On 2026/10/22 05:20, Stuart Lamble wrote: > > > On Wed, Oct 21, 2026, at 20:53, Stuart Henderson wrote: > > On 2026/10/21 13:50, Stuart Lamble wrote: > >> Currently, OpenBSD only has botan2 in the ports tree. This went end of > >> life at the start of 2025. As part of my work to get patches into the > >> upstream for Kea, I was told that botan3 will be required very soon for > >> RADIUS support, so I've done some preliminary work to that end (see > >> attached tarball, intended to be unpacked into /usr/ports/security.) This > >> is based on the existing botan2 port as a starting point. There are likely > >> to be artefacts from that; this is very much an unpolished first cut. > > > > cc bluhm (botan2 maintainer), I wonder if you're interested in > > taking maintainer of this as well (no problem if not, I thought it > > would be polite to ask). > > For the record, I approached bluhm off the mailing list to ask if he had > plans to package botan3; he indicated no, hence my taking it on like this. > (Absolutely no criticism from me; this is volunteer work, and there was no > expectation in my query. I simply wanted to make sure that I wasn’t going to > duplicate effort.) > > >> - I am uncertain about several of the patches from botan2 (in the > >> patches_orig directory): they appear to be patching CPU capability checks > >> for ARM and PPC, but I am not confident enough in my reading of the > >> upstream code to know whether they are still necessary. I don't THINK they > >> are, but I can't swear to it. > > > > these were committed upstream, but directory layout changed. > > I did find the new locations and did some digging to try to figure out if the > patches were still needed; my checks said no, but my confidence in that > assessment was not high enough to let it stand without a verification from > others. Thank you. > > >> - I am not certain what to do about the build-data/os/openbsd.txt patch. > >> I can get it to apply cleanly if I remove the elf_aux_info addition, but > >> I'm certain that it's not quite correct. I'd appreciate some commentary > >> from the more seasoned hands here. > > > > new tgz attached adapts this for botan-3. > > Thanks. I haven’t looked at it yet, but will do so soon. > > > I've checked build, packaging and make test (all tests succeed) on > > i386 amd64 aarch64. > > > > The only thing I see searching for it in bulk build so far is Kea and > > I can take care of that. > > Unless botan2 is going to be removed as part of the commit, I don’t think Kea > needs to be updated to use this immediately. The next release from ISC is > probably soon enough. (And if that release is 3.4, there’s a decent chance > that the Kea port will need to have some of its patches removed to reflect > fixes that are being pushed upstream.)
It does need to be handled one way or another, if it's imported then we need to make sure Kea either explicitly uses it, or explicitly sticks to botan2, so we don't distribute packages with wrong dependency information if a build machine just happens to have it installed when Kea is built. > Thanks again for the feedback, it’s appreciated.
