virtualbox-ose 7.2.8

Sponsored by:	UNIS Labs
MFH:		2026Q2

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2
https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixOVIR

Security:	CVE-2026-35242
Security:	CVE-2026-35246
Security:	CVE-2026-35251
Security:	CVE-2026-35230
Security:	CVE-2026-35245
Security:	CVE-2026-35247
Security:	CVE-2026-35248
Security:	CVE-2026-35249
Security:	CVE-2026-35250
Sponsored by:	UNIS Labs
MFH:		2026Q2

PR:		294588
Reported by:	ykla <yklaxds@gmail.com>
Approved by:	vbox@ (vvd@)
Approved by:	db@, yuri@ (Mentors, implicit)
MFH:	 	2026Q2

- Replace ${PREFIX}/share/applications with ${DESKTOPDIR}.
- Replace "*" with . in COPYTREE_SHARE.

Install files required by Unattended Installation of Guest OS feature.
These files were already prepared during the ports' build, so just add
them to the installation.

Details about this feature are here:
https://www.virtualbox.org/manual/topics/create-vm.html#tk_create-vm-unattended-install

Reported by:	xin3qu via IRC (#freebsd-vbox @ Libera.Chat)

Thes is ~430-640 files, ~30-55MB total for different platforms.
We are using devel/kBuild for build VirtualBox ports.
devel/kBuild is a newer version than the one included in the VirtualBox
tarballs.

out/freebsd.amd64/release/obj/webservice/soapC-7.cpp:5:32: error: use of undeclared identifier 'soap_codes_vbox__PartitionType'
    5 |         const char *s = soap_code_str(soap_codes_vbox__PartitionType, (long)n);
      |                                       ^
out/freebsd.amd64/release/obj/webservice/soapC-7.cpp:23:18: error: use of undeclared identifier 'soap_codes_vbox__PartitionType'
   23 |         map = soap_code(soap_codes_vbox__PartitionType, s);
      |                         ^
2 errors generated.

PR:		292890
Reported by:	pkg-fallout

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2#v6

emulators/virtualbox-ose{,-nox11}-72:
Remove the OGG, VORBIS, and VPX options - without libogg and libvorbis
in the system, the ports attempts to use the bundled versions, but
without libvpx, the build fails. Even when using libvpx, building the
bundled libvorbis library also fails.
These 3 libraries are not heavy dependencies, so we simply make them
mandatory even for emulators/virtualbox-ose-nox11-72.

PR:		292801
Tested by:	jwb
Security:	CVE-2026-21955
Security:	CVE-2026-21956
Security:	CVE-2026-21987
Security:	CVE-2026-21988
Security:	CVE-2026-21990
Security:	CVE-2026-21989
Security:	CVE-2026-21957
Security:	CVE-2026-21983
Security:	CVE-2026-21984
Security:	CVE-2026-21982
Security:	CVE-2026-21986
Security:	CVE-2026-21963
Security:	CVE-2026-21985
Security:	CVE-2026-21981
MFH:		2026Q1

Changes:	https://chromium.googlesource.com/webm/libvpx/+log/v1.15.2..v1.16.0
Reported by:	Repology

Remove build dependency for Qt when NLS and graphical frontend is not
required.

PR:		291023
Co-authored-by:	takahiro.kurosawa@gmail.com
MFH:		2025Q4

Upstream issue:
https://github.com/VirtualBox/virtualbox/issues/403
Upstream commit:
https://github.com/VirtualBox/virtualbox/commit/3cf64726847e2483c9539ca51c88862a0f1c7414

PR:	291128
MFH:	2025Q4

Ports need more thorough testing at runtime.

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

PR:		289019
Relnotes:	yes

Fix description for option vboxinit_start_delay.

MFH:	2025Q4

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

Fixed 9 CVEs:
https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixOVIR

Security:	CVE-2025-62587
Security:	CVE-2025-62588
Security:	CVE-2025-62589
Security:	CVE-2025-62641
Security:	CVE-2025-62590
Security:	CVE-2025-61760
Security:	CVE-2025-61759
Security:	CVE-2025-62591
Security:	CVE-2025-62592
MFH:		2025Q4

/wrkdirs/usr/ports/emulators/virtualbox-ose-additions/work/VirtualBox-6.1.50/src/VBox/Additions/freebsd/vboxvfs/vboxvfs_vnops.c:1271:9: error: use of undeclared identifier 'NULLVP'
 1271 |         *vpp = NULLVP;
      |                ^
/wrkdirs/usr/ports/emulators/virtualbox-ose-additions/work/VirtualBox-6.1.50/src/VBox/Additions/freebsd/vboxvfs/vboxvfs_vnops.c:1281:3: error: call to undeclared function 'VREF'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
 1281 |                 VREF(dvp);
      |                 ^

Commits that broke the build:
https://cgit.freebsd.org/src/commit/sys/sys/vnode.h?id=7e4c451c12aeb26cc1179221b8230c491b17cf00
https://cgit.freebsd.org/src/commit/sys/sys/vnode.h?id=01c8e2e33df81b242d73a23de49a6b61f33c24c1

PR:		289992
Reported by:	pkg-fallout
MFH:		2025Q4

Fix: "Failed to attach to TPM driver. rc=VERR_PDM_DRIVER_NOT_FOUND"

PR:	289922
MFH:	2025Q4

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

PR:		289019
Tested by:	Mario Lobo <lobo@bsd.com.br>
Tested by:	Vladimir Druzenko <vvd@FreeBSD.org>
MFH:		2025Q3

kBuild: Compiling VBoxRT - /wrkdirs/usr/ports/emulators/virtualbox-ose-72/work/VirtualBox-7.2.0/src/VBox/Runtime/generic/http-curl.cpp
/wrkdirs/usr/ports/emulators/virtualbox-ose-72/work/VirtualBox-7.2.0/src/VBox/Runtime/generic/http-curl.cpp:702:27: error: assigning to 'curl_proxytype' from incompatible type 'long'
  702 |     pThis->enmProxyType = CURLPROXY_HTTP;
      |                           ^~~~~~~~~~~~~~
/usr/local/include/curl/curl.h:791:35: note: expanded from macro 'CURLPROXY_HTTP'
  791 | #define CURLPROXY_HTTP            0L /* added in 7.10, new in 7.19.4 default is
      |                                   ^~

Upstream bug report:
https://github.com/curl/curl/issues/18054#issuecomment-3354156324

PR:	289924

Port based on patch from Stas Timokhin <devel@stasyan.com>.
The main work on porting was done by the author of the original patch.
The rest is a several various improvements and bug fixes that have been
made over the past few months in older versions and one upstream
regression: https://github.com/VirtualBox/virtualbox/issues/135

The requirements for 7.2.x are the same as for 7.1.x, but for now we'll
leave both versions: 7.2.x in experimental/test mode and 7.1.x - stable.

Upstream ported on aarch64, but for now we keep ONLY_FOR_ARCHS=amd64.
If you interested in porting it on aarch64 - create PR with patch.

The following ports also need to be created (they are not available for
versions 7.0.x and 7.1.x either):
 - emulators/virtualbox-ose-additions-72;
 - emulators/virtualbox-ose-additions-nox11-72.

www/phpvirtualbox-72 already in ports.

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

While here refresh patches.

PR:		289019
Relnotes:	Add VirtualBox 7.2.0
Co-authored-by:	Stas Timokhin <devel@stasyan.com>
Co-authored-by:	Mario Lobo <lobo@bsd.com.br>

PR:	289019