summaryrefslogtreecommitdiff
path: root/security/openssl
AgeCommit message (Collapse)AuthorFilesLines
2008-07-14Catch distinfo up with the removal of patch-a[bh].dsainty1-3/+1
(Hi Tobias :)
2008-07-14Update to openssl-0.9.8h. Changes from 0.9.8g:tnn4-37/+6
Two crashes discovered using the Codenomicon TLS test suite, as reported in CVE-2008-0891 and CVE-2008-1672, were fixed. The root CA certificates of commercial CAs were removed from the distribution. Functions were added to implement RFC3394 compatible AES key wrapping. Utility functions to handle ASN1 structures were added. The certificate status request TLS extension, as defined in RFC3546, was implemented. Several other bugfixes and enhancements were made.
2008-06-16Fix shared library build on various architectures. This basically fiddlestonnerre3-20/+20
with the number of colons between the fields.
2008-06-03Fix two Denial of Service vulnerabilities in OpenSSL 0.9.8g:tonnerre4-2/+35
- Fix flaw if 'Server Key exchange message' is omitted from a TLS handshake which could lead to a silent crash. - Fix double free in TLS server name extensions which could lead to a remote crash. Patches from upstream.
2008-05-08Fix build of OpenSSL on NetBSD/amd64 (4.0 and current tested)tonnerre2-4/+4
2008-04-25Fix detection of openssl configuration directory on NetBSD so it'sjlam1-3/+5
/etc/openssl only if USE_BUILTIN.openssl is "yes".
2008-04-12Convert to use PLIST_VARS instead of manually passing "@comment "jlam2-11/+11
through PLIST_SUBST to the plist module.
2008-02-20Link shared libraries with -rpath on IRIX to prevent check-shlibs errors.tnn2-4/+13
2008-01-17Update to openssl-0.9.8g. Provided by Jukka Salmi in pkgsrc-wip.tnn29-634/+262
pkgsrc notes: o Tested on NetBSD/i386 (Jukka Salmi), Mac OSX 10.5 (Adrian Portelli), Linux (Jeremy C. Reed), Tru64 5.1b (tnn), HP-UX 11i (tnn). Because the Makefile system has been rewamped, other platforms may require fixes. Please test if you can. o OpenSSL can now be built with installation to DESTDIR. Overview of important changes since 0.9.7i: o Add gcc 4.2 support. o DTLS improvements. o RFC4507bis support. o TLS Extensions support. o RFC3779 support. o New cipher Camellia o Updated ECC cipher suite support. o New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free(). o Zlib compression usage fixes. o Major work on the BIGNUM library for higher efficiency and to make operations more streamlined and less contradictory. This is the result of a major audit of the BIGNUM library. o Addition of BIGNUM functions for fields GF(2^m) and NIST curves, to support the Elliptic Crypto functions. o Major work on Elliptic Crypto; ECDH and ECDSA added, including the use through EVP, X509 and ENGINE. o New ASN.1 mini-compiler that's usable through the OpenSSL configuration file. o Added support for ASN.1 indefinite length constructed encoding. o New PKCS#12 'medium level' API to manipulate PKCS#12 files. o Complete rework of shared library construction and linking programs with shared or static libraries, through a separate Makefile.shared. o Rework of the passing of parameters from one Makefile to another. o Changed ENGINE framework to load dynamic engine modules automatically from specifically given directories. o New structure and ASN.1 functions for CertificatePair. o Changed the key-generation and primality testing "progress" mechanism to take a structure that contains the ticker function and an argument. o New engine module: GMP (performs private key exponentiation). o New engine module: VIA PadLOck ACE extension in VIA C3 Nehemiah processors. o Added support for IPv6 addresses in certificate extensions. See RFC 1884, section 2.2. o Added support for certificate policy mappings, policy constraints and name constraints. o Added support for multi-valued AVAs in the OpenSSL configuration file. o Added support for multiple certificates with the same subject in the 'openssl ca' index file. o Make it possible to create self-signed certificates using 'openssl ca -selfsign'. o Make it possible to generate a serial number file with 'openssl ca -create_serial'. o New binary search functions with extended functionality. o New BUF functions. o New STORE structure and library to provide an interface to all sorts of data repositories. Supports storage of public and private keys, certificates, CRLs, numbers and arbitrary blobs. This library is unfortunately unfinished and unused withing OpenSSL. o New control functions for the error stack. o Changed the PKCS#7 library to support one-pass S/MIME processing. o New FIPS 180-2 algorithms (SHA-224, -256, -384 and -512). o New X509_VERIFY_PARAM structure to support parametrisation of X.509 path validation. o Change the default digest in 'openssl' commands from MD5 to SHA-1. o Added support for DTLS. o New BIGNUM blinding. o Added support for the RSA-PSS encryption scheme o Added support for the RSA X.931 padding. o Added support for files larger than 2GB. o Added alternate pkg-config files.
2008-01-07Fix builtin.mk logic for thread feature if no native OpenSSL exists.joerg1-2/+3
Fixes PR pkg/37699 from Aleksey Cheusov.
2008-01-05Fixed a few pkglint warnings.rillig3-7/+8
2008-01-04Removed the special-case handling of PKG_SYSCONFDIR for NetBSD. Now therillig1-6/+2
configuration files are installed in the usual pkgsrc place, not in /etc. PKGREVISION++ Ok'ed by jlam@.
2007-12-27Remove deprecated "fee-based commercial use" license for idea, mdc2,gdt1-11/+8
rc5, and replace with {idea,mdc2,rc5}-nonlicense. Because pkgsrc does not yet handle multiple licenses, set LICENSE to openssl-patented-algorithms-nonlicense.
2007-10-21Full and proper fix for CVE-2007-5135adrianp3-14/+48
PKGREVISION++
2007-09-07Allow packages that use OpenSSL to specify that they need an OpenSSLjlam2-12/+35
built with support for threads. This is done by adding the following line to the package Makefile before the inclusion of openssl/buildlink3.mk: USE_FEATURES.openssl= threads The openssl/builtin.mk file is also adjusted to detect whether or not the built-in OpenSSL was built with support for threads and the result is used accordingly to determine whether or not a pkgsrc OpenSSL is needed.
2007-08-04Add a target configuration for Tru64 with gcc.tnn5-22/+64
2007-07-18Compile OpenSSL with supports for threads. This allows an applicationtron1-3/+3
to register callbacks which implement locking primitive to make OpenSSL thread-safe. Bump package revision because of this change.
2007-05-30Removed some code duplication from the buildlink3 files by using the newrillig1-8/+3
pkg-build-options.mk procedure.
2007-05-03Fix typo in "SUBST_MESSAGE.dl".tron1-2/+2
2007-04-26Also link with the "dl" library when creating the shared libraries.tron3-15/+24
Another attempt to fix PR pkg/36086.
2007-04-24Use all necessary means to convince OpenSSL's "special" build systemtron1-4/+10
to link with the "dl" library under Mac OS X if necessary. This should finally fix PR pkg/36086.
2007-04-18Make sure that the "dlcompat" related options are actually added totron1-1/+3
"LDFLAGS". This is another attempt to fix PR pkg/36086.
2007-04-17Because OpenSSL uses dlfcn(3) only internally and Mac OS X supports sharedtron1-3/+1
library dependences we don't need to include "dlopen.buildlink3.mk" here.
2007-04-17Use "pkgsrc/mk/dlopen.buildlink3.mk" instead of manually includingtron2-9/+6
"pkgsrc/devel/dlcompat/buildlink3.mk" under Darwin. This might finally fix PR pkg/36086.
2007-04-01Add ${BUILDLINK_LDFLAGS.dlcompat} (defined as "-ldl") to "LDFLAGS" undertron1-1/+3
Mac OS X. This is harmless under recent versions of Mac OS X where "libdl.dylib" is symbolic link to "libSystem.dylib". And it is necessary under old versions of Mac OS X (Jaguar and older) where we need the "libdl.dylib" from the "dlcompat" package. This should finally fix PR pkg/36086 by John D. Baker.
2007-03-26Include "pkgsrc/devel/dlcompat/buildlink3.mk" when building this packagetron1-1/+5
under Mac OS X. This should fix PR pkg/36086.
2007-02-22Whitespace cleanup, courtesy of pkglint.wiz1-8/+8
Patch provided by Sergey Svishchev in private mail.
2006-12-12Replace mk/bsd.prefs.mk includes with bsd.fast.prefs.mk includes.joerg1-2/+2
The redundant parsing of bsd.prefs.mk is mostly avoided now and parse time e.g. for x11/kdebase3 gets reduced by up to 10%.
2006-12-03Check for GCC on IRIX instead of assuming the native compiler is used.cbiere1-1/+5
2006-09-30Apply patches which fixes recent security problem of OpenSSL.taca14-3/+337
http://secunia.com/advisories/22130/ Bump PKGREVISION.
2006-09-07Add a patch to address CVE-2006-4339adrianp3-3/+32
2006-08-09some apps (dovecot) need the SSLDIR rather than SSLCERTS & SSLKEYSabs1-10/+10
2006-07-08Change the format of BUILDLINK_ORDER to contain depth information as well,jlam1-2/+2
and add a new helper target and script, "show-buildlink3", that outputs a listing of the buildlink3.mk files included as well as the depth at which they are included. For example, "make show-buildlink3" in fonts/Xft2 displays: zlib fontconfig iconv zlib freetype2 expat freetype2 Xrender renderproto
2006-07-08Track information in a new variable BUILDLINK_ORDER that informs usjlam1-1/+2
of the order in which buildlink3.mk files are (recursively) included by a package Makefile.
2006-06-13Forgotten patchsum update.joerg1-2/+2
2006-06-12Add DragonFly support.joerg4-12/+45
2006-04-06Over 1200 files touched but no revisions bumped :)reed2-5/+5
RECOMMENDED is removed. It becomes ABI_DEPENDS. BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo. BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo. BUILDLINK_DEPENDS does not change. IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS which defaults to "yes". Added to obsolete.mk checking for IGNORE_RECOMMENDED. I did not manually go through and fix any aesthetic tab/spacing issues. I have tested the above patch on DragonFly building and packaging subversion and pkglint and their many dependencies. I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I have used IGNORE_RECOMMENDED for a long time). I have been an active user of IGNORE_RECOMMENDED since it was available. As suggested, I removed the documentation sentences suggesting bumping for "security" issues. As discussed on tech-pkg. I will commit to revbump, pkglint, pkg_install, createbuildlink separately. Note that if you use wip, it will fail! I will commit to pkgsrc-wip later (within day).
2006-03-30Avoid extra stat() calls by not repeatedly checking whether a filejlam1-5/+7
exists on the disk -- we can just check whether a variable defined by find-files.mk is "__nonexistent__" or not.
2006-03-14Drop maintainership for packages that I no longer have time to maintain.jlam1-2/+2
2006-03-02add support for Solaris/i386 and x86_64, and fallback to the configuregrant1-6/+17
script's auto detection for other archs.
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg2-3/+4
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-27Update patch to also use PKGMANDIR instead of "man" for thereed2-4/+4
MANDIR in the makefile.
2005-12-17Change my MAINTAINER email address to the one I've been using forjlam1-2/+2
pkgsrc work.
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig1-3/+3
CONFIGURE_ARGS.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig1-2/+2
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-10-31Fix build on Interix; it seems % has special meaning in Configure now.tv2-4/+4
2005-10-15Update security/openssl from 0.9.7h to 0.9.7i. Changes from versionjlam2-6/+6
0.9.7h include fixing a shared library upgrade problem where openssl-0.9.7h had a different ABI than previous 0.9.7 sub-revisions due to a changed constant.
2005-10-12If the native openssl-0.9.7d contains the security fixes pulled up tojlam1-3/+16
the netbsd-2-0, netbsd-2, and netbsd-3-0 branches on 2005-10-11, then for the purposes of satisfying dependencies, pretend it's openssl-0.9.7h.
2005-10-12Remove leading "-" from version number when matching the openssl-0.9.6gjlam1-2/+2
from the netbsd-1-6 branch with the 20040401 fix.
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-26 22:18:47 +0000