The OpenSSL Project is a collaborative effort to develop a robust,
commercial-grade, full-featured, and Open Source toolkit implementing
the Secure Sockets Layer (SSL v3) and Transport Layer Security (TLS v1,
v1.1, v1.2, v1.3) protocols with full-strength cryptography world-wide.
The project is managed by a worldwide community of volunteers that use
the Internet to communicate, plan, and develop the OpenSSL tookit
and its related documentation.
OpenSSL is based on the excellent SSLeay library developed by Eric
A. Young and Tim J. Hudson. The OpenSSL toolkit is licensed under
an Apache-style licence, which basically means that you are free
to get and use it for commercial and non-commercial purposes subject
to some simple license conditions.
This port (security/openssl) has updated from 3.0 to 3.5
after end-of-life and first reported vulnerabilities
of OpenSSL 3.0.
All ports depending on security/openssl must be rebuilt
for the changed shared library versions
Affects: users of security/openssl and security/openssl35
Author: brnrd@FreeBSD.org
Reason:
The openssl port was renamed to openssl30 and subsequently the
openssl35 port was renamed to openssl.
The shared library version of OpenSSL has been bumped.
Users of DEFAULT_VERSIONS= ssl=openssl35 must update this to
ssl=openssl.
Users of DEFAULT_VERSIONS= ssl=openssl30 should not change this unless
they use ports that require the deprecated OpenSSL 3.0 version with
its documented vulnerabilities.
You must rebuild all ports that depend on OpenSSL if you use OpenSSL
from ports.
Affects: users of security/openssl and security/openssl30
Author: brnrd@FreeBSD.org
Reason:
The openssl port was renamed to openssl111 and subsequently the
openssl30 port was renamed to openssl.
The shared library version of OpenSSL has been bumped.
Users of DEFAULT_VERSIONS= ssl=openssl30 must update this to
ssl=openssl.
Users of DEFAULT_VERSIONS= ssl=openssl should not change this unless
they use ports that require the deprecated OpenSSL 1.1.1 version.
You must rebuild all ports that depend on OpenSSL if you use OpenSSL
from ports.
security/openssl: Security upgrade to 3.5.9
OpenSSL 3.0 is end-of-life and has known vulnerabilities.
Upgrade port to OpenSSL 3.5 by renaming security/openssl35
Security: 0d183075-bcb5-11f1-b09d-8447094a420
MFH: 2026Q3
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
security/openssl: Security update to 3.0.13
* Note that this is a security rollup of four previously reported CVEs
Security: 10dee731-c069-11ee-9190-84a93843eb75
Security: 8337251b-b07b-11ee-b0d7-84a93843eb75
Security: a5956603-7e4f-11ee-9df6-84a93843eb75
MFH: 2024Q1
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
security/openssl: Update to 1.1.1w
* Final version of OpenSSL 1.1.1, this port will upgrade to
3.0 (LTS) with a next commit.
* Note the recent vuln was Windows only
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/vuxml: Document OpenSSL vulnerability
* Pet `make validate`
* Fix spacing for 482456fb-e9af-11ec-93b6-318d1419ea39
* Add discovery date for 482456fb-e9af-11ec-93b6-318d1419ea39
using tor wiki page update date.
Fix CONFLICTS entries of multiple ports
There have been lots of missing CONFLICTS_INSTALL entries, either
because conflicting ports were added without updating existing ports,
due to name changes of generated packages, due to mis-understanding
the format and semantics of the conflicts entries, or just due to
typoes in package names.
This patch is the result of a comparison of all files contained in
the official packages with each other. This comparison was based on
packages built with default options and may therefore have missed
further conflicts with optionally installed files.
Where possible, version numbers in conflicts entries have been
generalized, some times taking advantage of the fact that a port
(Only the first 15 lines of the commit message are shown above )
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
security/openssl: Update KTLS patches for Chacha20-Poly1305
This pulls in several upstream KTLS patches from OpenSSL master:
* A fix to the return values of BIO_get_ktls_*().
* Support for Chacha20-Poly1305.
* Replacing the SSL_MODE_NO_KTLS_* modes which opted-out of KTLS with
an opt-in SSL_OP_ENABLE_KTLS. Note that this means that KTLS is not
enabled by default. Users can enable KTLS via a custom OpenSSL config
file that enables the KTLS option.
Reported by: jhb
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D31430
Expand support for TLS protocols supported by KTLS.
Backport additional patches merged into OpenSSL's master
branch to support KTLS RX for TLS 1.1 and 1.2 as well as
support for KTLS TX for TLS 1.3.
Reviewed by: brnrd (maintainer)
Sponsored by: Chelsio Communications, Netflix
Differential Revision: https://reviews.freebsd.org/D26261
Fix a common grammar error: "can not" means the opposite of "cannot."
"Can not" means "it is possible not to," and "cannot" means "it is impossible
to."
