* Version 3.5.9 (released 2017-02-12)

** libgnutls: Removed any references to OpenPGP functionality in documentation,
   and marked all functions in openpgp.h as deprecated. That functionality
   is considered deprecated and should not be used for other reason than
   backwards compatibility.

** libgnutls: Improve detection of AVX support. In certain cases when
   when the instruction was available on the host, but not on a VM running
   gnutls, detection could fail causing illegal instruction usage.

** libgnutls: Added support for IDNA2008 for internationalized DNS names.
   If gnutls is compiled using libidn2 (the latest version is recommended),
   it will support IDNA2008 instead of the now obsolete IDNA2003 standard.
   Resolves gitlab issue 150. Based on patch by Tim Ruehsen.

** p11tool: re-use ID from corresponding objects when writing certificates.
   That is, when writing a certificate which has a corresponding public key,
   or private key in the token, ensure that we use the same ID for the
   certificate.

** API and ABI modifications:
gnutls_idna_map: Added
gnutls_idna_reverse_map: Added

3 files changed, 17 insertions, 94 deletions

diff --git a/security/gnutls/Makefile b/security/gnutls/Makefile
index 18df4bf1feb..ce35a17c28f 100644
--- a/security/gnutls/Makefile
+++ b/security/gnutls/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.169 2017/01/10 16:23:49 wiz Exp $
+# $NetBSD: Makefile,v 1.170 2017/02/26 09:19:56 adam Exp $
 
-DISTNAME=	gnutls-3.5.8
+DISTNAME=	gnutls-3.5.9
 CATEGORIES=	security devel
 MASTER_SITES=	ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/
 EXTRACT_SUFX=	.tar.xz
@@ -22,6 +22,9 @@ CONFIGURE_ARGS+=	--disable-guile
 CONFIGURE_ARGS+=	--disable-libdane
 CONFIGURE_ARGS+=	--without-tpm
 CONFIGURE_ARGS+=	--disable-valgrind-tests
+# Assembler support is broken for SunOS in 3.2.9.
+CONFIGURE_ARGS.SunOS+=	--disable-hardware-acceleration
+CONFIGURE_ARGS.FreeBSD+=ac_cv_type_max_align_t=yes
 
 # as of 3.5.8, 0 test failures
 TEST_TARGET=		check
@@ -53,11 +56,6 @@ MAKE_ENV+=		TZ=UTC
 
 EGDIR=		${PREFIX}/share/examples/gnutls
 
-# Assembler support is broken for SunOS in 3.2.9.
-CONFIGURE_ARGS.SunOS+=	--disable-hardware-acceleration
-
-CONFIGURE_ARGS.FreeBSD+=	ac_cv_type_max_align_t=yes
-
 INSTALLATION_DIRS=	${DOCDIR} ${EGDIR} include/gnutls
 
 post-install:
@@ -66,19 +64,19 @@ post-install:
 .include "../../archivers/lzo/buildlink3.mk"
 .include "../../converters/libiconv/buildlink3.mk"
 .include "../../devel/autogen/buildlink3.mk"
-.include "../../mk/readline.buildlink3.mk"
 .include "../../devel/gettext-lib/buildlink3.mk"
+.include "../../devel/gmp/buildlink3.mk"
 .include "../../devel/libcfg+/buildlink3.mk"
 # Avoid creating a fake zlib.pc, because if it does
 # gnutls will add a Requires.private for it in its .pc file
 CHECK_BUILTIN.zlib:=yes
 .include "../../devel/zlib/buildlink3.mk"
-.include "../../devel/gmp/buildlink3.mk"
+# guile is useful for selftests, but bindings should be separate pkgs
+#.include "../../lang/guile20/buildlink3.mk"
 BUILDLINK_API_DEPENDS.libtasn1+=	libtasn1>=4.9
 .include "../../security/libtasn1/buildlink3.mk"
 BUILDLINK_API_DEPENDS.nettle+=		nettle>=3.1
 .include "../../security/nettle/buildlink3.mk"
 .include "../../textproc/libunistring/buildlink3.mk"
-# guile is useful for selftests, but bindings should be separate pkgs
-#.include "../../lang/guile20/buildlink3.mk"
+.include "../../mk/readline.buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff --git a/security/gnutls/PLIST b/security/gnutls/PLIST
index 55c25cb91a3..b521e8c2c19 100644
--- a/security/gnutls/PLIST
+++ b/security/gnutls/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.54 2017/01/10 16:23:49 wiz Exp $
+@comment $NetBSD: PLIST,v 1.55 2017/02/26 09:19:56 adam Exp $
 bin/certtool
 bin/gnutls-cli
 bin/gnutls-cli-debug
@@ -32,7 +32,6 @@ info/gnutls-internals.png
 info/gnutls-layers.png
 info/gnutls-logo.png
 info/gnutls-modauth.png
-info/gnutls-pgp.png
 info/gnutls-x509.png
 info/gnutls.info
 info/pkcs11-vision.png
@@ -101,8 +100,6 @@ man/man3/gnutls_certificate_free_crls.3
 man/man3/gnutls_certificate_free_keys.3
 man/man3/gnutls_certificate_get_crt_raw.3
 man/man3/gnutls_certificate_get_issuer.3
-man/man3/gnutls_certificate_get_openpgp_crt.3
-man/man3/gnutls_certificate_get_openpgp_key.3
 man/man3/gnutls_certificate_get_ours.3
 man/man3/gnutls_certificate_get_peers.3
 man/man3/gnutls_certificate_get_peers_subkey_id.3
@@ -119,13 +116,6 @@ man/man3/gnutls_certificate_set_known_dh_params.3
 man/man3/gnutls_certificate_set_ocsp_status_request_file.3
 man/man3/gnutls_certificate_set_ocsp_status_request_function.3
 man/man3/gnutls_certificate_set_ocsp_status_request_function2.3
-man/man3/gnutls_certificate_set_openpgp_key.3
-man/man3/gnutls_certificate_set_openpgp_key_file.3
-man/man3/gnutls_certificate_set_openpgp_key_file2.3
-man/man3/gnutls_certificate_set_openpgp_key_mem.3
-man/man3/gnutls_certificate_set_openpgp_key_mem2.3
-man/man3/gnutls_certificate_set_openpgp_keyring_file.3
-man/man3/gnutls_certificate_set_openpgp_keyring_mem.3
 man/man3/gnutls_certificate_set_params_function.3
 man/man3/gnutls_certificate_set_pin_function.3
 man/man3/gnutls_certificate_set_retrieve_function.3
@@ -289,6 +279,8 @@ man/man3/gnutls_hmac_get_len.3
 man/man3/gnutls_hmac_init.3
 man/man3/gnutls_hmac_output.3
 man/man3/gnutls_hmac_set_nonce.3
+man/man3/gnutls_idna_map.3
+man/man3/gnutls_idna_reverse_map.3
 man/man3/gnutls_init.3
 man/man3/gnutls_key_generate.3
 man/man3/gnutls_kx_get.3
@@ -347,75 +339,8 @@ man/man3/gnutls_oid_to_ecc_curve.3
 man/man3/gnutls_oid_to_mac.3
 man/man3/gnutls_oid_to_pk.3
 man/man3/gnutls_oid_to_sign.3
-man/man3/gnutls_openpgp_crt_check_email.3
-man/man3/gnutls_openpgp_crt_check_hostname.3
-man/man3/gnutls_openpgp_crt_check_hostname2.3
-man/man3/gnutls_openpgp_crt_deinit.3
-man/man3/gnutls_openpgp_crt_export.3
-man/man3/gnutls_openpgp_crt_export2.3
-man/man3/gnutls_openpgp_crt_get_auth_subkey.3
-man/man3/gnutls_openpgp_crt_get_creation_time.3
-man/man3/gnutls_openpgp_crt_get_expiration_time.3
-man/man3/gnutls_openpgp_crt_get_fingerprint.3
-man/man3/gnutls_openpgp_crt_get_key_id.3
-man/man3/gnutls_openpgp_crt_get_key_usage.3
-man/man3/gnutls_openpgp_crt_get_name.3
-man/man3/gnutls_openpgp_crt_get_pk_algorithm.3
-man/man3/gnutls_openpgp_crt_get_pk_dsa_raw.3
-man/man3/gnutls_openpgp_crt_get_pk_rsa_raw.3
-man/man3/gnutls_openpgp_crt_get_preferred_key_id.3
-man/man3/gnutls_openpgp_crt_get_revoked_status.3
-man/man3/gnutls_openpgp_crt_get_subkey_count.3
-man/man3/gnutls_openpgp_crt_get_subkey_creation_time.3
-man/man3/gnutls_openpgp_crt_get_subkey_expiration_time.3
-man/man3/gnutls_openpgp_crt_get_subkey_fingerprint.3
-man/man3/gnutls_openpgp_crt_get_subkey_id.3
-man/man3/gnutls_openpgp_crt_get_subkey_idx.3
-man/man3/gnutls_openpgp_crt_get_subkey_pk_algorithm.3
-man/man3/gnutls_openpgp_crt_get_subkey_pk_dsa_raw.3
-man/man3/gnutls_openpgp_crt_get_subkey_pk_rsa_raw.3
-man/man3/gnutls_openpgp_crt_get_subkey_revoked_status.3
-man/man3/gnutls_openpgp_crt_get_subkey_usage.3
-man/man3/gnutls_openpgp_crt_get_version.3
-man/man3/gnutls_openpgp_crt_import.3
-man/man3/gnutls_openpgp_crt_init.3
-man/man3/gnutls_openpgp_crt_print.3
-man/man3/gnutls_openpgp_crt_set_preferred_key_id.3
-man/man3/gnutls_openpgp_crt_verify_ring.3
-man/man3/gnutls_openpgp_crt_verify_self.3
-man/man3/gnutls_openpgp_keyring_check_id.3
-man/man3/gnutls_openpgp_keyring_deinit.3
-man/man3/gnutls_openpgp_keyring_get_crt.3
-man/man3/gnutls_openpgp_keyring_get_crt_count.3
-man/man3/gnutls_openpgp_keyring_import.3
-man/man3/gnutls_openpgp_keyring_init.3
-man/man3/gnutls_openpgp_privkey_deinit.3
-man/man3/gnutls_openpgp_privkey_export.3
-man/man3/gnutls_openpgp_privkey_export2.3
-man/man3/gnutls_openpgp_privkey_export_dsa_raw.3
-man/man3/gnutls_openpgp_privkey_export_rsa_raw.3
-man/man3/gnutls_openpgp_privkey_export_subkey_dsa_raw.3
-man/man3/gnutls_openpgp_privkey_export_subkey_rsa_raw.3
-man/man3/gnutls_openpgp_privkey_get_fingerprint.3
-man/man3/gnutls_openpgp_privkey_get_key_id.3
-man/man3/gnutls_openpgp_privkey_get_pk_algorithm.3
-man/man3/gnutls_openpgp_privkey_get_preferred_key_id.3
-man/man3/gnutls_openpgp_privkey_get_revoked_status.3
-man/man3/gnutls_openpgp_privkey_get_subkey_count.3
-man/man3/gnutls_openpgp_privkey_get_subkey_creation_time.3
-man/man3/gnutls_openpgp_privkey_get_subkey_expiration_time.3
-man/man3/gnutls_openpgp_privkey_get_subkey_fingerprint.3
-man/man3/gnutls_openpgp_privkey_get_subkey_id.3
-man/man3/gnutls_openpgp_privkey_get_subkey_idx.3
-man/man3/gnutls_openpgp_privkey_get_subkey_pk_algorithm.3
-man/man3/gnutls_openpgp_privkey_get_subkey_revoked_status.3
-man/man3/gnutls_openpgp_privkey_import.3
-man/man3/gnutls_openpgp_privkey_init.3
-man/man3/gnutls_openpgp_privkey_sec_param.3
-man/man3/gnutls_openpgp_privkey_set_preferred_key_id.3
 man/man3/gnutls_openpgp_privkey_sign_hash.3
 man/man3/gnutls_openpgp_send_cert.3
-man/man3/gnutls_openpgp_set_recv_key_function.3
 man/man3/gnutls_packet_deinit.3
 man/man3/gnutls_packet_get.3
 man/man3/gnutls_pcert_deinit.3
diff --git a/security/gnutls/distinfo b/security/gnutls/distinfo
index 8a0c3d6d620..db885a8e561 100644
--- a/security/gnutls/distinfo
+++ b/security/gnutls/distinfo
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.122 2017/01/10 16:23:49 wiz Exp $
+$NetBSD: distinfo,v 1.123 2017/02/26 09:19:56 adam Exp $
 
-SHA1 (gnutls-3.5.8.tar.xz) = 238d5e62f9bb078101131dd2f4c7f2c1ac13e813
-RMD160 (gnutls-3.5.8.tar.xz) = 77cd2f4a6da7cf1eece05422bc86b29833b08772
-SHA512 (gnutls-3.5.8.tar.xz) = e6cdc4f9f2e41bd10e61b90b6b5ea3882c80a7130de8a0e9c23e373985cdc332128529dad49d6854fe93ee934e1bbde8b34dfd19e354b3a8e11b22d61424292e
-Size (gnutls-3.5.8.tar.xz) = 7264448 bytes
+SHA1 (gnutls-3.5.9.tar.xz) = f3f184a92f128af1c2fb29b29a4d325af65694a5
+RMD160 (gnutls-3.5.9.tar.xz) = a200b078cf9204f70dfaae7c045fc2f762a22809
+SHA512 (gnutls-3.5.9.tar.xz) = 17a05143eaa70ee61b149a5f09ae7a688cb3f314ad1e67ce41a778e5960717e276cc780f3db9b6923c14c4d998e17563c134cab5297502181cd2dabb47da3515
+Size (gnutls-3.5.9.tar.xz) = 7166932 bytes
 SHA1 (patch-ae) = 5e020483ac14ef6ccc45a53e351242ab16c860f1
 SHA1 (patch-lib_Makefile.in) = d0e292e632a91a9f19e39bd2c2d205a086ba5588
 SHA1 (patch-src_libopts_autoopts_options.h) = 9202c55314fe8764ac82c95bbfabfa1b031e9ba4