CVS commit: pkgsrc/security/gnutls

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Aug  8 09:33:55 UTC 2023

Modified Files:
        pkgsrc/security/gnutls: Makefile PLIST distinfo
Removed Files:
        pkgsrc/security/gnutls/patches: patch-lib_system_certs.c

Log Message:
gnutls: updated to 3.8.1

Version 3.8.1 (released 2023-08-03)

** libgnutls: ClientHello extensions are randomized by default
   To make fingerprinting harder, TLS extensions in ClientHello
   messages are shuffled. As this behavior may cause compatibility
   issue with legacy applications that do not accept the last
   extension without payload, the behavior can be reverted with the
   %NO_SHUFFLE_EXTENSIONS priority keyword.

** libgnutls: Add support for RFC 9258 external PSK importer.
   This enables to deploy the same PSK across multiple TLS versions
   (TLS 1.2 and TLS 1.3) in a secure manner. To use, the application
   needs to set up a callback that formats the PSK identity using
   gnutls_psk_format_imported_identity().

** libgnutls: %GNUTLS_NO_EXTENSIONS has been renamed to
   %GNUTLS_NO_DEFAULT_EXTENSIONS.

** libgnutls: Add additional PBKDF limit checks in FIPS mode as
   defined in SP 800-132. Minimum salt length is 128 bits and
   minimum iterations bound is 1000 for PBKDF in FIPS mode.

** libgnutls: Add a mechanism to control whether to enforce extended
   master secret (RFC 7627). FIPS 140-3 mandates the use of TLS
   session hash (extended master secret, EMS) in TLS 1.2. To enforce
   this, a new priority keyword %FORCE_SESSION_HASH is added and if
   it is set and EMS is not set, the peer aborts the connection. This
   behavior is the default in FIPS mode, though it can be overridden
   through the configuration file with the "tls-session-hash" option.
   In either case non-EMS PRF is reported as a non-approved operation
   through the FIPS service indicator.

** New option --attime to specify current time.
   To make testing with different timestamp to the system easier, the
   tools doing certificate verification now provide a new option
   --attime, which takes an arbitrary time.

** API and ABI modifications:
gnutls_psk_client_credentials_function3: New typedef
gnutls_psk_server_credentials_function3: New typedef
gnutls_psk_set_server_credentials_function3: New function
gnutls_psk_set_client_credentials_function3: New function
gnutls_psk_format_imported_identity: New function
GNUTLS_PSK_KEY_EXT: New enum member of gnutls_psk_key_flags


To generate a diff of this commit:
cvs rdiff -u -r1.241 -r1.242 pkgsrc/security/gnutls/Makefile
cvs rdiff -u -r1.78 -r1.79 pkgsrc/security/gnutls/PLIST
cvs rdiff -u -r1.157 -r1.158 pkgsrc/security/gnutls/distinfo
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/gnutls/patches/patch-lib_system_certs.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/gnutls/Makefile
diff -u pkgsrc/security/gnutls/Makefile:1.241 pkgsrc/security/gnutls/Makefile:1.242
--- pkgsrc/security/gnutls/Makefile:1.241       Tue Jun  6 12:42:13 2023
+++ pkgsrc/security/gnutls/Makefile     Tue Aug  8 09:33:54 2023
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.241 2023/06/06 12:42:13 riastradh Exp $
+# $NetBSD: Makefile,v 1.242 2023/08/08 09:33:54 adam Exp $
 
-DISTNAME=      gnutls-3.8.0
-PKGREVISION=   3
+DISTNAME=      gnutls-3.8.1
 CATEGORIES=    security devel
 MASTER_SITES=  https://www.gnupg.org/ftp/gcrypt/gnutls/v${PKGVERSION_NOREV:R}/
 EXTRACT_SUFX=  .tar.xz
@@ -84,7 +83,7 @@ CONFIGURE_ARGS+=      --disable-hardware-acce
 .  endif
 .endif
 
-.if !empty(MACHINE_PLATFORM:MDarwin-*-aarch64)
+.if ${MACHINE_PLATFORM:MDarwin-*-aarch64}
 # don't assume GNU as(1) here
 BUILDLINK_TRANSFORM+=  rm:-Wa,-march=all
 .endif

Index: pkgsrc/security/gnutls/PLIST
diff -u pkgsrc/security/gnutls/PLIST:1.78 pkgsrc/security/gnutls/PLIST:1.79
--- pkgsrc/security/gnutls/PLIST:1.78   Tue Feb 14 16:45:21 2023
+++ pkgsrc/security/gnutls/PLIST        Tue Aug  8 09:33:54 2023
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.78 2023/02/14 16:45:21 wiz Exp $
+@comment $NetBSD: PLIST,v 1.79 2023/08/08 09:33:54 adam Exp $
 bin/certtool
 bin/gnutls-cli
 bin/gnutls-cli-debug
@@ -632,6 +632,7 @@ man/man3/gnutls_protocol_set_enabled.3
 man/man3/gnutls_psk_allocate_client_credentials.3
 man/man3/gnutls_psk_allocate_server_credentials.3
 man/man3/gnutls_psk_client_get_hint.3
+man/man3/gnutls_psk_format_imported_identity.3
 man/man3/gnutls_psk_free_client_credentials.3
 man/man3/gnutls_psk_free_server_credentials.3
 man/man3/gnutls_psk_server_get_username.3
@@ -640,10 +641,12 @@ man/man3/gnutls_psk_set_client_credentia
 man/man3/gnutls_psk_set_client_credentials2.3
 man/man3/gnutls_psk_set_client_credentials_function.3
 man/man3/gnutls_psk_set_client_credentials_function2.3
+man/man3/gnutls_psk_set_client_credentials_function3.3
 man/man3/gnutls_psk_set_params_function.3
 man/man3/gnutls_psk_set_server_credentials_file.3
 man/man3/gnutls_psk_set_server_credentials_function.3
 man/man3/gnutls_psk_set_server_credentials_function2.3
+man/man3/gnutls_psk_set_server_credentials_function3.3
 man/man3/gnutls_psk_set_server_credentials_hint.3
 man/man3/gnutls_psk_set_server_dh_params.3
 man/man3/gnutls_psk_set_server_known_dh_params.3

Index: pkgsrc/security/gnutls/distinfo
diff -u pkgsrc/security/gnutls/distinfo:1.157 pkgsrc/security/gnutls/distinfo:1.158
--- pkgsrc/security/gnutls/distinfo:1.157       Tue Feb 14 16:45:21 2023
+++ pkgsrc/security/gnutls/distinfo     Tue Aug  8 09:33:54 2023
@@ -1,7 +1,6 @@
-$NetBSD: distinfo,v 1.157 2023/02/14 16:45:21 wiz Exp $
+$NetBSD: distinfo,v 1.158 2023/08/08 09:33:54 adam Exp $
 
-BLAKE2s (gnutls-3.8.0.tar.xz) = 55bd4cb00bd6436a77565000e30099675c15b8752fc22c82ce24b1c6a2943692
-SHA512 (gnutls-3.8.0.tar.xz) = 2507b3133423fdaf90fbd826ccb1142e9ff6fc90fcd5531720218f19ddf0e6bbb8267d23bad35c0954860e5a4179da74823e0c8357db56a14f252e6ec9d59629
-Size (gnutls-3.8.0.tar.xz) = 6378480 bytes
+BLAKE2s (gnutls-3.8.1.tar.xz) = 60446b094b25207f8a77a88cc7aac1c6e6a643f6d7a8f50a677a4b5ee25a64c6
+SHA512 (gnutls-3.8.1.tar.xz) = 22e78db86b835843df897d14ad633d8a553c0f9b1389daa0c2f864869c6b9ca889028d434f9552237dc4f1b37c978fbe0cce166e3768e5d4e8850ff69a6fc872
+Size (gnutls-3.8.1.tar.xz) = 6447056 bytes
 SHA1 (patch-configure) = 866d8a365b8338348230e47518788f494279b139
-SHA1 (patch-lib_system_certs.c) = fba74b2834a36d66bddcd7d3405d0c91c1b14efc