CVS commit: pkgsrc/security/gnutls

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Feb 12 08:33:23 UTC 2025

Modified Files:
        pkgsrc/security/gnutls: Makefile distinfo
Removed Files:
        pkgsrc/security/gnutls/patches: patch-lib_algorithms_groups.c

Log Message:
gnutls: updated to 3.8.9

Version 3.8.9 (released 2025-02-07)

** libgnutls: leancrypto was added as an interim option for PQC
   The library can now be built with leancrypto instead of liboqs for
   post-quantum cryptography (PQC), when configured with
   --with-leancrypto option instead of --with-liboqs.

** libgnutls: Experimental support for ML-DSA signature algorithm
   The library and certtool now support ML-DSA signature algorithm as
   defined in FIPS 204 and based on
   draft-ietf-lamps-dilithium-certificates-04. This feature is
   currently marked as experimental and can only be enabled when
   compiled with --with-leancrypto or --with-liboqs.
   Contributed by David Dudas.

** libgnutls: Support for ML-KEM-1024 key encapsulation mechanism
   The support for ML-KEM post-quantum key encapsulation mechanisms
   has been extended to cover ML-KEM-1024, in addition to ML-KEM-768.
   MLKEM1024 is only offered as SecP384r1MLKEM1024 hybrid as per
   draft-kwiatkowski-tls-ecdhe-mlkem-03.

** libgnutls: Fix potential DoS in handling certificates with numerous name
   constraints, as a follow-up of CVE-2024-12133 in libtasn1. The
   bundled copy of libtasn1 has also been updated to the latest 4.20.0
   release to complete the fix.
   [GNUTLS-SA-2025-02-07, CVSS: medium] [CVE-2024-12243]

** API and ABI modifications:
GNUTLS_PK_MLDSA44: New enum member of gnutls_pk_algorithm_t
GNUTLS_PK_MLDSA65: New enum member of gnutls_pk_algorithm_t
GNUTLS_PK_MLDSA87: New enum member of gnutls_pk_algorithm_t
GNUTLS_SIGN_MLDSA44: New enum member of gnutls_sign_algorithm_t
GNUTLS_SIGN_MLDSA65: New enum member of gnutls_sign_algorithm_t
GNUTLS_SIGN_MLDSA87: New enum member of gnutls_sign_algorithm_t


To generate a diff of this commit:
cvs rdiff -u -r1.264 -r1.265 pkgsrc/security/gnutls/Makefile
cvs rdiff -u -r1.166 -r1.167 pkgsrc/security/gnutls/distinfo
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/gnutls/patches/patch-lib_algorithms_groups.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/gnutls/Makefile
diff -u pkgsrc/security/gnutls/Makefile:1.264 pkgsrc/security/gnutls/Makefile:1.265
--- pkgsrc/security/gnutls/Makefile:1.264       Tue Jan  7 20:12:53 2025
+++ pkgsrc/security/gnutls/Makefile     Wed Feb 12 08:33:23 2025
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.264 2025/01/07 20:12:53 riastradh Exp $
+# $NetBSD: Makefile,v 1.265 2025/02/12 08:33:23 adam Exp $
 
-DISTNAME=      gnutls-3.8.8
-PKGREVISION=   4
+DISTNAME=      gnutls-3.8.9
 CATEGORIES=    security devel
 MASTER_SITES=  https://www.gnupg.org/ftp/gcrypt/gnutls/v${PKGVERSION_NOREV:R}/
 EXTRACT_SUFX=  .tar.xz

Index: pkgsrc/security/gnutls/distinfo
diff -u pkgsrc/security/gnutls/distinfo:1.166 pkgsrc/security/gnutls/distinfo:1.167
--- pkgsrc/security/gnutls/distinfo:1.166       Mon Nov 11 02:03:54 2024
+++ pkgsrc/security/gnutls/distinfo     Wed Feb 12 08:33:23 2025
@@ -1,7 +1,6 @@
-$NetBSD: distinfo,v 1.166 2024/11/11 02:03:54 gutteridge Exp $
+$NetBSD: distinfo,v 1.167 2025/02/12 08:33:23 adam Exp $
 
-BLAKE2s (gnutls-3.8.8.tar.xz) = 7601a4d3ca0f1372f9525be85fe81f3f4b2a84485a9216105b9b9385024769d6
-SHA512 (gnutls-3.8.8.tar.xz) = 4f617c63e8e8392e400d72c9e39989fcd782268b4a4c4e36bbfb0444a4b5bcb0f53054f04a6dce99ab89c0f38f57430c95aaaec6eb9209b8e9329140abf230c3
-Size (gnutls-3.8.8.tar.xz) = 6696460 bytes
+BLAKE2s (gnutls-3.8.9.tar.xz) = 17ff18b116978c860a1b01cfa2f14ab35afa731b67c6cb3c7c28be000930d01e
+SHA512 (gnutls-3.8.9.tar.xz) = b3b201671bf4e75325610a0291d4cd36a669718e22b3685246b64bde97b5bd94f463ab376ed817869869714115f4ff11bdc53c32604bb04a8ff8e10daa6d1fc7
+Size (gnutls-3.8.9.tar.xz) = 6847364 bytes
 SHA1 (patch-configure) = 866d8a365b8338348230e47518788f494279b139
-SHA1 (patch-lib_algorithms_groups.c) = d26d8b46f70059c42c19247bbffeb5bd2b8c8a01