3478d1d08b
pkgsrc changes: - Remove comments regarding bash and tests (bash was added unconditionally due REPLACE_BASH usages) Changes: 3.6.5 ----- ** libgnutls: Provide the option of transparent re-handshake/reauthentication when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571). ** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127) ** libgnutls: The priority functions will ignore and not enable TLS1.3 if requested with legacy TLS versions enabled but not TLS1.2. That is because if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled) servers which do not support TLS1.3 will negotiate TLS1.2 which will be rejected by the client as disabled (#621). ** libgnutls: Change RSA decryption to use a new side-channel silent function. This addresses a security issue where memory access patterns as well as timing on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher attacks. Side-channel resistant code is slower due to the need to mask access and timings. When used in TLS the new functions cause RSA based handshakes to be between 13% and 28% slower on average (Numbers are indicative, the tests where performed on a relatively modern Intel CPU, results vary depending on the CPU and architecture used). This change makes nettle 3.4.1 the minimum requirement of gnutls (#630). [CVSS: medium] ** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword in the priority string. It is only accepted as legacy option and is ignored. ** libgnutls: Added support for EdDSA under PKCS#11 (#417) ** libgnutls: Added support for AES-CFB8 cipher (#357) ** libgnutls: Added support for AES-CMAC MAC (#351) ** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D S-BOXes). They are fixed now. ** libgnutls: Added support for GOST key unmasking and unwrapped GOST private keys parsing, as specified in R 50.1.112-2016. ** gnutls-serv: It applies the default settings when no --priority option is given, using gnutls_set_default_priority(). ** p11tool: Fix initialization of security officer's PIN with the --initialize-so-pin option (#561) ** certtool: Add parameter --no-text that prevents certtool from outputting text before PEM-encoded private key, public key, certificate, CRL or CSR. ** API and ABI modifications: GNUTLS_AUTO_REAUTH: Added GNUTLS_CIPHER_AES_128_CFB8: Added GNUTLS_CIPHER_AES_192_CFB8: Added GNUTLS_CIPHER_AES_256_CFB8: Added GNUTLS_MAC_AES_CMAC_128: Added GNUTLS_MAC_AES_CMAC_256: Added gnutls_record_get_max_early_data_size: Added gnutls_record_send_early_data: Added gnutls_record_recv_early_data: Added gnutls_db_check_entry_expire_time: Added gnutls_anti_replay_set_add_function: Added gnutls_anti_replay_init: Added gnutls_anti_replay_deinit: Added gnutls_anti_replay_set_window: Added gnutls_anti_replay_enable: Added gnutls_privkey_decrypt_data2: Added
23 lines
773 B
Makefile
23 lines
773 B
Makefile
# $NetBSD: buildlink3.mk,v 1.34 2018/12/09 20:12:41 leot Exp $
|
|
|
|
BUILDLINK_TREE+= gnutls
|
|
|
|
.if !defined(GNUTLS_BUILDLINK3_MK)
|
|
GNUTLS_BUILDLINK3_MK:=
|
|
|
|
BUILDLINK_API_DEPENDS.gnutls+= gnutls>=3.3.0
|
|
BUILDLINK_ABI_DEPENDS.gnutls+= gnutls>=3.6.0nb1
|
|
BUILDLINK_PKGSRCDIR.gnutls?= ../../security/gnutls
|
|
|
|
.include "../../archivers/lzo/buildlink3.mk"
|
|
.include "../../devel/gettext-lib/buildlink3.mk"
|
|
.include "../../devel/libcfg+/buildlink3.mk"
|
|
.include "../../devel/zlib/buildlink3.mk"
|
|
.include "../../security/libtasn1/buildlink3.mk"
|
|
BUILDLINK_API_DEPENDS.nettle+= nettle>=3.4.1
|
|
.include "../../security/nettle/buildlink3.mk"
|
|
.include "../../security/p11-kit/buildlink3.mk"
|
|
.include "../../textproc/libunistring/buildlink3.mk"
|
|
.endif # GNUTLS_BUILDLINK3_MK
|
|
|
|
BUILDLINK_TREE+= -gnutls
|