CVS commit: pkgsrc/security/botan-devel

["Joerg Sonnenberger" <joerg%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   joerg
Date:           Mon Apr 10 21:14:45 UTC 2017

Modified Files:
        pkgsrc/security/botan-devel: Makefile PLIST buildlink3.mk distinfo
        pkgsrc/security/botan-devel/patches:
            patch-src_build-data_os_openbsd.txt
            patch-src_build-data_os_solaris.txt
            patch-src_lib_utils_os__utils.cpp
Removed Files:
        pkgsrc/security/botan-devel/patches:
            patch-src_build-data_os_dragonfly.txt
            patch-src_build-data_os_netbsd.txt

Log Message:
Update to Botan 2.1.0, the new stable branch.

Some of the more important changes:

- Fix incorrect truncation in Bcrypt. Passwords in length between 56 and
  72 characters were truncated at 56 characters. Found and reported by
  Solar Designer. (CVE-2017-7252) (GH #938)
- Fix a bug in X509 DN string comparisons that could result in out of
  bound reads. This could result in information leakage, denial of
  service, or potentially incorrect certificate validation results.
  Found independently by Cisco Talos team and OSS-Fuzz. (CVE-2017-2801)
- Correct minimum work factor for Bcrypt password hashes. All other
  implementations require the work factor be at least 4. Previously
  Botan simply required it be greater than zero. (GH #938)
- Converge on a single side channel silent EC blinded multiply
  algorithm. Uses Montgomery ladder with order/2 bits scalar blinding
  and point randomization now by default. (GH #893)
- Add ability to search for certificates using the SHA-256 of the
  distinguished name. (GH #900)
- Support a 0-length IV in ChaCha stream cipher. Such an IV is treated
  identically to an 8-byte IV of all zeros.
- Previously Botan forbid any use of times past 2037 to avoid Y2038
  issues. Now this restriction is only in place on systems which have a
  32-bit time_t. (GH #933 fixing #917)
- Fix a longstanding bug in modular exponentiation which caused most
  exponentiations modulo an even number to have an incorrect result;
  such moduli occur only rarely in cryptographic contexts. (GH #754)
- Fix a bug in BigInt multiply operation, introduced in 1.11.30, which
  could cause incorrect results. Found by OSS-Fuzz fuzzing the ressol
  function, where the bug manifested as an incorrect modular
  exponentiation. OSS-Fuzz bug #287
- Fix a bug that meant the “ietf/modp/6144” and “ietf/modp/8192”
  discrete log groups used an incorrect value for the generator,
  specifically the value (p-1)/2 was used instead of the correct value
  of 2.
- DL_Group strong generation previously set the generator to 2. However
  sometimes 2 generates the entire group mod p, rather than the subgroup
  mod q. This is invalid by X9.42 standard, and exposes incautious
  applications to small subgroup attacks. Now DL_Group uses the smallest
  g which is a quadratic residue. (GH #818)
- The default TLS policy now requires 2048 or larger DH groups by
  default.
- The default Path_Validation_Restrictions constructor has changed to
  require at least 110 bit signature strength. This means 1024 bit RSA
  certificates and also SHA-1 certificates are rejected by default. Both
  settings were already the default for certificate validation in TLS
  handshake, but this changes it for applications also.
- Fix integer overflow during BER decoding, found by Falko Strenzke.
  This bug is not thought to be directly exploitable but upgrading ASAP
  is advised. (CVE-2016-9132)
- Add post-quantum signature scheme XMSS. Provides either 128 or 256 bit
  (post-quantum) security, with small public and private keys, fast
  verification, and reasonably small signatures (2500 bytes for 128-bit
  security). Signature generation is very slow, on the order of seconds.
  And very importantly the signature scheme is stateful: each leaf index
  must only be used once, or all security is lost. In the appropriate
  system where signatures are rarely generated (such as code signing)
  XMSS makes an excellent choice. (GH #717 #736)
- Add support for client-side OCSP stapling to TLS. (GH #738)
- Previously both public and private keys performed automatic self
  testing after generation or loading. However this often caused
  unexpected application performance problems, and so has been removed.
  Instead applications must call check_key explicitly. (GH #704)
- Fix TLS session resumption bugs which caused resumption failures if an
  application used a single session cache for both TLS and DTLS. (GH
  #688)
- The default TLS policy now disables static RSA ciphersuites, all DSA
  ciphersuites, and the AES CCM-8 ciphersuites. Disabling static RSA by
  default protects servers from oracle attacks, as well as enforcing a
  forward secure ciphersuite. Some applications may be forced to
  re-enable RSA for interop reasons. DSA and CCM-8 are rarely used, and
  likely should not be negotiated outside of special circumstances.
- The default TLS policy now prefers ChaCha20Poly1305 cipher over any
  AES mode.
- The default TLS policy now orders ECC curve preferences in order by
  performance, with x25519 first, then P-256, then P-521, then the rest.


To generate a diff of this commit:
cvs rdiff -u -r1.19 -r1.20 pkgsrc/security/botan-devel/Makefile
cvs rdiff -u -r1.8 -r1.9 pkgsrc/security/botan-devel/PLIST
cvs rdiff -u -r1.7 -r1.8 pkgsrc/security/botan-devel/buildlink3.mk
cvs rdiff -u -r1.12 -r1.13 pkgsrc/security/botan-devel/distinfo
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/botan-devel/patches/patch-src_build-data_os_dragonfly.txt \
    pkgsrc/security/botan-devel/patches/patch-src_build-data_os_netbsd.txt
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/security/botan-devel/patches/patch-src_build-data_os_openbsd.txt \
    pkgsrc/security/botan-devel/patches/patch-src_build-data_os_solaris.txt
cvs rdiff -u -r1.4 -r1.5 \
    pkgsrc/security/botan-devel/patches/patch-src_lib_utils_os__utils.cpp

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/botan-devel/Makefile
diff -u pkgsrc/security/botan-devel/Makefile:1.19 pkgsrc/security/botan-devel/Makefile:1.20
--- pkgsrc/security/botan-devel/Makefile:1.19   Sun Jan  1 16:05:59 2017
+++ pkgsrc/security/botan-devel/Makefile        Mon Apr 10 21:14:45 2017
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.19 2017/01/01 16:05:59 adam Exp $
+# $NetBSD: Makefile,v 1.20 2017/04/10 21:14:45 joerg Exp $
 
-DISTNAME=      Botan-1.11.33
+DISTNAME=      Botan-2.1.0
 PKGNAME=       ${DISTNAME:tl}
-PKGREVISION=   1
 CATEGORIES=    security
 MASTER_SITES=  http://botan.randombit.net/releases/
 EXTRACT_SUFX=  .tgz

Index: pkgsrc/security/botan-devel/PLIST
diff -u pkgsrc/security/botan-devel/PLIST:1.8 pkgsrc/security/botan-devel/PLIST:1.9
--- pkgsrc/security/botan-devel/PLIST:1.8       Fri Nov 11 19:41:44 2016
+++ pkgsrc/security/botan-devel/PLIST   Mon Apr 10 21:14:45 2017
@@ -1,281 +1,321 @@
-@comment $NetBSD: PLIST,v 1.8 2016/11/11 19:41:44 joerg Exp $
+@comment $NetBSD: PLIST,v 1.9 2017/04/10 21:14:45 joerg Exp $
 bin/botan
-include/botan-1.11/botan/adler32.h
-include/botan-1.11/botan/aead.h
-include/botan-1.11/botan/aes.h
-include/botan-1.11/botan/alg_id.h
-include/botan-1.11/botan/asn1_alt_name.h
-include/botan-1.11/botan/asn1_attribute.h
-include/botan-1.11/botan/asn1_obj.h
-include/botan-1.11/botan/asn1_oid.h
-include/botan-1.11/botan/asn1_str.h
-include/botan-1.11/botan/asn1_time.h
-include/botan-1.11/botan/assert.h
-include/botan-1.11/botan/auto_rng.h
-include/botan-1.11/botan/b64_filt.h
-include/botan-1.11/botan/base64.h
-include/botan-1.11/botan/basefilt.h
-include/botan-1.11/botan/bcrypt.h
-include/botan-1.11/botan/ber_dec.h
-include/botan-1.11/botan/bigint.h
-include/botan-1.11/botan/blake2b.h
-include/botan-1.11/botan/blinding.h
-include/botan-1.11/botan/block_cipher.h
-include/botan-1.11/botan/blowfish.h
-include/botan-1.11/botan/botan.h
-include/botan-1.11/botan/bswap.h
-include/botan-1.11/botan/buf_comp.h
-include/botan-1.11/botan/buf_filt.h
-include/botan-1.11/botan/build.h
-include/botan-1.11/botan/calendar.h
-include/botan-1.11/botan/camellia.h
-include/botan-1.11/botan/cascade.h
-include/botan-1.11/botan/cast128.h
-include/botan-1.11/botan/cast256.h
-include/botan-1.11/botan/cbc.h
-include/botan-1.11/botan/cbc_mac.h
-include/botan-1.11/botan/ccm.h
-include/botan-1.11/botan/cert_status.h
-include/botan-1.11/botan/certstor.h
-include/botan-1.11/botan/certstor_sql.h
-include/botan-1.11/botan/cfb.h
-include/botan-1.11/botan/chacha.h
-include/botan-1.11/botan/chacha20poly1305.h
-include/botan-1.11/botan/charset.h
-include/botan-1.11/botan/cipher_filter.h
-include/botan-1.11/botan/cipher_mode.h
-include/botan-1.11/botan/cmac.h
-include/botan-1.11/botan/comb4p.h
-include/botan-1.11/botan/comp_filter.h
-include/botan-1.11/botan/compression.h
-include/botan-1.11/botan/cpuid.h
-include/botan-1.11/botan/crc24.h
-include/botan-1.11/botan/crc32.h
-include/botan-1.11/botan/credentials_manager.h
-include/botan-1.11/botan/crl_ent.h
-include/botan-1.11/botan/cryptobox.h
-include/botan-1.11/botan/ctr.h
-include/botan-1.11/botan/curve25519.h
-include/botan-1.11/botan/curve_gfp.h
-include/botan-1.11/botan/curve_nistp.h
-include/botan-1.11/botan/data_snk.h
-include/botan-1.11/botan/data_src.h
-include/botan-1.11/botan/database.h
-include/botan-1.11/botan/datastor.h
-include/botan-1.11/botan/der_enc.h
-include/botan-1.11/botan/des.h
-include/botan-1.11/botan/desx.h
-include/botan-1.11/botan/dh.h
-include/botan-1.11/botan/divide.h
-include/botan-1.11/botan/dl_algo.h
-include/botan-1.11/botan/dl_group.h
-include/botan-1.11/botan/dlies.h
-include/botan-1.11/botan/dsa.h
-include/botan-1.11/botan/eax.h
-include/botan-1.11/botan/ec_group.h
-include/botan-1.11/botan/ecb.h
-include/botan-1.11/botan/ecc_key.h
-include/botan-1.11/botan/ecdh.h
-include/botan-1.11/botan/ecdsa.h
-include/botan-1.11/botan/ecgdsa.h
-include/botan-1.11/botan/ecies.h
-include/botan-1.11/botan/eckcdsa.h
-include/botan-1.11/botan/elgamal.h
-include/botan-1.11/botan/eme.h
-include/botan-1.11/botan/eme_pkcs.h
-include/botan-1.11/botan/eme_raw.h
-include/botan-1.11/botan/emsa.h
-include/botan-1.11/botan/emsa1.h
-include/botan-1.11/botan/emsa_pkcs1.h
-include/botan-1.11/botan/emsa_raw.h
-include/botan-1.11/botan/emsa_x931.h
-include/botan-1.11/botan/entropy_src.h
-include/botan-1.11/botan/exceptn.h
-include/botan-1.11/botan/fd_unix.h
-include/botan-1.11/botan/ffi.h
-include/botan-1.11/botan/filter.h
-include/botan-1.11/botan/filters.h
-include/botan-1.11/botan/fpe_fe1.h
-include/botan-1.11/botan/gcm.h
-include/botan-1.11/botan/gf2m_small_m.h
-include/botan-1.11/botan/gost_28147.h
-include/botan-1.11/botan/gost_3410.h
-include/botan-1.11/botan/gost_3411.h
-include/botan-1.11/botan/hash.h
-include/botan-1.11/botan/hash_id.h
-include/botan-1.11/botan/hex.h
-include/botan-1.11/botan/hex_filt.h
-include/botan-1.11/botan/hkdf.h
-include/botan-1.11/botan/hmac.h
-include/botan-1.11/botan/hmac_drbg.h
-include/botan-1.11/botan/hmac_rng.h
-include/botan-1.11/botan/http_util.h
-include/botan-1.11/botan/idea.h
-include/botan-1.11/botan/init.h
-include/botan-1.11/botan/kasumi.h
-include/botan-1.11/botan/kdf.h
-include/botan-1.11/botan/kdf1.h
-include/botan-1.11/botan/kdf1_iso18033.h
-include/botan-1.11/botan/kdf2.h
-include/botan-1.11/botan/keccak.h
-include/botan-1.11/botan/key_constraint.h
-include/botan-1.11/botan/key_filt.h
-include/botan-1.11/botan/key_spec.h
-include/botan-1.11/botan/keypair.h
-include/botan-1.11/botan/lion.h
-include/botan-1.11/botan/loadstor.h
-include/botan-1.11/botan/locking_allocator.h
-include/botan-1.11/botan/lookup.h
-include/botan-1.11/botan/mac.h
-include/botan-1.11/botan/mceies.h
-include/botan-1.11/botan/mceliece.h
-include/botan-1.11/botan/md4.h
-include/botan-1.11/botan/md5.h
-include/botan-1.11/botan/mdx_hash.h
-include/botan-1.11/botan/mem_ops.h
-include/botan-1.11/botan/mgf1.h
-include/botan-1.11/botan/misty1.h
-include/botan-1.11/botan/mode_pad.h
-include/botan-1.11/botan/mp_types.h
-include/botan-1.11/botan/mul128.h
-include/botan-1.11/botan/mutex.h
-include/botan-1.11/botan/name_constraint.h
-include/botan-1.11/botan/newhope.h
-include/botan-1.11/botan/noekeon.h
-include/botan-1.11/botan/numthry.h
-include/botan-1.11/botan/oaep.h
-include/botan-1.11/botan/ocb.h
-include/botan-1.11/botan/ocsp.h
-include/botan-1.11/botan/ocsp_types.h
-include/botan-1.11/botan/ofb.h
-include/botan-1.11/botan/oids.h
-include/botan-1.11/botan/openpgp.h
-include/botan-1.11/botan/package.h
-include/botan-1.11/botan/par_hash.h
-include/botan-1.11/botan/parsing.h
-include/botan-1.11/botan/passhash9.h
-include/botan-1.11/botan/pbes2.h
-include/botan-1.11/botan/pbkdf.h
-include/botan-1.11/botan/pbkdf1.h
-include/botan-1.11/botan/pbkdf2.h
-include/botan-1.11/botan/pem.h
-include/botan-1.11/botan/pipe.h
-include/botan-1.11/botan/pk_algs.h
-include/botan-1.11/botan/pk_keys.h
-include/botan-1.11/botan/pk_ops_fwd.h
-include/botan-1.11/botan/pkcs10.h
-include/botan-1.11/botan/pkcs8.h
-include/botan-1.11/botan/point_gfp.h
-include/botan-1.11/botan/poly1305.h
-include/botan-1.11/botan/polyn_gf2m.h
-include/botan-1.11/botan/pow_mod.h
-include/botan-1.11/botan/prf_tls.h
-include/botan-1.11/botan/prf_x942.h
-include/botan-1.11/botan/pssr.h
-include/botan-1.11/botan/pubkey.h
-include/botan-1.11/botan/rc4.h
-include/botan-1.11/botan/rdrand_rng.h
-include/botan-1.11/botan/reducer.h
-include/botan-1.11/botan/rfc3394.h
-include/botan-1.11/botan/rfc6979.h
-include/botan-1.11/botan/rmd160.h
-include/botan-1.11/botan/rng.h
-include/botan-1.11/botan/rotate.h
-include/botan-1.11/botan/rsa.h
-include/botan-1.11/botan/salsa20.h
-include/botan-1.11/botan/scan_name.h
-include/botan-1.11/botan/secmem.h
-include/botan-1.11/botan/secqueue.h
-include/botan-1.11/botan/seed.h
-include/botan-1.11/botan/serpent.h
-include/botan-1.11/botan/sha160.h
-include/botan-1.11/botan/sha2_32.h
-include/botan-1.11/botan/sha2_64.h
-include/botan-1.11/botan/sha3.h
-include/botan-1.11/botan/shake_cipher.h
-include/botan-1.11/botan/siphash.h
-include/botan-1.11/botan/siv.h
-include/botan-1.11/botan/skein_512.h
-include/botan-1.11/botan/sp800_108.h
-include/botan-1.11/botan/sp800_56c.h
-include/botan-1.11/botan/srp6.h
-include/botan-1.11/botan/srp6_files.h
-include/botan-1.11/botan/stateful_rng.h
-include/botan-1.11/botan/stream_cipher.h
-include/botan-1.11/botan/stream_mode.h
-include/botan-1.11/botan/sym_algo.h
-include/botan-1.11/botan/symkey.h
-include/botan-1.11/botan/system_rng.h
-include/botan-1.11/botan/threefish.h
-include/botan-1.11/botan/tiger.h
-include/botan-1.11/botan/tls_alert.h
-include/botan-1.11/botan/tls_blocking.h
-include/botan-1.11/botan/tls_callbacks.h
-include/botan-1.11/botan/tls_channel.h
-include/botan-1.11/botan/tls_ciphersuite.h
-include/botan-1.11/botan/tls_client.h
-include/botan-1.11/botan/tls_exceptn.h
-include/botan-1.11/botan/tls_handshake_msg.h
-include/botan-1.11/botan/tls_magic.h
-include/botan-1.11/botan/tls_policy.h
-include/botan-1.11/botan/tls_server.h
-include/botan-1.11/botan/tls_server_info.h
-include/botan-1.11/botan/tls_session.h
-include/botan-1.11/botan/tls_session_manager.h
-include/botan-1.11/botan/tls_session_manager_sql.h
-include/botan-1.11/botan/tls_version.h
-include/botan-1.11/botan/tss.h
-include/botan-1.11/botan/twofish.h
-include/botan-1.11/botan/types.h
-include/botan-1.11/botan/version.h
-include/botan-1.11/botan/whrlpool.h
-include/botan-1.11/botan/workfactor.h
-include/botan-1.11/botan/x509_ca.h
-include/botan-1.11/botan/x509_crl.h
-include/botan-1.11/botan/x509_dn.h
-include/botan-1.11/botan/x509_ext.h
-include/botan-1.11/botan/x509_key.h
-include/botan-1.11/botan/x509_obj.h
-include/botan-1.11/botan/x509cert.h
-include/botan-1.11/botan/x509path.h
-include/botan-1.11/botan/x509self.h
-include/botan-1.11/botan/x919_mac.h
-include/botan-1.11/botan/x931_rng.h
-include/botan-1.11/botan/xtea.h
-include/botan-1.11/botan/xts.h
-include/botan-1.11/botan/zlib.h
-lib/libbotan-1.11.a
-lib/libbotan-1.11.so
-lib/libbotan-1.11.so.33
-lib/libbotan-1.11.so.33.33
-lib/pkgconfig/botan-1.11.pc
-${PYSITELIB}/botan.py
+include/botan-2/botan/adler32.h
+include/botan-2/botan/aead.h
+include/botan-2/botan/aes.h
+include/botan-2/botan/alg_id.h
+include/botan-2/botan/asn1_alt_name.h
+include/botan-2/botan/asn1_attribute.h
+include/botan-2/botan/asn1_obj.h
+include/botan-2/botan/asn1_oid.h
+include/botan-2/botan/asn1_str.h
+include/botan-2/botan/asn1_time.h
+include/botan-2/botan/assert.h
+include/botan-2/botan/atomic.h
+include/botan-2/botan/auto_rng.h
+include/botan-2/botan/b64_filt.h
+include/botan-2/botan/base64.h
+include/botan-2/botan/basefilt.h
+include/botan-2/botan/bcrypt.h
+include/botan-2/botan/ber_dec.h
+include/botan-2/botan/bigint.h
+include/botan-2/botan/blake2b.h
+include/botan-2/botan/blinding.h
+include/botan-2/botan/block_cipher.h
+include/botan-2/botan/blowfish.h
+include/botan-2/botan/botan.h
+include/botan-2/botan/bswap.h
+include/botan-2/botan/buf_comp.h
+include/botan-2/botan/buf_filt.h
+include/botan-2/botan/build.h
+include/botan-2/botan/calendar.h
+include/botan-2/botan/camellia.h
+include/botan-2/botan/cascade.h
+include/botan-2/botan/cast128.h
+include/botan-2/botan/cast256.h
+include/botan-2/botan/cbc.h
+include/botan-2/botan/cbc_mac.h
+include/botan-2/botan/ccm.h
+include/botan-2/botan/cecpq1.h
+include/botan-2/botan/cert_status.h
+include/botan-2/botan/certstor.h
+include/botan-2/botan/certstor_sql.h
+include/botan-2/botan/cfb.h
+include/botan-2/botan/chacha.h
+include/botan-2/botan/chacha20poly1305.h
+include/botan-2/botan/charset.h
+include/botan-2/botan/cipher_filter.h
+include/botan-2/botan/cipher_mode.h
+include/botan-2/botan/cmac.h
+include/botan-2/botan/comb4p.h
+include/botan-2/botan/comp_filter.h
+include/botan-2/botan/compiler.h
+include/botan-2/botan/compression.h
+include/botan-2/botan/cpuid.h
+include/botan-2/botan/crc24.h
+include/botan-2/botan/crc32.h
+include/botan-2/botan/credentials_manager.h
+include/botan-2/botan/crl_ent.h
+include/botan-2/botan/cryptobox.h
+include/botan-2/botan/ctr.h
+include/botan-2/botan/curve25519.h
+include/botan-2/botan/curve_gfp.h
+include/botan-2/botan/curve_nistp.h
+include/botan-2/botan/data_snk.h
+include/botan-2/botan/data_src.h
+include/botan-2/botan/database.h
+include/botan-2/botan/datastor.h
+include/botan-2/botan/der_enc.h
+include/botan-2/botan/des.h
+include/botan-2/botan/desx.h
+include/botan-2/botan/dh.h
+include/botan-2/botan/divide.h
+include/botan-2/botan/dl_algo.h
+include/botan-2/botan/dl_group.h
+include/botan-2/botan/dlies.h
+include/botan-2/botan/dsa.h
+include/botan-2/botan/dyn_load.h
+include/botan-2/botan/eax.h
+include/botan-2/botan/ec_group.h
+include/botan-2/botan/ecc_key.h
+include/botan-2/botan/ecdh.h
+include/botan-2/botan/ecdsa.h
+include/botan-2/botan/ecgdsa.h
+include/botan-2/botan/ecies.h
+include/botan-2/botan/eckcdsa.h
+include/botan-2/botan/elgamal.h
+include/botan-2/botan/eme.h
+include/botan-2/botan/eme_pkcs.h
+include/botan-2/botan/eme_raw.h
+include/botan-2/botan/emsa.h
+include/botan-2/botan/emsa1.h
+include/botan-2/botan/emsa_pkcs1.h
+include/botan-2/botan/emsa_raw.h
+include/botan-2/botan/emsa_x931.h
+include/botan-2/botan/entropy_src.h
+include/botan-2/botan/exceptn.h
+include/botan-2/botan/fd_unix.h
+include/botan-2/botan/ffi.h
+include/botan-2/botan/filter.h
+include/botan-2/botan/filters.h
+include/botan-2/botan/fpe_fe1.h
+include/botan-2/botan/gcm.h
+include/botan-2/botan/gf2m_small_m.h
+include/botan-2/botan/gmac.h
+include/botan-2/botan/gost_28147.h
+include/botan-2/botan/gost_3410.h
+include/botan-2/botan/gost_3411.h
+include/botan-2/botan/hash.h
+include/botan-2/botan/hash_id.h
+include/botan-2/botan/hex.h
+include/botan-2/botan/hex_filt.h
+include/botan-2/botan/hkdf.h
+include/botan-2/botan/hmac.h
+include/botan-2/botan/hmac_drbg.h
+include/botan-2/botan/http_util.h
+include/botan-2/botan/idea.h
+include/botan-2/botan/init.h
+include/botan-2/botan/iso9796.h
+include/botan-2/botan/kasumi.h
+include/botan-2/botan/kdf.h
+include/botan-2/botan/kdf1.h
+include/botan-2/botan/kdf1_iso18033.h
+include/botan-2/botan/kdf2.h
+include/botan-2/botan/keccak.h
+include/botan-2/botan/key_constraint.h
+include/botan-2/botan/key_filt.h
+include/botan-2/botan/key_spec.h
+include/botan-2/botan/keypair.h
+include/botan-2/botan/lion.h
+include/botan-2/botan/loadstor.h
+include/botan-2/botan/locking_allocator.h
+include/botan-2/botan/lookup.h
+include/botan-2/botan/mac.h
+include/botan-2/botan/mceies.h
+include/botan-2/botan/mceliece.h
+include/botan-2/botan/md4.h
+include/botan-2/botan/md5.h
+include/botan-2/botan/mdx_hash.h
+include/botan-2/botan/mem_ops.h
+include/botan-2/botan/mgf1.h
+include/botan-2/botan/misty1.h
+include/botan-2/botan/mode_pad.h
+include/botan-2/botan/mp_types.h
+include/botan-2/botan/mul128.h
+include/botan-2/botan/mutex.h
+include/botan-2/botan/name_constraint.h
+include/botan-2/botan/newhope.h
+include/botan-2/botan/noekeon.h
+include/botan-2/botan/numthry.h
+include/botan-2/botan/oaep.h
+include/botan-2/botan/ocb.h
+include/botan-2/botan/ocsp.h
+include/botan-2/botan/ocsp_types.h
+include/botan-2/botan/ofb.h
+include/botan-2/botan/oids.h
+include/botan-2/botan/p11.h
+include/botan-2/botan/p11_ecc_key.h
+include/botan-2/botan/p11_ecdh.h
+include/botan-2/botan/p11_ecdsa.h
+include/botan-2/botan/p11_module.h
+include/botan-2/botan/p11_object.h
+include/botan-2/botan/p11_randomgenerator.h
+include/botan-2/botan/p11_rsa.h
+include/botan-2/botan/p11_session.h
+include/botan-2/botan/p11_slot.h
+include/botan-2/botan/p11_x509.h
+include/botan-2/botan/package.h
+include/botan-2/botan/par_hash.h
+include/botan-2/botan/parsing.h
+include/botan-2/botan/passhash9.h
+include/botan-2/botan/pbes2.h
+include/botan-2/botan/pbkdf.h
+include/botan-2/botan/pbkdf1.h
+include/botan-2/botan/pbkdf2.h
+include/botan-2/botan/pem.h
+include/botan-2/botan/pipe.h
+include/botan-2/botan/pk_algs.h
+include/botan-2/botan/pk_keys.h
+include/botan-2/botan/pk_ops.h
+include/botan-2/botan/pk_ops_fwd.h
+include/botan-2/botan/pkcs10.h
+include/botan-2/botan/pkcs11.h
+include/botan-2/botan/pkcs11f.h
+include/botan-2/botan/pkcs11t.h
+include/botan-2/botan/pkcs8.h
+include/botan-2/botan/point_gfp.h
+include/botan-2/botan/poly1305.h
+include/botan-2/botan/polyn_gf2m.h
+include/botan-2/botan/pow_mod.h
+include/botan-2/botan/prf_tls.h
+include/botan-2/botan/prf_x942.h
+include/botan-2/botan/pssr.h
+include/botan-2/botan/pubkey.h
+include/botan-2/botan/rc4.h
+include/botan-2/botan/rdrand_rng.h
+include/botan-2/botan/reducer.h
+include/botan-2/botan/rfc3394.h
+include/botan-2/botan/rfc6979.h
+include/botan-2/botan/rmd160.h
+include/botan-2/botan/rng.h
+include/botan-2/botan/rotate.h
+include/botan-2/botan/rsa.h
+include/botan-2/botan/salsa20.h
+include/botan-2/botan/scan_name.h
+include/botan-2/botan/secmem.h
+include/botan-2/botan/secqueue.h
+include/botan-2/botan/seed.h
+include/botan-2/botan/serpent.h
+include/botan-2/botan/sha160.h
+include/botan-2/botan/sha2_32.h
+include/botan-2/botan/sha2_64.h
+include/botan-2/botan/sha3.h
+include/botan-2/botan/shake.h
+include/botan-2/botan/shake_cipher.h
+include/botan-2/botan/siphash.h
+include/botan-2/botan/siv.h
+include/botan-2/botan/skein_512.h
+include/botan-2/botan/sp800_108.h
+include/botan-2/botan/sp800_56c.h
+include/botan-2/botan/srp6.h
+include/botan-2/botan/stateful_rng.h
+include/botan-2/botan/stl_compatibility.h
+include/botan-2/botan/stream_cipher.h
+include/botan-2/botan/stream_mode.h
+include/botan-2/botan/sym_algo.h
+include/botan-2/botan/symkey.h
+include/botan-2/botan/system_rng.h
+include/botan-2/botan/threefish.h
+include/botan-2/botan/tiger.h
+include/botan-2/botan/tls_alert.h
+include/botan-2/botan/tls_blocking.h
+include/botan-2/botan/tls_callbacks.h
+include/botan-2/botan/tls_channel.h
+include/botan-2/botan/tls_ciphersuite.h
+include/botan-2/botan/tls_client.h
+include/botan-2/botan/tls_exceptn.h
+include/botan-2/botan/tls_extensions.h
+include/botan-2/botan/tls_handshake_msg.h
+include/botan-2/botan/tls_magic.h
+include/botan-2/botan/tls_messages.h
+include/botan-2/botan/tls_policy.h
+include/botan-2/botan/tls_server.h
+include/botan-2/botan/tls_server_info.h
+include/botan-2/botan/tls_session.h
+include/botan-2/botan/tls_session_manager.h
+include/botan-2/botan/tls_session_manager_sql.h
+include/botan-2/botan/tls_version.h
+include/botan-2/botan/tss.h
+include/botan-2/botan/twofish.h
+include/botan-2/botan/types.h
+include/botan-2/botan/version.h
+include/botan-2/botan/whrlpool.h
+include/botan-2/botan/workfactor.h
+include/botan-2/botan/x509_ca.h
+include/botan-2/botan/x509_crl.h
+include/botan-2/botan/x509_dn.h
+include/botan-2/botan/x509_ext.h
+include/botan-2/botan/x509_key.h
+include/botan-2/botan/x509_obj.h
+include/botan-2/botan/x509cert.h
+include/botan-2/botan/x509path.h
+include/botan-2/botan/x509self.h
+include/botan-2/botan/x919_mac.h
+include/botan-2/botan/xmss.h
+include/botan-2/botan/xmss_address.h
+include/botan-2/botan/xmss_common_ops.h
+include/botan-2/botan/xmss_hash.h
+include/botan-2/botan/xmss_index_registry.h
+include/botan-2/botan/xmss_key_pair.h
+include/botan-2/botan/xmss_parameters.h
+include/botan-2/botan/xmss_privatekey.h
+include/botan-2/botan/xmss_publickey.h
+include/botan-2/botan/xmss_tools.h
+include/botan-2/botan/xmss_wots_parameters.h
+include/botan-2/botan/xmss_wots_privatekey.h
+include/botan-2/botan/xmss_wots_publickey.h
+include/botan-2/botan/xtea.h
+include/botan-2/botan/xts.h
+include/botan-2/botan/zlib.h
+lib/libbotan-2.a
+lib/libbotan-2.so
+lib/libbotan-2.so.0
+lib/libbotan-2.so.0.1.0
+lib/pkgconfig/botan-2.pc
+${PYSITELIB}/botan2.py
 share/doc/${PKGNAME}/deprecated.txt
 share/doc/${PKGNAME}/license.txt
-share/doc/${PKGNAME}/manual/aead.rst
 share/doc/${PKGNAME}/manual/bigint.rst
 share/doc/${PKGNAME}/manual/building.rst
+share/doc/${PKGNAME}/manual/cli.rst
 share/doc/${PKGNAME}/manual/compression.rst
 share/doc/${PKGNAME}/manual/contents.rst
 share/doc/${PKGNAME}/manual/credentials_manager.rst
 share/doc/${PKGNAME}/manual/cryptobox.rst
 share/doc/${PKGNAME}/manual/ffi.rst
 share/doc/${PKGNAME}/manual/filters.rst
-share/doc/${PKGNAME}/manual/firststep.rst
 share/doc/${PKGNAME}/manual/fpe.rst
+share/doc/${PKGNAME}/manual/goals.rst
+share/doc/${PKGNAME}/manual/hash.rst
 share/doc/${PKGNAME}/manual/index.rst
 share/doc/${PKGNAME}/manual/kdf.rst
 share/doc/${PKGNAME}/manual/lowlevel.rst
 share/doc/${PKGNAME}/manual/mceliece.rst
-share/doc/${PKGNAME}/manual/ocsp.rst
+share/doc/${PKGNAME}/manual/packaging.rst
 share/doc/${PKGNAME}/manual/passhash.rst
 share/doc/${PKGNAME}/manual/pbkdf.rst
+share/doc/${PKGNAME}/manual/pkcs11.rst
+share/doc/${PKGNAME}/manual/platforms.rst
 share/doc/${PKGNAME}/manual/pubkey.rst
 share/doc/${PKGNAME}/manual/python.rst
 share/doc/${PKGNAME}/manual/rng.rst
 share/doc/${PKGNAME}/manual/secmem.rst
+share/doc/${PKGNAME}/manual/side_channels.rst
 share/doc/${PKGNAME}/manual/srp.rst
+share/doc/${PKGNAME}/manual/support.rst
+share/doc/${PKGNAME}/manual/symmetric_crypto.rst
 share/doc/${PKGNAME}/manual/tls.rst
+share/doc/${PKGNAME}/manual/tpm.rst
 share/doc/${PKGNAME}/manual/versions.rst
 share/doc/${PKGNAME}/manual/x509.rst
 share/doc/${PKGNAME}/news.txt

Index: pkgsrc/security/botan-devel/buildlink3.mk
diff -u pkgsrc/security/botan-devel/buildlink3.mk:1.7 pkgsrc/security/botan-devel/buildlink3.mk:1.8
--- pkgsrc/security/botan-devel/buildlink3.mk:1.7       Sun Jan  1 16:05:59 2017
+++ pkgsrc/security/botan-devel/buildlink3.mk   Mon Apr 10 21:14:45 2017
@@ -1,12 +1,11 @@
-# $NetBSD: buildlink3.mk,v 1.7 2017/01/01 16:05:59 adam Exp $
+# $NetBSD: buildlink3.mk,v 1.8 2017/04/10 21:14:45 joerg Exp $
 
 BUILDLINK_TREE+=       botan
 
 .if !defined(BOTAN_BUILDLINK3_MK)
 BOTAN_BUILDLINK3_MK:=
 
-BUILDLINK_API_DEPENDS.botan+=  botan>=1.11.8
-BUILDLINK_ABI_DEPENDS.botan?=  botan>=1.11.33nb1
+BUILDLINK_API_DEPENDS.botan+=  botan>=2.1
 BUILDLINK_PKGSRCDIR.botan?=    ../../security/botan-devel
 
 .include "../../devel/zlib/buildlink3.mk"

Index: pkgsrc/security/botan-devel/distinfo
diff -u pkgsrc/security/botan-devel/distinfo:1.12 pkgsrc/security/botan-devel/distinfo:1.13
--- pkgsrc/security/botan-devel/distinfo:1.12   Mon Jan 16 01:50:14 2017
+++ pkgsrc/security/botan-devel/distinfo        Mon Apr 10 21:14:45 2017
@@ -1,12 +1,10 @@
-$NetBSD: distinfo,v 1.12 2017/01/16 01:50:14 joerg Exp $
+$NetBSD: distinfo,v 1.13 2017/04/10 21:14:45 joerg Exp $
 
-SHA1 (Botan-1.11.33.tgz) = 71f2f4c81af48197e7c6db86bab393396ecf6541
-RMD160 (Botan-1.11.33.tgz) = f0de0fea65fd501747cf1949e47ec2faeb6acaa0
-SHA512 (Botan-1.11.33.tgz) = 49bb4485663897dd07bb7982771befacc50bfabef5806dc802cbd4d39f5d641b08a264824b5b1b96421e810811353deea15e728c5d08ce2932cf0e4602ae099d
-Size (Botan-1.11.33.tgz) = 4329671 bytes
-SHA1 (patch-src_build-data_os_dragonfly.txt) = 2aef3f0c514f6d1e84aae43052d82b3536a1b1c5
-SHA1 (patch-src_build-data_os_netbsd.txt) = e3acd79c182f338542c4c65b20f2443e42a1a488
-SHA1 (patch-src_build-data_os_openbsd.txt) = 2388e859c855409f6ec23e2b149b3eb56c5a0aea
-SHA1 (patch-src_build-data_os_solaris.txt) = d4632d817c401d3942aaabe23719c7496d416b84
+SHA1 (Botan-2.1.0.tgz) = a754303f0fc5dc6e187dc80d1316f9fdb20cde1f
+RMD160 (Botan-2.1.0.tgz) = b736e1820aa4315095248ebdf119a5c6b493616d
+SHA512 (Botan-2.1.0.tgz) = af9ea35baf431500d380a360525e20e67dd17fdeaa442726019d544e9e423c301196cc17b09a3831f956ca9e62d7e99797f129b26fac10a653dd04e3ad1f4f4f
+Size (Botan-2.1.0.tgz) = 5073684 bytes
+SHA1 (patch-src_build-data_os_openbsd.txt) = 4b187abcca4652a780386a6817033e4b6cdeafa8
+SHA1 (patch-src_build-data_os_solaris.txt) = de351e82e261c1f9e8668ecca606f3776cfa9eb2
 SHA1 (patch-src_lib_utils_locking__allocator_info.txt) = 30dd9043e1fa7befdf6933778e5c729fcb88263d
-SHA1 (patch-src_lib_utils_os__utils.cpp) = 28298bc3b98703275dce23d1d7fcd65ff262d05f
+SHA1 (patch-src_lib_utils_os__utils.cpp) = 1b6b545c55995d0786669b1649e0913fbf0b5f3c

Index: pkgsrc/security/botan-devel/patches/patch-src_build-data_os_openbsd.txt
diff -u pkgsrc/security/botan-devel/patches/patch-src_build-data_os_openbsd.txt:1.1 pkgsrc/security/botan-devel/patches/patch-src_build-data_os_openbsd.txt:1.2
--- pkgsrc/security/botan-devel/patches/patch-src_build-data_os_openbsd.txt:1.1 Tue May 31 21:37:12 2016
+++ pkgsrc/security/botan-devel/patches/patch-src_build-data_os_openbsd.txt     Mon Apr 10 21:14:45 2017
@@ -1,14 +1,14 @@
-$NetBSD: patch-src_build-data_os_openbsd.txt,v 1.1 2016/05/31 21:37:12 joerg Exp $
+$NetBSD: patch-src_build-data_os_openbsd.txt,v 1.2 2017/04/10 21:14:45 joerg Exp $
 
---- src/build-data/os/openbsd.txt.orig 2016-05-25 21:23:16.331250012 +0000
+--- src/build-data/os/openbsd.txt.orig 2017-04-10 20:31:58.319297182 +0000
 +++ src/build-data/os/openbsd.txt
-@@ -1,5 +1,9 @@
+@@ -1,8 +1,6 @@
  os_type unix
  
-+soname_pattern_base  "libbotan-{version_major}.{version_minor}.so"
-+soname_pattern_abi   "libbotan-{version_major}.{version_minor}.so.{abi_rev}"
-+soname_pattern_patch "libbotan-{version_major}.{version_minor}.so.{abi_rev}.{version_patch}"
-+
+-soname_pattern_base  "libbotan-{version_major}.so"
+-soname_pattern_abi   "libbotan-{version_major}.so.{abi_rev}"
+-soname_pattern_patch "libbotan-{version_major}.so.{abi_rev}.{version_minor}"
++soname_suffix "so"
+ 
  <target_features>
- clock_gettime
- gettimeofday
+ arc4random
Index: pkgsrc/security/botan-devel/patches/patch-src_build-data_os_solaris.txt
diff -u pkgsrc/security/botan-devel/patches/patch-src_build-data_os_solaris.txt:1.1 pkgsrc/security/botan-devel/patches/patch-src_build-data_os_solaris.txt:1.2
--- pkgsrc/security/botan-devel/patches/patch-src_build-data_os_solaris.txt:1.1 Mon Jan 16 01:50:14 2017
+++ pkgsrc/security/botan-devel/patches/patch-src_build-data_os_solaris.txt     Mon Apr 10 21:14:45 2017
@@ -1,14 +1,12 @@
-$NetBSD: patch-src_build-data_os_solaris.txt,v 1.1 2017/01/16 01:50:14 joerg Exp $
+$NetBSD: patch-src_build-data_os_solaris.txt,v 1.2 2017/04/10 21:14:45 joerg Exp $
 
 --- src/build-data/os/solaris.txt.orig 2017-01-16 01:41:19.253492127 +0000
 +++ src/build-data/os/solaris.txt
-@@ -3,6 +3,10 @@ os_type unix
+@@ -3,6 +3,8 @@ os_type unix
  install_cmd_data '/usr/ucb/install -m 644'
  install_cmd_exec '/usr/ucb/install -m 755'
  
-+soname_pattern_base  "libbotan-{version_major}.{version_minor}.so"
-+soname_pattern_abi   "libbotan-{version_major}.{version_minor}.so.{abi_rev}"
-+soname_pattern_patch "libbotan-{version_major}.{version_minor}.so.{abi_rev}.{version_patch}"
++soname_suffix "so"
 +
  <target_features>
  posix_mlock

Index: pkgsrc/security/botan-devel/patches/patch-src_lib_utils_os__utils.cpp
diff -u pkgsrc/security/botan-devel/patches/patch-src_lib_utils_os__utils.cpp:1.4 pkgsrc/security/botan-devel/patches/patch-src_lib_utils_os__utils.cpp:1.5
--- pkgsrc/security/botan-devel/patches/patch-src_lib_utils_os__utils.cpp:1.4   Mon Jan 16 01:50:14 2017
+++ pkgsrc/security/botan-devel/patches/patch-src_lib_utils_os__utils.cpp       Mon Apr 10 21:14:45 2017
@@ -1,9 +1,9 @@
-$NetBSD: patch-src_lib_utils_os__utils.cpp,v 1.4 2017/01/16 01:50:14 joerg Exp $
+$NetBSD: patch-src_lib_utils_os__utils.cpp,v 1.5 2017/04/10 21:14:45 joerg Exp $
 
---- src/lib/utils/os_utils.cpp.orig    2016-10-26 13:39:08.000000000 +0000
+--- src/lib/utils/os_utils.cpp.orig    2017-04-05 01:09:22.000000000 +0000
 +++ src/lib/utils/os_utils.cpp
-@@ -19,6 +19,10 @@
-   #include <unistd.h>
+@@ -21,6 +21,10 @@
+   #include <setjmp.h>
  #endif
  
 +#ifdef __sun
@@ -11,11 +11,11 @@ $NetBSD: patch-src_lib_utils_os__utils.c
 +#endif
 +
  #if defined(BOTAN_TARGET_OS_IS_WINDOWS) || defined(BOTAN_TARGET_OS_IS_MINGW)
+   #define NOMINMAX 1
    #include <windows.h>
- #endif
-@@ -146,7 +150,21 @@ uint64_t get_system_timestamp_ns()
+@@ -170,7 +174,21 @@ uint64_t OS::get_system_timestamp_ns()
  
- size_t get_memory_locking_limit()
+ size_t OS::get_memory_locking_limit()
     {
 -#if defined(BOTAN_TARGET_OS_HAS_POSIX_MLOCK)
 +#if defined(__sun)