commit a769e6d
Michael Forney
·
2026-10-27 18:56:32 +0000 UTC
parent 61ffba0
openbsd: Update to 8.0
14 files changed,
+223,
-168
1@@ -1,4 +1,4 @@
2-From d36036bbd959091b6442d003128342ed515af01b Mon Sep 17 00:00:00 2001
3+From f45a3941114454bf560fdd45a1e5990c8e1c5c32 Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Sun, 26 Feb 2017 17:01:33 -0800
6 Subject: [PATCH] readpassphrase: Support systems without VSTATUS and TCSASOFT
7@@ -8,7 +8,7 @@ Subject: [PATCH] readpassphrase: Support systems without VSTATUS and TCSASOFT
8 1 file changed, 6 insertions(+)
9
10 diff --git a/lib/libc/gen/readpassphrase.c b/lib/libc/gen/readpassphrase.c
11-index a1aeb342b..a50eaf003 100644
12+index 51b407efd57..01bff7d306c 100644
13 --- a/lib/libc/gen/readpassphrase.c
14 +++ b/lib/libc/gen/readpassphrase.c
15 @@ -32,6 +32,10 @@
16@@ -22,7 +22,7 @@ index a1aeb342b..a50eaf003 100644
17 static volatile sig_atomic_t signo[_NSIG];
18
19 static void handler(int);
20-@@ -81,8 +85,10 @@ restart:
21+@@ -96,8 +100,10 @@ restart:
22 memcpy(&term, &oterm, sizeof(term));
23 if (!(flags & RPP_ECHO_ON))
24 term.c_lflag &= ~(ECHO | ECHONL);
25@@ -34,5 +34,5 @@ index a1aeb342b..a50eaf003 100644
26 } else {
27 memset(&term, 0, sizeof(term));
28 --
29-2.12.2
30+2.54.0
31
1@@ -1,4 +1,4 @@
2-From e76fda424564544bc8298fb5be7cda966451497d Mon Sep 17 00:00:00 2001
3+From c5f80115a04b3714b73e1f4dc1359b8e51ae8aa0 Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Sun, 26 Feb 2017 17:12:56 -0800
6 Subject: [PATCH] Remove getpass definition
7@@ -9,10 +9,10 @@ It is a legacy function and musl already provides an implementation.
8 1 file changed, 2 insertions(+), 10 deletions(-)
9
10 diff --git a/lib/libc/gen/readpassphrase.c b/lib/libc/gen/readpassphrase.c
11-index a50eaf003..57c6dc527 100644
12+index 01bff7d306c..f9d91263bc8 100644
13 --- a/lib/libc/gen/readpassphrase.c
14 +++ b/lib/libc/gen/readpassphrase.c
15-@@ -183,16 +183,8 @@ restart:
16+@@ -198,16 +198,8 @@ restart:
17 }
18 DEF_WEAK(readpassphrase);
19
20@@ -32,5 +32,5 @@ index a50eaf003..57c6dc527 100644
21 signo[s] = 1;
22 }
23 --
24-2.12.2
25+2.54.0
26
1@@ -1,4 +1,4 @@
2-From cca6c84b472255c4d015d7d97225791796f61392 Mon Sep 17 00:00:00 2001
3+From ce3fbebc0e4fba14f5af877b8c0bdd91bf9e5d4b Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Sun, 26 Feb 2017 16:50:55 -0800
6 Subject: [PATCH] doas: Port to linux/musl
7@@ -11,8 +11,6 @@ persist.
8
9 Use initgroups/setgid/setuid instead of setusercontext.
10
11-Provide UID_MAX and GID_MAX defaults.
12-
13 Use LOGIN_NAME_MAX instead of _PW_NAME_LEN.
14
15 Remove call to closefrom.
16@@ -27,12 +25,12 @@ Simplify handling of PATH in the environment since we don't have
17 login.conf with per-user default PATH.
18 ---
19 usr.bin/doas/doas.1 | 9 ---
20- usr.bin/doas/doas.c | 168 +++++++++++++----------------------------
21+ usr.bin/doas/doas.c | 160 ++++++++++++-----------------------------
22 usr.bin/doas/doas.h | 6 +-
23 usr.bin/doas/env.c | 17 ++---
24 usr.bin/doas/parse.y | 1 +
25- usr.bin/doas/persist.c | 133 ++++++++++++++++++++++++++++++++
26- 6 files changed, 198 insertions(+), 136 deletions(-)
27+ usr.bin/doas/persist.c | 133 ++++++++++++++++++++++++++++++++++
28+ 6 files changed, 190 insertions(+), 136 deletions(-)
29 create mode 100644 usr.bin/doas/persist.c
30
31 diff --git a/usr.bin/doas/doas.1 b/usr.bin/doas/doas.1
32@@ -63,7 +61,7 @@ index 25827cc7104..3542680faf5 100644
33 Parse and check the configuration file
34 .Ar config ,
35 diff --git a/usr.bin/doas/doas.c b/usr.bin/doas/doas.c
36-index 3999b2e2f64..32532359267 100644
37+index cb4a8616a92..f6c184338fa 100644
38 --- a/usr.bin/doas/doas.c
39 +++ b/usr.bin/doas/doas.c
40 @@ -20,8 +20,6 @@
41@@ -75,7 +73,7 @@ index 3999b2e2f64..32532359267 100644
42 #include <readpassphrase.h>
43 #include <string.h>
44 #include <stdio.h>
45-@@ -33,13 +31,22 @@
46+@@ -33,13 +31,14 @@
47 #include <syslog.h>
48 #include <errno.h>
49 #include <fcntl.h>
50@@ -83,14 +81,6 @@ index 3999b2e2f64..32532359267 100644
51
52 #include "doas.h"
53
54-+#ifndef UID_MAX
55-+#define UID_MAX 65535
56-+#endif
57-+
58-+#ifndef GID_MAX
59-+#define GID_MAX 65535
60-+#endif
61-+
62 static void __dead
63 usage(void)
64 {
65@@ -99,7 +89,7 @@ index 3999b2e2f64..32532359267 100644
66 " command [arg ...]\n");
67 exit(1);
68 }
69-@@ -203,16 +210,28 @@ checkconfig(const char *confpath, int argc, char **argv,
70+@@ -203,16 +202,28 @@ checkconfig(const char *confpath, int argc, char **argv,
71 }
72
73 static int
74@@ -135,7 +125,7 @@ index 3999b2e2f64..32532359267 100644
75 if (!challenge) {
76 char host[HOST_NAME_MAX + 1];
77
78-@@ -225,14 +244,12 @@ authuser_checkpass(char *myname, char *login_style)
79+@@ -225,14 +236,12 @@ authuser_checkpass(char *myname, char *login_style)
80 response = readpassphrase(challenge, rbuf, sizeof(rbuf),
81 RPP_REQUIRE_TTY);
82 if (response == NULL && errno == ENOTTY) {
83@@ -153,7 +143,7 @@ index 3999b2e2f64..32532359267 100644
84 warnx("Authentication failed");
85 return AUTH_FAILED;
86 }
87-@@ -241,79 +258,36 @@ authuser_checkpass(char *myname, char *login_style)
88+@@ -241,79 +250,36 @@ authuser_checkpass(char *myname, char *login_style)
89 }
90
91 static void
92@@ -241,7 +231,7 @@ index 3999b2e2f64..32532359267 100644
93 struct passwd mypwstore, targpwstore;
94 struct passwd *mypw, *targpw;
95 const struct rule *rule;
96-@@ -326,28 +300,20 @@ main(int argc, char **argv)
97+@@ -326,28 +292,20 @@ main(int argc, char **argv)
98 int nflag = 0;
99 char cwdpath[PATH_MAX];
100 const char *cwd;
101@@ -273,7 +263,7 @@ index 3999b2e2f64..32532359267 100644
102 case 'u':
103 if (parseuid(optarg, &target) != 0)
104 errx(1, "unknown user");
105-@@ -418,50 +384,30 @@ main(int argc, char **argv)
106+@@ -418,50 +376,30 @@ main(int argc, char **argv)
107 rv = permit(uid, groups, ngroups, &rule, target, cmd,
108 (const char **)argv + 1);
109 if (rv != 0) {
110@@ -334,7 +324,7 @@ index 3999b2e2f64..32532359267 100644
111
112 if (pledge("stdio rpath exec", NULL) == -1)
113 err(1, "pledge");
114-@@ -475,23 +421,17 @@ main(int argc, char **argv)
115+@@ -475,23 +413,17 @@ main(int argc, char **argv)
116 err(1, "pledge");
117
118 if (!(rule->options & NOLOG)) {
119@@ -577,5 +567,5 @@ index 00000000000..4ad1bf1efbf
120 + return 0;
121 +}
122 --
123-2.49.0
124+2.54.0
125
1@@ -1,4 +1,4 @@
2-From 0f55823084233ab6980c6c1beb9a2fedadc7a5ee Mon Sep 17 00:00:00 2001
3+From d29604bf36c2364b8d0a752e6753a345f2e431af Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Fri, 23 Apr 2021 20:10:05 -0700
6 Subject: [PATCH] acme-client: Fix signed-ness of base64buf_url input
7@@ -13,10 +13,10 @@ This make most of the pointer casts unnecessary.
8 5 files changed, 17 insertions(+), 14 deletions(-)
9
10 diff --git a/usr.sbin/acme-client/acctproc.c b/usr.sbin/acme-client/acctproc.c
11-index da3d49107ae..9e97a8bb760 100644
12+index f98826ab698..7a0b9811990 100644
13 --- a/usr.sbin/acme-client/acctproc.c
14 +++ b/usr.sbin/acme-client/acctproc.c
15-@@ -42,8 +42,9 @@
16+@@ -43,8 +43,9 @@
17 static char *
18 bn2string(const BIGNUM *bn)
19 {
20@@ -28,7 +28,7 @@ index da3d49107ae..9e97a8bb760 100644
21
22 /* Extract big-endian representation of BIGNUM. */
23
24-@@ -51,7 +52,7 @@ bn2string(const BIGNUM *bn)
25+@@ -52,7 +53,7 @@ bn2string(const BIGNUM *bn)
26 if ((buf = malloc(len)) == NULL) {
27 warn("malloc");
28 return NULL;
29@@ -37,7 +37,7 @@ index da3d49107ae..9e97a8bb760 100644
30 warnx("BN_bn2bin");
31 free(buf);
32 return NULL;
33-@@ -167,7 +168,7 @@ op_thumbprint(int fd, EVP_PKEY *pkey)
34+@@ -168,7 +169,7 @@ op_thumbprint(int fd, EVP_PKEY *pkey)
35 warnx("EVP_Digest");
36 goto out;
37 }
38@@ -46,7 +46,7 @@ index da3d49107ae..9e97a8bb760 100644
39 warnx("base64buf_url");
40 goto out;
41 }
42-@@ -281,7 +282,7 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
43+@@ -278,7 +279,7 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
44
45 /* Base64-encode the payload. */
46
47@@ -55,7 +55,7 @@ index da3d49107ae..9e97a8bb760 100644
48 warnx("base64buf_url");
49 goto out;
50 }
51-@@ -324,7 +325,7 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
52+@@ -325,7 +326,7 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
53
54 /* The header combined with the nonce, base64. */
55
56@@ -64,7 +64,7 @@ index da3d49107ae..9e97a8bb760 100644
57 warnx("base64buf_url");
58 goto out;
59 }
60-@@ -363,7 +364,7 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
61+@@ -364,7 +365,7 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
62
63 switch (EVP_PKEY_base_id(pkey)) {
64 case EVP_PKEY_RSA:
65@@ -73,7 +73,7 @@ index da3d49107ae..9e97a8bb760 100644
66 warnx("base64buf_url");
67 goto out;
68 }
69-@@ -402,7 +403,7 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
70+@@ -403,7 +404,7 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
71 goto out;
72 }
73
74@@ -83,10 +83,10 @@ index da3d49107ae..9e97a8bb760 100644
75 goto out;
76 }
77 diff --git a/usr.sbin/acme-client/base64.c b/usr.sbin/acme-client/base64.c
78-index 2b6377f0d81..0d84ad4b458 100644
79+index a665143e74f..b3ea459abac 100644
80 --- a/usr.sbin/acme-client/base64.c
81 +++ b/usr.sbin/acme-client/base64.c
82-@@ -39,7 +39,7 @@ base64len(size_t len)
83+@@ -40,7 +40,7 @@ base64len(size_t len)
84 * Returns NULL on allocation failure (not logged).
85 */
86 char *
87@@ -96,18 +96,18 @@ index 2b6377f0d81..0d84ad4b458 100644
88 size_t i, sz;
89 char *buf;
90 diff --git a/usr.sbin/acme-client/extern.h b/usr.sbin/acme-client/extern.h
91-index 8b500561744..990c784f706 100644
92+index 352e90a77db..b1d697412ed 100644
93 --- a/usr.sbin/acme-client/extern.h
94 +++ b/usr.sbin/acme-client/extern.h
95-@@ -241,7 +241,7 @@ int checkexit_ext(int *, pid_t, enum comp);
96+@@ -243,7 +243,7 @@ int checkexit_ext(int *, pid_t, enum comp);
97 * Returns a buffer or NULL on allocation error.
98 */
99 size_t base64len(size_t);
100 -char *base64buf_url(const char *, size_t);
101 +char *base64buf_url(const unsigned char *, size_t);
102+ int unbase64buf_url(const unsigned char *, unsigned char **);
103
104 /*
105- * JSON parsing routines.
106 diff --git a/usr.sbin/acme-client/keyproc.c b/usr.sbin/acme-client/keyproc.c
107 index bab74c2b385..4360156b9c0 100644
108 --- a/usr.sbin/acme-client/keyproc.c
109@@ -132,10 +132,10 @@ index bab74c2b385..4360156b9c0 100644
110 goto out;
111 } else if ((der64 = base64buf_url(der, len)) == NULL) {
112 diff --git a/usr.sbin/acme-client/revokeproc.c b/usr.sbin/acme-client/revokeproc.c
113-index 6fe34043129..c0963a278fb 100644
114+index b001c96cb3a..081a68786f2 100644
115 --- a/usr.sbin/acme-client/revokeproc.c
116 +++ b/usr.sbin/acme-client/revokeproc.c
117-@@ -79,7 +79,8 @@ revokeproc(int fd, const char *certfile, int force,
118+@@ -87,7 +87,8 @@ revokeproc(int fd, const char *certfile, int force,
119 int revocate, struct domain_c *domain)
120 {
121 GENERAL_NAMES *sans = NULL;
122@@ -145,7 +145,7 @@ index 6fe34043129..c0963a278fb 100644
123 int rc = 0, cc, sanidx, len, j, k;
124 int *found_altnames = NULL;
125 FILE *f = NULL;
126-@@ -320,7 +321,7 @@ revokeproc(int fd, const char *certfile, int force,
127+@@ -328,7 +329,7 @@ revokeproc(int fd, const char *certfile, int force,
128 } else if ((der = dercp = malloc(len)) == NULL) {
129 warn("malloc");
130 goto out;
1@@ -1,22 +1,22 @@
2-From 4ad4ffcb7c731ae48c97b93760d7625724a991bc Mon Sep 17 00:00:00 2001
3+From 1c035ffeee5beaaef9907f7b1a17c64e384085b5 Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Fri, 23 Apr 2021 23:14:16 -0700
6 Subject: [PATCH] acme-client: Port to BearSSL
7
8 ---
9- usr.sbin/acme-client/acctproc.c | 298 +++++++++------------------
10+ usr.sbin/acme-client/acctproc.c | 322 ++++++++++-------------------
11 usr.sbin/acme-client/certproc.c | 5 -
12 usr.sbin/acme-client/key.c | 329 ++++++++++++++++++++++++------
13 usr.sbin/acme-client/key.h | 22 +-
14 usr.sbin/acme-client/keyproc.c | 192 ++++++-----------
15- usr.sbin/acme-client/revokeproc.c | 319 +++++++++++------------------
16- 6 files changed, 568 insertions(+), 597 deletions(-)
17+ usr.sbin/acme-client/revokeproc.c | 327 +++++++++++------------------
18+ 6 files changed, 580 insertions(+), 617 deletions(-)
19
20 diff --git a/usr.sbin/acme-client/acctproc.c b/usr.sbin/acme-client/acctproc.c
21-index 9e97a8bb760..8d66dac49d9 100644
22+index 7a0b9811990..adbe6e8c2ab 100644
23 --- a/usr.sbin/acme-client/acctproc.c
24 +++ b/usr.sbin/acme-client/acctproc.c
25-@@ -19,73 +19,29 @@
26+@@ -19,74 +19,29 @@
27
28 #include <err.h>
29 #include <errno.h>
30@@ -29,6 +29,7 @@ index 9e97a8bb760..8d66dac49d9 100644
31 -#include <openssl/bn.h>
32 -#include <openssl/ec.h>
33 -#include <openssl/evp.h>
34+-#include <openssl/hmac.h>
35 -#include <openssl/rsa.h>
36 -#include <openssl/err.h>
37 +#include <bearssl.h>
38@@ -97,7 +98,7 @@ index 9e97a8bb760..8d66dac49d9 100644
39 else if ((json = json_fmt_thumb_rsa(exp, mod)) == NULL)
40 warnx("json_fmt_thumb_rsa");
41
42-@@ -99,31 +55,23 @@ op_thumb_rsa(EVP_PKEY *pkey)
43+@@ -100,31 +55,23 @@ op_thumb_rsa(EVP_PKEY *pkey)
44 * thumbprint from them.
45 */
46 static char *
47@@ -139,7 +140,7 @@ index 9e97a8bb760..8d66dac49d9 100644
48 free(x);
49 free(y);
50 return json;
51-@@ -133,26 +81,26 @@ op_thumb_ec(EVP_PKEY *pkey)
52+@@ -134,26 +81,26 @@ op_thumb_ec(EVP_PKEY *pkey)
53 * The thumbprint operation is used for the challenge sequence.
54 */
55 static int
56@@ -175,7 +176,7 @@ index 9e97a8bb760..8d66dac49d9 100644
57 goto out;
58 }
59
60-@@ -163,12 +111,10 @@ op_thumbprint(int fd, EVP_PKEY *pkey)
61+@@ -164,12 +111,10 @@ op_thumbprint(int fd, EVP_PKEY *pkey)
62 * it up in the read loop).
63 */
64
65@@ -192,22 +193,18 @@ index 9e97a8bb760..8d66dac49d9 100644
66 warnx("base64buf_url");
67 goto out;
68 }
69-@@ -183,11 +129,10 @@ out:
70+@@ -184,20 +129,17 @@ out:
71 }
72
73 static int
74--op_sign_rsa(char **prot, EVP_PKEY *pkey, const char *nonce, const char *url)
75-+op_sign_rsa(char **prot, struct key *key, const char *nonce, const char *url)
76+-op_sign_rsa(char **jwk, EVP_PKEY *pkey)
77++op_sign_rsa(char **jwk, struct key *key)
78 {
79 char *exp = NULL, *mod = NULL;
80 int rc = 0;
81 - RSA *r;
82
83- *prot = NULL;
84-
85-@@ -196,12 +141,10 @@ op_sign_rsa(char **prot, EVP_PKEY *pkey, const char *nonce, const char *url)
86- * Finally, format the header combined with the nonce.
87- */
88+ *jwk = NULL;
89
90 - if ((r = EVP_PKEY_get0_RSA(pkey)) == NULL)
91 - warnx("EVP_PKEY_get0_RSA");
92@@ -219,15 +216,15 @@ index 9e97a8bb760..8d66dac49d9 100644
93 + warnx("base64buf_url");
94 + else if ((exp = base64buf_url(key->rsa.pk.e, key->rsa.pk.elen)) == NULL)
95 + warnx("base64buf_url");
96- else if ((*prot = json_fmt_protected_rsa(exp, mod, nonce, url)) == NULL)
97- warnx("json_fmt_protected_rsa");
98+ else if ((*jwk = json_fmt_jwk_rsa(exp, mod)) == NULL)
99+ warnx("json_fmt_jwk_rsa");
100 else
101-@@ -213,35 +156,27 @@ op_sign_rsa(char **prot, EVP_PKEY *pkey, const char *nonce, const char *url)
102+@@ -209,35 +151,27 @@ op_sign_rsa(char **jwk, EVP_PKEY *pkey)
103 }
104
105 static int
106--op_sign_ec(char **prot, EVP_PKEY *pkey, const char *nonce, const char *url)
107-+op_sign_ec(char **prot, struct key *key, const char *nonce, const char *url)
108+-op_sign_ec(char **jwk, EVP_PKEY *pkey)
109++op_sign_ec(char **jwk, struct key *key)
110 {
111 - BIGNUM *X = NULL, *Y = NULL;
112 - EC_KEY *ec = NULL;
113@@ -235,7 +232,7 @@ index 9e97a8bb760..8d66dac49d9 100644
114 char *x = NULL, *y = NULL;
115 int rc = 0;
116
117- *prot = NULL;
118+ *jwk = NULL;
119
120 - if ((ec = EVP_PKEY_get0_EC_KEY(pkey)) == NULL)
121 - warnx("EVP_PKEY_get0_EC_KEY");
122@@ -258,8 +255,8 @@ index 9e97a8bb760..8d66dac49d9 100644
123 + warnx("base64buf_url");
124 + else if ((y = base64buf_url(key->ec.pk.q + 1 + len, len)) == NULL)
125 + warnx("base64buf_url");
126- else if ((*prot = json_fmt_protected_ec(x, y, nonce, url)) == NULL)
127- warnx("json_fmt_protected_ec");
128+ else if ((*jwk = json_fmt_jwk_ec(x, y)) == NULL)
129+ warnx("json_fmt_jwk_ec");
130 else
131 rc = 1;
132
133@@ -268,7 +265,7 @@ index 9e97a8bb760..8d66dac49d9 100644
134 free(x);
135 free(y);
136 return rc;
137-@@ -252,20 +187,18 @@ op_sign_ec(char **prot, EVP_PKEY *pkey, const char *nonce, const char *url)
138+@@ -248,21 +182,19 @@ op_sign_ec(char **jwk, EVP_PKEY *pkey)
139 * This requires the sender ("fd") to provide the payload and a nonce.
140 */
141 static int
142@@ -288,6 +285,7 @@ index 9e97a8bb760..8d66dac49d9 100644
143 - char *sign = NULL, *dig64 = NULL, *fin = NULL;
144 + char *sign = NULL, *sig64 = NULL, *fin = NULL;
145 char *url = NULL, *kid = NULL, *alg = NULL;
146+ char *jwk = NULL;
147 - const unsigned char *digp;
148 - unsigned char *dig = NULL, *buf = NULL;
149 - size_t digsz;
150@@ -297,7 +295,7 @@ index 9e97a8bb760..8d66dac49d9 100644
151
152 /* Read our payload and nonce from the requestor. */
153
154-@@ -282,19 +215,22 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
155+@@ -279,19 +211,22 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
156
157 /* Base64-encode the payload. */
158
159@@ -326,22 +324,22 @@ index 9e97a8bb760..8d66dac49d9 100644
160 break;
161 default:
162 warnx("unknown account key type");
163-@@ -308,17 +244,17 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
164+@@ -305,17 +240,17 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
165 goto out;
166 }
167 } else {
168 - switch (EVP_PKEY_base_id(pkey)) {
169 - case EVP_PKEY_RSA:
170-- if (!op_sign_rsa(&prot, pkey, nonce, url))
171+- if (!op_sign_rsa(&jwk, pkey))
172 + switch (key->type) {
173 + case BR_KEYTYPE_RSA:
174-+ if (!op_sign_rsa(&prot, key, nonce, url))
175++ if (!op_sign_rsa(&jwk, key))
176 goto out;
177 break;
178 - case EVP_PKEY_EC:
179-- if (!op_sign_ec(&prot, pkey, nonce, url))
180+- if (!op_sign_ec(&jwk, pkey))
181 + case BR_KEYTYPE_EC:
182-+ if (!op_sign_ec(&prot, key, nonce, url))
183++ if (!op_sign_ec(&jwk, key))
184 goto out;
185 break;
186 default:
187@@ -349,8 +347,8 @@ index 9e97a8bb760..8d66dac49d9 100644
188 + warnx("unknown key type");
189 goto out;
190 }
191- }
192-@@ -341,76 +277,34 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
193+
194+@@ -342,76 +277,34 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
195
196 /* Sign the message. */
197
198@@ -402,13 +400,8 @@ index 9e97a8bb760..8d66dac49d9 100644
199 - digp = dig;
200 - if ((ec_sig = d2i_ECDSA_SIG(NULL, &digp, digsz)) == NULL) {
201 - warnx("d2i_ECDSA_SIG");
202-+ case BR_KEYTYPE_EC:
203-+ sigsz = br_ecdsa_sign_raw_get_default()(br_ec_get_default(),
204-+ ctx.vtable, dig, &key->ec.sk, sig);
205-+ if (sigsz == 0 || sigsz % 2 != 0) {
206-+ warnx("br_ecdsa_sign_raw");
207- goto out;
208- }
209+- goto out;
210+- }
211 -
212 - if ((ec_sig_r = ECDSA_SIG_get0_r(ec_sig)) == NULL ||
213 - (ec_sig_s = ECDSA_SIG_get0_s(ec_sig)) == NULL) {
214@@ -423,8 +416,13 @@ index 9e97a8bb760..8d66dac49d9 100644
215 -
216 - if ((buf = calloc(2, bn_len)) == NULL) {
217 - warnx("calloc");
218-- goto out;
219-- }
220++ case BR_KEYTYPE_EC:
221++ sigsz = br_ecdsa_sign_raw_get_default()(br_ec_get_default(),
222++ ctx.vtable, dig, &key->ec.sk, sig);
223++ if (sigsz == 0 || sigsz % 2 != 0) {
224++ warnx("br_ecdsa_sign_raw");
225+ goto out;
226+ }
227 -
228 - if (BN_bn2binpad(ec_sig_r, buf, bn_len) != bn_len ||
229 - BN_bn2binpad(ec_sig_s, buf + bn_len, bn_len) != bn_len) {
230@@ -444,7 +442,7 @@ index 9e97a8bb760..8d66dac49d9 100644
231 goto out;
232 }
233
234-@@ -420,7 +314,11 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
235+@@ -421,7 +314,11 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
236 * when we next enter the read loop).
237 */
238
239@@ -457,7 +455,7 @@ index 9e97a8bb760..8d66dac49d9 100644
240 warnx("json_fmt_signed");
241 goto out;
242 } else if (writestr(fd, COMM_REQ, fin) < 0)
243-@@ -428,8 +326,6 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
244+@@ -429,8 +326,6 @@ op_sign(int fd, EVP_PKEY *pkey, enum acctop op)
245
246 rc = 1;
247 out:
248@@ -466,7 +464,7 @@ index 9e97a8bb760..8d66dac49d9 100644
249 free(pay);
250 free(sign);
251 free(pay64);
252-@@ -438,10 +334,9 @@ out:
253+@@ -440,15 +335,14 @@ out:
254 free(kid);
255 free(prot);
256 free(prot64);
257@@ -479,8 +477,65 @@ index 9e97a8bb760..8d66dac49d9 100644
258 return rc;
259 }
260
261-@@ -449,7 +344,7 @@ int
262- acctproc(int netsock, const char *acctkey, enum keytype keytype)
263+ static int
264+-op_eab(int fd, EVP_PKEY *pkey, const char *eab_kid,
265++op_eab(int fd, struct key *pkey, const char *eab_kid,
266+ const unsigned char *eab_key, int eab_key_len)
267+ {
268+ char *url = NULL;
269+@@ -456,9 +350,11 @@ op_eab(int fd, EVP_PKEY *pkey, const char *eab_kid,
270+ char *jwk = NULL, *pay64 = NULL;
271+ char *sign = NULL;
272+ char *dig64 = NULL, *fin = NULL;
273+- unsigned char dig[EVP_MAX_MD_SIZE];
274++ unsigned char dig[64];
275+ unsigned int digsz;
276+ int sign_len, rc = 0;
277++ br_hmac_key_context kc;
278++ br_hmac_context hc;
279+
280+ if ((url = readstr(fd, COMM_URL)) == NULL)
281+ goto out;
282+@@ -475,17 +371,17 @@ op_eab(int fd, EVP_PKEY *pkey, const char *eab_kid,
283+ }
284+
285+ /* payload component: account public key */
286+- switch (EVP_PKEY_base_id(pkey)) {
287+- case EVP_PKEY_RSA:
288++ switch (pkey->type) {
289++ case BR_KEYTYPE_RSA:
290+ if (!op_sign_rsa(&jwk, pkey))
291+ goto out;
292+ break;
293+- case EVP_PKEY_EC:
294++ case BR_KEYTYPE_EC:
295+ if (!op_sign_ec(&jwk, pkey))
296+ goto out;
297+ break;
298+ default:
299+- warnx("EVP_PKEY_base_id");
300++ warnx("unknown key type");
301+ goto out;
302+ }
303+
304+@@ -502,11 +398,10 @@ op_eab(int fd, EVP_PKEY *pkey, const char *eab_kid,
305+ }
306+
307+ /* sign with the EAB key */
308+- if (HMAC(EVP_sha256(), eab_key, eab_key_len, sign, sign_len, dig,
309+- &digsz) == NULL) {
310+- warnx("HMAC");
311+- goto out;
312+- }
313++ br_hmac_key_init(&kc, &br_sha256_vtable, eab_key, eab_key_len);
314++ br_hmac_init(&hc, &kc, 0);
315++ br_hmac_update(&hc, sign, sign_len);
316++ digsz = br_hmac_out(&hc, dig);
317+
318+ if ((dig64 = base64buf_url((char *)dig, digsz)) == NULL) {
319+ warnx("base64buf_url");
320+@@ -539,7 +434,7 @@ acctproc(int netsock, const char *acctkey, enum keytype keytype,
321+ const char *eab_kid, const unsigned char *eab_key, int eab_key_len)
322 {
323 FILE *f = NULL;
324 - EVP_PKEY *pkey = NULL;
325@@ -488,7 +543,7 @@ index 9e97a8bb760..8d66dac49d9 100644
326 long lval;
327 enum acctop op;
328 int rc = 0, cc, newacct = 0;
329-@@ -475,8 +370,6 @@ acctproc(int netsock, const char *acctkey, enum keytype keytype)
330+@@ -565,8 +460,6 @@ acctproc(int netsock, const char *acctkey, enum keytype keytype,
331
332 /* File-system, user, and sandbox jailing. */
333
334@@ -497,7 +552,7 @@ index 9e97a8bb760..8d66dac49d9 100644
335 if (pledge("stdio", NULL) == -1) {
336 warn("pledge");
337 goto out;
338-@@ -554,8 +447,7 @@ out:
339+@@ -650,8 +543,7 @@ out:
340 close(netsock);
341 if (f != NULL)
342 fclose(f);
343@@ -1210,7 +1265,7 @@ index 4360156b9c0..19b8077a8fb 100644
344 return rc;
345 }
346 diff --git a/usr.sbin/acme-client/revokeproc.c b/usr.sbin/acme-client/revokeproc.c
347-index c0963a278fb..2109d7a8799 100644
348+index 081a68786f2..785d8aea346 100644
349 --- a/usr.sbin/acme-client/revokeproc.c
350 +++ b/usr.sbin/acme-client/revokeproc.c
351 @@ -15,8 +15,6 @@
352@@ -1222,7 +1277,7 @@ index c0963a278fb..2109d7a8799 100644
353 #include <assert.h>
354 #include <ctype.h>
355 #include <err.h>
356-@@ -24,71 +22,54 @@
357+@@ -24,79 +22,54 @@
358 #include <stdio.h>
359 #include <stdlib.h>
360 #include <string.h>
361@@ -1241,13 +1296,13 @@ index c0963a278fb..2109d7a8799 100644
362 -/*
363 - * Convert the X509's notAfter time into a time_t value.
364 - */
365--static time_t
366--X509notafter(X509 *x)
367+-static int
368+-X509notafter(const X509 *x, time_t *notafter)
369 -{
370-- ASN1_TIME *atim;
371+- const ASN1_TIME *atim;
372 - struct tm t;
373 -
374-- if ((atim = X509_getm_notAfter(x)) == NULL)
375+- if ((atim = X509_get0_notAfter(x)) == NULL)
376 - return -1;
377 -
378 - memset(&t, 0, sizeof(t));
379@@ -1255,21 +1310,25 @@ index c0963a278fb..2109d7a8799 100644
380 - if (!ASN1_TIME_to_tm(atim, &t))
381 - return -1;
382 -
383-- return timegm(&t);
384+- t.tm_wday = -1; /* sentinel for error */
385+- if ((*notafter = timegm(&t)) == -1 && t.tm_wday == -1)
386+- return -1;
387+-
388+- return 0;
389 -}
390 -
391 -/*
392 - * Convert the X509's notBefore time into a time_t value.
393 - */
394--static time_t
395--X509notbefore(X509 *x)
396+-static int
397+-X509notbefore(const X509 *x, time_t *notbefore)
398 +static void
399 +append_cert(void *ctx, const void *buf, size_t len)
400 {
401-- ASN1_TIME *atim;
402+- const ASN1_TIME *atim;
403 - struct tm t;
404 -
405-- if ((atim = X509_getm_notBefore(x)) == NULL)
406+- if ((atim = X509_get0_notBefore(x)) == NULL)
407 - return -1;
408 -
409 - memset(&t, 0, sizeof(t));
410@@ -1277,7 +1336,11 @@ index c0963a278fb..2109d7a8799 100644
411 - if (!ASN1_TIME_to_tm(atim, &t))
412 - return -1;
413 -
414-- return timegm(&t);
415+- t.tm_wday = -1; /* sentinel for error */
416+- if ((*notbefore = timegm(&t)) == -1 && t.tm_wday == -1)
417+- return -1;
418+-
419+- return 0;
420 + br_x509_certificate *cert = ctx;
421 + size_t newlen;
422 + unsigned char *newdata;
423@@ -1324,7 +1387,7 @@ index c0963a278fb..2109d7a8799 100644
424
425 /*
426 * First try to open the certificate before we drop privileges
427-@@ -103,8 +84,6 @@ revokeproc(int fd, const char *certfile, int force,
428+@@ -111,8 +84,6 @@ revokeproc(int fd, const char *certfile, int force,
429
430 /* File-system and sandbox jailing. */
431
432@@ -1333,7 +1396,7 @@ index c0963a278fb..2109d7a8799 100644
433 if (pledge("stdio", NULL) == -1) {
434 warn("pledge");
435 goto out;
436-@@ -128,45 +107,89 @@ revokeproc(int fd, const char *certfile, int force,
437+@@ -136,45 +107,89 @@ revokeproc(int fd, const char *certfile, int force,
438 goto out;
439 }
440
441@@ -1386,7 +1449,7 @@ index c0963a278fb..2109d7a8799 100644
442
443 /* Read out the expiration date. */
444
445-- if ((notafter = X509notafter(x)) == -1) {
446+- if (X509notafter(x, ¬after) == -1) {
447 - warnx("X509notafter");
448 + br_x509_decoder_init(&xd, NULL, NULL);
449 + br_x509_decoder_push(&xd, cert.data, cert.data_len);
450@@ -1395,7 +1458,7 @@ index c0963a278fb..2109d7a8799 100644
451 goto out;
452 }
453 -
454-- if ((notbefore = X509notbefore(x)) == -1) {
455+- if (X509notbefore(x, ¬before) == -1) {
456 - warnx("X509notbefore");
457 + br_x509_decoder_get_notafter(&xd, &days, &secs);
458 + notafter = 86400ll * (days - 719528) + 86400;
459@@ -1450,7 +1513,7 @@ index c0963a278fb..2109d7a8799 100644
460 goto out;
461 }
462
463-@@ -175,121 +198,37 @@ revokeproc(int fd, const char *certfile, int force,
464+@@ -183,121 +198,37 @@ revokeproc(int fd, const char *certfile, int force,
465 * configuration file and that all domains are represented only once.
466 */
467
468@@ -1481,13 +1544,8 @@ index c0963a278fb..2109d7a8799 100644
469 - break;
470 - default:
471 - ip = NULL;
472-+ TAILQ_FOREACH(ac, &domain->altname_list, entry) {
473-+ for (i = 0; i < eltsz; i++) {
474-+ if (elts[i].status == 1 &&
475-+ strcmp(ac->domain, elts[i].buf) == 0) {
476-+ elts[i].status = 0;
477- break;
478- }
479+- break;
480+- }
481 - if (ip == NULL) {
482 - warnx("invalid IP address");
483 - continue;
484@@ -1504,14 +1562,19 @@ index c0963a278fb..2109d7a8799 100644
485 - if (name_len == -1) {
486 - warn("asprintf");
487 - continue;
488- }
489+- }
490 -
491 - j = 0;
492 - TAILQ_FOREACH(ac, &domain->altname_list, entry) {
493 - if (strcmp(name_buf, ac->domain) == 0) {
494 - found_altnames[j]++;
495-- break;
496-- }
497++ TAILQ_FOREACH(ac, &domain->altname_list, entry) {
498++ for (i = 0; i < eltsz; i++) {
499++ if (elts[i].status == 1 &&
500++ strcmp(ac->domain, elts[i].buf) == 0) {
501++ elts[i].status = 0;
502+ break;
503+ }
504 - /* increment if didn't match */
505 - j++;
506 - }
507@@ -1536,7 +1599,7 @@ index c0963a278fb..2109d7a8799 100644
508 - }
509 - force = 2;
510 - continue;
511-- }
512+ }
513 - /* should not reach here if j is out of bounds */
514 - if (found_altnames[j] > 1) {
515 + if (i == eltsz) {
516@@ -1590,7 +1653,7 @@ index c0963a278fb..2109d7a8799 100644
517 goto out;
518 }
519 force = 2;
520-@@ -315,16 +254,7 @@ revokeproc(int fd, const char *certfile, int force,
521+@@ -323,16 +254,7 @@ revokeproc(int fd, const char *certfile, int force,
522 if (cc <= 0)
523 goto out;
524
525@@ -1608,7 +1671,7 @@ index c0963a278fb..2109d7a8799 100644
526 warnx("base64buf_url");
527 goto out;
528 } else if (writestr(fd, COMM_CSR, der64) >= 0)
529-@@ -398,12 +328,9 @@ out:
530+@@ -406,12 +328,9 @@ out:
531 close(fd);
532 if (f != NULL)
533 fclose(f);
R pkg/openbsd/patch/0041-Explicitly-cast-arguments-to-functions-expecting-cha.patch =>
pkg/openbsd/patch/0040-Explicitly-cast-arguments-to-functions-expecting-cha.patch
+5,
-5
1@@ -1,4 +1,4 @@
2-From d74af6c05b11f5d000f0a4aae3c287b6d4e2829f Mon Sep 17 00:00:00 2001
3+From bd8db951717def72440051dae7dc0a8b71489a1a Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Thu, 2 Apr 2026 17:02:47 -0700
6 Subject: [PATCH] Explicitly cast arguments to functions expecting char pointer
7@@ -11,7 +11,7 @@ Subject: [PATCH] Explicitly cast arguments to functions expecting char pointer
8 3 files changed, 22 insertions(+), 21 deletions(-)
9
10 diff --git a/usr.bin/diff/diffreg.c b/usr.bin/diff/diffreg.c
11-index 3470f54c337..c36765a44c8 100644
12+index f3af03bc232..aab4a3b9fc8 100644
13 --- a/usr.bin/diff/diffreg.c
14 +++ b/usr.bin/diff/diffreg.c
15 @@ -1269,19 +1269,19 @@ match_function(const long *f, int pos, FILE *fp)
16@@ -130,10 +130,10 @@ index 1f1fb96e2af..37a18f191f2 100644
17 /* Headers continue until we hit an empty line */
18 for (r = 0; r < HTTP_MAXHDRS; r++) {
19 diff --git a/usr.sbin/acme-client/acctproc.c b/usr.sbin/acme-client/acctproc.c
20-index 8d66dac49d9..6bc647c6009 100644
21+index 2a3c7babb12..e2ef3607b24 100644
22 --- a/usr.sbin/acme-client/acctproc.c
23 +++ b/usr.sbin/acme-client/acctproc.c
24-@@ -215,7 +215,8 @@ op_sign(int fd, struct key *key, enum acctop op)
25+@@ -211,7 +211,8 @@ op_sign(int fd, struct key *key, enum acctop op)
26
27 /* Base64-encode the payload. */
28
29@@ -144,5 +144,5 @@ index 8d66dac49d9..6bc647c6009 100644
30 goto out;
31 }
32 --
33-2.49.0
34+2.54.0
35
1@@ -1,26 +0,0 @@
2-From ef9e08a9597e02425f9da0f43486e0cdfa1a4a1e Mon Sep 17 00:00:00 2001
3-From: Michael Forney <mforney@mforney.org>
4-Date: Wed, 4 Mar 2026 15:27:54 -0800
5-Subject: [PATCH] acme-client: Fix enum/int mismatch in declaration of
6- json_parse_response
7-
8----
9- usr.sbin/acme-client/extern.h | 2 +-
10- 1 file changed, 1 insertion(+), 1 deletion(-)
11-
12-diff --git a/usr.sbin/acme-client/extern.h b/usr.sbin/acme-client/extern.h
13-index 990c784f706..32127182548 100644
14---- a/usr.sbin/acme-client/extern.h
15-+++ b/usr.sbin/acme-client/extern.h
16-@@ -249,7 +249,7 @@ char *base64buf_url(const unsigned char *, size_t);
17- */
18- struct jsmnn *json_parse(const char *, size_t);
19- void json_free(struct jsmnn *);
20--int json_parse_response(struct jsmnn *);
21-+enum chngstatus json_parse_response(struct jsmnn *);
22- void json_free_challenge(struct chng *);
23- int json_parse_challenge(struct jsmnn *, struct chng *);
24- void json_free_order(struct order *);
25---
26-2.54.0
27-
R pkg/openbsd/patch/0042-fts-Use-prototype-in-declaration-of-fts_compar.patch =>
pkg/openbsd/patch/0041-fts-Use-prototype-in-declaration-of-fts_compar.patch
+0,
-0
R pkg/openbsd/patch/0043-nc-Use-explicit-cast-for-pointer-sign-conversion.patch =>
pkg/openbsd/patch/0042-nc-Use-explicit-cast-for-pointer-sign-conversion.patch
+4,
-4
1@@ -1,4 +1,4 @@
2-From bcaddae8de94a8d2d448a287b42a75a7306999b7 Mon Sep 17 00:00:00 2001
3+From 2945d5ff85734cad7ade43f5ea00d9cbf1f4295d Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Sun, 17 May 2026 01:40:40 -0700
6 Subject: [PATCH] nc: Use explicit cast for pointer sign conversion
7@@ -8,15 +8,15 @@ Subject: [PATCH] nc: Use explicit cast for pointer sign conversion
8 1 file changed, 1 insertion(+), 1 deletion(-)
9
10 diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
11-index 982b65592fe..82f1686fa6f 100644
12+index 6ce6eecfa15..5a8cbbaee7b 100644
13 --- a/usr.bin/nc/netcat.c
14 +++ b/usr.bin/nc/netcat.c
15 @@ -1763,7 +1763,7 @@ save_peer_cert(struct tls *tls_ctx, FILE *fp)
16 const char *pem;
17 size_t plen;
18
19-- if ((pem = tls_peer_cert_chain_pem(tls_ctx, &plen)) == NULL)
20-+ if ((pem = (char *)tls_peer_cert_chain_pem(tls_ctx, &plen)) == NULL)
21+- if ((pem = tls_peer_cert_unverified_bundle_pem(tls_ctx, &plen)) == NULL)
22++ if ((pem = (char *)tls_peer_cert_unverified_bundle_pem(tls_ctx, &plen)) == NULL)
23 errx(1, "Can't get peer certificate");
24 if (fprintf(fp, "%.*s", (int)plen, pem) < 0)
25 err(1, "unable to save peer cert");
R pkg/openbsd/patch/0044-Add-fallback-define-for-__pledge_open.patch =>
pkg/openbsd/patch/0043-Add-fallback-define-for-__pledge_open.patch
+0,
-0
1@@ -0,0 +1,28 @@
2+From 6aa6476b05becacf50fab5371eb8764337c87e7f Mon Sep 17 00:00:00 2001
3+From: Michael Forney <mforney@mforney.org>
4+Date: Tue, 27 Oct 2026 11:44:18 -0700
5+Subject: [PATCH] nc: Revert to libressl-4.3 libtls API
6+
7+Until we sync libtls-bearssl with libressl-4.4, we don't have
8+tls_peer_cert_unverified_bundle_pem. Revert to tls_peer_cert_chain_pem
9+for now.
10+---
11+ usr.bin/nc/netcat.c | 2 +-
12+ 1 file changed, 1 insertion(+), 1 deletion(-)
13+
14+diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
15+index 5a8cbbaee7b..1a1a612b103 100644
16+--- a/usr.bin/nc/netcat.c
17++++ b/usr.bin/nc/netcat.c
18+@@ -1763,7 +1763,7 @@ save_peer_cert(struct tls *tls_ctx, FILE *fp)
19+ const char *pem;
20+ size_t plen;
21+
22+- if ((pem = (char *)tls_peer_cert_unverified_bundle_pem(tls_ctx, &plen)) == NULL)
23++ if ((pem = (char *)tls_peer_cert_chain_pem(tls_ctx, &plen)) == NULL)
24+ errx(1, "Can't get peer certificate");
25+ if (fprintf(fp, "%.*s", (int)plen, pem) < 0)
26+ err(1, "unable to save peer cert");
27+--
28+2.54.0
29+
+2,
-2
1@@ -1,2 +1,2 @@
2-fb305c553059b48e8ee64539f392b783cb38a67865823f6f6a94f3b220a1268b src.tar.gz
3-c9ef294021ef7aafd5f18ffe8ebfed63394e5a86d65d7436d6db78551f9d57f1 sys.tar.gz
4+9984c74ff875b5ff041e4676a7f3e4e1ead2cc47a284d705eb9f37cbec4fe795 src.tar.gz
5+964b1aed7839b86f4e010a0fdd03dcd409e6f569e69fe85f95e5fceb740c2aaf sys.tar.gz
+2,
-2
1@@ -1,5 +1,5 @@
2 remote-name
3-url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.9/src.tar.gz"
4+url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/8.0/src.tar.gz"
5
6 remote-name
7-url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.9/sys.tar.gz"
8+url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/8.0/sys.tar.gz"
+1,
-1
1@@ -1 +1 @@
2-7.9
3+8.0