Noteworthy changes in version 1.6.0 (2021-06-10) [C22/A14/R0]
------------------------------------------------
* Limited support for the Authenticated-Enveloped-Data content type.
[81fdcd680c12]
* Support password based decryption. [cb7f2484a09c]
* Fix build problem on macOS.
* Silence warnings from static analyzers.
* Interface changes relative to the 1.5.0 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
KSBA_CT_AUTHENVELOPED_DATA NEW.
Release-info: https://dev.gnupg.org/T5479
Noteworthy changes in version 1.5.1 (2021-04-06) [C21/A13/R1]
------------------------------------------------
* Support Brainpool curves specified by ECDomainParameters.
Release-info: https://dev.gnupg.org/T5379
Noteworthy changes in version 1.5.0 (2020-11-18) [C21/A13/R0]
------------------------------------------------
* ksba_cms_identify now identifies OpenPGP keyblock content.
* Supports TR-03111 plain format ECDSA signature verification.
* Fixes a CMS signed data parser bug exhibited by a somewhat strange
CMS message. [b6438e768c]
* Interface changes relative to the 1.4.0 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
KSBA_CT_OPENPGP_KEYBLOCK NEW.
Release-info: https://dev.gnupg.org/T5146
All checksums have been double-checked against existing RMD160 and
SHA512 hashes
Unfetchable distfiles (fetched conditionally?):
./security/cyrus-sasl/distinfo cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2
Noteworthy changes in version 1.4.0
-----------------------------------
* Supports ECDSA and EdDSA certificate creation and parsing.
* Supports ECDH enveloped data.
* Supports ECDSA and EdDSA signed data.
* Supports rsaPSS signature verification.
* Supports standard file descriptors in ksba_reader_read.
* New configure flag --disable-doc.
* Improves supports for reproducible builds.
* Allows for optional elements in keyinfo objects.
* Updates the config and M4 scripts to the latest version.
* Fixes error detection in the CMS parser.
* Fixes memory leak in ksba_cms_identify.
* Fixes build warnings on macOS.
* Uses --disable-new-dtags if LD_LIBRARY_PATH is defined.
* New constants KSBA_VERSION and KSBA_VERSION_NUMBER.
* New API to make creation of DER objects easy.
* Interface changes relative to the 1.3.5 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
KSBA_VERSION NEW.
KSBA_VERSION_NUMBER NEW.
KSBA_CT_SPC_IND_DATA_CTX NEW.
KSBA_CLASS_* NEW.
KSBA_TYPE_* NEW.
ksba_der_t NEW.
ksba_der_release NEW.
ksba_der_builder_new NEW.
ksba_der_builder_reset NEW.
ksba_der_add_ptr NEW.
ksba_der_add_val NEW.
ksba_der_add_int NEW.
ksba_der_add_oid NEW.
ksba_der_add_bts NEW.
ksba_der_add_der NEW.
ksba_der_add_tag NEW.
ksba_der_add_end NEW.
ksba_der_builder_get NEW.
S/MIME messages encrypted with gpgsm are sometimes not decodable by
other implementations. Discussion on gnupg-devel indicates that gpg
(via libksba) is incorrectly dropping leading zeros from the encrypted
session key. This commit adds a patch by Daiki Ueno from the
mailinglist that appears to improve interoperability. Upstream has
not yet applied it, but also has not said that it is wrong.
Noteworthy changes in version 1.3.5 (2016-08-22) [C19/A11/R6]
------------------------------------------------
* Limit the allowed size of complex ASN.1 objects (e.g. certificates)
to 16MiB.
* Avoid read access to unitialized memory.
* Improve detection of invalid RDNs.
* Encode the OCSP nonce value as an octet string as described by
RFC-6960.
Noteworthy changes in version 1.3.4 (2016-05-03) [C19/A11/R4]
------------------------------------------------
* Fixed two OOB read access bugs which could be used to force a DoS.
* Fixed a crash due to faulty curve OID lookup code.
* Synced the list of supported curves with those of Libgcrypt.
* New configure option --enable-build-timestamp; a build timestamp is
not anymore used by default.
Problems found locating distfiles:
Package f-prot-antivirus6-fs-bin: missing distfile fp-NetBSD.x86.32-fs-6.2.3.tar.gz
Package f-prot-antivirus6-ws-bin: missing distfile fp-NetBSD.x86.32-ws-6.2.3.tar.gz
Package libidea: missing distfile libidea-0.8.2b.tar.gz
Package openssh: missing distfile openssh-7.1p1-hpn-20150822.diff.bz2
Package uvscan: missing distfile vlp4510e.tar.Z
Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden). All existing
SHA1 digests retained for now as an audit trail.
Noteworthy changes in version 1.3.3 (2015-04-10) [C19/A11/R4]
------------------------------------------------
* Fixed an integer overflow in the DN decoder.
* Now returns an error instead of terminating the process for certain
bad BER encodings.
* Improved the parsing of utf-8 strings in DNs.
* Allow building with newer versions of Bison.
* Improvement building on Windows with newer versions of Mingw.
Noteworthy changes in version 1.3.2 (2014-11-25) [C19/A11/R3]
------------------------------------------------
* Fixed a buffer overflow in ksba_oid_to_str.
Noteworthy changes in version 1.3.1 (2014-09-18)
------------------------------------------------
* Fixed memory leak in CRL parsing.
* Build fixes for Windows, Android, and ppc64el.
* New functions to allow the creation of X.509 certificates.
* Interface changes relative to the 1.1.0 release:
ksba_certreq_set_serial NEW
ksba_certreq_set_issuer NEW
ksba_certreq_set_validity NEW
ksba_certreq_set_siginfo NEW
maintainer Klaus Klein.
2) Update to version 0.9.7 to satisfy version requirements for, soon to
be committed, gnupg2 (1.9.10) that provides SMIME support.
Libksba is a library to make the tasks of working with X.509 certificates,
CMS data and related objects more easy. It a highlevel interface to the
implemented protocols and presents the data in a consistent way.
Changes since 0.9.1:
* Support for Extended Key Usage.
* ksba_cms_identify may no return a pseudo content type for pkcs#12
files.
* Cleaned up the DN label table.
* Fixed a bug in creating CMS signed data.
* Interface changes:
ksba_reader_clear NEW.
ksba_cert_get_ext_key_usages NEW.
KSBA_CT_PKCS12 NEW.
