BSD Commit Log Search

   update to rspamd-4.2.0

   libtls: move tls_ocsp.c to the proper place

   update to openrdap-0.10.2

   update to py3-platformdirs-4.11.9

   update to py3-pipx-1.17.3

   update to py3-filelock-3.32.7

   update to nicotine-plus-3.3.11

   update to yc-dyndyns 0.4

   show how to setup the user

   include tsc deadline bit in lapic timer mode mask
   ok dv@ mlarkin@

   Align X509_chack_ca() with modern OpenSSL

   We have been documenting for quite a while that this API is broken and
   that callers need to ensure proper caching of extensions using the usual
   X509_check_purpose() trick. Since the API can't indicate errors, choose
   to err on the safe side and report a CA only after successful caching of
   extensions.

   Reported by Frank Denis and others

   ok beck, discussed with jsing

   Update to packer-1.16.1.

   Update to py3-boto3-1.43.98.

   Update to py3-botocore-1.43.98.

   Update to gramps-6.0.8.

   Tweak comment; no pkg change.

   Fix a 10-year long warning by installing the dconf profile under the right
   name.

   race condition introduced by aja@

   update to 1.2.7

   Update to umurmur-0.5.1.

   From Andrew Kloet (MAINTAINER)

   Stop playing with XDG_RUNTIME_DIR.

   Update to umurmur-0.5.1.

   From Andrew Kloet (MAINTAINER)

   Update gentium RUN_DEPENDS to new location. Update SITES* and HOMEPAGE.

   Finish moving sil.org fonts.

   Consolidate sil.org-developed fonts into a single subdirectory.

   Update to pam_keyring.

   ocspcheck: do not use OCSP_TRUSTOTHER

   Like in libtls, ensure that the provided OCSP staple is validated by an
   OCSP trust chain to the root.

   From Acts1631

   ok beck kenjiro

   distfile no longer hosted here

   libtls: fix OCSP responder authorization bypass

   If a CA revokes a valid TLS server cert using OCSP, a client configured to
   require a valid OCSP staple should always reject that cert. If the server's
   private key has been compromised, it was possible to bypass this requirement.

   The problem is the behavior of OCSP_TRUSTOTHER which skips chain
   validation for the OCSP trust chain to the root and the checking that
   the staple was signed by a CA of the validating chain. So remove this flag.

   This only affects callers of tls_config_ocsp_require_stapling(). In OpenBSD
   base these are reachable in OpenBSD base via opt-in behaviors of nc(1) -T
   and ftp(1) -S via the "muststaple" keyword. No ports call these functions.

   Reported by Acts1631 and Jiho Kim

   ok beck kenjiro

   avoid double frees; ok krw@