OpenBSD/src k0kPJDiusr.sbin/rpki-client cms.c

   rpki-client: reject some signed objects with BER encoding

   ARIN finally fixed their shit and no longer distributes malformed ROAs.
   Detect one symptom of their malformedness. This is a very unsatisfactory
   kludge since it only detects indefinite length encoding at the outermost
   layer, but this will hopefully help avoid regressions. libcrypto's ASN.1
   parser is not going to help making the world a cleaner place.

   fine with claudio, ok job
VersionDeltaFile
1.61+18-2usr.sbin/rpki-client/cms.c
+18-21 files

OpenBSD/src lwsMkgKusr.sbin/rpki-client x509.c

   rpki-client: unconditionally warn about incorrect RSA parameters

   Now that ARIN have fixed their old ROAs, this encoding no longer occurs
   in the wild, so enabling this warning does no harm. Ideally we'd error,
   but a Postel-inspired MUST that has been sprinkled across numerous RFCs
   ensured that this had to be tolerated for more than a quarter of a century
   and will continue to be for at least another one.

   discussed with claudio job
VersionDeltaFile
1.134+2-6usr.sbin/rpki-client/x509.c
+2-61 files

OpenBSD/ports dB8SfScmath/lean Makefile

   lean: mark broken on mips64 and sparc64.

   I don't think it ever built on mips64 and it didn't like the switch to
   clang on sparc64.
VersionDeltaFile
1.11+3-0math/lean/Makefile
+3-01 files

OpenBSD/ports GUyRsS2news/sabnzbd Makefile distinfo

   Update to sabnzbd-5.1.2

   Fixes critical RCE (GHSA-rgqj-28c2-gxwp) and path traversal
   (GHSA-75g3-96fr-7p2r) vulnerabilities. Overview on changes:
   https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.2
VersionDeltaFile
1.58+2-2news/sabnzbd/distinfo
1.83+1-1news/sabnzbd/Makefile
+3-32 files

OpenBSD/src qny42yMlib/libc/sys recv.2

   change iovec markup from .Fa to .Vt

   refers to a struct, not the name of a field
   ok schwarze@
VersionDeltaFile
1.55+3-3lib/libc/sys/recv.2
+3-31 files

OpenBSD/src FzSR4s7share/man/man9 loadfirmware.9

   firmware is an uncountable noun, avoid indefinite article
   ok tb@ sobrado@ schwarze@
VersionDeltaFile
1.5+3-3share/man/man9/loadfirmware.9
+3-31 files

OpenBSD/src efawI23regress/usr.bin/mandoc/db Makefile README, regress/usr.bin/mandoc/db/makewhatis Makefile

   new tests for makewhatis(8) command line arguments
   and for its various operation modes
VersionDeltaFile
1.1+106-0regress/usr.bin/mandoc/db/makewhatis/Makefile
1.1+79-0regress/usr.bin/mandoc/db/out/dopt.dout
1.1+69-0regress/usr.bin/mandoc/db/out/uopt.dout
1.1+57-0regress/usr.bin/mandoc/db/out/dirarg.dout
1.1+38-0regress/usr.bin/mandoc/db/README
1.4+2-2regress/usr.bin/mandoc/db/Makefile
+351-22 files not shown
+357-28 files

OpenBSD/ports yRQoUHedevel/ruby-gettext Makefile distinfo, devel/ruby-gettext/pkg PLIST

   update 3.4.9 -> 3.5.2
VersionDeltaFile
1.10+0-1,084devel/ruby-gettext/pkg/PLIST
1.9+2-2devel/ruby-gettext/distinfo
1.27+1-1devel/ruby-gettext/Makefile
+3-1,0873 files

OpenBSD/ports Z34xVgddevel/ruby-concurrent-ruby Makefile distinfo

   update 1.3.6 -> 1.3.8
VersionDeltaFile
1.13+2-2devel/ruby-concurrent-ruby/distinfo
1.15+1-1devel/ruby-concurrent-ruby/Makefile
+3-32 files

OpenBSD/src RqkZX1qusr.bin/tmux layout.c

   Fix tiled pane resizing with floating layout cells, reported by Kevin
   Hovsäter.
VersionDeltaFile
1.98+23-16usr.bin/tmux/layout.c
+23-161 files

OpenBSD/ports 0ufIV3Zsysutils/ruby-openvoxserver-ca distinfo Makefile, sysutils/ruby-openvoxserver-ca/pkg PLIST

   update  3.2.0 -> 3.3.0
VersionDeltaFile
1.5+2-3sysutils/ruby-openvoxserver-ca/Makefile
1.3+2-2sysutils/ruby-openvoxserver-ca/distinfo
1.4+0-1sysutils/ruby-openvoxserver-ca/pkg/PLIST
+4-63 files

OpenBSD/ports 96em55Cdevel/ruby-hitimes Makefile distinfo

   update 3.1.0 -> 3.2.0
VersionDeltaFile
1.3+2-2devel/ruby-hitimes/distinfo
1.3+1-1devel/ruby-hitimes/Makefile
+3-32 files

OpenBSD/ports 2Y5BGJPwww/py-flask-caching distinfo Makefile, www/py-flask-caching/pkg PLIST

   update 2.4.1 -> 2.5.0
VersionDeltaFile
1.6+3-3www/py-flask-caching/pkg/PLIST
1.4+2-2www/py-flask-caching/distinfo
1.10+2-2www/py-flask-caching/Makefile
+7-73 files

OpenBSD/ports BcwL4z6devel/py-cachelib distinfo Makefile

   update 0.16.1 -> 0.17.0
VersionDeltaFile
1.4+2-2devel/py-cachelib/distinfo
1.9+2-2devel/py-cachelib/Makefile
+4-42 files

OpenBSD/ports 2QhbinOcomms/liquid-dsp/patches patch-include_liquid_h

   Add missing patch forgotten on last update

   breakage pointed out by sthen@
VersionDeltaFile
1.1+11-0comms/liquid-dsp/patches/patch-include_liquid_h
+11-01 files

OpenBSD/ports bLiJMQkwww/p5-LWP-MediaTypes distinfo Makefile, www/p5-LWP-MediaTypes/pkg DESCR

   update p5-LWP-MediaTypes to 6.04
VersionDeltaFile
1.6+9-6www/p5-LWP-MediaTypes/Makefile
1.2+5-1www/p5-LWP-MediaTypes/pkg/DESCR
1.2+2-2www/p5-LWP-MediaTypes/distinfo
+16-93 files

OpenBSD/ports o072ecOcad/prusaslicer distinfo Makefile, cad/prusaslicer/patches patch-src_slic3r_Utils_FontConfigHelp_hpp patch-src_slic3r_Utils_WxFontUtils_cpp

   cad/prusaslicer: update to 2.9.6

   ok ian@
VersionDeltaFile
1.1+39-0cad/prusaslicer/patches/patch-src_slic3r_Utils_WxFontUtils_cpp
1.1+31-0cad/prusaslicer/pkg/README
1.12+31-0cad/prusaslicer/pkg/PLIST
1.1+12-0cad/prusaslicer/patches/patch-src_slic3r_Utils_FontConfigHelp_hpp
1.13+2-2cad/prusaslicer/distinfo
1.33+2-2cad/prusaslicer/Makefile
+117-46 files

OpenBSD/ports JM9Nx4iwww/mozilla-firefox Makefile distinfo

   www/mozilla-firefox: update to 154.0.1.

   see https://www.firefox.com/en-US/firefox/154.0.1/releasenotes/
VersionDeltaFile
1.397.2.17+2-2www/mozilla-firefox/distinfo
1.680.2.19+1-1www/mozilla-firefox/Makefile
+3-32 files

OpenBSD/ports bDyaIfAwww/firefox-i18n Makefile.inc distinfo, www/mozilla-firefox Makefile distinfo

   www/mozilla-firefox: update to 154.0.1.

   see https://www.firefox.com/en-US/firefox/154.0.1/releasenotes/
VersionDeltaFile
1.404+164-164www/firefox-i18n/distinfo
1.418+4-4www/mozilla-firefox/distinfo
1.705+2-4www/mozilla-firefox/Makefile
1.359+1-1www/firefox-i18n/Makefile.inc
+171-1734 files

OpenBSD/src Es8PlLVshare/man/man5 port-modules.5

   fix alphabetical order of module names, no text change:
   cabal and cargo before cmake and wayland before www
VersionDeltaFile
1.288+24-24share/man/man5/port-modules.5
+24-241 files

OpenBSD/src BFZE8Lushare/man/man8 release.8

   Most dictionaries list the noun "firmware" as uncountable,
   so avoid the plural form.
   OK jsg@ ian@  and also agrees with jmc@'s past practice.
   Minor issue found by jsg@.
VersionDeltaFile
1.102+3-3share/man/man8/release.8
+3-31 files

OpenBSD/ports ODOQnOumail/postfix/stable Makefile, security/sslscan Makefile

   stable: bump openssl consumers with static link
VersionDeltaFile
1.56.2.2+1-1sysutils/borgbackup/2.0/Makefile
1.86.2.2+1-1security/sslscan/Makefile
1.281.2.6+1-0mail/postfix/stable/Makefile
+3-23 files

OpenBSD/ports lqmNWo8security/openssl/3.5 Makefile distinfo, security/openssl/3.5/pkg PLIST

   Update to OpenSSL 3.5.8

   https://github.com/openssl/openssl/releases/tag/openssl-3.5.8
VersionDeltaFile
1.7.2.2+2-2security/openssl/3.5/distinfo
1.7.2.2+4-0security/openssl/3.5/pkg/PLIST
1.16.2.2+1-1security/openssl/3.5/Makefile
+7-33 files

OpenBSD/ports CeTry7csecurity/openssl/4.0 Makefile distinfo, security/openssl/4.0/pkg PLIST

   MFC: Update to OpenSSL 4.0.2

   https://github.com/openssl/openssl/releases/tag/openssl-4.0.2
VersionDeltaFile
1.2.2.2+2-2security/openssl/4.0/distinfo
1.2.2.2+4-0security/openssl/4.0/pkg/PLIST
1.4.2.2+1-1security/openssl/4.0/Makefile
+7-33 files

OpenBSD/src mP2Jd1Olib/libc/arch/aarch64/hash sha512_aarch64.c sha256_aarch64.c

   Consistently test against zero.
VersionDeltaFile
1.2+2-2lib/libc/arch/aarch64/hash/sha512_aarch64.c
1.2+2-2lib/libc/arch/aarch64/hash/sha256_aarch64.c
+4-42 files

OpenBSD/ports TlwBLynmail/postfix/stable Makefile, security/sslscan Makefile

   bump openssl consumers with static link
VersionDeltaFile
1.88+1-1security/sslscan/Makefile
1.62+2-0sysutils/borgbackup/2.0/Makefile
1.287+1-0mail/postfix/stable/Makefile
+4-13 files

OpenBSD/src z7aAOYVlib/libc/arch/aarch64/hash Makefile.inc sha1_aarch64.c, lib/libc/hash sha1.c

   Provide assembly implementation of SHA-1 for aarch64 in libc

   Provide a CE assembly implementation that can be used on hardware that
   has the CE SHA-1 instructions. This is considerably faster than the
   generic C implementation.

   Largely borrowed from libcrypto.

   With input from naddy@

   ok naddy@ tb@
VersionDeltaFile
1.1+219-0lib/libc/arch/aarch64/hash/sha1_aarch64_ce.S
1.1+34-0lib/libc/arch/aarch64/hash/sha1_aarch64.c
1.32+4-2lib/libc/hash/sha1.c
1.5+5-1lib/libc/hidden/sha1.h
1.3+3-1lib/libc/arch/aarch64/hash/Makefile.inc
+265-45 files

OpenBSD/ports S2pPny5security/openssl/3.5 Makefile distinfo, security/openssl/3.5/pkg PLIST

   Update to OpenSSL 3.5.8

   https://github.com/openssl/openssl/releases/tag/openssl-3.5.8
VersionDeltaFile
1.9+2-2security/openssl/3.5/distinfo
1.9+4-0security/openssl/3.5/pkg/PLIST
1.18+1-1security/openssl/3.5/Makefile
+7-33 files

OpenBSD/ports 1OavAERsecurity/openssl/4.0 Makefile distinfo, security/openssl/4.0/patches patch-crypto_x509_x509_vfy_c

   Update to OpenSSL 4.0.2

   https://github.com/openssl/openssl/releases/tag/openssl-4.0.2
VersionDeltaFile
1.7+1-3security/openssl/4.0/Makefile
1.4+2-2security/openssl/4.0/distinfo
1.4+4-0security/openssl/4.0/pkg/PLIST
1.2+0-0security/openssl/4.0/patches/patch-crypto_x509_x509_vfy_c
+7-54 files

OpenBSD/src UHV71jjsbin/dhcpleased engine.c

   Validate the IP address the dhcp server acks.

   acts1631 at proton.me points out that a rogue dhcp server can trick
   dhcpleased into holding on to a lease indefinitely since it looses
   track which IP is actually configured.

   Diff provided by acts1631 as well, thanks!

   While here, remove checking for yiaddr being absent (i.e. INADDR_ANY)
   because that check is now redundant.
VersionDeltaFile
1.69+9-5sbin/dhcpleased/engine.c
+9-51 files