On Wed, Oct 21, 2026, at 20:53, Stuart Henderson wrote:
> On 2026/10/21 13:50, Stuart Lamble wrote:
>> Currently, OpenBSD only has botan2 in the ports tree. This went end of life
>> at the start of 2025. As part of my work to get patches into the upstream
>> for Kea, I was told that botan3 will be required very soon for RADIUS
>> support, so I've done some preliminary work to that end (see attached
>> tarball, intended to be unpacked into /usr/ports/security.) This is based on
>> the existing botan2 port as a starting point. There are likely to be
>> artefacts from that; this is very much an unpolished first cut.
>
> cc bluhm (botan2 maintainer), I wonder if you're interested in
> taking maintainer of this as well (no problem if not, I thought it
> would be polite to ask).
For the record, I approached bluhm off the mailing list to ask if he had plans
to package botan3; he indicated no, hence my taking it on like this.
(Absolutely no criticism from me; this is volunteer work, and there was no
expectation in my query. I simply wanted to make sure that I wasn’t going to
duplicate effort.)
>> - I am uncertain about several of the patches from botan2 (in the
>> patches_orig directory): they appear to be patching CPU capability checks
>> for ARM and PPC, but I am not confident enough in my reading of the upstream
>> code to know whether they are still necessary. I don't THINK they are, but I
>> can't swear to it.
>
> these were committed upstream, but directory layout changed.
I did find the new locations and did some digging to try to figure out if the
patches were still needed; my checks said no, but my confidence in that
assessment was not high enough to let it stand without a verification from
others. Thank you.
>> - I am not certain what to do about the build-data/os/openbsd.txt patch. I
>> can get it to apply cleanly if I remove the elf_aux_info addition, but I'm
>> certain that it's not quite correct. I'd appreciate some commentary from the
>> more seasoned hands here.
>
> new tgz attached adapts this for botan-3.
Thanks. I haven’t looked at it yet, but will do so soon.
> I've checked build, packaging and make test (all tests succeed) on
> i386 amd64 aarch64.
>
> The only thing I see searching for it in bulk build so far is Kea and
> I can take care of that.
Unless botan2 is going to be removed as part of the commit, I don’t think Kea
needs to be updated to use this immediately. The next release from ISC is
probably soon enough. (And if that release is 3.4, there’s a decent chance that
the Kea port will need to have some of its patches removed to reflect fixes
that are being pushed upstream.)
Thanks again for the feedback, it’s appreciated.
