CVS commit: pkgsrc/security/gnupg2

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Jul  3 11:30:46 UTC 2026

Modified Files:
        pkgsrc/security/gnupg2: Makefile distinfo
Removed Files:
        pkgsrc/security/gnupg2/patches: patch-sm_decrypt.c

Log Message:
gnupg2: updated to 2.5.21

Noteworthy changes in version 2.5.21 (2026-07-02)

* New and extended features:

  - gpg, gpgsm: Use partial file on decryption, remove on failure.
    Disable with "--compatibility-flags=no-partial-file-guard".

  - gpg: Use the INT_RCP_FPR subpacket in revocation signatures.

  - Create a pkgversioninfo.txt file when building using the speedo
    build system.

* Bug fixes:

  - gpg: Fix potential use-after-free in batch key generation when
    handling the keyserver URL option.

  - gpgsm: Fix regression in gpgsm_verify with expired certificates.

  - gpgsm: Require a minimum tag length for GCM decryption.

  - scd: Limit the size of returned APDU objects from faulty cards.

  - scd: Fix condition to retrieve ATR.

  - scd:openpgp: Fix regression in CHV1 retry counter byte index.

  - agent: Make batch import of Kyber keys work.

  - dirmngr: Add a validation check in get_dns_cert_standard.

  - gpgconf: Raise an error on certain parse errors.

  - Fix use of usleep in file remove function on Windows.  Regression
    since 2.5.13.


To generate a diff of this commit:
cvs rdiff -u -r1.178 -r1.179 pkgsrc/security/gnupg2/Makefile
cvs rdiff -u -r1.98 -r1.99 pkgsrc/security/gnupg2/distinfo
cvs rdiff -u -r1.1 -r0 pkgsrc/security/gnupg2/patches/patch-sm_decrypt.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/gnupg2/Makefile
diff -u pkgsrc/security/gnupg2/Makefile:1.178 pkgsrc/security/gnupg2/Makefile:1.179
--- pkgsrc/security/gnupg2/Makefile:1.178       Mon Jun 22 20:08:57 2026
+++ pkgsrc/security/gnupg2/Makefile     Fri Jul  3 11:30:46 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.178 2026/06/22 20:08:57 wiz Exp $
+# $NetBSD: Makefile,v 1.179 2026/07/03 11:30:46 adam Exp $
 
-DISTNAME=      gnupg-2.5.20
+DISTNAME=      gnupg-2.5.21
 PKGNAME=       ${DISTNAME:S/gnupg-/gnupg2-/}
-PKGREVISION=   2
 CATEGORIES=    security
 MASTER_SITES=  ${MASTER_SITE_GNUPG:=gnupg/}
 EXTRACT_SUFX=  .tar.bz2
@@ -31,14 +30,10 @@ CONFIGURE_ARGS+=    --sysconfdir=${PKG_SYSC
 CONFIGURE_ARGS+=       --localstatedir=${VARBASE}
 # SunOS does have getaddrinfo() and the code knows how to use it
 CONFIGURE_ARGS.SunOS+= ac_cv_func_getaddrinfo=yes
-
 TEST_TARGET=           check
 
 CPPFLAGS.SunOS+=       -D_XOPEN_SOURCE=600     # socklen_t
-
 LDFLAGS.Darwin+=       -lintl
-#LDFLAGS.SunOS+=       -lsocket -lrt
-#LDFLAGS.Linux+=       -lrt
 
 .include "options.mk"
 
@@ -50,8 +45,7 @@ BUILDLINK_API_DEPENDS.npth+=          npth>=1.2
 .include "../../devel/readline/buildlink3.mk"
 BUILDLINK_API_DEPENDS.libgcrypt+=      libgcrypt>=1.11.0
 .include "../../security/libgcrypt/buildlink3.mk"
-# per configure script as of 2.5.17
-#BUILDLINK_API_DEPENDS.libgpg-error+=  libgpg-error>=1.56
+# As of 2.5.21, configure script requests libgpg-error>=1.56
 # but we need a fix for NetBSD
 BUILDLINK_API_DEPENDS.libgpg-error+=   libgpg-error>=1.58nb2
 .include "../../security/libgpg-error/buildlink3.mk"

Index: pkgsrc/security/gnupg2/distinfo
diff -u pkgsrc/security/gnupg2/distinfo:1.98 pkgsrc/security/gnupg2/distinfo:1.99
--- pkgsrc/security/gnupg2/distinfo:1.98        Mon Jun 22 20:08:57 2026
+++ pkgsrc/security/gnupg2/distinfo     Fri Jul  3 11:30:46 2026
@@ -1,7 +1,6 @@
-$NetBSD: distinfo,v 1.98 2026/06/22 20:08:57 wiz Exp $
+$NetBSD: distinfo,v 1.99 2026/07/03 11:30:46 adam Exp $
 
-BLAKE2s (gnupg-2.5.20.tar.bz2) = 5f30632261ae8febc1b4de3a7189a1c24effa31b1e995ff61087becdb7bf01f0
-SHA512 (gnupg-2.5.20.tar.bz2) = 73e5f3020271069421c220871caffcb6ec05c52a8e12d8dcbd214ce2b14a2b22ce0030d9e1fedf25c60ec1077a33630b0a6bd1cc1043fbbaf7083b998113f90f
-Size (gnupg-2.5.20.tar.bz2) = 8327674 bytes
+BLAKE2s (gnupg-2.5.21.tar.bz2) = c77f26371c08475c95eed6a7f293d59868c75660a66388d2b258b8c5cb8aa50d
+SHA512 (gnupg-2.5.21.tar.bz2) = dcc4e976e56411c0dd7309c0cb7e790b409709af55bb93883d257890abe72b17442d6c8fd682fef0e019d70e46a6a5cf860f1ae355a99024ed2aea230de8c0ea
+Size (gnupg-2.5.21.tar.bz2) = 8351785 bytes
 SHA1 (patch-common_sysutils.c) = 569c12e21172c1521284922244b2f4f361c945d6
-SHA1 (patch-sm_decrypt.c) = f39c64f78fae05f8caea11102b28300bbe4d6c80