CVS commit: pkgsrc/net/tor

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Jun 29 12:38:29 UTC 2026

Modified Files:
        pkgsrc/net/tor: Makefile distinfo

Log Message:
tor: updated to 0.4.9.11

0.4.9.11

Security release follows in quick succession after the previous one due to
additional high-priority security issues including one concerning onion
services. We strongly recommend upgrading as soon as possible.

o Major bugfixes (onion services):
  - Prevent a race condition where in just the right circumstances a
    rendezvous point could man-in-the-middle (impersonate) the onion
    service that the client was trying to reach. Fixes bug 41297;
    bugfix on 0.3.5.3-alpha.

o Major bugfixes (client):
  - Clients no longer assert and exit if an onion service encodes an
    all-zero public key for one of its introduction points. Fixes bug
    41295; bugfix on 0.3.2.1-alpha.

o Major bugfixes (directory authorities):
  - Stop allowing 0 as a port in exit policy lines. We had put in some
    secondary checks to make sure exit policy ports weren't out of the
    expected range, but one of those checks accidentally allowed us to
    parse the port "0" as equivalent to the port range "1-0", which
    triggered an assert when generating a networkstatus vote (on v3
    directory authorities) or a networkstatus document (on the bridge
    authority). Fixes bug 41292; bugfix on 0.1.2.5-alpha.

o Major bugfixes (security, conflux):
  - Fix a use-after-free (and potential double free) of a conflux
    object when a recovery leg revives a conflux set whose last linked
    leg has already been closed. A malicious exit could use this to
    crash a client. TROVE-2026-026. Fixes bug 41306; bugfix
    on 0.4.8.1-alpha.

o Minor features (fallbackdir):
  - Regenerate fallback directories generated on June 25, 2026.

o Minor features (geoip data):
  - Update the geoip files to match the IPFire Location Database, as
    retrieved on 2026/06/25.


To generate a diff of this commit:
cvs rdiff -u -r1.199 -r1.200 pkgsrc/net/tor/Makefile
cvs rdiff -u -r1.143 -r1.144 pkgsrc/net/tor/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/tor/Makefile
diff -u pkgsrc/net/tor/Makefile:1.199 pkgsrc/net/tor/Makefile:1.200
--- pkgsrc/net/tor/Makefile:1.199       Wed Jun 24 18:12:01 2026
+++ pkgsrc/net/tor/Makefile     Mon Jun 29 12:38:29 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.199 2026/06/24 18:12:01 adam Exp $
+# $NetBSD: Makefile,v 1.200 2026/06/29 12:38:29 adam Exp $
 
-DISTNAME=      tor-0.4.9.10
+DISTNAME=      tor-0.4.9.11
 CATEGORIES=    net security
 MASTER_SITES=  https://dist.torproject.org/
 

Index: pkgsrc/net/tor/distinfo
diff -u pkgsrc/net/tor/distinfo:1.143 pkgsrc/net/tor/distinfo:1.144
--- pkgsrc/net/tor/distinfo:1.143       Wed Jun 24 18:12:01 2026
+++ pkgsrc/net/tor/distinfo     Mon Jun 29 12:38:29 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.143 2026/06/24 18:12:01 adam Exp $
+$NetBSD: distinfo,v 1.144 2026/06/29 12:38:29 adam Exp $
 
-BLAKE2s (tor-0.4.9.10.tar.gz) = 1ebfdffb46c4c5e3ab275ae631406655fa7840996b9422928a3a1448557ef0b3
-SHA512 (tor-0.4.9.10.tar.gz) = 5dcd961f418addf3fd49b14a1e9e26a91413d980c1e670a88d8f8de611c6e7cde889a01fdbf08aeec87610417d64a39062e3e2dc4e42eebb49869cbc9290b4ce
-Size (tor-0.4.9.10.tar.gz) = 10855905 bytes
+BLAKE2s (tor-0.4.9.11.tar.gz) = 6618b6a4f7a41b9a1eb9753917857715306b21a7fe60fe096119c089a0630c13
+SHA512 (tor-0.4.9.11.tar.gz) = a9bf90c16998b68ca794dc717abc7bf681dcc2e6f4d1eb57badd0f1a3eb4a84347b2a41758d19dc20913655694ce4898c605c566cdeb8dd71be263a866263bb1
+Size (tor-0.4.9.11.tar.gz) = 10859160 bytes