w%CV;`{of%@<XTG&1W+?m;G2Ihi2pbQU@3Unnf*Vi5Qh2y

literal 0
HcmV?d00001

diff --git a/scripts/apply-freebsd-patches.sh b/scripts/apply-freebsd-patches.sh
index 4c025e4..3fb1518 100755
--- a/scripts/apply-freebsd-patches.sh
+++ b/scripts/apply-freebsd-patches.sh
@@ -7,17 +7,28 @@ PATCH_ROOT=/opt/rust-package-builder/opnsense/patches
 
 [[ -f "$SOURCE_DIR/Cargo.toml" ]] || fatal "missing Cargo.toml in FreeBSD build source: $SOURCE_DIR"
 
-VERSION=$(python3 - "$SOURCE_DIR/Cargo.toml" <<'PY'
-import sys, tomllib
+# build-release.sh already resolves the Cargo package version and exports VERSION.
+# Reuse it here so the FreeBSD branch does not need to parse Cargo.toml again.
+SOURCE_VERSION=${VERSION:-}
+if [[ -z "$SOURCE_VERSION" ]]; then
+    # Fallback for standalone/manual use of this helper. Rocky Linux 9 exposes
+    # python3 as Python 3.9, while tomllib is part of the stdlib from Python 3.11.
+    PYTHON_BIN=${RUST_PROXY_PYTHON:-/usr/bin/python3.11}
+    [[ -x "$PYTHON_BIN" ]] || fatal "Python 3.11 not found: $PYTHON_BIN"
+    SOURCE_VERSION=$("$PYTHON_BIN" - "$SOURCE_DIR/Cargo.toml" <<'PY'
+import sys
+import tomllib
 from pathlib import Path
 with Path(sys.argv[1]).open('rb') as f:
     print(tomllib.load(f)['package']['version'])
 PY
-)
+    )
+fi
 
-PATCH_DIR="$PATCH_ROOT/$VERSION"
+[[ -n "$SOURCE_VERSION" ]] || fatal "cannot determine RustProxy version for FreeBSD patch selection"
+PATCH_DIR="$PATCH_ROOT/$SOURCE_VERSION"
 if [[ ! -d "$PATCH_DIR" ]]; then
-    log "no FreeBSD/OPNsense patch set for RustProxy $VERSION; using upstream source"
+    log "no FreeBSD/OPNsense patch set for RustProxy $SOURCE_VERSION; using upstream source"
     exit 0
 fi
 
@@ -25,7 +36,7 @@ shopt -s nullglob
 patches=("$PATCH_DIR"/*.patch)
 (( ${#patches[@]} > 0 )) || fatal "FreeBSD patch directory is empty: $PATCH_DIR"
 
-log "applying FreeBSD/OPNsense patches for RustProxy $VERSION"
+log "applying FreeBSD/OPNsense patches for RustProxy $SOURCE_VERSION"
 for patch_file in "${patches[@]}"; do
     patch_name=$(basename "$patch_file")
     if git -C "$SOURCE_DIR" apply --check "$patch_file" 2>/dev/null; then
@@ -34,6 +45,6 @@ for patch_file in "${patches[@]}"; do
     elif git -C "$SOURCE_DIR" apply --reverse --check "$patch_file" 2>/dev/null; then
         log "patch already present: $patch_name"
     else
-        fatal "patch does not apply cleanly: $patch_name (RustProxy $VERSION)"
+        fatal "patch does not apply cleanly: $patch_name (RustProxy $SOURCE_VERSION)"
     fi
 done