FreeBSD ports frozen after someone commits the entire 150MB Linux Copilot binary

FreeBSD ports 仓库因有人提交了 150MB 的 Linux Copilot 二进制文件而被冻结

A rather unusual announcement was made late last night: the FreeBSD project has frozen their ports repository. For more than 48 hours now, no changes have been accepted or made to the tree, and here’s why. 昨晚深夜，FreeBSD 项目发布了一则不同寻常的公告：他们已冻结了 ports 仓库。在过去 48 小时内，该代码树未接受或进行任何更改，原因如下。

A 150MB binary file was recently committed to the ports tree and, as a result, core@ made the decision to implement a temporary freeze of the ports tree in order to implement some clean up efforts. The commit in question severed our ports tree mirroring to github.com due to their filesize hard limit of 100MB, and introduced a blob of questionable licensing into the repository history. ↫ Kyle Evans in freebsd-announce 最近，一个 150MB 的二进制文件被提交到了 ports 树中。因此，core@ 团队决定对 ports 树实施临时冻结，以便进行清理工作。由于 GitHub 对文件大小有 100MB 的硬性限制，此次提交导致 FreeBSD 的 ports 树与 GitHub 的镜像同步中断，并向仓库历史中引入了一个授权协议存疑的二进制大对象（blob）。—— Kyle Evans 在 freebsd-announce 中的说明

While FreeBSD’s ports tree is not hosted by GitHub – it’s merely mirrored there – the FreeBSD team believes the community values the GitHub mirror too much, and as such, steps had to be taken to fix this. Ports has not been compromised and users’ systems do not appear to be at risk in any way due to this occurrence, which is good news. 虽然 FreeBSD 的 ports 树并非托管在 GitHub 上（只是在那里做了镜像），但 FreeBSD 团队认为社区非常依赖该镜像，因此必须采取措施进行修复。好消息是，Ports 系统并未遭到破坏，用户的系统似乎也不会因此次事件面临任何风险。

Curiously, the official announcement makes no mention of which 150MB file, exactly, was committed to ports, but it didn’t take for people long to pinpoint the offending commit (screenshot). It turns out someone committed the entire github-copilot-cli Linux binary to ports, as part of the github-copilot-cli port. This FreeBSD port is effectively a way to easily install and run this tool on FreeBSD using Linuxulator, FreeBSD’s Linux compatibility layer that allows you to run unmodified Linux binaries on FreeBSD. 令人好奇的是，官方公告并未提及具体是哪个 150MB 的文件被提交到了 ports，但人们很快就定位到了那个违规提交（截图）。原来，有人在制作 github-copilot-cli 的 port 时，将整个 github-copilot-cli 的 Linux 二进制文件提交到了仓库中。这个 FreeBSD port 本质上是一种通过 Linuxulator（FreeBSD 的 Linux 兼容层，允许在 FreeBSD 上运行未经修改的 Linux 二进制文件）在 FreeBSD 上轻松安装和运行该工具的方法。

It’s important to note this FreeBSD port is not actually a port of the Linux version of github-copilot-cli to FreeBSD; the FreeBSD “port” merely acts as a setup script to run the unmodified Linux binary using Linuxulator. It’s not a “real” port because the tool isn’t open source and its license doesn’t allow for modifications. That’s why the announcement specifically mentions “questionable licensing” – github-copilot-cli is licensed under some custom license specifically made for this tool, and is not open source. 需要注意的是，这个 FreeBSD port 实际上并非将 Linux 版 github-copilot-cli 移植到 FreeBSD；这个 FreeBSD “port” 仅仅是一个安装脚本，用于通过 Linuxulator 运行未经修改的 Linux 二进制文件。它不是一个“真正”的移植，因为该工具并非开源，且其许可证不允许进行修改。这就是为什么公告中特别提到“授权协议存疑”——github-copilot-cli 使用的是专门为其定制的私有许可证，而非开源协议。

Anyway, for whatever reason, the maintainer of this FreeBSD port accidentally made a commit that added the actual, full 150MB Linux binary to FreeBSD ports. I’m assuming that under normal circumstances, building and installing the github-copilot-cli FreeBSD port would merely download the binary off GitHub and set Linuxulator up so that it could run it. Mistakes happen, and since there’s clearly nothing malicious going on, there’s not much to worry about. In fact, this may lead to new checks and balances to prevent this from happening in the future, which would be good news. 总之，无论出于何种原因，该 FreeBSD port 的维护者不小心提交了完整的 150MB Linux 二进制文件。我推测在正常情况下，构建和安装 github-copilot-cli 的 FreeBSD port 应该只是从 GitHub 下载二进制文件，并配置 Linuxulator 以便运行它。错误在所难免，既然这显然不是恶意行为，也就没什么可担心的。事实上，这可能会促使官方引入新的检查机制，以防止此类事件再次发生，这反而是个好消息。

The FreeBSD team is working on rolling back, fixing the issue, and investigating how this could have happened. Ports is still frozen at the time of writing, but I’m sure we’ll have a more detailed account soon. FreeBSD 团队目前正在进行回滚、修复问题，并调查事故原因。截至本文撰写时，Ports 仓库仍处于冻结状态，但我相信很快就会有更详细的说明。