Libgcrypt is a general purpose cryptographic library based on the code from
GnuPG.
It provides functions for all cryptographic building blocks: symmetric ciphers,
hash algorithms, MACs, public key algorithms, large integer functions,
random numbers and a lot of supporting functions.
===> The following configuration options are available for libgcrypt-1.12.4:
AVX512=off: Include AVX512 support for FreeBSD 14 and 15
DOCS=on: Build and/or install documentation
INFO=on: Build and/or install GNU info pages
STATIC=on: Build static executables and/or libraries
===> Use 'make config' to modify these settings
security/libgcrypt: Rephrase AVX512 description
It has been reported that the phrase "support for 14 and 15" is
ambiguous to some. Add "FreeBSD" to the description.
security/libgcrypt: Remove AVX512 support for FreeBSD 14 and 15
LLVM19 as shipped with FreeBSD 14 and 15 is incompete. Disable it by
default. Users who want AVX512 on FreeBSD < 16 must install LLVM20 or
newer and select the AVX512 option.
FreeBSD 16-CURRENT has LLVM21, with complete support for AVX512. Setting
the AVX512 option on 16-CURRENT is a NOP.
PR: 297987
security/libgcrypt: Fix build on older LLVM
According to dim@ LLVM20 was the first LLVM to properly support the
requried SM4-EVEX instruction set. Let's make sure we have the minimum
needed LLVM installed.
PR: 297987
Revert "security/libgcrypt: Fix build on hardware lacking SM4-EVEX"
The patch does in fact not fix the problem. dim@ suggests a minimum
of LLVM20.
PR: 297987
This reverts commit f5beaaec79ca9a6d8dee273b44febf82e56a91a0.
security/libgcrypt: Fix build on hardware lacking SM4-EVEX
The failure comes from cipher/sm4-intel-avx512-amd64.S, which uses the
EVEX-encoded (zmm) SM4 instructions. The base system assembler only
knows the VEX/ymm forms, and configure's SM4 probe only tests those, so
the AVX512 implementation is assembled anyway and breaks.
This patch extends the probe with the zmm forms, so the Intel SM4
assembly is disabled automatically where the assembler lacks SM4-EVEX.
GFNI-based SM4 and all other AVX512 code remain enabled, and the check
heals itself once LLVM gains these instructions.
PR: 297987
security/libgcrypt: Fix Curve25519 key validation
Starting with version 1.12.0, libgcrypt was failing to validate
Curve25519 secret keys on FreeBSD-main. This resulted in failures such
as in the example below. Incorporate the patch from
https://dev.gnupg.org/T8094 to fix the problem.
% TEMP_GPG=$(mktemp -d)
% GNUPGHOME=$TEMP_GPG gpg --batch --import < ./test/openpgp4-secret-key.asc
gpg: keybox '/tmp/tmp.gkqFaMAlVu/pubring.kbx' created
gpg: /tmp/tmp.gkqFaMAlVu/trustdb.gpg: trustdb created
gpg: key 7E6ABE924645CC60: public key "Notmuch Test Suite (INSECURE!)
<test_suite@notmuchmail.org>" imported
gpg: key 7E6ABE924645CC60: secret key imported
gpg: Total number processed: 1
(Only the first 15 lines of the commit message are shown above )
security/libgcrypt: Fix regression
In order to harvest the best entropy jitterentropy-base.c requires
that the compiler not optimize out any of its code. To ensure this
the cipher and randmom makefiles remove optmization options. This
will work in cases where the user has specified, for instance,
CFLAGS=-O3 but will not work when CFLAGS+=-O3 is specified. These
makefiles will only remove the first occurrence of the optimization
flag, resulting in a build failure. This patch alters the "munging"
sed command to remove all optimization options.
PR: 280081
MFH: 2024Q3
security/libgcrypt: Remove GNU_CONFIGURE_MANPREFIX
Now that manprefix has been moved we no longer need
GNU_CONFIGURE_MANPREFIX. Remove it.
PR: 279904
Submitted by: dizzy (part of a larger patch)
security/libgcrypt: Remove redundant USE_CSTD
USE=CSTD=gnu89 has not been needed for a while. Let's remove it.
PR: 279904
Submitted by: dizzy (part of a larger patch)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/libgcrypt: optionalize INFO
Allow the user to optionally exclude INFO files, allowing the space
conscious user the ability to install a minimual package. The default
remains to install INOF files as before.
PR: 259552
Reported by: Greg V <greg@unrelenting.technology>
Submitted by: Greg V <greg@unrelenting.technology>
security/libgcrypt: Make static an option
Static linked binaries, due to the fact that they're statically linked,
can pose a security risk should a library be updated and depending
software not be recompiled and linked. This was a hot topic on BUGTRAQ
about 25 years ago.
The default is to build static libraries so as not to alter the package
avoiding a POLA violation.
PR: 255735
Submitted by: Daniel Engberg <daniel.engberg.lists@pyret.net> (mostly)
Reported by: Daniel Engberg <daniel.engberg.lists@pyret.net>
Reviewed by: cy
Tested by: cy
MFH: 2021Q2
security/libgcrypt: Fix armv7 build
Similar to armv6, armv7 fails to build jitterentropy-base.c without
optimization, falling flat on the #pragma GCC optimize statement.
Like armv6, avoid building jitterentropy-base.c altogether.
PR: 253698
security/libgcrypt: Fix armv6 build
Armv6 fails to build jitterentropy-base.c without optimization,
even though #pragma GCC optimization and #pragma clang optimization
are specified. For now brute force disable building the jitter
entropy generator on armv6.
PR: 253698
Submitted by: yani _ pi-greece.eu
Reported by: yani _ pi-greece.eu
Install texinfo files (GNU info) into ${PREFIX}/share/info
After a discussion on the mailing list on moving manpages to
${PREFIX}/share/man for consistency with base where it is
installed in usr/share/man, it appeared the same should happen
to GNU info files which were installed under share in base and
not in ports.
Now texinfo is not in base on any of the supported version of FreeBSD
it is possible to proceed to this move and it is easier to do than
the manpage change.
Other benefit than consistency are less patching: all build tools but
cmake are expecting info files to be under share/info and cmake (patched here)
was having an exception for BSD so the patch makes FreeBSD case less
specific for them
Bump revision of all impacted ports
PR: 232907
exp-run by: antoine
Differential Revision: https://reviews.freebsd.org/D17816
security/libgcrypt: Update to 1.8.3 (bugfix)
- Improve comment in Makefile
- Provide more elaborate port description and update WWW in pkg-descr
Noteworthy changes in version 1.8.3
===================================
- Use blinding for ECDSA signing to mitigate a novel side-channel
attack. [#4011,CVE-2018-0495]
- Fix incorrect counter overflow handling for GCM when using an IV
size other than 96 bit. [#3764]
- Fix incorrect output of AES-keywrap mode for in-place encryption
(Only the first 15 lines of the commit message are shown above )
security/libgcrypt: update to 1.7.7
- Update libgcrypt to 1.7.7
- Silence all explicitly called commands
- Update WWW in pkg-descr: use https://
- Bump library version in pkg-plist
Noteworthy changes in version 1.7.7
* Bug fixes:
- Fix possible timing attack on EdDSA session key.
- Fix long standing bug in secure memory implementation which could
lead to a segv on free. [bug#3027].
PR: 219747
MFH: 2017Q2
Exp-run by: antoine
security/libgcrypt: update to 1.7.6
Noteworthy changes in version 1.7.6
* Bug fixes:
- Fix AES CTR self-check detected failure in the SSSE3 based
implementation.
- Remove gratuitous select before the getrandom syscall.
PR: 216305
MFH: 2017Q1
Exp-run by: antoine
security/libgcrypt: Update to 1.7.5
- Update to 1.7.5
- Remove files useless to install from DOCS
- Remove patch since sparc v8 is not supported on FreeBSD
- Bump library version in pkg-plist
Changelog:
https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000399.html
PR: 215236
Approved by: amdmi3 (mentor)
MFH: 2016Q4
Exp-run by: antoine
This patch fixes alignment of self-test context in salsa20 required
for amd64 implementation.
Other changes:
- Regenerate patches to make portlint(1) happy
- Update MAINTAINER to my @FreeBSD.org address
- Bump PORTREVISION
PR: 206919
Approved by: junovitch (mentor)
Add upstream commit to fix build errors with -pedantic.
This fixes at least devel/ccrtp's build on 9.3, which is currently broken:
In file included from ccrtp/crypto/gcrypt/gcrypthmac.cpp:23:
/usr/local/include/gcrypt.h:509: error: comma at end of enumerator list
/usr/local/include/gcrypt.h:1346: error: comma at end of enumerator list
Makefile:571: recipe for target 'gcrypthmac.lo' failed
MFH'ing this is not necessary, this bug is only present in libgcrypt 1.6.4.
PR: 205000
Approved by: maintainer timeout (15 days)
security/libgcrypt: Re-add missing patch
- This patch was removed when updating to 1.6.4, so the patch needs
to be put back in order to solve the bug 204399.
PR: 204600
Submitted by: Carlos J. Puga Medina <cpm@fbsd.es> (maintainer)
Enable the building and installation of the .a version of the library
for static linking. This affects emulators/qemu-user-static primarily
but will help anyone trying to statically link their applications.
Reviewed by: tijl cpm@fbsd.es (Maintainer)
MASTER_SITES cleanup.
- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.
While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.
Also, replace some EXTRACT_SUFX occurences with USES=tar:*.
Checked by: make fetch-urlall-list
With hat: portmgr
Sponsored by: Absolight
security/libgcrypt: 1.6.1 -> 1.6.2, bump depends
Changes:
- src/sexp.c (do_vsexp_sscan): Return error for invalid args.
- cipher/md.c (_gcry_md_info): Fix a segv in case of calling
with wrong parameters.
- cipher/primegen.c (_gcry_generate_elg_prime): Change to return an
error code, possible NULL deref in call to prime generator.
- cipher/dsa.c (generate): Take care of new return code.
- cipher/elgamal.c (generate): Change to return an error code. Take
care of _gcry_generate_elg_prime return code.
- ecc: Support the non-standard 0x40 compression flag for EdDSA.
- mpi: Extend the internal mpi_get_buffer.
- mpi: Fix regression for powerpc-apple-darwin detection.
- Fix bug inhibiting the use of the sentinel attribute in src/gcrypt.h.in
(Only the first 15 lines of the commit message are shown above )
security/libgcrypt: fix build with GCC on 8.x/amd64, 2nd attempt
Thanks to tijl@ for spotting the Makefile bug.
PR: 192555
Submitted by: Carlos Jacobo Puga Medina <cpm@fbsd.es>
Approved by: maintainer (timeout)
Bump PORTREVISION on more ports that depend on libgcrypt after the update
in r363436 and remove the UPDATING entry because it did not guarantee
that all ports were updated nor that they were updated in the right order.
Also remove libgcrypt.la again.
PR: 192342
Approved by: portmgr (implicit, bump unstaged ports)
When linking a library libA with a library libB using libtool, if libB.la
exists, libtool will add all libraries libB.la refers to (dependency_libs
field) to the linker command line and store them in the dependency_libs
field of libA.la. So everything that subsequently links with libA will also
link to these extra libraries. This causes too much overlinking.
This commit modifies Mk/Uses/libtool.mk so it empties the dependency_libs
field in .la libraries during staging. However, because .la libraries have
very limited use when dependency_libs is empty it makes sense to completely
remove them during staging.
So with this commit USES=libtool is modified to remove .la libraries and a
new form (USES=libtool:keepla) is introduced in case they need to be kept
(dependency_libs is still emptied).
(Only the first 15 lines of the commit message are shown above )
