CVS commit: pkgsrc/security/hs-tls

["Masatake Daimon" <pho%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   pho
Date:           Sat Mar  8 05:10:18 UTC 2025

Modified Files:
        pkgsrc/security/hs-tls: Makefile buildlink3.mk distinfo
Added Files:
        pkgsrc/security/hs-tls/patches: patch-Network_TLS_Parameters.hs

Log Message:
security/hs-tls: Don't require RFC 7627 Extended Master Secret by default


To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 pkgsrc/security/hs-tls/Makefile \
    pkgsrc/security/hs-tls/buildlink3.mk
cvs rdiff -u -r1.9 -r1.10 pkgsrc/security/hs-tls/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/security/hs-tls/patches/patch-Network_TLS_Parameters.hs

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/hs-tls/Makefile
diff -u pkgsrc/security/hs-tls/Makefile:1.18 pkgsrc/security/hs-tls/Makefile:1.19
--- pkgsrc/security/hs-tls/Makefile:1.18        Wed Mar  5 03:39:50 2025
+++ pkgsrc/security/hs-tls/Makefile     Sat Mar  8 05:10:17 2025
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.18 2025/03/05 03:39:50 pho Exp $
+# $NetBSD: Makefile,v 1.19 2025/03/08 05:10:17 pho Exp $
 
 DISTNAME=      tls-2.1.7
-PKGREVISION=   2
+PKGREVISION=   3
 CATEGORIES=    security
 
 MAINTAINER=    pho%cielonegro.org@localhost
Index: pkgsrc/security/hs-tls/buildlink3.mk
diff -u pkgsrc/security/hs-tls/buildlink3.mk:1.18 pkgsrc/security/hs-tls/buildlink3.mk:1.19
--- pkgsrc/security/hs-tls/buildlink3.mk:1.18   Wed Mar  5 03:39:50 2025
+++ pkgsrc/security/hs-tls/buildlink3.mk        Sat Mar  8 05:10:17 2025
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.18 2025/03/05 03:39:50 pho Exp $
+# $NetBSD: buildlink3.mk,v 1.19 2025/03/08 05:10:17 pho Exp $
 
 BUILDLINK_TREE+=       hs-tls
 
@@ -6,7 +6,7 @@ BUILDLINK_TREE+=        hs-tls
 HS_TLS_BUILDLINK3_MK:=
 
 BUILDLINK_API_DEPENDS.hs-tls+= hs-tls>=2.1.7
-BUILDLINK_ABI_DEPENDS.hs-tls+= hs-tls>=2.1.7nb2
+BUILDLINK_ABI_DEPENDS.hs-tls+= hs-tls>=2.1.7nb3
 BUILDLINK_PKGSRCDIR.hs-tls?=   ../../security/hs-tls
 
 .include "../../devel/hs-asn1-encoding/buildlink3.mk"

Index: pkgsrc/security/hs-tls/distinfo
diff -u pkgsrc/security/hs-tls/distinfo:1.9 pkgsrc/security/hs-tls/distinfo:1.10
--- pkgsrc/security/hs-tls/distinfo:1.9 Thu Jan 30 11:10:36 2025
+++ pkgsrc/security/hs-tls/distinfo     Sat Mar  8 05:10:17 2025
@@ -1,5 +1,6 @@
-$NetBSD: distinfo,v 1.9 2025/01/30 11:10:36 pho Exp $
+$NetBSD: distinfo,v 1.10 2025/03/08 05:10:17 pho Exp $
 
 BLAKE2s (tls-2.1.7.tar.gz) = 0faee6a2b1fb6820de750e99fe3f4658a8a6a80600d6fe8f8338e29c4ffae743
 SHA512 (tls-2.1.7.tar.gz) = 0cb83f3220be33564c48a248633a5dae1c6b4c78134e465a397f0894f3e4e0134577bf5936fbabf4412cfcb9415d7fe36be3f057cd16e37da3dc1c186edb61ee
 Size (tls-2.1.7.tar.gz) = 172969 bytes
+SHA1 (patch-Network_TLS_Parameters.hs) = 12ae291a7306f9392b4216d361b6b2bb603e1874

Added files:

Index: pkgsrc/security/hs-tls/patches/patch-Network_TLS_Parameters.hs
diff -u /dev/null pkgsrc/security/hs-tls/patches/patch-Network_TLS_Parameters.hs:1.1
--- /dev/null   Sat Mar  8 05:10:18 2025
+++ pkgsrc/security/hs-tls/patches/patch-Network_TLS_Parameters.hs      Sat Mar  8 05:10:18 2025
@@ -0,0 +1,19 @@
+$NetBSD: patch-Network_TLS_Parameters.hs,v 1.1 2025/03/08 05:10:18 pho Exp $
+
+Don't require RFC 7627 Extended Master Secret by default. This patch is
+very regrettable. We really shouldn't do this. But, let's face the
+reality. Not all TLS 1.2 servers out there support RFC 7627. lang/elm
+especially suffers from this, because its package server doesn't support
+this extension.
+
+--- Network/TLS/Parameters.hs.orig     2025-03-08 04:58:15.060237703 +0000
++++ Network/TLS/Parameters.hs
+@@ -364,7 +364,7 @@ defaultSupported =
+         , supportedHashSignatures = Struct.supportedSignatureSchemes
+         , supportedSecureRenegotiation = True
+         , supportedClientInitiatedRenegotiation = False
+-        , supportedExtendedMainSecret = RequireEMS
++        , supportedExtendedMainSecret = AllowEMS
+         , supportedSession = True
+         , supportedFallbackScsv = True
+         , supportedEmptyPacket = True