CVS commit: pkgsrc/security/softhsm2

["Havard Eidnes" <he%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   he
Date:           Wed Nov  6 10:11:41 UTC 2019

Added Files:
        pkgsrc/security/softhsm2: DESCR Makefile PLIST buildlink3.mk distinfo
        pkgsrc/security/softhsm2/patches: patch-configure patch-configure.ac
            patch-src_lib_common_Makefile.in

Log Message:
Add SoftHSM version 2.5.0.

SoftHSM2 is not a drop-in replacement for SoftHSM version 1, so this
is added as a separate package.  See softhsm2-migrate(1) for
migration instructions.

Upstream changes since SoftHSM version 1.x:

SoftHSM 2.5.0 - 2018-09-24

* Issue #323: Support for EDDSA with vendor defined mechanisms.
  (Patch from Francis Dupont)
* Issue #362: CMake Build System Support for SoftHSM.
  (Patch from Constantine Grantcharov)
* Issue #368: Support migrating 32-bit SoftHSMv1 DB on 64-bit system (LP64).
* Issue #385: Default is not to build EDDSA since it has not been released in
  OpenSSL.
* Issue #387: Windows: Add VS2017 detection to Configure.py.
  (Patch from Jaroslav Imrich)
* Issue #412: Replace PKCS11 headers with a version from p11-kit.
  (Patch from Alexander Bokovoy)

Bugfixes:
* Issue #366: Support cross-compilation.
  (Patch from Michael Weiser)
* Issue #377: Duplicate symbol error with custom p11test.
* Issue #386: Use RDRAND in OpenSSL if that engine is available.
* Issue #388: Update DBTests.cpp to fix x86 test failure.
  (Patch from tcely)
* Issue #393: Not setting CKA_PUBLIC_KEY_INFO correctly.
  (Patch from pkalapat)
* Issue #401: Wrong key and keyserver mentioned in installation documentation.
  (Patch from Berry A.W. van Halderen)
* Issue #408: Remove mutex callbacks after C_Finalize().
  (Patch from Alexander Bokovoy)

SoftHSM 2.4.0 - 2018-02-27

* Issue #135: Support PKCS#8 for GOST.
* Issue #140: Support for CKA_ALLOWED_MECHANISMS.
  (Patch from Brad Hess)
* Issue #141: Support CKA_ALWAYS_AUTHENTICATE for private key objects.
* Issue #220: Support for CKM_DES3_CMAC and CKM_AES_CMAC.
* Issue #226: Configuration option for Windows build to enable build with
  static CRT (/MT).
* Issue #325: Support for CKM_AES_GCM.
* Issue #334: Document that initialized tokens will be reassigned to another
  slot (based on the token serial number).
* Issue #335: Support for CKM_RSA_PKCS_PSS.
  (Patch from Nikos Mavrogiannopoulos)
* Issue #341: Import AES keys with softhsm2-util.
  (Patch from Pavel Cherezov)
* Issue #348: Document that OSX needs pkg-config to detect cppunit.
* Issue #349: softhsm2-util will check the configuration and report any
  issues before loading the PKCS#11 library.

Bugfixes:
* Issue #345: Private objects are presented to security officer in search
  results.
* Issue #358: Race condition when multiple applications are creating and
  reading object files.

SoftHSM 2.3.0 - 2017-07-03

* Issue #130: Upgraded to PKCS#11 v2.40.
  * Minor changes to some return values.
  * Added CKA_DESTROYABLE to all objects. Used by C_DestroyObject().
  * Added CKA_PUBLIC_KEY_INFO to certificates, private, and public key
    objects. Will be accepted from application, but SoftHSM will
    currently not calculate it.
* Issue #142: Support for CKM_AES_CTR.
* Issue #155: Add unit tests for SessionManager.
* Issue #189: C_DigestKey returns CKR_KEY_INDIGESTIBLE when key
  attribute CKA_EXTRACTABLE = false. Whitelist SHA algorithms to allow
  C_DigestKey in this case.
* Issue #225: Show slot id after initialization.
* Issue #247: Run AppVeyor (Windows CI) for each PR and merge.
* Issue #257: Set CKA_DECRYPT/CKA_ENCRYPT flags on key import to true.
  (Patch from Martin Domke)
* Issue #261: Add support for libeaycompat lib for FIPS on Windows.
  (Patch from Matt Hauck)
* Issue #262: Support importing ECDSA P-521 in softhsm-util.
* Issue #276: Support for Botan 2.0.
* Issue #279: Editorial changes from Mountain Lion to Sierra.
  (Patch from Mike Neumann)
* Issue #283: More detailed error messages when initializing SoftHSM.
* Issue #285: Support for LibreSSL.
  (Patch from Alon Bar-Lev)
* Issue #286: Update .gitignore.
  (Patch from Alon Bar-Lev)
* Issue #291: Change to enable builds and reports on new Jenkinks
  environment.
* Issue #293: Detect cppunit in autoconf.
  (Patch from Alon Bar-Lev)
* Issue #309: CKO_CERTIFICATE and CKO_PUBLIC_KEY now defaults to
  CKA_PRIVATE=false.
* Issue #314: Update README with information about logging.
* Issue #330: Adjust log levels for failing to enumerate object store.
  (Patch from Nikos Mavrogiannopoulos)

Bugfixes:
* Issue #216: Better handling of CRYPTO_set_locking_callback() for OpenSSL.
* Issue #265: Fix deriving shared secret with ECC.
* Issue #280: HMAC with sizes less than L bytes is strongly discouraged.
  Set a lower bound equal to L bytes in ulMinKeySize and check it when
  initializing the operation.
* Issue #281: Fix test of p11 shared library.
  (Patch from Lars Silvén)
* Issue #289: Minor fix of 'EVP_CipherFinal_ex'.
  (Patch from Viktor Tarasov)
* Issue #297: Fix build with cppunit.
  (Patch from Ludovic Rousseau)
* Issue #302: Export PKCS#11 symbols from the library.
  (Patch from Ludovic Rousseau)
* Issue #305: Zero pad key to fit the block in CKM_AES_KEY_WRAP.
* Issue #313: Detecting CppUnit when using Macports.
  (Patch from mouse07410)

SoftHSM 2.2.0 - 2016-12-05

* Issue #143: Delete a token using softhsm2-util.
* Issue #185: Change access mode bits for /var/lib/softhsm/tokens/
  to 1777. All users can now create tokens, but only access their own.
  (Patch from Rick van Rein)
* Issue #186: Reinitializing a token will now keep the token, but all
  token objects are deleted, the user PIN is removed and the token
  label is updated.
* Issue #190: Support for OpenSSL 1.1.0.
* Issue #198: Calling C_GetSlotList with NULL_PTR will make sure that
  there is always a slot with an uninitialized token available.
* Issue #199: The token serial number will be used when setting the slot
  number. The serial number is set after the token has been initialized.
  (Patch from Lars Silvén)
* Issue #203: Update the command utils to use the token label or serial
  to find the token and its slot number.
* Issue #209: Possibility to test other PKCS#11 implementations with the
  CppUnit test.
  (Patch from Lars Silvén)
* Issue #223: Mark public key as non private by default.
  (Patch from Nikos Mavrogiannopoulos)
* Issue #230: Install p11-kit module, to disable use --disable-p11-kit.
  (Patch from David Woodhouse)
* Issue #237: Add windows continuous integration build.
  (Patch from Peter Polacko)

Bugfixes:
* Issue #201: Missing new source file and test configuration in the
  Windows build project.
* Issue #205: ECDSA P-521 support for OpenSSL and better test coverage.
* Issue #207: Fix segmentation faults in loadLibrary function.
  (Patch from Jaroslav Imrich)
* Issue #215: Update the Homebrew install notes for OSX.
* Issue #218: Fix build warnings.
* Issue #235: Add the libtool install command for OSX.
  (Patch from Mark Wylde)
* Issue #236: Use GetEnvironmentVariable instead of getenv on Windows.
  (Patch from Jaroslav Imrich)
* Issue #239: Crash on module unload with OpenSSL.
  (Patch from David Woodhouse)
* Issue #241: Added EXTRALIBS to Windows utils project.
  (Patch from Peter Polacko)
* Issue #250: C++11 not detected.
* Issue #255: API changes in Botan 1.11.27.
* Issue #260: Fix include guard to check WITH_FIPS.
  (Patch from Matt Hauck)
* Issue #268: p11test fails on 32-bit systems.
* Issue #270: Build warning about "converting a string constant".
* Issue #272: Fix C++11 check to look for unique_ptr.
  (Patch from Matt Hauck)

SoftHSM 2.1.0 - 2016-03-14

* Issue #136: Improved guide and build scripts for Windows.
  (Thanks to Jaroslav Imrich)
* Issue #144: The password prompt in softhsm2-util can now be
  interrupted (ctrl-c).
* Issue #166: Add slots.removable config option.
  (Patch from Sumit Bose)
* Issue #180: Windows configure script improvements.
  (Patch from Arnaud Grandville)

Bugfixes:
* Issue #128: Prioritize the return values in C_GetAttributeValue.
  (Patch from Nicholas Wilson)
* Issue #129: Fix errors reported by Visual Studio 2015.
  (Patch from Jaroslav Imrich)
* Issue #132: Handle the CKA_CHECK_VALUE correctly for certificates
  and symmetric key objects.
* Issue #154: Fix the Windows build and destruction order of objects.
  (Patch from Arnaud Grandville)
* Issue #162: Not possible to create certificate objects containing
  CKA_CERTIFICATE_CATEGORY, CKA_NAME_HASH_ALGORITHM, or
  CKA_JAVA_MIDP_SECURITY_DOMAIN.
* Issue #163: Do not attempt decryption of empty byte strings.
  (Patch from Michal Kepien)
* Issue #165: Minor changes after a PVS-Studio code analysis, and
  C_EncryptUpdate crash if no ciphered data is produced.
  (Patch from Arnaud Grandville)
* Issue #169: One-byte buffer overflow in call to EVP_DecryptUpdate.
* Issue #171: Problem while closing library that is initialized but
  improperly finalized.
* Issue #173: Adjust return values for the template parsing.
* Issue #174: C_DeriveKey() error with leading zero bytes.
* Issue #177: CKA_NEVER_EXTRACTABLE set to CK_FALSE on objects
  created with C_CreateObject.
* Issue #182: Resolve compiler warning.
  (Patch from Josh Datko)
* Issue #184: Stop discarding the global OpenSSL libcrypto state.
  (Patch from Michal Trojnara)
* SOFTHSM-123: Fix library cleanup on BSD.

SoftHSM 2.0.0 - 2015-07-17

* SOFTHSM-121: Test cases for C_DecryptUpdate/C_DecryptFinal.
* Support C_DecryptUpdate/C_DecryptFinal for symmetric algorithms.
  (Patch from Thomas Calderon)

Bugfixes:
* SOFTHSM-120: Segfault after renaming variables.

SoftHSM 2.0.0b3 - 2015-04-17

* SOFTHSM-113: Support for Botan 1.11.15
* SOFTHSM-119: softhsm2-util: Support ECDSA key import
  (Patch from Magnus Ahltorp)
* SUPPORT-139: Support deriving generic secrets, DES, DES2, DES3, and AES.
  Using DH, ECDH or symmetric encryption.

Bugfixes:
* SOFTHSM-108: A marked as trusted certificate cannot be imported.
* SOFTHSM-109: Unused parameter and variable warnings.
* SOFTHSM-110: subdir-objects warnings from autoreconf.
* SOFTHSM-111: Include FIPS-NOTES.md in dist.
* SOFTHSM-112: CKM_AES_KEY_WRAP* conflict in pkcs11.h.
* SOFTHSM-114: Fix memory leak in a test script.
* SOFTHSM-115: Fix static analysis warnings.
* SUPPORT-154: A marked as non-modifiable object cannot be generated.
* SUPPORT-155: auto_ptr is deprecated in C++11, use unique_ptr.
* SUPPORT-157: Derived secrets were truncated after encryption and
  could thus not be decrypted.
* Mutex should call MutexFactory wrapper functions.
  (Patch from Jerry Lundstrom)
* Return detailed error message to loadLibrary().
  (Patch from Petr Spacek)

SoftHSM 2.0.0b2 - 2014-12-28

* SOFTHSM-50: OpenSSL FIPS support.
* SOFTHSM-64: Updated build script for Windows.
* SOFTHSM-100: Use --free with softhsm2-util to initialize the first
  free token.
* SOFTHSM-103: Allow runtime configuration of log level.
* SOFTHSM-107: Support for CKM_<symcipher>_CBC_PAD.
* Add support for CKM_RSA_PKCS_OAEP key un/wrapping.
  (Patch from Petr Spacek)
* Use OpenSSL EVP interface for AES key wrapping.
  (Patch from Petr Spacek)
* Allow reading configuration file from user's home directory.
  (Patch from Nikos Mavrogiannopoulos)

Bugfixes:
* SOFTHSM-102: C_DeriveKey() uses OBJECT_OP_GENERATE.
* Coverity found a number of issues.

SoftHSM 2.0.0b1 - 2014-09-10

* SOFTHSM-84: Check that all mandatory attributes are given during
  the creation process.
* SOFTHSM-92: Enable -fvisibility=hidden on per default
* SUPPORT-137: Implement C_EncryptUpdate and C_EncryptFinal
  (Patch from Martin Paljak)
* Add support for CKM_RSA_PKCS key un/wrapping
  (Patch from Petr Spacek)

Bugfixes:
* SOFTHSM-66: Attribute handling when using multiple threads
* SOFTHSM-93: Invalid C++ object recycling.
* SOFTHSM-95: umask affecting the calling application.
* SOFTHSM-97: Check if Botan has already been initialized.
* SOFTHSM-98: Handle mandatory attributes for DSA, DH, and ECDSA
  correctly.
* SOFTHSM-99: Binary encoding of GOST values.
* SUPPORT-136: softhsm2-keyconv creates files with sensitive material
  in insecure way.

SoftHSM 2.0.0a2 - 2014-03-25

* SOFTHSM-68: Display a better configure message when there is a
  version of Botan with a broken ECC/GOST/OID implementation.
* SOFTHSM-70: Improved handling of the database backend.
* SOFTHSM-71: Supporting Botan 1.11.
* SOFTHSM-76: Do not generate RSA keys smaller than 1024 bit when
  using the Botan crypto backend.
* SOFTHSM-83: Support CKA_VALUE_BITS for CKK_DH private key object.
* SOFTHSM-85: Rename libsofthsm.so to libsofthsm2.so and prefix the
  command line utilties with softhsm2-.
* SOFTHSM-89: Use constants and not strings for signaling algorithms.
* SUPPORT-129: Possible to use an empty template in C_GenerateKey.
  The class and key type are inherited from the generation mechanism.
  Some mechanisms do however require a length attribute. [SOFTHSM-88]
* SUPPORT-131: Support RSA-PSS using SHA1, SHA224, SHA256, SHA384,
  or SHA512. [SOFTHSM-87]

Bugfixes:
* SOFTHSM-39: Fix 64 bit build on sparc sun4v.
* SOFTHSM-69: GOST did not work when you disabled ECC.
* SOFTHSM-78: Correct the attribute checks for a number of objects.
* SOFTHSM-80: Prevent segfault in OpenSSL GOST HMAC code.
* SOFTHSM-91: Fix a warning from static code analysis.
* Fixed a number of memory leaks.

SoftHSM 2.0.0a1 - 2014-02-10

This is the first alpha release of SoftHSMv2. It focuses on a higher
level of security by encrypting sensitive information and using
unswappable memory. There is also a more generalized crypto backend,
where you can use Botan or OpenSSL.


To generate a diff of this commit:
cvs rdiff -u -r0 -r1.1 pkgsrc/security/softhsm2/DESCR \
    pkgsrc/security/softhsm2/Makefile pkgsrc/security/softhsm2/PLIST \
    pkgsrc/security/softhsm2/buildlink3.mk pkgsrc/security/softhsm2/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/security/softhsm2/patches/patch-configure \
    pkgsrc/security/softhsm2/patches/patch-configure.ac \
    pkgsrc/security/softhsm2/patches/patch-src_lib_common_Makefile.in

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Added files:

Index: pkgsrc/security/softhsm2/DESCR
diff -u /dev/null pkgsrc/security/softhsm2/DESCR:1.1
--- /dev/null   Wed Nov  6 10:11:41 2019
+++ pkgsrc/security/softhsm2/DESCR      Wed Nov  6 10:11:41 2019
@@ -0,0 +1,4 @@
+SoftHSM is an implementation of a cryptographic store accessible through a
+PKCS#11 interface. You can use it to explore PKCS#11 without having a
+Hardware Security Module. It is being developed as a part of the OpenDNSSEC
+project. SoftHSM uses Botan for its cryptographic operations.
Index: pkgsrc/security/softhsm2/Makefile
diff -u /dev/null pkgsrc/security/softhsm2/Makefile:1.1
--- /dev/null   Wed Nov  6 10:11:41 2019
+++ pkgsrc/security/softhsm2/Makefile   Wed Nov  6 10:11:41 2019
@@ -0,0 +1,48 @@
+# $NetBSD: Makefile,v 1.1 2019/11/06 10:11:41 he Exp $
+#
+
+VERSION=       2.5.0
+DISTNAME=      softhsm-${VERSION}
+PKGNAME=       softhsm2-${VERSION}
+CATEGORIES=    security
+MASTER_SITES=  http://www.opendnssec.org/files/source/
+
+MAINTAINER=    he%NetBSD.org@localhost
+HOMEPAGE=      http://www.opendnssec.org/softhsm/
+COMMENT=       Cryptographic store accessible through a PKCS\#11 interface
+LICENSE=       2-clause-bsd
+
+BUILD_DEFS+=   VARBASE
+
+USE_LANGUAGES= c c++
+USE_LIBTOOL=   yes
+
+GNU_CONFIGURE=         yes
+CONFIGURE_ARGS+=       --localstatedir=${VARBASE}
+CONFIGURE_ARGS+=       --with-botan=${PREFIX}
+CONFIGURE_ARGS+=       --with-objectstore-backend-db
+CONFIGURE_ARGS+=       --with-migrate
+
+EGDIR=                 ${PREFIX}/share/examples/softhsm
+
+SUBST_CLASSES+=         paths
+SUBST_FILES.paths=      ${WRKSRC}/src/lib/common/Makefile.in
+SUBST_STAGE.paths=      pre-configure
+SUBST_VARS.paths=      EGDIR
+
+CXXFLAGS.NetBSD+=      -D_NETBSD_SOURCE
+# For debugging:
+CXXFLAGS+=             -g
+INSTALL_UNSTRIPPED=    YES
+
+CONF_FILES=            ${EGDIR}/softhsm2.conf ${PKG_SYSCONFDIR}/softhsm2.conf
+
+INSTALLATION_DIRS=     ${EGDIR} etc bin lib
+OWN_DIRS=              ${VARBASE}/softhsm
+
+pre-install:
+       ${INSTALL_DATA} ${WRKSRC}/src/lib/common/softhsm2.conf ${DESTDIR}${EGDIR}
+
+.include "../../databases/sqlite3/buildlink3.mk"
+.include "../../security/botan/buildlink3.mk"
+.include "../../mk/bsd.pkg.mk"
Index: pkgsrc/security/softhsm2/PLIST
diff -u /dev/null pkgsrc/security/softhsm2/PLIST:1.1
--- /dev/null   Wed Nov  6 10:11:41 2019
+++ pkgsrc/security/softhsm2/PLIST      Wed Nov  6 10:11:41 2019
@@ -0,0 +1,15 @@
+@comment $NetBSD: PLIST,v 1.1 2019/11/06 10:11:41 he Exp $
+bin/softhsm2-dump-db
+bin/softhsm2-dump-file
+bin/softhsm2-keyconv
+bin/softhsm2-migrate
+bin/softhsm2-util
+lib/softhsm/libsofthsm2.la
+man/man1/softhsm2-dump-db.1
+man/man1/softhsm2-dump-file.1
+man/man1/softhsm2-keyconv.1
+man/man1/softhsm2-migrate.1
+man/man1/softhsm2-util.1
+man/man5/softhsm2.conf.5
+share/examples/softhsm/softhsm2.conf
+@pkgdir etc
Index: pkgsrc/security/softhsm2/buildlink3.mk
diff -u /dev/null pkgsrc/security/softhsm2/buildlink3.mk:1.1
--- /dev/null   Wed Nov  6 10:11:41 2019
+++ pkgsrc/security/softhsm2/buildlink3.mk      Wed Nov  6 10:11:41 2019
@@ -0,0 +1,16 @@
+# $NetBSD: buildlink3.mk,v 1.1 2019/11/06 10:11:41 he Exp $
+
+BUILDLINK_TREE+=       softhsm2
+
+.if !defined(SOFTHSM2_BUILDLINK3_MK)
+SOFTHSM2_BUILDLINK3_MK:=
+
+BUILDLINK_API_DEPENDS.softhsm2+=       softhsm2>=2.0.0
+BUILDLINK_ABI_DEPENDS.softhsm2+=       softhsm2>=2.0.0
+BUILDLINK_PKGSRCDIR.softhsm2?= ../../security/softhsm2
+
+.include "../../databases/sqlite3/buildlink3.mk"
+.include "../../security/botan/buildlink3.mk"
+.endif # SOFTHSM2_BUILDLINK3_MK
+
+BUILDLINK_TREE+=       -softhsm2
Index: pkgsrc/security/softhsm2/distinfo
diff -u /dev/null pkgsrc/security/softhsm2/distinfo:1.1
--- /dev/null   Wed Nov  6 10:11:41 2019
+++ pkgsrc/security/softhsm2/distinfo   Wed Nov  6 10:11:41 2019
@@ -0,0 +1,9 @@
+$NetBSD: distinfo,v 1.1 2019/11/06 10:11:41 he Exp $
+
+SHA1 (softhsm-2.5.0.tar.gz) = 9b1072d9e12e1834e4f9518ec60a3e38aa92bc09
+RMD160 (softhsm-2.5.0.tar.gz) = 652beae56eb85bb864df45e89fcb1ddf84276d6d
+SHA512 (softhsm-2.5.0.tar.gz) = a1e686729196dc25591eb3da57c2c8ea8494ed274ba711842b2dcae696f477a202acda13a975b8fb1eb68e8e44a79e839dbbc6ba500cab02ad13072c660752d9
+Size (softhsm-2.5.0.tar.gz) = 1078439 bytes
+SHA1 (patch-configure) = 220881a76fa84e8ba6a81c902bdfd07bc6af88bd
+SHA1 (patch-configure.ac) = 5d1d5134e580f1310446da4323c0e1c65b6115de
+SHA1 (patch-src_lib_common_Makefile.in) = ca783cdfdb4d16eece5fd21d02033e71968d00c6

Index: pkgsrc/security/softhsm2/patches/patch-configure
diff -u /dev/null pkgsrc/security/softhsm2/patches/patch-configure:1.1
--- /dev/null   Wed Nov  6 10:11:41 2019
+++ pkgsrc/security/softhsm2/patches/patch-configure    Wed Nov  6 10:11:41 2019
@@ -0,0 +1,15 @@
+$NetBSD: patch-configure,v 1.1 2019/11/06 10:11:41 he Exp $
+
+Use /var/db not /var/lib, to adhere to NetBSD hier(7).
+
+--- configure.orig     2018-09-24 07:52:05.000000000 +0000
++++ configure
+@@ -8495,7 +8495,7 @@ full_sysconfdir=`eval eval eval eval eva
+ full_localstatedir=`eval eval eval eval eval echo "${localstatedir}" | sed "s#NONE#${prefix}#" | sed "s#NONE#${ac_default_prefix}#"`
+ full_libdir=`eval eval eval eval eval echo "${libdir}" | sed "s#NONE#${prefix}#" | sed "s#NONE#${ac_default_prefix}#"`
+ default_softhsm2_conf="`eval echo ${full_sysconfdir} | sed s,NONE,$ac_default_prefix,g`/softhsm2.conf"
+-softhsmtokendir=${full_localstatedir}/lib/softhsm/tokens/
++softhsmtokendir=${full_localstatedir}/db/softhsm/tokens/
+ 
+ # Install the library in a sub-directory
+ full_libdir="$full_libdir/softhsm"
Index: pkgsrc/security/softhsm2/patches/patch-configure.ac
diff -u /dev/null pkgsrc/security/softhsm2/patches/patch-configure.ac:1.1
--- /dev/null   Wed Nov  6 10:11:41 2019
+++ pkgsrc/security/softhsm2/patches/patch-configure.ac Wed Nov  6 10:11:41 2019
@@ -0,0 +1,15 @@
+$NetBSD: patch-configure.ac,v 1.1 2019/11/06 10:11:41 he Exp $
+
+Use /var/db not /var/lib, to adhere to NetBSD hier(7).
+
+--- configure.ac.orig  2018-09-24 07:50:22.000000000 +0000
++++ configure.ac
+@@ -126,7 +126,7 @@ full_sysconfdir=`eval eval eval eval eva
+ full_localstatedir=`eval eval eval eval eval echo "${localstatedir}" | sed "s#NONE#${prefix}#" | sed "s#NONE#${ac_default_prefix}#"`
+ full_libdir=`eval eval eval eval eval echo "${libdir}" | sed "s#NONE#${prefix}#" | sed "s#NONE#${ac_default_prefix}#"`
+ default_softhsm2_conf="`eval echo ${full_sysconfdir} | sed s,NONE,$ac_default_prefix,g`/softhsm2.conf"
+-softhsmtokendir=${full_localstatedir}/lib/softhsm/tokens/
++softhsmtokendir=${full_localstatedir}/db/softhsm/tokens/
+ 
+ # Install the library in a sub-directory
+ full_libdir="$full_libdir/softhsm"
Index: pkgsrc/security/softhsm2/patches/patch-src_lib_common_Makefile.in
diff -u /dev/null pkgsrc/security/softhsm2/patches/patch-src_lib_common_Makefile.in:1.1
--- /dev/null   Wed Nov  6 10:11:41 2019
+++ pkgsrc/security/softhsm2/patches/patch-src_lib_common_Makefile.in   Wed Nov  6 10:11:41 2019
@@ -0,0 +1,30 @@
+$NetBSD: patch-src_lib_common_Makefile.in,v 1.1 2019/11/06 10:11:41 he Exp $
+
+Install config in example directory.
+
+--- src/lib/common/Makefile.in.orig    2016-12-05 10:05:20.000000000 +0000
++++ src/lib/common/Makefile.in
+@@ -268,6 +268,7 @@ DUMPBIN = @DUMPBIN@
+ ECHO_C = @ECHO_C@
+ ECHO_N = @ECHO_N@
+ ECHO_T = @ECHO_T@
++EGDIR = @EGDIR@
+ EGREP = @EGREP@
+ EXEEXT = @EXEEXT@
+ FGREP = @FGREP@
+@@ -768,11 +769,10 @@ uninstall-man: uninstall-man5
+ 
+ 
+ install-data-hook:
+-      test -d ${DESTDIR}${sysconfdir} || \
+-              ${INSTALL} -d ${DESTDIR}${sysconfdir}
+-      test -f ${DESTDIR}${sysconfdir}/softhsm2.conf || \
+-              ${INSTALL_DATA} ${top_builddir}/src/lib/common/softhsm2.conf ${DESTDIR}${sysconfdir}
+-      ${INSTALL_DATA} ${top_builddir}/src/lib/common/softhsm2.conf ${DESTDIR}${sysconfdir}/softhsm2.conf.sample
++      test -d ${DESTDIR}${EGDIR} || \
++              ${INSTALL} -d ${DESTDIR}${EGDIR}
++      test -f ${DESTDIR}${EGDIR}/softhsm2.conf || \
++              ${INSTALL_DATA} ${top_builddir}/src/lib/common/softhsm2.conf ${DESTDIR}${EGDIR}
+       test -d ${DESTDIR}${softhsmtokendir} || \
+               ${INSTALL} -d -m 1777 ${DESTDIR}${softhsmtokendir}
+