Log message:
clean up mirrors. use official up to date ones.

Log message:
the external rsaref option was dropped from securirty/openssl over
4 years ago; remove support from the bl3.mk as well.

Log message:
NetBSD/sparc64 build fix. Reported and fix tested by Michael C. Vergallen.

Log message:
Update to openssl-0.9.8k.

Changes between 0.9.8j and 0.9.8k  [25 Mar 2009]
*) Don't set val to NULL when freeing up structures, it is freed up by
   underlying code. If sizeof(void *) > sizeof(long) this can result in
   zeroing past the valid field. (CVE-2009-0789)
*) Fix bug where return value of CMS_SignerInfo_verify_content() was not
   checked correctly. This would allow some invalid signed attributes to
   appear to verify correctly. (CVE-2009-0591)
*) Reject UniversalString and BMPString types with invalid lengths. This
   prevents a crash in ASN1_STRING_print_ex() which assumes the strings have
   a legal length. (CVE-2009-0590)
*) Set S/MIME signing as the default purpose rather than setting it
   unconditionally. This allows applications to override it at the store
   level.
*) Permit restricted recursion of ASN1 strings. This is needed in practice
   to handle some structures.
*) Improve efficiency of mem_gets: don't search whole buffer each time
   for a '\n'
*) New -hex option for openssl rand.
*) Print out UTF8String and NumericString when parsing ASN1.
*) Support NumericString type for name components.
*) Allow CC in the environment to override the automatically chosen
   compiler. Note that nothing is done to ensure flags work with the
   chosen compiler.

Log message:
Simply and speed up buildlink3.mk files and processing.
This changes the buildlink3.mk files to use an include guard for the
recursive include. The use of BUILDLINK_DEPTH, BUILDLINK_DEPENDS,
BUILDLINK_PACKAGES and BUILDLINK_ORDER is handled by a single new
variable BUILDLINK_TREE. Each buildlink3.mk file adds a pair of
enter/exit marker, which can be used to reconstruct the tree and
to determine first level includes. Avoiding := for large variables
(BUILDLINK_ORDER) speeds up parse time as += has linear complexity.
The include guard reduces system time by avoiding reading files over and
over again. For complex packages this reduces both %user and %sys time to
half of the former time.

Log message:
Update to openssl-0.9.8j. Fixes CVE-2008-5077.

Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
*) Properly check EVP_VerifyFinal() and similar return values
   (CVE-2008-5077).
*) Allow the CHIL engine to be loaded, whether the application is
   multithreaded or not. (This does not release the developer from the
   obligation to set up the dynamic locking callbacks.)
*) Use correct exit code if there is an error in dgst command.
*) Tweak Configure so that you need to say "experimental-jpake" to enable
   JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
*) Add experimental JPAKE support, including demo authentication in
   s_client and s_server.
*) Set the comparison function in v3_addr_canonize().
*) Add support for XMPP STARTTLS in s_client.
*) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
   to ensure that even with this option, only ciphersuites in the
   server's preference list will be accepted.  (Note that the option
   applies only when resuming a session, so the earlier behavior was
   just about the algorithm choice for symmetric cryptography.)

Changes between 0.9.8h and 0.9.8i  [15 Sep 2008]
*) Fix a state transitition in s3_srvr.c and d1_srvr.c
   (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
*) The fix in 0.9.8c that supposedly got rid of unsafe
   double-checked locking was incomplete for RSA blinding,
   addressing just one layer of what turns out to have been
   doubly unsafe triple-checked locking.
   So now fix this for real by retiring the MONT_HELPER macro
   in crypto/rsa/rsa_eay.c.
*) Various precautionary measures:
   - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
   - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
     (NB: This would require knowledge of the secret session ticket key
     to exploit, in which case you'd be SOL either way.)
   - Change bn_nist.c so that it will properly handle input BIGNUMs
     outside the expected range.
   - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
     builds.
*) Allow engines to be "soft loaded" - i.e. optionally don't die if
   the load fails. Useful for distros.
*) Add support for Local Machine Keyset attribute in PKCS#12 files.
*) Fix BN_GF2m_mod_arr() top-bit cleanup code.
*) Expand ENGINE to support engine supplied SSL client certificate functions.
   This work was sponsored by Logica.
*) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
   keystores. Support for SSL/TLS client authentication too.
   Not compiled unless enable-capieng specified to Configure.
   This work was sponsored by Logica.
*) Fix bug in X509_ATTRIBUTE creation: dont set attribute using
   ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
   attribute creation routines such as certifcate requests and PKCS#12
   files.

Log message:
Might be good to actually add the patch that fixes the problem

Log message:
OpenSSL is not JOBS_SAFE
Pull in a fix from the OpenSSL CVS:
http://cvs.openssl.org/filediff?f=openssl/crypto/x509/x509_att.c&v1=1.14&v2=1.15
This should fix PR #39767 opened by Wolfgang Solfrank

Log message:
Add zlib option.
This is for PR 39433.
It is not enabled by default.

Log message:
Catch distinfo up with the removal of patch-a[bh].

(Hi Tobias :)