                                                                      (v1.3.8)
2026-10-10  Tomas Volf  <~@wolfsden.cz>

        port: Print test-suite.log when check fails.

        * etc/port/check-: If `make check' fails, cat `test-suite.log'.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        configure: Stop being a foreign package.

        By adhering to GNU's standards, the user benefits by having a detailed change
        log (useful) and list of authors (meh).

        * configure.ac (AM_INIT_AUTOMAKE): Drop `foreign' option.  Probe for awk, sed.
        * Makefile.am (ChangeLog): New target.
        * AUTHORS: New file.
        * INSTALL: Delete file.
        * README: Move over relevant parts of the old INSTALL file.
        * NEWS: Note the ChangeLog and AUTHORS.
        * .gitignore: Ignore ChangeLog, INSTALL.
        * manifest.scm [concatenate-manifests]: Add git.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        tests: Configure the test files.

        This simplifies the code a little bit and brings the code base closer to typical
        autoconf setup.

        * .gitignore: Adjust to ignore the new files.  Minor cleanup.
        * Makefile.am (AM_TESTS_ENVIRONMENT): Do not set.
        (EXTRA_DIST): Do not distribute tests/test-alternative-names,
        tests/test-basic-ecdsa, tests/test-basic-rsa, tests/test.inc.
        * configure.ac: Probe for curl, nginx, openssl, pebble.  Substitute the
        variables.  Configure the test files.
        * tests/test-alternative-names.in, tests/test-basic-ecdsa.in,
        tests/test-basic-rsa.in: Rename from s/.in//.  Use @abs_builddir@.
        * tests/test.inc: Rename from this...
        * tests/test.common.in: ... to this.  Use @CURL@, @NGINX@, @OPENSSL@, @PEBBLE@,
        @abs_srcdir@.  Wait for servers to be running instead of just sleeping.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        all: Make the code more aesthetically pleasing.

        Aah, much better.

        * Makefile.am, etc/port/check-libressl, etc/port/check-libressl-libtls,
        etc/port/check-openssl-1.1.1, etc/port/check-openssl-1.1.1-libtls,
        etc/port/check-openssl-3.0, etc/port/check-openssl-3.0-libtls,
        etc/port/check-openssl-3.5, etc/port/check-openssl-3.5-libtls,
        etc/port/test-alpine-3.24, etc/port/test-archlinux, etc/port/test-debian,
        etc/port/update, tests/test.inc: Align \ characters.
        * etc/port/test-alpine-3.24: Start packages to install on new line.
        * etc/port/test-debian: Sort list of packages to install.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        port: Run tests also on Debian.

        * etc/port/test-debian: New file.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        port: Drop unnecessary line from Alpine's test.

        * etc/port/test-alpine-3.24: Stop sourcing profile.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        port: Test on Alpine 3.24.

        For Alpine, I test on latest stable.

        * etc/port/test-alpine-3.23: Move this...
        * etc/port/test-alpine-3.24: ... here.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        port: Update openssl 3.5.

        * etc/port/setup-openssl-3.5 (VER): Use 3.5.9.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        port: Update openssl 3.0.

        * etc/port/setup-openssl-3.0 (VER): Use 3.0.22.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        port: Update libressl.

        * etc/port/setup-libressl (VER): Use 4.3.3.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        port: Drop CFLAGS from test files.

        It is covered by --enable-devel-flags now.

        * etc/port/test-alpine-3.23 [2]: Drop CFLAGS.
        * etc/port/test-archlinux [2]: Same.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        port: Move all scripting from _tools to etc/port.

        * HACKING (Hacking on the ~acme-client~): Note the change.
        * _tools/check-, _tools/check-libressl, _tools/check-libressl-libtls,
        _tools/check-openssl-1.1.1, _tools/check-openssl-1.1.1-libtls,
        _tools/check-openssl-3.0, _tools/check-openssl-3.0-libtls,
        _tools/check-openssl-3.5, _tools/check-openssl-3.5-libtls, _tools/check-system,
        _tools/last-synced, _tools/setup, _tools/setup-hosts, _tools/setup-libressl,
        _tools/setup-openssl-1.1.1, _tools/setup-openssl-3.0, _tools/setup-openssl-3.5,
        _tools/setup-pebble, _tools/test-alpine-3.23, _tools/test-archlinux,
        _tools/update: Move into etc/port.  Adjust where appropriate.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        doc: Document /etc/hosts in HACKING.

        * HACKING (Hacking on the ~acme-client~, Checks before cutting release): Note
        the need for /etc/hosts bind.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        doc: Note need for special /etc/hosts for tests.

        Also reformat to GNU conventions (two spaces after a sentence).

        * README: Reformat.
        (Tests): Note about /etc/hosts.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        vcs: Add mailmap.

        * .mailmap: New file.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        legal: Change license to GPL-3.0-only.

        These days I typically use GNU Affero General Public License, but in this
        specific project there is little point.  Only party this program interacts
        with (and to which the user would be compelled to give source code) is the
        certificate authority, and it will not bother asking for the code.

        So, GNU General Public License will effectively do the same job, while being
        more common.

        There are no legally significant changes under previous license from people
        beside me, so I am allow to do this change.

        As before, the code originating from the OpenBSD of course preserves its
        original license, this change affects only the compatibility bits added by me.

        * COPYING: Replace by version 3.
        * README (License): Note the change.
        * NEWS: This is probably news worthy.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        make: Move compatibility layer into separate directory.

        * compat.c, compat.h, compat_bsd_sys_queue.h, compat_vis.c, compat_vis.h: Move
        into compat directory.
        * Makefile.am (acme_client_SOURCES): Adjust.
        (acme_client_CPPFLAGS): Add -I$(srcdir)/compat.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        tests: Support running tests as regular user.

        Originally acme-client did not support port number in authority's URL.  It does
        now, so we can stop using 443 (default) in favor of 8443.  This allows us to run
        the tests as regular user, though special care still needs to be taken with
        regards to /etc/hosts.

        * tests/hosts: New file.
        * Makefile.am (EXTRA_DIST): Distribute it.
        * tests/pebble.json: Listen on 8443.
        * tests/acme-client.conf.alternative-names, tests/acme-client.conf.basic-ecdsa,
        tests/acme-client.conf.basic-rsa (api_url): Use port 8443.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        configure: Move warnings flags into the developer mode.

        The do not affect compilation, so I decided to move them into developer mode
        flags to not bother people with warnings they have no interest in.

        * configure.ac: Move -Wall, -Wextra, -Wformat, -Wmissing-declarations,
        -Wmissing-prototypes, -Wpointer-arith, -Wshadow, -Wsign-compare,
        -Wstrict-prototypes, -Wno-pointer-sign, -Wundef, -Wvla into
        --enable-devel-flags.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        vcs: Ignore test outputs.

        * .gitignore: Ignore /tests/*.log, /tests/*.trs.

2026-10-10  Tomas Volf  <~@wolfsden.cz>

        configure: Fix compilation with devel flags.

        Due to bug in GCC, it was not possible to actually compile the program under
        --enable-devel:

            compat_vis.c: In function ‘stravis’:
            compat_vis.c:222:23: error: pointer ‘buf_15’ may be used after ‘realloc’ [-Werror=use-after-free]
              222 |                 *outp = buf;
                  |                 ~~~~~~^~~~~
            compat_vis.c:220:17: note: call to ‘realloc’ here
              220 |         *outp = realloc(buf, len + 1);
                  |                 ^~~~~~~~~~~~~~~~~~~~~
            cc1: all warnings being treated as errors

        We want to disable the warning, but we need to do it in a way that does not
        hamper compilation of release build and is as localized as possible.  Since I
        use just GCC for development, use its pragmas, but guard it by check for the new
        --enable-devel-flags.

        * configure.ac: Rename --enable-devel to --enable-devel-flags.  AC_DEFINE it as
        WITH_DEVEL_FLAGS if set.  Add -pedantic.
        * compat_vis.c (stravis) [if WITH_DEVEL_FLAGS]: Ignore -Wuse-after-free.

2026-10-08  Tomas Volf  <~@wolfsden.cz>

        configure: Bump version to 1.3.8.

        * configure.ac (AC_INIT): Set version to 1.3.8.
        * NEWS: Add news for the version.

2026-10-05  Tomas Volf  <~@wolfsden.cz>

        compat: Provide freezero function.

2026-10-05  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2026-09-18  jmatthew  <jmatthew@openbsd.org>

        Allow wildcards to be specified in alternate names in the configuration
        file. This does not enable issuance of wildcard certificates except in
        limited circumstances where the ACME server does not require any
        challenges, such as when you've already validated control of the domain
        name with your CA and you're using an EAB key provided by the CA to
        link that to an ACME account.

        ok tb@, "fine by me" florian@

2026-09-16  jan  <jan@openbsd.org>

        acme-client: missing null check before calling json_getstr()

        ok jmatthew

2026-09-16  tb  <tb@openbsd.org>

        acme-client: treat eab and eab_key as secrets

        Wipe them with freezero after use and also make sure to delete possible
        remnants of them on unbase64buf_url() failure.

        reads fine to florian
        ok jmatthew

2026-09-16  tb  <tb@openbsd.org>

        acme-client: zero optarg for external account binding

        After copying the key-id:key pair, wipe the optarg so that this secret
        is
        not visible to other users during the entire run time (in ps for
        example).

        From Acts1631

        reads fine to florian
        ok jmatthew

2026-09-16  tb  <tb@openbsd.org>

        acme-client: error check strdup() for external account binding

        From Acts1631

        reads fine to florian
        ok jmatthew

2026-09-09  tb  <tb@openbsd.org>

        acme-client: reject whitespace and control characters in url2host()

        Prevents an HTTP request injection issue when handling the URLs returned
        by an ACME server.

        from Acts1631
        ok jmatthew

2026-09-07  jsg  <jsg@openbsd.org>

        correct json_parse_response() prototype

        return type changed from int to enum chngstatus in json.c rev 1.11

2026-07-30  jmatthew  <jmatthew@openbsd.org>

        Handle '=' padding in base64url encoded EAB keys.

        bentley@ found one in the wild and confirmed that this makes it work

2026-06-21  tb  <tb@openbsd.org>

        annotate tm_wday = -1 with /* sentinel for error */ per timegm(3)
        manpage

        suggested by deraadt

2026-05-29  tb  <tb@openbsd.org>

        acme-client: use _get0_ instead of _getm_ for const correctness

        The revokeproc doesn't modify the Validity, so use a const ASN1_TIME and
        switch to X509_get0_notBefore()/X509_get0_notAfter().

        suggested by job a long time ago

2026-05-29  tb  <tb@openbsd.org>

        acme-client: fix timegm(3) invocations

        Use the tm.tm_wday = -1 sentinel check and switch X509notbefore() and
        X509notafter() to use a time_t * output parameter since an in-band error
        doesn't work for them for the same reason it doesn't work for timegm(3).
        The error check remains against -1 to keep the diff small, but should
        perhaps be changed to use a Boolean 0/1 approach.

        Of course, with the aggressive push to very short-lived certificates in
        the WebPKI, negative epoch times won't happen here in practice.

        ok florian

2026-05-22  jmatthew  <jmatthew@openbsd.org>

        Add support for external account binding. If we're creating a new
        account with the ACME CA, and we have an EAB key and key ID specified
        with the new -e command line argument, compute the required hash of the
        account details and include it in the new account request.

        feedback from florian@ and tb@
        tested against security/pebble and Digicert by me, and against Actalis
        by
        rroadrrunner at proton dot me.
        ok florian@ tb@

2026-05-02  florian  <florian@openbsd.org>

        Prevent memory leaks from json_getstr.

        json_getstr returns the result of strdup (or NULL) to the caller so
        the caller has to free the memory.

        While here, setting order->finalize to NULL once is enough.

        From Jan Schreiber (jes AT posteo.de), with input from tb.

        OK tb (some time ago)

2026-10-05  Tomas Volf  <~@wolfsden.cz>

        manifest: Define module, use selective imports.

        * manifest.scm (define-module): Define `manifest' module, use #:select.

2026-10-05  Tomas Volf  <~@wolfsden.cz>

        configure: Use autoconf 2.72.

        * configure.ac (AC_PREREQ): Use 2.72.
        (AC_CONFIG_SRCDIR): Check for a single file.
        * manifest.scm <concatenate-manifests>: Use autoconf-2.72.

2026-05-01  Tomas Volf  <~@wolfsden.cz>

        manifest.scm: Use development manifest for acme-client.

        This keeps it DRYer.

        * manifest.scm: Use package->development-manifest.

2026-05-01  Tomas Volf  <~@wolfsden.cz>

        README: Convert to org-mode.

        * README: Convert to org-mode.

2026-05-01  Tomas Volf  <~@wolfsden.cz>

        HACKING: Add file.

        * HACKING: New file.

2026-05-01  Tomas Volf  <~@wolfsden.cz>

        bootstrap: Add file.

        * bootstrap: New file.

                                                                      (v1.3.7)
2026-04-30  Tomas Volf  <~@wolfsden.cz>

        Release 1.3.7

        * NEWS: Add news.
        * configure.ac: Bump version.  Update bug email.

2026-04-30  Tomas Volf  <~@wolfsden.cz>

        _tools: Update libraries.

2026-04-30  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2026-01-21  Tomas Volf  <~@wolfsden.cz>

        Release 1.3.6

        * NEWS: Add news.
        * configure.ac: Bump version.

2026-01-21  Tomas Volf  <~@wolfsden.cz>

        Makefile.am: Install the example.

2026-03-02  tb  <tb@openbsd.org>

        acme-client: use accessors instead of reaching into ASN1_STRING

        ok sthen

2026-02-23  sthen  <sthen@openbsd.org>

        mention ip address certs

2026-02-23  sthen  <sthen@openbsd.org>

        acme-client: add support for iPAddress certificates, ok florian

        started by Lloyd <ng2d68@proton.me>, also worked on by myself and
        florian@

2026-02-21  sthen  <sthen@openbsd.org>

        don't talk about CN, we no longer send it in the CSR, and CAs
        constructed their own anyway.

2026-02-21  sthen  <sthen@openbsd.org>

        don't include CN in the certificate signing request.

        the CA will decide whether to include a CN based on their
        configuration/profile and sets that up themselves.

        ok florian

2026-01-21  Tomas Volf  <~@wolfsden.cz>

        _tools: Also update the example configuration file.

2026-01-21  Tomas Volf  <~@wolfsden.cz>

        _tools: Use alpine 3.23 for tests.

2026-01-21  Tomas Volf  <~@wolfsden.cz>

        Import the example.

2026-01-21  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2026-01-18  schwarze  <schwarze@openbsd.org>

        Slightly iprove a confusing wording in the parse.y manuals: The things
        that need quoting are not necessarily "argument names", and not even
        necessarily "names" at all, so just talk about "arguments".

        "I guess?" florian@ and no objection from otto@, both back in July 2025.

        Actually, the quoting rules are more complicated than the text makes
        believe, but i do not know how to better describe them.  It may not be
        easy because some suspect the implementation may be somewhat adhoc
        rather than based on cleary defined lexical rules.

2025-12-17  sthen  <sthen@openbsd.org>

        fix function name in warnx; ok tb

2025-11-18  dlg  <dlg@openbsd.org>

        only include port numbers in Host headers when it's not 443.

        step-ca has a teary if you include the port in the Host header, but
        pebble gets confused if you don't. florian says "I can't see anything
        in RFC9110 7.2 that suggests sending a port in the host header is
        wrong", so we're pretty sure step-ca is doing the wrong thing, but
        it's also pretty easy to be accomodating by omitting the port if
        the https request is on port 443. just don't talk to step-ca on a
        non standard port i guess.

        ok sthen@ florian@

2025-09-18  sthen  <sthen@openbsd.org>

        document changes to renewal timers, ok florian tb

2025-09-18  florian  <florian@openbsd.org>

        Adapt renewal calculation for shortlived certificates.

        If the lifetime is more than 10 days renew if less than 1/3 of the
        lifetime is left. Otherwise renew after 1/2 of the remaining lifetime.

        Since we suggest to run the cronjob daily, this is capped at 3 days
        remaining lifetime to have the opportunity to run the cronjob at least
        twice.

        Input & OK tb, sthen

        Putting it in now because it gives buypass users 60 days of warnings
        instead of 30 that their certificate can't be renewed (pointed out by
        sthen).

2025-09-16  sthen  <sthen@openbsd.org>

        implement draft-ietf-acme-profiles for acme-client, ok florian

        letsencrypt uses this to allow asking for a certificate with a specific
        TLS profile; see https://letsencrypt.org/docs/profiles/ for current
        options

        note that with current timers, if you select the non-default
        "shortlived"
        profile, renewal will be done at each acme-client run. if this results
        in
        exceeding rate limits, adjust cronjobs, or don't do that. (this is being
        looked at, but may possibly be too sensitive to change before release).

2025-07-08  schwarze  <schwarze@openbsd.org>

        Make internal hyperlinking work by moving custom sections from .Sh to
        .Ss and the titles from all caps to sentence case such that they match
        the table of contents, and switch from .Sy to .Sx as needed. OK florian@

2025-07-07  schwarze  <schwarze@openbsd.org>

        In the manual pages for configuration files based on parse.y, describe
        the syntax of both defining and using macros, rather than exclusively
        relying on examples, which some of the pages do not even provide. In
        those pages containing tables of content, also clarify that the
        "Macros" section contains *definitions* of variables. Both changes were
        already committed to vm.conf(5) earlier.

        In those few pages that referenced cpp(1) and m4(1), stop doing that
        because the macro definition syntax and the macro dereferencing syntax
        of both languages is totally different from the parse.y syntax.

        OK florian@, and deraadt also requests keeping these manuals in sync.

                                                                      (v1.3.5)
2025-06-29  Tomas Volf  <~@wolfsden.cz>

        Release 1.3.5

        * NEWS: Add news.
        * configure.ac: Bump version.

2025-06-29  Tomas Volf  <~@wolfsden.cz>

        README: Update download path.

2025-06-29  Tomas Volf  <~@wolfsden.cz>

        _tools: Update versions used for testing.

2025-06-29  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2025-06-12  florian  <florian@openbsd.org>

        Unbreak previous.

        There are other errors besides badNonce and we still need to handle
        those, so leave the http error code intact.

2025-06-12  tb  <tb@openbsd.org>

        acme-client: zap extra space between else and if (forgot to mention it
        after review)

2025-06-12  florian  <florian@openbsd.org>

        Retry request on badNonce error.

        RFC 8555, 6.5 tells us we SHOULD do this and we MUST use the nonce
        provided in the error response.

        Non-compliance found with pebble.

        OK tb

2025-06-10  florian  <florian@openbsd.org>

        Allow port numbers in API URLs.

        With this we can talk to Let's Encrypt's pebble server.

        Input & OK tb

2025-06-08  florian  <florian@openbsd.org>

        Add insecure API endpoints for regress test with pebble.

        Pebble is Let's Encrypt's test server which can be used to test corner
        cases or common mistakes clients make when implementing the acme
        RFC(s). It can also be used to test new protocol features.

        This is intentionally undocumented.

        OK tb

2025-06-08  florian  <florian@openbsd.org>

        Remove http support, RFC 8555 requires https for the API server.

        input & OK job
        OK tb

2025-05-20  florian  <florian@openbsd.org>

        Handle "processing" status by retrying as the RFC suggests.

        Previously we would give up with "unhandled status" and not get a
        certificate.

        While here limit the amount of retries we are willing to perform in
        the "pending" and "processing" state.

        Let's encrypt seems to enter the "processing" state farely often in
        the staging environment.

        problem reported & OK sthen

                                                                      (v1.3.4)
2025-01-23  Tomas Volf  <~@wolfsden.cz>

        Release 1.3.4

        * NEWS: Add news.
        * configure.ac: Bump version.

2025-01-23  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2024-10-10  florian  <florian@openbsd.org>

        Always print account URI on first creation of an account key.

        This was hidden behind -v but it seems useful to always have this when
        creating a new account.

        As sthen points out in his previous commit:
        This is useful if you want to set a CAA DNS record restricting
        issuance to a specific user account.

        OK deraadt

2024-10-07  sthen  <sthen@openbsd.org>

        When acme-client is run with -v, show the account URI from the Location
        header sent by the server in response to the newAccount API call (used
        for every cert request). This is useful if you want to set a CAA DNS
        record restricting issuance to a specific user account, rather than
        just "all of $whichever_acme_CA". ok florian

2024-07-01  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2024-06-19  claudio  <claudio@openbsd.org>

        Kill the SIGPIPE signal handler which is installed around write
        opertations. Instead just SIG_IGN SIGPIPE in main.c for all of
        acme-client. More work to be done here but at least this distraction is
        gone. OK florian@ deraadt@ op@

2024-06-17  Tomas Volf  <~@wolfsden.cz>

        _tools: Update test setup.

        New libressl and openssl are out.  Also use latest alpine.

        * _tools/setup-libressl (VER): Update to 3.9.2.
        * _tools/setup-openssl-3.0 (VER): Update to 3.0.14.
        * _tools/setup-pebble: Update to 2.6.0.
        * _tools/test-alpine-3.20: Rename to this...
        * _tools/test-alpine-3.19: ... from this

2024-05-01  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2024-05-21  jsg  <jsg@openbsd.org>

        remove prototypes with no matching function and externs with no var
        partly checked by millert@

2024-05-09  tb  <tb@openbsd.org>

        Align RSA and EC key generation with each other

        Being two different cryptographic primitives, it is clear that there
        must
        be some differences between RSA and EC keygen, but they don't have to be
        entirely different. We need to set the key type, RSA needs a bit size
        and
        ECDSA needs a curve. That's all the differences there need to be.

        Garbage collect a few useless elses and avoid two exit labels paths
        where
        one would do just fine.

        As another small bonus, this file no longer uses "deprecated API", so
        the
        portable fork can get rid of an ugly openssl 3 patch if they want to.

        ok florian

2024-04-28  tb  <tb@openbsd.org>

        Remove unused url from netproc()

        Leftover from when RFC 8555 support was added.

        ok florian

2024-04-28  florian  <florian@openbsd.org>

        Don't filter dangerous characters by hand when strvisx(3) is right
        there.

        segfault reported by sthen, which was most likely caused by buf_dump().

        OK tb

2024-04-16  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

                                                                      (v1.3.3)
2024-01-29  Tomas Volf  <~@wolfsden.cz>

        Release 1.3.3

        * NEWS: Add news.
        * configure.ac: Bump version.

2024-01-29  Tomas Volf  <~@wolfsden.cz>

        _tools: Update test dependencies.

        * _tools/setup-libressl: Use 3.8.2.
        * _tools/setup-openssl-1.1.1: Use 1.1.1w.
        * _tools/setup-openssl-3.0: Use 3.0.12.
        * _tools/setup-pebble: Use v2.4.0.

2024-01-29  Tomas Volf  <~@wolfsden.cz>

        _tools: Delete obsolete files.

        * _tools/container-check, _tools/container-run, _tools/container-setup,
        _tools/tarball-check: Delete files.

2024-01-28  Tomas Volf  <~@wolfsden.cz>

        .builds: Replace by a shell scripts

        I was using a .builds provided by builds.sr.ht until now.  As part of my
        migration away from sourcehut (for ideological reasons), this commit replaces
        them by a shell scripts that can run the tests using podman containerization
        tool.

        * .builds/alpine-edge.yml, .builds/alpine-latest.yml, .builds/archlinux.yml:
        Delete files.
        * _tools/test-alpine-3.19, _tools/test-archlinux: New files.

2024-01-28  Tomas Volf  <~@wolfsden.cz>

        dnsproc.c: Include netinet/in.h.

        On Linux it seems to be included by default, but on FreeBSD it needs to be
        explicitly included.

        * usr.sbin/acme-client/dnsproc.c: Include netinet/in.h.

2024-01-28  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2023-11-10  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2023-09-16  Tomas Volf  <~@wolfsden.cz>

        Fix type mismatch between declaration and definition

        In extern.h, json_parse_response has return type int, however in json.c the
        return type is enum chngstatus.  This mismatch should work on gcc, it is a
        potential portability issue and therefore worth fixing.

2023-09-16  Tomas Volf  <~@wolfsden.cz>

        Ignore use-after-free, gcc produces false positive

2023-09-16  Tomas Volf  <~@wolfsden.cz>

        Use alpine-edge instead of old 3.16

2023-09-15  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2023-08-29  op  <op@openbsd.org>

        acme-client: drop ecdsa.h, fix spacing and a typo in error message

        While here drop EC_KEY_set_asn1_flag(OPENSSL_EC_NAMED_CURVE).
        EC_KEY_new_by_curve_name() ends up calling EC_GROUP_new() which already
        sets the OPENSSL_EC_NAMED_CURVE flag on the group.  (suggested by tb@)

        ok tb@

2023-06-10  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2023-05-16  espie  <espie@openbsd.org>

        since apparently, the "example" conf is not free-form (adding comments
        would break scripts, go figure), highlight the staging servers so that
        people with non-standard configurations (challenge/response) get a
        chance at figuring things out.

        okay tb@

2022-12-28  jmc  <jmc@openbsd.org>

        spelling fixes; from paul tagliamonte any parts of his diff not taken
        are noted on tech

2022-12-19  tb  <tb@openbsd.org>

        acme-client: fix copy-paste error in error message

2022-12-18  tb  <tb@openbsd.org>

        acme-client: rename cc to sign_len in op_sign()

        requested by jsing

2022-12-18  tb  <tb@openbsd.org>

        acme-client: fix openssl includes in acctproc.c

        We don't do PEM or random in here, but we use BN, EC, ECDSA, so include
        the relevant headers. errno.h was also missing.

2022-12-18  tb  <tb@openbsd.org>

        acme-client: check EC signature length

        Make sure the size_t containing EC signature length is not truncated
        when passing it to d2i_ECDSA_SIG() as a long. This won't happen, but
        documents API quirks...

        requested by jsing

2022-12-18  tb  <tb@openbsd.org>

        acme-client: simplify elliptic curve signatures

        We can get the correct size of the signature using EVP_PKEY_bits() which
        uses the order instead of the (strictly speaking incorrect) degree. Grab
        the (r, s) out of the ECDSA signature with ECDSA_SIG_get0_{r,s}(), which
        is a saner interface than EVP_SIG_get0(). Finally, do the zero padding
        using BN_bn2binpad() which is simpler than the currently rather fiddly
        solution.

        ok jsing

2022-12-18  tb  <tb@openbsd.org>

        acme-client: switch op_sign() to EVP_DigestSign()

        EVP_DigestSign() is a bit more ergonomic than the old EVP_Sign* family,
        it takes size_t instead of int and and it also allows allocating the
        memory needed instead of relying on some weird estimate. This again gets
        rid of a few stupid else if.

        ok jsing

2022-12-18  tb  <tb@openbsd.org>

        acme-client: simplify op_thumbprint()

        We can EVP_Digest() into an array on the stack rather than doing a long
        dance and song with lots of ugly else if.

        ok jsing

2022-12-18  tb  <tb@openbsd.org>

        acme-client: inline a confusing and useless define

2022-12-18  tb  <tb@openbsd.org>

        acme-client: encode unexpected SANs before printing

        If a SAN isn't configured, it could be anything, so make printing it
        safe
        using strvisx(). If it is configured but duplicate, printing it should
        be
        fine, so don't bother. This removes two XXX added in the previous
        commit.

        ok florian

2022-12-17  tb  <tb@openbsd.org>

        acme-client: fix SAN-handling insanity

        The revoke process, which does a lot more than revoking a cert, wants to
        know the SANs in the cert to be revoked or renewed and check them
        against
        the ones configured in the config file.

        To find out which ones are, it prints the SAN extension to a BIO using
        X509V3_EXT_print(), slurps that into a buffer, tokenizes the
        undocumented
        output string and plucks out the "DNS:" names. This is reminiscent of
        node's hilarious CVE-2021-44532 and on about the same level of crazy,
        but
        fortunately not security relevant.

        Get the SAN extension as a GENERAL_NAMES from libcrypto, then we have an
        actual data structure to work with, which allows us to access the DNS
        names
        without problems. This simplifies things quite a bit, but the actual
        logic
        in this file remains unmodified. Be careful about ASN1_IA5STRINGs and do
        not assume they are C strings.

        Tested by florian, millert, Renaud Allard, thanks!

        ok florian jsing

2022-12-15  tb  <tb@openbsd.org>

        acme-client: use timegm() instead of mktime()

        Times in certificates are all expressed in Zulu time, so calling the
        time
        zone dependent mktime() on such a time and comparing it to time(NULL) is
        wrong.

        This means that the check of at least 30 days validity and deciding on
        whether to renew or not might have been off by by half a day depending
        on
        where you are. That should not matter since you (or cron) are supposed
        to
        run acme-client way more often than once a month.

        ok claudio millert

2022-12-15  tb  <tb@openbsd.org>

        acme-client: use ASN1_TIME_to_tm()

        There is a hand-rolled, only minimally checked implementation converting
        an ASN1_TIME into a struc tm. beck has invested a lot of time improving
        the time parsing inside libcrypto, so make use of that. That code is
        safer,
        better vetted and more correct.

        ok florian

2022-12-15  florian  <florian@openbsd.org>

        The argument to ctype functions must be EOF or representable as an
        unsigned char.

        Casting to int is particularly useless because that's what the
        compiler already does. We need to prevent sign extension, not write
        down that we want sign extension.

        OK deraadt, kn, miod

2022-12-14  florian  <florian@openbsd.org>

        The argument to ctype functions must be EOF or representable as an
        unsigned char.

        Casting to int is particularly useless because that's what the
        compiler already does. We need to prevent sign extension, not write
        down that we want sign extension.

        OK deraadt, millert, kn

2022-12-14  otto  <otto@openbsd.org>

        Continue loop if no match found; avoids an OOB write. ok florian@ tb@

2022-12-14  tb  <tb@openbsd.org>

        Plug leak of ECDSA_SIG

        ok sthen

2022-11-09  mbuhl  <mbuhl@openbsd.org>

        nreq could leak a http get request in case a redirect without location
        header was received. OK deraadt

2022-10-09  op  <op@openbsd.org>

        allow newlines inside the `alternative names' block in acme-client.conf

        ok florian

2023-06-10  Tomas Volf  <~@wolfsden.cz>

        Add manifest.scm

        Manifest with tools required to build the acme-client-portable from git.

2022-09-16  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2022-08-28  tb  <tb@openbsd.org>

        Make a few error messages match the actually failing function.

2022-08-28  jsing  <jsing@openbsd.org>

        Set the X.509 request version number.

        Rather than assuming the default value from X509_REQ_new(), explicitly
        set
        the X.509 request version number to zero.

        ok tb@

                                                                      (v1.3.1)
2022-08-11  Tomas Volf  <~@wolfsden.cz>

        Release 1.3.1

2022-08-08  Tomas Volf  <~@wolfsden.cz>

        Run tests against libressl 3.5.3

2022-08-08  Tomas Volf  <~@wolfsden.cz>

        Run tests on stable alpine as well

2022-07-23  Ruud van Asseldonk  <dev@veniogames.com>

        Fix compatibility with LibreSSL 3.5

        LibreSSL 3.5 supports the same interface as OpenSSL. This breaks
        compatibility with LibreSSL 3.4, which does not support this interface,
        but if you are using a recent acme-client, you should probably also be
        using a recent LibreSSL.

2022-08-06  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2022-05-05  florian  <florian@openbsd.org>

        Check that the challenge token which is turned into a filename is
        base64url encoded. We have only the challenge directory unveil(2)'ed so
        funny business like ../ will not work, but we shouldn't generate
        garbage filenames that someone else might trip over either. Pointed out
        and diff by Ali Farzanrad (ali_farzanrad AT riseup.net) OK beck

2022-02-22  tb  <tb@openbsd.org>

        Plug leak in ec_key_create()

        EVP_PKEY_set1_EC_KEY() bumps the refcount of eckey, so eckey won't be
        freed at the end of keyproc() or acctproc(), which means that secrets
        aren't wiped. Move EC_KEY_free() to the out label, so that the refcount
        is decremented or the key freed, as appropriate.

        tested/ok claudio

2022-02-22  tb  <tb@openbsd.org>

        whitespace/KNF

2022-02-22  tb  <tb@openbsd.org>

        acme-client: only warn on PEM_write_ECPrivateKey() failure instead of
        everytime ec_create_key() is called.

        From wolf at wolfsden dot cz

        ok florian

2022-02-03  Jordan Christiansen  <xordspar0@gmail.com>

        Run nginx test server on localhost only

        Previously nginx would bind to all interfaces, including public ones.

                                                                      (v1.3.0)
2022-02-02  Tomas Volf  <~@wolfsden.cz>

        Release 1.3.0

2022-02-02  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2022-01-21  deraadt  <deraadt@openbsd.org>

        the wrapped cron line is going to lose people

2022-01-17  Tomas Volf  <~@wolfsden.cz>

        Add script to check release tarball

        It is necessary to validate, that the released tarball actually contains
        everything necessary to compile the program without any additional
        dependencies (for example bison). This script can be used to take any
        tarball for a spin using the sr.ht's build jobs.

2022-01-17  Tomas Volf  <~@wolfsden.cz>

        Fix libressl compilation

        After last sync from upstream, r->[en] was replaced by RSA_get0_[en],
        and I've accepted the change since it was supposed to simplify the code.
        However, version of libressl available outside of OpenBSD does not yet
        provide this function, so it broken the builds. This commit basically
        reverts the merge.

        Next time I should verify it actually compiles and passes the tests
        before pushing.

2022-01-16  Tomas Volf  <~@wolfsden.cz>

        Check system as well in the automated builds

        I forgot to add this check into automated builds. Since it is the one
        running checkdisk, it definitely must run as well.

2022-01-16  Tomas Volf  <~@wolfsden.cz>

        Sync openbsd branch

2022-01-14  tb  <tb@openbsd.org>

        Fix acme-client build with opaque RSA

2022-01-16  Tomas Volf  <~@wolfsden.cz>

        Add automated builds

        Run tests on libressl and both openssls on alpine and archlinux. More
        platforms can be added later, this should however cover majority of user
        base.

2022-01-16  Tomas Volf  <~@wolfsden.cz>

        Add INSTALL instructions

        Also we should actually distribute both README and INSTALL files.

2022-01-09  Tomas Volf  <~@wolfsden.cz>

        Add support for openssl 3.0

        Sadly openssl 3.0 decided to deprecate parts of the API, so adding
        support for it was not exactly one-line change. Especially if the
        requirement is to support both openssl versions (1.1.1 and 3.0) and
        libressl at the same time.

        Few more tests were also added so make sure the openssl 3.0 port is
        correct.

2021-12-26  Tomas Volf  <~@wolfsden.cz>

        Add and use ax_check_libtls

        I cannot think of a reason not to use same macro for libtls as is used
        for openssl. This has the advantage that both dependencies are now
        configured in the same style using similar ./configure options.

2021-12-24  Tomas Volf  <~@wolfsden.cz>

        Make the source code portable

        This commit implements support for libressl and openssl 1.1.1 outside of
        OpenBSD. I've tried to introduce as little changes as possible.

2021-12-15  Tomas Volf  <~@wolfsden.cz>

        Add README

        This commit adds README with basic information and clarification of the
        licensing.

2021-12-15  Tomas Volf  <~@wolfsden.cz>

        Add tooling for syncing from the upstream

        Since there is a git-based mirror of openbsd source, this new port if
        using it instead of CSV (I've never learned to use it properly).

        Also the import was done and last sync commit recorded.

2021-12-13  jca  <jca@openbsd.org>

        Let dnsproc pass multiple addresses to netproc

        The loop was exited prematurely because of a stray break statement.
        In case of a failure to connect to the first address returned by
        getaddrinfo(3), acme-client can now try to connect using another address
        or address family if available.

        ok florian@

2021-11-22  tb  <tb@openbsd.org>

        acme-client: use BIO_number_written(bio) instead of bio->num_write.
        Avoid awkward line wrapping by removing awkward else if chaining.

        ok claudio florian

2021-11-18  tb  <tb@openbsd.org>

        acme-client: use EVP_PKEY_base_id()

        In an upcoming libcrypto bump, EVP_PKEY will become opaque. In order to
        stop reaching inside EVP_PKEY, we must replace EVP_PKEY_type(pkey->type)
        with the equivalent EVP_PKEY_base_Id(pkey) in various places.

        ok florian

2021-10-15  naddy  <naddy@openbsd.org>

        Don't declare variables as "unsigned char *" that are passed to
        functions that take "char *" arguments. Where such chars are assigned
        to int or passed to ctype functions, explicitly cast them to unsigned
        char.

        For OpenBSD's clang, -Wpointer-sign has been disabled by default,
        but when the parse.y code was built elsewhere, the compiler would
        complain.

        With help from millert@
        ok benno@ deraadt@

2021-10-13  tb  <tb@openbsd.org>

        acme-client: stop reaching into X509

        Prepare for an upcoming change in libcrypto and retrieve the stack
        of extensions via X509_get0_extensions(). Simplify the for loop by
        relying on the fact that empty or NULL stacks have an sk_num() of 0
        and -1, respectively, so the loop won't be entered and the extsz
        dance is unnecessary.

        ok florian

2021-09-17  sthen  <sthen@openbsd.org>

        Fix subjectAlternativeName (SAN) generation for CSRs. CA/B Forum
        baseline requirements require that it's used in certificates so it
        makes sense to generate a CSR compliant with this, additionally it
        replaces rather than adds to the name in the certificate's subject
        which we weren't handling correctly. Diff from wolf at wolfsden/cz, ok
        florian@

2021-09-14  tb  <tb@openbsd.org>

        Add missing void to definition of http_init().

        ok deraadt florian

2021-08-24  benno  <benno@openbsd.org>

        fix outdated comments, from Emil Engler, thanks.

2021-07-14  kn  <kn@openbsd.org>

        Remove unneeded calls to tls_init(3)

        As per the manual and lib/libtls/tls.c revision 1.79 from 2018
        "Automatically handle library initialisation for libtls." initialisation
        is handled automatically by other tls_*(3) functions.

        Remove explicit tls_init() calls from base to not give the impression of
        it being needed.

        Feedback tb
        OK Tests mestre

2021-07-12  beck  <beck@openbsd.org>

        Change the error reporting pattern throughout the tree when unveil
        fails to report the path that the failure occured on. Suggested by
        deraadt@ after some tech discussion.

        Work done and verified by Ashton Fagg <ashton@fagg.id.au>

        ok deraadt@ semarie@ claudio@

2021-05-13  tb  <tb@openbsd.org>

        acme-client: use EC_POINT_{get,set}_affine_cooordinates()

        The versions with _GFp() suffix only exist for historical reasons.
        Now that we have EC_POINT_{get,set}_affine_coordinates(), we should
        stop using the old ones as they provide no benefit.

        ok florian

2021-02-12  sthen  <sthen@openbsd.org>

        Xr to ssl(8) which has clues about EC key generation that are still
        useful to acme-client users.

2021-01-11  jmc  <jmc@openbsd.org>

        document how to specify multiple alternative names; modified version of
        diff from wolf on misc, improved by and ok florian benno sthen

2021-01-03  florian  <florian@openbsd.org>

        Create .1 backup files when acme-client is going to overwrite a
        certificate file. These files are not terribly big and they might
        become helpful if one re-creates a certificate with additional or
        removed domains and whishes to revoke the old cert (this part needs a
        bit of work to make it convenient to do). OK sthen

2021-01-02  sthen  <sthen@openbsd.org>

        If acme-client detects an added or removed SAN in the config file
        compared to the existing certificate on disk, automatically request a
        new certificate without requiring -F.

        (Previously the code using -F only coped with added SANs; if one was
        removed in config then the certificate needed manual removal vefore
        acme-client would work).

        Name checks for -r (revocation) are kept as-is for now.

2020-12-24  florian  <florian@openbsd.org>

        First fulfil all challenges then tell the CA that it should check.

        For http-01 this doesn't matter but I think this will be nicer for
        dns-01 because there are propagation delays to consider and it will be
        better to just put everything in DNS and then wait then wait after
        each challenge.

        Testing & OK sthen

2020-12-19  tb  <tb@openbsd.org>

        remove extra s

2020-12-18  solene  <solene@openbsd.org>

        Add details to -F flag

        If you add alternatives domain names to
        acme-client.conf, using -F is required to
        renew the certificate with the new names.

        ok jmc@

2020-11-18  beck  <beck@openbsd.org>

        Do not check the list of SAN's in the cert when -F is specified to
        force renewal

        This allows you to add a SAN DNS name to a cert, and request a forced
        renewal
        to get the new name added immediately

        ok florian@

2020-11-06  sthen  <sthen@openbsd.org>

        mention that acme-client generates a 4096-bit or secp384r1 key if the
        key file doesn't exist; ok florian jmc

2020-11-04  denis  <denis@openbsd.org>

        Back out last commit.

        Some devs are not convinced.

2020-11-02  denis  <denis@openbsd.org>

        acme response challenge location to issue better error code

        Notified to me by jmc@

        Diff by Matthias Pressfreund <mpfr @ fn de>, thanks

2020-09-14  florian  <florian@openbsd.org>

        We need to be able to provide contact information to use the
        buypass.com acme api. From Bartosz Kuzma (bartosz.kuzma AT
        release11.com), thanks! OK beck, deraadt

2020-09-14  florian  <florian@openbsd.org>

        Relax parsing of pem files a bit. Apparently there are CAs that use
        \r\n line endings. From Bartosz Kuzma (bartosz.kuzma AT release11.com)
        as part of a larger diff. OK beck

2020-09-14  florian  <florian@openbsd.org>

        Report what's wrong when account creation fails instead of a generic
        http error. OK beck

2020-06-07  florian  <florian@openbsd.org>

        whitespace

2020-06-07  florian  <florian@openbsd.org>

        Swap arguments of calloc(3). While it doesn't matter for calloc, it's
        easier on the eyes to always list the number of elements first and then
        the size. From Donovan Watteau ( contrib AT dwatteau.fr), Thanks!

2020-05-16  sthen  <sthen@openbsd.org>

        somehow yacc pieces got missed from the "domain name" commit; add them.
        ok florian@

2020-05-16  jmc  <jmc@openbsd.org>

        list example files in FILES with a short description: generally,
        "Example configuration file.", but occasionally something else fit
        better; at the same time, try to make the format for FILES more
        consistent;

        original diff from clematis

2020-05-12  jmc  <jmc@openbsd.org>

        new sentence, new line;

2020-05-10  florian  <florian@openbsd.org>

        In case the order fails print the human readable reason from the
        challenge objects that the server hopefully provides. input & OK
        deraadt OK beck, benno

2020-05-10  florian  <florian@openbsd.org>

        remove noisy and useless debug line

2020-05-10  benno  <benno@openbsd.org>

        Allow to have multiple domain ... {} sextions with the same domain
        name, by adding a new (optional) config option "domain name". This can
        be used to create a rsa and an ecdsa key for the same domain name. The
        old domain name in the 'title' line continues to be used as domain name
        in the abscence of the domain name argument, i.e. the change is
        backward compatible with current config files. tested by sthen@ ok
        florian@ sthen@

2020-04-15  millert  <millert@openbsd.org>

        Use the new random interval support in cron instead of a random sleep.
        The random intervals used can be adjusted as needed. OK deraadt@

2020-02-10  schwarze  <schwarze@openbsd.org>

        briefly mention /etc/examples/ in the FILES section of all the manual
        pages that document the corresponding configuration files; OK jmc@, and
        general direction discussed with many

2020-02-07  florian  <florian@openbsd.org>

        Do not define variables in extern.h since this will lead to duplicate
        definitions in every source file that includes extern.h. From Michael
        Forney (mforney AT mforney DOT org), thanks! OK jca

2020-01-22  tedu  <tedu@openbsd.org>

        use the correct length to allocate the right amount, broken by
        previous. noticed by Matthew Martin ok deraadt

2020-01-22  tedu  <tedu@openbsd.org>

        set array length after allocation succeeds so free path doesn't deref
        null. ok deraadt

2020-01-20  sthen  <sthen@openbsd.org>

        Remove the tls_close warnx in acme-client. Currently it very often
        reports a spurious "acme-client: tls_close: EOF without close notify"
        warning which is plain confusing - it is a warning only, doesn't block
        anything, but when people have some other failure (network problems,
        bad acme-challenge path in webserver, etc) they often see this message
        and think that it's relevant.

        The libtls warning is there to detect truncation attacks in protocols
        that don't have their own way to do so (e.g. HTTP/0.9). HTTP/1.0 or
        newer
        have methods to do this (Content-Length or chunked transfer encoding);
        acme-client doesn't check them yet and perhaps should. But that's a
        separate
        issue, the warnx doesn't really help with this anyway, and it's unlikely
        that a truncated json payload would be valid for acme-client parsing
        anyway.

        OK florian@ benno@

2019-12-27  benno  <benno@openbsd.org>

        make -n stop after parsing the config. make -nv print the parsed
        configuration, then stop. ok sthen@, seems better deraadt@

2019-11-06  florian  <florian@openbsd.org>

        Give acme-client a chance to work on IPv6 only hosts by using the
        AI_ADDRCONFIG flag for getaddrinfo to only return addresses for a
        configured address family.

        Implementing a loop over all IPs is left as an exercise to the reader.

        Reported some time ago by kasimov.an AT gmail on bugs@, thanks!

        oh boy deraadt@
        OK benno@

2019-08-12  benno  <benno@openbsd.org>

        Do not exit with error if the challenge file already exists, instead
        truncate it and write the challenge again. We can get asked to supply
        the same challenge multiple times. bug found and patch tested by jmc@
        patch discussed with, mangled and okayed by florian@

2019-08-11  florian  <florian@openbsd.org>

        In let's encrypt v1 we had to track a challenge for every domain in the
        certificate we were requesting.

        This is no longer true in v2 and we have to free the amount of
        challenges the server told us to fullfill.

        OK benno

2019-07-12  florian  <florian@openbsd.org>

        According to RFC 8555 we MUST send an User-Agent. Pointed out and diff
        by Wolf, thanks! Tweaked by me. OK benno

2019-07-04  solene  <solene@openbsd.org>

        Use v02 let's encrypt API key as in the example file

        ok deraadt@

2019-06-28  deraadt  <deraadt@openbsd.org>

        When system calls indicate an error they return -1, not some arbitrary
        value < 0. errno is only updated in this case. Change all (most?)
        callers of syscalls to follow this better, and let's see if this
        strictness helps us in the future.

2019-06-18  florian  <florian@openbsd.org>

        When the parser detects that it needs more tokens it returns
        JSMN_ERROR_NOMEM. We then need to allocate more tokens and call the
        parser with its current state again. It will continue where it left of.
        For this to work we also need to pass in the old tokens from the
        previous run and not just more space.

        Found the hard way by Renaud Allard.
        OK millert

2019-06-17  florian  <florian@openbsd.org>

        It's enough to allocate the EC key once. OK tb

2019-06-17  tb  <tb@openbsd.org>

        One NULL-check before EVP_MD_CTX_free() was left in previous.

2019-06-17  florian  <florian@openbsd.org>

        Use non-deprecated API; from Renaud Allard, thanks! OK tb

2019-06-17  florian  <florian@openbsd.org>

        Implement elliptic curve account keys. OK benno Input & OK tb

2019-06-17  florian  <florian@openbsd.org>

        s/get1/get0/ in comments

2019-06-16  florian  <florian@openbsd.org>

        Trade unveil(2) for chroot(2). This uses less code and unveil(2) seems
        to be the better tool here. The directory one chroots into needs to be
        carefully setup (they are not) and comon wisedom is that root can break
        out of chroots. There is probably nothing wrong with the chroot code
        because of pledge but it still makes me feel uneasy. input & OK on
        previous version mestre OK on previous version deraadt bug found, input
        & OK benno

2019-06-16  florian  <florian@openbsd.org>

        Do not leak rsa keys; nobody is messing with the reference behind our
        back so there is no need to get a copy. Clue & probably OK tb

2019-06-16  florian  <florian@openbsd.org>

        acctkey indirection is unnecessary, just pass authority->account

2019-06-15  florian  <florian@openbsd.org>

        Remove bugs section. It is missleading to call (parts of) acme-client
        staying root a bug. Discussed with deraadt@

        Non-RSA account keys are (probably) coming, so remove that as well
        while here.

2019-06-15  florian  <florian@openbsd.org>

        Now that we have different key types (rsa and ecdsa) we probably should
        do something if the key type on disk differes from the configured
        keytype. Mark this XXX for now.

2019-06-15  florian  <florian@openbsd.org>

        Print domain key type in config test mode (-n).

2019-06-14  florian  <florian@openbsd.org>

        Track key type (RSA or ECDSA) in an enum and clean up a bit while here.
        Originaly from Renaud Allard following input from benno, tweaked by me.
        OK benno

2019-06-12  jmc  <jmc@openbsd.org>

        tweak previous;

2019-06-12  gilles  <gilles@openbsd.org>

        these were moved to key.[ch] in previous commit

2019-06-12  gilles  <gilles@openbsd.org>

        use acme-client to sign certificated with ecdsa keys

        diff from Renaud Allard <renaud@allard.it>, ok to get in from florian@

2019-06-08  florian  <florian@openbsd.org>

        remove unused variable

2019-06-08  florian  <florian@openbsd.org>

        Remove A and D flag, they are superfluous. One could always use them on
        the command line and acme-client would do the right thing.

2019-06-07  florian  <florian@openbsd.org>

        Implement RFC 8555 "Automatic Certificate Management Environment
        (ACME)" to be able to talk to the v02 Let's Encrypt API.

        With this acme-client(1) will no longer be able to talk to the v01
        API. Users must change the api url in /etc/acme-client.conf to
        https://acme-v02.api.letsencrypt.org/directory
        Existing accounts (and certs of course) stay valid and after the url
        change acme-client will be able to renew certs.

        Tested by Renaud Allard and benno
        Input & OK benno

2019-04-01  naddy  <naddy@openbsd.org>

        repair confusing "} if"; from florian@

2019-03-09  benno  <benno@openbsd.org>

        remove free() before exit() from main(), in ongoing work to make things
        more readable. otto notes that free() does some checks, but in this
        case readability is better than complete cleanup. ok florian@ deraadt@

2019-03-09  benno  <benno@openbsd.org>

        use temporary strings for calls to basename(), because it may change
        the contents of its argument (on other platforms). Also strdup() the
        result, because basename returns a pointer to static memory. ok florian@

2019-03-08  benno  <benno@openbsd.org>

        fix dirname usage in acme-client: dirname() can modify its argument (it
        does not on OpenBSD) so we need to us a copy of the string. In
        addition, copy the result of dirname() as well, because it's static
        storage and if we call dirname() again it will be overwritten. Original
        problem noted and fix suggested by Wolf (wolf AT wolfsden DOT cz) ok
        florian@

2019-03-04  florian  <florian@openbsd.org>

        According to RFC 7230 Section 3.2 header field names are
        case-insensitive. Pointed out by "Wolf" ( wolf at wolfsden.cz ),
        thanks! OK benno

2019-02-13  deraadt  <deraadt@openbsd.org>

        (unsigned) means (unsigned int) which on ptrdiff_t or size_t or other
        larger types really is a range reduction... Almost any cast to
        (unsigned) is a bug. ok millert tb benno

2019-02-03  jmc  <jmc@openbsd.org>

        flesh this page out a bit to (hopefully) make it more helpful; sthen
        suggested adding a random sleep (like we do with spamd) for the example
        cron job;

        help/ok sthen benno florian

2019-02-01  benno  <benno@openbsd.org>

        fix comments and clean up whitespace ok florian@

2019-02-01  benno  <benno@openbsd.org>

        if not all challenges were validated, retry again. Found and fix
        suggested by "Thomas L.", tom AT longshine AT web DOT de, Thanks! ok
        florian@

2019-01-31  benno  <benno@openbsd.org>

        make struct chng.status a enum for readability. ok florian@

2019-01-30  jmc  <jmc@openbsd.org>

        consistently talk about domain key; ok benno

2019-01-29  benno  <benno@openbsd.org>

        add an extra check for existing "api ..." line in the config. move the
        check of existing "account ..." line from main.c to the parser. ok
        deraadt@

2019-01-08  florian  <florian@openbsd.org>

        With the change to httpd the workflow got much simpler.

2019-01-08  florian  <florian@openbsd.org>

        Remove missleading and outdated examples from man page.
        /etc/examples/httpd.conf and /etc/examples/acme-client.conf (comming
        soon) are better places. Pointed out by & OK deraadt, OK benno

2018-11-29  tedu  <tedu@openbsd.org>

        update for libtls default cert changes. bonus: this exposed a few
        missing const qualifiers.

2018-11-06  jsing  <jsing@openbsd.org>

        Use TLS_CA_CERT_FILE instead of a separate define.

        ok beck@ bluhm@ tb@

2018-11-01  sashan  <sashan@openbsd.org>

        - odd condition/test in PF lexer (and other lexers too)

        This commit rectifies earlier change:

            in the lex... even inside quotes, a \ followed by space or tab
        should
            expand to space or tab, and a \ followed by newline should be
        ignored
            (as a line continuation).  compatible with the needs of hoststated
            (which has the most strict quoted string requirements), and ifstated
            (where one commonly does line continuations in strings).

        OK deraadt@, OK millert@

2018-09-07  miko  <miko@openbsd.org>

        replace malloc()+strlcpy() with strndup() in cmdline_symset().

        "looks good" gilles@ halex@

2018-08-08  deraadt  <deraadt@openbsd.org>

        In netproc process, unveil to only expose the CA file. ok florian

2018-08-03  benno  <benno@openbsd.org>

        return is not a function and if (x) -> if (x != NULL) From Ross L
        Richardson, thanks ok millert@

2018-08-03  benno  <benno@openbsd.org>

        fix error messages from earlier syntax change From Ross L Richardson ok
        millert@

2018-08-03  benno  <benno@openbsd.org>

        correct an error message, from Ross L Richardson ok millert@

2018-08-03  benno  <benno@openbsd.org>

        document the default in the abscence of a certificate authority. From
        Ross L Richardson

2018-08-03  benno  <benno@openbsd.org>

        Document that domain certificate is optional. From Ross L Richardson

2018-08-02  benno  <benno@openbsd.org>

        According to code (and testing), each is optional but at least one must
        be present. From Ross L Richardson, thanks ok sthen@

2018-08-02  benno  <benno@openbsd.org>

        It's an "X.509 certificate" rather than a "TLS certificate". As pointed
        out by sthen@, TLS isn't the only possible use. From Ross L Richardson
        ok shten@

2018-08-02  benno  <benno@openbsd.org>

        its a X.509 certificate, consistency with acme-client.conf.5 From Ross
        L Richardson ok sthen@

2018-07-30  benno  <benno@openbsd.org>

        cleanup initialization of chngdir. inspired by Ross L Richardson. ok tb@

2018-07-30  benno  <benno@openbsd.org>

        replace exit() with return(), from Ross L Richardson. ok tb@ (previous
        3 commits to main.c as well)

2018-07-30  benno  <benno@openbsd.org>

        replace warn() + exit() with err() From Ross L Richardson.

2018-07-30  benno  <benno@openbsd.org>

        line too long and whitespace. From Ross L Richardson.

2018-07-30  benno  <benno@openbsd.org>

        reorder option parsing to be alphabetical/same order as usage and
        manpage. From Ross L Richardson.

2018-07-29  tb  <tb@openbsd.org>

        Remove NULL checks before X509_{REQ,NAME}_free() and zap an unnecessary
        pair of parens.

        From Ross L. Richardson

2018-07-29  benno  <benno@openbsd.org>

        replace hand-rolled tmp files with mkstemp() ok florian@ back in april,
        reminded by theo.

2018-07-29  deraadt  <deraadt@openbsd.org>

        remove extra space in output; from Ross L Richardson

2018-07-28  tb  <tb@openbsd.org>

        Remove NULL checks before (most) libcrypto *_free() functions. From
        Ross L. Richardson, thanks!

        ok deraadt

2018-07-11  krw  <krw@openbsd.org>

        Do for most running out of memory err() what was done for most running
        out of memory log_warn(). i.e. ("%s", __func__) instead of manual
        function names and redundant verbiage about which wrapper detected the
        out of memory condition.

        ok henning@

2018-07-09  krw  <krw@openbsd.org>

        No need to mention which memory allocation entry point failed (malloc,
        calloc or strdup), we just need to log that we ran out of memory in a
        particular function.

        Recommended by florian@ and deraadt@

        ok benno@ henning@ tb@

2018-07-08  krw  <krw@openbsd.org>

        Be consistent in warn() and log_warn() usage when running out of memory.

        Next step, be correct *and* consistent.

        ok dennis@ tb@ benno@ schwarze@

2018-07-08  benno  <benno@openbsd.org>

        clarify account key (pair) vs certificate (domain) key pair, and that
        the domain block really describes a certificate to manage. from Ross L
        Richardson <openbsd at rlr dot id dot au>, thanks with feedback and ok
        jmc and sthen

2018-06-17  denis  <denis@openbsd.org>

        Fix an off-by-one line count when using include statements.

        Thanks to otto@ for the initial diff.

        OK benno@

2018-06-13  reyk  <reyk@openbsd.org>

        Rename httpd.conf "root strip" option to "request strip".

        "root strip" was semantically incorrect and did cause some confusion
        as it never stripped the root but the client's request path.

        Discussed with many.  Heads up: this is a grammar change that also
        affects acme-client(1) configurations (see current.html).

        OK claudio@

2018-04-26  krw  <krw@openbsd.org>

        Plug leak in error case of the common 'varset' implementations.

        ok benno@

2018-04-08  florian  <florian@openbsd.org>

        We warned long enough, also sysmerge(8) should have handled the removal
        of the agreement url by now.

        OK benno

2018-03-15  otto  <otto@openbsd.org>

        writebufg() does two write(2) calls, both can return EPIPE, so handle
        it in both cases. Avoids race in the exit path. ok sthen@ florian@

2018-03-14  florian  <florian@openbsd.org>

        letsencrypt responded with a 301 redirect when requesting the chain
        certificate for some time. While they stopped doing so it seems best to
        follow redirects anyway.

        More status codes pointed out by & OK sthen
        OK benno

2018-02-06  florian  <florian@openbsd.org>

        move malloc check up so that it actually works. OK benno

2018-02-06  florian  <florian@openbsd.org>

        kill dead code

2017-11-27  sthen  <sthen@openbsd.org>

        lenght->length, mostly in comments

2017-11-27  florian  <florian@openbsd.org>

        Deprecate agreement url config option and get the information from the
        directory call. This way we don't need to update the acme-client.conf
        file every time it changes. Still parse the option, ignore and warn
        about it for a release. Sysmerge should be able to handle the removal.
        "nice" deraadt@ OK benno

2017-10-19  jsg  <jsg@openbsd.org>

        fix a use after free and a memory leak in error paths ok deraadt@
        florian@

2017-10-17  schwarze  <schwarze@openbsd.org>

        add missing HISTORY; based on CVS logs and release announcements

2017-07-08  tb  <tb@openbsd.org>

        fix typo in comment

        from Hiltjo Posthuma

2017-07-03  espie  <espie@openbsd.org>

        no need to generate y.tab.h if nothing uses it, set YFLAGS to nothing
        instead of CLEANFILES += y.tab.h

        okay millert@

2017-05-27  florian  <florian@openbsd.org>

        Use basename(3) instead of hand rolling it. Gets rid of double slashes,
        pointed out by Raf Czlonka (rczlonka at gmail), thanks!

        OK benno

2017-03-29  tj  <tj@openbsd.org>

        account key needs to be in quotes.

        ok benno deraadt

2017-03-26  deraadt  <deraadt@openbsd.org>

        recallocarray() for data buffer from the net. ok beck

2017-03-23  florian  <florian@openbsd.org>

        It is perfectly valid to have a cert / key not owned by root; remove
        useless check. OK benno

2017-03-23  florian  <florian@openbsd.org>

        pull root check up, the parser will bomb out anyway OK benno

2017-03-22  benno  <benno@openbsd.org>

        Improve manpage and config file to show the more common use case. from
        Nick Holland (nick AT holland-consulting DOT net) ok jmc@ florian@

2017-03-20  ajacoutot  <ajacoutot@openbsd.org>

        Simplify cron(8) job example.

        input from jmc@
        ok tb@ deraadt@

2017-02-03  guenther  <guenther@openbsd.org>

        Don't use <sys/param.h> from userland without cause. Sort <sys/*>
        before other includes per style(9) while we're here.

        ok florian@ bcook@ jsing@ beck@

2017-01-28  jmc  <jmc@openbsd.org>

        - -N got changed to -D - there is no Challenges section

        reported by michael reed

2017-01-25  inoguchi  <inoguchi@openbsd.org>

        remove __BEGIN_DECLS and __END_DECLS from http.h sync with ocspcheck
        and acme-client ok benno@

2017-01-24  jsing  <jsing@openbsd.org>

        Make returns consistent and remove parentheses per style(9).

        Transformed with coccinelle.

        Requested by and ok tb@

2017-01-24  tb  <tb@openbsd.org>

        nuke extra brackets. discussed with jsing

2017-01-24  deraadt  <deraadt@openbsd.org>

        Complete jsing's coccinelle cleanup... by hand ok jsing

2017-01-24  deraadt  <deraadt@openbsd.org>

        errx() does not need extra newline

2017-01-24  jsing  <jsing@openbsd.org>

        Replace comparisons between a constant or enum and an expression, with
        a comparison between the expression and the constant or enum. This
        significantly improves readability.

        Transformed with coccinelle.

        Requested by deraadt@

2017-01-24  deraadt  <deraadt@openbsd.org>

        string terminator is called a NUL

2017-01-23  deraadt  <deraadt@openbsd.org>

        whitespace

2017-01-21  jmc  <jmc@openbsd.org>

        tweak previous;

2017-01-21  benno  <benno@openbsd.org>

        find the first authority works better this way, now that we use a tailq
        ok florian@

2017-01-21  benno  <benno@openbsd.org>

        move config data structures mostly to TAILQs, because that way we
        preserve order.

        ok florian@

2017-01-21  florian  <florian@openbsd.org>

        it is ok to only specify a full chain certificate OK benno

2017-01-21  benno  <benno@openbsd.org>

        dont print config if its broken ok florian@

2017-01-21  florian  <florian@openbsd.org>

        it's chain certificate not certificate chain

2017-01-21  florian  <florian@openbsd.org>

        Enforce minimum config in the parser. Based on a diff by & OK benno@

2017-01-21  benno  <benno@openbsd.org>

        Improve Documentation

        ok florian

2017-01-21  benno  <benno@openbsd.org>

        add option 'domain full chain certificate "path"', revokation works,
        the fullchain file will be unlinked.

        ok florian

2017-01-21  benno  <benno@openbsd.org>

        document default challengedir "/var/www/acme"

2017-01-21  benno  <benno@openbsd.org>

        see also acme-client.conf(5) suggested by millert and Raf Czlonka ok
        florian

2017-01-21  florian  <florian@openbsd.org>

        Implement domain chain certificate. OK benno

2017-01-21  florian  <florian@openbsd.org>

        Split certificate file from config file into certdir and certfile. This
        way we can still chroot to certdir but the the certificate file is not
        fixed to "cert.pem".

        Writing of chain.pem and fullchain.pem is currently broken with this.

        OK benno

2017-01-21  florian  <florian@openbsd.org>

        remove unused vars; OK benno

2017-01-21  florian  <florian@openbsd.org>

        Remove backup option. This is not acme-client's business; also it gets
        in the way. OK benno

2017-01-21  florian  <florian@openbsd.org>

        We are only dealing with one domain on the command line OK benno

2017-01-21  florian  <florian@openbsd.org>

        typo; ok benno

2017-01-21  florian  <florian@openbsd.org>

        kill remote with fire, we need to handle this differently OK benno

2017-01-21  florian  <florian@openbsd.org>

        typo; ok benno

2017-01-21  benno  <benno@openbsd.org>

        acme-client use configuration file [5 of 5] implement new -n option to
        check and print configuration

        ok florian

2017-01-21  benno  <benno@openbsd.org>

        acme-client use configuration file [4 of 5]

        fix getopt()

        ok florian

2017-01-21  benno  <benno@openbsd.org>

        acme-client use configuration file [3 of 5]

        change command line options:

            n -> A   new Account key
            N -> D   new Domain key

        With this acme-client has these main usage patterns:

        * create new Account Key and Domain Key and get a certificate:

          acme-client -A -D www.example.com

        * renew certificate:

          acme-client www.example.com

        * revoke certificate:

          acme-client -r www.example.com

        ok florian

2017-01-21  benno  <benno@openbsd.org>

        acme-client use configuration file [2 of 5]

        - add challengedir option to config file
        - remove -C option from command line

        ok florian

2017-01-21  benno  <benno@openbsd.org>

        acme-client use configuration file [1 of 5]

        start using the configuration file and delete command line arguments:

        -a agreement    -> agreement url ...
        -c certdir      -> domain certificate "path"
        -f accountkey   -> account key "path"
        -k domainkey    -> domain key "path"
        -s authority    -> sign with "name"

        new argument:
        -f configfile

        the changes needed to use the new configuration are local to main.c for
        now.
        While the configuration could be passed directly to netproc(),
        keyproc() etc,
        the diff is smaller this way.

        This also removes the multidir (-m) mode for now - specify different
        paths in
        each domain {} block instead.

        ok florian

2017-01-05  krw  <krw@openbsd.org>

        Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with more
        modern TAILQ_FOREACH_SAFE().

        No intentional functional change.

        ok millert@ bluhm@ gilles@

2017-01-05  krw  <krw@openbsd.org>

        Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQ
        with more modern TAILQ_FOREACH(). This what symget() was already doing.

        Add paranoia '{}' around body of symget()'s TAILQ_FOREACH().

        No intentional functional change.

        ok bluhm@ otto@

2016-11-02  jsing  <jsing@openbsd.org>

        Use secure defaults for TLS - instead of accepting TLSv1.0 and any
        cipher suite, use the libtls defaults and require TLSv1.2 with an
        AEAD+PFS cipher suite - given who we're talking to one would hope that
        they meet these requirements...

        ok benno@ deraadt@ florian@

2016-10-04  jsing  <jsing@openbsd.org>

        Avoid a potential MITM - calling tls_config_insecure_noverify() is a
        bad idea, so stop doing that. Instead, use a single tls_config, set it
        up and configure the CA file to use while we still have rpath, then
        drop rpath. This also avoids creating a new tls_config for each and
        every HTTPS connection, which is unnecessary.

        ok benno@ florian@

2016-10-04  jsing  <jsing@openbsd.org>

        s/letsencrypt/ACME/

2016-10-04  jsing  <jsing@openbsd.org>

        tls_close() can return TLS_WANT_POLLIN/TLS_WANT_POLLOUT - handle this
        case correctly.

        ok florian@

2016-09-24  jsing  <jsing@openbsd.org>

        The file descriptor needs to be closed in both the TLS and non-TLS
        case, so make it a common/shared code path.

2016-09-24  jsing  <jsing@openbsd.org>

        Both tls_free() and tls_config_free() are safe to call with NULL.

2016-09-24  jsing  <jsing@openbsd.org>

        Remove more backwards compat for unsupported OpenBSD releases.

2016-09-20  benno  <benno@openbsd.org>

        reoorder includes, noticed by & ok florian@

2016-09-18  jmc  <jmc@openbsd.org>

        tweak previous;

2016-09-18  benno  <benno@openbsd.org>

        add a config file parser to acme-client (unused at the moment, so that
        it can be worked on in the tree). ok florian@ deraadt@

2016-09-15  jmc  <jmc@openbsd.org>

        more fat trimming;

2016-09-14  tj  <tj@openbsd.org>

        move default file and directory locations to a new FILES section and
        trim some extraneous text.

        ok florian jmc deraadt

2016-09-13  tedu  <tedu@openbsd.org>

        convert some ifs to switches. ok millert tb

2016-09-13  deraadt  <deraadt@openbsd.org>

        A small amount more KNF to make this easier on our eyes. Not going
        further than this. ok florian

2016-09-13  deraadt  <deraadt@openbsd.org>

        hoist local variable initialization directly into the definitions,
        rather than doing it right afterwards. ok florian

2016-09-13  deraadt  <deraadt@openbsd.org>

        Inconsistant use of case (value): idiom drives me nuts, I have no idea
        what purpose it was intended to serve.

2016-09-13  deraadt  <deraadt@openbsd.org>

        RAND_status() and RAND_seed() are not needed, this is 2016.

2016-09-13  deraadt  <deraadt@openbsd.org>

        use reallocarray()

2016-09-13  deraadt  <deraadt@openbsd.org>

        chroot is not the reason this is run as root

2016-09-06  jmc  <jmc@openbsd.org>

        some indent; from michael reed

2016-09-05  deraadt  <deraadt@openbsd.org>

        We do not compile things -g by default

2016-09-05  deraadt  <deraadt@openbsd.org>

        this file cannot be kept accurate

2016-09-01  tb  <tb@openbsd.org>

        Use b64_ntop instead of adding yet another base implementation of
        base64 encoding to base. Tweaked version of a diff by florian.

        ok florian

2016-09-01  florian  <florian@openbsd.org>

        update usage(); pointed out by jmc@

2016-09-01  jmc  <jmc@openbsd.org>

        tidy up the list;

2016-09-01  florian  <florian@openbsd.org>

        Implement table driven selection to which ACME authorities we can talk.
        Suggest by and OK deraadt, OK benno.

        (Later on deraadt and benno discussed if this should be handled with a
        config file. This seems to be good enough for now. We can do a config
        file later.)

2016-09-01  jmc  <jmc@openbsd.org>

        make the page more neutral, as suggested by deraadt; add STANDARDS, as
        suggested by florian;

        help/ok deraadt florian

2016-09-01  jmc  <jmc@openbsd.org>

        various cleanup;

2016-09-01  florian  <florian@openbsd.org>

        we don't have config.h

2016-09-01  deraadt  <deraadt@openbsd.org>

        line wrap usage

2016-09-01  deraadt  <deraadt@openbsd.org>

        do { } while is easier to eyeball

2016-09-01  deraadt  <deraadt@openbsd.org>

        PATH_VAR_EMPTY is not used

2016-09-01  deraadt  <deraadt@openbsd.org>

        Collapse krazy abstractions for other sandbox models, using chroot and
        pledge directly as needed. ok florian

2016-09-01  benno  <benno@openbsd.org>

        knf

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  florian  <florian@openbsd.org>

        We are past 5.8. Also gets rid of asserts as a bonus. OK benno@,
        deraadt@

2016-08-31  florian  <florian@openbsd.org>

        Bring in license for man page Kristaps just added upstream in commit
        33c4b38b1db65097e4301e982c9cffcb8c3e648d.

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  deraadt  <deraadt@openbsd.org>

        revoke -> revocate, to avoid alias ok florian

2016-08-31  benno  <benno@openbsd.org>

        whitespace

2016-08-31  deraadt  <deraadt@openbsd.org>

        ASN1_TIME *atim avoids shadowing time

2016-08-31  deraadt  <deraadt@openbsd.org>

        avoid arith on void *, by using char *

2016-08-31  benno  <benno@openbsd.org>

        whitespace cleanup

2016-08-31  florian  <florian@openbsd.org>

        whitespace

2016-08-31  florian  <florian@openbsd.org>

        store files in directories called acme

2016-08-31  florian  <florian@openbsd.org>

        use bsd.prog.mk

2016-08-31  florian  <florian@openbsd.org>

        Some man page clean up: - make it more httpd centric - remove mkdir
        instructions, we create the directories by default - no 2nd person
        wording - remove commented out lines - add author

2016-08-31  florian  <florian@openbsd.org>

        oops, use correct filename

        usr.sbin/acme-client/acme-client.1

2016-08-31  florian  <florian@openbsd.org>

        Import Kristaps' letskencrypt and call it acme-client in tree. OK to
        get it in deraadt@ (and probably beck@)

        At least deraadt@, beck@ and otto@ are fine with the name and the
        disagreements stopped.

2021-12-15  Tomas Volf  <~@wolfsden.cz>

        Root commit

2021-12-15  Tomas Volf  <~@wolfsden.cz>

        Root commit

