Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package signify for openSUSE:Factory checked in at 2026-05-14 21:42:22 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/signify (Old) and /work/SRC/openSUSE:Factory/.signify.new.1966 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "signify" Thu May 14 21:42:22 2026 rev:9 rq:1353053 version:33 Changes: -------- --- /work/SRC/openSUSE:Factory/signify/signify.changes 2024-03-13 22:17:03.988934156 +0100 +++ /work/SRC/openSUSE:Factory/.signify.new.1966/signify.changes 2026-05-14 21:43:06.358966539 +0200 @@ -1,0 +2,20 @@ +Tue May 12 12:33:28 UTC 2026 - Martin Hauke <[email protected]> + +- Update to version 33 + Added + * New Meson-based build system, which also works with Muon. This + is considered experimental for now, and therefore the existing + GNU Make-based one is still supported. + Changed + * Development has moved to Codeberg, with the old GitHub + repository now being a mirror. + * Try to detect whether the compiler supports the bounded + attribute via __has_attribute(), and enable its usage + automatically when available. + * Updated sources from upstream OpenBSD and libbsd 0.12.1 + Fixed + * Fix compilation issues when -Wimplicit-function-declaration is + in effect, which is the case with Clang 16 and GCC 13 (or + newer). + +------------------------------------------------------------------- Old: ---- signify-32.tar.xz signify-32.tar.xz.asc New: ---- signify-33.tar.xz signify-33.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ signify.spec ++++++ --- /var/tmp/diff_new_pack.oPg16e/_old 2026-05-14 21:43:06.970991646 +0200 +++ /var/tmp/diff_new_pack.oPg16e/_new 2026-05-14 21:43:06.974991810 +0200 @@ -1,7 +1,7 @@ # # spec file for package signify # -# Copyright (c) 2024 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -17,15 +17,14 @@ Name: signify -Version: 32 +Version: 33 Release: 0 Summary: OpenBSD tool to sign and verify signatures on files (portable version) License: BSD-3-Clause Group: Productivity/Networking/Security -URL: https://github.com/aperezdc/signify -Source0: %{url}/releases/download/v%{version}/signify-%{version}.tar.xz -Source1: %{url}/releases/download/v%{version}/signify-%{version}.tar.xz.asc -# https://github.com/aperezdc/signify/blob/master/README.md#release-signing +URL: https://codeberg.org/aperezdc/signify +Source0: https://codeberg.org/aperezdc/signify/releases/download/v%{version}/%{name}-%{version}.tar.xz +Source1: https://codeberg.org/aperezdc/signify/releases/download/v%{version}/%{name}-%{version}.tar.xz.asc Source2: %{name}.keyring BuildRequires: pkgconfig BuildRequires: pkgconfig(libbsd) >= 0.11.0 @@ -36,7 +35,7 @@ See http://www.tedunangst.com/flak/post/signify for more information. %prep -%setup -q +%autosetup %build export EXTRA_CFLAGS="%{optflags} -D_GNU_SOURCE" ++++++ signify-32.tar.xz -> signify-33.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/CHANGELOG.md new/signify-33/CHANGELOG.md --- old/signify-32/CHANGELOG.md 2024-03-06 23:41:45.136625000 +0100 +++ new/signify-33/CHANGELOG.md 2026-05-11 14:05:30.388548400 +0200 @@ -1,6 +1,23 @@ # Change Log All notable changes to this project will be documented in this file. +## [v33] - 2026-05-11 +### Added +- New [Meson](https://meson.build)-based build system, which also works with + [Muon](https://muon.build). This is considered experimental for now, and + therefore the existing GNU Make-based one is still supported. + +### Changed +- Development has [moved to Codeberg](https://codeberg.org/aperezdc/signify), + with the old GitHub repository now being a mirror. +- Try to detect whether the compiler supports the `bounded` attribute via + `__has_attribute()`, and enable its usage automatically when available. +- Updated sources from upstream OpenBSD and libbsd 0.12.1 + +### Fixed +- Fix compilation issues when `-Wimplicit-function-declaration` is in effect, + which is the case with Clang 16 and GCC 13 (or newer). + ## [v32] - 2024-03-07 ### Changed - Allow overriding the `INSTALL` Make variable to set the program used @@ -116,18 +133,19 @@ - Support using versions 0.8.2 and 0.8.3 of libbsd when `BUNDLED_LIBBSD=1` is specified. -[v32]: https://github.com/aperezdc/signify/compare/v31...v32 -[v31]: https://github.com/aperezdc/signify/compare/v30...v31 -[v30]: https://github.com/aperezdc/signify/compare/v29...v30 -[v29]: https://github.com/aperezdc/signify/compare/v28...v29 -[v28]: https://github.com/aperezdc/signify/compare/v27...v28 -[v27]: https://github.com/aperezdc/signify/compare/v26...v27 -[v26]: https://github.com/aperezdc/signify/compare/v25...v26 -[v25]: https://github.com/aperezdc/signify/compare/v24...v25 -[v24]: https://github.com/aperezdc/signify/compare/v23...v24 -[v23]: https://github.com/aperezdc/signify/compare/v22...v23 -[v22]: https://github.com/aperezdc/signify/compare/v21...v22 -[v21]: https://github.com/aperezdc/signify/compare/v20...v21 -[v20]: https://github.com/aperezdc/signify/compare/v19...v20 -[v19]: https://github.com/aperezdc/signify/compare/v18...v19 -[v18]: https://github.com/aperezdc/signify/compare/v17...v18 +[v33]: https://codeberg.org/aperezdc/signify/compare/v32...v33 +[v32]: https://codeberg.org/aperezdc/signify/compare/v31...v32 +[v31]: https://codeberg.org/aperezdc/signify/compare/v30...v31 +[v30]: https://codeberg.org/aperezdc/signify/compare/v29...v30 +[v29]: https://codeberg.org/aperezdc/signify/compare/v28...v29 +[v28]: https://codeberg.org/aperezdc/signify/compare/v27...v28 +[v27]: https://codeberg.org/aperezdc/signify/compare/v26...v27 +[v26]: https://codeberg.org/aperezdc/signify/compare/v25...v26 +[v25]: https://codeberg.org/aperezdc/signify/compare/v24...v25 +[v24]: https://codeberg.org/aperezdc/signify/compare/v23...v24 +[v23]: https://codeberg.org/aperezdc/signify/compare/v22...v23 +[v22]: https://codeberg.org/aperezdc/signify/compare/v21...v22 +[v21]: https://codeberg.org/aperezdc/signify/compare/v20...v21 +[v20]: https://codeberg.org/aperezdc/signify/compare/v19...v20 +[v19]: https://codeberg.org/aperezdc/signify/compare/v18...v19 +[v18]: https://codeberg.org/aperezdc/signify/compare/v17...v18 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/Makefile new/signify-33/Makefile --- old/signify-32/Makefile 2024-03-06 23:36:42.370278000 +0100 +++ new/signify-33/Makefile 2026-05-11 13:59:50.254855600 +0200 @@ -1,5 +1,5 @@ ################################################################## -# The following variables may be overriden in the command line: # +# The following variables may be overridden in the command line: # # # BZERO ?= MUSL ?= 0 @@ -71,7 +71,7 @@ libbsd-config.h: for i in $(patsubst conf/%.c,%,$(wildcard conf/*.c)); do \ - if $(CC) $(LDFLAGS) -o conf-$$i conf/$$i.c > /dev/null 2>&1 ; then \ + if $(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o conf-$$i conf/$$i.c > /dev/null 2>&1 ; then \ echo "#define $$i" ; \ fi ; \ $(RM) conf-$$i ; \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/README.md new/signify-33/README.md --- old/signify-32/README.md 2021-09-23 23:30:45.195191600 +0200 +++ new/signify-33/README.md 2026-04-02 23:42:38.979218200 +0200 @@ -4,9 +4,10 @@ OpenBSD tool to sign and verify signatures on files. This is a portable version which uses [libbsd](http://libbsd.freedesktop.org/wiki/) (version -0.8 or newer is required). +0.11 or newer is required). + +The **main project site** is https://codeberg.org/aperezdc/signify -See https://www.tedunangst.com/flak/post/signify for more information. ## License @@ -14,14 +15,49 @@ license](https://opensource.org/licenses/isc-license.txt). +## Project Goals + +The main goal of this project is providing a portable version of the OpenBSD +`signify` command that can be built on Linux-based systems, reusing as much +as possible from the original code. + +In particular, this means that adding new features or changing the tool in +ways that make it incompatible with the original are non-goals. + + ## Installation Some GNU/Linux distributions have readily available packages in their repositories. It is recommended to use these, unless you absolutely need to build from source code: -- Debian: `apt install signify-openbsd` +- Alpine Linux: `apk add signify` - Arch Linux: `pacman -S signify` +- Debian/Ubuntu: `apt install signify-openbsd` +- CentOS/RHEL/Rocky: `dnf install epel-release` then `dnf install signify` +- Fedora: `dnf install signify` + + +## Contributing + +Pull requests with third party contributions are welcome as long as they +keep in mind the [project goals](#project-goals). + +Development takes place [at Codeberg](https://codeberg.org/aperezdc/signify), +the GitHub repository should be treated as a mostly read-only mirror. Pull +requests from GitHub *might* be reviewed and accepted on occasion. + + +### Strict No LLM / No AI Policy + +No LLMs for issues. + +No LLMs for pull requests. + +No LLMs for comments on the bug tracker, including translation. English +is encouraged, but not required. You are welcome to post in your native +language and rely on others to have their own translation tools of choice +to interpret your words. ## Building @@ -30,7 +66,7 @@ * GNU Make (any version above 3.70). * C compiler. Both GCC and Clang are tested and supported. -* [libbsd](http://libbsd.freedesktop.org/wiki/) 0.8 or newer. +* [libbsd](http://libbsd.freedesktop.org/wiki/) 0.11 or newer. If your system does not provide a package for `libbsd`, it is possible to use a bundled copy, check the [build options](#options) section for more details. @@ -183,3 +219,5 @@ generated by Signify (generating them is not yet implemented), and can be used as a library. * [signify-rs](https://github.com/badboy/signify-rs), a re-implementation in Rust. It's fully compatible with the original implementation. +* [OpenWrt usign](https://github.com/openwrt/usign) small implementation used by OpenWrt to sign packages. It's signature format is [different](https://github.com/aperezdc/signify/pull/29) +* [Minisign](https://jedisct1.github.io/minisign/) based on libsodium [See comparision](https://github.com/aperezdc/signify/issues/20) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/base64.c new/signify-33/base64.c --- old/signify-32/base64.c 2024-03-06 23:06:05.758999800 +0100 +++ new/signify-33/base64.c 2026-05-07 02:13:49.763588400 +0200 @@ -52,6 +52,7 @@ #include <stdlib.h> #include <string.h> +#include "base64.h" static const char Base64[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; @@ -186,7 +187,7 @@ { int tarindex, state, ch; unsigned char nextbyte; - char *pos; + const char *pos; state = 0; tarindex = 0; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/base64.h new/signify-33/base64.h --- old/signify-32/base64.h 1970-01-01 01:00:00.000000000 +0100 +++ new/signify-33/base64.h 2026-04-02 23:36:17.184052700 +0200 @@ -0,0 +1,2 @@ +int b64_pton(char const *, unsigned char *, size_t); +int b64_ntop(unsigned char const *, size_t , char *, size_t); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/compat.h new/signify-33/compat.h --- old/signify-32/compat.h 2020-03-06 23:56:12.164964000 +0100 +++ new/signify-33/compat.h 2026-05-11 10:33:51.893024200 +0200 @@ -21,8 +21,16 @@ #define _GNU_SOURCE 1 #endif /* !_GNU_SOURCE */ +#if defined __has_attribute +#define COMPAT_HAS_ATTRIBUTE __has_attribute +#else +#define COMPAT_HAS_ATTRIBUTE(name) 0 +#endif + #ifndef COMPAT_BOUNDS_CHECKING +#if !COMPAT_HAS_ATTRIBUTE(bounded) #define __bounded__(a, b, c) +#endif #endif /* !COMPAT_BOUNDS_CHECKING */ #ifndef __dead @@ -56,4 +64,10 @@ extern void explicit_bzero(void *buf, size_t len); #endif /* BUNDLED_BZERO */ + +int b64_ntop(unsigned char const *src, size_t srclength, char *target, + size_t targsize); + +int b64_pton(char const *src, unsigned char *target, size_t targsize); + #endif /* !COMPAT_H */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/helper.c new/signify-33/helper.c --- old/signify-32/helper.c 2024-03-06 23:07:44.348075600 +0100 +++ new/signify-33/helper.c 2026-05-07 02:13:25.579152300 +0200 @@ -1,4 +1,4 @@ -/* $OpenBSD: helper.c,v 1.18 2019/06/28 13:32:41 deraadt Exp $ */ +/* $OpenBSD: helper.c,v 1.19 2026/03/10 16:20:57 deraadt Exp $ */ /* * Copyright (c) 2000 Poul-Henning Kamp <[email protected]> @@ -67,7 +67,7 @@ HASHInit(&ctx); - if ((fd = open(filename, O_RDONLY)) == -1) + if ((fd = open(filename, O_RDONLY|O_CLOEXEC)) == -1) return (NULL); if (len == 0) { if (fstat(fd, &sb) == -1) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/libbsd/arc4random.h new/signify-33/libbsd/arc4random.h --- old/signify-32/libbsd/arc4random.h 2024-03-06 23:27:28.226553700 +0100 +++ new/signify-33/libbsd/arc4random.h 2024-03-06 02:28:11.000000000 +0100 @@ -32,9 +32,7 @@ int getentropy(void *buf, size_t len); -#if defined(__OpenBSD__) -#include "arc4random_openbsd.h" -#elif defined(__linux__) +#if defined(__linux__) #include "arc4random_linux.h" #elif defined(_WIN32) #include "arc4random_win.h" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/libbsd/arc4random_openbsd.h new/signify-33/libbsd/arc4random_openbsd.h --- old/signify-32/libbsd/arc4random_openbsd.h 2016-09-08 20:38:33.000000000 +0200 +++ new/signify-33/libbsd/arc4random_openbsd.h 1970-01-01 01:00:00.000000000 +0100 @@ -1,61 +0,0 @@ -/* $OpenBSD: arc4random.h,v 1.3 2014/07/20 20:51:13 bcook Exp $ */ - -/* - * Copyright (c) 1996, David Mazieres <[email protected]> - * Copyright (c) 2008, Damien Miller <[email protected]> - * Copyright (c) 2013, Markus Friedl <[email protected]> - * Copyright (c) 2014, Theo de Raadt <[email protected]> - * - * Permission to use, copy, modify, and distribute this software for any - * purpose with or without fee is hereby granted, provided that the above - * copyright notice and this permission notice appear in all copies. - * - * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES - * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF - * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR - * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES - * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN - * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF - * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - */ - -/* - * Stub functions for portability. - */ -#include <sys/mman.h> - -#include <signal.h> - -#include "thread_private.h" - -static inline void -_getentropy_fail(void) -{ - raise(SIGKILL); -} - -static inline int -_rs_allocate(struct _rs **rsp, struct _rsx **rsxp) -{ - struct { - struct _rs rs; - struct _rsx rsx; - } *p; - - if ((p = mmap(NULL, sizeof(*p), PROT_READ|PROT_WRITE, - MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) - return (-1); - if (minherit(p, sizeof(*p), MAP_INHERIT_ZERO) == -1) { - munmap(p, sizeof(*p)); - return (-1); - } - - *rsp = &p->rs; - *rsxp = &p->rsx; - return (0); -} - -static inline void -_rs_forkdetect(void) -{ -} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/libbsd/progname.c new/signify-33/libbsd/progname.c --- old/signify-32/libbsd/progname.c 2024-03-06 23:23:23.484285600 +0100 +++ new/signify-33/libbsd/progname.c 2024-02-11 19:30:03.000000000 +0100 @@ -137,7 +137,7 @@ free(wpath); free(mbname); } -#elif !defined(HAVE___PROGNAME) +#else #error "Function getprogname() needs to be ported." #endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/meson.build new/signify-33/meson.build --- old/signify-32/meson.build 1970-01-01 01:00:00.000000000 +0100 +++ new/signify-33/meson.build 2026-05-11 14:06:29.478253000 +0200 @@ -0,0 +1,142 @@ +project('signify', 'c', + version: '33', + license: 'BSD-2-Clause', + meson_version: '>=1.4', +) + +cc = meson.get_compiler('c') + +compat_h_file = files('compat.h')[0] +cc.has_multi_arguments('-include', compat_h_file.full_path(), required: true) +signify_cflags = ['-include', compat_h_file.full_path()] + +sed_exe = find_program(['sed', 'gsed'], native: true, required: true) + +signify_extra_sources = [ + custom_target( + output: 'sha256hl.c', + input: 'helper.c', + capture: true, + command: [sed_exe, + '-e', 's/hashinc/sha2.h/g', + '-e', 's/HASH_CTX/SHA2_CTX/g', + '-e', 's/HASH/SHA256/g', + '@INPUT@', + ], + ), + custom_target( + output: 'sha512hl.c', + input: 'helper.c', + capture: true, + command: [sed_exe, + '-e', 's/hashinc/sha2.h/g', + '-e', 's/HASH_CTX/SHA2_CTX/g', + '-e', 's/HASH/SHA512/g', + '@INPUT@', + ], + ), + custom_target( + output: 'sha512_256hl.c', + input: 'helper.c', + capture: true, + command: [sed_exe, + '-e', 's/hashinc/sha2.h/g', + '-e', 's/HASH_CTX/SHA2_CTX/g', + '-e', 's/HASH/SHA512_256/g', + '@INPUT@', + ], + ), +] + +bundled_libbsd = get_option('bundled_libbsd') +libbsd_dep = disabler() + +if not bundled_libbsd.enabled() + libbsd_dep = dependency('libbsd-overlay', version: '>=0.11', required: bundled_libbsd.disabled()) +endif + +if not libbsd_dep.found() and not bundled_libbsd.disabled() + libbsdbundled_feature_flags = [] + foreach item : ['__PROGNAME', 'GETEXECNAME', 'PROGRAM_INVOCATION_SHORT_NAME'] + if cc.links(files('conf/HAVE_' + item + '.c'), args: signify_cflags) + libbsdbundled_feature_flags += ['-DHAVE_' + item] + endif + endforeach + libbsdbundled_flags = ['-DLIBBSD_OVERLAY'] + libbsdbundled_inc = include_directories('libbsd/bsd', is_system: true) + libbsdbundled_lib = static_library('libbsdbundled', + 'libbsd/arc4random.c', + 'libbsd/freezero.c', + 'libbsd/progname.c', + 'libbsd/readpassphrase.c', + 'libbsd/strlcpy.c', + include_directories: libbsdbundled_inc, + c_args: signify_cflags + libbsdbundled_feature_flags + libbsdbundled_flags, + ) + libbsd_dep = declare_dependency( + include_directories: libbsdbundled_inc, + compile_args: libbsdbundled_flags, + link_with: libbsdbundled_lib, + ) +endif + +signify_dependencies = [libbsd_dep] + +if not cc.has_function('explicit_bzero', prefix: '#include <string.h>') + signify_extra_sources += ['explicit_bzero.c'] + signify_cflags += ['-DBUNDLED_BZERO'] +endif + +if get_option('waive').enabled() + libwaive_lib = static_library('libwaive', + 'libwaive/waive.c', + dependencies: dependency('libseccomp', required: true), + ) + libwaive_dep = declare_dependency( + link_with: libwaive_lib, + include_directories: include_directories('libwaive'), + ) + signify_dependencies += [libwaive_dep] + signify_extra_sources += ['pledge_waive.c'] +else + signify_extra_sources += ['pledge_noop.c'] +endif + +libsignifynowarn_lib = static_library('libsignify_nowarn', + 'signify.c', + 'bcrypt_pbkdf.c', + 'zsig.c', + c_args: signify_cflags + cc.get_supported_arguments('-Wno-pointer-sign'), + dependencies: signify_dependencies, + install: false, +) + +signify_exe = executable('signify', + 'base64.c', + 'blowfish.c', + 'crypto_api.c', + 'fe25519.c', + 'mod_ed25519.c', + 'mod_ge25519.c', + 'ohash.c', + 'sc25519.c', + 'sha2.c', + 'timingsafe_bcmp.c', + signify_extra_sources, + c_args: signify_cflags, + dependencies: signify_dependencies, + link_with: libsignifynowarn_lib, + install: true, + build_by_default: true, +) + +install_man('signify.1') + +test('regress', + files('regress/run'), + depends: signify_exe, + is_parallel: false, + env: { + 'SIGNIFY_EXE_PATH': signify_exe.full_path(), + }, +) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/meson.options new/signify-33/meson.options --- old/signify-32/meson.options 1970-01-01 01:00:00.000000000 +0100 +++ new/signify-33/meson.options 2026-05-11 10:15:40.751525200 +0200 @@ -0,0 +1,10 @@ +option('bundled_libbsd', + type: 'feature', + value: 'disabled', + description: 'Use bundled copies of libbsd functions' +) +option('waive', + type: 'feature', + value: 'disabled', + description: 'Use libwaive to implement pledge()' +) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/regress/run new/signify-33/regress/run --- old/signify-32/regress/run 2020-01-15 23:04:36.134340000 +0100 +++ new/signify-33/regress/run 2026-05-11 10:47:48.440927000 +0200 @@ -47,7 +47,7 @@ # Point to the locally-built signify program signify () { echo " - signify $* ..." 1>&2 - "../../signify" "$@" + "${SIGNIFY_EXE_PATH:-../../signify}" "$@" } # Harness configured. Go! diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/signify.1 new/signify-33/signify.1 --- old/signify-32/signify.1 2024-03-06 23:06:18.624271200 +0100 +++ new/signify-33/signify.1 2026-05-07 01:28:13.392758000 +0200 @@ -1,4 +1,4 @@ -.\" $OpenBSD: signify.1,v 1.59 2024/03/02 23:38:00 benno Exp $ +.\" $OpenBSD: signify.1,v 1.63 2026/03/11 02:27:20 deraadt Exp $ .\" .\"Copyright (c) 2013 Marc Espie <[email protected]> .\"Copyright (c) 2013 Ted Unangst <[email protected]> @@ -14,7 +14,7 @@ .\"WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN .\"ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\"OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -.Dd $Mdocdate: March 2 2024 $ +.Dd $Mdocdate: March 11 2026 $ .Dt SIGNIFY 1 .Os .Sh NAME @@ -171,12 +171,12 @@ .Pa SHA256.sig and a full set of release files: .Bd -literal -offset indent -compact -$ signify -C -p /etc/signify/openbsd-76-base.pub -x SHA256.sig +$ signify -C -p /etc/signify/openbsd-80-base.pub -x SHA256.sig .Ed .Pp Verify a bsd.rd before an upgrade: .Bd -literal -offset indent -compact -$ signify -C -p /etc/signify/openbsd-76-base.pub -x SHA256.sig bsd.rd +$ signify -C -p /etc/signify/openbsd-80-base.pub -x SHA256.sig bsd.rd .Ed .Pp Sign a gzip archive: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/signify.c new/signify-33/signify.c --- old/signify-32/signify.c 2024-03-06 23:07:44.350075700 +0100 +++ new/signify-33/signify.c 2026-05-07 02:13:25.580152300 +0200 @@ -1,4 +1,4 @@ -/* $OpenBSD: signify.c,v 1.136 2022/08/26 00:24:56 kn Exp $ */ +/* $OpenBSD: signify.c,v 1.137 2025/05/20 01:03:56 tedu Exp $ */ /* * Copyright (c) 2013 Ted Unangst <[email protected]> * @@ -34,6 +34,7 @@ #include "sha2.h" #include "crypto_api.h" +#include "base64.h" #include "signify.h" #define SIGBYTES crypto_sign_ed25519_BYTES @@ -347,7 +348,7 @@ sizeof(pubkey), O_EXCL, 0666); } -static const char * +const char * check_keyname_compliance(const char *pubkeyfile, const char *seckeyfile) { const char *pos; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/signify.h new/signify-33/signify.h --- old/signify-32/signify.h 2024-03-06 23:06:17.220241500 +0100 +++ new/signify-33/signify.h 2026-05-07 01:28:09.581685500 +0200 @@ -1,4 +1,4 @@ -/* $OpenBSD: signify.h,v 1.2 2019/03/23 07:10:06 tedu Exp $ */ +/* $OpenBSD: signify.h,v 1.3 2025/05/20 01:03:56 tedu Exp $ */ /* * Copyright (c) 2016 Marc Espie <[email protected]> * @@ -21,6 +21,8 @@ extern void zverify(const char *, const char *, const char *, const char *); extern void zsign(const char *, const char *, const char *, int); +extern const char *check_keyname_compliance(const char *, const char *); + extern void *xmalloc(size_t); extern void writeall(int, const void *, size_t, const char *); extern int xopen(const char *, int, mode_t); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/src-files new/signify-33/src-files --- old/signify-32/src-files 1970-01-01 01:00:00.000000000 +0100 +++ new/signify-33/src-files 2026-05-07 01:27:26.585867600 +0200 @@ -0,0 +1,27 @@ +include/blf.h +include/sha2.h + +lib/libc/crypt/blowfish.c +lib/libc/hash/sha2.c +lib/libc/hash/helper.c +lib/libc/net/base64.c +lib/libc/string/timingsafe_bcmp.c + +lib/libutil/ohash.h +lib/libutil/ohash.c +lib/libutil/bcrypt_pbkdf.c + +usr.bin/signify/crypto_api.c +usr.bin/signify/crypto_api.h +usr.bin/signify/fe25519.c +usr.bin/signify/fe25519.h +usr.bin/signify/ge25519.h +usr.bin/signify/ge25519_base.data +usr.bin/signify/mod_ed25519.c +usr.bin/signify/mod_ge25519.c +usr.bin/signify/sc25519.c +usr.bin/signify/sc25519.h +usr.bin/signify/signify.h +usr.bin/signify/signify.c +usr.bin/signify/signify.1 +usr.bin/signify/zsig.c diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/update-src-files new/signify-33/update-src-files --- old/signify-32/update-src-files 1970-01-01 01:00:00.000000000 +0100 +++ new/signify-33/update-src-files 2026-05-07 02:12:39.822942700 +0200 @@ -0,0 +1,21 @@ +#! /bin/bash +# +# update-src-files +# Copyright (C) 2014, 2026 Adrian Perez <[email protected]> +# +# Distributed under terms of the MIT license. +# +set -e + +: ${BASE_URL:='https://raw.githubusercontent.com/openbsd/src/master'} + +while read -r filepath ; do + if [[ -z $filepath ]] ; then + continue + fi + sleeptime=$(( RANDOM % 2 )).$(( RANDOM % 10 )) + echo "[32;1m*[0;0m $BASE_URL/[0;0m[1;1m${filepath}[0;0m +${sleeptime}s" + curl -\# -LJO "$BASE_URL/$filepath" + sleep "$sleeptime" +done + diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/signify-32/zsig.c new/signify-33/zsig.c --- old/signify-32/zsig.c 2024-03-06 23:07:44.350075700 +0100 +++ new/signify-33/zsig.c 2026-05-07 02:13:25.580152300 +0200 @@ -1,4 +1,4 @@ -/* $OpenBSD: zsig.c,v 1.19 2023/04/29 10:08:18 espie Exp $ */ +/* $OpenBSD: zsig.c,v 1.20 2025/05/20 01:03:56 tedu Exp $ */ /* * Copyright (c) 2016 Marc Espie <[email protected]> * @@ -274,7 +274,7 @@ "key=%s\n" "algorithm=SHA512/256\n" "blocksize=%zu\n\n", - date, seckeyfile, bufsize); + date, check_keyname_compliance(NULL, seckeyfile), bufsize); p = strchr(msg, 0); while (1) {
