aboutsummaryrefslogtreecommitdiff
path: root/secure
Commit message (Collapse)AuthorAgeFilesLines
* crypto/openssl: add manpages missed in related commitEnji Cooper2026-08-292-0/+522
| | | | | | MFC with: 78e936b2d Fixes: 0d4d0f3a9 ("crypto/openssl: update generated content ...") Reported by: Jenkins CI
* crypto/openssl: update generated content to match 3.5.8 releaseEnji Cooper2026-08-29899-1033/+1494
| | | | | | | This contains 2 new manpages as well as some minor manpage content changes. MFC with: 78e936b2d
* Only build secure/libexec/ssh-sk-helper if MK_USB == noEnji Cooper2026-07-222-5/+4
| | | | | | | The ssh-sk-helper utility only functions if/when MK_USB == yes. Installing it on systems where MK_USB == no doesn't make sense. Differential Revision: https://reviews.freebsd.org/D58246
* OpenSSH: Update to 10.4p1Ed Maste2026-07-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Full release notes are available at https://www.openssh.com/txt/release-10.4 Selected highlights from the release notes: Potentially-incompatible changes -------------------------------- * sshd(8): configuration dump mode ("sshd -G") now writes directives in mixed case (e.g. "PubkeyAuthentication") whereas previously it emitted only lower-case names. * ssh(1), sshd(8): make the transport protocol stricter by disconnecting if the peer sends non-KEX messages during a post- authentication key re-exchange. Previously a malicious peer could continue sending non-key exchange messages without penalty. These would be buffered, causing memory to be wasted up until the connection terminated or the server/client hit a memory limit. Implementations that do not restrict messages sent during key exchange as per RFC4253 section 7.1 may be disconnected. Reported by Marko Jevtic. Changes since OpenSSH 10.3 ========================== This release contains a number of security fixes as well as general bugfixes and a couple of new features. Security ======== * sftp(1): when downloading files on the command-line using "sftp host:/path .", a malicious server could cause the file to be downloaded to an unexpected location. This issue was identified by the Swival Security Scanner. * scp(1): when copying files between two remote destinations, do not allow a malicious server to write files to the parent directory of the intended target directory. This issue was identified by the Swival Security Scanner. * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes as it was documented to do. Note that PermitTunnel is not enabled by default. Reported independently by Huzaifa Sidhpurwala of Redhat and Marko Jevtic. * sshd(8): avoid a potential pre-authentication denial of service when GSSAPIAuthentication was enabled (this feature is off by default). This was not mitigated by MaxAuthTries, but would be penalised by PerSourcePenalties. This was reported by Manfred Kaiser of the milCERT AT (Austrian Ministry of Defence). * sshd(8): fix a number of cases where the minimum authentication delay was not being enforced. Reported by the Orange Cyberdefense Vulnerability Team. * ssh(1): fix a possible client-side use-after-free if the server changes its host key during a key reexchange. This was reported by Zhenpeng (Leo) Lin of Depthfirst. New features ------------ * All: add experimental support for a composite post-quantum signature scheme that combines ML-DSA 44 and Ed25519 as specified in draft-miller-sshm-mldsa44-ed25519-composite-sigs. This scheme is not enabled by default. To use it, you'll need to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc. Keys may be generated using "ssh-keygen -t mldsa44-ed25519". Bugfixes -------- * sshd(8): avoid sending observably different messages for valid vs invalid users in GSSAPIAuthentication (disabled by default). * ssh(1), sshd(8): fix several bugs that incorrectly classified bulk traffic as interactive. bz3972, bz3958 * ssh-keygen(1), ssh-add(1): skip unsupported key types when downloading resident keys from a FIDO token. Previously, downloads would abort when one was encountered. GHPR657 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58083
* crypto/openssl: update artifacts to match 3.5.7 releaseEnji Cooper2026-06-10898-973/+1117
| | | | | MFC after: 3 days MFC with: 1523ccfd9
* OpenSSH: Update to 10.3p1Ed Maste2026-05-144-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Full release notes are available at https://www.openssh.com/txt/release-10.3 Selected highlights from the release notes: * ssh(1), sshd(8): remove bug compatibility for implementations that don't support rekeying. If such an implementation tries to interoperate with OpenSSH, it will now eventually fail when the transport needs rekeying. * ssh(1), sshd(8): support IANA-assigned codepoints for SSH agent forwarding, as per draft-ietf-sshm-ssh-agent. Support for the new names is advertised via the EXT_INFO message. If a server offers support for the new names, then they are used preferentially. * ssh(1): add a ~I escape option that shows information about the current SSH connection. * sshd(8): add 'invaliduser' penalty to PerSourcePenalties, which is applied to login attempts for usernames that do not match real accounts. Defaults to 5s to match 'authfail' but allows administrators to block such attempts for longer if desired. * Support the ed25519 signature scheme via libcrypto. Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D56999
* OpenSSH: Update to 10.1p1Ed Maste2026-05-122-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Full release notes are available at https://www.openssh.com/txt/release-10.1 Selected highlights from the release notes: Potentially-incompatible changes * ssh(1): add a warning when the connection negotiates a non-post quantum key agreement algorithm. * ssh(1), sshd(8): major changes to handling of DSCP marking/IPQoS * ssh(1), sshd(8): deprecate support for IPv4 type-of-service (ToS) keywords in the IPQoS configuration directive. * ssh-add(1): when adding certificates to an agent, set the expiry to the certificate expiry time plus a short (5 min) grace period. * ssh-agent(1), sshd(8): move agent listener sockets from /tmp to under ~/.ssh/agent for both ssh-agent(1) and forwarded sockets in sshd(8). Security * ssh(1): disallow control characters in usernames passed via the commandline or expanded using %-sequences from the configuration file, and disallow \0 characters in ssh:// URIs. New features * ssh(1), sshd(8): add SIGINFO handlers to log active channel and session information. Sponsored by: The FreeBSD Foundation
* caroot: RegenerateDag-Erling Smørgrav2026-04-27105-5662/+3198
| | | | | | | Regenerate using certificate data from NSS 3.123.1. MFC after: 1 week Reviewed by: kevans
* caroot: Clean upDag-Erling Smørgrav2026-04-27194-1300/+800
| | | | | | | | | | | | | | | | | | | | * Get certdata.txt directly from the NSS Mercurial repository, rather than from the Mozilla Firefox repository which imports it from NSS at irregular intervals. * Instead of always fetching the latest certdata.txt, fetch a specific version. For this commit, we set this to the version that was last imported in May 2025. * Add a refrence to the MPL to the generated files. * Regenerate with latest OpenSSL. This is purely cosmetic; mostly, the certificate names now contain less unnecessary whitespace and some elements are quoted. MFC after: 1 week Reviewed by: michaelo, kevans Differential Revision: https://reviews.freebsd.org/D56620
* OpenSSL: move `-DOPENSSL_PIC` from `PIC_FLAG` to `SHARED_CFLAGS`Enji Cooper2026-04-221-1/+1
| | | | | | | | | `PIC_FLAG` should be used strictly for `-fPIC`, `-fpic`, etc, options. `SHARED_CFLAGS` is the more appropriate place to this flag to be set. Requested by: jrtc27 MFC after: 3 days MFC with: 3797fe720a
* [OpenSSL] Add missing header file (openssl/ml_kem.h)Po-Chuan Hsieh2026-04-121-1/+1
| | | | | | | | Add missing header file (openssl/ml_kem.h) of OpenSSL 3.5 Reviewed by: fluffy, ngie Approved by: ngie (maintainer) Differential Revision: https://reviews.freebsd.org/D56291
* crypto/openssl: add new manpage from release 3.5.6Enji Cooper2026-04-092-0/+110
| | | | | MFC after: 1 day (the security issues warrant a quick backport). MFC with: 10a428653ee7216475f1ddce3fb4cbf1200319f8
* crypto/openssl: update artifacts to match 3.5.6 release artifactsEnji Cooper2026-04-09897-1349/+1578
| | | | | | | A new manpage and any associated links will be added in the next commit. MFC after: 1 day (the security issues warrant a quick backport). MFC with: 10a428653ee7216475f1ddce3fb4cbf1200319f8
* libcrypto: compile all PIC objects with -DOPENSSL_PIC -fPICEnji Cooper2026-03-222-6/+3
| | | | | | | | | | | | This change modifies the libcrypto PIC objects to always compile with `-DOPENSSL_PIC -fPIC` to restore parity with the upstream build process. This ensures that the legacy provider is built with parity to the upstream legacy provider. MFC after: 12 days Tested with: `make check` (legacy provider), `make universe` Fixes: 14b9955e Differential Revision: https://reviews.freebsd.org/D44896
* Revert "libcrypto: compile all PIC objects with -DOPENSSL_PIC"Enji Cooper2026-03-201-2/+0
| | | | | | | | | | | | | | This commit broke the build with some build options. Some validation needs to be done to confirm that moving the preprocessor argument to `secure/lib/libcrypto/Makefile.inc` works without breaking the build, but revert for now until a `tinderbox` run can be done with the change. PR: 293934 Reported by: Jenkins, Trond Endrestøl This reverts commit 14b9955e57cc28b61e785165b9effcbe620edb46.
* libcrypto: compile all PIC objects with -DOPENSSL_PICEnji Cooper2026-03-201-0/+2
| | | | | | | | | | | This change modifies the libcrypto PIC objects to always compile with `-DOPENSSL_PIC` to restore parity with the upstream build process. This ensures that `-DOPENSSL_PIC` is used whenever building the auxiliary shared objects. In this case, just the legacy provider (we no longer distribute the fips provider). MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D44896
* OpenSSL: install EVP_CIPHER_CTX_get_app_data.3 onceBrooks Davis2026-02-171-1/+0
| | | | | | | | | | | | A separate EVP_CIPHER_CTX_get_app_data.3 was added in the OpenSSL 3.5.5 import, but the link to EVP_EncryptInit.3 was still being installed which stomped on the file and created inconsistent entries in the METALOG. Reviewed by: emaste Found by: package_check script in Cirrus-CI Fixes: 1731fc70f734 ("OpenSSL: update vendor sources to match 3.5.5 content") Sponsored by: Innovate UK Differential Revision: https://reviews.freebsd.org/D55332
* OpenSSL: update vendor sources to match 3.5.5 contentEnji Cooper2026-01-31898-5725/+9185
| | | | | MFC with: f25b8c9fb4f58cf61adb47d7570abe7caa6d385d MFC after: 1 week
* libcrypto: Install tests in the tests packageLexi Winter2025-11-051-1/+1
| | | | | | | | | | | | libcrypto's Makefile.inc used PACKAGE=openssl, which overrides the PACKAGE=tests in libcrypto/tests/Makefile. Use PACKAGE?=openssl instead to avoid this. This puts the OpenSSL tests in the tests package where they belong. MFC after: 1 day Reviewed by: manu, ngie Sponsored by: https://www.patreon.com/bsdivy Differential Revision: https://reviews.freebsd.org/D53595
* OpenSSL: install .pc files from the exporters subdirEnji Cooper2025-10-172-11/+3
| | | | | | | | | | | | | | | | | | | | | | | | The .pc files generated in the root directory are used as part of the build; they should never be installed. Use the versions from the exporters subdirectory--which should be installed--as the .pc files which are distributed with FreeBSD. This avoids the need for "fixing up" these files after the fact (see `crypto/openssl/BSDmakefile` for more details as part of this change). Garbage collect `secure/lib/libcrypto/Makefile.version`, et al, as they're orphaned files. They were technically unused prior to this change as the vendor process properly embeds the version numbers in various files, but this commit formalizes the removal. This correction/clarification on the .pc files will be made in an upcoming release of OpenSSL [1]. References: 1. https://github.com/openssl/openssl/issues/28803 Suggested by: Richard Levitte (OpenSSL project) MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D53043
* openssl: add a simple smoke test for the legacy providerEnji Cooper2025-10-173-0/+48
| | | | | | | | | | | This change adds a simple smoke test for the legacy provider to ensure that the provider doesn't break in the future when performing updates. This is not a functional or system test; the OpenSSL test suite does a much better job at doing this than we can. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D53045
* blocklist: Rename blacklist to blocklistJose Luis Duran2025-10-123-11/+11
| | | | | | | | | | | | | | | | | | Follow up upstream rename from blacklist to blocklist. - Old names and rc scripts are still valid, but emitting an ugly warning - Old firewall rules and anchor names should work, but emitting an ugly warning - Old MK_BLACKLIST* knobs are wired to the new ones Although care has been taken not to break current configurations, this is a large patch containing mostly duplicated code. If issues arise, it will be swiftly reverted. Reviewed by: ivy (pkgbase) Approved by: emaste (mentor) MFC after: 2 days Relnotes: yes
* libpkgecc: Remove -ffreestandingLexi Winter2025-10-081-1/+0
| | | | | | | | | | | This incorporates pkg(8) commit a31c8c3682a3 for consistency. https://github.com/freebsd/pkg/commit/a31c8c3682a3 MFC after: 1 day Reviewed by: kevans Sponsored by: https://www.patreon.com/bsdivy Differential Revision: https://reviews.freebsd.org/D52920
* crypto/openssl: update generated files to match 3.5.4 artifactsEnji Cooper2025-10-07894-913/+918
| | | | | | MFC with: 046c625e9382 Fixes: 046c625e9382 ("crypto/openssl: update to 3.5.4") Reported by: Herbert J. Skuhra <herbert@gojira.at>
* crypto/openssl: update build artifacts for the 3.5.3 releaseEnji Cooper2025-09-22894-1007/+1053
| | | | | | | | | This change updates the build artifacts to match the 3.5.3 release. Much of the change involves updating version numbers and release dates to match the release version's metadata. MFC after: 1 week MFC with: 88b8b7f0c4e9948667a2279e78e975a784049cba
* OpenSSL: update Makefiles to reflect 3.5.1 releaseEnji Cooper2025-09-184-32/+67
| | | | | | | | | | | | | | This is a targeted effort to update the INCS and SRCS entries for libcrypto, the legacy provider, and libssl to match what upstream (OpenSSL) builds in their respective libraries. The number of stylistic changes were kept at a minimum. Another incoming change will reformat this file to make future maintenance easier. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52554
* Update the installed manpages to match OpenSSL 3.5.1Enji Cooper2025-09-082-1983/+2768
| | | | | MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52008
* openssl: Disable KTLS in bootstrap librariesMark Johnston2025-09-042-2/+3
| | | | | | | | | We need to build OpenSSL when bootstrapping certctl. On MacOS ktls_enable() isn't defined anywhere, so without this the build fails. We don't need KTLS in the bootstrap library, so just disable it. Reviewed by: khorben, ngie Differential Revision: https://reviews.freebsd.org/D52341
* openssl: link enough files for the legacy provider to actually loadGleb Smirnoff2025-09-011-3/+4
| | | | | Reviewed by: khorben, ngie Differential Revision: https://reviews.freebsd.org/D52113
* sshd-auth: Chase MK_GSSAPI changesEd Maste2025-08-261-6/+5
| | | | | Fixes: 8e28d84935f2 ("OpenSSH: Update to 10.0p2") Sponsored by: The FreeBSD Foundation
* OpenSSH: Update to 10.0p2Ed Maste2025-08-263-3/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Full release notes are available at https://www.openssh.com/txt/release-10.0 Selected highlights from the release notes: Potentially-incompatible changes - This release removes support for the weak DSA signature algorithm. [This change was previously merged to FreeBSD main.] - This release has the version number 10.0 and announces itself as "SSH-2.0-OpenSSH_10.0". Software that naively matches versions using patterns like "OpenSSH_1*" may be confused by this. - sshd(8): this release removes the code responsible for the user authentication phase of the protocol from the per-connection sshd-session binary to a new sshd-auth binary. Security - sshd(8): fix the DisableForwarding directive, which was failing to disable X11 forwarding and agent forwarding as documented. [This change was previously merged to FreeBSD main.] New features - ssh(1): the hybrid post-quantum algorithm mlkem768x25519-sha256 is now used by default for key agreement. Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D51630
* caroot: Rename script and normalize licenseDag-Erling Smørgrav2025-08-252-35/+35
| | | | | | MFC after: 1 week Reviewed by: mandree, markj Differential Revision: https://reviews.freebsd.org/D51775
* caroot: Generate both trusted and untrustedDag-Erling Smørgrav2025-08-254-99/+51
| | | | | | | | | | Until now, the untrusted directory has been maintained manually. Modify the script used to maintain the trusted directory so it can handle both. While here, clean it up a bit. MFC after: 1 week Reviewed by: mandree, markj Differential Revision: https://reviews.freebsd.org/D51774
* packages: Improve handling of -lib packagesLexi Winter2025-08-235-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For some packages (OpenSSL, Kerberos) we want to ship runtime libraries in a separate package, e.g. openssl and openssl-lib. Currently this is done using PACKAGE=openssl-lib, but that creates packages with strange names like openssl-lib-lib32. Instead, add a new LIB_PACKAGE option to bsd.lib.mk that causes runtime libraries to be placed in a new -lib subpackage. This significantly improves the set of packages we create; for example, OpenSSL goes from: FreeBSD-openssl FreeBSD-openssl-dbg FreeBSD-openssl-lib FreeBSD-openssl-lib-dbg FreeBSD-openssl-lib-dbg-lib32 FreeBSD-openssl-lib-dev FreeBSD-openssl-lib-dev-lib32 FreeBSD-openssl-lib-lib32 FreeBSD-openssl-lib-man FreeBSD-openssl-man to: FreeBSD-openssl FreeBSD-openssl-dbg FreeBSD-openssl-dbg-lib32 FreeBSD-openssl-dev FreeBSD-openssl-dev-lib32 FreeBSD-openssl-lib FreeBSD-openssl-lib32 FreeBSD-openssl-man While here, move /usr/bin/krb5-config and /usr/bin/compile_et into the kerberos-dev package. Reviewed by: des Differential Revision: https://reviews.freebsd.org/D51925
* crypto/openssl: make vendor imports easier/less error proneEnji Cooper2025-08-212-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds a custom BSD makefile containing multiple high-level PHONY targets, similar to targets provided by the ports framework. The Makefile does the following: - Reruns Configure with a deterministic set of arguments to ensure that all appropriate features have been enabled/disabled in OpenSSL. - Preens the pkgconfig files to remove duplicate paths in their `CFLAGS` and `includedir` variables. - Rebuilds all ASM files to ensure that the content contained is fresh. - Rebuilds all manpages to ensure that the content contained in the manpages is fresh. Some additional work needs to be done to make the manpage regeneration "operation" reproducible (the date the manpages were generated is embedded in the files). All dynamic configuration previously captured in `include/openssl/configuration.h` and `include/crypto/bn_conf.h` has been moved to `freebsd/include/dynamic_freebsd_configuration.h` and `freebsd/include/crypto/bn_conf.h`, respectively. This helps ensure that future updates don't wipe out FreeBSD customizations to these files, which tune behavior on a per-target architecture basis, e.g., ARM vs x86, 32-bit vs 64-bit, etc. MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D51663
* libssl: unbreak building the library with KTLSEnji Cooper2025-08-211-0/+2
| | | | | | | | | | | | | | | The 3.5.1 update dropped a `SRCS` entry for the MK_OPENSSL_KTLS != no case (the source was renamed from `ktls.c` to `ktls_meth.c`). Add the new file to SRCS in order to unbreak linking the library when KTLS is enabled. This bug isn't apparent now because KTLS is always disabled in `include/openssl/configuration.h` (this will be fixed soon). Found when doing `make universe` with KTLS enabled in `include/openssl/configuration.h`. Fixes: 4757b351ea9d59d ("openssl: Import version 3.5.1")
* Remove MK_GSSAPILexi Winter2025-08-204-5/+4
| | | | | | | | | | | | | | | For MIT Kerberos, MK_GSSAPI has no meaning: GSSAPI is a required part of Kerberos and is always built if MK_KERBEROS is enabled. Backport this behaviour to Heimdal so it works the same way. While here, change Heimdal's libcom_err and compile_et to be selected by MK_KERBEROS, not MK_KERBEROS_SUPPORT, since these are part of Kerberos and third-party users might need it even if Kerberos support is disabled in the base system. This means MK_KERBEROS_SUPPORT installs the same files with both MIT and Heimdal. Reviewed by: cy Differential Revision: https://reviews.freebsd.org/D51859
* build: remove certctl requirement for host OpenSSL libs on macOSKyle Evans2025-08-192-2/+5
| | | | | | | | | | | | | | | | | | Some platforms, like macOS, do not expose headers for the system's libcrypto for public consumption. libcrypto is relatively heavy and needs to know, e.g., the host system's endianness, so we scope the build down to macOS where OpenSSL headers are known to not be present and we can be reasonably certain that most of the systems today that would be cross-building are little endian. We still don't bother if building WITHOUT_OPENSSL since the end result is expected to be used by OpenSSL, but perhaps we could revisit that independently in case one, e.g., brings their own implementation. Reported by: jrtc27 Reviewed by: jrtc27, ngie Fixes: c340ef28fd38 ("certctl: Reimplement in C") Differential Revision: https://reviews.freebsd.org/D51935
* openssl: Import version 3.5.1Pierre Pronchery2025-08-07909-91038/+60363
| | | | | | | | | | Migrate to OpenSSL 3.5 in advance of FreeBSD 15.0. OpenSSL 3.0 will be EOL after 2026-09-07. Approved by: philip (mentor) Sponsored by: Alpha-Omega Beach Cleaning Project Sponsored by: The FreeBSD Foundation Differential revision: https://reviews.freebsd.org/D51613
* gssapi,krb5: Replace libgssapi with the MIT versionCy Schubert2025-08-073-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | lib/libgssapi is based on Heimdal. As on Linux systems, the MIT libgssapi_krb5 replaces it. With both gssapi libraries and header files installed results in broken buildworld (gssd) and ports that will not build without modifications to support the MIT gssapi in an alternate location. 73ed0c7992fd removed the MIT GSSAPI headers from /usr/include. Apps using MIT KRB5 gssapi functions and structures will fail to build without this patch. This patch includes a temporary patch to usr.sbin/gssd to allow it to build with this patch. rmacklem@ has a patch for this and for kgssapi that uses this patch to resolve kgssapi issues for NFS with Kerberos. This patch is an updated version of D51661 to allow it to build following additional patchs to the tree. This should have been implmented with 7e35117eb07f. Fixes: 7e35117eb07f, 73ed0c7992fd Differential Revision: https://reviews.freebsd.org/D51661
* openssh: Support building with MIT KRB5Cy Schubert2025-06-162-0/+13
| | | | | | | | | | | | Remove HEIMDAL=1 from openssh/krb5_config.h and move the definition to the Makefile in order to control whether we're building under Heimdal or MIT. Add MIT KRB5 LIBS and INCLUDES to the openssh build. Sponsored by: The FreeBSD Foundation Reviewed by: markj Differential revision: https://reviews.freebsd.org/D50782
* build: remove the last vestiges of lint supportBrooks Davis2025-06-053-5/+0
| | | | | | | | | Commit 1cbb58886a47 (shipped in 12.0.0) removed all lint infrastructure. A bunch of NO_LINT definitions remained (perhaps as a bootstrapping measture). Remove them. Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D50704
* caroot: Update certdata URL for GitHub switchMichael Osipov2025-05-281-1/+1
| | | | | | | | | | | Mozilla has migrated its projects' source code to GitHub, update certdata URL along with it. Reference: https://github.com/curl/curl/pull/17321 Reviewed by: jrm (mentor), otis (mentor), kevans MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D50575
* openssh: Add ${SKSRCS} to libsshJose Luis Duran2025-05-201-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | sshkey.c references sshsk_sign(), which is defined in ${SKSRCS}. Due to how FreeBSD builds libssh, or put differently, due to upstream not building a shared libssh.so, we need to partially revert 65d8491719bb ("secure: Adapt Makefile to ssh-sk-client everywhere"), and add ${SKSRCS} back, to avoid linking problems, especially when building with GCC: /usr/local/bin/ld: /usr/obj/usr/src/amd64.amd64/secure/lib/libssh/libprivatessh.so: undefined reference to `sshsk_sign' collect2: error: ld returned 1 exit status` Put the sources in a separate line, to maintain line-by-line compatibility with upstream Makefile.in PR: 286580 Reviewed by: emaste Approved by: emaste (mentor) Fixes: 65d8491719bb ("secure: Adapt Makefile to ssh-sk-client everywhere") Differential Revision: https://reviews.freebsd.org/D50020
* libcrypto: move engines and modules to openssl-libLexi Winter2025-05-052-0/+3
| | | | | | | | | | | | | | | | | currently, some OpenSSL-related files end up in the utilities package: /usr/lib/engines-3/capi.so /usr/lib/engines-3/devcrypto.so /usr/lib/engines-3/loader_attic.so /usr/lib/engines-3/padlock.so /usr/lib/ossl-modules/legacy.so since these are part of OpenSSL and are not useful without it, move them to the openssl-lib package. Reviewed by: manu, des, emaste Approved by: des (mentor) Differential Revision: https://reviews.freebsd.org/D50144
* secure: Add ssh-sk-client to all consumers of libsshJohn Baldwin2025-04-223-3/+3
| | | | | | | These all failed to link with ld.bfd used by GCC due to Fssh_sshsk_sign being an unresolved symbol. Fixes: 65d8491719bb ("secure: Adapt Makefile to ssh-sk-client everywhere")
* secure: Adapt Makefile to ssh-sk-client everywhereJose Luis Duran2025-04-1711-11/+11
| | | | | | | | | Upstream commit 7b47b40b1 ("adapt Makefile to ssh-sk-client everywhere") adapted the Makefiles to ssh-sk-client. Do the same here. Reviewed by: emaste Approved by: emaste (mentor) Differential Revision: https://reviews.freebsd.org/D49795
* secure: Match SRCS with upstream Makefile.inJose Luis Duran2025-04-171-1/+2
| | | | | | Reviewed by: emaste Approved by: emaste (mentor) Differential Revision: https://reviews.freebsd.org/D49794
* secure: Rearrange Makefile SRCS to match upstream Makefile.inJose Luis Duran2025-04-177-14/+24
| | | | | | | | | | | SRCS entries are kept in the same order and with the same line breaks as upstream, to make comparison easier. No functional change intended. Reviewed by: emaste Approved by: emaste (mentor) Differential Revision: https://reviews.freebsd.org/D49793
* openssh: Request the OpenSSL 1.1 APIJose Luis Duran2025-03-271-0/+2
| | | | | | | | | | | | | Upstream OpenSSH commit f51423bda ("request 1.1x API compatibility for OpenSSL >=3.x") requests OPENSSL_API_COMPAT version 0x10100000L (OpenSSL 1.1.0), in order to avoid warnings about deprecated functions. Do the same here, to avoid getting those warnings. Reviewed by: emaste Approved by: emaste (mentor) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D49517
generated by cgit v1.3 (git 2.53.0) at 2026-09-17 06:03:17 +0000