Log message:
Build fix for OS X Tiger via Macports

Log message:
Bump PKGREVISIONs for perl 5.30.0

Log message:
*: recursive bump for nettle 3.5.1

Log message:
Update to v3.6.8

Changes
=======

* Version 3.6.8 (released 2019-05-28)

** libgnutls: Added gnutls_prf_early() function to retrieve early keying
   material (#329)

** libgnutls: Added support for AES-XTS cipher (#354)

** libgnutls: Fix calculation of Streebog digests (incorrect carry operation in
   512 bit addition)

** libgnutls: During Diffie-Hellman operations in TLS, verify that the peer's
   public key is on the right subgroup (y^q=1 mod p), when q is available (under
   TLS 1.3 and under earlier versions when RFC7919 parameters are used).

** libgnutls: the gnutls_srp_set_server_credentials_function can now be used
   with the 8192 parameters as well (#995).

** libgnutls: Fixed bug preventing the use of gnutls_pubkey_verify_data2() and
   gnutls_pubkey_verify_hash2() with the GNUTLS_VERIFY_DISABLE_CA_SIGN flag (#754)

** libgnutls: The priority string option %ALLOW_SMALL_RECORDS was added to allow
   clients to communicate with the server advertising smaller limits than 512

** libgnutls: Apply STD3 ASCII rules in gnutls_idna_map() to prevent
   hostname/domain crafting via IDNA conversion (#720)

** certtool: allow the digital signature key usage flag in CA certificates.
   Previously certtool would ignore this flag for CA certificates even if
   specified (#767)

** gnutls-cli/serv: added the --keymatexport and --keymatexportsize options.
   These allow testing the RFC5705 using these tools.

** API and ABI modifications:
gnutls_prf_early: Added
gnutls_record_set_max_recv_size: Added
gnutls_dh_params_import_raw3: Added
gnutls_ffdhe_2048_group_q: Added
gnutls_ffdhe_3072_group_q: Added
gnutls_ffdhe_4096_group_q: Added
gnutls_ffdhe_6144_group_q: Added
gnutls_ffdhe_8192_group_q: Added

Log message:
gnutls: Update to 3.6.7

Bug fix and security release on the stable 3.6.x branch.
OK during the freeze by <jperkin>, thanks!

Changes:
3.6.7
-----

 - libgnutls, gnutls tools: Every gnutls_free() will automatically set
   the free'd pointer to NULL. This prevents possible use-after-free and
   double free issues. Use-after-free will be turned into NULL dereference.
   The counter-measure does not extend to applications using gnutls_free().
 - libgnutls: Fixed a memory corruption (double free) vulnerability in the
   certificate verification API. Reported by Tavis Ormandy; addressed with
   the change above. [GNUTLS-SA-2019-03-27, #694]
 - libgnutls: Fixed an invalid pointer access via malformed TLS1.3 async messages;
   Found using tlsfuzzer. [GNUTLS-SA-2019-03-27, #704]
 - libgnutls: enforce key usage limitations on certificates more actively.
   Previously we would enforce it for TLS1.2 protocol, now we enforce it
   even when TLS1.3 is negotiated, or on client certificates as well. When
   an inappropriate for TLS1.3 certificate is seen on the credentials structure
   GnuTLS will disable TLS1.3 support for that session (#690).
 - libgnutls: the default number of tickets sent under TLS 1.3 was increased to
   two. This makes it easier for clients which perform multiple connections
   to the server to use the tickets sent by a default server.
 - libgnutls: enforce the equality of the two signature parameters fields in
   a certificate. We were already enforcing the signature algorithm, but there
   was a bug in parameter checking code.
 - libgnutls: fixed issue preventing sending and receiving from different
   threads when false start was enabled (#713).
 - libgnutls: the flag GNUTLS_PKCS11_OBJ_FLAG_LOGIN_SO now implies a writable
   session, as non-writeable security officer sessions are undefined in PKCS#11
   (#721).
 - libgnutls: no longer send downgrade sentinel in TLS 1.3.
   Previously the sentinel value was embedded to early in version
   negotiation and was sent even on TLS 1.3. It is now sent only when
   TLS 1.2 or earlier is negotiated (#689).
 - gnutls-cli: Added option --logfile to redirect informational messages output.

 - No API and ABI modifications since last version.

Log message:
gnutls: updated to 3.6.6

Version 3.6.6:
* libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits
  on the public key.
* libgnutls: Added support for raw public-key authentication as defined in RFC7250.
  Raw public-keys can be negotiated by enabling the corresponding certificate
  types via the priority strings. The raw public-key mechanism must be explicitly
  enabled via the GNUTLS_ENABLE_RAWPK init flag.
* libgnutls: When on server or client side we are sending no extensions we do
  not set an empty extensions field but we rather remove that field competely.
  This solves a regression since 3.5.x and improves compatibility of the server
  side with certain clients.
* libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if
  the CKA_SIGN is not set.
* libgnutls: The priority string option %NO_EXTENSIONS was improved to completely
  disable extensions at all cases, while providing a functional session. This
  also implies that when specified, TLS1.3 is disabled.
* libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated.
  The previous definition was non-functional.
* API and ABI modifications:
GNUTLS_ENABLE_RAWPK: Added
GNUTLS_ENABLE_CERT_TYPE_NEG: Removed (was no-op; replaced by GNUTLS_ENABLE_RAWPK)
GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION: Deprecated
GNUTLS_PCERT_NO_CERT: Deprecated

Log message:
gnutls: Add a dependency to mozilla-rootcerts and configure to use them

Without providing `--with-default-trust-store-file=' configure
argument gnutls try to check a list of hardcoded paths for the
trust store file and use the first found.

If none of them is found gnutls_certificate_set_x509_system_trust()
returns GNUTLS_E_UNIMPLEMENTED_FEATURE and the location of trust
store file should be provided (e.g. in gnutls-cli via --x509cafile
option).

Depends on mozilla-rootcerts and pass `--with-default-trust-store-file='
similarly to security/p11-kit to always have a consistent default
trust store file and an implemented
gnutls_certificate_set_x509_system_trust().

Bump PKGREVISION

Log message:
gnutls: Update security/gnutls to 3.6.5

pkgsrc changes:
- Remove comments regarding bash and tests (bash was added
  unconditionally due REPLACE_BASH usages)

Changes:
3.6.5
-----
** libgnutls: Provide the option of transparent re-handshake/reauthentication
   when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571).
** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127)
** libgnutls: The priority functions will ignore and not enable TLS1.3 if
   requested with legacy TLS versions enabled but not TLS1.2. That is because
   if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled)
   servers which do not support TLS1.3 will negotiate TLS1.2 which will be
   rejected by the client as disabled (#621).
** libgnutls: Change RSA decryption to use a new side-channel silent function.
   This addresses a security issue where memory access patterns as well as timing
   on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher
   attacks. Side-channel resistant code is slower due to the need to mask
   access and timings. When used in TLS the new functions cause RSA based
   handshakes to be between 13% and 28% slower on average (Numbers are indicative,
   the tests where performed on a relatively modern Intel CPU, results vary
   depending on the CPU and architecture used). This change makes nettle 3.4.1
   the minimum requirement of gnutls (#630). [CVSS: medium]
** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword
   in the priority string. It is only accepted as legacy option and is ignored.
** libgnutls: Added support for EdDSA under PKCS#11 (#417)
** libgnutls: Added support for AES-CFB8 cipher (#357)
** libgnutls: Added support for AES-CMAC MAC (#351)
** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB \ 
ciphers
   have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D
   S-BOXes). They are fixed now.
** libgnutls: Added support for GOST key unmasking and unwrapped GOST private
   keys parsing, as specified in R 50.1.112-2016.
** gnutls-serv: It applies the default settings when no --priority option is given,
   using gnutls_set_default_priority().
** p11tool: Fix initialization of security officer's PIN with the --initialize-so-pin
   option (#561)
** certtool: Add parameter --no-text that prevents certtool from outputting
   text before PEM-encoded private key, public key, certificate, CRL or CSR.

** API and ABI modifications:
GNUTLS_AUTO_REAUTH: Added
GNUTLS_CIPHER_AES_128_CFB8: Added
GNUTLS_CIPHER_AES_192_CFB8: Added
GNUTLS_CIPHER_AES_256_CFB8: Added
GNUTLS_MAC_AES_CMAC_128: Added
GNUTLS_MAC_AES_CMAC_256: Added
gnutls_record_get_max_early_data_size: Added
gnutls_record_send_early_data: Added
gnutls_record_recv_early_data: Added
gnutls_db_check_entry_expire_time: Added
gnutls_anti_replay_set_add_function: Added
gnutls_anti_replay_init: Added
gnutls_anti_replay_deinit: Added
gnutls_anti_replay_set_window: Added
gnutls_anti_replay_enable: Added
gnutls_privkey_decrypt_data2: Added

Log message:
gnutls: update to 3.6.4.

* Version 3.6.4 (released 2018-09-24)

** libgnutls: Added the final (RFC8446) version numbering of the TLS1.3 protocol.

** libgnutls: Corrected regression since 3.6.3 in the callbacks set with
   gnutls_certificate_set_retrieve_function() which could not handle the case where
   no certificates were returned, or the callbacks were set to NULL (see #528).

** libgnutls: gnutls_handshake() on server returns early on handshake when no
   certificate is presented by client and the gnutls_init() flag \ 
GNUTLS_ENABLE_EARLY_START
   is specified.

** libgnutls: Added session ticket key rotation on server side with TOTP.
   The key set with gnutls_session_ticket_enable_server() is used as a
   master key to generate time-based keys for tickets. The rotation
   relates to the gnutls_db_set_cache_expiration() period.

** libgnutls: The 'record size limit' extension is added and preferred to the
   'max record size' extension when possible.

** libgnutls: Provide a more flexible PKCS#11 search of trust store certificates.
   This addresses the problem where the CA certificate doesn't have a subject key
   identifier whereas the end certificates have an authority key identifier (#569)

** libgnutls: gnutls_privkey_export_gost_raw2(), gnutls_privkey_import_gost_raw(),
   gnutls_pubkey_export_gost_raw2(), gnutls_pubkey_import_gost_raw() import
   and export GOST parameters in the "native" little endian format \ 
used for these
   curves. This is an intentional incompatible change with 3.6.3.

** libgnutls: Added support for seperately negotiating client and server \ 
certificate types
   as defined in RFC7250. This mechanism must be explicitly enabled via the
   GNUTLS_ENABLE_CERT_TYPE_NEG flag in gnutls_init().

** gnutls-cli: enable CRL validation on startup (#564)

** API and ABI modifications:
GNUTLS_ENABLE_EARLY_START: Added
GNUTLS_ENABLE_CERT_TYPE_NEG: Added
GNUTLS_TL_FAIL_ON_INVALID_CRL: Added
GNUTLS_CERTIFICATE_VERIFY_CRLS: Added
gnutls_ctype_target_t: New enumeration
gnutls_record_set_max_early_data_size: Added
gnutls_certificate_type_get2: Added
gnutls_priority_certificate_type_list2: Added
gnutls_ffdhe_6144_group_prime: Added
gnutls_ffdhe_6144_group_generator: Added
gnutls_ffdhe_6144_key_bits: Added

Log message:
gnutls: be explicit about --without-idn