| Newsgroups |
gmane.os.netbsd.devel.pkgsrc.bugs |
| Message-ID |
<[email protected]> |
>Number: 60509
>Category: pkg
>Synopsis: comms/kermit: update to 11.0.504
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: pkg-manager
>State: open
>Class: change-request
>Submitter-Id: net
>Arrival-Date: Mon Jul 27 01:00:00 +0000 2026
>Originator: John Goerzen
>Release: pkgsrc trunk, built and tested on NetBSD 11.0_RC5/amd64
>Organization:
>Environment:
NetBSD anyvm.org 11.0_RC5 NetBSD 11.0_RC5 (GENERIC) #0: Tue Jun 16 15:48:07 UTC 2026 [email protected]:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
This is a request to update C-Kermit to version 11.0, along with a patch to do so.
C-Kermit 9.0.302 contains a number of bugs which have been fixed in C-Kermit 11.0. Among them:
- CVE-2025-68920, a remote file overwrite vulnerability
- Insecure defaults permitting a malicious remote server to do things like change the local working directory
- MAIL/PRINT handling disabled by default due to shell escaping issues
- Two potential data corruption bugs
- Numerous potential buffer overruns and unbounded writes eliminated
- A number of race conditions, some impacting NetBSD particularly
C-Kermit's long-time maintainer, Frank da Cruz, retired after over 40 years of maintaining C-Kermit. I set up openkermit.org to continue the development of C-Kermit. Version 11 is the first non-beta C-Kermit release since the 9.0 series, which NetBSD previously carried. Of particular note: I wrote a test suite for C-Kermit, which runs two different builds on NetBSD (both with and without SSL support). My upstream CI process builds NetBSD binaries as an official target, and these tests and builds have led to the discovery and fix of a number of NetBSD bugs, some going back 20 years.
I have reviewed the patches carried in pkgsrc. They can all be dropped at this time, and my patch below does so. A large modernization effort began in the C-Kermit 10beta series, and continued in the development for 11. For instance, OpenSSL 3.x support, latest gcc support, and more flexible makefile (with more autodetection) have all been integrated upstream.
FYI - this patch drops Kerberos support. Kerberos is in C-Kermit for use with telnet authentication. It has been a neglected corner of the codebase for well over a decade now (since before even the 9.0.302 that is currently carried in NetBSD) and doesn't seem to have any active users. Telnet itself has been largely deprecated in security-sensitive settings. C-Kermit supports ssh, but delegates all the ssh functions to the external ssh binary, so authentication with ssh (including Kerberos, if relevant) supports whatever ssh does. Due to the difficulty of establishing a testing environment for Kerberos and lack of users for it, as upstream, I can't vouch for its stability (and it seems to presently have compilation issues on some platforms, including this one.) As the 11.0.x series pr
ogresses and I continue to work to audit and simplify the code, I will either deprecate or focus on Kerberos support, and will send in a new patch if I wind up able to support it.
For users that really do need Kerberos with telnet, C-Kermit can drive the telnet binary over a pty in the same manner as it does the ssh binary, allowing people to continue to use C-Kermit with Kerberos if desired.
Finally, I would just like to mention that as upstream, my goal is for C-Kermit to compile without patches for all platforms, including NetBSD. If you find patches are necessary in the future, please let me know as I would like to integrate changes upstream wherever possible.
>How-To-Repeat:
A more extensive list of bugs fixed in C-Kermit 11 can be found at https://www.openkermit.org/ckermit/changelog/ . If you search for "NetBSD" on that page, you will find reports of the bugs specifically found on NetBSD. (Note that many other bug fixes are also relevant on NetBSD, especially the security ones.)
>Fix:
Here is a blurb for doc/CHANGES-YYYY:
kermit: update to 11.0.504
Update from the long-stale kermit-9.0.302 (2011) to the current
upstream release. Upstream moved to openkermit.org and
https://github.com/OpenKermit/ckermit; switch MASTER_SITES
accordingly. Drop all local patches; their fixes are now upstream
or the underlying problem no longer applies to this source (see below).
Here is a patch:
--- a/comms/kermit/Makefile
+++ b/comms/kermit/Makefile
@@ -1,13 +1,12 @@
# $NetBSD: Makefile,v 1.99 2023/10/24 22:08:25 wiz Exp $
-DISTNAME= cku302
-PKGNAME= kermit-9.0.302
-PKGREVISION= 14
+DISTNAME= ckermit-${PKGVERSION_NOREV}
+PKGNAME= kermit-11.0.504
CATEGORIES= comms
-MASTER_SITES= ftp://ftp.kermitproject.org/kermit/archives/
-
+MASTER_SITES= https://github.com/OpenKermit/ckermit/archive/refs/tags/
+DISTFILES= v${PKGVERSION_NOREV}${EXTRACT_SUFX}
MAINTAINER= [email protected]
-HOMEPAGE= https://www.kermitproject.org/
+HOMEPAGE= https://www.openkermit.org/
COMMENT= Network and serial communication, file transfer, and scripting utility
# UNIX C-Kermit 9.0 has been released with the Revised 3-Clause BSD License.
@@ -16,7 +15,6 @@ LICENSE= modified-bsd
.include "../../mk/bsd.prefs.mk"
-WRKSRC= ${WRKDIR}
DIST_SUBDIR= ${PKGNAME_NOREV}
BUILD_DEFS+= KFLAGS LIBS MANINSTALL
MAKE_ENV+= KFLAGS=${KFLAGS:Q} LIBS=${LIBS:Q}
@@ -34,10 +32,63 @@ INSTALLATION_DIRS= bin ${PKGMANDIR}/man1 share/doc/kermit
do-install:
${INSTALL_PROGRAM} ${WRKSRC}/wermit ${DESTDIR}${PREFIX}/bin/kermit
- ${INSTALL_DATA} ${WRKSRC}/*.txt ${DESTDIR}${PREFIX}/share/doc/kermit
+ ${INSTALL_DATA} ${WRKSRC}/COPYING.TXT ${DESTDIR}${PREFIX}/share/doc/kermit
${INSTALL_MAN} ${WRKSRC}/ckuker.nr \
${DESTDIR}${PREFIX}/${PKGMANDIR}/man1/kermit.1
+# Test suite: C unit tests (make check) and the Python integration
+# suite (pytest).
+#
+# devel/check is buildlinked (DEPMETHOD=build) rather than listed in
+# TEST_DEPENDS, since its headers and library must be visible to the sandboxed
+# compiler wrapper during "bmake test". Bare TEST_DEPENDS doesn't add the
+# package to # the buildlink tree the wrapper actually allows -I/-L flags into.
+# Gated on make(test) so a plain "bmake install" (no testing) does not pull in
+# devel/check as a build dependency it will never use.
+.if make(test) || defined(PKGSRC_RUN_TEST)
+BUILDLINK_DEPMETHOD.check= build
+.include "../../devel/check/buildlink3.mk"
+.endif
+
+TEST_DEPENDS+= ${PYPKGPREFIX}-test-[0-9]*:../../devel/py-test
+TEST_DEPENDS+= ${PYPKGPREFIX}-test-xdist-[0-9]*:../../devel/py-test-xdist
+TEST_DEPENDS+= ${PYPKGPREFIX}-test-timeout-[0-9]*:../../devel/py-test-timeout
+TEST_DEPENDS+= ${PYPKGPREFIX}-pyftpdlib-[0-9]*:../../net/py-pyftpdlib
+# Python itself is only needed to run the test suite, not at runtime
+# or to build wermit; keep it out of the installed package's DEPENDS.
+PYTHON_FOR_BUILD_ONLY= test
+.include "../../lang/python/pyversion.mk"
+
+# test_kermit_transfer_protocol_options' jumbo-packet (9024-byte) "send" cases
+# over the pseudoterminal transport are excluded. Upstream CI testing observed
+# that write() sometimes returns a value indicating more bytes were written
+# than were actually sent down the pty. Kermit's automatic adaptive packet
+# size will detect this and work around it in the wild in normal modes, but the
+# tests intentionally force extreme edge cases (jumbo packets, forbidding
+# packet size renegotiation, etc).
+#
+# This is noted upstream at https://www.openkermit.org/ckermit/platforms/
+# alongside the known workaround: "sysctl -w kern.tty.qsize=65536", which
+# follows the advice in that file related to a similar issue with PPP. Ustream
+# CI, which has full control over the testing VM, applies this change prior to
+# running tests. Here we lack that kind of control over the system
+# environment, so we skip the tests that would otherwise be flaky due to this
+# issue.
+#
+# This issue existed in C-Kermit 9.x as well, but there was no test suite in
+# that version and therefore it was mostly invisible, since the triggering
+# conditions are rare in normal use. This being a kernel issue, there is
+# nothing else we can do at the Kermit level about it. So, here it is
+# appropriate to simply skip the relevant test cases.
+PYTEST_DESELECT_EXPR= pseudoterminal and jumbopkt and send
+
+do-test:
+ cd ${WRKSRC} && ${MAKE_PROGRAM} check \
+ CHECK_LIBS_CMD='echo ${BUILDLINK_CPPFLAGS} ${BUILDLINK_LDFLAGS} -lcheck'
+ ${RUN} ${MKDIR} ${WRKDIR}/pytest-tmp
+ cd ${WRKSRC} && TMPDIR=${WRKDIR}/pytest-tmp ${PYTHONBIN} -m pytest -n4 -q \
+ -k "not (${PYTEST_DESELECT_EXPR})"
+
.include "../../mk/curses.buildlink3.mk"
.include "../../mk/termcap.buildlink3.mk"
diff --git a/comms/kermit/PLIST b/comms/kermit/PLIST
index ed1d6575d..83cea8bd3 100644
--- a/comms/kermit/PLIST
+++ b/comms/kermit/PLIST
@@ -1,14 +1,4 @@
@comment $NetBSD: PLIST,v 1.9 2011/08/25 14:54:06 hans Exp $
bin/kermit
man/man1/kermit.1
-share/doc/kermit/ckaaaa.txt
-share/doc/kermit/ckc302.txt
-share/doc/kermit/ckcbwr.txt
-share/doc/kermit/ckccfg.txt
-share/doc/kermit/ckcplm.txt
-share/doc/kermit/ckermit70.txt
-share/doc/kermit/ckermit80.txt
-share/doc/kermit/ckermit90.txt
-share/doc/kermit/ckubwr.txt
-share/doc/kermit/ckuins.txt
-share/doc/kermit/ckututor.txt
+share/doc/kermit/COPYING.TXT
diff --git a/comms/kermit/distinfo b/comms/kermit/distinfo
index 123feccf3..9eae034b9 100644
--- a/comms/kermit/distinfo
+++ b/comms/kermit/distinfo
@@ -1,22 +1,5 @@
$NetBSD: distinfo,v 1.31 2025/10/11 22:14:36 mrg Exp $
-BLAKE2s (kermit-9.0.302/cku302.tar.gz) = 246c177058b8855f0b0e6d81fc624fbc2820ab4d121ac43d83c285131cae527f
-SHA512 (kermit-9.0.302/cku302.tar.gz) = 2cfc264e5262d29618fdf218fd3407fd9049b16110972cdddb03d114703b7a0ea13c4b0a354f50c2a9f70d4727732fe4d1920b5c656f969bc56c1eb9dc3c43fa
-Size (kermit-9.0.302/cku302.tar.gz) = 3122219 bytes
-SHA1 (patch-aa) = f0242120b32b31bac3e0e6f2d1272f86002a2b89
-SHA1 (patch-ab) = 280bfca4d44630bc9ec4a9331b650b81c7f80774
-SHA1 (patch-ac) = 4fc10a60467afe528a800a608112b7719e4d0e35
-SHA1 (patch-ad) = 414f61c19185e4a82a8326121c2d9dacfba48077
-SHA1 (patch-ae) = 3cd335d719933fce95c2f5b05e9959d0d1ca06e0
-SHA1 (patch-af) = 2a09f9f933d3c1e6860983d8138ac61f33306ef7
-SHA1 (patch-ag) = cae37680ea5af85f4d2c774fe230f73a1f0be48c
-SHA1 (patch-ah) = 5b2098dfd57f8bd4d107acafaabe1a2c9b97d037
-SHA1 (patch-aj) = 6468e2139639f601de4609db8dff07b8b3a82d82
-SHA1 (patch-ak) = 983583d79abc4fcee1b7e9bf8ae46f184aa7011d
-SHA1 (patch-al) = 616ad10e65b24a04d24ff2556d6362ef3cc64b78
-SHA1 (patch-am) = 8c5acbfefe7b7d11825cc32c4449582b51f6cad9
-SHA1 (patch-ckcftp.c) = 1af977dce79f61c43619186c6a5d2032d7a9a6bd
-SHA1 (patch-ckcpro.w) = 247c1d0e0bcec632c4095c10067757cc40fb3831
-SHA1 (patch-ckupty.c) = fd8966627f3642550750ccd42e3add64a36dae09
-SHA1 (patch-ckuus3.c) = 557e938b36931f7948783116d1c5c2224d51bcbb
-SHA1 (patch-ckuus4.c) = 2204f4c95f8266358b66ac0936ac83ab27bec0c9
+BLAKE2s (kermit-11.0.504/v11.0.504.tar.gz) = f047c37d580e19775ab9225750adfdbe55679fe9437ba637c8022883040a9f48
+SHA512 (kermit-11.0.504/v11.0.504.tar.gz) = acb3cf9753c35958b0b4277ca6045f7fb7d42d1fca28fa42b78a5a521858c1fbe6a80bfc3c06c8ef798bff32987e2eb85635db7b46c653742fe67ecc41754c9f
+Size (kermit-11.0.504/v11.0.504.tar.gz) = 3218326 bytes
diff --git a/comms/kermit/options.mk b/comms/kermit/options.mk
index 63b8cc88c..50453e2dd 100644
--- a/comms/kermit/options.mk
+++ b/comms/kermit/options.mk
@@ -1,7 +1,7 @@
# $NetBSD: options.mk,v 1.7 2024/09/04 12:34:48 gdt Exp $
PKG_OPTIONS_VAR= PKG_OPTIONS.kermit
-PKG_SUPPORTED_OPTIONS= kermit-suid-uucp ssl kerberos
+PKG_SUPPORTED_OPTIONS= kermit-suid-uucp ssl
PKG_OPTIONS_OPTIONAL_GROUPS+= socks
PKG_OPTIONS_GROUP.socks= socks4 dante
@@ -31,15 +31,6 @@ LIBS+= -L${BUILDLINK_PREFIX.dante}/lib -lsocks
.include "../../net/dante/buildlink3.mk"
.endif
-.if !empty(PKG_OPTIONS:Mkerberos)
-BUILD_TARGET_OPTIONS+= +krb5
-# \todo Change to krb5.buildlink3.mk (allowing heimdal), or document why not.
-.include "../../security/mit-krb5/buildlink3.mk"
-K5INC= -I${WRKDIR}/.buildlink/include
-K5LIB= -L${WRKDIR}/.buildlink/lib ${COMPILER_RPATH_FLAG}${WRKDIR}/.buildlink/lib
-MAKE_ENV+= K5INC=${K5INC:Q} K5LIB=${K5LIB:Q}
-.endif
-
.if !empty(PKG_OPTIONS:Mssl)
BUILD_TARGET_OPTIONS+= +ssl
.include "../../security/openssl/buildlink3.mk"
diff --git a/comms/kermit/patches/patch-aa b/comms/kermit/patches/patch-aa
deleted file mode 100644
index e3be7833d..000000000
--- a/comms/kermit/patches/patch-aa
+++ /dev/null
@@ -1,127 +0,0 @@
-$NetBSD: patch-aa,v 1.11 2025/10/11 22:14:36 mrg Exp $
-
-* Get K5LIB, K5INC, SSLLIB and SSLINC from pkgsrc.
-* s/-lgssapi/-lgssapi_krb5/ on netbsd+krb5*
-* Add $(LIBS) to link command on solaris2xg+openssl+zlib+pam+shadow
-* s@$(K5INC)/krb5@$(K5INC)/kerberosv5/ on solaris9g+krb5+ssl
-* On linux get HAVE_LIBCURSES and HAVE_CURSES from pkgsrc (with the
- curses include and library pathes coming from BUILDLINK_*FLAGS).
-* Use MAINTYPE=int on NetBSD.
-
-
---- makefile.orig 2011-08-21 08:12:07.000000000 -0700
-+++ makefile 2025-10-11 14:48:36.917185449 -0700
-@@ -824,12 +824,12 @@ manroot = $(prefix)
-
- K4LIB=-L/usr/kerberos/lib
- K4INC=-I/usr/kerberos/include
--K5LIB=-L/usr/kerberos/lib
--K5INC=-I/usr/kerberos/include
-+#K5LIB=-L/usr/kerberos/lib
-+#K5INC=-I/usr/kerberos/include
- SRPLIB=-L$(srproot)/lib
- SRPINC=-I$(srproot)/include
--SSLLIB=-L$(sslroot)/ssl/lib
--SSLINC=-I$(sslroot)/ssl/include
-+#SSLLIB=-L$(sslroot)/ssl/lib
-+#SSLINC=-I$(sslroot)/ssl/include
-
- # To override these assignments; for example, if your OpenSSL files are
- # not in /usr/local/ssl, invoke the desired target like this:
-@@ -1812,6 +1812,7 @@ netbsd netbsd2 netbsd15 netbsd16 old-net
- "CFLAGS=`grep fseeko /usr/include/stdio.h > /dev/null && \
- echo '-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64'` \
- -DBSD44 -DCK_CURSES -DTCPSOCKET -DUSE_STRERROR -DHAVE_OPENPTY \
-+ -DMAINTYPE=int \
- -funsigned-char -DHERALD=\"\\\" NetBSD `uname -r`\\\"\" \
- -DCK_DTRCD -DCK_DTRCTS -DTPUTSARGTYPE=int -DFNFLOAT $(KFLAGS) -O" \
- "LIBS= -lcurses -lcrypt -lm -lutil $(LIBS)"
-@@ -1839,6 +1840,7 @@ netbsd+ssl netbsd+openssl:
- $(MAKE) netbsd KTARGET=$${KTARGET:-$(@)} "CC = $(CC)" "CC2 = $(CC2)" \
- "KFLAGS= -DCK_AUTHENTICATION -DCK_ENCRYPTION -DCK_CAST $$HAVE_DES \
- -DCK_SSL -DCK_PAM -DZLIB -DNO_DCL_INET_ATON $$OPENSSLOPTION \
-+ -DMAINTYPE=int \
- $(KFLAGS)" "LNKFLAGS = $(LNKFLAGS)" \
- "LIBS= -L/usr/pkg/lib -R/usr/pkg/lib -lssl $$DES_LIB -lcurses \
- -lcrypto -lcrypt -lz -lm -lpam -lutil $(LIBS)"
-@@ -1867,9 +1869,10 @@ netbsd+krb5:
- $(MAKE) netbsd KTARGET=$${KTARGET:-$(@)} "CC = $(CC)" "CC2 = $(CC2)" \
- "KFLAGS= -DCK_AUTHENTICATION -DCK_ENCRYPTION -DCK_KERBEROS -DKRB5 \
- -DCK_CAST $$HAVE_DES -DNOFTP_GSSAPI $(K5INC) $(K5INC)/krb5 \
-+ -DMAINTYPE=int \
- $(KFLAGS)" \
- "LIBS= $(K5LIB) -L/usr/pkg/lib -R/usr/pkg/lib -lcurses $$DES_LIB \
-- -lcrypto -lgssapi -lkrb5 -lm -lutil $(LIBS)"
-+ -lcrypto -lgssapi_krb5 -lkrb5 -lm -lutil $(LIBS)"
-
- # NetBSD - With Kerberos 5 and SSL and Zlib.
- # OK: 2011/08/21 on 5.1 with MIT Kerberos.
-@@ -1894,9 +1897,10 @@ netbsd+krb5+ssl netbsd+krb5+openssl+zlib
- "KFLAGS= -DCK_AUTHENTICATION -DCK_ENCRYPTION -DCK_CAST $$HAVE_DES \
- -DCK_KERBEROS -DKRB5 -DNOFTP_GSSAPI $(K5INC) $(K5INC)/krb5 \
- -DCK_SSL -DCK_PAM -DZLIB -DNO_DCL_INET_ATON $$OPENSSLOPTION \
-+ -DMAINTYPE=int \
- $(KFLAGS)" "LNKFLAGS = $(LNKFLAGS)" \
- "LIBS= $(K5LIB) -L/usr/pkg/lib -R/usr/pkg/lib -lssl $$DES_LIB \
-- -lcrypto -lcrypt -lgssapi -lkrb5 -lz -lm -lpam -lutil -lcurses $(LIBS)"
-+ -lcrypto -lcrypt -lgssapi_krb5 -lkrb5 -lz -lm -lpam -lutil -lcurses $(LIBS)"
-
- #Special Security Enhanced NetBSD target with SRP, SSL, and zlib support.
- #To build this, you need to BUILD the pkgsrc srp_client package. After
-@@ -1911,6 +1915,7 @@ netbsd+ssl+srp+zlib:
- "CFLAGS= -DBSD44 -DCK_CURSES -DTCPSOCKET -DUSE_STRERROR -DNETBSD15 \
- -DCK_DTRCD -DCK_DTRCTS -DTPUTSARGTYPE=int -DHAVE_OPENPTY \
- -I/usr/include/openssl -I/usr/pkg/include \
-+ -DMAINTYPE=int \
- -DCK_AUTHENTICATION -DCK_SRP -DPRE_SRP_1_4_5 -DCK_ENCRYPTION \
- -DCK_CAST -DCK_DES -DLIBDES -DCK_SSL -DZLIB -DFNFLOAT $(KFLAGS) -O" \
- "LIBS= -L/usr/pkg/lib -R/usr/pkg/lib -lcurses -lsrp -lgmp -ldes \
-@@ -1928,6 +1933,7 @@ netbsdn:
- $(MAKE) CC=$(CC) CC2=$(CC2) xermit KTARGET=$${KTARGET:-$(@)} \
- "CFLAGS=`grep fseeko /usr/include/stdio.h > /dev/null && \
- echo '-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64'` \
-+ -DMAINTYPE=int \
- -DBSD44 -DCK_CURSES -DTCPSOCKET -DUSE_STRERROR -DHAVE_OPENPTY \
- -DHERALD=\"\\\" NetBSD `uname -r`\\\"\" \
- -DCK_DTRCD -DCK_DTRCTS -DTPUTSARGTYPE=int -DFNFLOAT $(KFLAGS) -O" \
-@@ -3544,7 +3550,7 @@ solaris2xg+openssl+zlib+pam+shadow:
- -DCK_AUTHENTICATION -DCK_SSL -DCK_PAM -DCK_SHADOW -DZLIB \
- -DBIGBUFOK $(SSLINC) $(KFLAGS)" \
- "LIBS= $(SSLLIB) -ltermlib \
-- -lsocket -lnsl -lm -lresolv -lssl -lcrypto -lpam -lz"
-+ -lsocket -lnsl -lm -lresolv -lssl -lcrypto -lpam -lz $(LIBS)"
-
- #Ditto but with GCC 3.1 in which you have to specify 32-bit with -m32.
- #In Solaris 9 (and maybe 8) you'll also need specifiy the Library path.
-@@ -3899,7 +3905,7 @@ solaris9g+krb5+ssl solaris10g+krb5+ssl s
- -DCK_CURSES -DCK_NEWTERM -DDIRENT -DHDBUUCP -DTCPSOCKET -DBIGBUFOK \
- -DCK_AUTHENTICATION -DCK_SSL -DZLIB -DCK_KERBEROS -DKRB5 \
- -DCK_ENCRYPTION -DCK_CAST $$OPENSSLOPTION \
-- $$HAVE_DES $(SSLINC) $(K5INC) $(K5INC)/krb5 $(KFLAGS)" \
-+ $$HAVE_DES $(SSLINC) $(K5INC) $(K5INC)/kerberosv5 $(KFLAGS)" \
- "LIBS= $(SSLLIB) $(K5LIB) -lz -lssl -ltermlib -lsocket -lnsl -lm \
- -lresolv -lcrypto \
- $$GSSAPILIB -lkrb5 -lcom_err -lk5crypto $$DES_LIB $(LIBS)"
-@@ -6095,22 +6101,6 @@ linux:
- if test `grep openpty /usr/include/pty.h | wc -l` -gt 0; \
- then HAVE_OPENPTY='-DHAVE_OPENPTY'; \
- else HAVE_OPENPTY=''; fi ; \
-- HAVE_LIBCURSES=''; \
-- if test -f /usr/lib64/libncurses.so || \
-- test -f /usr/lib/libncurses.a || \
-- test -f /usr/lib/libncurses.so; then \
-- HAVE_LIBCURSES='-lncurses'; \
-- else if test -f /usr/lib64/libcurses.so || \
-- test -f /usr/lib/libcurses.a || \
-- test -f /usr/lib/libcurses.so; then \
-- HAVE_LIBCURSES='-lcurses'; fi; fi; \
-- HAVE_CURSES=''; \
-- if test -n '$$HAVE_LIBCURSES'; then \
-- if test -f /usr/include/ncurses.h; then \
-- HAVE_CURSES='-DCK_NCURSES -I/usr/include/ncurses'; \
-- else if test -f /usr/include/curses.h; then \
-- HAVE_CURSES='-DCK_CURSES'; \
-- fi; fi; fi; \
- if test -f /usr/include/baudboy.h || test -f /usr/include/ttylock.h; \
- then HAVE_LOCKDEV='-DHAVE_LOCKDEV' ; \
- else HAVE_LOCKDEV='' ; fi ; \
diff --git a/comms/kermit/patches/patch-ab b/comms/kermit/patches/patch-ab
deleted file mode 100644
index 46f328f76..000000000
--- a/comms/kermit/patches/patch-ab
+++ /dev/null
@@ -1,568 +0,0 @@
-$NetBSD: patch-ab,v 1.8 2020/04/08 15:22:07 rhialto Exp $
-
-- Update for openssl 1.1.1e.
-- Kermit tries to keep SSL and TLS contexts (since in old openssl, the
- *v23* methods were not version-flexible enough). Now afer simplification
- there is lots of duplicate code left over that could be simplified more.
-
---- ck_ssl.c.orig 2011-07-06 15:03:32.000000000 +0200
-+++ ck_ssl.c 2020-04-06 16:43:41.323530837 +0200
-@@ -301,7 +301,7 @@
- break;
- default:
- printf("Error %d while verifying certificate.\r\n",
-- ctx->error);
-+ error);
- break;
- }
- }
-@@ -804,6 +804,17 @@
- #define MS_CALLBACK
- #endif /* MS_CALLBACK */
-
-+static BIGNUM *get_RSA_F4()
-+{
-+ static BIGNUM *bn;
-+
-+ if (!bn) {
-+ bn = BN_new();
-+ BN_add_word(bn, RSA_F4);
-+ }
-+ return bn;
-+}
-+
- static RSA MS_CALLBACK *
- #ifdef CK_ANSIC
- tmp_rsa_cb(SSL * s, int export, int keylength)
-@@ -822,7 +833,16 @@
- if (ssl_debug_flag)
- printf("Generating temporary (%d bit) RSA key...\r\n",keylength);
-
-- rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL);
-+ rsa_tmp = RSA_new();
-+ if (rsa_tmp) {
-+ int error = RSA_generate_key_ex(rsa_tmp, keylength, get_RSA_F4(),NULL);
-+ if (error) {
-+ if (ssl_debug_flag)
-+ printf(" error %d", error);
-+ RSA_free(rsa_tmp);
-+ rsa_tmp = NULL;
-+ }
-+ }
-
- if (ssl_debug_flag)
- printf("\r\n");
-@@ -936,10 +956,26 @@
-
- if ((dh=DH_new()) == NULL)
- return(NULL);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ BIGNUM *p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
-+ BIGNUM *g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
-+ if ((p == NULL) || (g == NULL)) {
-+ BN_free(g);
-+ BN_free(p);
-+ DH_free(dh);
-+ return(NULL);
-+ }
-+ DH_set0_pqg(dh, p, NULL, g);
-+#else
- dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
- dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
-- if ((dh->p == NULL) || (dh->g == NULL))
-+ if ((dh->p == NULL) || (dh->g == NULL)) {
-+ BN_free(dh->g);
-+ BN_free(dh->p);
-+ DH_free(dh);
- return(NULL);
-+ }
-+#endif
- return(dh);
- }
-
-@@ -950,10 +986,26 @@
-
- if ((dh=DH_new()) == NULL)
- return(NULL);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ BIGNUM *p=BN_bin2bn(dh768_p,sizeof(dh768_p),NULL);
-+ BIGNUM *g=BN_bin2bn(dh768_g,sizeof(dh768_g),NULL);
-+ if ((p == NULL) || (g == NULL)) {
-+ BN_free(g);
-+ BN_free(p);
-+ DH_free(dh);
-+ return(NULL);
-+ }
-+ DH_set0_pqg(dh, p, NULL, g);
-+#else
- dh->p=BN_bin2bn(dh768_p,sizeof(dh768_p),NULL);
- dh->g=BN_bin2bn(dh768_g,sizeof(dh768_g),NULL);
-- if ((dh->p == NULL) || (dh->g == NULL))
-+ if ((dh->p == NULL) || (dh->g == NULL)) {
-+ BN_free(dh->g);
-+ BN_free(dh->p);
-+ DH_free(dh);
- return(NULL);
-+ }
-+#endif
- return(dh);
- }
-
-@@ -964,10 +1016,26 @@
-
- if ((dh=DH_new()) == NULL)
- return(NULL);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ BIGNUM *p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
-+ BIGNUM *g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
-+ if ((p == NULL) || (g == NULL)) {
-+ BN_free(g);
-+ BN_free(p);
-+ DH_free(dh);
-+ return(NULL);
-+ }
-+ DH_set0_pqg(dh, p, NULL, g);
-+#else
- dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
- dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
-- if ((dh->p == NULL) || (dh->g == NULL))
-+ if ((dh->p == NULL) || (dh->g == NULL)) {
-+ BN_free(dh->g);
-+ BN_free(dh->p);
-+ DH_free(dh);
- return(NULL);
-+ }
-+#endif
- return(dh);
- }
-
-@@ -978,10 +1046,26 @@
-
- if ((dh=DH_new()) == NULL)
- return(NULL);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ BIGNUM *p=BN_bin2bn(dh1536_p,sizeof(dh1536_p),NULL);
-+ BIGNUM *g=BN_bin2bn(dh1536_g,sizeof(dh1536_g),NULL);
-+ if ((p == NULL) || (g == NULL)) {
-+ BN_free(g);
-+ BN_free(p);
-+ DH_free(dh);
-+ return(NULL);
-+ }
-+ DH_set0_pqg(dh, p, NULL, g);
-+#else
- dh->p=BN_bin2bn(dh1536_p,sizeof(dh1536_p),NULL);
- dh->g=BN_bin2bn(dh1536_g,sizeof(dh1536_g),NULL);
-- if ((dh->p == NULL) || (dh->g == NULL))
-+ if ((dh->p == NULL) || (dh->g == NULL)) {
-+ BN_free(dh->g);
-+ BN_free(dh->p);
-+ DH_free(dh);
- return(NULL);
-+ }
-+#endif
- return(dh);
- }
-
-@@ -992,10 +1076,26 @@
-
- if ((dh=DH_new()) == NULL)
- return(NULL);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ BIGNUM *p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL);
-+ BIGNUM *g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL);
-+ if ((p == NULL) || (g == NULL)) {
-+ BN_free(g);
-+ BN_free(p);
-+ DH_free(dh);
-+ return(NULL);
-+ }
-+ DH_set0_pqg(dh, p, NULL, g);
-+#else
- dh->p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL);
- dh->g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL);
-- if ((dh->p == NULL) || (dh->g == NULL))
-+ if ((dh->p == NULL) || (dh->g == NULL)) {
-+ BN_free(dh->g);
-+ BN_free(dh->p);
-+ DH_free(dh);
- return(NULL);
-+ }
-+#endif
- return(dh);
- }
- #endif /* NO_DH */
-@@ -1054,10 +1154,11 @@
- if (ssl == NULL)
- return;
-
-- if (ssl->expand == NULL || ssl->expand->meth == NULL)
-+ const COMP_METHOD *method = SSL_get_current_compression(ssl);
-+ if (method == NULL)
- printf("Compression: None\r\n");
- else {
-- printf("Compression: %s\r\n",ssl->expand->meth->name);
-+ printf("Compression: %s\r\n",SSL_COMP_get_name(method));
- }
- }
-
-@@ -1072,7 +1173,7 @@
- #endif /* CK_ANSIC */
- {
- X509 *peer;
-- SSL_CIPHER * cipher;
-+ const SSL_CIPHER * cipher;
- const char *cipher_list;
- char buf[512]="";
-
-@@ -1457,13 +1558,23 @@
-
- #ifdef ZLIB
- cm = COMP_zlib();
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ if (cm != NULL && COMP_get_type(cm) != NID_undef) {
-+#else
- if (cm != NULL && cm->type != NID_undef) {
-+#endif
- SSL_COMP_add_compression_method(0xe0, cm); /* EAY's ZLIB ID */
- }
- #endif /* ZLIB */
-+#ifdef NID_rle_compression
- cm = COMP_rle();
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ if (cm != NULL && COMP_get_type(cm) != NID_undef)
-+#else
- if (cm != NULL && cm->type != NID_undef)
-+#endif
- SSL_COMP_add_compression_method(0xe1, cm); /* EAY's RLE ID */
-+#endif /* NID_rle_compression */
-
- /* Ensure the Random number generator has enough entropy */
- if ( !RAND_status() ) {
-@@ -1483,8 +1594,12 @@
- }
- debug(F110,"ssl_rnd_file",ssl_rnd_file,0);
-
-+#ifdef OPENSSL_NO_EGD
-+ rc1 = 0;
-+#else
- rc1 = RAND_egd(ssl_rnd_file);
- debug(F111,"ssl_once_init","RAND_egd()",rc1);
-+#endif
- if ( rc1 <= 0 ) {
- rc2 = RAND_load_file(ssl_rnd_file, -1);
- debug(F111,"ssl_once_init","RAND_load_file()",rc1);
-@@ -1579,25 +1694,13 @@
- /* This can fail because we do not have RSA available */
- if ( !ssl_ctx ) {
- debug(F110,"ssl_tn_init","SSLv23_client_method failed",0);
-- ssl_ctx=(SSL_CTX *)SSL_CTX_new(SSLv3_client_method());
-- }
-- if ( !ssl_ctx ) {
-- debug(F110,"ssl_tn_init","SSLv3_client_method failed",0);
- last_ssl_mode = -1;
- return(0);
- }
--#ifndef COMMENT
-- tls_ctx=(SSL_CTX *)SSL_CTX_new(TLSv1_client_method());
--#else /* COMMENT */
- tls_ctx=(SSL_CTX *)SSL_CTX_new(SSLv23_client_method());
- /* This can fail because we do not have RSA available */
- if ( !tls_ctx ) {
- debug(F110,"ssl_tn_init","SSLv23_client_method failed",0);
-- tls_ctx=(SSL_CTX *)SSL_CTX_new(SSLv3_client_method());
-- }
--#endif /* COMMENT */
-- if ( !tls_ctx ) {
-- debug(F110,"ssl_tn_init","TLSv1_client_method failed",0);
- last_ssl_mode = -1;
- return(0);
- }
-@@ -1611,25 +1714,13 @@
- /* This can fail because we do not have RSA available */
- if ( !ssl_ctx ) {
- debug(F110,"ssl_tn_init","SSLv23_server_method failed",0);
-- ssl_ctx=(SSL_CTX *)SSL_CTX_new(SSLv3_server_method());
-- }
-- if ( !ssl_ctx ) {
-- debug(F110,"ssl_tn_init","SSLv3_server_method failed",0);
- last_ssl_mode = -1;
- return(0);
- }
--#ifdef COMMENT
-- tls_ctx=(SSL_CTX *)SSL_CTX_new(TLSv1_server_method());
--#else /* COMMENT */
- tls_ctx=(SSL_CTX *)SSL_CTX_new(SSLv23_server_method());
- /* This can fail because we do not have RSA available */
- if ( !tls_ctx ) {
- debug(F110,"ssl_tn_init","SSLv23_server_method failed",0);
-- tls_ctx=(SSL_CTX *)SSL_CTX_new(TLSv1_server_method());
-- }
--#endif /* COMMENT */
-- if ( !tls_ctx ) {
-- debug(F110,"ssl_tn_init","TLSv1_server_method failed",0);
- last_ssl_mode = -1;
- return(0);
- }
-@@ -1655,7 +1746,6 @@
- SSL_CTX_set_info_callback(ssl_ctx,ssl_client_info_callback);
- SSL_CTX_set_info_callback(tls_ctx,ssl_client_info_callback);
-
--#ifndef COMMENT
- /* Set the proper caching mode */
- if ( mode == SSL_SERVER ) {
- SSL_CTX_set_session_cache_mode(ssl_ctx,SSL_SESS_CACHE_SERVER);
-@@ -1666,10 +1756,6 @@
- }
- SSL_CTX_set_session_id_context(ssl_ctx,(CHAR *)"1",1);
- SSL_CTX_set_session_id_context(tls_ctx,(CHAR *)"2",1);
--#else /* COMMENT */
-- SSL_CTX_set_session_cache_mode(ssl_ctx,SSL_SESS_CACHE_OFF);
-- SSL_CTX_set_session_cache_mode(tls_ctx,SSL_SESS_CACHE_OFF);
--#endif /* COMMENT */
- }
-
- /* The server uses defaults for the certificate files. */
-@@ -1777,7 +1863,14 @@
-
- if ( ssl_debug_flag )
- printf("Generating temp (512 bit) RSA key ...\r\n");
-- rsa=RSA_generate_key(512,RSA_F4,NULL,NULL);
-+ rsa = RSA_new();
-+ if (rsa) {
-+ int error = RSA_generate_key_ex(rsa,512,get_RSA_F4(),NULL);
-+ if (error) {
-+ RSA_free(rsa);
-+ rsa = NULL;
-+ }
-+ }
- if ( ssl_debug_flag )
- printf("Generation of temp (512 bit) RSA key done\r\n");
-
-@@ -2153,18 +2246,10 @@
- printf("SSL_DEBUG_FLAG on\r\n");
-
- if (!tls_http_ctx ) {
--#ifdef COMMENT
-- /* too many web servers still do not support TLSv1 */
-- tls_http_ctx=(SSL_CTX *)SSL_CTX_new(TLSv1_client_method());
--#else /* COMMENT */
- tls_http_ctx=(SSL_CTX *)SSL_CTX_new(SSLv23_client_method());
- /* This can fail because we do not have RSA available */
- if ( !tls_http_ctx ) {
- debug(F110,"ssl_http_init","SSLv23_client_method failed",0);
-- tls_http_ctx=(SSL_CTX *)SSL_CTX_new(SSLv3_client_method());
-- }
--#endif /* COMMENT */
-- if ( !tls_http_ctx ) {
- debug(F110,"ssl_http_init","TLSv1_client_method failed",0);
- return(0);
- }
-@@ -2182,7 +2267,7 @@
- * for TLS be sure to prevent use of SSLv2
- */
- SSL_CTX_set_options(tls_http_ctx,
-- SSL_OP_NO_SSLv2|SSL_OP_SINGLE_DH_USE|SSL_OP_EPHEMERAL_RSA);
-+ SSL_OP_NO_SSLv2/*|SSL_OP_NO_SSLv3*/|SSL_OP_SINGLE_DH_USE|SSL_OP_EPHEMERAL_RSA);
-
- SSL_CTX_set_info_callback(tls_http_ctx,ssl_client_info_callback);
-
-@@ -2575,7 +2660,11 @@
- int
- ssl_verify_crl(int ok, X509_STORE_CTX *ctx)
- {
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ X509_OBJECT *obj;
-+#else
- X509_OBJECT obj;
-+#endif
- X509_NAME *subject = NULL;
- X509_NAME *issuer = NULL;
- X509 *xs = NULL;
-@@ -2595,6 +2684,14 @@
- if (!crl_store)
- return ok;
-
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ obj = X509_OBJECT_new();
-+ if (!obj)
-+ return(ok);
-+#else
-+ memset((char *)&obj, 0, sizeof(obj));
-+#endif
-+
- store_ctx = X509_STORE_CTX_new();
- if ( !store_ctx )
- return(ok);
-@@ -2641,11 +2738,16 @@
- * Try to retrieve a CRL corresponding to the _subject_ of
- * the current certificate in order to verify it's integrity.
- */
-- memset((char *)&obj, 0, sizeof(obj));
- X509_STORE_CTX_init(store_ctx, crl_store, NULL, NULL);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ rc = X509_STORE_get_by_subject(store_ctx, X509_LU_CRL, subject, obj);
-+ X509_STORE_CTX_cleanup(store_ctx);
-+ crl = X509_OBJECT_get0_X509_CRL(obj);
-+#else
- rc = X509_STORE_get_by_subject(store_ctx, X509_LU_CRL, subject, &obj);
- X509_STORE_CTX_cleanup(store_ctx);
- crl = obj.data.crl;
-+#endif
- if (rc > 0 && crl != NULL) {
- /*
- * Verify the signature on this CRL
-@@ -2653,7 +2755,11 @@
- if (X509_CRL_verify(crl, X509_get_pubkey(xs)) <= 0) {
- fprintf(stderr, "Invalid signature on CRL!\n");
- X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_SIGNATURE_FAILURE);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ X509_OBJECT_free(obj);
-+#else
- X509_OBJECT_free_contents(&obj);
-+#endif
- X509_STORE_CTX_free(store_ctx);
- return 0;
- }
-@@ -2661,12 +2767,16 @@
- /*
- * Check date of CRL to make sure it's not expired
- */
-- i = X509_cmp_current_time(X509_CRL_get_nextUpdate(crl));
-+ i = X509_cmp_current_time(X509_CRL_get0_nextUpdate(crl));
- if (i == 0) {
- fprintf(stderr, "Found CRL has invalid nextUpdate field.\n");
- X509_STORE_CTX_set_error(ctx,
- X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ X509_OBJECT_free(obj);
-+#else
- X509_OBJECT_free_contents(&obj);
-+#endif
- X509_STORE_CTX_free(store_ctx);
- return 0;
- }
-@@ -2675,22 +2785,38 @@
- "Found CRL is expired - revoking all certificates until you get updated CRL.\n"
- );
- X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_HAS_EXPIRED);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ X509_OBJECT_free(obj);
-+#else
- X509_OBJECT_free_contents(&obj);
-+#endif
- X509_STORE_CTX_free(store_ctx);
- return 0;
- }
-- X509_OBJECT_free_contents(&obj);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ X509_OBJECT_free(obj);
-+#else
-+ X509_OBJECT_free_contents(&obj);
-+#endif
- }
-
- /*
- * Try to retrieve a CRL corresponding to the _issuer_ of
- * the current certificate in order to check for revocation.
- */
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- memset((char *)&obj, 0, sizeof(obj));
-+#endif
- X509_STORE_CTX_init(store_ctx, crl_store, NULL, NULL);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ rc = X509_STORE_get_by_subject(store_ctx, X509_LU_CRL, issuer, obj);
-+ X509_STORE_CTX_free(store_ctx); /* calls X509_STORE_CTX_cleanup() */
-+ crl = X509_OBJECT_get0_X509_CRL(obj);
-+#else
- rc = X509_STORE_get_by_subject(store_ctx, X509_LU_CRL, issuer, &obj);
- X509_STORE_CTX_free(store_ctx); /* calls X509_STORE_CTX_cleanup() */
- crl = obj.data.crl;
-+#endif
- if (rc > 0 && crl != NULL) {
- /*
- * Check if the current certificate is revoked by this CRL
-@@ -2698,19 +2824,34 @@
- n = sk_X509_REVOKED_num(X509_CRL_get_REVOKED(crl));
- for (i = 0; i < n; i++) {
- revoked = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ if (ASN1_INTEGER_cmp(X509_REVOKED_get0_serialNumber(revoked),
-+ X509_get_serialNumber(xs)) == 0) { // }
-+
-+ serial = ASN1_INTEGER_get(X509_REVOKED_get0_serialNumber(revoked));
-+#else
- if (ASN1_INTEGER_cmp(revoked->serialNumber,
- X509_get_serialNumber(xs)) == 0) {
-
- serial = ASN1_INTEGER_get(revoked->serialNumber);
-+#endif
- cp = X509_NAME_oneline(issuer, NULL, 0);
- free(cp);
-
- X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED);
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ X509_OBJECT_free(obj);
-+#else
- X509_OBJECT_free_contents(&obj);
-+#endif
- return 0;
- }
- }
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ X509_OBJECT_free(obj);
-+#else
- X509_OBJECT_free_contents(&obj);
-+#endif
- }
- return ok;
- }
-@@ -2877,6 +3018,7 @@
- #ifndef OpenBSD
- #ifndef FREEBSD4
- #ifndef NETBSD15
-+#ifndef __DragonFly__
- #ifndef LINUX
- #ifndef AIX41
- #ifndef UW7
-@@ -2919,6 +3061,7 @@
- #endif /* UW7 */
- #endif /* AIX41 */
- #endif /* LINUX */
-+#endif /* __DragonFly__ */
- #endif /* NETBSD15 */
- #endif /* FREEBSD4 */
- #endif /* OpenBSD */
-@@ -3057,7 +3200,7 @@
- tls_is_anon(int x)
- {
- char buf[128];
-- SSL_CIPHER * cipher;
-+ const SSL_CIPHER * cipher;
- SSL * ssl = NULL;
-
- switch ( x ) {
-@@ -3101,7 +3244,7 @@
- tls_is_krb5(int x)
- {
- char buf[128];
-- SSL_CIPHER * cipher;
-+ const SSL_CIPHER * cipher;
- SSL * ssl = NULL;
-
- switch ( x ) {
-@@ -4343,7 +4486,14 @@
- if (!(fp = fopen(buf, "r")))
- return 0;
- while (!r && (file_cert = PEM_read_X509(fp, NULL, NULL, NULL))) {
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
-+ const ASN1_BIT_STRING *peer_cert_sig, *file_cert_sig;
-+ X509_get0_signature(&peer_cert_sig, NULL, peer_cert);
-+ X509_get0_signature(&file_cert_sig, NULL, file_cert);
-+ if (!ASN1_STRING_cmp(peer_cert_sig, file_cert_sig))
-+#else
- if (!ASN1_STRING_cmp(peer_cert->signature, file_cert->signature))
-+#endif
- r = 1;
- X509_free(file_cert);
- }
diff --git a/comms/kermit/patches/patch-ac b/comms/kermit/patches/patch-ac
deleted file mode 100644
index 1f2745e5b..000000000
--- a/comms/kermit/patches/patch-ac
+++ /dev/null
@@ -1,32 +0,0 @@
-$NetBSD: patch-ac,v 1.10 2025/10/11 22:14:36 mrg Exp $
-
---- ckcdeb.h.orig 2010-08-23 06:30:56.000000000 -0700
-+++ ckcdeb.h 2025-10-11 15:06:08.218109885 -0700
-@@ -2190,6 +2190,9 @@ _PROTOTYP( void bleep, (short) );
- #endif /* __FreeBSD__ */
- #endif /* __linux__ */
- #endif /* HAVE_OPENPTY */
-+#ifdef __NetBSD__
-+#include <util.h>
-+#endif
- #endif /* NO_OPENPTY */
-
- /* Kermit feature selection */
-@@ -4532,7 +4535,6 @@ extern int errno;
- following is an anachronism and should be the execption rather than the
- rule.
- */
--extern int errno;
- #endif /* __GLIBC__ */
- #endif /* OS2 */
- #endif /* VMS */
-@@ -5292,6 +5294,9 @@ typedef int WAIT_T;
- #undef CK_OSF_BSD
- #endif /* CK_OSF_BSD */
- #else /* !POSIX */
-+#ifdef __NetBSD__
-+#include <sys/wait.h>
-+#endif
- typedef int WAIT_T;
- #endif /* POSIX */
- #endif /* MACHWAIT */
diff --git a/comms/kermit/patches/patch-ad b/comms/kermit/patches/patch-ad
deleted file mode 100644
index 2cb7cdc88..000000000
--- a/comms/kermit/patches/patch-ad
+++ /dev/null
@@ -1,12 +0,0 @@
-$NetBSD: patch-ad,v 1.10 2012/05/17 20:29:13 christos Exp $
-
---- ckcmai.c.orig 2012-05-17 16:22:58.000000000 -0400
-+++ ckcmai.c 2012-05-17 16:23:53.000000000 -0400
-@@ -540,6 +540,7 @@
-
- #include "ckcker.h" /* Kermit symbols */
- #include "ckcnet.h" /* Network symbols */
-+#include "ckupty.h" /* time.h */
-
- #ifdef CK_SSL
- #include "ck_ssl.h"
diff --git a/comms/kermit/patches/patch-ae b/comms/kermit/patches/patch-ae
deleted file mode 100644
index db3302538..000000000
--- a/comms/kermit/patches/patch-ae
+++ /dev/null
@@ -1,65 +0,0 @@
-$NetBSD: patch-ae,v 1.8 2020/07/30 03:03:07 gutteridge Exp $
-
-Portability fixes for DragonFly, SunOS, and Linux.
-
-The Linux fix is taken from upstream's 9.0.305 Alpha.01 release, and is
-noted to be a temporary workaround, so it may change in form in a
-pending release.
-
---- ckucmd.c.orig 2011-07-14 12:14:37.000000000 +0000
-+++ ckucmd.c
-@@ -7370,7 +7370,11 @@ cmdconchk() {
-
- /* Here we must look inside the stdin buffer - highly platform dependent */
-
--#ifdef _IO_file_flags /* Linux */
-+#ifdef __FILE_defined /* glibc 2.28 1 Aug 2018 */
-+ x = (int) ((stdin->_IO_read_end) - (stdin->_IO_read_ptr));
-+ debug(F101,"cmdconchk __FILE_defined","",x);
-+#else /* __FILE_defined */
-+#ifdef _IO_file_flags /* Linux (glibc 2.28 removed this symbol */
- x = (int) ((stdin->_IO_read_end) - (stdin->_IO_read_ptr));
- debug(F101,"cmdconchk _IO_file_flags","",x);
- #else /* _IO_file_flags */
-@@ -7382,8 +7386,19 @@ cmdconchk() {
- #ifdef NOARROWKEYS
- debug(F101,"cmdconchk NOARROWKEYS x","",0);
- #else
-+#if defined(__sun) && (defined(__amd64) || defined(__sparcv9))
-+ struct sun_64_FILE {
-+ unsigned char *_ptr; /* next character from/to here in buffer */
-+ unsigned char *_base; /* the buffer */
-+ unsigned char *_end; /* the end of the buffer */
-+ ssize_t _cnt; /* number of available characters in buffer */
-+ } *sun_64_stdin = (struct sun_64_FILE *)stdin;
-+ debug(F101,"cmdconchk sun_64_stdin->_cnt","",sun_64_stdin->_cnt);
-+ x = sun_64_stdin->_cnt;
-+#else
- debug(F101,"cmdconchk stdin->_cnt","",stdin->_cnt);
- x = stdin->_cnt;
-+#endif
- #endif /* NOARROWKEYS */
- #endif /* VMS */
- if (x == 0) x = conchk();
-@@ -7395,7 +7410,12 @@ cmdconchk() {
- if (x == 0) x = conchk();
- if (x < 0) x = 0;
- #else /* USE_FILE_CNT */
--#ifdef USE_FILE_R /* FreeBSD, OpenBSD, etc */
-+#if defined(__DragonFly__) && defined(feof_unlocked)
-+ debug(F101,"cmdconchk stdin->_r","",((struct __FILE_public *)stdin)->_r);
-+ x = ((struct __FILE_public *)stdin)->_r;
-+ if (x == 0) x = conchk();
-+ if (x < 0) x = 0;
-+#elif defined(USE_FILE_R) /* FreeBSD, OpenBSD, etc */
- debug(F101,"cmdconchk stdin->_r","",stdin->_r);
- x = stdin->_r;
- if (x == 0) x = conchk();
-@@ -7407,6 +7427,7 @@ cmdconchk() {
- #endif /* USE_FILE__CNT */
- #endif /* USE_FILE_CNT */
- #endif /* _IO_file_flags */
-+#endif /* __FILE_defined */
- #endif /* CMD_CONINC */
- #endif /* OS2 */
- return(x + y);
diff --git a/comms/kermit/patches/patch-af b/comms/kermit/patches/patch-af
deleted file mode 100644
index 6547c595b..000000000
--- a/comms/kermit/patches/patch-af
+++ /dev/null
@@ -1,13 +0,0 @@
-$NetBSD: patch-af,v 1.1 2005/12/18 23:15:43 joerg Exp $
-
---- ckuusr.c.orig 2005-12-18 23:04:34.000000000 +0000
-+++ ckuusr.c
-@@ -87,6 +87,8 @@ char *userv = "User Interface 8.0.278, 1
- #define MULTINET_OLD_STYLE /* Leave select prototype undefined */
- #endif /* MULTINET */
-
-+#include <errno.h>
-+
- #include "ckcdeb.h"
- #include "ckcasc.h"
- #include "ckcker.h"
diff --git a/comms/kermit/patches/patch-ag b/comms/kermit/patches/patch-ag
deleted file mode 100644
index aa5dad967..000000000
--- a/comms/kermit/patches/patch-ag
+++ /dev/null
@@ -1,16 +0,0 @@
-$NetBSD: patch-ag,v 1.2 2011/08/25 14:54:06 hans Exp $
-
---- ckuus6.c.orig 2011-06-07 17:27:51.000000000 +0200
-+++ ckuus6.c 2011-08-23 10:34:29.697605882 +0200
-@@ -33,11 +33,7 @@
- #endif /* def VMS [else] */
- #endif /* NOSTAT */
-
--#ifdef VMS
--#ifndef TCPSOCKET
- #include <errno.h>
--#endif /* TCPSOCKET */
--#endif /* VMS */
-
- #ifdef datageneral
- #define fgets(stringbuf,max,fd) dg_fgets(stringbuf,max,fd)
diff --git a/comms/kermit/patches/patch-ah b/comms/kermit/patches/patch-ah
deleted file mode 100644
index 906ee4ab0..000000000
--- a/comms/kermit/patches/patch-ah
+++ /dev/null
@@ -1,14 +0,0 @@
-$NetBSD: patch-ah,v 1.1 2005/12/18 23:15:43 joerg Exp $
-
---- ckcfns.c.orig 2005-12-18 23:06:48.000000000 +0000
-+++ ckcfns.c
-@@ -93,9 +93,7 @@ _PROTOTYP( long zfsize, (char *) );
- #endif /* OS2ONLY */
- #endif /* OS2 */
-
--#ifdef VMS
- #include <errno.h>
--#endif /* VMS */
-
- /* Externals from ckcmai.c */
-
diff --git a/comms/kermit/patches/patch-aj b/comms/kermit/patches/patch-aj
deleted file mode 100644
index 0ff718fa1..000000000
--- a/comms/kermit/patches/patch-aj
+++ /dev/null
@@ -1,13 +0,0 @@
-$NetBSD: patch-aj,v 1.1 2006/06/28 23:13:18 dbj Exp $
-
---- ckuus5.c.orig 2006-06-27 19:22:53.000000000 -0400
-+++ ckuus5.c 2006-06-27 19:23:30.000000000 -0400
-@@ -28,6 +28,8 @@
- #include "ckcker.h"
- #include "ckuusr.h"
-
-+#include <errno.h>
-+
- #ifdef DCMDBUF
- char *line; /* Character buffer for anything */
- char *tmpbuf;
diff --git a/comms/kermit/patches/patch-ak b/comms/kermit/patches/patch-ak
deleted file mode 100644
index 55430e3f1..000000000
--- a/comms/kermit/patches/patch-ak
+++ /dev/null
@@ -1,24 +0,0 @@
-$NetBSD: patch-ak,v 1.2 2020/04/08 15:22:07 rhialto Exp $
-
-- Use version-flexible SSL/TLS method.
-
---- ckuus7.c.orig 2011-06-23 16:13:11.000000000 +0000
-+++ ckuus7.c
-@@ -32,6 +32,8 @@
- #include "ckucmd.h"
- #include "ckclib.h"
-
-+#include <errno.h>
-+
- #ifdef VMS
- #ifndef TCPSOCKET
- #include <errno.h>
-@@ -14340,7 +14342,7 @@ sho_auth(cx) int cx; {
- if (ssl_con == NULL) {
- SSL_library_init();
- ssl_ctx = (SSL_CTX *)
-- SSL_CTX_new((SSL_METHOD *)TLSv1_method());
-+ SSL_CTX_new((SSL_METHOD *)SSLv23_method());
- if (ssl_ctx != NULL)
- ssl_con= (SSL *) SSL_new(ssl_ctx);
- }
diff --git a/comms/kermit/patches/patch-al b/comms/kermit/patches/patch-al
deleted file mode 100644
index 6205aca78..000000000
--- a/comms/kermit/patches/patch-al
+++ /dev/null
@@ -1,391 +0,0 @@
-$NetBSD: patch-al,v 1.3 2014/06/23 22:24:24 christos Exp $
-
---- ckuath.c.orig 2011-06-13 13:26:54.000000000 -0400
-+++ ckuath.c 2014-06-23 18:20:26.000000000 -0400
-@@ -117,19 +117,6 @@
- #include <time.h>
- #include <fcntl.h>
- #include <errno.h>
--#ifndef malloc
--#ifndef VMS
--#ifndef FREEBSD4
--#ifndef OpenBSD
--#ifdef MACOSX
--#include <sys/malloc.h>
--#else /* MACOSX */
--#include <malloc.h>
--#endif /* MACOSX */
--#endif /* OpenBSD */
--#endif /* FREEBSD4 */
--#endif /* VMS */
--#endif /* malloc */
- #ifdef OS2
- #include <io.h>
- #endif /* OS2 */
-@@ -149,7 +136,9 @@
- #endif /* saveprintf */
- #else /* HEIMDAL */
- #include "krb5.h"
-+#ifdef BETATEST
- #include "profile.h"
-+#endif
- #include "com_err.h"
- #ifdef KRB5_GET_INIT_CREDS_OPT_TKT_LIFE
- #define KRB5_HAVE_GET_INIT_CREDS
-@@ -417,7 +406,6 @@
- char des_outpkt[2*RLOG_BUFSIZ+4]; /* needs to be > largest write size */
- #ifdef KRB5
- krb5_data desinbuf,desoutbuf;
--krb5_encrypt_block eblock; /* eblock for encrypt/decrypt */
- static krb5_data encivec_i[2], encivec_o[2];
-
- enum krb5_kcmd_proto {
-@@ -3145,8 +3133,13 @@
- data.data = k4_session_key;
- data.length = 8;
-
-- code = krb5_c_decrypt(k5_context, &k4_krbkey, 0, 0,
-- &encdata, &data);
-+ code = krb5_c_decrypt(k5_context,
-+#ifdef HEIMDAL
-+ k4_krbkey,
-+#else
-+ &k4_krbkey,
-+#endif
-+ 0, 0, &encdata, &data);
-
- krb5_free_keyblock_contents(k5_context, &random_key);
-
-@@ -3162,8 +3155,13 @@
- data.data = k4_challenge;
- data.length = 8;
-
-- code = krb5_c_decrypt(k5_context, &k4_krbkey, 0, 0,
-- &encdata, &data);
-+ code = krb5_c_decrypt(k5_context,
-+#ifdef HEIMDAL
-+ k4_krbkey,
-+#else
-+ &k4_krbkey,
-+#endif
-+ 0, 0, &encdata, &data);
- #else /* MIT_CURRENT */
- memset(k4_sched,0,sizeof(Schedule));
- ckhexdump("auth_send",cred.session,8);
-@@ -3295,7 +3293,7 @@
- case AUTHTYPE_KERBEROS_V5:
- debug(F111,"auth_send KRB5","k5_auth.length",k5_auth.length);
- for ( i=0 ; i<k5_auth.length ; i++ ) {
-- if ( (char *)k5_auth.data[i] == IAC )
-+ if ( ((char *)k5_auth.data)[i] == IAC )
- iaccnt++;
- }
- if ( k5_auth.length + iaccnt + 10 < sizeof(buf) ) {
-@@ -4250,8 +4248,13 @@
- kdata.data = k4_challenge;
- kdata.length = 8;
-
-- if (code = krb5_c_decrypt(k5_context, &k4_krbkey, 0, 0,
-- &encdata, &kdata)) {
-+ if (code = krb5_c_decrypt(k5_context,
-+#ifdef HEIMDAL
-+ k4_krbkey,
-+#else
-+ &k4_krbkey,
-+#endif
-+ 0, 0, &encdata, &kdata)) {
- com_err("k4_auth_is", code, "while decrypting challenge");
- auth_finished(AUTH_REJECT);
- return AUTH_FAILURE;
-@@ -4752,9 +4755,11 @@
- ap_opts |= AP_OPTS_MUTUAL_REQUIRED;
-
- #ifdef HEIMDAL
-+#ifdef notdef
- r = krb5_auth_setkeytype(k5_context, auth_context, KEYTYPE_DES);
- if (r)
- com_err(NULL, r, "while setting auth keytype");
-+#endif
- r = krb5_auth_con_setaddrs_from_fd(k5_context,auth_context, &ttyfd);
- if (r)
- com_err(NULL, r, "while setting auth addrs");
-@@ -4924,7 +4929,6 @@
- skey.data = k5_session_key->contents;
- #endif /* HEIMDAL */
- } else {
--#ifdef HEIMDAL
- switch ( k5_session_key->keytype ) {
- case ETYPE_DES_CBC_CRC:
- case ETYPE_DES_CBC_MD5:
-@@ -4934,24 +4938,17 @@
- break;
- default:
- skey.type = SK_GENERIC;
-+#ifdef HEIMDAL
-+ skey.length = k5_session_key->keyvalue.length;
-+#else /* HEIMDAL */
- skey.length = k5_session_key->length;
-+#endif /* HEIMDAL */
- encrypt_dont_support(ENCTYPE_DES_CFB64);
- encrypt_dont_support(ENCTYPE_DES_OFB64);
- }
-+#ifdef HEIMDAL
- skey.data = k5_session_key->keyvalue.data;
- #else /* HEIMDAL */
-- switch ( k5_session_key->enctype ) {
-- case ENCTYPE_DES_CBC_CRC:
-- case ENCTYPE_DES_CBC_MD5:
-- case ENCTYPE_DES_CBC_MD4:
-- skey.type = SK_DES;
-- skey.length = 8;
-- default:
-- skey.type = SK_GENERIC;
-- skey.length = k5_session_key->length;
-- encrypt_dont_support(ENCTYPE_DES_CFB64);
-- encrypt_dont_support(ENCTYPE_DES_OFB64);
-- }
- skey.data = k5_session_key->contents;
- #endif /* HEIMDAL */
- }
-@@ -5038,7 +5035,6 @@
- skey.data = k5_session_key->contents;
- #endif /* HEIMDAL */
- } else {
--#ifdef HEIMDAL
- switch ( k5_session_key->keytype ) {
- case ETYPE_DES_CBC_CRC:
- case ETYPE_DES_CBC_MD5:
-@@ -5047,21 +5043,15 @@
- skey.length = 8;
- default:
- skey.type = SK_GENERIC;
-+#ifdef HEIMDAL
-+ skey.length = k5_session_key->keyvalue.length;
-+#else /* HEIMDAL */
- skey.length = k5_session_key->length;
-+#endif /* HEIMDAL */
- }
-+#ifdef HEIMDAL
- skey.data = k5_session_key->keyvalue.data;
- #else /* HEIMDAL */
-- switch ( k5_session_key->enctype ) {
-- case ENCTYPE_DES_CBC_CRC:
-- case ENCTYPE_DES_CBC_MD5:
-- case ENCTYPE_DES_CBC_MD4:
-- skey.type = SK_DES;
-- skey.length = 8;
-- break;
-- default:
-- skey.type = SK_GENERIC;
-- skey.length = k5_session_key->length;
-- }
- skey.data = k5_session_key->contents;
- #endif /* HEIMDAL */
- }
-@@ -5138,7 +5128,11 @@
- }
- if ( msg.length == 24 && !memcmp(msg.data,tls_verify,24) )
- krb5_tls_verified = 1;
-+#ifdef HEIMDAL
-+ krb5_data_free(&msg);
-+#else /* HEIMDAL */
- krb5_free_data_contents(k5_context,&msg);
-+#endif /* HEIMDAL */
- if (krb5_tls_verified)
- return(AUTH_SUCCESS);
- }
-@@ -5166,7 +5160,7 @@
- krb5_context context;
- krb5_auth_context auth_context;
- krb5_data *inbuf;
-- krb5_const_principal client;
-+ krb5_principal client;
- {
- krb5_creds ** creds=NULL;
- krb5_error_code retval;
-@@ -5197,7 +5191,7 @@
- if ((retval = krb5_cc_initialize(context, ccache, client)))
- return(retval);
-
-- if ((retval = krb5_rd_cred(context, auth_context, ccache, inbuf)))
-+ if ((retval = krb5_rd_cred2(context, auth_context, ccache, inbuf)))
- return(retval);
- #else /* HEIMDAL */
- if ((retval = krb5_rd_cred(context, auth_context, inbuf, &creds, NULL)))
-@@ -5472,17 +5466,17 @@
- goto errout;
- }
- SendK5AuthSB(KRB5_TLS_VERIFY, msg.data, msg.length);
-+#ifdef HEIMDAL
-+ krb5_data_free(&msg);
-+#else
- krb5_free_data_contents(k5_context,&msg);
-+#endif
- }
- #endif /* CK_SSL */
- if ((how & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) {
- /* do ap_rep stuff here */
- if ((r = krb5_mk_rep(k5_context,
--#ifdef HEIMDAL
-- &auth_context,
--#else /* HEIMDAL */
- auth_context,
--#endif /* HEIMDAL */
- &outbuf))) {
- debug(F111,"k5_auth_is","krb5_mk_rep",r);
- (void) ckstrncpy(errbuf, "Make reply failed: ",sizeof(errbuf));
-@@ -5503,7 +5497,7 @@
- {
- szUserNameAuthenticated[0] = '\0';
- } else {
-- ckstrncpy(szUserNameAuthenticated,UIDBUFLEN,name);
-+ ckstrncpy(szUserNameAuthenticated,name,UIDBUFLEN);
- free(name);
- }
- }
-@@ -9687,6 +9681,7 @@
- return(-1);
- }
-
-+int
- #ifdef CK_ANSIC
- ck_krb4_destroy(struct krb_op_data * op)
- #else
-@@ -11228,7 +11223,12 @@
-
- use_ivecs = 1;
-
-- if (status = krb5_c_block_size(k5_context, k5_session_key->enctype,
-+ if (status = krb5_c_block_size(k5_context,
-+#ifdef HEIMDAL
-+ k5_session_key->keytype,
-+#else
-+ k5_session_key->enctype,
-+#endif
- &blocksize)) {
- /* XXX what do I do? */
- printf("fatal kerberos 5 crypto library error\n");
-@@ -11309,8 +11309,7 @@
- krb5_ap_rep_enc_part *rep_ret = NULL;
- krb5_data outbuf;
- int rc;
-- krb5_int32 seqno=0;
-- krb5_int32 server_seqno=0;
-+ int server_seqno=0;
- char ** realmlist=NULL;
- int buflen;
- char tgt[256];
-@@ -11388,7 +11387,11 @@
- }
-
- if (krb5_rlog_ver == KCMD_OLD_PROTOCOL)
-+#ifdef HEIMDAL
-+ get_cred->session.keytype=ETYPE_DES_CBC_CRC;
-+#else
- get_cred->keyblock.enctype=ENCTYPE_DES_CBC_CRC;
-+#endif
-
- /* Get ticket from credentials cache or kdc */
- status = krb5_get_credentials(k5_context,
-@@ -11429,10 +11432,11 @@
- krb5_boolean is_des;
-
- if (status = krb5_c_enctype_compare( k5_context,
-- ENCTYPE_DES_CBC_CRC,
- #ifdef HEIMDAL
-+ ETYPE_DES_CBC_CRC,
- ret_cred->session.keytype,
- #else /* HEIMDAL */
-+ ENCTYPE_DES_CBC_CRC,
- ret_cred->keyblock.enctype,
- #endif /* HEIMDAL */
- &is_des)) {
-@@ -11482,7 +11486,11 @@
- &rep_ret,
- NULL
- );
-+#ifdef HEIMDAL
-+ krb5_data_free(&cksumdat);
-+#else
- krb5_free_data_contents(k5_context,&cksumdat);
-+#endif
-
- if (status) {
- if ( !quiet )
-@@ -11490,12 +11498,17 @@
- error_message(status));
- if (error) {
- if ( !quiet ) {
-- printf("Server returned error code %d (%s)\r\n",
-- error->error,
-- error_message(ERROR_TABLE_BASE_krb5 + error->error));
-- if (error->text.length) {
-- printf("Error text sent from server: %s\r\n",
-- error->text.data);
-+#ifdef HEIMDAL
-+ int xerror = error->error_code;
-+ char *xtext = *error->e_text;
-+#else
-+ int xerror = error->error;
-+ char *xtext = error->text.length ? error->text.data : NULL;
-+#endif
-+ printf("Server returned error code %d (%s)\r\n", xerror,
-+ error_message(ERROR_TABLE_BASE_krb5 + xerror));
-+ if (xtext) {
-+ printf("Error text sent from server: %s\r\n", xtext);
- }
- }
- krb5_free_error(k5_context, error);
-@@ -11505,7 +11518,11 @@
- }
-
- if (rep_ret) {
-+#ifdef HEIMDAL
-+ server_seqno = *rep_ret->seq_number;
-+#else
- server_seqno = rep_ret->seq_number;
-+#endif
- krb5_free_ap_rep_enc_part(k5_context, rep_ret);
- }
-
-@@ -11834,7 +11851,11 @@
- rd_len = (rd_len << 8) | c;
-
- if (status = krb5_c_encrypt_length(k5_context,
-+#ifdef HEIMDAL
-+ k5_session_key->keytype,
-+#else
- k5_session_key->enctype,
-+#endif
- use_ivecs ? rd_len + 4 : rd_len,
- (size_t *)&net_len)) {
- errno = status;
-@@ -11865,9 +11886,15 @@
- plain.length = sizeof(storage);
- plain.data = storage;
-
-- if ( status = krb5_c_decrypt(k5_context, k5_session_key, KCMD_KEYUSAGE,
-+ if ( status = krb5_c_decrypt(k5_context,
-+#ifdef HEIMDAL
-+ *k5_session_key,
-+#else
-+ k5_session_key,
-+#endif
-+ KCMD_KEYUSAGE,
- use_ivecs ? encivec_i + secondary : 0,
-- &cipher,&plain) ) {
-+ &cipher,&plain) ) {
- /* probably out of sync */
- printf("Cannot decrypt data from network: %s\r\n",
- error_message(status));
-@@ -12759,8 +12786,8 @@
-
- static int
- binaryEqual (a, b, len)
--register char *a, *b;
--register int len;
-+char *a, *b;
-+int len;
- {
- while (len--)
- if (*a++ != *b++)
diff --git a/comms/kermit/patches/patch-am b/comms/kermit/patches/patch-am
deleted file mode 100644
index 244ff9dee..000000000
--- a/comms/kermit/patches/patch-am
+++ /dev/null
@@ -1,14 +0,0 @@
-$NetBSD: patch-am,v 1.1 2011/05/14 19:27:53 hans Exp $
-
---- ckuusx.c.orig 2004-03-14 18:13:23.000000000 +0100
-+++ ckuusx.c 2009-12-26 23:23:19.652637206 +0100
-@@ -70,6 +70,9 @@ _PROTOTYP(char * os2_gethostname, (void)
- #ifdef BSD44
- #include <errno.h>
- #endif /* BSD44 */
-+#ifdef SOLARIS
-+#include <errno.h>
-+#endif
-
- extern xx_strp xxstring;
-
diff --git a/comms/kermit/patches/patch-ckcftp.c b/comms/kermit/patches/patch-ckcftp.c
deleted file mode 100644
index adaabc1ea..000000000
--- a/comms/kermit/patches/patch-ckcftp.c
+++ /dev/null
@@ -1,31 +0,0 @@
-$NetBSD: patch-ckcftp.c,v 1.1 2020/04/08 16:22:00 rhialto Exp $
-
-Use SSLv23_client_method() because it is version-flexible.
-The difference that Kermit makes between SSL and TLS is gone.
-
---- ckcftp.c.orig 2011-07-14 18:17:30.000000000 +0200
-+++ ckcftp.c 2020-04-06 17:01:35.943676852 +0200
-@@ -10196,19 +10196,19 @@
- #define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS 0L
- #endif
- if (auth_type && !strcmp(auth_type,"TLS")) {
-- ssl_ftp_ctx=SSL_CTX_new(SSLv3_client_method());
-+ ssl_ftp_ctx=SSL_CTX_new(SSLv23_client_method());
- if (!ssl_ftp_ctx)
- return(0);
- SSL_CTX_set_options(ssl_ftp_ctx,
- SSL_OP_SINGLE_DH_USE|SSL_OP_EPHEMERAL_RSA
- );
- } else {
-- ssl_ftp_ctx = SSL_CTX_new(ftp_bug_use_ssl_v2 ? SSLv23_client_method() :
-- SSLv3_client_method());
-+ ssl_ftp_ctx = SSL_CTX_new(SSLv23_client_method());
- if (!ssl_ftp_ctx)
- return(0);
- SSL_CTX_set_options(ssl_ftp_ctx,
-- (ftp_bug_use_ssl_v2 ? 0 : SSL_OP_NO_SSLv2)|
-+
-+ (ftp_bug_use_ssl_v2 ? 0 : SSL_OP_NO_SSLv2/*|SSL_OP_NO_SSLv3*/)|
- SSL_OP_SINGLE_DH_USE|SSL_OP_EPHEMERAL_RSA
- );
- }
diff --git a/comms/kermit/patches/patch-ckcpro.w b/comms/kermit/patches/patch-ckcpro.w
deleted file mode 100644
index 0b801fdb5..000000000
--- a/comms/kermit/patches/patch-ckcpro.w
+++ /dev/null
@@ -1,19 +0,0 @@
-$NetBSD: patch-ckcpro.w,v 1.1 2019/04/11 02:21:09 mrg Exp $
-
-dest is an int.
-ffc and calibrate are CK_OFF_Ts.
-
---- ckcpro.w.orig 2011-06-07 11:39:21.000000000 -0700
-+++ ckcpro.w 2019-04-10 19:15:37.736900735 -0700
-@@ -151,8 +151,9 @@
- extern int quiet, tsecs, parity, backgrd, nakstate, atcapu, wslotn, winlo;
- extern int wslots, success, xitsta, rprintf, discard, cdtimo, keep, fdispla;
- extern int timef, stdinf, rscapu, sendmode, epktflg, epktrcvd, epktsent;
-- extern int binary, fncnv;
-- extern long speed, ffc, crc16, calibrate, dest;
-+ extern int binary, fncnv, dest;
-+ extern CK_OFF_T ffc, calibrate;
-+ extern long speed, crc16;
- #ifdef COMMENT
- extern char *TYPCMD, *DIRCMD, *DIRCM2;
- #endif /* COMMENT */
diff --git a/comms/kermit/patches/patch-ckupty.c b/comms/kermit/patches/patch-ckupty.c
deleted file mode 100644
index bffc5c4f7..000000000
--- a/comms/kermit/patches/patch-ckupty.c
+++ /dev/null
@@ -1,40 +0,0 @@
-$NetBSD: patch-ckupty.c,v 1.1 2015/11/07 23:20:59 dholland Exp $
-
-Always use termios, never sgtty.h.
-
---- ckupty.c~ 2011-06-13 15:34:13.000000000 +0000
-+++ ckupty.c
-@@ -79,33 +79,7 @@ char * ptyver = "PTY support 8.0.016, 22
- #endif /* SUNOS41 */
-
- #ifndef USE_TERMIO
--#ifdef LINUX
--#define USE_TERMIO
--#else
--#ifdef ATTSV
--#define USE_TERMIO
--#else
--#ifdef HPUX
--#define USE_TERMIO
--#else
--#ifdef AIX
--#define USE_TERMIO
--#else
--#ifdef BSD44ORPOSIX
- #define USE_TERMIO
--#else
--#ifdef IRIX60
--#define USE_TERMIO
--#else
--#ifdef QNX
--#define USE_TERMIO
--#endif /* QNX */
--#endif /* IRIX60 */
--#endif /* BSD44ORPOSIX */
--#endif /* AIX */
--#endif /* HPUX */
--#endif /* ATTSV */
--#endif /* LINUX */
- #endif /* USE_TERMIO */
-
- #ifdef QNX
diff --git a/comms/kermit/patches/patch-ckuus3.c b/comms/kermit/patches/patch-ckuus3.c
deleted file mode 100644
index 0ae810603..000000000
--- a/comms/kermit/patches/patch-ckuus3.c
+++ /dev/null
@@ -1,15 +0,0 @@
-$NetBSD: patch-ckuus3.c,v 1.1 2020/04/08 15:22:07 rhialto Exp $
-
-Use version-flexible method.
-
---- ckuus3.c.orig 2011-06-26 18:20:07.000000000 +0000
-+++ ckuus3.c
-@@ -13048,7 +13048,7 @@ case XYDEBU:
- if (ssl_con == NULL) {
- SSL_library_init();
- ssl_ctx = (SSL_CTX *)
-- SSL_CTX_new((SSL_METHOD *)TLSv1_method());
-+ SSL_CTX_new((SSL_METHOD *)SSLv23_method());
- if (ssl_ctx != NULL)
- ssl_con= (SSL *) SSL_new(ssl_ctx);
- }
diff --git a/comms/kermit/patches/patch-ckuus4.c b/comms/kermit/patches/patch-ckuus4.c
deleted file mode 100644
index 1dd7c8eb5..000000000
--- a/comms/kermit/patches/patch-ckuus4.c
+++ /dev/null
@@ -1,29 +0,0 @@
-$NetBSD: patch-ckuus4.c,v 1.1 2019/04/11 02:21:09 mrg Exp $
-
-Always include errno.h.
-crc16 is a long.
-
---- ckuus4.c.orig 2011-06-24 11:58:10.000000000 -0700
-+++ ckuus4.c 2019-04-10 18:25:09.650654615 -0700
-@@ -34,8 +34,9 @@
- #include "ck_ssl.h"
- #endif /* CK_SSL */
-
-+#include <errno.h>
-+
- #ifdef VMS
--#include <errno.h> /* For \v(errno) */
- extern char * ckvmserrstr(unsigned long);
- #ifndef OLD_VMS
- #include <lib$routines.h> /* Not for VAX C 2.4 */
-@@ -409,7 +410,9 @@
- npad, pkttim, bigrbsiz, bigsbsiz, keep, atcapr, autopar, bctr, bctu,
- crunched, ckdelay, ebq, ebqflg, pktlog, retrans, rpackets, rptflg, rptq,
- rtimo, spackets, spsiz, spsizf, spsizr, timeouts, fncact, fncnv, urpsiz,
-- wmax, wslotn, wslotr, fdispla, spmax, fnrpath, fnspath, crc16;
-+ wmax, wslotn, wslotr, fdispla, spmax, fnrpath, fnspath;
-+extern long
-+ crc16;
- #endif /* NOXFER */
-
- #ifdef OS2