Botan is a crypto library written in C++. It provides a variety of
cryptographic algorithms, including common ones such as AES, MD5, SHA,
HMAC, RSA, Diffie-Hellman, DSA, and ECDSA, as well as many others that
are more obscure or specialized. It also offers X.509v3 certificates
and CRLs, and PKCS #10 certificate requests. A message processing
system that uses a filter/pipeline metaphor allows for many common
cryptographic tasks to be completed with just a few lines of code.
Assembly optimizations for common CPUs, including x86, x86-64, and
PowerPC, offers further speedups for critical tasks such as SHA-1
hashing and multiple precision integer operations.
Botan is licensed under the same permissive terms as FreeBSD itself.
===> The following configuration options are available for botan2-2.19.5_5:
DOCS=on: Build and/or install documentation
MANPAGES=on: Build and/or install manual pages
OPENMP=on: Parallel processing support via OpenMP
PYTHON=off: Python bindings or support
SQLITE3=off: SQLite 3 database support
===> Use 'make config' to modify these settings
security/botan2: Remove expired port
2025-03-31 security/botan2: End of life 2024-12-31 upstream, consider migrating
to security/botan3
With keepass286 moved to botan3 and softhsm2 using OpenSSL by default,
we can strip softhsm2's botan2 non-default option and remove botan2 from
the tree.
security/botan2: Fix CVE-2024-50383 (+)
Backport upstream fix: make additions be constant time
Fixes vulnerability CVE-2024-50383
While here, prepare for upcoming retire of Boost.System library which is stub
since Boost-1.70
security/botan2: prepare for boost-1.87 (+)
While here, also take upstream commits for:
* Backport: Update roughtime.cloudflare.com public key and port
* Remove code relying on Python distutils
security/botan2: Deprecate and set expiration date to 2025-01-31
End of life 2024-12-31 upstream, point users to security/botan3
Reference:
https://botan.randombit.net/#releases
PR: 281977
Approved by: portmgr (maintainter timeout, 2+ weeks)
security/botan2: update to 2.19.5 release (+)
What's new:
* A reminder that Botan2 reaches end of life at the end of 2024
* CVE-2024-34702: Fix a DoS caused by excessive name constraints. (GH #4187)
* CVE-2024-39312: Fix a name constraint processing error, where if permitted and
excluded rules both applied to a certificate, only the permitted rules would be
checked. (GH #4187)
* Fix a crash in OCB (GH #3812 #3924)
* During certificate verification, first verify the entire chain of
certificates, then perform other validation. (GH #4052 #4045)
* Fix a test failure in compression with certain versions of zlib (GH #4135
#3896)
* Fix some iterator debugging errors in TLS CBC decryption. (GH #4125 #4130)
* Avoid a miscompilation in ARIA when using XCode 14 (GH #3465 #3492 #4053)
Full chamgelog: https://botan.randombit.net/news.html#version-2-19-5-2024-07-08
all: remove explicit versions in USES=python for "3.x+"
The logic in USES=python will automatically convert this to 3.8+ by
itself.
Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.
finance/quickfix: mark BROKEN with PYTHON
libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++
-DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable
-Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong
-fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi
-Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings
-Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x
-MT _quickfix_la-QuickfixPython.lo -MD -MP -MF
.deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o
.libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean
'-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
^~~~~~~~~~
1 warning and 1 error generated.
Reviewed by: portmgr, vishwin, yuri
Differential Revision: <https://reviews.freebsd.org/D40568>
security/botan2: update to 2.19.3 security release (+)
A malicious OCSP responder could forge OCSP responses due to a failure
to validate that an embedded certificate was issued by the end-entity
issuing certificate authority.
Security: CVE-2022-43705
MFH: 2022Q4
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
compiler: use CHOSEN_COMPILER_TYPE instead of COMPILER_TYPE
CHOSEN_COMPILER_TYPE is the only safe variable to let a port know which
typer of compiler has been elected to be used by the framework
PR: 199098
security/botan2: fix build on powerpc64
aes_power8.cpp needs VSX too apart from crypto:
src/lib/block/aes/aes_power8/aes_power8.cpp:43:49: error: use of undeclared
identifier 'vec_vsx_ld'
return (Altivec64x2)reverse_vec((Altivec8x16)vec_vsx_ld(0, key));;
^
src/lib/block/aes/aes_power8/aes_power8.cpp:48:36: error: use of undeclared
identifier 'vec_vsx_ld'
return (Altivec64x2)reverse_vec(vec_vsx_ld(0, src));
- Update to 2.17.2
- Fix building in presence of older version of botan2 installed in the system by
importing upstream patch
PR: 251106
Submitted by: tremere@cainites.net (maintainer)
Reported by: amdmi3, acupuncture@cgocable.ca, fastmint@hush.com
security/botan2: update to 2.14.0 maintenance release
Since 2.14.0 release, ABI version number != shlib minor version number
PR: 245477
Submitted by: fluffy
Approved by: maintainer
Relnotes: https://botan.randombit.net/news.html
security/botan2: update to 2.13.0 release
* Fix a bug introduced in 2.12.0 where TLS::Channel::is_active and
TLS::Channel::is_closed
could simultaneously return true. (GH #2174 #2171)
* Use std::shared_ptr instead of boost::shared_ptr in some examples. (GH #2155)
* Add Roughtime client (GH #2143 #1842)
* Add support for XMSS X.509 certificates (GH #2172)
* Add support for X.509 CRLs in FFI layer and Python wrapper (GH #2213)
https://botan.randombit.net/news.html
PR: 243239
Submitted by: maintainer
Approved by: maintainer
MFH: 2020Q1
security/botan2: fix build on powerpc64
This port detects architecture based on uname -m and on powerpc64 it prints
powerpc, which makes configure script thinks it builds on 32-bit powerpc and
causes error because the compiler is configured for 64-bits.
Explicitly configure as ppc64 on powerpc64.
PR: 241375
Approved by: tremere@cainites.net (maintainer), linimon (mentor)
Bump PORTREVISION for ports depending on the canonical version of GCC
as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3
to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
security/botan2: reduce SOVERSION churn
ABI isn't compatible between minor updates, so SONAME changes very
frequently which requires rebuilding consumers.
PR: 237019
Submitted by: Ralf van der Enden (maintainer)
security/botan2: lift BROKEN on armv7
botan2 builds fine on armv7 down to 2.4.0 but before that all non-x86
were broken (including aarch64) due to missing HAS_RDRAND_RNG conditional.
Pointy hat to: linimon (for using 2.3.0 error logs to mark 2.4.0)
Bump PORTREVISION for ports depending on the canonical version of GCC
defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t
GCC 8.2 under most circumstances.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.
PR: 231590
security/botan2: update to 2.7.0
While here, bump PORTREVISION on dependent ports
PR: 230666
Submitted by: Ralf van der Enden <tremere@cainites.net> (maintainer
MFH: 2018Q3
Security: 7762d7ad-2e38-41d2-9785-c51f653ba8bd
Bump PORTREVISION for ports depending on the canonical version of GCC
in the ports tree (via Mk/bsd.default-versions.mk and lang/gcc) which
has now moved from GCC 6 to GCC 7 by default.
This includes ports
- featuring USE_GCC=yes or USE_GCC=any,
- featuring USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and those
- with USES=compiler specifying one of openmp, nestedfct, c11, c++0x,
c++11-lib, c++11-lang, c++14-lang, c++17-lang, or gcc-c++11-lib.
PR: 222542
Update to 2.6.0
Bugfixes and some new features. Most notable fix:
- CVE-2018-9860 Fix a bug decrypting TLS CBC ciphertexts which could
for a malformed ciphertext cause the decryptor to read and HMAC an
additional 64K bytes of data which is not part of the record. This
could cause a crash if the read went into unmapped memory. No
information leak or out of bounds write occurs.
PR: 227455
Submitted by: maintainer
Update security/botan2 to 2.4.0
- Fix build on aarch64
- While I'm here:
- Strip shared library in post-install:
- Do not silence installation message
- Bump PORTREVISION of dependent ports for shlib change
Changes: https://botan.randombit.net/news.html
PR: 225085
Submitted by: Ralf van der Enden <tremere@cainites.net> (maintainer)
Mark more recently failing ports broken on aarch64.
While here, pet portlint and reformat some other BROKEN statements.
Approved by: portmgr (tier-2 blanket)
New port: security/botan2: Portable, easy to use and efficient C++ crypto
library
PR: 223199
Submitted by: Ralf van der Enden <tremere@cainites.net>
Reviewed by: tcberner (mentor)
Differential Revision: https://reviews.freebsd.org/D13043
