The OpenSSL Project is a collaborative effort to develop a robust,
commercial-grade, full-featured, and Open Source toolkit implementing
the Secure Sockets Layer (SSL v3) and Transport Layer Security (TLS v1,
v1.1, v1.2, v1.3) protocols with full-strength cryptography world-wide.
The project is managed by a worldwide community of volunteers that use
the Internet to communicate, plan, and develop the OpenSSL tookit
and its related documentation.
OpenSSL is based on the excellent SSLeay library developed by Eric
A. Young and Tim J. Hudson. The OpenSSL toolkit is licensed under
an Apache-style licence, which basically means that you are free
to get and use it for commercial and non-commercial purposes subject
to some simple license conditions.
This port (security/openssl) has updated from 3.0 to 3.5
after end-of-life and first reported vulnerabilities
of OpenSSL 3.0.
All ports depending on security/openssl must be rebuilt
for the changed shared library versions
Affects: users of security/openssl and security/openssl35
Author: brnrd@FreeBSD.org
Reason:
The openssl port was renamed to openssl30 and subsequently the
openssl35 port was renamed to openssl.
The shared library version of OpenSSL has been bumped.
Users of DEFAULT_VERSIONS= ssl=openssl35 must update this to
ssl=openssl.
Users of DEFAULT_VERSIONS= ssl=openssl30 should not change this unless
they use ports that require the deprecated OpenSSL 3.0 version with
its documented vulnerabilities.
You must rebuild all ports that depend on OpenSSL if you use OpenSSL
from ports.
Affects: users of security/openssl and security/openssl30
Author: brnrd@FreeBSD.org
Reason:
The openssl port was renamed to openssl111 and subsequently the
openssl30 port was renamed to openssl.
The shared library version of OpenSSL has been bumped.
Users of DEFAULT_VERSIONS= ssl=openssl30 must update this to
ssl=openssl.
Users of DEFAULT_VERSIONS= ssl=openssl should not change this unless
they use ports that require the deprecated OpenSSL 1.1.1 version.
You must rebuild all ports that depend on OpenSSL if you use OpenSSL
from ports.
security/openssl: Update to 1.0.2m
- Remove patch now included upstream
- Include post-release patch for clang build error
MFH: 2017Q4
Security: 3bb451fc-db64-11e7-ac58-b499baebfeaf
Begin deorbit burn of ia64. We have not attempted to build packages for
it for many years.
While here, alphabetize ARCHs, pet portlint, and modernize usages.
Approved by: portmgr (tier-2 blanket)
security/openssl: Bump shared library version
- Bump shlib version for security/openssl
- Bump shlib version for security/openssl-devel
- Add instructions to UPDATING
PR: 209582
Reported by: Matthew D. Fuller <fullermd@over-yonder.net>
MFH: 2016Q4
devel/openssl: change CONFLICTS to CONFLICTS_INSTALL
THere's no problem building openssl with other ports SSL libraries
installed, the conflict comes when it's time to install it.
Cleanup $() variables in ports Makefiles.
Mostly replace with ${}, but sometime, replace with $$() because it is
what was intended in the first place. (I think.)
Sponsored by: Absolight
Add DEFAULT_VERSIONS=ssl=XXX
Move the openssl detection routine to bsd.default-version.mk.
Add warnings telling people to not use WITH_OPENSSL_PORT or
WITH_OPENSSL_BASE.
To ease maintainability, change the way the different ssl libraries
version numbers are checked.
PR: 210149
Submitted by: mat
Exp-run by: antoine
Sponsored by: The FreeBSD Foundation, Absolight
Differential Revision: https://reviews.freebsd.org/D6577
security/openssl: Revert disabling of SSLv2 and MD2
Disabling SSLv2 without a shared library bump has a visible impact to
some applications. It is unclear at this time if disabling MD2 could
cause the same issues, but both are being reverted at the moment to be
safe.
PR: 195796
security/openssl: Disable SSLv2 and MD2
SSLv2 is being disabled due to DROWN.
MD2 is being disabled as it should not have been enabled by default.
This was disabled by upstream back in 2009.
PR: 195796
Approved by: delphij, eadler
Security: CVE-2009-2409
Security: CVE-2016-0800
security/openssl: Fix No-SSLv3 option
- This change adds `no-ssl3-method` to config args
- Bump portrevision
Testing with security/openssl buillt with SSL3 option disabled [1]
revealed that the openssl binary and the libraries still support SSLv3
connections and methods. With the added no-ssl3-method argument passed
to the config script, the binary no longer supports the -ssl3 option
and ports requiring SSLv3 methods fail on undefined references to
methods.
PR: 203693 [1]
Reviewed by: koobs (mentor), feld (mentor, ports-secteam), dinoex (maintainer)
Approved by: koobs (mentor), feld (mentor, ports-secteam
MFH: 2016Q1
Differential Revision: D4924
MASTER_SITES cleanup.
- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.
While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.
Also, replace some EXTRACT_SUFX occurences with USES=tar:*.
Checked by: make fetch-urlall-list
With hat: portmgr
Sponsored by: Absolight
security/openssl: Remove patch hunk for configuring pthreads
The patching of Configure file for pthreads is unnecessary -- the effect
of -lpthread -D_REENTRANT is the same as -pthread -D_REENTRANT, so just
remove it to make things even more simpler.
