This release includes security fixes, amd cppc driver and a new age attestation daemon.

aged(8) and agectl(8) programs added. aged will run at startup unless it is disabled in /etc/rc.conf.

If you live in a jurisdiction that does not have any age verification/attestation laws, you may turn it off with sysrc aged_enable=NO

adduser changed to ask for age when creating new accounts.

mport package manager now checks the user's age bracket when installing packages (which should always been root) and sets negative ACLs to block apps running for users under the age range of any mports. Currently, NOTHING is rated in mports.

To set age 15 on a user account:
doas agectl -a 15 myuser

You may also use date of birth if you prefer
agectl -b 2006-02-28 myacct

By default, the root account assumes it's run as a user 18+. Parents should manage PCs in jurisdictions requiring this functionality for it to work as intended. You can change the age of the root account.

Application developers needing to check for the signal can do so in 3 ways:
run agectl without arguments as the user. (for shell scripts, etc)
use the new functions in libutil

int * agev_get_age_bracket(const char *username);
int agev_set_age(const char *username, int age);

Directly communicate with the aged(8) socket. (not recommended)

Security fix:
Remote code execution via RPCSEC_GSS packet validation
Each RPCSEC_GSS data packet is validated by a routine which checks a signature
in the packet. This routine copies a portion of the packet into a stack buffer,
but fails to ensure that the buffer is sufficiently large, and a malicious
client can trigger a stack overflow. Notably, this does not require the client
to authenticate itself first.

New feature:
Add the amd-cppc driver implementation from Rob Augustinus. https://github.com/raugustinus/freebsd-amd-cppc/
Improves power management on recent Ryzen CPUs.

Full Changelog: 4.0.3...4.0.4