Noteworthy changes since the last release:
- Replace GNU LD version script with Libtool -export-symbols-regex,
from Joe Orton <joe at manyfish.co.uk>.
- Copy libtasn1 has been updated to version 0.2.11.
- Corrected the write of CRL distribution points.
- It is now possible to generate PKCS#12 structures without private
keys using "certtool --to-p12", suggested by Fabian Fagerholm
<fabbe at paniq.net>.
Version 1.0.22 (28/10/2004)
- Print DN of certificates with unknown characters in them, but in hexform
only.
- Corrected bug in _gnutls_x509_get_dn_oid(), and returns the actual OID.
- Added second precision to the X.509 parsing functions.
- Add parameter --la-file to libgnutls-config and libgnutls-extra-config,
tiny patch contributed by Joe Orton <joe@manyfish.co.uk>.
- Add pkg-config meta files, suggested by Stéphane LOEUILLET
<stephane.loeuillet@tiscali.fr>.
- Fix memory initializaion bug in gnutls_certificate_set_x509_trust,
tiny patch by Aleix Conchillo Flaque <aleix@member.fsf.org>.
- Fix certtool --password for PKCS #12, back ported from 1.1.x branch.
- Fix library order in libgnutls*-config --libs output, to permit
static linking, reported by Yoann Vandoorselaere
<yoann@prelude-ids.org>.
Version 1.0.21 (07/10/2004)
- Fix memory leak in gnutls_certificate_verify_peers and
gnutls_certificate_free_credentials, report and patch by Simon
Posnjak <simon.posnjak@cetrtapot.si>.
- Fix crash in `certtool --to-p12 --load-privkey foo', i.e. exporting
a key and no certificate to PKCS#12.
- Fix objdir != srcdir builds, reported by "Gerrit P. Haase"
<gp@familiehaase.de>.
- Avoid redefining getpass if system already has it, reported by
Yoann Vandoorselaere <yoann@prelude-ids.org>.
- Add new example "ex-rfc2818" for certificate verification, from Nikos.
- Known bug: the library require snprintf.
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
All library names listed by *.la files no longer need to be listed
in the PLIST, e.g., instead of:
lib/libfoo.a
lib/libfoo.la
lib/libfoo.so
lib/libfoo.so.0
lib/libfoo.so.0.1
one simply needs:
lib/libfoo.la
and bsd.pkg.mk will automatically ensure that the additional library
names are listed in the installed package +CONTENTS file.
Also make LIBTOOLIZE_PLIST default to "yes".
- Some complilation fixes.
- Added the --xml parameter to the certtool utility.
Changes 1.0.12:
- Corrected bug in OpenPGP key loading using a callback.
- Renamed gnutls-srpcrypt to srptool
- Allow handshake requests by the client.
* Things backported from the development branch:
- Added support for authority key identifier and the extended key usage
X.509 extension fields. The certtoool was updated to support them.
- Added batch support to certtool. Now it can use templates.
- The RC2 cipher is no more included. The one in libgcrypt is now used.
Changes 1.0.11:
- Added gnutls_sign_algorithm_get_name() and gnutls_pk_algorithm_get_name()
- Corrected bug in TLS renegotiation.
Changes 1.0.10:
- Corrected bug in RSA parameters handling which could cause
unexpected crashes.
- Corrected bug in SSL 3.0 authentication.
by moving the inclusion of buildlink3.mk files outside of the protected
region. This bug would be seen by users that have set PREFER_PKGSRC
or PREFER_NATIVE to non-default values.
BUILDLINK_PACKAGES should be ordered so that for any package in the
list, that package doesn't depend on any packages to the left of it
in the list. This ordering property is used to check for builtin
packages in the correct order. The problem was that including a
buildlink3.mk file for <pkg> correctly ensured that <pkg> was removed
from BUILDLINK_PACKAGES and appended to the end. However, since the
inclusion of any other buildlink3.mk files within that buildlink3.mk
was in a region that was protected against multiple inclusion, those
dependencies weren't also moved to the end of BUILDLINK_PACKAGES.
Version 1.0.8 (28/02/2004)
- Corrected bug in mutual certificate authentication in SSL 3.0.
- Several other minor bugfixes.
Version 1.0.7 (25/02/2004)
- Implemented TLS 1.1 (and also obsoleted the TLS 1.0 CBC protection hack).
- Some updates in the documentation.
Version 1.0.4 (04/01/2004)
- Changed handshake behaviour to send the lowest TLS version
when an unsupported version was advertized. The current behaviour
is to send the maximum version we support.
- certtool no longer asks the password in unencrypted private
keys.
- The source is now compiled to use the reentrant libc functions.
- Corrected bug in gnutls_bye() which made it return an error code
of INVALID_REQUEST instead of success.
- Corrected a bug in the GNUTLS_KEY key usage definitions.
Changes since 1.0.0:
- Some minor fixes in the makefiles. They now include CFLAGS
from libgcrypt or opencdk if installed in a non standard directory.
- Fixed the SRP detection test in gnutls-cli-debug.
- Added gnutls_rsa_params_export_pkcs1() and
gnutls_rsa_params_import_pkcs1().
Changes:
- Exported the static SRP group parameters.
- Some fixes in the certificate authenticated SRP ciphersuites.
- Improved the support for draft-ietf-tls-srp-05. The two-phase
handshake is now fully supported without any interaction with
the application layer (except for a callback).
- Some fixes in the openpgp authentication.
- Removed the Twofish cipher.
- The openssl compatibility layer was moved to gnutls-openssl
library instead of being included in the gnutls-extra library.
- Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04.
- Building with openpgp support is now mandatory.
- gnutls4 compatibility header is no longer included by default in
gnutls.h.
- gnutls8 function usage yelds a deprecation warning in gcc3.
- gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid()
functions have a raw_flag parameter added.
- The certtool utility can now generate PKCS #12 structures
without specifying a certificate.
- Added capability to read CRLs to certtool.
- Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER
to properly set the required buffer size.
- Corrected a bug in libgcrypt detection.
And more...
own security/libtasn1 package, which is too new to work fine with gnutls.
While here, add missing dependency on devel/zlib.
Fixes PR pkg/23172; reviewed by wiz@. Bump PKGREVISION to 1.
GnuTLS is a portable ANSI C based library which implements the TLS 1.0 and SSL
3.0 protocols. The library does not include any patented algorithms and is
available under the GNU Lesser GPL license.
Important features of the GnuTLS library include:
- Thread safety
- Support for both TLS 1.0 and SSL 3.0 protocols
- Support for both X.509 and OpenPGP certificates
- Support for basic parsing and verification of certificates
- Support for SRP for TLS authentication
- Support for TLS Extension mechanism
- Support for TLS Compression Methods
Additionaly GnuTLS provides an emulation API for the widely used OpenSSL
library, to ease integration with existing applications.
Package provided by Juan RP via pkgsrc-wip with modifications by me.
