CVS commit: pkgsrc/security

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Sun Oct 19 13:45:31 UTC 2025

Modified Files:
        pkgsrc/security/botan3: Makefile Makefile.common PLIST buildlink3.mk
            distinfo
        pkgsrc/security/py-botan3: Makefile
Removed Files:
        pkgsrc/security/botan3/patches: patch-src_cli_tls__proxy.cpp
            patch-src_lib_utils_socket_socket.cpp
            patch-src_lib_utils_socket_socket__udp.cpp

Log Message:
botan3 py-botan3: updated to 3.9.0

3.9.0

Add SHA-1 implementation using AVX2/BMI2

Add Camellia implementation using GFNI/AVX2

Add SHACAL2 implementation using AVX512

The eFrodoKEM TLS 1.3 ciphersuites have changed the suite code to match changes in OQS.

Add support for TLS 1.2 NULL cipher suites. These suites are disabled in the build by default, enable tls_null module to use.

Add support for X.509 extensions from RFC 3779

Elliptic curve improvements

Add EC_Scalar::hash following RFC 9380’s hash_to_field

Modify the OID lookup system to use a static switch for builtin OIDs.

Optimizations for X448 and Ed448

Modify BOTAN_CLEAR_CPUID so that clearing ssse3 also disables AVX2/AVX512

Remove various internal references to “EMSA”, an obsolete term used for RSA signature padding that originates from IEEE 1363.

Enable support for GCC’s “strub” stack clearing. This is disabled by default, use the --enable-stack-scrubbing option to turn on.

Use std::span in the internal block cipher padding mode interfaces

Properly check DNS label length restrictions when checking wildcards.

Work around a GCC 13/14 miscompilation when LTO is used

Fix a bug preventing building System_RNG with only getrandom enabled.

Document the specific threat model the library uses

Remove configure.py options to disable specific CPU instructions.

Remove configure.py option --with-local-config

Add a better interface for encoding optional ASN.1 elements using std::optional

Internal cleanups relating to multiprecision integers

Resolve many warnings from clang-tidy

CMake improvements

CI improvements


To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 pkgsrc/security/botan3/Makefile
cvs rdiff -u -r1.6 -r1.7 pkgsrc/security/botan3/Makefile.common \
    pkgsrc/security/botan3/PLIST
cvs rdiff -u -r1.9 -r1.10 pkgsrc/security/botan3/buildlink3.mk
cvs rdiff -u -r1.8 -r1.9 pkgsrc/security/botan3/distinfo
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/botan3/patches/patch-src_cli_tls__proxy.cpp \
    pkgsrc/security/botan3/patches/patch-src_lib_utils_socket_socket.cpp \
    pkgsrc/security/botan3/patches/patch-src_lib_utils_socket_socket__udp.cpp
cvs rdiff -u -r1.7 -r1.8 pkgsrc/security/py-botan3/Makefile

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/botan3/Makefile
diff -u pkgsrc/security/botan3/Makefile:1.20 pkgsrc/security/botan3/Makefile:1.21
--- pkgsrc/security/botan3/Makefile:1.20        Sat Sep 27 09:57:35 2025
+++ pkgsrc/security/botan3/Makefile     Sun Oct 19 13:45:30 2025
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.20 2025/09/27 09:57:35 wiz Exp $
+# $NetBSD: Makefile,v 1.21 2025/10/19 13:45:30 adam Exp $
 
-PKGREVISION= 6
 .include "Makefile.common"
 
 PKGNAME=       ${DISTNAME:S/Botan/botan3/}
@@ -9,10 +8,10 @@ COMMENT=      Portable, easy to use, and effi
 DEPENDS+=      mozilla-rootcerts-[0-9]*:../../security/mozilla-rootcerts
 
 HAS_CONFIGURE=         yes
+USE_CXX_FEATURES=      c++20
 USE_LANGUAGES=         c++
 USE_TOOLS+=            gmake
 GCC_REQD+=             11
-USE_CXX_FEATURES+=     c++20
 
 PYTHON_FOR_BUILD_ONLY= yes
 
@@ -34,7 +33,7 @@ PKGCONFIG_OVERRIDE=   src/build-data/botan
 
 .include "../../mk/compiler.mk"
 .if !empty(PKGSRC_COMPILER:Mclang)
-CONFIGURE_ARGS+=       --cc-bin=${CXX} --cc=clang
+CONFIGURE_ARGS+=       --cc-bin=${CXX:Q} --cc=clang
 .else
 CONFIGURE_ARGS+=       --cc=gcc
 .endif

Index: pkgsrc/security/botan3/Makefile.common
diff -u pkgsrc/security/botan3/Makefile.common:1.6 pkgsrc/security/botan3/Makefile.common:1.7
--- pkgsrc/security/botan3/Makefile.common:1.6  Fri Nov  1 07:22:45 2024
+++ pkgsrc/security/botan3/Makefile.common      Sun Oct 19 13:45:30 2025
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile.common,v 1.6 2024/11/01 07:22:45 nros Exp $
+# $NetBSD: Makefile.common,v 1.7 2025/10/19 13:45:30 adam Exp $
 #
 # used by security/py-botan3/Makefile
 
-DISTNAME=      Botan-3.6.1
+DISTNAME=      Botan-3.9.0
 CATEGORIES=    security
 MASTER_SITES=  https://botan.randombit.net/releases/
 EXTRACT_SUFX=  .tar.xz
Index: pkgsrc/security/botan3/PLIST
diff -u pkgsrc/security/botan3/PLIST:1.6 pkgsrc/security/botan3/PLIST:1.7
--- pkgsrc/security/botan3/PLIST:1.6    Fri Nov  1 07:22:45 2024
+++ pkgsrc/security/botan3/PLIST        Sun Oct 19 13:45:30 2025
@@ -1,7 +1,8 @@
-@comment $NetBSD: PLIST,v 1.6 2024/11/01 07:22:45 nros Exp $
+@comment $NetBSD: PLIST,v 1.7 2025/10/19 13:45:30 adam Exp $
 bin/botan3
 include/botan-3/botan/aead.h
 include/botan-3/botan/allocator.h
+include/botan-3/botan/api.h
 include/botan-3/botan/argon2.h
 include/botan-3/botan/argon2fmt.h
 include/botan-3/botan/asio_async_ops.h
@@ -31,6 +32,8 @@ include/botan-3/botan/certstor_sqlite.h
 include/botan-3/botan/certstor_system.h
 include/botan-3/botan/chacha_rng.h
 include/botan-3/botan/cipher_mode.h
+include/botan-3/botan/cmce.h
+include/botan-3/botan/cmce_parameter_set.h
 include/botan-3/botan/compiler.h
 include/botan-3/botan/compression.h
 include/botan-3/botan/concepts.h
@@ -50,6 +53,7 @@ include/botan-3/botan/dsa.h
 include/botan-3/botan/ec_apoint.h
 include/botan-3/botan/ec_group.h
 include/botan-3/botan/ec_point.h
+include/botan-3/botan/ec_point_format.h
 include/botan-3/botan/ec_scalar.h
 include/botan-3/botan/ecc_key.h
 include/botan-3/botan/ecdh.h
@@ -92,6 +96,7 @@ include/botan-3/botan/p11.h
 include/botan-3/botan/p11_ecc_key.h
 include/botan-3/botan/p11_ecdh.h
 include/botan-3/botan/p11_ecdsa.h
+include/botan-3/botan/p11_mechanism.h
 include/botan-3/botan/p11_object.h
 include/botan-3/botan/p11_randomgenerator.h
 include/botan-3/botan/p11_rsa.h
@@ -116,6 +121,7 @@ include/botan-3/botan/pkix_enums.h
 include/botan-3/botan/pkix_types.h
 ${PLIST.prng}include/botan-3/botan/processor_rng.h
 include/botan-3/botan/psk_db.h
+include/botan-3/botan/pss_params.h
 include/botan-3/botan/pubkey.h
 include/botan-3/botan/pwdhash.h
 include/botan-3/botan/reducer.h
@@ -189,8 +195,8 @@ lib/cmake/Botan-${PKGVERSION}/botan-conf
 lib/cmake/Botan-${PKGVERSION}/botan-config.cmake
 lib/libbotan-3.a
 lib/libbotan-3.so
-lib/libbotan-3.so.6
-lib/libbotan-3.so.6.6.1
+lib/libbotan-3.so.9
+lib/libbotan-3.so.9.9.0
 lib/pkgconfig/botan-3.pc
 share/doc/${PKGNAME}/authors.txt
 share/doc/${PKGNAME}/handbook/abi.rst
@@ -201,6 +207,7 @@ share/doc/${PKGNAME}/handbook/api_ref/co
 share/doc/${PKGNAME}/handbook/api_ref/contents.rst
 share/doc/${PKGNAME}/handbook/api_ref/credentials_manager.rst
 share/doc/${PKGNAME}/handbook/api_ref/cryptobox.rst
+share/doc/${PKGNAME}/handbook/api_ref/ec_group.rst
 share/doc/${PKGNAME}/handbook/api_ref/ecc.rst
 share/doc/${PKGNAME}/handbook/api_ref/env_vars.rst
 share/doc/${PKGNAME}/handbook/api_ref/ffi.rst
@@ -222,6 +229,7 @@ share/doc/${PKGNAME}/handbook/api_ref/py
 share/doc/${PKGNAME}/handbook/api_ref/rng.rst
 share/doc/${PKGNAME}/handbook/api_ref/roughtime.rst
 share/doc/${PKGNAME}/handbook/api_ref/secmem.rst
+share/doc/${PKGNAME}/handbook/api_ref/sodium.rst
 share/doc/${PKGNAME}/handbook/api_ref/srp.rst
 share/doc/${PKGNAME}/handbook/api_ref/stream_ciphers.rst
 share/doc/${PKGNAME}/handbook/api_ref/tls.rst
@@ -245,6 +253,7 @@ share/doc/${PKGNAME}/handbook/dev_ref/mi
 share/doc/${PKGNAME}/handbook/dev_ref/next_major.rst
 share/doc/${PKGNAME}/handbook/dev_ref/oids.rst
 share/doc/${PKGNAME}/handbook/dev_ref/os.rst
+share/doc/${PKGNAME}/handbook/dev_ref/pcurves.rst
 share/doc/${PKGNAME}/handbook/dev_ref/reading_list.rst
 share/doc/${PKGNAME}/handbook/dev_ref/release_process.rst
 share/doc/${PKGNAME}/handbook/dev_ref/test_framework.rst
@@ -253,6 +262,7 @@ share/doc/${PKGNAME}/handbook/goals.rst
 share/doc/${PKGNAME}/handbook/hardware_acceleration.rst
 share/doc/${PKGNAME}/handbook/index.rst
 share/doc/${PKGNAME}/handbook/migration_guide.rst
+share/doc/${PKGNAME}/handbook/news_2x.rst
 share/doc/${PKGNAME}/handbook/old_news.rst
 share/doc/${PKGNAME}/handbook/openssl_migration_guide.rst
 share/doc/${PKGNAME}/handbook/packaging.rst
@@ -262,6 +272,7 @@ share/doc/${PKGNAME}/handbook/security.r
 share/doc/${PKGNAME}/handbook/sem_ver.rst
 share/doc/${PKGNAME}/handbook/side_channels.rst
 share/doc/${PKGNAME}/handbook/support.rst
+share/doc/${PKGNAME}/handbook/threat_model.rst
 share/doc/${PKGNAME}/license.txt
 share/doc/${PKGNAME}/news.txt
 share/doc/${PKGNAME}/pgpkey.txt

Index: pkgsrc/security/botan3/buildlink3.mk
diff -u pkgsrc/security/botan3/buildlink3.mk:1.9 pkgsrc/security/botan3/buildlink3.mk:1.10
--- pkgsrc/security/botan3/buildlink3.mk:1.9    Sat Sep 27 09:57:35 2025
+++ pkgsrc/security/botan3/buildlink3.mk        Sun Oct 19 13:45:30 2025
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.9 2025/09/27 09:57:35 wiz Exp $
+# $NetBSD: buildlink3.mk,v 1.10 2025/10/19 13:45:30 adam Exp $
 
 BUILDLINK_TREE+=       botan3
 
@@ -6,7 +6,7 @@ BUILDLINK_TREE+=        botan3
 BOTAN3_BUILDLINK3_MK:=
 
 BUILDLINK_API_DEPENDS.botan3+= botan3>=3.0.0
-BUILDLINK_ABI_DEPENDS.botan3?= botan3>=3.6.1nb6
+BUILDLINK_ABI_DEPENDS.botan3+= botan3>=3.6.1nb6
 BUILDLINK_PKGSRCDIR.botan3?=   ../../security/botan3
 
 .include "../../devel/boost-libs/buildlink3.mk"

Index: pkgsrc/security/botan3/distinfo
diff -u pkgsrc/security/botan3/distinfo:1.8 pkgsrc/security/botan3/distinfo:1.9
--- pkgsrc/security/botan3/distinfo:1.8 Mon Dec 30 09:40:19 2024
+++ pkgsrc/security/botan3/distinfo     Sun Oct 19 13:45:30 2025
@@ -1,9 +1,6 @@
-$NetBSD: distinfo,v 1.8 2024/12/30 09:40:19 wiz Exp $
+$NetBSD: distinfo,v 1.9 2025/10/19 13:45:30 adam Exp $
 
-BLAKE2s (Botan-3.6.1.tar.xz) = b3168adf972bcd88107fe963edce95a4503f911e0037c4ee0ddc522109194361
-SHA512 (Botan-3.6.1.tar.xz) = 06327c55bee5e0d2e142f81b997dd8a1ef98f61ef920b57f6eb4e80ebf6b3de1c62373b889d4a32e62509495792e0b46d5dcc82a6446266974b4d4ead8d9f287
-Size (Botan-3.6.1.tar.xz) = 7581864 bytes
-SHA1 (patch-src_cli_tls__proxy.cpp) = ae02215325e9f4093aa0da6293a72e063817c683
-SHA1 (patch-src_lib_utils_socket_socket.cpp) = cb478f2e81b4b1eb58c95400f975a3db71276d5e
-SHA1 (patch-src_lib_utils_socket_socket__udp.cpp) = 402015e2b6f79e88b80f8b6da7b4fd3fac44f417
+BLAKE2s (Botan-3.9.0.tar.xz) = 1bc9b14c45fbecb6b59da6b04ebd97e679744c3d4aef3775a629ddf43356d1c5
+SHA512 (Botan-3.9.0.tar.xz) = 50fc581d120619dc8ceadff8f2c6a831992fbb7c74621edcfb266f2bc973e66723e15d855fdad96f46204bdcdb957609c506e02d2d7edbecb67eb54b4bd96fc6
+Size (Botan-3.9.0.tar.xz) = 8769364 bytes
 SHA1 (patch-src_scripts_install.py) = c8ac2a6315e0e53a0292447e8e6b967572de9d24

Index: pkgsrc/security/py-botan3/Makefile
diff -u pkgsrc/security/py-botan3/Makefile:1.7 pkgsrc/security/py-botan3/Makefile:1.8
--- pkgsrc/security/py-botan3/Makefile:1.7      Sat Sep 27 09:57:36 2025
+++ pkgsrc/security/py-botan3/Makefile  Sun Oct 19 13:45:31 2025
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.7 2025/09/27 09:57:36 wiz Exp $
+# $NetBSD: Makefile,v 1.8 2025/10/19 13:45:31 adam Exp $
 
-PKGREVISION= 3
 .include "../../security/botan3/Makefile.common"
 
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/Botan/botan3/}