![[BACK]](/icons/back.gif){kind=icon}
Up to [cvs.NetBSD.org] / pkgsrc / security / botan-devel
Request diff between arbitrary revisions
Default branch: MAIN
Revision 1.46, Fri Apr 1 08:07:29 2022 UTC (2 years ago) by wiz
Branch: MAIN
CVS Tags: HEAD
Changes since 1.45: +1 -1
lines
FILE REMOVED
*: finish move of botan to versioned directories
Revision 1.45 / (download) - annotate - [select for diffs], Thu Mar 31 23:24:22 2022 UTC (2 years ago) by wiz
Branch: MAIN
Changes since 1.44: +2 -3
lines
Diff to previous 1.44 (colored) to selected 1.28 (colored)
botan: update to 2.19.1. Version 2.19.1, 2022-01-21 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Fix a compilation problem affecting macOS XCode (GH #2880) * Fix a build problem preventing amalgamation builds in 2.19.0 (GH #2879) Version 2.19.0, 2022-01-19 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Add a forward error correction code compatible with the zfec library (GH #2868 #2866) * Improve Emscripten build (GH #2864) * Always use ``-L`` before build flags (GH #2858 2848) * Fix compilation issue on earlier macOS versions (GH #2851) * Add a GCC 4.8 CI target to prevent build regressions (GH #2869) * Add support for Loongarch64 (GH #2877) * Check OSXSAVE flag before using AVX2 instructions (GH #2878) Version 2.18.2, 2021-10-25 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Avoid using short exponents when encrypting in ElGamal, as some PGP implementations generate keys with parameters that are weak when short exponents are used (GH #2794) * Fix a low risk OAEP decryption side channel (GH #2797) * Work around a miscompilation of SHA-3 caused by a bug in Clang 12 and XCode 13. (GH #2826) * Remove support in OpenSSL provider for algorithms which are disabled by default in OpenSSL 3.0 (GH #2823, #2814) * Add CI based on GitHub actions to replace Travis CI (GH #2632) * Fix the online OCSP test, as the certificate involved had expired. (GH #2799) * Fix some test failures induced by the expiration of the trust root "DST Root CA X3" (GH #2820) Version 2.18.1, 2021-05-09 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Fix a build regression in 2.18.0 which caused linker flags which contain ``-l`` within them (such as ``-fuse-linker-plugin``) to be misinterpreted. (GH #2715) * Fix a bug which caused decoding a certificate which contained more than one name in a single RDN. (GH #2611 #2630 #2724) * Fix a bug which caused OID lookup failures when run in a locale which uses thousands separators (pt_BR was reported as having this issue). (GH #2732 #2730 #2237) * DNS names in name constraints were compared with case sensitivity, which could cause valid certificates to be rejected. (GH #2739 #2735) * X.509 name constraint extensions were rejected if non-critical. RFC 5280 requires conforming CAs issue such extensions as critical, but not all certificates are compliant, and all other known implementations do not require this. (GH #2739 #2736) * X.509 name constraints were incorrectly applied to the certificate which included the constraint. (GH #2739 #2737) Version 2.18.0, 2021-04-15 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Add support for implementing custom RNG objects through the FFI interface (GH #2627 #2600) * Improve safegcd bounds, improving runtime performance (GH #2628 #2619) * Fix a bug introduced in 2.9.0 where BigInt::operator< would return an incorrect result if both operands were negative. (GH #2641 #2638) * Reject non-TLS messages as quickly as possible without waiting for a full record. (GH #2676) * Add build support for RISC-V 32 * Fixes for TLS::Stream::async_shutdown (GH #2673) * Fix a regression introduced in 2.17.0 where LDFLAGS which add an extra library (such as ``-latomic`` needed on SPARC) were not always applied effectively. (GH #2622 #2623 #2625)
Revision 1.44 / (download) - annotate - [select for diffs], Mon Jan 10 01:46:43 2022 UTC (2 years, 3 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2022Q1-base,
pkgsrc-2022Q1
Changes since 1.43: +2 -2
lines
Diff to previous 1.43 (colored) to selected 1.28 (colored)
*: Recursive revbump from boost 1.78.0
Revision 1.43 / (download) - annotate - [select for diffs], Fri Oct 1 12:13:08 2021 UTC (2 years, 6 months ago) by nia
Branch: MAIN
CVS Tags: pkgsrc-2021Q4-base,
pkgsrc-2021Q4
Changes since 1.42: +4 -1
lines
Diff to previous 1.42 (colored) to selected 1.28 (colored)
botan-devel: Fix PLIST on non-x86.
Revision 1.42 / (download) - annotate - [select for diffs], Wed Sep 29 19:00:12 2021 UTC (2 years, 6 months ago) by adam
Branch: MAIN
Changes since 1.41: +2 -2
lines
Diff to previous 1.41 (colored) to selected 1.28 (colored)
revbump for boost-libs
Revision 1.41 / (download) - annotate - [select for diffs], Mon Sep 20 09:09:21 2021 UTC (2 years, 6 months ago) by nia
Branch: MAIN
CVS Tags: pkgsrc-2021Q3-base,
pkgsrc-2021Q3
Changes since 1.40: +5 -3
lines
Diff to previous 1.40 (colored) to selected 1.28 (colored)
botan-devel: work around broken CPU arch detection on arm
Revision 1.40 / (download) - annotate - [select for diffs], Wed Apr 21 13:24:15 2021 UTC (2 years, 11 months ago) by adam
Branch: MAIN
CVS Tags: pkgsrc-2021Q2-base,
pkgsrc-2021Q2
Changes since 1.39: +2 -1
lines
Diff to previous 1.39 (colored) to selected 1.28 (colored)
revbump for boost-libs
Revision 1.39 / (download) - annotate - [select for diffs], Sun Mar 7 17:56:25 2021 UTC (3 years, 1 month ago) by he
Branch: MAIN
CVS Tags: pkgsrc-2021Q1-base,
pkgsrc-2021Q1
Changes since 1.38: +2 -3
lines
Diff to previous 1.38 (colored) to selected 1.28 (colored)
Update botan-devel to version 2.17.3. Informally OK'ed by joerg@ Pkgsrc changes: * Add comment the patches which lacked them. * Adjust PLIST. Upstream changes: Version 2.17.3, 2020-12-21 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Change base64, base58, base32, and hex encoding and decoding opearations to run in constant time (GH #2549) * Fix a build problem on PPC64 building with Clang (GH #2547) * Fix an install problem introduced in 2.17.2 affecting MSVC 2015 * Fix use of -L flag in linking when configured using ``--with-external-libdir`` (GH #2496) * Fix a build problem on big-endian PowerPC related to VSX instructions in the AES code. (GH #2515) Version 2.17.2, 2020-11-13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Fix an build problem on ppc64 introduced with certain recent versions of GCC or binutils where using the DARN instruction requires using an appropriate -mcpu flag to enable the instruction in the assembler. (GH #2481 2463) * Resolve an issue in the modular square root algorithm where a loop to find a quadratic non-residue could, for a carefully chosen composite modulus, not terminte in a timely manner. (GH #2482 #2476) * Fix a regression in MinGW builds introduced in 2.17.1 Version 2.17.1, 2020-11-07 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Fix a build problem that could occur if Python was not in the PATH. This was known to occur on some installations of macOS. * Re-enable support for the x86 CLMUL instruction on Visual C++, which was accidentally disabled starting in 2.12.0. (GH #2460) Version 2.17.0, 2020-11-05 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Fix a bug in ECDSA which could occur when the group size and hash length differ. In this case, on occasion the generated signature would not be accepted by other ECDSA implementations. This was particularly likely to affect users of 160-bit or 239-bit curves. (GH #2433 #2415) * Fix a bug in ECDSA verification when the public key was chosen to be a small multiple of the group generator. In that case, verification would fail even if the signature was actually valid. (GH #2425) * SIV's functionality of supporting multiple associated data inputs has been generalized onto the AEAD_Mode interface. However at the moment SIV is the only AEAD implemented which supports more than one AD. (GH #2440) * The contents of ASN.1 headers ``asn1_str.h``, ``asn1_time.h``, ``asn1_oid.h`` and ``alg_id.h`` have been moved to ``asn1_obj.h``. The header files remain but simply forward the include to ``asn1_obj.h``. These now-empty header files are deprecated, and will be removed in a future major release. (GH #2441) * The contents of X.509/PKIX headers ``asn1_attribute.h`` ``asn1_alt_name.h`` ``name_constraint.h`` ``x509_dn.h`` ``cert_status.h`` and ``key_constraint.h`` have been merged into ``pkix_enums.h`` (for enumerations) and ``pkix_types.h`` (for all other definitions). The previous header files remain but simply forward the include to the new header containing the definition. These now-empty header files are deprecated, and will be removed in a future major release. (GH #2441) * A number of other headers including those related to HOTP/TOTP, XMSS, PKCS11, PSK_DB have also been merged. Any now deprecated/empty headers simply include the new header and issue a deprecation warning. (GH #2443 #2446 #2447 2448 #2449) * Small optimizations in the non-hardware assisted AES key generation code path (GH #2417 #2418) * Move the GHASH code to a new module in utils, making it possible to build GMAC support without requiring GCM (GH #2416) * Add more detection logic for AVX-512 features (GH #2430) * Avoid std::is_pod which is deprecated in C++20 (GH #2429) * Fix a bug parsing deeply nested cipher names (GH #2426) * Add support for ``aarch64_be`` target CPU (GH #2422) * Fix order of linker flags so they are always applied effectively (GH #2420) * Prevent requesting DER encoding of signatures when the algorithm did not support it (GH #2419) Version 2.16.0, 2020-10-06 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Now userspace PRNG objects (such as AutoSeeded_RNG and HMAC_DRBG) use an internal lock, which allows safe concurrent use. This however is purely a precaution in case of accidental sharing of such RNG objects; for performance reasons it is always preferable to use a RNG per thread if a userspace RNG is needed. (GH #2399) * DL_Group and EC_Group objects now track if they were created from a known trusted group (such as P-256 or an IPsec DH parameter). If so, then verification tests can be relaxed, as compared to parameters which may have been maliciously constructed in order to pass primality checks. (GH #2409) * RandomNumberGenerator::add_entropy_T assumed its input was a POD type but did not verify this. (GH #2403) * Support OCSP responders that live on a non-standard port (GH #2401) * Add support for Solaris sandbox (GH #2385) * Support suffixes on release numbers for alpha/beta releases (GH #2404) * Fix a bug in EAX which allowed requesting a 0 length tag, which had the effect of using a full length tag. Instead omit the length field, or request the full tag length explicitly. (GH #2392 #2390) * Fix a memory leak in GCM where if passed an unsuitable block cipher (eg not 128 bit) it would throw an exception and leak the cipher object. (GH #2392 #2388) Version 2.15.0, 2020-07-07 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Fix a bug where the name constraint extension did not constrain the alternative DN field which can be included in a subject alternative name. This would allow a corrupted sub-CA which was otherwise constrained by a name constraint to issue a certificate with a prohibited DN. * Fix a bug in the TLS server during client authentication where where if a (disabled by default) static RSA ciphersuite was selected, then no certificate request would be sent. This would have an equivalent effect to a client which simply replied with an empty Certificate message. (GH #2367) * Replace the T-Tables implementation of AES with a 32-bit bitsliced version. As a result AES is now constant time on all processors. (GH #2346 #2348 #2353 #2329 #2355) * In TLS, enforce that the key usage given in the server certificate allows the operation being performed in the ciphersuite. (GH #2367) * In X.509 certificates, verify that the algorithm parameters are the expected NULL or empty. (GH #2367) * Change the HMAC key schedule to attempt to reduce the information leaked from the key schedule with regards to the length of the key, as this is at times (as for example in PBKDF2) sensitive information. (GH #2362) * Add Processor_RNG which wraps RDRAND or the POWER DARN RNG instructions. The previous RDRAND_RNG interface is deprecated. (GH #2352) * The documentation claimed that mlocked pages were created with a guard page both before and after. However only a trailing guard page was used. Add a leading guard page. (GH #2334) * Add support for generating and verifying DER-encoded ECDSA signatures in the C and Python interfaces. (GH #2357 #2356) * Workaround a bug in GCC's UbSan which triggered on a code sequence in XMSS (GH #2322) * When building documentation using Sphinx avoid parallel builds with version 3.0 due to a bug in that version (GH #2326 #2324) * Fix a memory leak in the CommonCrypto block cipher calls (GH #2371) * Fix a flaky test that would occasionally fail when running the tests with a large number of threads. (GH #2325 #2197) * Additional algorithms are now deprecated: XTEA, GOST, and Tiger. They will be removed in a future major release. Version 2.14.0, 2020-04-06 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Add support for using POWER8+ VPSUMD instruction to accelerate GCM (GH #2247) * Optimize the vector permute AES implementation, especially improving performance on ARMv7, Aarch64, and POWER. (GH #2243) * Use a new algorithm for modular inversions which is both faster and more resistant to side channel attacks. (GH #2287 #2296 #2301) * Address an issue in CBC padding which would leak the length of the plaintext which was being padded. Unpadding during decryption was not affected. Thanks to Maximilian Blochberger for reporting this. (GH #2312) * Optimize NIST prime field reductions, improving ECDSA by 3-9% (GH #2295) * Increase the size of the ECC blinding mask and scale it based on the size of the group order. (GH #880 #893 #2308) * Add server side support for the TLS asio wrapper. (GH #2229) * Add support for using Windows certificate store on MinGW (GH #2280) * Use the library thread pool instead of a new thread for RSA computations, improving signature performance by up to 20%. (GH #2257) * Precompute and cache additional fields in ``X509_Certificate`` (GH #2250) * Add a CLI utility ``cpu_clock`` which estimates the speed of the processor cycle counter. (GH #2251) * Fix a bug which prevented using DER-encoded ECDSA signatures with a PKCS11 key (GH #2293) * Enable use of raw block ciphers from CommonCrypto (GH #2278) * Support for splitting up the amalgamation file by ABI extension has been removed. Instead only ``botan_all.cpp`` and ``botan_all.h`` are generated. (GH #2246) * Improve support for baremetal systems with no underlying OS, with target OS ``none`` (GH #2303 #2304 #2305) * The build system now avoids using ``-rpath=$ORIGIN`` or (on macOS) install_name which allowed running the tests from the build directory without setting ``LD_LIBRARY_PATH``/``DYLD_LIBRARY_PATH`` environment variables. Instead set the dynamic linker variables appropriately, or use ``make check``. (GH #2294 #2302) * Add new option ``--name-amalgamation`` which allows naming the amalgamation output, instead of the default ``botan_all``. (GH #2246) * Avoid using symbolic links on Windows (GH #2288 #2286 #2285) * Fix a bug that prevented compilation of the amalgamation on ARM and POWER processors (GH #2245 #2241) * Fix some build problems under Intel C++ (GH #2260) * Remove use of Toolhelp Windows library, which was known to trigger false positives under some antivirus systems. (GH #2261) * Fix a compilation problem when building on Windows in Unicode mode. Add Unicode build to CI to prevent regressions. (GH #2254 #2256) * Work around a GCC bug affecting old libc (GH #2235) * Workaround a bug in macOS 10.15 which caused a test to crash. (GH #2279 #2268) * Avoid a crash in PKCS8::load_key due to a bug in Clang 8. (GH #2277) Version 2.13.0, 2020-01-06 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Add Roughtime client (GH #2143 #1842) * Add support for XMSS X.509 certificates (GH #2172) * Add support for X.509 CRLs in FFI layer and Python wrapper (GH #2213) * It is now possible to disable TLS v1.0/v1.1 and DTLS v1.0 at build time. (GH #2188) * The format of encrypted TLS sessions has changed, which will invalidate all existing session tickets. The new format will make it easier to support ticket key rotation in the future. (GH #2225) * Improve RSA key generation performance (GH #2148) * Make gcd computation constant-time (GH #2147) * Add AVX2 implementation of SHACAL2 (GH #2196) * Update BSI policy to reflect 2019 update of TR 02102-2 (GH #2195) * Support more functionality for X.509 in the Python API (GH #2165) * Add ``generic`` CPU target useful when building for some new or unusual platform. * Disable MD5 in BSI or NIST modes (GH #2188) * Disable stack protector on MinGW as it causes crashes with some recent versions. (GH #2187) * On Windows the DLL is now installed into the binary directory (GH #2233) * Previously Windows required an explicit ``.lib`` suffix be added when providing an explicit library name, as is used for example for Boost. Now the ``.lib`` suffix is implicit, and should be omitted. * Remove the 32-bit x86 inline asm for Visual C++ as it seemed to not offer much in the way of improved performance. (GH #2204 #256) * Resolve all compile time warnings generated by GCC, Clang and MSVC. Modify CI to compile with warnings-as-errors. (GH #2170 #2206 #2211 #2212) * Fix bugs linking to 3rd party libraries on Windows due to invalid link specifiers. (GH #2210 #2215) * Add long input and NIST Monte-Carlo hash function tests. * Fix a bug introduced in 2.12.0 where ``TLS::Channel::is_active`` and ``TLS::Channel::is_closed`` could simultaneously return true. (GH #2174 #2171) * Use ``std::shared_ptr`` instead of ``boost::shared_ptr`` in some examples. (GH #2155) Version 2.12.1, 2019-10-14 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Fix a bug that prevented building with nmake (GH #2142 #2141) * Fix an issue where make install would attempt to build targets which were disabled. (GH #2140) * If the option ``--without-documentation`` is used, avoid invoking the documentation build script. (GH #2138) * Fix a bug that prevented compilation on x86-32 using GCC 4.9 (GH #2139) * Fix a bug in CCM encryption, where it was possible to call ``finish`` without ever setting a nonce (GH #2151 #2150) * Improve ECIES/DLIES interfaces. If no initialization vector was set, they would typically produce hard to understand exceptions. (GH #2151 #2150) Version 2.12.0, 2019-10-07 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * Many currently public headers are being deprecated. If any such header is included by an application, a warning is issued at compile time. Headers issuing this warning will be made internal in a future major release. (GH #2061) * RSA signature performance improvements (GH #2068 #2070) * Performance improvements for GCM (GH #2024 #2099 #2119), OCB (#2122), XTS (#2123) and ChaCha20Poly1305 (GH #2117), especially for small messages. * Add support for constant time AES using NEON and AltiVec (GH #2093 #2095 #2100) * Improve performance of POWER8 AES instructions (GH #2096) * Add support for the POWER9 hardware random number generator (GH #2026) * Add support for 64-bit version of RDRAND, doubling performance on x86-64 (GH #934 #2022) * In DTLS server, support a client crashing and then reconnecting from the same source port, as described in RFC 6347 sec 4.2.8 (GH #2029) * Optimize DTLS MTU splitting to split precisely to the set MTU (GH #2042) * Add support for the TLS v1.3 downgrade indicator. (GH #2027) * Improve the error messages generated when an invalid TLS state transition occurs (GH #2030) * Fix some edge cases around TLS close_notify support. (GH #2054) * Modifications to support GOST 34.10-2012 signatures (GH #2055 #2056 #1860 #1897) * Add some new APIs on ``OID`` objects (GH #2057) * Properly decode OCSP responses which indicate an error (GH #2110) * Add a function to remove an X.509 extension from an Extensions object. (GH #2101 #2073 #2065) * Support Argon2 outputs longer than 64 bytes (GH #2079 #2078) * Correct a bug in CAST-128 which caused incorrect computation using 11, 13, 14, or 15 byte keys. (GH #2081) * Fix a bug which would cause Streebog to produce incorrect outputs for certain messages (GH #2082 #2083) * Fix a bug that prevented loading EC points with an affine x or y value of 0. For certain curves such points can exist. (GH #2102) * Fix a bug which would cause PBKDF2 to go into a very long loop if it was requested to use an iteration count of 0. (GH #2090 #2088) * The BearSSL provider has been removed (GH #2020) * Add a new ``entropy`` cli which allows sampling the output of the entropy sources. * Add new ``base32_enc`` and ``base32_dec`` cli for base32 encoding operations. (GH #2111) * Support setting TLS policies in CLIs like ``tls_client`` and ``tls_proxy_server`` (GH #2047) * The tests now run in multithreaded mode by default. Provide option ``--test-threads=1`` to return to previous single-threaded behavior. (GH #2071 #2075) * Cleanups in TLS record layer (GH #2021) * Fix typos in some OCSP enums which used "OSCP" instead. (GH #2048) * In the Python module, avoid trying to load DLLs for names that don't match the current platform (GH #2062 #2059) * In the Python module, also look for ``botan.dll`` so Python wrapper can run on Windows. (GH #2059 #2060) * Add support for TOTP algorithm to the Python module. (GH #2112) * Now the minimum Windows target is set to Windows 7 (GH #2036 #2028) * Add ``BOTAN_FORCE_INLINE`` macro to resolve a performance issue with BLAKE2b on MSVC (GH #2092 #2089) * Avoid using ``__GNUG__`` in headers that may be consumed by a C compiler (GH #2013) * Improve the PKCS11 tests (GH #2115) * Fix a warning from Klocwork (GH #2128 #2129) * Fix a bug which caused amalgamation builds to fail on iOS (GH #2045) * Support disabling thread local storage, needed for building on old iOS (GH #2045) * Add a script to help with building for Android, using Docker (GH #2016 #2033 #513) * Add Android NDK build to Travis CI (GH #2017)
Revision 1.38 / (download) - annotate - [select for diffs], Sat Mar 6 21:23:28 2021 UTC (3 years, 1 month ago) by joerg
Branch: MAIN
Changes since 1.37: +6 -1
lines
Diff to previous 1.37 (colored) to selected 1.28 (colored)
Hook up self tests
Revision 1.37 / (download) - annotate - [select for diffs], Fri Jan 1 08:24:55 2021 UTC (3 years, 3 months ago) by ryoon
Branch: MAIN
Changes since 1.36: +2 -2
lines
Diff to previous 1.36 (colored) to selected 1.28 (colored)
*: Recursive revbump from boost-1.75.0
Revision 1.36 / (download) - annotate - [select for diffs], Wed May 6 14:04:12 2020 UTC (3 years, 11 months ago) by adam
Branch: MAIN
CVS Tags: pkgsrc-2020Q4-base,
pkgsrc-2020Q4,
pkgsrc-2020Q3-base,
pkgsrc-2020Q3,
pkgsrc-2020Q2-base,
pkgsrc-2020Q2
Changes since 1.35: +2 -2
lines
Diff to previous 1.35 (colored) to selected 1.28 (colored)
revbump after boost update
Revision 1.35 / (download) - annotate - [select for diffs], Sun Jan 12 20:19:58 2020 UTC (4 years, 3 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2020Q1-base,
pkgsrc-2020Q1
Changes since 1.34: +2 -2
lines
Diff to previous 1.34 (colored) to selected 1.28 (colored)
*: Recursive revbump from devel/boost-libs
Revision 1.34 / (download) - annotate - [select for diffs], Sun Dec 22 22:33:15 2019 UTC (4 years, 3 months ago) by markd
Branch: MAIN
CVS Tags: pkgsrc-2019Q4-base,
pkgsrc-2019Q4
Changes since 1.33: +2 -1
lines
Diff to previous 1.33 (colored) to selected 1.28 (colored)
botan-devel: don't accidentally detect and use sphinx
Revision 1.33 / (download) - annotate - [select for diffs], Thu Aug 22 12:23:43 2019 UTC (4 years, 7 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2019Q3-base,
pkgsrc-2019Q3
Changes since 1.32: +2 -1
lines
Diff to previous 1.32 (colored) to selected 1.28 (colored)
Recursive revbump from boost-1.71.0
Revision 1.32 / (download) - annotate - [select for diffs], Mon Jul 15 18:31:29 2019 UTC (4 years, 9 months ago) by bsiegert
Branch: MAIN
Changes since 1.31: +6 -5
lines
Diff to previous 1.31 (colored) to selected 1.28 (colored)
Update botan-devel to 2.11.0. There are too many changes to put them in this message.
Revision 1.31 / (download) - annotate - [select for diffs], Mon Jul 1 04:07:51 2019 UTC (4 years, 9 months ago) by ryoon
Branch: MAIN
Changes since 1.30: +2 -2
lines
Diff to previous 1.30 (colored) to selected 1.28 (colored)
Recursive revbump from boost-1.70.0
Revision 1.30 / (download) - annotate - [select for diffs], Thu Apr 25 07:33:15 2019 UTC (4 years, 11 months ago) by maya
Branch: MAIN
CVS Tags: pkgsrc-2019Q2-base,
pkgsrc-2019Q2
Changes since 1.29: +2 -2
lines
Diff to previous 1.29 (colored) to selected 1.28 (colored)
PKGREVISION bump for anything using python without a PYPKGPREFIX. This is a semi-manual PKGREVISION bump.
Revision 1.29 / (download) - annotate - [select for diffs], Thu Dec 13 19:51:36 2018 UTC (5 years, 4 months ago) by adam
Branch: MAIN
CVS Tags: pkgsrc-2019Q1-base,
pkgsrc-2019Q1,
pkgsrc-2018Q4-base,
pkgsrc-2018Q4
Changes since 1.28: +2 -2
lines
Diff to previous 1.28 (colored)
revbump for boost 1.69.0
Revision 1.28 / (download) - annotate - [selected], Tue Sep 4 00:02:03 2018 UTC (5 years, 7 months ago) by minskim
Branch: MAIN
CVS Tags: pkgsrc-2018Q3-base,
pkgsrc-2018Q3
Changes since 1.27: +2 -1
lines
Diff to previous 1.27 (colored)
security/botan{,-devel}: Designate doc dir explicitly
Before this change, botan{,-devel} installed documents in
${PREFIX}/doc, not ${PREFIX}/share/doc, on Darwin.
Revision 1.27 / (download) - annotate - [select for diffs], Thu Aug 16 18:54:31 2018 UTC (5 years, 8 months ago) by adam
Branch: MAIN
Changes since 1.26: +2 -2
lines
Diff to previous 1.26 (colored) to selected 1.28 (colored)
revbump after boost-libs update
Revision 1.26 / (download) - annotate - [select for diffs], Sun Apr 29 21:31:22 2018 UTC (5 years, 11 months ago) by adam
Branch: MAIN
CVS Tags: pkgsrc-2018Q2-base,
pkgsrc-2018Q2
Changes since 1.25: +2 -2
lines
Diff to previous 1.25 (colored) to selected 1.28 (colored)
revbump for boost-libs update
Revision 1.25 / (download) - annotate - [select for diffs], Fri Feb 2 13:56:35 2018 UTC (6 years, 2 months ago) by jperkin
Branch: MAIN
CVS Tags: pkgsrc-2018Q1-base,
pkgsrc-2018Q1
Changes since 1.24: +2 -2
lines
Diff to previous 1.24 (colored) to selected 1.28 (colored)
botan-devel: Leave pkgsrc to handle security features. Fix SunOS.
Revision 1.24 / (download) - annotate - [select for diffs], Mon Jan 1 21:18:10 2018 UTC (6 years, 3 months ago) by adam
Branch: MAIN
Changes since 1.23: +2 -2
lines
Diff to previous 1.23 (colored) to selected 1.28 (colored)
Revbump after boost update
Revision 1.23 / (download) - annotate - [select for diffs], Sun Nov 26 10:40:05 2017 UTC (6 years, 4 months ago) by wiz
Branch: MAIN
CVS Tags: pkgsrc-2017Q4-base,
pkgsrc-2017Q4
Changes since 1.22: +3 -3
lines
Diff to previous 1.22 (colored) to selected 1.28 (colored)
botan-devel: follow redirects
Revision 1.22 / (download) - annotate - [select for diffs], Thu Aug 24 20:03:00 2017 UTC (6 years, 7 months ago) by adam
Branch: MAIN
CVS Tags: pkgsrc-2017Q3-base,
pkgsrc-2017Q3
Changes since 1.21: +2 -2
lines
Diff to previous 1.21 (colored) to selected 1.28 (colored)
Revbump for boost update
Revision 1.21 / (download) - annotate - [select for diffs], Sun Apr 30 01:21:24 2017 UTC (6 years, 11 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2017Q2-base,
pkgsrc-2017Q2
Changes since 1.20: +2 -1
lines
Diff to previous 1.20 (colored) to selected 1.28 (colored)
Recursive revbump from boost update
Revision 1.20 / (download) - annotate - [select for diffs], Mon Apr 10 21:14:45 2017 UTC (7 years ago) by joerg
Branch: MAIN
Changes since 1.19: +2 -3
lines
Diff to previous 1.19 (colored) to selected 1.28 (colored)
Update to Botan 2.1.0, the new stable branch. Some of the more important changes: - Fix incorrect truncation in Bcrypt. Passwords in length between 56 and 72 characters were truncated at 56 characters. Found and reported by Solar Designer. (CVE-2017-7252) (GH #938) - Fix a bug in X509 DN string comparisons that could result in out of bound reads. This could result in information leakage, denial of service, or potentially incorrect certificate validation results. Found independently by Cisco Talos team and OSS-Fuzz. (CVE-2017-2801) - Correct minimum work factor for Bcrypt password hashes. All other implementations require the work factor be at least 4. Previously Botan simply required it be greater than zero. (GH #938) - Converge on a single side channel silent EC blinded multiply algorithm. Uses Montgomery ladder with order/2 bits scalar blinding and point randomization now by default. (GH #893) - Add ability to search for certificates using the SHA-256 of the distinguished name. (GH #900) - Support a 0-length IV in ChaCha stream cipher. Such an IV is treated identically to an 8-byte IV of all zeros. - Previously Botan forbid any use of times past 2037 to avoid Y2038 issues. Now this restriction is only in place on systems which have a 32-bit time_t. (GH #933 fixing #917) - Fix a longstanding bug in modular exponentiation which caused most exponentiations modulo an even number to have an incorrect result; such moduli occur only rarely in cryptographic contexts. (GH #754) - Fix a bug in BigInt multiply operation, introduced in 1.11.30, which could cause incorrect results. Found by OSS-Fuzz fuzzing the ressol function, where the bug manifested as an incorrect modular exponentiation. OSS-Fuzz bug #287 - Fix a bug that meant the ãà×Êetf/modp/6144ãàand ãà×Êetf/modp/8192ãà discrete log groups used an incorrect value for the generator, specifically the value (p-1)/2 was used instead of the correct value of 2. - DL_Group strong generation previously set the generator to 2. However sometimes 2 generates the entire group mod p, rather than the subgroup mod q. This is invalid by X9.42 standard, and exposes incautious applications to small subgroup attacks. Now DL_Group uses the smallest g which is a quadratic residue. (GH #818) - The default TLS policy now requires 2048 or larger DH groups by default. - The default Path_Validation_Restrictions constructor has changed to require at least 110 bit signature strength. This means 1024 bit RSA certificates and also SHA-1 certificates are rejected by default. Both settings were already the default for certificate validation in TLS handshake, but this changes it for applications also. - Fix integer overflow during BER decoding, found by Falko Strenzke. This bug is not thought to be directly exploitable but upgrading ASAP is advised. (CVE-2016-9132) - Add post-quantum signature scheme XMSS. Provides either 128 or 256 bit (post-quantum) security, with small public and private keys, fast verification, and reasonably small signatures (2500 bytes for 128-bit security). Signature generation is very slow, on the order of seconds. And very importantly the signature scheme is stateful: each leaf index must only be used once, or all security is lost. In the appropriate system where signatures are rarely generated (such as code signing) XMSS makes an excellent choice. (GH #717 #736) - Add support for client-side OCSP stapling to TLS. (GH #738) - Previously both public and private keys performed automatic self testing after generation or loading. However this often caused unexpected application performance problems, and so has been removed. Instead applications must call check_key explicitly. (GH #704) - Fix TLS session resumption bugs which caused resumption failures if an application used a single session cache for both TLS and DTLS. (GH #688) - The default TLS policy now disables static RSA ciphersuites, all DSA ciphersuites, and the AES CCM-8 ciphersuites. Disabling static RSA by default protects servers from oracle attacks, as well as enforcing a forward secure ciphersuite. Some applications may be forced to re-enable RSA for interop reasons. DSA and CCM-8 are rarely used, and likely should not be negotiated outside of special circumstances. - The default TLS policy now prefers ChaCha20Poly1305 cipher over any AES mode. - The default TLS policy now orders ECC curve preferences in order by performance, with x25519 first, then P-256, then P-521, then the rest.
Revision 1.19 / (download) - annotate - [select for diffs], Sun Jan 1 16:05:59 2017 UTC (7 years, 3 months ago) by adam
Branch: MAIN
CVS Tags: pkgsrc-2017Q1-base,
pkgsrc-2017Q1
Changes since 1.18: +2 -1
lines
Diff to previous 1.18 (colored) to selected 1.28 (colored)
Revbump after boost update
Revision 1.18 / (download) - annotate - [select for diffs], Wed Nov 23 13:01:54 2016 UTC (7 years, 4 months ago) by joerg
Branch: MAIN
CVS Tags: pkgsrc-2016Q4-base,
pkgsrc-2016Q4
Changes since 1.17: +13 -1
lines
Diff to previous 1.17 (colored) to selected 1.28 (colored)
Restore explicit CPU selection based on MACHINE_ARCH, needing e.g. on SmartOS.
Revision 1.17 / (download) - annotate - [select for diffs], Fri Nov 11 19:46:05 2016 UTC (7 years, 5 months ago) by joerg
Branch: MAIN
Changes since 1.16: +2 -2
lines
Diff to previous 1.16 (colored) to selected 1.28 (colored)
Become maintainer.
Revision 1.16 / (download) - annotate - [select for diffs], Fri Nov 11 19:41:44 2016 UTC (7 years, 5 months ago) by joerg
Branch: MAIN
Changes since 1.15: +2 -13
lines
Diff to previous 1.15 (colored) to selected 1.28 (colored)
Update to Botan-1.11.33: - avoid side channel with OAEP (CVE-2016-8871) - avoid Lucky13 timing attack against CBC-based TLS cipher - added X25519-based key exchange for TLS - add support for the TLS Supported Point Formats Extension from RFC 4492 - add support for the NewHope Ring-LWE key encapsulation algorithm for estimated ~200 bit security level against a quantum attacker. - add support for TLS Encrypt-then-MAC extension - Fix undefined behavior in Curve25519 for 32bit platforms - bugfix for GCM when 32-bit counters overflowed - added ChaCha20Poly1305 TLS cipher
Revision 1.15 / (download) - annotate - [select for diffs], Fri Oct 7 18:25:33 2016 UTC (7 years, 6 months ago) by adam
Branch: MAIN
Changes since 1.14: +2 -1
lines
Diff to previous 1.14 (colored) to selected 1.28 (colored)
Revbump post boost update
Revision 1.14 / (download) - annotate - [select for diffs], Thu May 19 21:58:43 2016 UTC (7 years, 10 months ago) by joerg
Branch: MAIN
CVS Tags: pkgsrc-2016Q3-base,
pkgsrc-2016Q3,
pkgsrc-2016Q2-base,
pkgsrc-2016Q2
Changes since 1.13: +2 -2
lines
Diff to previous 1.13 (colored) to selected 1.28 (colored)
Update to Botan 1.11.29: - CVE-2016-2849: side channel attack against DSA and ECDSA - CVE-2016-2850: failure to enforce TLS policies could lead to weaker algorithms being choosen - CVE-2016-2195: heap overflow in ECC point decoding - CVE-2016-2196: heap overflow in P-521 reduction - CVE-2016-2194: DOS against the modular reduction - CVE-2015-7824: padding oracle attack against TLS CBC - CVE-2015-7825: DOS due to certificate chains - CVE-2015-7826: wildcard certifications verification failures - CVE-2015-7827: protection against PKCS#1 side channel issues - CVE-2015-5726: potential DOS with invalid zero-length BER - CVE-2015-5727: unbound memory use with BER - deprecation or removal of various insecure crypto primitives - TLS heartbeat removed - various other bugfixes and improvements.
Revision 1.13 / (download) - annotate - [select for diffs], Fri Feb 26 11:40:30 2016 UTC (8 years, 1 month ago) by jperkin
Branch: MAIN
CVS Tags: pkgsrc-2016Q1-base,
pkgsrc-2016Q1
Changes since 1.12: +1 -2
lines
Diff to previous 1.12 (colored) to selected 1.28 (colored)
Remove manual addition of MAKE_FLAGS to OPSYSVARS, it's now in by default.
Revision 1.12 / (download) - annotate - [select for diffs], Fri Feb 26 09:41:05 2016 UTC (8 years, 1 month ago) by jperkin
Branch: MAIN
Changes since 1.11: +3 -4
lines
Diff to previous 1.11 (colored) to selected 1.28 (colored)
Use OPSYSVARS.
Revision 1.10.2.1 / (download) - annotate - [select for diffs], Mon Oct 26 20:09:36 2015 UTC (8 years, 5 months ago) by bsiegert
Branch: pkgsrc-2015Q3
Changes since 1.10: +2 -1
lines
Diff to previous 1.10 (colored) next main 1.11 (colored) to selected 1.28 (colored)
Pullup ticket #4843 - requested by joerg security/botan-devel: build fix Revisions pulled up: - security/botan-devel/Makefile 1.11 --- Module Name: pkgsrc Committed By: joerg Date: Wed Oct 21 21:29:14 UTC 2015 Modified Files: pkgsrc/security/botan-devel: Makefile Log Message: For amd64 builds, override the automatic CPU detection. It fails on SmartOS for 64bit builds.
Revision 1.11 / (download) - annotate - [select for diffs], Wed Oct 21 21:29:14 2015 UTC (8 years, 5 months ago) by joerg
Branch: MAIN
CVS Tags: pkgsrc-2015Q4-base,
pkgsrc-2015Q4
Changes since 1.10: +2 -1
lines
Diff to previous 1.10 (colored) to selected 1.28 (colored)
For amd64 builds, override the automatic CPU detection. It fails on SmartOS for 64bit builds.
Revision 1.10 / (download) - annotate - [select for diffs], Sun Sep 13 02:31:22 2015 UTC (8 years, 7 months ago) by joerg
Branch: MAIN
CVS Tags: pkgsrc-2015Q3-base
Branch point for: pkgsrc-2015Q3
Changes since 1.9: +5 -1
lines
Diff to previous 1.9 (colored) to selected 1.28 (colored)
Add missing stdexcept includes. Add missing libraries for socket functions on Solaris. Check privileges for mlock use on Solaris before trying to lock the resource buffer.
Revision 1.9 / (download) - annotate - [select for diffs], Wed May 20 21:57:10 2015 UTC (8 years, 10 months ago) by joerg
Branch: MAIN
CVS Tags: pkgsrc-2015Q2-base,
pkgsrc-2015Q2
Changes since 1.8: +3 -1
lines
Diff to previous 1.8 (colored) to selected 1.28 (colored)
Add missing header. Patch up Python interpreter. Regen distinfo.
Revision 1.8 / (download) - annotate - [select for diffs], Thu May 14 18:39:24 2015 UTC (8 years, 11 months ago) by joerg
Branch: MAIN
Changes since 1.7: +8 -6
lines
Diff to previous 1.7 (colored) to selected 1.28 (colored)
Update to Botan 1.11.16: - Switch to using IETF ALPN extension for negotiating application-level protocols for TLS in place of NPN extension. - Optimizations for ECDSA - Allow using OpenSSL's RSA implementation - RC4 is deprecated and will be removed in the future - Removed global state like the global PRNG. - Cleaner registration for algorithm etc, potentially requires changes for statically linked programs. - Simple C binding for common operations - Optimized reductors for P-192, P-224, P-256, P-384, P-521 - Experimental OCB support for TLS - Reduced memory footprint of CTR - botan-config has been merged into botan - Removal of SSLv3 support - MCEIES, DTLS-STRP, SipHash, Curve25519, Poly1305, ChaCha20Poly1305 supported - Changed format of serialized TLS sessions - TLS heartbeat messages support user-defined size of padding for PMTU discovery - RFC 6979 support for deterministic nouns and signatures with DSA and ECDSA - Support for TLS fallback signaling
Revision 1.7 / (download) - annotate - [select for diffs], Fri Apr 17 15:52:57 2015 UTC (9 years ago) by adam
Branch: MAIN
Changes since 1.6: +2 -2
lines
Diff to previous 1.6 (colored) to selected 1.28 (colored)
Revbump after updating devel/boost-libs
Revision 1.6 / (download) - annotate - [select for diffs], Fri Nov 7 19:39:25 2014 UTC (9 years, 5 months ago) by adam
Branch: MAIN
CVS Tags: pkgsrc-2015Q1-base,
pkgsrc-2015Q1,
pkgsrc-2014Q4-base,
pkgsrc-2014Q4
Changes since 1.5: +2 -2
lines
Diff to previous 1.5 (colored) to selected 1.28 (colored)
Revbump after updating boost
Revision 1.5 / (download) - annotate - [select for diffs], Wed Aug 13 10:57:32 2014 UTC (9 years, 8 months ago) by adam
Branch: MAIN
CVS Tags: pkgsrc-2014Q3-base,
pkgsrc-2014Q3
Changes since 1.4: +2 -2
lines
Diff to previous 1.4 (colored) to selected 1.28 (colored)
Revbump after boost-libs update
Revision 1.4 / (download) - annotate - [select for diffs], Wed May 21 01:22:14 2014 UTC (9 years, 10 months ago) by joerg
Branch: MAIN
CVS Tags: pkgsrc-2014Q2-base,
pkgsrc-2014Q2
Changes since 1.3: +10 -1
lines
Diff to previous 1.3 (colored) to selected 1.28 (colored)
Fix build on NetBSD/evbarm.
Revision 1.3 / (download) - annotate - [select for diffs], Sat May 17 16:10:48 2014 UTC (9 years, 11 months ago) by wiz
Branch: MAIN
Changes since 1.2: +2 -1
lines
Diff to previous 1.2 (colored) to selected 1.28 (colored)
Bump applications PKGREVISIONs for python users that might be using python3, since the default changed from python33 to python34. I probably bumped too many. I hope I got them all.
Revision 1.2 / (download) - annotate - [select for diffs], Wed Mar 5 21:22:38 2014 UTC (10 years, 1 month ago) by joerg
Branch: MAIN
CVS Tags: pkgsrc-2014Q1-base,
pkgsrc-2014Q1
Changes since 1.1: +6 -1
lines
Diff to previous 1.1 (colored) to selected 1.28 (colored)
Fix build on NetBSD and with clang.
Revision 1.1 / (download) - annotate - [select for diffs], Mon Feb 24 20:49:14 2014 UTC (10 years, 1 month ago) by joerg
Branch: MAIN
Diff to selected 1.28 (colored)
Add botan 1.11.8, the in-progress version of security/botan. It brings a heavily changed x509 instructure and TLS support on top.