CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

net/jose 15

Tools for JSON Object Signing and Encryption (JOSE)

Port info

Maintainer
hdholm@alumni.iastate.edu
Packages
latest: 15
Upstream
up to date
Last update
to 15 · dc700304f4
Quarterly
2026Q4: 15
WWW
https://github.com/latchset/jose
Links
cgit · VuXML

Install

Package
# pkg install jose
installs 15 from latest; from quarterly (2026Q4) 15
Port
# cd /usr/ports/net/jose && make install clean
# make -C /usr/ports/net/jose config  # change options first
Size
113 KiB download · 280 KiB installed
Depends on
devel/jansson 2.15.1_1
License
APACHE20
Options
1 of 1 on in the package: MANPAGES

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161515–
FreeBSD 151515–
FreeBSD 14151515

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151515–
FreeBSD 14151515

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 15.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (13)

Vladimir Druzenko (vvd) · 15
net/jose: Update 14 => 15

Changelog:
https://github.com/latchset/jose/releases/tag/v15

PR:		295963
Sponsored by:	UNIS Labs
MFH:		2026Q2
dc700304f4
Xavier Beaudouin (kiwi) · 14_1
net/jose: Fix compilation on 13.5 and 14.x

This patch removes a check that was previously added on PR 277905
by adding a -export-symbols-regex=^jose_.* flag only on FreeBSD.

The PR 277905 fix has been merged into upstream jose but it seems
that something is still not handled correctly on FreeBSD 13.5 and
14.x branches.

This workaround is just temporary to make the port build again
on 13.5 and 14. I will work with upstream to find the right
long-term fix.

PR:		284417, 277905
Reported by:	Alexey <ucu8u1b-ol@avksrv.org>
Approved by:	0mp (mentor)
Sponsored by:	Klara, Inc.
Differential Revision:	https://reviews.freebsd.org/D49871
dfe8117053
Daniel Engberg (diizzy) · 14
net/jose: Improve port

* Use upstream release archive
* Remove USES= ninja, selection of meson backend is handled by the framework
* Make asciidoc build dependency optional via MANPAGES option
* Remove INSTALL_TARGET (not used with meson)
* Sort pkg-plist

PR:		280101
Approved by:	portmgr (maintainer timeout, 1+ month)
5a9e5ba34b
Zsolt Udvari (uzsolt) · 14
net/jose: Update to v14

Fix tab indentation.

Changelog: https://github.com/latchset/jose/releases/tag/v14

PR:		280058
Approved by:	Submitter is maintainer
9a47b49083
Fernando Apesteguía (fernape) · 13
net/jose: Update to v13 (CVE-2023-50967)

ChangeLog: https://github.com/latchset/jose/releases/tag/v13

PR:		278243
Reported by:	hdholm@alumni.iastate.edu (maintainer)
MFH:		2024Q2 (security fix)
Security:	CVE-2023-50967
533aed3585
Dimitry Andric (dim) · 12
net/jose: fix build with lld 18

With recent lld, the --version-script check in net/jose's meson.build
fails, causing it to erroneously use a -export-symbols-regex flag:

  cc: error: unknown argument: '-export-symbols-regex=^jose_.*'

Fix this by adding --undefined-version to the meson check, so it
succeeds.

PR:		277905
Approved by:	hdholm@alumni.iastate.edu (maintainer)
MFH:		2024Q1
142d074b14
Fernando Apesteguía (fernape) · 12
net/jose: Update to v12

ChangeLog: https://github.com/latchset/jose/releases/tag/v12

 * Clean up some FreeBSD conditions
 * Add ES256K support
 * Meson changes
 * lib/openssl/rsaes.c: Fix issue where jose_hook_alg_find failed to find the …
   …existance of RSA_OAEP algorithm
 * Increase test program/scripts timeout values
 * Fix test compilation warnings
 * Adapt alg_comp test to different zlib
 * lib/openssl/hmac.c: rename hmac function to jhmac
 * jose: build library only as shared
 * meson: add option to disable building manpages
 * Add a more descriptive error when jwk gen fails
 * Use "command -v" instead of "which"
 * Test for jq existing
 * Correct jose_jws.3 man page example
 * lib/hsh.c: rename hsh local variable
 * Avoid master word when possible
 * Fix format of jose-jwe-enc man page
 * Meson Fixes

PR:		276790
Reported by:	hdholm@alumni.iastate.edu (maintainer)
ac63024aa4
Muhammad Moinur Rahman (bofh) · 11_1
*/*: Sanitize MANPREFIX for meson ports

Approved by:	portmgr
9f8f710b3e
Matthew Seaman (matthew) · 11
net/jose: unbreak with openssl3

PR:		271192
Reported by:	ngie
Author:	 	Howard Holm <hdholm@alumni.iastate.edu> (maintainer)
1653e42587
Muhammad Moinur Rahman (bofh) · 11
net/jose: Mark BROKEN_SSL

- Fails to build with lots of ld: error: undefined symbol: EVP_CIPHER_*

Approved by:	portmgr (blanket)
551118aae6
Stefan Eßer (se) · 11
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 11
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Neel Chauhan (nc) · 11
New port: net/jose: Performing tasks on JSON Object Signing and Encryption objects

PR:	255693
9ed3c42903