GnuTLS is a secure communications library implementing the SSL, TLS and DTLS
protocols and technologies around them. It provides a simple C language
application programming interface (API) to access the secure communications
protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and
other required structures. It is aimed to be portable and efficient with
focus on security and interoperability.
===> The following configuration options are available for gnutls-3.8.13:
DANE=off: Certificate verification via DNSSEC
EXAMPLES=on: Build and/or install examples
IDN=on: International Domain Names support
KTLS=on: Enable support for in-kernel TLS
MAN3=on: Install API manpages (section 3)
NLS=on: Native Language Support
P11KIT=on: PKCS#11 and p11-kit support
SRP=off: Secure Remote Password support
===> Use 'make config' to modify these settings
security/gnutls: Update to 3.8.10
- Fetch ktls_utils.h missing from distfile, needed by tests.
- Support TLS 1.3 certificate compression with brotli and zstd.
security/gnutls: Fix RSAES-PKCS1-v1_5
Add upstream patch to fix RSAES-PKCS1-v1_5 when configuration file is
missing.
Pet portlint/portclippy/portfmt.
PR: 279571
security/gnutls: initialise libpthread
To ensure thread-safety libgnutls calls libpthread functions but to
avoid the overhead for single-threaded programs it does not link with
libpthread. It only calls libpthread if the executable or another
library links to it.
Since 3.8.0 libgnutls calls pthread_key_create from its init function
but because it does not link with libpthread libpthread might not have
been initialised yet. Patch the libgnutls init function so it
initialises libpthread.
PR: 278076
security/gnutls: Update to 3.8.5
Add SRP option. Upstream disabled it by default in 3.8.0
"because the SRP authentication in TLS is not up to date with
the latest TLS standards and its ciphersuites are based on
the CBC mode and SHA-1."
security/gnutls: fix build with lld 17
Since lld17 the default is to have the LDFLAGS --no-undefined-version
activated by default, which means that versions scripts should not
contain undefined symbols
2 bugs in gnutls:
1/ the configure scripts tests an empty binary against a list of version
symbols, meaning it breaks in configure (hence the activation of
--enable-ld-version-scripts) which means currently provided gnutls
packages are build without version scripts which breaks existing
installations...
2/ the version script used to link the binary can contain undefined
symbols depending on the options used to build (hence the addition of
the LDFLAGS.
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/gnutls: update to 3.7.4
Switch from security/ca_root_nss to base system certificate store.
Disable obsolete TPM 1.2 support.
PR: 257995, 260723, 263107, 263131
Exp-run by: antoine
Chase security/p11-kit update
After switch to meson libp11-kit.so no longer has symbols
in the LIBP11_KIT_1.0 namespace. As a workaround, bump
PORTREVISION of consumers to get those rebuilt.
See more details in the comments of the linked PR.
PR: 248819
Reported by: John Hein
security/gnutls: Add MAN3 option
There are over 1,000 man3 pages. This adds a MAN3 option to
control their installation, similar to the openssl and libressl
ports.
PR: 248841
Approved by: maintainer (tijl)
Bump PORTREVISION for ports depending on the canonical version of GCC
as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3
to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
- Prevent detection of autogen. It causes some files to be regenerated
and then they require a newer header than is provided with gnutls.
- Remove ZLIB option. It's no longer available.
PR: 237419
Reported by: Kevin Oberman <rkoberman@gmail.com>
- Let gnutls look for its configuration files in PREFIX/etc instead of /etc.
- Use --with-default-trust-store-file to set the location of the root
certificates so configure doesn't have to autodetect this and the
build dependency can be removed.
- Define TEST_TARGET.
- Remove DOCSDIR. The files are also in PREFIX/share/info.
- Use p11-kit-trust as the default PKCS#11 trust store.
PR: 235703
Reported by: mi
Install texinfo files (GNU info) into ${PREFIX}/share/info
After a discussion on the mailing list on moving manpages to
${PREFIX}/share/man for consistency with base where it is
installed in usr/share/man, it appeared the same should happen
to GNU info files which were installed under share in base and
not in ports.
Now texinfo is not in base on any of the supported version of FreeBSD
it is possible to proceed to this move and it is easier to do than
the manpage change.
Other benefit than consistency are less patching: all build tools but
cmake are expecting info files to be under share/info and cmake (patched here)
was having an exception for BSD so the patch makes FreeBSD case less
specific for them
Bump revision of all impacted ports
PR: 232907
exp-run by: antoine
Differential Revision: https://reviews.freebsd.org/D17816
Most commonly used build systems support silent builds, when they
hide actual commands executed and only show short summary line (like
"CC foo.c"). CMake and ninja enable this by default, some autotools
using ports do as well. This is unacceptable because we need complete
build logs at any time, so we now switch to verbose build logs
unconditionally. Note that this change deliberately affects ALL
builds and not only package builds on cluster, because we need to
be sure that user experiencing failure can always provide informative
build log regardless of settings and without rerunning the build.
Change summary:
- Always do verbose builds for cmake, ninja and GNU configure (the
latter includes check if --disable-silent-rules is actually supported
by the configure script; there are isolated cases when it's not true)
(Only the first 15 lines of the commit message are shown above )
Update to 3.4.12.
libpkcs11mock1.so is commented out in pkg-plist because it is part of the
testsuite and shouldn't be installed. This has been fixed upstream.
- Update security/gnutls to 3.4.10.
- Rename the LIBDANE option DANE because that's the name of the protocol
supported by libgnutls-dane and gnutls-cli. Also clarify the option
description.
- Add an IDN option.
- libgnutls-openssl has been removed in 3.4. Some ports used this library
in their LIB_DEPENDS but no port actually required it.
- Some old API functions have been removed. Ports that used these have been
updated or patched to use the new API.
- Add a patch to print/cups to prevent overlinking of libgnutls.so.
- Bump PORTREVISION on dependent ports.
net-im/jabber: This port used the old API to give users fine grained
control over which crypto algorithms were used via a configuration file.
It's not immediately obvious how to port this to the new API so the port
always uses the defaults now.
www/hydra: Mark BROKEN. This uses more removed calls than the other ports,
is said to be alpha quality and not fully functional and has been abandoned
10 years ago.
PR: 207768
Exp-run by: antoine
Approved by: portmgr (antoine)
- Update unbound to 1.5.7
- Bump PORTREVISIOn on dependent ports
Some Upgrade Notes:
This release fixes a validation failure for nodata with wildcards and
emptynonterminals. Fixes OpenSSL Library compability. Fixes correct
response for malformed EDNS queries. For crypto in libunbound there is
libnettle support.
Qname minimisation is implemented. Use qname-minimisation: yes to
enable it. This version sends the full query name when an error is
found for intermediate names. It should therefore not fail for names
on nonconformant servers. It combines well with
harden-below-nxdomain: yes because those nxdomains are probed by the
(Only the first 15 lines of the commit message are shown above )
Fix plist when LIBDANE is defined (PORTREVISION not bumped
because package wouldn't be successful in the case).
Pointy hat to: delphij
Reported by: sunpoet
MFH: 2015Q2
GnuTLS tries to use /usr/local/share/certs/ca-root-nss.crt. Instead of
maybe using it if it is already installed or if the P11KIT option is selected
(which depends on ca_root_nss), just always depend on ca_root_nss.
Reported by: Tatsuki Makino
dns/libidn:
- Add USES=libtool and bump dependent ports
- Add INSTALL_TARGET=install-strip
- Always install libidn-components.png because it is used by libidn.info
- Add -lintl to Libs.private instead of Libs in libidn.pc
- Switch dns/unbound to USES=libtool, drop .la files
- Bump dependent ports as .so version has changed
- While here, add LICENSE_FILE to dns/getdns
Approved by: portmgr blanket
security/gnutls: Support OPTIONal library dependencies
Factor out libidn, libp11-kit and libtspi into OPTIONal library
dependencies, with the CRYWRAP, P11KIT and TPM options respectively, as per
the upstream documentation [1].
Make ZLIB an OPTION because we can, and the choice to customise
compression support in security software (especially lately) may be
very useful for some consumers.
Add CRYWRAP, P11KIT, TPM and ZLIB to OPTIONS_DEFAULT to retain current
default functionality.
[1] http://gnutls.org/manual/html_node/Downloading-and-installing.html
Inspired by: Recent gnutls 2 -> 3 change, fan of minimal dependencies
PR: 192090
Submitted by: koobs
Approved by: maintainer
- Update security/libtasn1 to 4.0
- Add USES= libtool and set INSTALL_TARGET to install-strip
- Drop useless bsd.port.options.mk include
- Bump PORTREVISION of ports that depend on libtasn1 as
shlib version has changed
- Add an UPDATING entry for that
Exp-run by: antoine
