PuTTY is a client program for the SSH, Telnet and Rlogin network protocols.
These protocols are all used to run a remote session on a computer,
over a network. PuTTY implements the client end of that session:
the end at which the session is displayed, rather than the end
at which it runs.
===> The following configuration options are available for putty-0.85:
GTK3=on: GTK 3 GUI toolkit support
====> Options available for the single GSSAPI_SELECT: you have to select exactly one of them
GSSAPI_BASE=on: GSSAPI support via base system (needs Kerberos)
GSSAPI_HEIMDAL=off: GSSAPI support via security/heimdal
GSSAPI_MIT=off: GSSAPI support via security/krb5
GSSAPI_NONE=off: Disable GSSAPI support
===> Use 'make config' to modify these settings
security/putty*: Security update 0.84 => 0.85
While here, add USE_XORG+=xrender since pterm seems to be linked to it.
Changelog: https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
PR: 297593
Reported by: mandree (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q3
gnome.mk: rename gdkpixbuf2 to gdkpixbuf to prepare for port move
The GTK 1-based gdk-pixbuf has not existed for some time.
No functional or package changes.
security/putty: update to 0.83
Quoting <https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html>,
omitting three Windows items:
These features are new in [PuTTY] 0.83 (released 2025-02-08):
+ Support for ML-KEM, the NIST-standardised post-quantum key exchange
mechanism. (In addition to NTRU Prime, which has been supported since 0.78.)
+ [...]
+ Bug fix: psftp -b works again.
+ Bug fix: assertion failure if an SSH connection times out at the login
prompt.
+ Bug fix: crash in Pageant if an SSH connection is abandoned while waiting
for a deferred decryption passphrase.
+ Bug fix: tight loop if PuTTY tried to send an empty answerback string.
+ Bug fix: accidental truncation of some configuration edit boxes' contents to
127 characters.
+ [...]
+ Bug fix: restored interoperation with third-party tools that auto-fill login
prompts by sending ^M for Return.
+ [...]
+ Bug fix: the small keypad keys didn't reliably work in the terminal on Unix.
MFH: 2025Q1
security/putty: update to 20250121's snapshot/Git ec158a2
Bugfix a potential crash, upstream commit message:
Pageant: call signop_unlink from signop_free.
A user reported that the following sequence of events leads to Pageant
crashing:
- load an encrypted key into Pageant for decryption later
- attempt to use the key, so that Pageant prompts for the passphrase
- before entering the passphrase, abort the attempt to use the
key (e.g. by closing the PuTTY that was trying to use it)
- now enter the passphrase at the Pageant prompt, once the need for
it has gone away.
security/putty: update to 0.83pre 20250114's snapshot
Changelog since 20250105 (the e7ac... patch is also Windows-only):
* e7acb9f6 2025-01-13 | GetDlgItemTextW_alloc: use the right memchr. [Simon
Tatham]
* 293be042 2025-01-13 | GTK: cherry-pick font defaults and fallbacks from main.
[Simon Tatham]
* f58ddf26 2025-01-07 | Windows: fix leak of a Filename. [Jacob Nevins]
* 457eb612 2025-01-07 | It's a new year. [Jacob Nevins]
security/putty: SECURITY update to 0.81
This fixes a vulnerability where NIST P521 ecdsa-sha2-nistp521 (only!)
keys can be recovered easily because signature generation in PuTTY used
a biased random number generator.
MFH: 2024Q2
Security: 080936ba-fbb7-11ee-abc8-6960f2492b1d
Security: CVE-2024-31497
security/putty: security update → 0.80 to fix Terrapin vulnerability
Note this requires the server side to also add the protocol extension.
Security: 91955195-9ebb-11ee-bc14-a703705db3a6
Security: CVE-2023-48795
Changelog: https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html
MFH: 2023Q4
accessibility/at-spi2-core: update to 2.46.0
What's new in at-spi2-core 2.46.0:
* Fix GetInterfaces documentation on org.a11y.atspi.Accessible
interface.
What's new in at-spi2-core 2.45.91:
* Send device event controller events using the same signature as other
events.
* Document the Accessible, Action, and Cache dbus interfaces.
* Fix license of atspi-gmain.c (#87).
What's new in at-spi2-core 2.45.90:
* xml: Add some documentation.
* xml: Fix event arguments.
(Only the first 15 lines of the commit message are shown above )
security/putty: fix ARM NEON AES-GCM code
Cherry-pick a test patch from upstream maintainer:
- this uses fallback code for compilers not providing vaddq_p128
(f.i. clang-10 on FreeBSD 12.3 AMD64/aarch64)
- and uses vaddq_p128 on systems that provide it, for instance,
FreeBSD 13-STABLE AMD64/aarch64 with clang 14.0.5
Obtained from: Simon Tatham
MFH: 2022Q4
security/putty: fix aarch64 build on clang 10.
clang 10 (FreeBSD 12.3) does not support vaddq_p128 and similar
ARM NEON intrinsics, but clang 13 (FreeBSD 13.1) does.
Abuse the HAVE_NEON_PMULL cmake test to disable aesgcm-neon.c
unless vaddq_p128() is available.
http://ampere1.nyi.freebsd.org/data/123arm64-quarterly/31229ca1324c/logs/putty-nogtk-0.78~pre20220922.log:
/wrkdirs/usr/ports/security/putty-nogtk/work/putty-0.78~pre20220922.9fcfd67/crypto/aesgcm-neon.c:125:16:
warning: implicit declaration of function 'vaddq_p128' is invalid in C99
[-Wimplicit-function-declaration]
ctx->acc = vaddq_p128(ctx->acc, load_p128_be(coeff));
security/putty: update to 0.78~pre20220922
This permits a FreeBSD build without patches; the two remaining
items are 1. avoiding the GSSAPI-related call into pkg-config because it
would not cover base-GSSAPI so we force the fallback to krb5-config
(which we control by way of ports/Mk/Uses/gssapi.mk), and
2. making sure PuTTY's build would not ascend directory hierarchy to
pick up our ports tree's Git information. We are only packaging
(pre-)release tarballs where we do not need to run Git.
Thanks to Simon Tatham, upstream maintainer, for issuing the
pre-releases and being very responsive and open to making the
build experience smooth for everyone.
security/putty: add Git patch to fix X11 inclusion
Pull in a fix from upstream's Git to avoid pulling in X11 headers
in no-GTK builds, so we can remove one more local workaround.
security/putty: permanently remove GSSAPI_DYNAMIC
While it seems a nice idea to load the GSS provider library at run-time,
the existing search code hardwires library versions and only works
with krb5 (MIT Kerberos), and does not attempt to control library paths.
This sort of defeats the purpose, and we do not need a brittle
alternative for a robust GSSAPI_MIT.
So, drop the commented-out GSSAPI_DYNAMIC stuff from the Makefile.
security/putty: Pick right Kerberos version
Make sure that putty only compiles and links against the configured
static GSSAPI version, especially against base even if krb5 or heimdal
are installed.
To that end, hand down the right krb5-config executable,
and punch out pkg-config from the shipped unix.cmake.
security/putty: Fix static GSSAPI solutions,
with a patch received from Simon Tatham, and mask GSSAPI_DYNAMIC
for now, because it is not working. Debugging going on, but let's
get GSSAPI working at all for now, and make GSSAPI_BASE the default.
security/putty: upgrade to pre-release 0.78~pre20220916.e1b73f0
ChangeLog: https://lists.tartarus.org/pipermail/putty-announce/2022/000034.html
Please test this thoroughly and if you happen to have a Kerberos-
or GSSAPI-enabled SSH server, please give the maintainer feedback
whether GSSAPI works for you and which GSSAPI library you have
installed.
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/putty: update to 0.77
PuTTY 0.77 changed its build system to cmake, and restructured the
source code, thus the patches were regenerated and updated.
As a consequence, GSSAPI_BASE no longer works because cmake wants
pkg-config and hence .pc files.
GSSAPI_HEIMDAL does not compile due to #define (&_foo) xxx.
Both GSSAPI_BASE and GSSAPI_HEIMDAL were disabled. Assistance solicited.
There is a new experimental GSSAPI_DYNAMIC which permits configuring the
GSS provider at run-time, which the package maintainer cannot test
for lack of Kerberized access somewhere. Feedback solicited.
(Only the first 15 lines of the commit message are shown above )
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
security/putty: update to 0.76.
FreeBSD relevant changes per
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
+ New option to abandon an SSH connection if the server allows you to
authenticate in a trivial manner.
+ Bug fix: user colour-palette reconfiguration via 'Change Settings'
were delayed-action.
+ Bug fix: server colour-palette reconfigurations were sometimes lost.
+ Bug fix: a tight loop could occur on reading a truncated private key
file.
security/putty*: take LICENCE file from extracted source,
...rather than copying it into $FILESDIR where it would require
maintenance.
Reported by: danfe@
security/putty*: upgrade to 0.74 security fix release
Changelog:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
among them are these two---and more bugfixes beyond not listed here:
* Security fix: if an SSH server accepted an offer of a public key
and then rejected the signature, PuTTY could access freed memory,
if the key had come from an SSH agent.
* Security feature: new config option to disable PuTTY's dynamic
host key preference policy, if you prefer to avoid giving away
to eavesdroppers which hosts you have stored keys for.
MFH: 2020Q2
Security: 6190c0cd-b945-11ea-9401-2dcf562daa69
Security: CVE-2020-14002
Security: FZI-2020-5
Update to upstream release 0.73 (security fixes)
Relevant changes taken from this...
ChangeLog: https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
* Security fix: in bracketed paste mode, the terminal escape sequences that
should delimit the pasted data were appearing together on one side of it,
making it possible to misidentify pasted data as manual keyboard input.
* Bug fix (possibly security-related): an SSH-1 server sending a disconnection
message could cause an access to freed memory.
* Bug fix: tweaked terminal handling to prevent lost characters at the ends of
lines in gcc's coloured error messages.
* Bug fix: removed a bad interaction between the 'clear scrollback' operation
and mouse selection that could give rise to the dreaded "line==NULL"
assertion box.
MFH: 2019Q4
Security update to new upstream release 0.72.
Security fixes found by the EU-funded bug bounty:
- two separate vulnerabilities affecting the obsolete SSH-1 protocol, both
available before host key checking
- a vulnerability in all the SSH client tools (PuTTY, Plink, PSFTP and PSCP) if
a malicious program can impersonate Pageant
Changelog: https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
Switch off -DSTATIC_GSSAPI build as that produces non-working executables
(assertion failures). Bug has been reported upstream.
MFH: 2019Q3
Security: 5914705c-ab03-11e9-a4f9-080027ac955c
Update security/putty to 0.71 security fix release
Unfortunately, this new release breaks GSSAPI_NONE, which is removed
for now. Bug has been reported upstream.
Changelog: https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
MFH: 2019Q1
Security: 46e1ece5-48bd-11e9-9c40-080027ac955c
Reinstate support for GTK2 (rather than GTK3) as an OPTION.
While here, add a putty-gtk2 slave port and update _CONFLICTS.
Since the default package does not change, and pkg would handle conflicts
around attempted installation of the new -gtk2 package, omit the
PORTREVISION bump from Miroslav's original patch.
PR: 227200
Submitted by: Miroslav Lachman
Retire WITHOUT_DEBUG flag.
The flag has partial support across the tree, and the same effect
can be obtained by using ".undef WITH_DEBUG".
Reviewed by: mat, rene
Approved by: portmgr (rene)
Differential Revision: https://reviews.freebsd.org/D12548
Update to new upstream release 0.69.
Upstream change "You can now explicitly configure SSH terminal mode
settings not to be sent to the server, if your server objects to them."
Enable pageant, was missing from the 0.68 upgrade.
Switch to GTK3, no longer compiles with GTK2.
The security fixes contained in 0.69 are only good on Windows, so not
flagging this as a security update.
Cleanup $() variables in ports Makefiles.
Mostly replace with ${}, but sometime, replace with $$() because it is
what was intended in the first place. (I think.)
Sponsored by: Absolight
Security upgrade to new upstream release 0.67.
Unix-relevant changes:
* Security fix: a buffer overrun in the old-style SCP protocol when receiving
the header of each file downloaded from the server is fixed. (CVE-2016-2563)
* Assorted other robustness fixes for crashes and memory leaks.
MFH: 2016Q1
Security: 7f0fbb30-e462-11e5-a3f3-080027ef73ec
Security: CVE-2016-2563
security/putty: Fix krb5 dependency
Due to using both <bsd.port.pre.mk> and <bsd.port.options.mk>, the
USES+= gssapi:mit directive was ignored and not included in the build
dependency list. Remove <pre>/<post> includes to fix.
Approved by: mandree (maintainer)
MASTER_SITES cleanup.
- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.
While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.
Also, replace some EXTRACT_SUFX occurences with USES=tar:*.
Checked by: make fetch-urlall-list
With hat: portmgr
Sponsored by: Absolight
Upgrade to upstream bugfix release 0.64.
This fixes a security bug, various other bugs, and supports SSH
connection sharing between multiple instances of PuTTY and its tools.
MFH: 2015Q1
Security: 92fc2e2b-c383-11e4-8ef7-080027ef73ec
Security: CVE-2015-2157
Convert GMAKE to MAKE_CMD
Please note that lots of invocation of MAKE_CMD here are wrong as they do not
properly respect MAKE_ENV and friends
With hat: portmgr
Upgrade PuTTY to new 0.63 beta upstream release, adding vulnerability info.
Quoting the upstream's change log:
- Security fix: prevent a nefarious SSH server or network attacker from
crashing PuTTY at startup in three different ways by presenting a maliciously
constructed public key and signature.
- Security fix: PuTTY no longer retains the private half of users' keys in
memory by mistake after authenticating with them.
- Revamped the internal configuration storage system to remove all fixed
arbitrary limits on string lengths. In particular, there should now no longer
be an unreasonably small limit on the number of port forwardings PuTTY can
store.
- Port-forwarded TCP connections which close one direction before the other
should now be reliably supported, with EOF propagated independently in the
(Only the first 15 lines of the commit message are shown above )
- Convert to Options NG. Renames GTK option to GTK2 for consistency.
- Strip Makefile header.
- Make sure that the port build heeds ${CC}, passing it through MAKE_ARGS.
- Replace CC-is-clang specific -Wno-empty-body by unconditional -Wno-error.
- Remove LIB_DEPENDS ABI versions.
- Take over maintainership from beat@ along his suggestion,
permit him to take it back or commit without my approval.
- Update to upstream version 0.61.
- Add OPTIONS for GSSAPI and GTK (both enabled by default).
NOTE: GSSAPI is currently broken on 9-CURRENT because the
Kerberos in base expects MD2 which isn't provided by OpenSSL.
- mark BROKEN on OSVERSION >= 900000 when GSSAPI is enabled
- heed CFLAGS, CC, WITH_DEBUG, INSTALL_* settings.
- WITHOUT_X11 is now an alias for WITHOUT_GTK
- drop utmp support, the upstream requires a utmpx implementation that
FreeBSD does not provide in any version.
- Preliminary clang support (adds files/patch-timing.c)
- Refreshed patches.
Bump portrevision due to upgrade of devel/gettext.
The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).
PR: ports/124340
Submitted by: edwin@
Approved by: portmgr (pav)
