CVS commit: pkgsrc/security/libgcrypt

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Fri Jan 30 14:01:25 UTC 2026

Modified Files:
        pkgsrc/security/libgcrypt: Makefile distinfo
        pkgsrc/security/libgcrypt/patches: patch-mpi_config.links
            patch-src_libgcrypt-config.in
Removed Files:
        pkgsrc/security/libgcrypt/patches: patch-cipher_aria.c
            patch-cipher_rijndael-arm.S patch-config.h.in patch-configure
            patch-src_visibility.h

Log Message:
libgcrypt: update to 1.12.0.

Noteworthy changes in version 1.12.0 (2026-01-29)  [C27/A7/R0]
-------------------------------------------------

 * New and extended interfaces:

   - Allow access to the FIPS service indicator via the new
     GCRYCTL_FIPS_SERVICE_INDICATOR control code.
     [T7338,rCd0db6a5abf,rCf51f4e9893]

   - Add GCRYCTL_FIPS_REJECT_NON_FIPS control code.  [T7338,rCe52adf0948]

   - Add GCRY_FIPS_FLAG_REJECT_PK_FLAGS constant.  [T7338,rC0414e126b9]

   - Make SHA-1 non-FIPS internally for the 1.12 API.  This introduces
     the GCRY_FIPS_FLAG_REJECT_MD_SHA1 constant.  [rC4ee91a94bc]

   - Add GCRY_FIPS_FLAG_REJECT_PK_FLAGS.  [rC0414e126b9]

   - Provide macros for each KEM enum constant.  [rCe9b1c3ec91]

   - Add Dilithium (ML-DSA) support.  [T7640]

   - Support optional random-override and support byte string data.
     [rCcbefff5fca,rC3bb4a54f43]

 * Performance:

   - Add VAES/AVX512 accelerated implementation for AES which boosts
     OCB performance by about 2 times on AMD Zen5.  [rC9e3af928ee]

   - Avoid AVX512/AVX2/SSSE3 for single block processing with Zen5 for
     ChaCha20.  [rCc1d9fff3b2]

   - Avoid AVX/AVX2/AVX512 when CPU has high vector inst latency like
     Zen5 for Blake2.  [rCe5bc3b2826]

   - Various optimizations for Camellia.
     [rCf5848080d4,rCb9bafd6c6c,rC8b538a8c76]

   - Add POLYVAL acceleration for RISC-V and GCM-SIV.  [rC00815c4207]

   - Add RISC-V Zbb+Zbc implementation of CRC.  [rCab4fa2a19c]

   - Add RISC-V vector cryptography implementation of GHASH.
     [rCcc2a4b6388]

   - Add RISC-V vector cryptography implementation of AES.
     [rCb000ab6025]

   - Add RISC-V vector cryptography implementations of SHA256 and
     SHA512.  [rCcc1d5b0b5e]

   - Add AVX2 and AVX512 code paths to improve CRC.  [rCc30788969d]

 * Bug fixes:

   - Use secure MPI in _gcry_mpi_assign_limb_space.  [rC6e77b09cff]

   - Use CSIDL_COMMON_APPDATA instead of /etc on Windows.  [rCd5e3cbfd88]

   - Apply a Kyber patch from upstream.  [rCbdc3724d72]

   - Fix an edge case in Jent initialization.  [rC0ceca9993f]

   - mceliece6688128f: Fix stack overflow crash on win64/wine
     [rC5bd9320171]

 * Other:

  - Add support for IBM z/OS, fixing -lpthread check with glibc.
    [rC5af59d8454]

  - Introduce mpi_tfr and use it for point_tfr to decrease EM signal
    and increase EM noise.  [rC4e65996bb8]

  - Handle HAVE_BROKEN_MLOCK for the case of building with ASAN.
    [T7889]

  - Harden mask generation against branch optimization for several
    algorithms.  [e.g. rC4012e9a037,rCbf7546c502,rC052b03fb0c]

  - Improve constant-time operation for ECDSA.  [T7519,rC0bd4c77be6]


To generate a diff of this commit:
cvs rdiff -u -r1.121 -r1.122 pkgsrc/security/libgcrypt/Makefile
cvs rdiff -u -r1.103 -r1.104 pkgsrc/security/libgcrypt/distinfo
cvs rdiff -u -r1.2 -r0 pkgsrc/security/libgcrypt/patches/patch-cipher_aria.c \
    pkgsrc/security/libgcrypt/patches/patch-config.h.in \
    pkgsrc/security/libgcrypt/patches/patch-src_visibility.h
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/libgcrypt/patches/patch-cipher_rijndael-arm.S
cvs rdiff -u -r1.13 -r0 pkgsrc/security/libgcrypt/patches/patch-configure
cvs rdiff -u -r1.4 -r1.5 \
    pkgsrc/security/libgcrypt/patches/patch-mpi_config.links
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/security/libgcrypt/patches/patch-src_libgcrypt-config.in

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/libgcrypt/Makefile
diff -u pkgsrc/security/libgcrypt/Makefile:1.121 pkgsrc/security/libgcrypt/Makefile:1.122
--- pkgsrc/security/libgcrypt/Makefile:1.121    Tue Aug  5 06:08:38 2025
+++ pkgsrc/security/libgcrypt/Makefile  Fri Jan 30 14:01:24 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.121 2025/08/05 06:08:38 adam Exp $
+# $NetBSD: Makefile,v 1.122 2026/01/30 14:01:24 wiz Exp $
 
-DISTNAME=      libgcrypt-1.11.2
+DISTNAME=      libgcrypt-1.12.0
 CATEGORIES=    security
 MASTER_SITES=  ${MASTER_SITE_GNUPG:=libgcrypt/}
 EXTRACT_SUFX=  .tar.bz2

Index: pkgsrc/security/libgcrypt/distinfo
diff -u pkgsrc/security/libgcrypt/distinfo:1.103 pkgsrc/security/libgcrypt/distinfo:1.104
--- pkgsrc/security/libgcrypt/distinfo:1.103    Fri Jan  9 19:26:56 2026
+++ pkgsrc/security/libgcrypt/distinfo  Fri Jan 30 14:01:24 2026
@@ -1,12 +1,7 @@
-$NetBSD: distinfo,v 1.103 2026/01/09 19:26:56 nia Exp $
+$NetBSD: distinfo,v 1.104 2026/01/30 14:01:24 wiz Exp $
 
-BLAKE2s (libgcrypt-1.11.2.tar.bz2) = fa7f567dc55b97302991972de130b85737ebb48c115f432d06a0be8a24926049
-SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
-Size (libgcrypt-1.11.2.tar.bz2) = 4237802 bytes
-SHA1 (patch-cipher_aria.c) = dcb6dc45ca601237191ffb8b6b9a0774fe543583
-SHA1 (patch-cipher_rijndael-arm.S) = ef3cb7f481022440780eb48ae31cbfad0a3ec115
-SHA1 (patch-config.h.in) = 93dddd3db484230f23450aa9d02564fe11efbc6b
-SHA1 (patch-configure) = d9cd7509ffa682104703b3aa626a4cd5751ebdfe
-SHA1 (patch-mpi_config.links) = 0e87480ead46914653405bb9c693554180ccd126
-SHA1 (patch-src_libgcrypt-config.in) = 60b3f4453b217ed8879a2ffd8d485c0195ffb5f8
-SHA1 (patch-src_visibility.h) = 8cbbf6803ab34b4b7dda832aa8ee18247aa89518
+BLAKE2s (libgcrypt-1.12.0.tar.bz2) = 8e8c265bd087638c042cc6563a664436e4b208e15b8e93c58b801f9abd26685a
+SHA512 (libgcrypt-1.12.0.tar.bz2) = 9421461297bd79b14f94d1ab275c3ed93b5d433531915c5cc7a718a94d32978a46feccb7a33fe63a60780ff00d465fbe1fe9ada5c250cf6d10a525c246c63d1c
+Size (libgcrypt-1.12.0.tar.bz2) = 4438947 bytes
+SHA1 (patch-mpi_config.links) = 1bb6bd677b0c7519fe14672bba0adc8c99c8e09f
+SHA1 (patch-src_libgcrypt-config.in) = 2b791d7ebe51c52ece864b23dcbeae5354701263

Index: pkgsrc/security/libgcrypt/patches/patch-mpi_config.links
diff -u pkgsrc/security/libgcrypt/patches/patch-mpi_config.links:1.4 pkgsrc/security/libgcrypt/patches/patch-mpi_config.links:1.5
--- pkgsrc/security/libgcrypt/patches/patch-mpi_config.links:1.4        Sat Jun 19 11:17:53 2021
+++ pkgsrc/security/libgcrypt/patches/patch-mpi_config.links    Fri Jan 30 14:01:24 2026
@@ -1,10 +1,12 @@
-$NetBSD: patch-mpi_config.links,v 1.4 2021/06/19 11:17:53 spz Exp $
+$NetBSD: patch-mpi_config.links,v 1.5 2026/01/30 14:01:24 wiz Exp $
 
 Extend the m68k assembler syntax probe to match NetBSD targets.
 
 (...probably should just make ELF_SYNTAX the default for pkgsrc, but
 not now)
 
+https://dev.gnupg.org/T8069
+
 --- mpi/config.links~  2021-01-28 12:53:52.000000000 +0000
 +++ mpi/config.links
 @@ -279,6 +279,18 @@ case "${host}" in

Index: pkgsrc/security/libgcrypt/patches/patch-src_libgcrypt-config.in
diff -u pkgsrc/security/libgcrypt/patches/patch-src_libgcrypt-config.in:1.1 pkgsrc/security/libgcrypt/patches/patch-src_libgcrypt-config.in:1.2
--- pkgsrc/security/libgcrypt/patches/patch-src_libgcrypt-config.in:1.1 Fri May  9 14:05:32 2025
+++ pkgsrc/security/libgcrypt/patches/patch-src_libgcrypt-config.in     Fri Jan 30 14:01:24 2026
@@ -1,13 +1,13 @@
-$NetBSD: patch-src_libgcrypt-config.in,v 1.1 2025/05/09 14:05:32 adam Exp $
+$NetBSD: patch-src_libgcrypt-config.in,v 1.2 2026/01/30 14:01:24 wiz Exp $
 
 Add rpath to configure script.
 
---- src/libgcrypt-config.in.orig       2008-08-19 17:20:04.000000000 +0200
+--- src/libgcrypt-config.in.orig       2025-09-23 13:14:23.000000000 +0000
 +++ src/libgcrypt-config.in
-@@ -155,7 +155,7 @@ if test "$echo_libs" = "yes"; then
+@@ -167,7 +167,7 @@ if test "$echo_libs" = "yes"; then
  
      # Set up `libdirs'.
-     if test "x$libdir" != "x/usr/lib" -a "x$libdir" != "x/lib"; then
+     if test "x$libdir" != "x/usr/lib" && test "x$libdir" != "x/lib"; then
 -      libdirs="-L$libdir"
 +      libdirs="-L$libdir @COMPILER_RPATH_FLAG@@libdir@"
      fi