Mon Dec 3 15:19:51 2018 UTC ()
libssh: updated to 0.8.5

version 0.8.5:
* Added support to get known_hosts locations with ssh_options_get()
* Fixed preferred algorithm for known hosts negotiations
* Fixed KEX with some server implementations (e.g. Cisco)
* Fixed issues with MSVC
* Fixed keyboard-interactive auth in server mode
  (regression from CVE-2018-10933)
* Fixed gssapi auth in server mode (regression from CVE-2018-10933)
* Fixed socket fd handling with proxy command
* Fixed a memory leak with OpenSSL

version 0.8.4:
* Fixed CVE-2018-10933
* Fixed building without globbing support
* Fixed possible memory leaks
* Avoid SIGPIPE on sockets

version 0.8.3:
* Added support for rsa-sha2
* Added support to parse private keys in openssh container format
  (other than ed25519)
* Added support for diffie-hellman-group18-sha512 and
  diffie-hellman-group16-sha512
* Added ssh_get_fingerprint_hash()
* Added ssh_pki_export_privkey_base64()
* Added support for Match keyword in config file
* Improved performance and reduced memory footprint for sftp
* Fixed ecdsa publickey auth
* Fixed reading a closed channel
* Added support to announce posix-rename@openssh.com and
  hardlink@openssh.com in the sftp server

version 0.8.2:
* Added sha256 fingerprints for pubkeys
* Improved compiler flag detection
* Fixed race condition in reading sftp messages
* Fixed doxygen generation and added modern style
* Fixed library initialization on Windows
* Fixed __bounded__ attribute detection
* Fixed a bug in the options parser
* Fixed documentation for new knwon_hosts API

version 0.8.1:
* Fixed version number in the header
* Fixed version number in pkg-config and cmake config
* Fixed library initialization
* Fixed attribute detection

version 0.8.0:
* Removed support for deprecated SSHv1 protocol
* Added new connector API for clients
* Added new known_hosts parsing API
* Added support for OpenSSL 1.1
* Added support for chacha20-poly1305 cipher
* Added crypto backend for mbedtls crypto library
* Added ECDSA support with gcrypt backend
* Added advanced client and server testing using cwrap.org
* Added support for curve25519-sha256 alias
* Added support for global known_hosts file
* Added support for symbol versioning
* Improved ssh_config parsing
* Improved threading support


(adam)
diff -r1.24 -r1.25 pkgsrc/security/libssh/Makefile
diff -r1.8 -r1.9 pkgsrc/security/libssh/PLIST
diff -r1.17 -r1.18 pkgsrc/security/libssh/buildlink3.mk
diff -r1.13 -r1.14 pkgsrc/security/libssh/distinfo
diff -r1.3 -r1.4 pkgsrc/security/libssh/options.mk
diff -r0 -r1.1 pkgsrc/security/libssh/patches/patch-CompilerChecks.cmake
diff -r1.6 -r0 pkgsrc/security/libssh/patches/patch-aa
diff -r1.1 -r0 pkgsrc/security/libssh/patches/patch-cmake_Modules_DefineCompilerFlags.cmake
cvs diff -r1.24 -r1.25 pkgsrc/security/libssh/Makefile (expand / switch to unified diff)

--- pkgsrc/security/libssh/Makefile 2018/10/16 20:25:25 1.24
+++ pkgsrc/security/libssh/Makefile 2018/12/03 15:19:51 1.25
@@ -1,31 +1,36 @@ @@ -1,31 +1,36 @@
1# $NetBSD: Makefile,v 1.24 2018/10/16 20:25:25 maya Exp $ 1# $NetBSD: Makefile,v 1.25 2018/12/03 15:19:51 adam Exp $
2# 2#
3# history: upstream renamed 0.11 to 0.1.1; 3# history: upstream renamed 0.11 to 0.1.1;
4# we have to use the old-style convention so that version compares work. 4# we have to use the old-style convention so that version compares work.
5# 
6VER= 0.7.6 
7DISTNAME= libssh-${VER} 
8PKGNAME= libssh-0.76 
9CATEGORIES= security 
10MASTER_SITES= https://www.libssh.org/files/0.7/ 
11EXTRACT_SUFX= .tar.xz 
12 
13MAINTAINER= is@NetBSD.org 
14HOMEPAGE= http://www.libssh.org/ 
15COMMENT= SSHv2+v1 protocol library 
16LICENSE= 2-clause-bsd 
17 5
18DIST_SUBDIR= security 6VER= 0.8.5
 7DISTNAME= libssh-${VER}
 8PKGNAME= libssh-0.85
 9CATEGORIES= security
 10MASTER_SITES= https://www.libssh.org/files/${VER:R}/
 11EXTRACT_SUFX= .tar.xz
 12
 13MAINTAINER= is@NetBSD.org
 14HOMEPAGE= http://www.libssh.org/
 15COMMENT= SSHv2+v1 protocol library
 16LICENSE= 2-clause-bsd
19 17
20USE_CMAKE= yes 18USE_CMAKE= yes
21USE_LANGUAGES= c c++ 19USE_LANGUAGES= c c++
22CMAKE_ARGS+= WITH_TESTING=yes 
23 
24PKGCONFIG_OVERRIDE+= libssh.pc.in 20PKGCONFIG_OVERRIDE+= libssh.pc.in
25TEST_TARGET= check 21TEST_TARGET= test
 22
 23CONFIGURE_DIRS= ${WRKDIR}/build
 24CMAKE_ARG_PATH= ${WRKSRC}
 25CMAKE_ARGS+= -DUNIT_TESTING=ON
26 26
27.include "options.mk" 27.include "options.mk"
28 28
 29post-extract:
 30 ${MKDIR} ${WRKDIR}/build
 31
29.include "../../devel/argp/buildlink3.mk" 32.include "../../devel/argp/buildlink3.mk"
 33.include "../../devel/cmocka/buildlink3.mk"
30.include "../../devel/zlib/buildlink3.mk" 34.include "../../devel/zlib/buildlink3.mk"
 35.include "../../mk/krb5.buildlink3.mk"
31.include "../../mk/bsd.pkg.mk" 36.include "../../mk/bsd.pkg.mk"
cvs diff -r1.8 -r1.9 pkgsrc/security/libssh/PLIST (expand / switch to unified diff)

--- pkgsrc/security/libssh/PLIST 2018/10/16 20:25:25 1.8
+++ pkgsrc/security/libssh/PLIST 2018/12/03 15:19:51 1.9
@@ -1,18 +1,14 @@ @@ -1,18 +1,14 @@
1@comment $NetBSD: PLIST,v 1.8 2018/10/16 20:25:25 maya Exp $ 1@comment $NetBSD: PLIST,v 1.9 2018/12/03 15:19:51 adam Exp $
2include/libssh/callbacks.h 2include/libssh/callbacks.h
3include/libssh/legacy.h 3include/libssh/legacy.h
4include/libssh/libssh.h 4include/libssh/libssh.h
5include/libssh/libsshpp.hpp 5include/libssh/libsshpp.hpp
6include/libssh/server.h 6include/libssh/server.h
7include/libssh/sftp.h 7include/libssh/sftp.h
8include/libssh/ssh2.h 8include/libssh/ssh2.h
9lib/cmake/libssh/libssh-config-version.cmake 9lib/cmake/libssh/libssh-config-version.cmake
10lib/cmake/libssh/libssh-config.cmake 10lib/cmake/libssh/libssh-config.cmake
11lib/libssh.so 11lib/libssh.so
12lib/libssh.so.4 12lib/libssh.so.4
13lib/libssh.so.4.4.3 13lib/libssh.so.4.7.2
14lib/libssh_threads.so 
15lib/libssh_threads.so.4 
16lib/libssh_threads.so.4.4.3 
17lib/pkgconfig/libssh.pc 14lib/pkgconfig/libssh.pc
18lib/pkgconfig/libssh_threads.pc 
cvs diff -r1.17 -r1.18 pkgsrc/security/libssh/buildlink3.mk (expand / switch to unified diff)

--- pkgsrc/security/libssh/buildlink3.mk 2016/10/09 22:02:07 1.17
+++ pkgsrc/security/libssh/buildlink3.mk 2018/12/03 15:19:51 1.18
@@ -1,26 +1,24 @@ @@ -1,26 +1,24 @@
1# $NetBSD: buildlink3.mk,v 1.17 2016/10/09 22:02:07 kamil Exp $ 1# $NetBSD: buildlink3.mk,v 1.18 2018/12/03 15:19:51 adam Exp $
2 2
3BUILDLINK_TREE+= libssh 3BUILDLINK_TREE+= libssh
4 4
5.if !defined(LIBSSH_BUILDLINK3_MK) 5.if !defined(LIBSSH_BUILDLINK3_MK)
6LIBSSH_BUILDLINK3_MK:= 6LIBSSH_BUILDLINK3_MK:=
7 7
8BUILDLINK_API_DEPENDS.libssh+= libssh>=0.54 8BUILDLINK_API_DEPENDS.libssh+= libssh>=0.54
9BUILDLINK_ABI_DEPENDS.libssh+= libssh>=0.73nb1 9BUILDLINK_ABI_DEPENDS.libssh+= libssh>=0.73nb1
10BUILDLINK_PKGSRCDIR.libssh?= ../../security/libssh 10BUILDLINK_PKGSRCDIR.libssh?= ../../security/libssh
11 11
12pkgbase := libssh 12pkgbase := libssh
13.include "../../mk/pkg-build-options.mk" 13.include "../../mk/pkg-build-options.mk"
14 14
15.if !empty(PKG_BUILD_OPTIONS.libssh:Mzlib) 
16.include "../../devel/zlib/buildlink3.mk" 
17.endif 
18 
19.if !empty(PKG_BUILD_OPTIONS.libssh:Mopenssl) 15.if !empty(PKG_BUILD_OPTIONS.libssh:Mopenssl)
20.include "../../security/openssl/buildlink3.mk" 16.include "../../security/openssl/buildlink3.mk"
21.endif 17.endif
22 18
23.include "../../devel/argp/buildlink3.mk" 19.include "../../devel/argp/buildlink3.mk"
 20.include "../../devel/zlib/buildlink3.mk"
 21.include "../../mk/krb5.buildlink3.mk"
24.endif # LIBSSH_BUILDLINK3_MK 22.endif # LIBSSH_BUILDLINK3_MK
25 23
26BUILDLINK_TREE+= -libssh 24BUILDLINK_TREE+= -libssh
cvs diff -r1.13 -r1.14 pkgsrc/security/libssh/distinfo (expand / switch to unified diff)

--- pkgsrc/security/libssh/distinfo 2018/10/16 20:25:25 1.13
+++ pkgsrc/security/libssh/distinfo 2018/12/03 15:19:51 1.14
@@ -1,8 +1,7 @@ @@ -1,8 +1,7 @@
1$NetBSD: distinfo,v 1.13 2018/10/16 20:25:25 maya Exp $ 1$NetBSD: distinfo,v 1.14 2018/12/03 15:19:51 adam Exp $
2 2
3SHA1 (security/libssh-0.7.6.tar.xz) = 8e5f23a861f84fa214ca1da0e3f98b839ff7c051 3SHA1 (libssh-0.8.5.tar.xz) = b5564774f986e396a7288a593595455bf10d9ce8
4RMD160 (security/libssh-0.7.6.tar.xz) = 7316fae4a5355cf2c511cd91a5a65d7354ab361f 4RMD160 (libssh-0.8.5.tar.xz) = a118e08705257814531ce6c01d2d48cf0d6e59ce
5SHA512 (security/libssh-0.7.6.tar.xz) = 2a01402b5a9fab9ecc29200544ed45d3f2c40871ed1c8241ca793f8dc7fdb3ad2150f6a522c4321affa9b8778e280dc7ed10f76adfc4a73f0751ae735a42f56c 5SHA512 (libssh-0.8.5.tar.xz) = f1e90a5046e006d44a48ab36675167761d8e308ada7a1d7a1f7ba2825d222a2fab7e19dbc78b1371fee9ba74d9c55d9856a623f97842c9b9ad4c79215e344124
6Size (security/libssh-0.7.6.tar.xz) = 366556 bytes 6Size (libssh-0.8.5.tar.xz) = 427372 bytes
7SHA1 (patch-aa) = 2f9a7c8a629188f40f3c94d4304b1e44720e45ae 7SHA1 (patch-CompilerChecks.cmake) = 86de41ab778d25368691c1b0b9ecfa653f24cc5d
8SHA1 (patch-cmake_Modules_DefineCompilerFlags.cmake) = 9f140ad664363953e4c7ff4e3bede74c693da993 
cvs diff -r1.3 -r1.4 pkgsrc/security/libssh/options.mk (expand / switch to unified diff)

--- pkgsrc/security/libssh/options.mk 2018/01/25 19:52:38 1.3
+++ pkgsrc/security/libssh/options.mk 2018/12/03 15:19:51 1.4
@@ -1,27 +1,20 @@ @@ -1,27 +1,20 @@
1# $NetBSD: options.mk,v 1.3 2018/01/25 19:52:38 markd Exp $ 1# $NetBSD: options.mk,v 1.4 2018/12/03 15:19:51 adam Exp $
2 2
3PKG_OPTIONS_VAR= PKG_OPTIONS.libssh 3PKG_OPTIONS_VAR= PKG_OPTIONS.libssh
4PKG_OPTIONS_REQUIRED_GROUPS= crypto 4PKG_OPTIONS_REQUIRED_GROUPS= crypto
5PKG_OPTIONS_GROUP.crypto= openssl libgcrypt 5PKG_OPTIONS_GROUP.crypto= openssl libgcrypt
6#PKG_SUPPORTED_OPTIONS= compression 6PKG_SUGGESTED_OPTIONS= openssl
7PKG_SUGGESTED_OPTIONS= openssl # XXX zlib 
8 7
9.include "../../mk/bsd.options.mk" 8.include "../../mk/bsd.options.mk"
10 9
11.if !empty(PKG_OPTIONS:Mzlib) 
12BUILDLINK_API_DEPENDS.zlib+= zlib>=1.2 
13CONFIGURE_ARGS+= --with-libz=${BUILDLINK_PREFIX.zlib:Q} 
14.include "../../devel/zlib/buildlink3.mk" 
15.endif 
16 
17.if !empty(PKG_OPTIONS:Mopenssl) 10.if !empty(PKG_OPTIONS:Mopenssl)
18BUILDLINK_API_DEPENDS.openssl+= openssl>=0.9.8 11BUILDLINK_API_DEPENDS.openssl+= openssl>=0.9.8
19CMAKE_ARGS+= -DWITH_GCRYPT:BOOL=OFF 12CMAKE_ARGS+= -DWITH_GCRYPT:BOOL=OFF
20.include "../../security/openssl/buildlink3.mk" 13.include "../../security/openssl/buildlink3.mk"
21.endif 14.endif
22 15
23.if !empty(PKG_OPTIONS:Mlibgcrypt) 16.if !empty(PKG_OPTIONS:Mlibgcrypt)
24BUILDLINK_API_DEPENDS.libgcrypt+= libgcrypt>=1.4 17BUILDLINK_API_DEPENDS.libgcrypt+= libgcrypt>=1.4
25CMAKE_ARGS+= -DWITH_GCRYPT:BOOL=ON 18CMAKE_ARGS+= -DWITH_GCRYPT:BOOL=ON
26.include "../../security/libgcrypt/buildlink3.mk" 19.include "../../security/libgcrypt/buildlink3.mk"
27.endif 20.endif
File Added: pkgsrc/security/libssh/patches/Attic/patch-CompilerChecks.cmake
$NetBSD: patch-CompilerChecks.cmake,v 1.1 2018/12/03 15:19:51 adam Exp $

Let PkgSrc handle security features.

--- CompilerChecks.cmake.orig	2018-12-03 09:27:44.000000000 +0000
+++ CompilerChecks.cmake
@@ -62,20 +62,7 @@ if (UNIX)
         endif()
     endif()
 
-    check_c_compiler_flag_ssp("-fstack-protector-strong" WITH_STACK_PROTECTOR_STRONG)
-    if (WITH_STACK_PROTECTOR_STRONG)
-        list(APPEND SUPPORTED_COMPILER_FLAGS "-fstack-protector-strong")
-    else (WITH_STACK_PROTECTOR_STRONG)
-        check_c_compiler_flag_ssp("-fstack-protector" WITH_STACK_PROTECTOR)
-        if (WITH_STACK_PROTECTOR)
-            list(APPEND SUPPORTED_COMPILER_FLAGS "-fstack-protector")
-        endif()
-    endif (WITH_STACK_PROTECTOR_STRONG)
 
-    check_c_compiler_flag_ssp("-fstack-clash-protection" WITH_STACK_CLASH_PROTECTION)
-    if (WITH_STACK_CLASH_PROTECTION)
-        list(APPEND SUPPORTED_COMPILER_FLAGS "-fstack-clash-protection")
-    endif()
 
     if (PICKY_DEVELOPER)
         add_c_compiler_flag("-Wno-error=deprecated-declarations" SUPPORTED_COMPILER_FLAGS)
File Deleted: pkgsrc/security/libssh/patches/Attic/patch-aa
File Deleted: pkgsrc/security/libssh/patches/Attic/patch-cmake_Modules_DefineCompilerFlags.cmake