From nobody Thu Apr 30 15:16:48 2026 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g5ySd1v9xz6c69T for ; Thu, 30 Apr 2026 15:16:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g5ySc5nn7z45Xr for ; Thu, 30 Apr 2026 15:16:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777562208; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MYdcTdBe2cS+ssRQJBoW+oP7pLuYV/3NodA4q085PxA=; b=UYtovP3gDf4y8tU4a56NzR+1MMtgiVhHXymmwc8c7NqMBbaV4EyoWkIavzH5JsEczC9GjC bG8j0xgSkXDGJTXh1x78c+UVh1XRfyNgTX5NW4X4aUvdEPKFnjAdEKUlBwdMVcoCSulqsH Xs97lSrkk3s2cwcg0m3/2CG8tru6Pp+quJpFSQadKNTWBxFdw0Zrx35ED5/ytk8258lSfe kIJbtn5cg7DrBu1xf+Zzdre4rWXPuXd3J3YuFA/Hpsv2F3F7Ku8DECveix42vfUZI5dlMm TtX1lZzFuDJf1bVyhCK53/KcoEV+CjjdrcH48m4kViWQ9AfoE2XlPxdxkFqi+Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1777562208; a=rsa-sha256; cv=none; b=Fog9lbqHUEdz9TprahlMe510JbFxkvMLL9kmk9e6Bt+ESscahgSena1+1p6YcSOmMOd3L9 2c8v403V9iCFSctohyha9G9VkM2TwTpFPQVWf7ZmVg7GIV4Lg/VYxYxV5clQNvQ14wieRl tNwrKabMI60E7W9/khSbcWFqtJOpkaspbZc8DIYDDsv0QuAhptpOy8jPzEXoK8zArNlqqs cfVXQRJVv85by3oXKaQ0pWSi4fPzWZXLDRCnV5e5sRiihEVv4mXup75frpHCP5xxRMV6Gx /+lioexPOmSeLKF1T0BuRglDWTH++TKNlaC+IIVqDaz+hgO7Jhzdy3zBfRDghQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777562208; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MYdcTdBe2cS+ssRQJBoW+oP7pLuYV/3NodA4q085PxA=; b=e3ITZ7AR1mlDdlhJQnwiruvIX0OMpiqK4S34J4PD5O9Fexig8iUIapzaoaoFIfIWgYgsAD FiqX2/iCiWdQuMWtQTggKfusOhmcRaqtID4PlQwgTTMw94qlDXqw1k6v1luuQuRMNgo/Qp yyTkLBCnM6idWzYXFT1xEuiMRuqh3R7+V0yG9mgb3aIHkTLnn4aXPYZBzTwIVFth6juowN PHB7qVYWVPkjh9UakE+UBbHu9Jn3AGV8Iqx6stpdYkc2JEkPrt2+PZ6z1toB4eRX/zQ1OF 9q0s4p4BsAgG9rIVg7LoqqZoAtxuhCv48tnHec2SswCe4b6EOa5Ds1oDpjSh3Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4g5ySc4nN5z2GD for ; Thu, 30 Apr 2026 15:16:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 18140 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 30 Apr 2026 15:16:48 +0000 To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Cc: Fabian Keil From: Vladimir Druzenko Subject: git: 12d2ebc10b68 - main - security/mbedtls4: Apply upstream fix for a TLS 1.2 client regression List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-main@freebsd.org Sender: owner-dev-commits-ports-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: vvd X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 12d2ebc10b688232d9e0928c180512d30d445414 Auto-Submitted: auto-generated Date: Thu, 30 Apr 2026 15:16:48 +0000 Message-Id: <69f37260.18140.16d84000@gitrepo.freebsd.org> The branch main has been updated by vvd: URL: https://cgit.FreeBSD.org/ports/commit/?id=12d2ebc10b688232d9e0928c180512d30d445414 commit 12d2ebc10b688232d9e0928c180512d30d445414 Author: Fabian Keil AuthorDate: 2026-04-30 15:13:39 +0000 Commit: Vladimir Druzenko CommitDate: 2026-04-30 15:13:39 +0000 security/mbedtls4: Apply upstream fix for a TLS 1.2 client regression TLS 1.2 client regression that caused valid ServerKeyExchange signatures using rsa_pss_rsae_* to be rejected: https://github.com/Mbed-TLS/mbedtls/issues/10668 https://github.com/Mbed-TLS/mbedtls/commit/5fc28f401666f3ab3338168f6dcee71e6b468a4e While at it, add a DEBUG option that was useful to figure out the problem. PR: 294776 Sponsored by: UNIS Labs Co-authored-by: Vladimir Druzenko MFH: 2026Q2 --- security/mbedtls4/Makefile | 14 ++++++++++++++ security/mbedtls4/distinfo | 4 +++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/security/mbedtls4/Makefile b/security/mbedtls4/Makefile index 0816fe7b7ee2..0a4b66e45444 100644 --- a/security/mbedtls4/Makefile +++ b/security/mbedtls4/Makefile @@ -1,9 +1,16 @@ PORTNAME= mbedtls DISTVERSION= 4.1.0 +PORTREVISION= 1 CATEGORIES= security devel MASTER_SITES= https://github.com/Mbed-TLS/${PORTNAME}/releases/download/${DISTNAME}/ PKGNAMESUFFIX= 4 +PATCH_SITES= https://github.com/Mbed-TLS/${PORTNAME}/commit/ +PATCHFILES= 5fc28f401666f3ab3338168f6dcee71e6b468a4e.patch:-p1 +# Fix a TLS 1.2 client regression that caused valid ServerKeyExchange +# signatures using rsa_pss_rsae_* to be rejected. +# https://github.com/Mbed-TLS/mbedtls/issues/10668 + MAINTAINER= pkaipila@gmail.com COMMENT= Embedded SSL/TLS and cryptography library WWW= https://www.trustedfirmware.org/projects/mbed-tls/ @@ -31,15 +38,22 @@ PORTSCOUT= limit:^${DISTVERSION:R:S/./\./g}\. PLIST_SUB= DISTVERSION=${DISTVERSION} +OPTIONS_DEFINE= DEBUG + pre-configure: @${WRKSRC}/scripts/config.py set MBEDTLS_SSL_DTLS_SRTP @${WRKSRC}/scripts/config.py set MBEDTLS_THREADING_C @${WRKSRC}/scripts/config.py set MBEDTLS_THREADING_PTHREAD +pre-configure-DEBUG-on: + @${WRKSRC}/scripts/config.py set MBEDTLS_DEBUG_C + post-install: @cd ${STAGEDIR}${PREFIX}/bin && for f in *; do \ ${MV} "$$f" "mbedtls_$$f"; \ done + +post-install-DEBUG-off: @${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/libmbedcrypto.so .include diff --git a/security/mbedtls4/distinfo b/security/mbedtls4/distinfo index d3de5725a39f..badd48273317 100644 --- a/security/mbedtls4/distinfo +++ b/security/mbedtls4/distinfo @@ -1,3 +1,5 @@ -TIMESTAMP = 1775565640 +TIMESTAMP = 1777117771 SHA256 (mbedtls-4.1.0.tar.bz2) = 377a09cf8eb81b5fb2707045e5522d5489d3309fed5006c9874e60558fc81d10 SIZE (mbedtls-4.1.0.tar.bz2) = 7009629 +SHA256 (5fc28f401666f3ab3338168f6dcee71e6b468a4e.patch) = 1d2522273d11d420a55e8a86b8df0b4482be61e6ec42f8c8e029acba727bc4c0 +SIZE (5fc28f401666f3ab3338168f6dcee71e6b468a4e.patch) = 8585