Log message:
Update to gnutls-2.2.5.
* Version 2.2.5 (released 2008-05-19)
  Fix flaw in fix for GNUTLS-SA-2008-1-3.
* Version 2.2.4 (released 2008-05-19)
  Fix three security vulnerabilities.  [GNUTLS-SA-2008-1]
  [GNUTLS-SA-2008-1-1]
   libgnutls: Fix crash when sending invalid server name.
  [GNUTLS-SA-2008-1-2]
   libgnutls: Fix crash when sending repeated client hellos.
  [GNUTLS-SA-2008-1-3]
   libgnutls: Fix crash in cipher padding decoding for invalid record lengths.
* Version 2.2.3 (released 2008-05-06)
  Increase default handshake packet size limit to 48kb.
  Fix compilation error related to __FUNCTION__ on some systems.
  Documented the --priority option to gnutls-cli and gnutls-serv.
  Fix fopen file descriptor leak in PSK server code.
  Build Guile code with -fgnu89-inline only when supported.
  Make Camellia encryption work.

Log message:
Update to 2.2.2:

* Version 2.2.2 (released 2008-02-21)

** Cipher priority string handling now handle strings that starts with NULL.
Thanks to Laurence Withers <l@lwithers.me.uk>.

** Corrected memory leaks in session resuming and DHE ciphersuites. Reported
by Daniel Stenberg.

** Increased the default certificate verification chain limits and allowed
for checks without limitation.

** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name()
and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary
strings and return the proper size.

** API and ABI modifications:
No changes since last version.

* Version 2.2.1 (released 2008-01-17)

** Prevent linking libextra against previously installed libgnutls.
Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see
<http://bugs.gentoo.org/show_bug.cgi?id=202269>.

** Fixes the post_client_hello_function(). The extensions are now parsed
in a callback friendly way.

** Fix for certificate selection in servers with certificate callbacks.

** API and ABI modifications:
No changes since last version.

* Version 2.2.0 (released 2007-12-14)

Major changes compared to the v2.0 branch:

* SRP support aligned with newly published RFC 5054.

* OpenPGP support aligned with newly published RFC 5081.

* Support for DSA2 keys.

* Support for Camellia cipher.

* Support for Opaque PRF Input extension.

* PKCS#8 parser now handle DSA keys.

* Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra,
etc.  Notice that liblzo2 2.02 is licensed under GPLv2 only.  Earlier
versions, such as 2.01 which is included with GnuTLS, is available under
GPLv2 or later.  If this incompatibility causes problems, we recommend
you to disable LZO using --without-lzo.  LZO compression is not a
standard TLS compression algorithm, so the impact should be minimal.

* Functions for disabling record protocol padding.
Works around bugs on Nokia/Ericsson phones.

* New functions gnutls_priority_set() for setting cipher priorities easily.
Priorities like "COMPAT" also enables other work arounds, such as
disabling padding.

* Other minor improvements and bug fixes.

Minor changes compared to the latest v2.1.8 release candidate:

* Update internal copy of libtasn1 to version 1.2.

* Certtool --verify-chain now handle inputs larger than 64kb.
This fixes the self-test "rsa-md5-collision" under MinGW+Wine with
recent versions of libgcrypt.  The problem was that Wine with the
libgcrypt RNG generates huge amounts of debugging output.

* Translation updates.
Added Dutch translation.  Updated Polish and Swedish translation.

Backwards incompatible API/ABI changes in GnuTLS 2.2
====================================================

To adapt to changes in the TLS extension specifications for OpenPGP
and SRP, the GnuTLS API had to be modified.  This means breaking the
API and ABI backwards compatibility.  That is something we try to
avoid unless it is necessary.  We decided to also remove the already
deprecated stub functions for X.509 to XML conversion and TLS
authorization (see below) when we had the opportunity.

Generally, most applications does not need to be modified.  Just
re-compile them against the latest GnuTLS release, and it should work
fine.

Applications that use the OpenPGP or SRP features needs to be
modified.  Below is a list of the modified APIs and discussion of what
the minimal things you need to modify in your application to make it
work with GnuTLS 2.2.

Note that GnuTLS 2.2 also introduces new APIs -- such as
gnutls_set_priority() that is superior to
gnutls_set_default_priority() -- that you may want to start using.
However, using those new APIs is not required to use GnuTLS 2.2 since
the old functions continue are still supported.  This text only
discuss what you minimally have to modify.

XML related changes
-------------------

The function `gnutls_x509_crt_to_xml' has been removed.  It has been
deprecated and only returned an error code since GnuTLS version
1.2.11.  Nobody has complained, so users doesn't seem to miss the
functionality.  We don't know of any other library to convert X.509
certificates into XML format, but we decided (long ago) that GnuTLS
isn't the right place for this kind of functionality.  If you want
help to find some other library to use here, please explain and
discuss your use case on help-gnutls <at> gnu.org.

TLS Authorization related changes
---------------------------------

Everything related to TLS authorizations have been removed, they were
only stub functions that returned an error code:

 GNUTLS_SUPPLEMENTAL_AUTHZ_DATA
 gnutls_authz_data_format_type_t
 gnutls_authz_recv_callback_func
 gnutls_authz_send_callback_func
 gnutls_authz_enable
 gnutls_authz_send_x509_attr_cert
 gnutls_authz_send_saml_assertion
 gnutls_authz_send_x509_attr_cert_url
 gnutls_authz_send_saml_assertion_url

SRP related changes
-------------------

The callback gnutls_srp_client_credentials_function has a new
prototype, and its semantic has changed.  You need to rewrite the
callback, see the updated function documentation and SRP example code
(doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more
information.

The alert codes GNUTLS_A_MISSING_SRP_USERNAME and
GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP
specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is
used.  There are #define's to map the old names to the new.  You may
run into problems if you have a switch-case with cases for both SRP
alerts, since they are now mapped to the same value.  The solution is
to drop the SRP alerts from such switch cases, as they are now
deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY.

OpenPGP related changes
-----------------------

The function `gnutls_certificate_set_openpgp_keyserver' have been
removed.  There is no replacement functionality inside GnuTLS.  If you
need keyserver functionality, consider using the GnuPG tools.

All functions, types, and error codes related to OpenPGP trustdb
format have been removed.  The trustdb format is a non-standard
GnuPG-specific format, and we recommend you to use key rings instead.
The following have been removed:
 gnutls_certificate_set_openpgp_trustdb
 gnutls_openpgp_trustdb_init
 gnutls_openpgp_trustdb_deinit
 gnutls_openpgp_trustdb_import
 gnutls_openpgp_key_verify_trustdb
 gnutls_openpgp_trustdb_t
 GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED

The following functions has an added parameter of the (new) type
`gnutls_openpgp_crt_fmt_t'.  The type specify the format of the data
(binary or base64).  The functions are:
 gnutls_certificate_set_openpgp_key_file
 gnutls_certificate_set_openpgp_key_mem
 gnutls_certificate_set_openpgp_keyring_mem
 gnutls_certificate_set_openpgp_keyring_file

To improve terminology and align with the X.509 interface, some
functions have been renamed.  Compatibility mappings exists.  The old
and new names of the affected functions and types are:

        Old name                                New name
 gnutls_openpgp_key_t                    gnutls_openpgp_crt_t
 gnutls_openpgp_key_fmt_t                gnutls_openpgp_crt_fmt_t
 gnutls_openpgp_key_status_t             gnutls_openpgp_crt_status_t
 GNUTLS_OPENPGP_KEY                      GNUTLS_OPENPGP_CERT
 GNUTLS_OPENPGP_KEY_FINGERPRINT          GNUTLS_OPENPGP_CERT_FINGERPRINT
 gnutls_openpgp_key_init                 gnutls_openpgp_crt_init
 gnutls_openpgp_key_deinit               gnutls_openpgp_crt_deinit
 gnutls_openpgp_key_import               gnutls_openpgp_crt_import
 gnutls_openpgp_key_export               gnutls_openpgp_crt_export
 gnutls_openpgp_key_get_key_usage        gnutls_openpgp_crt_get_key_usage
 gnutls_openpgp_key_get_fingerprint      gnutls_openpgp_crt_get_fingerprint
 gnutls_openpgp_key_get_pk_algorithm     gnutls_openpgp_crt_get_pk_algorithm
 gnutls_openpgp_key_get_name             gnutls_openpgp_crt_get_name
 gnutls_openpgp_key_get_version          gnutls_openpgp_crt_get_version
 gnutls_openpgp_key_get_creation_time    gnutls_openpgp_crt_get_creation_time
 gnutls_openpgp_key_get_expiration_time  gnutls_openpgp_crt_get_expiration_time
 gnutls_openpgp_key_get_id               gnutls_openpgp_crt_get_id
 gnutls_openpgp_key_check_hostname       gnutls_openpgp_crt_check_hostname
 gnutls_openpgp_send_key                 gnutls_openpgp_send_cert

* Version 2.0.0 (released 2007-09-04)

The following changes have been made since GnuTLS 1.6:

* Support for external RSA/DSA signing for TLS client authentication.
  This allows you to secure the private key better, for example by using
  privilege-separation techniques between the private key and the
  network client/server.

* Support for signing X.509 certificates using RSA with SHA-256/384/512.

* Experimental support for TLS 1.2 (disabled by default).  The TLS 1.2
  specification is not finalized yet, but we implement a draft version
  for testing.

* Support for X.509 Proxy Certificates (RFC 3820)

* Support for Supplemental handshakes messages (RFC 4680).

* Support for TLS authorization extension (draft-housley-tls-authz-extns-07).

* Support for the X.509 'otherName' Subject Altnerative Names (for XMPP).

* Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes.

* Improve logic of gnutls_set_default_priority() which can now be more
  recommended.

* New APIs to enumerate supported algorithms in the library.

* New APIs to access X.509 Certificate extension sequentially.

* New APIs to print X.509 Certificates and CRLs in human readable formats.

* New APIs to extract X.509 Distinguished Names from certificates.

* New APIs to handle pathLenConstraint in X.509 Basic Constraints.

* Certtool can export more than one certificate to PKCS#12.

* Several message translation improvements.

* Instructions and improvements to easily set up a HTTPS test server.

* Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4.

* Build improvements for Windows, Mac OS X, uClinux, etc.

* GnuTLS is now developed in GIT.

* Improved manual

* Many bugfixes and minor improvements.

Log message:
Increase the BUILDLINK_API_DEPENDS.gnutls to at least gnutls>=1.2.6
which is still very old.

This fixes problem where building something depending on gnutls
when old gnutls is already installed using liblzo won't buildlink
because lzo is not installed. This forces a newer gnutls to be
installed that uses lzo instead.

Log message:
Update to 2.0.4:

* Version 2.0.4 (released 2007-11-16)

** Corrected bug in decompression of expanded compression data.

** API and ABI modifications:
No changes since last version.

Log message:
Update to 2.0.3:

* Version 2.0.3 (released 2007-11-10)

** This version backports several fixes from the 2.1.x branch.

** Fixed PKCS #3 parameter export.

** Added gnutls_record_disable_padding() to allow servers talking to
buggy clients that complain if the TLS 1.0 record protocol padding is
used.

** Introduced gnutls_session_enable_compatibility_mode() to allow enabling
all supported compatibility options (like disabling padding).

** Corrected bug which did not allow a server to run without supporting
certificates.

** API and ABI modifications:
gnutls_session_enable_compatibility_mode: ADDED
gnutls_record_disable_padding: ADDED

Add LICENSE, commented out; it contains both LGPL-2.1 and GPL2 code.

Log message:
Fixed building the package with sunpro.

Log message:
Update to 2.0.2:

* Version 2.0.2 (released 2007-10-17)

** TLS authorization support removed.
This technique may be patented in the future, and it is not of crucial
importance for the Internet community.  After deliberation we have
concluded that the best thing we can do in this situation is to
encourage society not to adopt this technique.  We have decided to
lead the way with our own actions.

** certtool: Fixed data corruption when using --outder.

** Fix configure-time Guile detection.

** API and ABI modifications:
GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA: ADDED.  To avoid that the
    gnutls_supplemental_data_format_type_t enum type becomes empty.

* Version 2.0.1 (released 2007-09-20)

** New directory doc/credentials/ with test credentials.
This collects the test credentials from the web page and from src/.
The script gnutls-http-serv has also been moved to that directory.

** Update SRP extension type and cipher suite with official IANA values.
This breaks backwards compatibility with SRP in older versions of
GnuTLS, but this is intentional to speed up the adoption of the
official values.  The old values we used were incorrect.

** Guile: Fix `x509-certificate-dn-oid'

** API and ABI modifications:
No changes since last version.

Log message:
Hack around stupid GNUlib mess to allow building on DragonFly.

Log message:
Fix typo in comment.

Log message:
update to 2.0.0
While an update to a .0 version is somehow risky, it finishes the
unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc
opencdk, which I wouldn't like to go into the next stable branch.
Release candidates have worked for me, and there is some time left
before the Q3 branch, so I'm confident.
changes:
* Support for external RSA/DSA signing for TLS client authentication
-many X.509 enhancements
 Support for Supplemental handshakes messages (RFC 4680)
* Support for TLS authorization extension (draft-housley-tls-authz-extns-07)
* Improve logic of gnutls_set_default_priority()
* New APIs to enumerate supported algorithms in the library
* Certtool can export more than one certificate to PKCS#12
* Several message translation improvements
* Improved manual
* Many bugfixes and minor improvements