update to 2.0.0

While an update to a .0 version is somehow risky, it finishes the
unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc
opencdk, which I wouldn't like to go into the next stable branch.
Release candidates have worked for me, and there is some time left
before the Q3 branch, so I'm confident.
changes:
* Support for external RSA/DSA signing for TLS client authentication
-many X.509 enhancements
 Support for Supplemental handshakes messages (RFC 4680)
* Support for TLS authorization extension (draft-housley-tls-authz-extns-07)
* Improve logic of gnutls_set_default_priority()
* New APIs to enumerate supported algorithms in the library
* Certtool can export more than one certificate to PKCS#12
* Several message translation improvements
* Improved manual
* Many bugfixes and minor improvements

10 files changed, 116 insertions, 59 deletions

diff --git a/security/gnutls/Makefile b/security/gnutls/Makefile
index 713a81e2d14..3e4ca459e91 100644
--- a/security/gnutls/Makefile
+++ b/security/gnutls/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.62 2007/06/06 06:23:58 wiz Exp $
+# $NetBSD: Makefile,v 1.63 2007/09/05 21:51:21 drochner Exp $
 
-DISTNAME=	gnutls-1.6.3
-PKGREVISION=	1
+DISTNAME=	gnutls-2.0.0
 CATEGORIES=	security devel
 MASTER_SITES=	http://josefsson.org/gnutls/releases/ \
 		ftp://ftp.gnutls.org/pub/gnutls/ \
@@ -28,9 +27,7 @@ INFO_FILES=		yes
 PKGCONFIG_OVERRIDE=	lib/gnutls.pc.in
 PKGCONFIG_OVERRIDE+=	libextra/gnutls-extra.pc.in
 
-# Disabled because 1.6.x doesn't work with opencdk-0.6.x
-CONFIGURE_ARGS+=	--with-included-opencdk
-#BUILDLINK_API_DEPENDS.opencdk+=	opencdk>=0.5.5
+BUILDLINK_API_DEPENDS.opencdk+=		opencdk>=0.6.0
 BUILDLINK_API_DEPENDS.libtasn1+=	libtasn1>=0.3.4
 BUILDLINK_API_DEPENDS.libgcrypt+=	libgcrypt>=1.2.2
 
@@ -56,6 +53,7 @@ post-install:
 .include "../../devel/zlib/buildlink3.mk"
 .include "../../security/libgcrypt/buildlink3.mk"
 .include "../../security/libtasn1/buildlink3.mk"
-# Disabled because 1.6.x doesn't work with opencdk-0.6.x
-#.include "../../security/opencdk/buildlink3.mk"
+.include "../../security/opencdk/buildlink3.mk"
+# guile is useful for selftests, but bindings should be seperate pkgs
+#.include "../../lang/guile/buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff --git a/security/gnutls/PLIST b/security/gnutls/PLIST
index 7ef2fd1f437..ecaac534545 100644
--- a/security/gnutls/PLIST
+++ b/security/gnutls/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.27 2007/06/01 20:12:44 wiz Exp $
+@comment $NetBSD: PLIST,v 1.28 2007/09/05 21:51:21 drochner Exp $
 bin/certtool
 bin/gnutls-cli
 bin/gnutls-cli-debug
@@ -16,6 +16,18 @@ include/gnutls/openssl.h
 include/gnutls/pkcs12.h
 include/gnutls/x509.h
 info/gnutls.info
+info/gnutls-certificate-user-use-case.png
+info/gnutls-client-server-use-case.png
+info/gnutls-extensions_st.png
+info/gnutls-handshake-sequence.png
+info/gnutls-handshake-state.png
+info/gnutls-internals.png
+info/gnutls-layers.png
+info/gnutls-logo.png
+info/gnutls-mod_auth_st.png
+info/gnutls-objects.png
+info/gnutls-pgp.png
+info/gnutls-x509.png
 lib/libgnutls-extra.la
 lib/libgnutls-openssl.la
 lib/libgnutls.la
@@ -42,6 +54,11 @@ man/man3/gnutls_anon_set_server_params_function.3
 man/man3/gnutls_auth_client_get_type.3
 man/man3/gnutls_auth_get_type.3
 man/man3/gnutls_auth_server_get_type.3
+man/man3/gnutls_authz_enable.3
+man/man3/gnutls_authz_send_saml_assertion.3
+man/man3/gnutls_authz_send_saml_assertion_url.3
+man/man3/gnutls_authz_send_x509_attr_cert.3
+man/man3/gnutls_authz_send_x509_attr_cert_url.3
 man/man3/gnutls_bye.3
 man/man3/gnutls_certificate_activation_time_peers.3
 man/man3/gnutls_certificate_allocate_credentials.3
@@ -82,6 +99,7 @@ man/man3/gnutls_certificate_set_x509_trust_file.3
 man/man3/gnutls_certificate_set_x509_trust_mem.3
 man/man3/gnutls_certificate_type_get.3
 man/man3/gnutls_certificate_type_get_name.3
+man/man3/gnutls_certificate_type_list.3
 man/man3/gnutls_certificate_type_set_priority.3
 man/man3/gnutls_certificate_verify_peers.3
 man/man3/gnutls_certificate_verify_peers2.3
@@ -89,10 +107,13 @@ man/man3/gnutls_check_version.3
 man/man3/gnutls_cipher_get.3
 man/man3/gnutls_cipher_get_key_size.3
 man/man3/gnutls_cipher_get_name.3
+man/man3/gnutls_cipher_list.3
 man/man3/gnutls_cipher_set_priority.3
 man/man3/gnutls_cipher_suite_get_name.3
+man/man3/gnutls_cipher_suite_info.3
 man/man3/gnutls_compression_get.3
 man/man3/gnutls_compression_get_name.3
+man/man3/gnutls_compression_list.3
 man/man3/gnutls_compression_set_priority.3
 man/man3/gnutls_credentials_clear.3
 man/man3/gnutls_credentials_set.3
@@ -160,9 +181,11 @@ man/man3/gnutls_ia_verify_endphase.3
 man/man3/gnutls_init.3
 man/man3/gnutls_kx_get.3
 man/man3/gnutls_kx_get_name.3
+man/man3/gnutls_kx_list.3
 man/man3/gnutls_kx_set_priority.3
 man/man3/gnutls_mac_get.3
 man/man3/gnutls_mac_get_name.3
+man/man3/gnutls_mac_list.3
 man/man3/gnutls_mac_set_priority.3
 man/man3/gnutls_malloc.3
 man/man3/gnutls_openpgp_key_check_hostname.3
@@ -190,6 +213,7 @@ man/man3/gnutls_openpgp_privkey_deinit.3
 man/man3/gnutls_openpgp_privkey_get_pk_algorithm.3
 man/man3/gnutls_openpgp_privkey_import.3
 man/man3/gnutls_openpgp_privkey_init.3
+man/man3/gnutls_openpgp_privkey_sign_hash.3
 man/man3/gnutls_openpgp_send_key.3
 man/man3/gnutls_openpgp_set_recv_key_function.3
 man/man3/gnutls_openpgp_trustdb_deinit.3
@@ -241,6 +265,7 @@ man/man3/gnutls_prf.3
 man/man3/gnutls_prf_raw.3
 man/man3/gnutls_protocol_get_name.3
 man/man3/gnutls_protocol_get_version.3
+man/man3/gnutls_protocol_list.3
 man/man3/gnutls_protocol_set_priority.3
 man/man3/gnutls_psk_allocate_client_credentials.3
 man/man3/gnutls_psk_allocate_server_credentials.3
@@ -286,6 +311,8 @@ man/man3/gnutls_session_set_ptr.3
 man/man3/gnutls_set_default_export_priority.3
 man/man3/gnutls_set_default_priority.3
 man/man3/gnutls_sign_algorithm_get_name.3
+man/man3/gnutls_sign_callback_get.3
+man/man3/gnutls_sign_callback_set.3
 man/man3/gnutls_srp_allocate_client_credentials.3
 man/man3/gnutls_srp_allocate_server_credentials.3
 man/man3/gnutls_srp_base64_decode.3
@@ -319,11 +346,13 @@ man/man3/gnutls_x509_crl_get_dn_oid.3
 man/man3/gnutls_x509_crl_get_issuer_dn.3
 man/man3/gnutls_x509_crl_get_issuer_dn_by_oid.3
 man/man3/gnutls_x509_crl_get_next_update.3
+man/man3/gnutls_x509_crl_get_signature.3
 man/man3/gnutls_x509_crl_get_signature_algorithm.3
 man/man3/gnutls_x509_crl_get_this_update.3
 man/man3/gnutls_x509_crl_get_version.3
 man/man3/gnutls_x509_crl_import.3
 man/man3/gnutls_x509_crl_init.3
+man/man3/gnutls_x509_crl_print.3
 man/man3/gnutls_x509_crl_set_crt.3
 man/man3/gnutls_x509_crl_set_crt_serial.3
 man/man3/gnutls_x509_crl_set_next_update.3
@@ -358,6 +387,7 @@ man/man3/gnutls_x509_crt_deinit.3
 man/man3/gnutls_x509_crt_export.3
 man/man3/gnutls_x509_crt_get_activation_time.3
 man/man3/gnutls_x509_crt_get_authority_key_id.3
+man/man3/gnutls_x509_crt_get_basic_constraints.3
 man/man3/gnutls_x509_crt_get_ca_status.3
 man/man3/gnutls_x509_crt_get_crl_dist_points.3
 man/man3/gnutls_x509_crt_get_dn.3
@@ -365,8 +395,11 @@ man/man3/gnutls_x509_crt_get_dn_by_oid.3
 man/man3/gnutls_x509_crt_get_dn_oid.3
 man/man3/gnutls_x509_crt_get_expiration_time.3
 man/man3/gnutls_x509_crt_get_extension_by_oid.3
+man/man3/gnutls_x509_crt_get_extension_data.3
+man/man3/gnutls_x509_crt_get_extension_info.3
 man/man3/gnutls_x509_crt_get_extension_oid.3
 man/man3/gnutls_x509_crt_get_fingerprint.3
+man/man3/gnutls_x509_crt_get_issuer.3
 man/man3/gnutls_x509_crt_get_issuer_dn.3
 man/man3/gnutls_x509_crt_get_issuer_dn_by_oid.3
 man/man3/gnutls_x509_crt_get_issuer_dn_oid.3
@@ -376,19 +409,25 @@ man/man3/gnutls_x509_crt_get_key_usage.3
 man/man3/gnutls_x509_crt_get_pk_algorithm.3
 man/man3/gnutls_x509_crt_get_pk_dsa_raw.3
 man/man3/gnutls_x509_crt_get_pk_rsa_raw.3
+man/man3/gnutls_x509_crt_get_proxy.3
 man/man3/gnutls_x509_crt_get_raw_dn.3
 man/man3/gnutls_x509_crt_get_raw_issuer_dn.3
 man/man3/gnutls_x509_crt_get_serial.3
+man/man3/gnutls_x509_crt_get_signature.3
 man/man3/gnutls_x509_crt_get_signature_algorithm.3
+man/man3/gnutls_x509_crt_get_subject.3
 man/man3/gnutls_x509_crt_get_subject_alt_name.3
+man/man3/gnutls_x509_crt_get_subject_alt_othername_oid.3
 man/man3/gnutls_x509_crt_get_subject_key_id.3
 man/man3/gnutls_x509_crt_get_version.3
 man/man3/gnutls_x509_crt_import.3
 man/man3/gnutls_x509_crt_init.3
 man/man3/gnutls_x509_crt_list_import.3
 man/man3/gnutls_x509_crt_list_verify.3
+man/man3/gnutls_x509_crt_print.3
 man/man3/gnutls_x509_crt_set_activation_time.3
 man/man3/gnutls_x509_crt_set_authority_key_id.3
+man/man3/gnutls_x509_crt_set_basic_constraints.3
 man/man3/gnutls_x509_crt_set_ca_status.3
 man/man3/gnutls_x509_crt_set_crl_dist_points.3
 man/man3/gnutls_x509_crt_set_crq.3
@@ -399,6 +438,8 @@ man/man3/gnutls_x509_crt_set_issuer_dn_by_oid.3
 man/man3/gnutls_x509_crt_set_key.3
 man/man3/gnutls_x509_crt_set_key_purpose_oid.3
 man/man3/gnutls_x509_crt_set_key_usage.3
+man/man3/gnutls_x509_crt_set_proxy.3
+man/man3/gnutls_x509_crt_set_proxy_dn.3
 man/man3/gnutls_x509_crt_set_serial.3
 man/man3/gnutls_x509_crt_set_subject_alternative_name.3
 man/man3/gnutls_x509_crt_set_subject_key_id.3
@@ -408,6 +449,7 @@ man/man3/gnutls_x509_crt_sign2.3
 man/man3/gnutls_x509_crt_to_xml.3
 man/man3/gnutls_x509_crt_verify.3
 man/man3/gnutls_x509_crt_verify_data.3
+man/man3/gnutls_x509_dn_get_rdn_ava.3
 man/man3/gnutls_x509_dn_oid_known.3
 man/man3/gnutls_x509_privkey_cpy.3
 man/man3/gnutls_x509_privkey_deinit.3
@@ -425,6 +467,7 @@ man/man3/gnutls_x509_privkey_import_pkcs8.3
 man/man3/gnutls_x509_privkey_import_rsa_raw.3
 man/man3/gnutls_x509_privkey_init.3
 man/man3/gnutls_x509_privkey_sign_data.3
+man/man3/gnutls_x509_privkey_sign_hash.3
 man/man3/gnutls_x509_privkey_verify_data.3
 man/man3/gnutls_x509_rdn_get.3
 man/man3/gnutls_x509_rdn_get_by_oid.3
@@ -435,6 +478,7 @@ share/doc/gnutls/TODO
 share/doc/gnutls/gnutls.ps
 share/examples/gnutls/ex-alert.c
 share/examples/gnutls/ex-cert-select.c
+share/examples/gnutls/ex-client-authz.c
 share/examples/gnutls/ex-client-resume.c
 share/examples/gnutls/ex-client-srp.c
 share/examples/gnutls/ex-client-tlsia.c
@@ -444,6 +488,7 @@ share/examples/gnutls/ex-crq.c
 share/examples/gnutls/ex-pkcs12.c
 share/examples/gnutls/ex-rfc2818.c
 share/examples/gnutls/ex-serv-anon.c
+share/examples/gnutls/ex-serv-authz.c
 share/examples/gnutls/ex-serv-export.c
 share/examples/gnutls/ex-serv-pgp.c
 share/examples/gnutls/ex-serv-srp.c
@@ -455,6 +500,7 @@ share/examples/gnutls/tcp.c
 share/locale/de/LC_MESSAGES/gnutls.mo
 share/locale/en@boldquot/LC_MESSAGES/gnutls.mo
 share/locale/en@quot/LC_MESSAGES/gnutls.mo
+share/locale/ms/LC_MESSAGES/gnutls.mo
 share/locale/pl/LC_MESSAGES/gnutls.mo
 share/locale/sv/LC_MESSAGES/gnutls.mo
 @dirrm share/examples/gnutls
diff --git a/security/gnutls/buildlink3.mk b/security/gnutls/buildlink3.mk
index 50c4953e7b9..374e5fff89a 100644
--- a/security/gnutls/buildlink3.mk
+++ b/security/gnutls/buildlink3.mk
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.18 2007/06/06 06:23:59 wiz Exp $
+# $NetBSD: buildlink3.mk,v 1.19 2007/09/05 21:51:21 drochner Exp $
 
 BUILDLINK_DEPTH:=	${BUILDLINK_DEPTH}+
 GNUTLS_BUILDLINK3_MK:=	${GNUTLS_BUILDLINK3_MK}+
@@ -23,6 +23,6 @@ BUILDLINK_PKGSRCDIR.gnutls?=	../../security/gnutls
 .include "../../devel/zlib/buildlink3.mk"
 .include "../../security/libgcrypt/buildlink3.mk"
 .include "../../security/libtasn1/buildlink3.mk"
-#.include "../../security/opencdk/buildlink3.mk"
+.include "../../security/opencdk/buildlink3.mk"
 
 BUILDLINK_DEPTH:=	${BUILDLINK_DEPTH:S/+$//}
diff --git a/security/gnutls/distinfo b/security/gnutls/distinfo
index 09be5983770..a89dc8c5c9f 100644
--- a/security/gnutls/distinfo
+++ b/security/gnutls/distinfo
@@ -1,8 +1,9 @@
-$NetBSD: distinfo,v 1.36 2007/06/01 20:12:45 wiz Exp $
+$NetBSD: distinfo,v 1.37 2007/09/05 21:51:21 drochner Exp $
 
-SHA1 (gnutls-1.6.3.tar.bz2) = 7553b9f7ddd4982c0759b814bc6d9bf892cf7347
-RMD160 (gnutls-1.6.3.tar.bz2) = 31f9a5b5747b532199ecf6d6b45f0bf5f3b389f3
-Size (gnutls-1.6.3.tar.bz2) = 4286276 bytes
-SHA1 (patch-aa) = eb29cda3b79c6cf7303ebf53ace62a7834eac6bf
-SHA1 (patch-ab) = 088e7b11194dafeae0b6e2cf2736c6d34eecf6b6
-SHA1 (patch-ac) = 937b2ea324ffa0dccb37a0612d7ace8b0de9c00a
+SHA1 (gnutls-2.0.0.tar.bz2) = 985d86cb942b9d79abb5c8966439f23141ad803a
+RMD160 (gnutls-2.0.0.tar.bz2) = 4f0fac158749ac9df9d0f1c0dd0264ef26230b93
+Size (gnutls-2.0.0.tar.bz2) = 4764031 bytes
+SHA1 (patch-ab) = d1e28c1e8bf1af4f65f38571840d92c88b222d8f
+SHA1 (patch-ad) = 24d7eb4fc75b90b97697a05267de8966313e8899
+SHA1 (patch-ae) = 3b74520c79a129a29dbeee6c6b66d5aa42b9aa47
+SHA1 (patch-af) = bd4701640dfef5bfdce87d620befd93098b0dff3
diff --git a/security/gnutls/patches/patch-aa b/security/gnutls/patches/patch-aa
deleted file mode 100644
index 316419c8676..00000000000
--- a/security/gnutls/patches/patch-aa
+++ /dev/null
@@ -1,19 +0,0 @@
-$NetBSD: patch-aa,v 1.9 2007/01/24 15:58:04 tron Exp $
-
---- includes/gnutls/gnutlsxx.h.orig	2006-08-07 13:40:23.000000000 +0100
-+++ includes/gnutls/gnutlsxx.h	2007-01-24 11:29:43.000000000 +0000
-@@ -233,7 +233,14 @@
- {
-     public:
-         credentials(gnutls_credentials_type_t t);
-+#if defined(__APPLE__) || defined(__MACOS__)
-+        credentials( credentials& c) {
-+                type = c.type;
-+                set_ptr( c.ptr());
-+	}
-+#else
-         credentials( credentials& c);
-+#endif
-         virtual ~credentials() { }
-         gnutls_credentials_type_t get_type() const;
-     protected:
diff --git a/security/gnutls/patches/patch-ab b/security/gnutls/patches/patch-ab
index aae8164fa39..1853ce1b44a 100644
--- a/security/gnutls/patches/patch-ab
+++ b/security/gnutls/patches/patch-ab
@@ -1,13 +1,13 @@
-$NetBSD: patch-ab,v 1.6 2007/04/20 06:07:16 wiz Exp $
+$NetBSD: patch-ab,v 1.7 2007/09/05 21:51:22 drochner Exp $
 
---- doc/Makefile.in.orig	2007-04-18 12:35:11.000000000 +0000
+--- doc/Makefile.in.orig	2007-05-26 17:45:35.000000000 +0200
 +++ doc/Makefile.in
-@@ -483,7 +483,7 @@ gnutls.dvi: gnutls.texi $(srcdir)/versio
+@@ -603,7 +603,7 @@ gnutls.dvi: gnutls.texi $(srcdir)/versio
  gnutls.pdf: gnutls.texi $(srcdir)/version.texi $(gnutls_TEXINFOS)
  gnutls.html: gnutls.texi $(srcdir)/version.texi $(gnutls_TEXINFOS)
  $(srcdir)/version.texi:  $(srcdir)/stamp-vti
 -$(srcdir)/stamp-vti: gnutls.texi $(top_srcdir)/configure
 +$(srcdir)/stamp-vti: gnutls.texi
  	@(dir=.; test -f ./gnutls.texi || dir=$(srcdir); \
- 	set `$(SHELL) $(srcdir)/mdate-sh $$dir/gnutls.texi`; \
+ 	set `$(SHELL) $(top_srcdir)/build-aux/mdate-sh $$dir/gnutls.texi`; \
  	echo "@set UPDATED $$1 $$2 $$3"; \
diff --git a/security/gnutls/patches/patch-ac b/security/gnutls/patches/patch-ac
deleted file mode 100644
index 534c5c18d8e..00000000000
--- a/security/gnutls/patches/patch-ac
+++ /dev/null
@@ -1,18 +0,0 @@
-$NetBSD: patch-ac,v 1.3 2007/01/24 15:58:04 tron Exp $
-
---- lib/gnutlsxx.cpp.orig	2006-06-01 20:49:01.000000000 +0100
-+++ lib/gnutlsxx.cpp	2007-01-24 11:31:05.000000000 +0000
-@@ -822,11 +822,13 @@
- { 
- }
- 
-+#if !(defined(__APPLE__) || defined(__MACOS__))
- credentials::credentials( credentials& c)
- {
-     this->type = c.type;
-     this->set_ptr( c.ptr());
- }
-+#endif
- 
- gnutls_credentials_type_t credentials::get_type() const
- { 
diff --git a/security/gnutls/patches/patch-ad b/security/gnutls/patches/patch-ad
new file mode 100644
index 00000000000..18009aaaf05
--- /dev/null
+++ b/security/gnutls/patches/patch-ad
@@ -0,0 +1,13 @@
+$NetBSD: patch-ad,v 1.1 2007/09/05 21:51:22 drochner Exp $
+
+--- ./lib/x509/output.c.orig	2007-08-21 23:48:45.000000000 +0200
++++ ./lib/x509/output.c
+@@ -84,7 +84,7 @@ asciiprint (gnutls_string * str, const c
+   size_t j;
+ 
+   for (j = 0; j < len; j++)
+-    if (isprint (data[j]))
++    if (isprint ((unsigned char) data[j]))
+       addf (str, "%c", (unsigned char) data[j]);
+     else
+       addf (str, ".");
diff --git a/security/gnutls/patches/patch-ae b/security/gnutls/patches/patch-ae
new file mode 100644
index 00000000000..c7fe5be098d
--- /dev/null
+++ b/security/gnutls/patches/patch-ae
@@ -0,0 +1,23 @@
+$NetBSD: patch-ae,v 1.1 2007/09/05 21:51:22 drochner Exp $
+
+--- guile/src/core.c.orig	2007-09-04 18:11:37.000000000 +0200
++++ guile/src/core.c
+@@ -22,7 +22,7 @@
+ #include <gnutls/gnutls.h>
+ #include <libguile.h>
+ 
+-#include <alloca.h>
++#include <stdlib.h>
+ 
+ #include "enums.h"
+ #include "smobs.h"
+@@ -2380,7 +2380,8 @@ SCM_DEFINE (scm_gnutls_x509_certificate_
+       if (c_oid_actual_len < c_oid_len)					\
+ 	c_oid = scm_realloc (c_oid, c_oid_actual_len);			\
+ 									\
+-      result = scm_take_locale_string (c_oid);				\
++      result = scm_take_locale_stringn (c_oid,				\
++					c_oid_actual_len);		\
+     }									\
+ 									\
+   return result;
diff --git a/security/gnutls/patches/patch-af b/security/gnutls/patches/patch-af
new file mode 100644
index 00000000000..f66750f5d1b
--- /dev/null
+++ b/security/gnutls/patches/patch-af
@@ -0,0 +1,13 @@
+$NetBSD: patch-af,v 1.1 2007/09/05 21:51:22 drochner Exp $
+
+--- guile/src/extra.c.orig	2007-09-04 18:12:51.000000000 +0200
++++ guile/src/extra.c
+@@ -27,7 +27,7 @@
+ #include <gnutls/openpgp.h>
+ #include <libguile.h>
+ 
+-#include <alloca.h>
++#include <stdlib.h>
+ 
+ #include "errors.h"
+ #include "utils.h"