fixes

builder/debian/build-docker-release.sh

@@ -41,7 +41,7 @@ if [[ "$RUN_LINUX_TESTS" == "1" ]]; then
 fi
 
 echo "Cross-compiling RustProxy for x86_64-unknown-freebsd..."
-docker run "${run_args[@]}" "$DOCKER_IMAGE" bash -lc '
+docker run "${run_args[@]}" "$DOCKER_IMAGE" bash -c '
     set -euo pipefail
     cargo build --locked --release --target x86_64-unknown-freebsd
     install -m 0555 /target/x86_64-unknown-freebsd/release/rust-proxy /out/rust-proxy

builder/debian/package-freebsd.sh

@@ -89,7 +89,7 @@ common = {
     "version": version,
     "origin": "opnsense/os-rustproxy",
     "comment": "RustProxy reverse proxy service",
-    "desc": "RustProxy packaged as an OPNsense plugin. The initial UI exposes Enabled/Disabled only.",
+    "desc": "RustProxy packaged as an OPNsense plugin with configurable HTTP, HTTPS/TLS and administration listeners.",
     "maintainer": "local@localhost",
     "www": "https://git.linuxiarz.pl/gru/RustProxy",
     "prefix": "/usr/local",
@@ -120,11 +120,67 @@ manifest["scripts"] = {
 PY
 
 archive="$work/os-rustproxy.tar"
-rm -f "$archive" "$package_file"
+payload_list="$work/payload.list"
+rm -f "$archive" "$package_file" "$payload_list"
+
+# FreeBSD pkg expects payload paths to match +MANIFEST exactly.  The manifest
+# uses absolute paths (/usr/local/...), so the tar members must also be
+# absolute.  Do not archive directory entries: pkg creates parent directories
+# while extracting files, and an undeclared directory entry makes pkg add fail.
+(
+    cd "$stage"
+    find . \( -type f -o -type l \) -print \
+        | LC_ALL=C sort \
+        | sed 's#^\./##' > "$payload_list"
+)
+
+[[ -s "$payload_list" ]] || { echo "Package payload is empty" >&2; exit 1; }
+
 tar --format=ustar --owner=0 --group=0 --numeric-owner \
     -cf "$archive" -C "$meta" +COMPACT_MANIFEST +MANIFEST
-tar --format=ustar --owner=0 --group=0 --numeric-owner \
-    -rf "$archive" -C "$stage" usr
+tar -P --format=ustar --owner=0 --group=0 --numeric-owner --no-recursion \
+    --transform='s,^,/,S' \
+    -rf "$archive" -C "$stage" -T "$payload_list"
+
+# Validate the raw package archive before compression.  This catches the exact
+# class of errors that pkg(8) reports as "not specified in the manifest".
+python3 - "$archive" "$meta/+MANIFEST" <<'PYVERIFY'
+import json
+from pathlib import Path
+import sys
+import tarfile
+
+archive = Path(sys.argv[1])
+manifest = json.loads(Path(sys.argv[2]).read_text(encoding="utf-8"))
+expected = set(manifest.get("files", {}))
+
+with tarfile.open(archive, "r:") as tf:
+    members = tf.getmembers()
+
+if [m.name for m in members[:2]] != ["+COMPACT_MANIFEST", "+MANIFEST"]:
+    raise SystemExit("Package metadata must be the first two tar members")
+
+payload = members[2:]
+directories = [m.name for m in payload if m.isdir()]
+if directories:
+    raise SystemExit(f"Directory entries are not allowed in payload: {directories[:5]}")
+
+actual = {m.name for m in payload if m.isfile() or m.issym() or m.islnk()}
+relative = sorted(name for name in actual if not name.startswith("/"))
+if relative:
+    raise SystemExit(f"Payload contains non-absolute paths: {relative[:5]}")
+
+missing = sorted(expected - actual)
+extra = sorted(actual - expected)
+if missing or extra:
+    raise SystemExit(
+        "Package payload does not match +MANIFEST; "
+        f"missing={missing[:5]} extra={extra[:5]}"
+    )
+
+print(f"Verified package payload: {len(actual)} files, manifest paths match")
+PYVERIFY
+
 zstd -q -f -19 -T0 "$archive" -o "$package_file"
 
 # Convenience stable path for direct deployment.