security/krb5-1221.22.2_4

databases/lmdb: allow to install both 0.x and 1.x together

LMDB 1.0 and the legacy 0.9 ABI cannot be mixed, the datanase format are
incompatibles as well.

Rename or relocate everything databases/lmdb0 installs so that it no
longer overlaps with databases/lmdb:
- the utilities are now mdb_copy0, mdb_dump0, mdb_load0 and mdb_stat0
- the header is include/lmdb0/lmdb.h
- the linker name is liblmdb0.so, the shared object keeps its ABI name
  liblmdb.so.0 so already linked programs are unaffected
- the pkg-config file is lmdb0.pc

A compatibility prefix holding the previous layout is also installed
under ${PREFIX}/lmdb0/ (include/, lib/ and libdata/pkgconfig/) so that
build systems which expect to find lmdb.h and -llmdb relative to a
single directory only need a path change.

Now all ports should migrate to lmdb 1.X and use the lmdb 0.9 port to ease
in the migration path, lmdb, the lmdb 0.x is supposed to get removed at
some point.

Approved by:	mat (portmgr)
Reviewed by:	mat
Differential Revision:	https://reviews.freebsd.org/D60741

databases/lmdb0: Add port for LMDB 0.9.x legacy ABI

LMDB 1.0 introduced an incompatible on-disk format change and subtle
API breakage: applications that compiled cleanly against 1.0 headers
could fail silently at run time. Known affected ports include dns/knot3,
mail/bogofilter, and mail/postfix; the postfix issue has been confirmed
upstream. Linux distributions such as Arch Linux have observed the same
breakage. Samba can also be affected in certain configurations.

Because the regression is not detectable in an -exp build run -- the
postfix failure only manifests at run time, and bogofilter was caught
only because post-build self-tests happen to exercise this path -- we
cannot rely on package builds to validate the 1.0 upgrade.

This commit introduces databases/lmdb0 as a holding port for the 0.9.35
release, pinned to the 0.x branch with PORTSCOUT=limit:^0. and mutually
conflicting with databases/lmdb, which retains 1.0. The two packages
cannot be installed simultaneously, but having lmdb0 available means:

* Ports known to require the 0.9 ABI can declare an explicit dependency
  on databases/lmdb0 until they are validated against 1.0.
* Users with existing databases in the 0.9 format can still access the
  mdb_dump and mdb_load utilities to migrate data before upgrading.
* The package conflict prevents accidental mixing.

All 50 direct dependents of databases/lmdb are redirected to
databases/lmdb0 for now with a PORTREVISION bump, effectively restoring
the tree to the state prior to the LMDB 1.0 update. Once all dependent
ports are validated against LMDB 1.0, they will be moved back to
databases/lmdb and databases/lmdb0 will be removed.

PR:             ports/296530

security/krb5-12?:  Fix reachable assert when importing krb5 names

If a name token contains trailing garbage, error out from
krb5_gss_import_name() instead of crashing the process with an
assertion failure.

Commit message details obtained from upstream commit.
Obtained from:	upstream commit 07818f1fd
Reported by:	Aisle Research (Ze Sheng, Dmitrijs Trizna,
		Luigino Camastra, Guido Vranken) to krb5-bugs
MFH:		2026Q2

security/krb5-122: Fix null dereference in SPNEGO token processing

krb5 1.22.1 erroneously removed a check from get_negTokenResp() for
successful decoding of the mechListMIC field.  Restore the check to
prevent a null pointer dereference.

Commit message details obtained from upstream commit.
Obtained from:  Upstream commit 4ae75cded
		src commit efb5c07f91c5
MFH:		2026Q2

security/krb5-122: Update to 1.22.2

devel/autoconf: Update to 2.73

cad/alliance, databases/proxysql, deskutils/growl-for-linux,
emulators/wine-proton, net/yate, sysutils/grub2-efi,
sysutils/grub2-pcbsd: Add USE_CSTD=gnu11 because autoconf 2.73 tries
to use C23 and these ports are broken with that.

PR:		293963
Exp-run by:	antoine

security/krb5-*: Rename BUILTIN and OPENSSL options

Rename the BUILTIN option to CRYPTO_BUILTIN and rename the OPENSSL
option to CRYPTO_OPENSSL.

Suggested by:	michaelo

security/krb5*: Add CRYPTO radio button

Base MIT KRB5 is linked against OpenSSL to supply its crypto. This
was done to avoid symbol conflicts within ssh (i.e. a buildworld
failure). This now causes the port and base inconsistencies.
Add a crypto option to allow the user to select either builtin or
openssl crypto.

PR:		291695

security/krb5-122: Update to 1.22.1

Security:	CVE-2025-57736

security/krb5-122: Fix KRB5 GsS MIC Verification

Apply same fix as src/f96110babbe1, also upstream/83cd76b11. This
fixes upstream bug #9181. The result of the bug is the acceptance
of MIC tokens with invalid checksums.

Security:	CVE-2025-57736

security/krb5-122: Regenerate patches

Regenerate patches using makepatch.

security/krb5-122: Fix package name when not a slave port

When not a slave port this port must have 122 appended to it giving it
a unique package name.

Fixes:		a7490b1dfbd5
Reported by:	antoine

security/krb5-122: Add new port

MIT KRB5 1.22 was just released. Import it into ports. It now becomes
the default KRB5.