CVS commit: pkgsrc/security/libsodium

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/security/libsodium
From: "Adam Ciarcinski" <adam%netbsd.org@localhost>
Date: Thu, 8 Jan 2026 14:54:46 +0000

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Jan  8 14:54:46 UTC 2026

Modified Files:
        pkgsrc/security/libsodium: Makefile PLIST distinfo
Added Files:
        pkgsrc/security/libsodium/patches:
            patch-src_libsodium_crypto__ipcrypt_crypto_ipcrypt.c
            patch-src_libsodium_crypto__ipcrypt_ipcrypt__armcrypto.c
            patch-src_libsodium_include_sodium_crypto__ipcrypt.h
Removed Files:
        pkgsrc/security/libsodium/patches:
            patch-src_libsodium_crypto__core_ed25519_ref10_ed25519__ref10.c
            patch-test_default_core__ed25519.c

Log Message:
libsodium: updated to 1.0.21

* Version 1.0.21-stable
 - Export missing crypto_ipcrypt_nd_keygen() helper function.
 - Fixed compilation with GCC on aarch64.

* Version 1.0.21
  This point release includes all the changes from 1.0.20-stable, which
include a security fix for the `crypto_core_ed25519_is_valid_point()`
function, as well as two new sets of functions:
 - The new `crypto_ipcrypt_*` functions implement mechanisms for securely
encrypting and anonymizing IP addresses as specified in https://ipcrypt-std.github.io
 - The `sodium_bin2ip` and `sodium_ip2bin` helper functions have been added
to complement the `crypto_ipcrypt_*` functions and easily convert addresses
between bytes and strings.
 - XOF: the `crypto_xof_shake*` and `crypto_xof_turboshake*` functions
are standard extendable output functions. From input of any length, they can
derive output of any length with the same properties as hash functions. These
primitives are required by many post-quantum mechanisms, but can also be used
for a wide range of applications, including key derivation, session encryption
and more.


To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 pkgsrc/security/libsodium/Makefile
cvs rdiff -u -r1.11 -r1.12 pkgsrc/security/libsodium/PLIST
cvs rdiff -u -r1.20 -r1.21 pkgsrc/security/libsodium/distinfo
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/libsodium/patches/patch-src_libsodium_crypto__core_ed25519_ref10_ed25519__ref10.c \
    pkgsrc/security/libsodium/patches/patch-test_default_core__ed25519.c
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/security/libsodium/patches/patch-src_libsodium_crypto__ipcrypt_crypto_ipcrypt.c \
    pkgsrc/security/libsodium/patches/patch-src_libsodium_crypto__ipcrypt_ipcrypt__armcrypto.c \
    pkgsrc/security/libsodium/patches/patch-src_libsodium_include_sodium_crypto__ipcrypt.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/libsodium/Makefile
diff -u pkgsrc/security/libsodium/Makefile:1.18 pkgsrc/security/libsodium/Makefile:1.19
--- pkgsrc/security/libsodium/Makefile:1.18     Wed Dec 31 00:13:22 2025
+++ pkgsrc/security/libsodium/Makefile  Thu Jan  8 14:54:45 2026
@@ -1,12 +1,11 @@
-# $NetBSD: Makefile,v 1.18 2025/12/31 00:13:22 wiz Exp $
+# $NetBSD: Makefile,v 1.19 2026/01/08 14:54:45 adam Exp $
 
-DISTNAME=      libsodium-1.0.20
-PKGREVISION=   1
+DISTNAME=      libsodium-1.0.21
 CATEGORIES=    security
 MASTER_SITES=  https://download.libsodium.org/libsodium/releases/
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
-HOMEPAGE=      https://download.libsodium.org/doc/
+HOMEPAGE=      https://doc.libsodium.org/
 COMMENT=       Library for build higher-level cryptographic tools
 LICENSE=       isc
 

Index: pkgsrc/security/libsodium/PLIST
diff -u pkgsrc/security/libsodium/PLIST:1.11 pkgsrc/security/libsodium/PLIST:1.12
--- pkgsrc/security/libsodium/PLIST:1.11        Mon Sep 18 12:38:21 2023
+++ pkgsrc/security/libsodium/PLIST     Thu Jan  8 14:54:45 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.11 2023/09/18 12:38:21 adam Exp $
+@comment $NetBSD: PLIST,v 1.12 2026/01/08 14:54:45 adam Exp $
 include/sodium.h
 include/sodium/core.h
 include/sodium/crypto_aead_aegis128l.h
@@ -16,6 +16,7 @@ include/sodium/crypto_box_curve25519xsal
 include/sodium/crypto_core_ed25519.h
 include/sodium/crypto_core_hchacha20.h
 include/sodium/crypto_core_hsalsa20.h
+include/sodium/crypto_core_keccak1600.h
 include/sodium/crypto_core_ristretto255.h
 include/sodium/crypto_core_salsa20.h
 include/sodium/crypto_core_salsa2012.h
@@ -25,6 +26,7 @@ include/sodium/crypto_generichash_blake2
 include/sodium/crypto_hash.h
 include/sodium/crypto_hash_sha256.h
 include/sodium/crypto_hash_sha512.h
+include/sodium/crypto_ipcrypt.h
 include/sodium/crypto_kdf.h
 include/sodium/crypto_kdf_blake2b.h
 include/sodium/crypto_kdf_hkdf_sha256.h
@@ -59,6 +61,10 @@ include/sodium/crypto_stream_xsalsa20.h
 include/sodium/crypto_verify_16.h
 include/sodium/crypto_verify_32.h
 include/sodium/crypto_verify_64.h
+include/sodium/crypto_xof_shake128.h
+include/sodium/crypto_xof_shake256.h
+include/sodium/crypto_xof_turboshake128.h
+include/sodium/crypto_xof_turboshake256.h
 include/sodium/export.h
 include/sodium/randombytes.h
 include/sodium/randombytes_internal_random.h

Index: pkgsrc/security/libsodium/distinfo
diff -u pkgsrc/security/libsodium/distinfo:1.20 pkgsrc/security/libsodium/distinfo:1.21
--- pkgsrc/security/libsodium/distinfo:1.20     Wed Dec 31 00:13:22 2025
+++ pkgsrc/security/libsodium/distinfo  Thu Jan  8 14:54:45 2026
@@ -1,7 +1,8 @@
-$NetBSD: distinfo,v 1.20 2025/12/31 00:13:22 wiz Exp $
+$NetBSD: distinfo,v 1.21 2026/01/08 14:54:45 adam Exp $
 
-BLAKE2s (libsodium-1.0.20.tar.gz) = 162c6d74f9a570caeffbd251dad3fa26d73d6678ba20366c86e69bc656fe968a
-SHA512 (libsodium-1.0.20.tar.gz) = 7ea165f3c1b1609790e30a16348b9dfdc5731302da00c07c65e125c8ab115c75419a5631876973600f8a4b560ca2c8267001770b68f2eb3eebc9ba095d312702
-Size (libsodium-1.0.20.tar.gz) = 1925167 bytes
-SHA1 (patch-src_libsodium_crypto__core_ed25519_ref10_ed25519__ref10.c) = 9350573d632205a3e9d5a82d01b1f35251d09460
-SHA1 (patch-test_default_core__ed25519.c) = b5e65c874d34332639e339b5257c2bb84a841b97
+BLAKE2s (libsodium-1.0.21.tar.gz) = c991d247e9005e1c58d21fbdf8ab1dc88d25a2776fdaadf781ff10ec763afb58
+SHA512 (libsodium-1.0.21.tar.gz) = ee8cc2f3f5707b172bf75d8c04afbd5f0c83c6f94dbab3f988f07aab716d96f1662556a59e09b3d83c3bd5c22f59327ad95937bf499d523c86146f4df830f777
+Size (libsodium-1.0.21.tar.gz) = 2046164 bytes
+SHA1 (patch-src_libsodium_crypto__ipcrypt_crypto_ipcrypt.c) = 035a877dd85e5d3cb58586197a2304c95ba73372
+SHA1 (patch-src_libsodium_crypto__ipcrypt_ipcrypt__armcrypto.c) = 3a2eae33de58554b567043199825516c358087d5
+SHA1 (patch-src_libsodium_include_sodium_crypto__ipcrypt.h) = c1aabe3d4ba6e9c701fd2178ebcc217d3d4bd055

Added files:

Index: pkgsrc/security/libsodium/patches/patch-src_libsodium_crypto__ipcrypt_crypto_ipcrypt.c
diff -u /dev/null pkgsrc/security/libsodium/patches/patch-src_libsodium_crypto__ipcrypt_crypto_ipcrypt.c:1.1
--- /dev/null   Thu Jan  8 14:54:46 2026
+++ pkgsrc/security/libsodium/patches/patch-src_libsodium_crypto__ipcrypt_crypto_ipcrypt.c      Thu Jan  8 14:54:46 2026
@@ -0,0 +1,19 @@
+$NetBSD: patch-src_libsodium_crypto__ipcrypt_crypto_ipcrypt.c,v 1.1 2026/01/08 14:54:46 adam Exp $
+
+Export missing crypto_ipcrypt_nd_keygen() helper function.
+
+--- src/libsodium/crypto_ipcrypt/crypto_ipcrypt.c      2026-01-06 14:42:08.000000000 +0000
++++ src/libsodium/crypto_ipcrypt/crypto_ipcrypt.c
+@@ -99,6 +99,12 @@ crypto_ipcrypt_keygen(unsigned char k[cr
+ }
+ 
+ void
++crypto_ipcrypt_nd_keygen(unsigned char k[crypto_ipcrypt_ND_KEYBYTES])
++{
++    randombytes_buf(k, crypto_ipcrypt_ND_KEYBYTES);
++}
++
++void
+ crypto_ipcrypt_ndx_keygen(unsigned char k[crypto_ipcrypt_NDX_KEYBYTES])
+ {
+     randombytes_buf(k, crypto_ipcrypt_NDX_KEYBYTES);
Index: pkgsrc/security/libsodium/patches/patch-src_libsodium_crypto__ipcrypt_ipcrypt__armcrypto.c
diff -u /dev/null pkgsrc/security/libsodium/patches/patch-src_libsodium_crypto__ipcrypt_ipcrypt__armcrypto.c:1.1
--- /dev/null   Thu Jan  8 14:54:46 2026
+++ pkgsrc/security/libsodium/patches/patch-src_libsodium_crypto__ipcrypt_ipcrypt__armcrypto.c  Thu Jan  8 14:54:46 2026
@@ -0,0 +1,34 @@
+$NetBSD: patch-src_libsodium_crypto__ipcrypt_ipcrypt__armcrypto.c,v 1.1 2026/01/08 14:54:46 adam Exp $
+
+Fixed compilation with GCC on aarch64.
+
+--- src/libsodium/crypto_ipcrypt/ipcrypt_armcrypto.c   2026-01-06 14:42:08.000000000 +0000
++++ src/libsodium/crypto_ipcrypt/ipcrypt_armcrypto.c
+@@ -37,7 +37,7 @@ typedef uint64x2_t BlockVec;
+ #    define XOR128_3(a, b, c) veorq_u64(veorq_u64((a), (b)), (c))
+ #    define SET64x2(a, b)     vsetq_lane_u64((uint64_t) (a), vmovq_n_u64((uint64_t) (b)), 1)
+ #    define BYTESHL128(a, b) \
+-        vreinterpretq_u64_u8(vextq_s8(vdupq_n_s8(0), vreinterpretq_s8_u64(a), 16 - (b)))
++        vreinterpretq_u64_u8(vextq_u8(vdupq_n_u8(0), vreinterpretq_u8_u64(a), 16 - (b)))
+ 
+ #    define AES_XENCRYPT(block_vec, rkey) \
+         vreinterpretq_u64_u8(             \
+@@ -348,12 +348,12 @@ pfx_set_bit(uint8_t ip16[16], const unsi
+ static void
+ pfx_shift_left(uint8_t ip16[16])
+ {
+-    BlockVec       v       = LOAD128(ip16);
+-    const BlockVec shl     = vshlq_n_u8(vreinterpretq_u8_u64(v), 1);
+-    const BlockVec msb     = vshrq_n_u8(vreinterpretq_u8_u64(v), 7);
+-    const BlockVec zero    = vdupq_n_u8(0);
+-    const BlockVec carries = vextq_u8(vreinterpretq_u8_u64(msb), zero, 1);
+-    v                      = vreinterpretq_u64_u8(vorrq_u8(shl, carries));
++    BlockVec         v       = LOAD128(ip16);
++    const uint8x16_t shl     = vshlq_n_u8(vreinterpretq_u8_u64(v), 1);
++    const uint8x16_t msb     = vshrq_n_u8(vreinterpretq_u8_u64(v), 7);
++    const uint8x16_t zero    = vdupq_n_u8(0);
++    const uint8x16_t carries = vextq_u8(msb, zero, 1);
++    v                        = vreinterpretq_u64_u8(vorrq_u8(shl, carries));
+     STORE128(ip16, v);
+ }
+ 
Index: pkgsrc/security/libsodium/patches/patch-src_libsodium_include_sodium_crypto__ipcrypt.h
diff -u /dev/null pkgsrc/security/libsodium/patches/patch-src_libsodium_include_sodium_crypto__ipcrypt.h:1.1
--- /dev/null   Thu Jan  8 14:54:46 2026
+++ pkgsrc/security/libsodium/patches/patch-src_libsodium_include_sodium_crypto__ipcrypt.h      Thu Jan  8 14:54:46 2026
@@ -0,0 +1,17 @@
+$NetBSD: patch-src_libsodium_include_sodium_crypto__ipcrypt.h,v 1.1 2026/01/08 14:54:46 adam Exp $
+
+Export missing crypto_ipcrypt_nd_keygen() helper function.
+
+--- src/libsodium/include/sodium/crypto_ipcrypt.h      2026-01-06 14:42:08.000000000 +0000
++++ src/libsodium/include/sodium/crypto_ipcrypt.h
+@@ -64,6 +64,10 @@ SODIUM_EXPORT
+ void crypto_ipcrypt_keygen(unsigned char k[crypto_ipcrypt_KEYBYTES]) __attribute__((nonnull));
+ 
+ SODIUM_EXPORT
++void crypto_ipcrypt_nd_keygen(unsigned char k[crypto_ipcrypt_ND_KEYBYTES])
++    __attribute__((nonnull));
++
++SODIUM_EXPORT
+ void crypto_ipcrypt_ndx_keygen(unsigned char k[crypto_ipcrypt_NDX_KEYBYTES])
+     __attribute__((nonnull));
+

Prev by Date: CVS commit: pkgsrc/converters/php-mbstring
Next by Date: CVS commit: pkgsrc/security/libsodium
Previous by Thread: CVS commit: pkgsrc/converters/php-mbstring
Next by Thread: CVS commit: pkgsrc/security/libsodium
Indexes:

Home | Main Index | Thread Index | Old Index