Log message:
*: recursive bump for Python 3.11 as new default

Log message:
*: Remove all instances of GCC_REQD where my name is the most recent
in 'cvs annotate' (part 2)

Log message:
mbedtls: update to 2.28.3.

= Mbed TLS 2.28.3 branch released 2023-03-28

Features
   * Use HOSTCC (if it is set) when compiling C code during generation of the
     configuration-independent files. This allows them to be generated when
     CC is set for cross compilation.
   * AES-NI is now supported with Visual Studio.
   * AES-NI is now supported in 32-bit builds, or when MBEDTLS_HAVE_ASM
     is disabled, when compiling with GCC or Clang or a compatible compiler
     for a target CPU that supports the requisite instructions (for example
     gcc -m32 -msse2 -maes -mpclmul). (Generic x86 builds with GCC-like
     compilers still require MBEDTLS_HAVE_ASM and a 64-bit target.)

Security
   * MBEDTLS_AESNI_C, which is enabled by default, was silently ignored on
     builds that couldn't compile the GCC-style assembly implementation
     (most notably builds with Visual Studio), leaving them vulnerable to
     timing side-channel attacks. There is now an intrinsics-based AES-NI
     implementation as a fallback for when the assembly one cannot be used.

Bugfix
   * Fix a build issue on Windows where the source and build directory could
     not be on different drives (#5751).
   * Fix possible integer overflow in mbedtls_timing_hardclock(), which
     could cause a crash for certain platforms & compiler options.
   * Fix IAR compiler warnings. Fixes #6924.
   * Fix a bug in the build where directory names containing spaces were
     causing generate_errors.pl to error out resulting in a build failure.
     Fixes issue #6879.
   * Fix compile error where MBEDTLS_RSA_C and MBEDTLS_X509_CRT_WRITE_C are
     defined, but MBEDTLS_PK_RSA_ALT_SUPPORT is not defined. Fixes #3174.
   * Fix a build issue when defining MBEDTLS_TIMING_ALT and MBEDTLS_SELF_TEST.
     The library would not link if the user didn't provide an external self-test
     function. The self-test is now provided regardless of the choice of
     internal/alternative timing implementation. Fixes #6923.
   * mbedtls_x509write_crt_set_serial() now explicitly rejects serial numbers
     whose binary representation is longer than 20 bytes. This was already
     forbidden by the standard (RFC5280 - section 4.1.2.2) and now it's being
     enforced also at code level.
   * Fix potential undefined behavior in mbedtls_mpi_sub_abs().  Reported by
     Pascal Cuoq using TrustInSoft Analyzer in #6701; observed independently by
     Aaron Ucko under Valgrind.
   * Fix behavior of certain sample programs which could, when run with no
     arguments, access uninitialized memory in some cases. Fixes #6700 (which
     was found by TrustInSoft Analyzer during REDOCS'22) and #1120.
   * Fix build errors in test programs when MBEDTLS_CERTS_C is disabled.
     Fixes #6243.
   * Fix parsing of X.509 SubjectAlternativeName extension. Previously,
     malformed alternative name components were not caught during initial
     certificate parsing, but only on subsequent calls to
     mbedtls_x509_parse_subject_alt_name(). Fixes #2838.
   * Fix bug in conversion from OID to string in
     mbedtls_oid_get_numeric_string(). OIDs such as 2.40.0.25 are now printed
     correctly.
   * Reject OIDs with overlong-encoded subidentifiers when converting
     them to a string.
   * Reject OIDs with subidentifier values exceeding UINT_MAX.  Such
     subidentifiers can be valid, but Mbed TLS cannot currently handle them.
   * Reject OIDs that have unterminated subidentifiers, or (equivalently)
     have the most-significant bit set in their last byte.
   * Silence a warning about an unused local variable in bignum.c on
     some architectures. Fixes #7166.
   * Silence warnings from clang -Wdocumentation about empty \retval
     descriptions, which started appearing with Clang 15. Fixes #6960.
   * Fix undefined behavior in mbedtls_ssl_read() and mbedtls_ssl_write() if
     len argument is 0 and buffer is NULL.

Changes
   * The C code follows a new coding style. This is transparent for users but
     affects contributors and maintainers of local patches. For more
     information, see
     \ 
https://mbed-tls.readthedocs.io/en/latest/kb/how-to/rewrite-branch-for-coding-style/
   * Changed the default MBEDTLS_ECP_WINDOW_SIZE from 6 to 2.
     As tested in issue 6790, the correlation between this define and
     RSA decryption performance has changed lately due to security fixes.
     To fix the performance degradation when using default values the
     window was reduced from 6 to 2, a value that gives the best or close
     to best results when tested on Cortex-M4 and Intel i7.

Log message:
*: convert to cmake/build.mk

Log message:
mbedtls: update to 2.28.2.

= Mbed TLS 2.28.2 branch released 2022-12-14

Security
   * Fix potential heap buffer overread and overwrite in DTLS if
     MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and
     MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
   * An adversary with access to precise enough information about memory
     accesses (typically, an untrusted operating system attacking a secure
     enclave) could recover an RSA private key after observing the victim
     performing a single private-key operation if the window size used for the
     exponentiation was 3 or smaller. Found and reported by Zili KOU,
     Wenjian HE, Sharad Sinha, and Wei ZHANG. See "Cache Side-channel Attacks
     and Defenses of the Sliding Window Algorithm in TEEs" - Design, Automation
     and Test in Europe 2023.

Bugfix
   * Fix a long-standing build failure when building x86 PIC code with old
     gcc (4.x). The code will be slower, but will compile. We do however
     recommend upgrading to a more recent compiler instead. Fixes #1910.
   * Fix support for little-endian Microblaze when MBEDTLS_HAVE_ASM is defined.
     Contributed by Kazuyuki Kimura to fix #2020.
   * Use double quotes to include private header file psa_crypto_cipher.h.
     Fixes 'file not found with <angled> include' error
     when building with Xcode.
   * Fix handling of broken symlinks when loading certificates using
     mbedtls_x509_crt_parse_path(). Instead of returning an error as soon as a
     broken link is encountered, skip the broken link and continue parsing
     other certificate files. Contributed by Eduardo Silva in #2602.
   * Fix a compilation error when using CMake with an IAR toolchain.
     Fixes #5964.
   * Fix bugs and missing dependencies when building and testing
     configurations with only one encryption type enabled in TLS 1.2.
   * Provide the missing definition of mbedtls_setbuf() in some configurations
     with MBEDTLS_PLATFORM_C disabled. Fixes #6118, #6196.
   * Fix compilation errors when trying to build with
     PSA drivers for AEAD (GCM, CCM, Chacha20-Poly1305).
   * Fix memory leak in ssl_parse_certificate_request() caused by
     mbedtls_x509_get_name() not freeing allocated objects in case of error.
     Change mbedtls_x509_get_name() to clean up allocated objects on error.
   * Fix checks on PK in check_config.h for builds with PSA and RSA. This does
     not change which builds actually work, only moving a link-time error to
     an early check.
   * Fix ECDSA verification, where it was not always validating the
     public key. This bug meant that it was possible to verify a
     signature with an invalid public key, in some cases. Reported by
     Guido Vranken using Cryptofuzz in #4420.
   * Fix a possible null pointer dereference if a memory allocation fails
     in TLS PRF code. Reported by Michael Madsen in #6516.
   * Fix a bug in which mbedtls_x509_crt_info() would produce non-printable
     bytes when parsing certificates containing a binary RFC 4108
     HardwareModuleName as a Subject Alternative Name extension. Hardware
     serial numbers are now rendered in hex format. Fixes #6262.
   * Fix bug in error reporting in dh_genprime.c where upon failure,
     the error code returned by mbedtls_mpi_write_file() is overwritten
     and therefore not printed.
   * In the bignum module, operations of the form (-A) - (+A) or (-A) - (-A)
     with A > 0 created an unintended representation of the value 0 which was
     not processed correctly by some bignum operations. Fix this. This had no
     consequence on cryptography code, but might affect applications that call
     bignum directly and use negative numbers.
   * Fix undefined behavior (typically harmless in practice) of
     mbedtls_mpi_add_mpi(), mbedtls_mpi_add_abs() and mbedtls_mpi_add_int()
     when both operands are 0 and the left operand is represented with 0 limbs.
   * Fix undefined behavior (typically harmless in practice) when some bignum
     functions receive the most negative value of mbedtls_mpi_sint. Credit
     to OSS-Fuzz. Fixes #6597.
   * Fix undefined behavior (typically harmless in practice) in PSA ECB
     encryption and decryption.

Log message:
mbedtls: mark this as the 'old stable 2.x branch'

Log message:
mbedtls: update to 2.28.1.

= Mbed TLS 2.28.1 branch released 2022-07-11

Default behavior changes
   * mbedtls_cipher_set_iv will now fail with ChaCha20 and ChaCha20+Poly1305
     for IV lengths other than 12. The library was silently overwriting this
     length with 12, but did not inform the caller about it. Fixes #4301.

Features
   * When MBEDTLS_PSA_CRYPTO_CONFIG is enabled, you may list the PSA crypto
     feature requirements in the file named by the new macro
     MBEDTLS_PSA_CRYPTO_CONFIG_FILE instead of the default psa/crypto_config.h.
     Furthermore you may name an additional file to include after the main
     file with the macro MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE.

Security
   * Zeroize dynamically-allocated buffers used by the PSA Crypto key storage
     module before freeing them. These buffers contain secret key material, and
     could thus potentially leak the key through freed heap.
   * Fix a potential heap buffer overread in TLS 1.2 server-side when
     MBEDTLS_USE_PSA_CRYPTO is enabled, an opaque key (created with
     mbedtls_pk_setup_opaque()) is provisioned, and a static ECDH ciphersuite
     is selected. This may result in an application crash or potentially an
     information leak.
   * Fix a buffer overread in DTLS ClientHello parsing in servers with
     MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled. An unauthenticated client
     or a man-in-the-middle could cause a DTLS server to read up to 255 bytes
     after the end of the SSL input buffer. The buffer overread only happens
     when MBEDTLS_SSL_IN_CONTENT_LEN is less than a threshold that depends on
     the exact configuration: 258 bytes if using mbedtls_ssl_cookie_check(),
     and possibly up to 571 bytes with a custom cookie check function.
     Reported by the Cybeats PSI Team.

Bugfix
   * Fix a memory leak if mbedtls_ssl_config_defaults() is called twice.
   * Fix several bugs (warnings, compiler and linker errors, test failures)
     in reduced configurations when MBEDTLS_USE_PSA_CRYPTO is enabled.
   * Fix a bug in (D)TLS curve negotiation: when MBEDTLS_USE_PSA_CRYPTO was
     enabled and an ECDHE-ECDSA or ECDHE-RSA key exchange was used, the
     client would fail to check that the curve selected by the server for
     ECDHE was indeed one that was offered. As a result, the client would
     accept any curve that it supported, even if that curve was not allowed
     according to its configuration. Fixes #5291.
   * Fix unit tests that used 0 as the file UID. This failed on some
     implementations of PSA ITS. Fixes #3838.
   * Fix API violation in mbedtls_md_process() test by adding a call to
     mbedtls_md_starts(). Fixes #2227.
   * Fix compile errors when MBEDTLS_HAVE_TIME is not defined. Add tests
     to catch bad uses of time.h.
   * Fix the library search path when building a shared library with CMake
     on Windows.
   * Fix bug in the alert sending function mbedtls_ssl_send_alert_message()
     potentially leading to corrupted alert messages being sent in case
     the function needs to be re-called after initially returning
     MBEDTLS_SSL_WANT_WRITE. Fixes #1916.
   * In configurations with MBEDTLS_SSL_DTLS_CONNECTION_ID enabled but none of
     MBEDTLS_SSL_HW_RECORD_ACCEL, MBEDTLS_SSL_EXPORT_KEYS or MBEDTLS_DEBUG_C,
     DTLS handshakes using CID would crash due to a null pointer dereference.
     Fix this. Fixes #3998.
   * Fix incorrect documentation of mbedtls_x509_crt_profile. The previous
     documentation stated that the `allowed_pks` field applies to signatures
     only, but in fact it does apply to the public key type of the end entity
     certificate, too. Fixes #1992.
   * Fix PSA cipher multipart operations using ARC4. Previously, an IV was
     required but discarded. Now, an IV is rejected, as it should be.
   * Fix undefined behavior in mbedtls_asn1_find_named_data(), where val is
     not NULL and val_len is zero.
   * psa_raw_key_agreement() now returns PSA_ERROR_BUFFER_TOO_SMALL when
     applicable. Fixes #5735.
   * Fix a bug in the x25519 example program where the removal of
     MBEDTLS_ECDH_LEGACY_CONTEXT caused the program not to run. Fixes #4901 and
     #3191.
   * Encode X.509 dates before 1/1/2000 as UTCTime rather than
     GeneralizedTime. Fixes #5465.
   * Fix order value of curve x448.
   * Fix string representation of DNs when outputting values containing commas
     and other special characters, conforming to RFC 1779. Fixes #769.
   * Silence a warning from GCC 12 in the selftest program. Fixes #5974.
   * Fix mbedtls_asn1_write_mpi() writing an incorrect encoding of 0.
   * Fix resource leaks in mbedtls_pk_parse_public_key() in low
     memory conditions.
   * Fix server connection identifier setting for outgoing encrypted records
     on DTLS 1.2 session resumption. After DTLS 1.2 session resumption with
     connection identifier, the Mbed TLS client now properly sends the server
     connection identifier in encrypted record headers. Fix #5872.
   * Fix a null pointer dereference when performing some operations on zero
     represented with 0 limbs (specifically mbedtls_mpi_mod_int() dividing
     by 2, and mbedtls_mpi_write_string() in base 2).
   * Fix record sizes larger than 16384 being sometimes accepted despite being
     non-compliant. This could not lead to a buffer overflow. In particular,
     application data size was already checked correctly.

Changes
   * Assume source files are in UTF-8 when using MSVC with CMake.

= mbed TLS 2.28.0 branch released 2021-12-17

API changes
   * Some fields of mbedtls_ssl_session and mbedtls_ssl_config are in a
     different order. This only affects applications that define such
     structures directly or serialize them.

Requirement changes
   * Sign-magnitude and one's complement representations for signed integers are
     not supported. Two's complement is the only supported representation.

Removals
   * Remove config option MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES,
     which allowed SHA-1 in the default TLS configuration for certificate
     signing. It was intended to facilitate the transition in environments
     with SHA-1 certificates. SHA-1 is considered a weak message digest and
     its use constitutes a security risk.
   * Remove the partial support for running unit tests via Greentea on Mbed OS,
     which had been unmaintained since 2018.

Features
   * The identifier of the CID TLS extension can be configured by defining
     MBEDTLS_TLS_EXT_CID at compile time.
   * Warn if errors from certain functions are ignored. This is currently
     supported on GCC-like compilers and on MSVC and can be configured through
     the macro MBEDTLS_CHECK_RETURN. The warnings are always enabled
     (where supported) for critical functions where ignoring the return
     value is almost always a bug. Enable the new configuration option
     MBEDTLS_CHECK_RETURN_WARNING to get warnings for other functions. This
     is currently implemented in the AES, DES and md modules, and will be
     extended to other modules in the future.
   * Add missing PSA macros declared by PSA Crypto API 1.0.0:
     PSA_ALG_IS_SIGN_HASH, PSA_ALG_NONE, PSA_HASH_BLOCK_LENGTH, PSA_KEY_ID_NULL.
   * Add new API mbedtls_ct_memcmp for constant time buffer comparison.
   * Add PSA API definition for ARIA.

Security
   * Zeroize several intermediate variables used to calculate the expected
     value when verifying a MAC or AEAD tag. This hardens the library in
     case the value leaks through a memory disclosure vulnerability. For
     example, a memory disclosure vulnerability could have allowed a
     man-in-the-middle to inject fake ciphertext into a DTLS connection.
   * In psa_cipher_generate_iv() and psa_cipher_encrypt(), do not read back
     from the output buffer. This fixes a potential policy bypass or decryption
     oracle vulnerability if the output buffer is in memory that is shared with
     an untrusted application.
   * Fix a double-free that happened after mbedtls_ssl_set_session() or
     mbedtls_ssl_get_session() failed with MBEDTLS_ERR_SSL_ALLOC_FAILED
     (out of memory). After that, calling mbedtls_ssl_session_free()
     and mbedtls_ssl_free() would cause an internal session buffer to
     be free()'d twice.

Bugfix
   * Stop using reserved identifiers as local variables. Fixes #4630.
   * The GNU makefiles invoke python3 in preference to python except on Windows.
     The check was accidentally not performed when cross-compiling for Windows
     on Linux. Fix this. Fixes #4774.
   * Prevent divide by zero if either of PSA_CIPHER_ENCRYPT_OUTPUT_SIZE() or
     PSA_CIPHER_UPDATE_OUTPUT_SIZE() were called using an asymmetric key type.
   * Fix a parameter set but unused in psa_crypto_cipher.c. Fixes #4935.
   * Don't use the obsolete header path sys/fcntl.h in unit tests.
     These header files cause compilation errors in musl.
     Fixes #4969.
   * Fix missing constraints on x86_64 and aarch64 assembly code
     for bignum multiplication that broke some bignum operations with
     (at least) Clang 12.
     Fixes #4116, #4786, #4917, #4962.
   * Fix mbedtls_cipher_crypt: AES-ECB when MBEDTLS_USE_PSA_CRYPTO is enabled.
   * Failures of alternative implementations of AES or DES single-block
     functions enabled with MBEDTLS_AES_ENCRYPT_ALT, MBEDTLS_AES_DECRYPT_ALT,
     MBEDTLS_DES_CRYPT_ECB_ALT or MBEDTLS_DES3_CRYPT_ECB_ALT were ignored.
     This does not concern the implementation provided with Mbed TLS,
     where this function cannot fail, or full-module replacements with
     MBEDTLS_AES_ALT or MBEDTLS_DES_ALT. Reported by Armelle Duboc in #1092.
   * Some failures of HMAC operations were ignored. These failures could only
     happen with an alternative implementation of the underlying hash module.
   * Fix the error returned by psa_generate_key() for a public key. Fixes #4551.
   * Fix the build of sample programs when neither MBEDTLS_ERROR_C nor
     MBEDTLS_ERROR_STRERROR_DUMMY is enabled.
   * Fix PSA_ALG_RSA_PSS verification accepting an arbitrary salt length.
     This algorithm now accepts only the same salt length for verification
     that it produces when signing, as documented. Use the new algorithm
     PSA_ALG_RSA_PSS_ANY_SALT to accept any salt length. Fixes #4946.
   * The existing predicate macro name PSA_ALG_IS_HASH_AND_SIGN is now reserved
     for algorithm values that fully encode the hashing step, as per the PSA
     Crypto API specification. This excludes PSA_ALG_RSA_PKCS1V15_SIGN_RAW and
     PSA_ALG_ECDSA_ANY. The new predicate macro PSA_ALG_IS_SIGN_HASH covers
     all algorithms that can be used with psa_{sign,verify}_hash(), including
     these two.
   * Fix issue in Makefile on Linux with SHARED=1, that caused shared libraries
     not to list other shared libraries they need.
   * Fix a bug in mbedtls_gcm_starts() when the bit length of the iv
     exceeds 2^32. Fixes #4884.
   * Fix an uninitialized variable warning in test_suite_ssl.function with GCC
     version 11.
   * Fix the build when no SHA2 module is included. Fixes #4930.
   * Fix the build when only the bignum module is included. Fixes #4929.
   * Fix a potential invalid pointer dereference and infinite loop bugs in
     pkcs12 functions when the password is empty. Fix the documentation to
     better describe the inputs to these functions and their possible values.
     Fixes #5136.
   * The key usage flags PSA_KEY_USAGE_SIGN_MESSAGE now allows the MAC
     operations psa_mac_compute() and psa_mac_sign_setup().
   * The key usage flags PSA_KEY_USAGE_VERIFY_MESSAGE now allows the MAC
     operations psa_mac_verify() and psa_mac_verify_setup().

Changes
   * Set config option MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE to be
     disabled by default.
   * Improve the performance of base64 constant-flow code. The result is still
     slower than the original non-constant-flow implementation, but much faster
     than the previous constant-flow implementation. Fixes #4814.
   * Indicate in the error returned if the nonce length used with
     ChaCha20-Poly1305 is invalid, and not just unsupported.
   * The mbedcrypto library includes a new source code module constant_time.c,
     containing various functions meant to resist timing side channel attacks.
     This module does not have a separate configuration option, and functions
     from this module will be included in the build as required. Currently
     most of the interface of this module is private and may change at any
     time.

= mbed TLS 2.27.0 branch released 2021-07-07

API changes
   * Update AEAD output size macros to bring them in line with the PSA Crypto
     API version 1.0 spec. This version of the spec parameterizes them on the
     key type used, as well as the key bit-size in the case of
     PSA_AEAD_TAG_LENGTH.
     The old versions of these macros were renamed and deprecated as follows:
     - PSA_AEAD_TAG_LENGTH          -> PSA_AEAD_TAG_LENGTH_1_ARG
     - PSA_AEAD_ENCRYPT_OUTPUT_SIZE -> PSA_AEAD_ENCRYPT_OUTPUT_SIZE_2_ARG
     - PSA_AEAD_DECRYPT_OUTPUT_SIZE -> PSA_AEAD_DECRYPT_OUTPUT_SIZE_2_ARG
     - PSA_AEAD_UPDATE_OUTPUT_SIZE  -> PSA_AEAD_UPDATE_OUTPUT_SIZE_2_ARG
     - PSA_AEAD_FINISH_OUTPUT_SIZE  -> PSA_AEAD_FINISH_OUTPUT_SIZE_1_ARG
     - PSA_AEAD_VERIFY_OUTPUT_SIZE  -> PSA_AEAD_VERIFY_OUTPUT_SIZE_1_ARG
   * Implement one-shot cipher functions, psa_cipher_encrypt and
     psa_cipher_decrypt, according to the PSA Crypto API 1.0.0
     specification.

Requirement changes
   * The library now uses the %zu format specifier with the printf() family of
     functions, so requires a toolchain that supports it. This change does not
     affect the maintained LTS branches, so when contributing changes please
     bear this in mind and do not add them to backported code.

Features
   * Add mbedtls_rsa_rsassa_pss_sign_ext() function allowing to generate a
     signature with a specific salt length. This function allows to validate
     test cases provided in the NIST's CAVP test suite. Contributed by Cédric
     Meuter in PR #3183.
   * Added support for built-in driver keys through the PSA opaque crypto
     driver interface. Refer to the documentation of
     MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS for more information.
   * Implement psa_sign_message() and psa_verify_message().
   * The new function mbedtls_mpi_random() generates a random value in a
     given range uniformly.
   * Implement psa_mac_compute() and psa_mac_verify() as defined in the
     PSA Cryptograpy API 1.0.0 specification.
   * MBEDTLS_ECP_MAX_BITS is now determined automatically from the configured
     curves and no longer needs to be configured explicitly to save RAM.

Security
   * Fix a bias in the generation of finite-field Diffie-Hellman-Merkle (DHM)
     private keys and of blinding values for DHM and elliptic curves (ECP)
     computations. Reported by FlorianF89 in #4245.
   * Fix a potential side channel vulnerability in ECDSA ephemeral key generation.
     An adversary who is capable of very precise timing measurements could
     learn partial information about the leading bits of the nonce used for the
     signature, allowing the recovery of the private key after observing a
     large number of signature operations. This completes a partial fix in
     Mbed TLS 2.20.0.
   * It was possible to configure MBEDTLS_ECP_MAX_BITS to a value that is
     too small, leading to buffer overflows in ECC operations. Fail the build
     in such a case.
   * An adversary with access to precise enough information about memory
     accesses (typically, an untrusted operating system attacking a secure
     enclave) could recover an RSA private key after observing the victim
     performing a single private-key operation. Found and reported by
     Zili KOU, Wenjian HE, Sharad Sinha, and Wei ZHANG.
   * An adversary with access to precise enough timing information (typically, a
     co-located process) could recover a Curve25519 or Curve448 static ECDH key
     after inputting a chosen public key and observing the victim performing the
     corresponding private-key operation. Found and reported by Leila Batina,
     Lukas Chmielewski, Björn Haase, Niels Samwel and Peter Schwabe.

Bugfix
   * Add printf function attributes to mbedtls_debug_print_msg to ensure we
     get printf format specifier warnings.
   * Fix premature fopen() call in mbedtls_entropy_write_seed_file which may
     lead to seed file corruption in the case where the path to the seed file is
     equal to MBEDTLS_PLATFORM_STD_NV_SEED_FILE. Contributed by Victor
     Krasnoshchok in #3616.
   * PSA functions other than psa_open_key now return PSA_ERROR_INVALID_HANDLE
     rather than PSA_ERROR_DOES_NOT_EXIST for an invalid handle, bringing them
     in line with version 1.0.0 of the specification. Fix #4162.
   * PSA functions creating a key now return PSA_ERROR_INVALID_ARGUMENT rather
     than PSA_ERROR_INVALID_HANDLE when the identifier specified for the key
     to create is not valid, bringing them in line with version 1.0.0 of the
     specification. Fix #4271.
   * Fix some cases in the bignum module where the library constructed an
     unintended representation of the value 0 which was not processed
     correctly by some bignum operations. This could happen when
     mbedtls_mpi_read_string() was called on "-0", or when
     mbedtls_mpi_mul_mpi() and mbedtls_mpi_mul_int() was called with one of
     the arguments being negative and the other being 0. Fixes #4643.
   * Fix a bug in ECDSA that would cause it to fail when the hash is all-bits
     zero. Fixes #1792
   * Fix a compilation error when MBEDTLS_ECP_RANDOMIZE_MXZ_ALT is
     defined. Fixes #4217.
   * Fix an incorrect error code when parsing a PKCS#8 private key.
   * In a TLS client, enforce the Diffie-Hellman minimum parameter size
     set with mbedtls_ssl_conf_dhm_min_bitlen() precisely. Before, the
     minimum size was rounded down to the nearest multiple of 8.
   * In library/net_sockets.c, _POSIX_C_SOURCE and _XOPEN_SOURCE are
     defined to specific values.  If the code is used in a context
     where these are already defined, this can result in a compilation
     error.  Instead, assume that if they are defined, the values will
     be adequate to build Mbed TLS.
   * The cipher suite TLS-RSA-WITH-CAMELLIA-256-GCM-SHA384 was not available
     when SHA-1 was disabled and was offered when SHA-1 was enabled but SHA-384
     was disabled. Fix the dependency. Fixes #4472.
   * Do not offer SHA384 cipher suites when SHA-384 is disabled. Fixes #4499.
   * With MBEDTLS_PSA_CRYPTO_C disabled, some functions were getting built
     nonetheless, resulting in undefined reference errors when building a
     shared library. Reported by Guillermo Garcia M. in #4411.
   * Fix test suite code on platforms where int32_t is not int, such as
     Arm Cortex-M. Fixes #4530.
   * Fix some issues affecting MBEDTLS_ARIA_ALT implementations: a misplaced
     directive in a header and a missing initialization in the self-test.
   * Fix a missing initialization in the Camellia self-test, affecting
     MBEDTLS_CAMELLIA_ALT implementations.
   * Restore the ability to configure PSA via Mbed TLS options to support RSA
     key pair operations but exclude RSA key generation. When MBEDTLS_GENPRIME
     is not defined PSA will no longer attempt to use mbedtls_rsa_gen_key().
     Fixes #4512.
   * Fix a regression introduced in 2.24.0 which broke (D)TLS CBC ciphersuites
     (when the encrypt-then-MAC extension is not in use) with some ALT
     implementations of the underlying hash (SHA-1, SHA-256, SHA-384), causing
     the affected side to wrongly reject valid messages. Fixes #4118.
   * Remove outdated check-config.h check that prevented implementing the
     timing module on Mbed OS. Fixes #4633.
   * Fix PSA_ALG_TLS12_PRF and PSA_ALG_TLS12_PSK_TO_MS being too permissive
     about missing inputs.
   * Fix mbedtls_net_poll() and mbedtls_net_recv_timeout() often failing with
     MBEDTLS_ERR_NET_POLL_FAILED on Windows. Fixes #4465.
   * Fix a resource leak in a test suite with an alternative AES
     implementation. Fixes #4176.
   * Fix a crash in mbedtls_mpi_debug_mpi on a bignum having 0 limbs. This
     could notably be triggered by setting the TLS debug level to 3 or above
     and using a Montgomery curve for the key exchange. Reported by lhuang04
     in #4578. Fixes #4608.
   * psa_verify_hash() was relying on implementation-specific behavior of
     mbedtls_rsa_rsassa_pss_verify() and was causing failures in some _ALT
     implementations. This reliance is now removed. Fixes #3990.
   * Disallow inputs of length different from the corresponding hash when
     signing or verifying with PSA_ALG_RSA_PSS (The PSA Crypto API mandates
     that PSA_ALG_RSA_PSS uses the same hash throughout the algorithm.)
   * Fix a null pointer dereference when mbedtls_mpi_exp_mod() was called with
     A=0 represented with 0 limbs. Up to and including Mbed TLS 2.26, this bug
     could not be triggered by code that constructed A with one of the
     mbedtls_mpi_read_xxx functions (including in particular TLS code) since
     those always built an mpi object with at least one limb.
     Credit to OSS-Fuzz. Fixes #4641.
   * Fix mbedtls_mpi_gcd(G,A,B) when the value of B is zero. This had no
     effect on Mbed TLS's internal use of mbedtls_mpi_gcd(), but may affect
     applications that call mbedtls_mpi_gcd() directly. Fixes #4642.
   * The PSA API no longer allows the creation or destruction of keys with a
     read-only lifetime. The persistence level PSA_KEY_PERSISTENCE_READ_ONLY
     can now only be used as intended, for keys that cannot be modified through
     normal use of the API.
   * When MBEDTLS_PSA_CRYPTO_SPM is enabled, crypto_spe.h was not included
     in all the right places. Include it from crypto_platform.h, which is
     the natural place. Fixes #4649.
   * mbedtls_pk_sign() and mbedtls_pk_verify() and their extended and
     restartable variants now always honor the specified hash length if
     nonzero. Before, for RSA, hash_len was ignored in favor of the length of
     the specified hash algorithm.
   * Fix which alert is sent in some cases to conform to the
     applicable RFC: on an invalid Finished message value, an
     invalid max_fragment_length extension, or an
     unsupported extension used by the server.
   * Correct (change from 12 to 13 bytes) the value of the macro describing the
     maximum nonce length returned by psa_aead_generate_nonce().

Changes
   * Add extra printf compiler warning flags to builds.
   * Fix memsan build false positive in x509_crt.c with Clang 11
   * Fix the setting of the read timeout in the DTLS sample programs.
   * Remove the AES sample application programs/aes/aescrypt2 which shows
     bad cryptographic practice. Fix #1906.
   * Alternative implementations of CMAC may now opt to not support 3DES as a
     CMAC block cipher, and still pass the CMAC self test.
   * Remove configs/config-psa-crypto.h, which was identical to the default
     configuration except for having some extra cryptographic mechanisms
     enabled and for unintended differences. This configuration was primarily
     intended to demonstrate the PSA API, and lost most of its usefulness when
     MBEDTLS_PSA_CRYPTO_C became enabled by default.
   * When building the test suites with GNU make, invoke python3 or python, not
     python2, which is no longer supported upstream.
   * When using session cache based session resumption on the server,
     double-check that custom session cache implementations return
     sessions which are consistent with the negotiated ciphersuite
     and compression method.
   * Fix build failure on MinGW toolchain when __USE_MING_ANSI_STDIO is on.
     When that flag is on, standard GNU C printf format specifiers
     should be used.
   * Reduce the default value of MBEDTLS_ECP_WINDOW_SIZE. This reduces RAM usage
     during ECC operations at a negligible performance cost.
   * mbedtls_mpi_read_binary(), mbedtls_mpi_read_binary_le() and
     mbedtls_mpi_read_string() now construct an mbedtls_mpi object with 0 limbs
     when their input has length 0. Note that this is an implementation detail
     and can change at any time, so this change should be transparent, but it
     may result in mbedtls_mpi_write_binary() or mbedtls_mpi_write_string()
     now writing an empty string where it previously wrote one or more
     zero digits when operating from values constructed with an mpi_read
     function and some mpi operations.
   * Implicitly add PSA_KEY_USAGE_SIGN_MESSAGE key usage policy flag when
     PSA_KEY_USAGE_SIGN_HASH flag is set and PSA_KEY_USAGE_VERIFY_MESSAGE flag
     when PSA_KEY_USAGE_VERIFY_HASH flag is set. This usage flag extension
     is also applied when loading a key from storage.

Log message:
security: Replace RMD160 checksums with BLAKE2s checksums

All checksums have been double-checked against existing RMD160 and
SHA512 hashes

Unfetchable distfiles (fetched conditionally?):
./security/cyrus-sasl/distinfo \ 
cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2

Log message:
security: Remove SHA1 hashes for distfiles

Log message:
mbedtls: update to 2.26.0

This release of Mbed TLS provides bug fixes, minor enhancements and new \ 
features. This release includes fixes for security issues.
API changes

    Renamed the PSA Crypto API output buffer size macros to bring them in line
    with version 1.0.0 of the specification.
    The API glue function mbedtls_ecc_group_of_psa() now takes the curve size
    in bits rather than bytes, with an additional flag to indicate if the
    size may have been rounded up to a whole number of bytes.
    Renamed the PSA Crypto API AEAD tag length macros to bring them in line
    with version 1.0.0 of the specification.

Default behavior changes

    In mbedtls_rsa_context objects, the ver field was formerly documented
    as always 0. It is now reserved for internal purposes and may take
    different values.

New deprecations

    PSA_KEY_EXPORT_MAX_SIZE, PSA_HASH_SIZE, PSA_MAC_FINAL_SIZE,
    PSA_BLOCK_CIPHER_BLOCK_SIZE, PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE and
    PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN have been renamed, and the old names
    deprecated.
    PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH and PSA_ALG_AEAD_WITH_TAG_LENGTH
    have been renamed, and the old names deprecated.

Features

    The PSA crypto subsystem can now use HMAC_DRBG instead of CTR_DRBG.
    CTR_DRBG is used by default if it is available, but you can override
    this choice by setting MBEDTLS_PSA_HMAC_DRBG_MD_TYPE at compile time.
    Fix #3354.
    Automatic fallback to a software implementation of ECP when
    MBEDTLS_ECP_xxx_ALT accelerator hooks are in use can now be turned off
    through setting the new configuration flag MBEDTLS_ECP_NO_FALLBACK.
    The PSA crypto subsystem can now be configured to use less static RAM by
    tweaking the setting for the maximum amount of keys simultaneously in RAM.
    MBEDTLS_PSA_KEY_SLOT_COUNT sets the maximum number of volatile keys that
    can exist simultaneously. It has a sensible default if not overridden.
    Partial implementation of the PSA crypto driver interface: Mbed TLS can
    now use an external random generator instead of the library's own
    entropy collection and DRBG code. Enable MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
    and see the documentation of mbedtls_psa_external_get_random() for details.
    Applications using both mbedtls_xxx and psa_xxx functions (for example,
    applications using TLS and MBEDTLS_USE_PSA_CRYPTO) can now use the PSA
    random generator with mbedtls_xxx functions. See the documentation of
    mbedtls_psa_get_random() for details.
    In the PSA API, the policy for a MAC or AEAD algorithm can specify a
    minimum MAC or tag length thanks to the new wildcards
    PSA_ALG_AT_LEAST_THIS_LENGTH_MAC and
    PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG.

Security

    Fix a security reduction in CTR_DRBG when the initial seeding obtained a
    nonce from entropy. Applications were affected if they called
    mbedtls_ctr_drbg_set_nonce_len(), if they called
    mbedtls_ctr_drbg_set_entropy_len() with a size that was 3/2 times the key
    length, or when the entropy module uses SHA-256 and CTR_DRBG uses AES-256.
    In such cases, a random nonce was necessary to achieve the advertised
    security strength, but the code incorrectly used a constant instead of
    entropy from the nonce.
    Found by John Stroebel in #3819 and fixed in #3973.
    Fix a buffer overflow in mbedtls_mpi_sub_abs() when calculating
    |A| - |B| where |B| is larger than |A| and has more limbs (so the
    function should return MBEDTLS_ERR_MPI_NEGATIVE_VALUE). Only
    applications calling mbedtls_mpi_sub_abs() directly are affected:
    all calls inside the library were safe since this function is
    only called with |A| >= |B|. Reported by Guido Vranken in #4042.
    Fix an errorneous estimation for an internal buffer in
    mbedtls_pk_write_key_pem(). If MBEDTLS_MPI_MAX_SIZE is set to an odd
    value the function might fail to write a private RSA keys of the largest
    supported size.
    Found by Daniel Otte, reported in #4093 and fixed in #4094.
    Fix a stack buffer overflow with mbedtls_net_poll() and
    mbedtls_net_recv_timeout() when given a file descriptor that is
    beyond FD_SETSIZE. Reported by FigBug in #4169.
    Guard against strong local side channel attack against base64 tables by
    making access aceess to them use constant flow code.

Bugfix

    Fix use-after-scope error in programs/ssl/ssl_client2.c and ssl_server2.c
    Fix memory leak that occured when calling psa_close_key() on a
    wrapped key with MBEDTLS_PSA_CRYPTO_SE_C defined.
    Fix an incorrect error code if an RSA private operation glitched.
    Fix a memory leak in an error case in psa_generate_derived_key_internal().
    Fix a resource leak in CTR_DRBG and HMAC_DRBG when MBEDTLS_THREADING_C
    is enabled, on platforms where initializing a mutex allocates resources.
    This was a regression introduced in the previous release. Reported in
    #4017, #4045 and #4071.
    Ensure that calling mbedtls_rsa_free() or mbedtls_entropy_free()
    twice is safe. This happens for RSA when some Mbed TLS library functions
    fail. Such a double-free was not safe when MBEDTLS_THREADING_C was
    enabled on platforms where freeing a mutex twice is not safe.
    Fix a resource leak in a bad-arguments case of mbedtls_rsa_gen_key()
    when MBEDTLS_THREADING_C is enabled on platforms where initializing
    a mutex allocates resources.
    Fixes a bug where, if the library was configured to include support for
    both the old SE interface and the new PSA driver interface, external keys were
    not loaded from storage. This was fixed by #3996.
    This change makes 'mbedtls_x509write_crt_set_basic_constraints'
    consistent with RFC 5280 4.2.1.9 which says: "Conforming CAs MUST
    include this extension in all CA certificates that contain public keys
    used to validate digital signatures on certificates and MUST mark the
    extension as critical in such certificates." Previous to this change,
    the extension was always marked as non-critical. This was fixed by
    #3698.

Changes

    A new library C file psa_crypto_client.c has been created to contain
    the PSA code needed by a PSA crypto client when the PSA crypto
    implementation is not included into the library.
    On recent enough versions of FreeBSD and DragonFlyBSD, the entropy module
    now uses the getrandom syscall instead of reading from /dev/urandom.

Who should update

We recommend all users should update to take advantage of the bug fixes \ 
contained in this release at an appropriate point in their development \ 
lifecycle.