CVS commit: pkgsrc/security/gnutls

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Feb 14 16:45:21 UTC 2023

Modified Files:
        pkgsrc/security/gnutls: Makefile PLIST distinfo
        pkgsrc/security/gnutls/patches: patch-configure

Log Message:
gnutls: update to 3.8.0.

* Version 3.8.0 (unreleased 2023-02-09)

** libgnutls: Fix a Bleichenbacher oracle in the TLS RSA key exchange.
   Reported by Hubert Kario (#1050). Fix developed by Alexander Sosedkin.
   [GNUTLS-SA-2020-07-14, CVSS: medium] [CVE-2023-0361]

** libgnutls: C++ library is now header only. All definitions from
   gnutlsxx.c have been moved into gnutlsxx.h. Users of the C++
   interface have two options:
   1. include gnutlsxx.h in their application and link against
      the C library. (default)
   2. include gnutlsxx.h in their application, compile with
      GNUTLS_GNUTLSXX_NO_HEADERONLY macro defined and link
      against the C++ library.

** libgnutls: GNUTLS_NO_STATUS_REQUEST flag and %NO_STATUS_REQUEST
   priority modifier have been added to allow disabling of the
   status_request TLS extension in the client side.

** libgnutls: TLS heartbeat is disabled by default.
   The heartbeat extension in TLS (RFC 6520) is not widely used given
   other implementations dropped support for it. To enable back
   support for it, supply --enable-heartbeat-support to configure
   script.

** libgnutls: SRP authentication is now disabled by default.
   It is disabled because the SRP authentication in TLS is not up to
   date with the latest TLS standards and its ciphersuites are based
   on the CBC mode and SHA-1.  To enable it back, supply
   --enable-srp-authentication option to configure script.

** libgnutls: All code has been indented using "indent -ppi1 -linux".
   CI/CD has been adjusted to catch regressions.  This is implemented
   through devel/indent-gnutls, devel/indent-maybe and .gitlab-ci.yml’s
   commit-check.  You may run devel/indent-gnutls to fix any
   indentation issues if you make code modifications.

** guile: Guile-bindings removed.
   They have been extracted into a separate project to reduce complexity
   and to simplify maintenance, see <https://gitlab.com/gnutls/guile/>.

** minitasn1: Upgraded to libtasn1 version 4.19.

** API and ABI modifications:
GNUTLS_NO_STATUS_REQUEST: New flag
GNUTLS_SRTP_AEAD_AES_128_GCM: New gnutls_srtp_profile_t enum member
GNUTLS_SRTP_AEAD_AES_256_GCM: New gnutls_srtp_profile_t enum member

* Version 3.7.8 (released 2022-09-27)

** libgnutls: In FIPS140 mode, RSA signature verification is an approved
   operation if the key has modulus with known sizes (1024, 1280,
   1536, and 1792 bits), in addition to any modulus sizes larger than
   2048 bits, according to SP800-131A rev2.

** libgnutls: gnutls_session_channel_binding performs additional checks when
   GNUTLS_CB_TLS_EXPORTER is requested. According to RFC9622 4.2, the
   "tls-exporter" channel binding is only usable when the handshake is
   bound to a unique master secret (i.e., either TLS 1.3 or extended
   master secret extension is negotiated). Otherwise the function now
   returns error.

** libgnutls: usage of the following functions, which are designed to
   loosen restrictions imposed by allowlisting mode of configuration,
   has been additionally restricted. Invoking them is now only allowed
   if system-wide TLS priority string has not been initialized yet:
gnutls_digest_set_secure
gnutls_sign_set_secure
gnutls_sign_set_secure_for_certs
gnutls_protocol_set_enabled

** API and ABI modifications:
No changes since last version.


To generate a diff of this commit:
cvs rdiff -u -r1.236 -r1.237 pkgsrc/security/gnutls/Makefile
cvs rdiff -u -r1.77 -r1.78 pkgsrc/security/gnutls/PLIST
cvs rdiff -u -r1.156 -r1.157 pkgsrc/security/gnutls/distinfo
cvs rdiff -u -r1.7 -r1.8 pkgsrc/security/gnutls/patches/patch-configure

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/gnutls/Makefile
diff -u pkgsrc/security/gnutls/Makefile:1.236 pkgsrc/security/gnutls/Makefile:1.237
--- pkgsrc/security/gnutls/Makefile:1.236       Wed Oct 26 10:31:07 2022
+++ pkgsrc/security/gnutls/Makefile     Tue Feb 14 16:45:21 2023
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.236 2022/10/26 10:31:07 wiz Exp $
+# $NetBSD: Makefile,v 1.237 2023/02/14 16:45:21 wiz Exp $
 
-DISTNAME=      gnutls-3.7.8
-PKGREVISION=   1
+DISTNAME=      gnutls-3.8.0
 CATEGORIES=    security devel
 MASTER_SITES=  https://www.gnupg.org/ftp/gcrypt/gnutls/v${PKGVERSION_NOREV:R}/
 EXTRACT_SUFX=  .tar.xz

Index: pkgsrc/security/gnutls/PLIST
diff -u pkgsrc/security/gnutls/PLIST:1.77 pkgsrc/security/gnutls/PLIST:1.78
--- pkgsrc/security/gnutls/PLIST:1.77   Fri Jul 29 08:04:47 2022
+++ pkgsrc/security/gnutls/PLIST        Tue Feb 14 16:45:21 2023
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.77 2022/07/29 08:04:47 adam Exp $
+@comment $NetBSD: PLIST,v 1.78 2023/02/14 16:45:21 wiz Exp $
 bin/certtool
 bin/gnutls-cli
 bin/gnutls-cli-debug
@@ -6,7 +6,6 @@ bin/gnutls-serv
 bin/ocsptool
 bin/p11tool
 bin/psktool
-bin/srptool
 include/gnutls/abstract.h
 include/gnutls/compat.h
 include/gnutls/crypto.h
@@ -27,7 +26,6 @@ include/gnutls/x509-ext.h
 include/gnutls/x509.h
 info/gnutls-client-server-use-case.png
 info/gnutls-crypto-layers.png
-info/gnutls-guile.info
 info/gnutls-handshake-sequence.png
 info/gnutls-handshake-state.png
 info/gnutls-internals.png
@@ -47,7 +45,6 @@ man/man1/gnutls-serv.1
 man/man1/ocsptool.1
 man/man1/p11tool.1
 man/man1/psktool.1
-man/man1/srptool.1
 man/man1/tpmtool.1
 man/man3/dane_cert_type_name.3
 man/man3/dane_cert_usage_name.3
@@ -1250,10 +1247,12 @@ share/locale/es/LC_MESSAGES/gnutls.mo
 share/locale/fi/LC_MESSAGES/gnutls.mo
 share/locale/fr/LC_MESSAGES/gnutls.mo
 share/locale/it/LC_MESSAGES/gnutls.mo
+share/locale/ka/LC_MESSAGES/gnutls.mo
 share/locale/ms/LC_MESSAGES/gnutls.mo
 share/locale/nl/LC_MESSAGES/gnutls.mo
 share/locale/pl/LC_MESSAGES/gnutls.mo
 share/locale/pt_BR/LC_MESSAGES/gnutls.mo
+share/locale/ro/LC_MESSAGES/gnutls.mo
 share/locale/sr/LC_MESSAGES/gnutls.mo
 share/locale/sv/LC_MESSAGES/gnutls.mo
 share/locale/uk/LC_MESSAGES/gnutls.mo

Index: pkgsrc/security/gnutls/distinfo
diff -u pkgsrc/security/gnutls/distinfo:1.156 pkgsrc/security/gnutls/distinfo:1.157
--- pkgsrc/security/gnutls/distinfo:1.156       Wed Sep 28 13:25:57 2022
+++ pkgsrc/security/gnutls/distinfo     Tue Feb 14 16:45:21 2023
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.156 2022/09/28 13:25:57 adam Exp $
+$NetBSD: distinfo,v 1.157 2023/02/14 16:45:21 wiz Exp $
 
-BLAKE2s (gnutls-3.7.8.tar.xz) = a0f16a832acf448fd3a92c3c7389dbb962bf5a847c2637b1c865e40ef3bec1a0
-SHA512 (gnutls-3.7.8.tar.xz) = 4199bcf7c9e3aab2f52266aadceefc563dfe2d938d0ea1f3ec3be95d66f4a8c8e5494d3a800c03dd02ad386dec1738bd63e1fe0d8b394a2ccfc7d6c6a0cc9359
-Size (gnutls-3.7.8.tar.xz) = 6029220 bytes
-SHA1 (patch-configure) = 6a4a78de339d4958557bba1dfea77a249237cabd
+BLAKE2s (gnutls-3.8.0.tar.xz) = 55bd4cb00bd6436a77565000e30099675c15b8752fc22c82ce24b1c6a2943692
+SHA512 (gnutls-3.8.0.tar.xz) = 2507b3133423fdaf90fbd826ccb1142e9ff6fc90fcd5531720218f19ddf0e6bbb8267d23bad35c0954860e5a4179da74823e0c8357db56a14f252e6ec9d59629
+Size (gnutls-3.8.0.tar.xz) = 6378480 bytes
+SHA1 (patch-configure) = 866d8a365b8338348230e47518788f494279b139
 SHA1 (patch-lib_system_certs.c) = fba74b2834a36d66bddcd7d3405d0c91c1b14efc

Index: pkgsrc/security/gnutls/patches/patch-configure
diff -u pkgsrc/security/gnutls/patches/patch-configure:1.7 pkgsrc/security/gnutls/patches/patch-configure:1.8
--- pkgsrc/security/gnutls/patches/patch-configure:1.7  Wed Sep 28 13:25:57 2022
+++ pkgsrc/security/gnutls/patches/patch-configure      Tue Feb 14 16:45:21 2023
@@ -1,14 +1,14 @@
-$NetBSD: patch-configure,v 1.7 2022/09/28 13:25:57 adam Exp $
+$NetBSD: patch-configure,v 1.8 2023/02/14 16:45:21 wiz Exp $
 
 Fix linking on Darwin.
 
---- configure.orig     2022-09-27 12:46:24.000000000 +0000
+--- configure.orig     2023-02-09 14:56:14.000000000 +0000
 +++ configure
-@@ -11379,7 +11379,6 @@ $as_echo "#define DYN_NCRYPT 1" >>confde
+@@ -11813,7 +11813,6 @@ printf "%s\n" "#define DYN_NCRYPT 1" >>c
    *darwin*)
      have_macosx=yes
      save_LDFLAGS="$LDFLAGS"
 -                LDFLAGS="$LDFLAGS -Wl,-no_weak_imports"
-     { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker supports -Wl,-no_weak_imports" >&5
- $as_echo_n "checking whether the linker supports -Wl,-no_weak_imports... " >&6; }
+     { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the linker supports -Wl,-no_weak_imports" >&5
+ printf %s "checking whether the linker supports -Wl,-no_weak_imports... " >&6; }
      cat confdefs.h - <<_ACEOF >conftest.$ac_ext