[Git][NTPsec/ntpsec][2026-06-drop-libaes-siv] 78 commits: ci: detect Python version dynamically in ubuntu-devel job

Sat Oct 3 04:48:20 UTC 2026

Mark Atwood pushed to branch 2026-06-drop-libaes-siv at NTPsec / ntpsec

Commits:
120c3ea2 by Mark Atwood at 2026-06-30T16:30:28-07:00
ci: detect Python version dynamically in ubuntu-devel job

The hardcoded python3.9 breaks when ubuntu:devel updates to a new
Python version. Query the actual version at runtime instead.

- - - - -
b93b1a39 by Mark Atwood at 2026-07-01T02:18:24+00:00
ci: use $CI_REGISTRY_IMAGE instead of hardcoded project path

Fixes fork CI builds - forks push rebuilt images to their own registry
but jobs with hardcoded $CI_REGISTRY/ntpsec/ntpsec/ paths tried to
pull from upstream, causing 'image not found' failures.

$CI_REGISTRY_IMAGE resolves to the correct registry for any project.

- - - - -
8cb4e6a2 by Mark Atwood at 2026-07-01T02:20:50+00:00
ci: add ubuntu-devel Docker image with OpenSSL 3.0+

The ubuntu-devel image was removed years ago but the CI job remained,
causing failures when OpenSSL 3.0 was required. This adds a fresh
ubuntu:devel based image.

Marked allow_failure: true since ubuntu:devel is unstable by nature.

- - - - -
b5e40ce8 by Mark Atwood at 2026-07-03T01:12:11+00:00
ci: add image to python-coverage job

The job uses apt-get but had no image specified, which caused failures
when GitLab's default runner image lacked apt. Uses python3 image
since that's a minimal Debian-based image with Python available.

- - - - -
734848f0 by James Browning at 2026-07-03T01:14:08+00:00
CI: Don't install in /usr/local for macOS basic

- - - - -
10ee1b55 by Matt Selsky at 2026-07-02T22:11:46-04:00
Add some missing NEWS items and reformat a bit

Some parts of the file were using Markdown instead of AsciiDoc syntax

- - - - -
b3341237 by James Browning at 2026-07-11T07:39:03-07:00
ntp.util: Ensure srcadr truthy before .startswith()

This prevents ntpq/ntmon from breaking on things like
NXDOMAIN from DNS and MDF_POOL associations.

- - - - -
cb9202c4 by Hal Murray at 2026-07-11T11:21:31-07:00
mode6: Skip addresses starting '\0' or '('

The former are empty string and the latter are unhandled.

- - - - -
1406b1af by Hal Murray at 2026-07-11T11:21:31-07:00
libntp: Don't resolve AF_UNSPEC like AF_INET

This also renders 000dfdcef and its' fallout moot.

- - - - -
2c347573 by James Browning at 2026-07-11T11:21:31-07:00
Docs: Remove extra address mode; revert 000dfdcef+ 1/x

- - - - -
b3b49b1f by James Browning at 2026-07-11T11:21:31-07:00
ntpmon: Remove extra address modes; revert 000dfdcef+ 2/x

- - - - -
bca0bdf7 by James Browning at 2026-07-11T11:21:31-07:00
Docs: Remove extra address mode; revert 000dfdcef+ 3/x

- - - - -
f745fec4 by James Browning at 2026-07-11T11:21:31-07:00
ntpq: Remove extra address mode; revert 000dfdcef+ 4/x

- - - - -
9beb8ad4 by James Browning at 2026-07-11T11:21:31-07:00
ntp.util: Remove extra address mode internals; revert 000dfdcef+ 5/x

- - - - -
b004b6f5 by Mark Atwood at 2026-07-14T05:14:25+00:00
ci: add Rocky Linux 9 docker image (but no live jobs yet)

- - - - -
63e8721c by Mark Atwood at 2026-07-14T06:42:35+00:00
ci: add Rocky Linux 9 build and test jobs

- - - - -
ae0eeaec by Gary E. Miller at 2026-07-14T20:03:28-07:00
ntpd/keyword-gen.c: fix gcc warnings about mis-use of printf().

- - - - -
7287ded9 by Hal Murray at 2026-07-18T02:29:56-07:00
Cleanup of several attic crypto timing programs

- - - - -
28255fe0 by Gary E. Miller at 2026-07-31T01:34:51+00:00
ntpd/refclock_zyfer.c:Zyfer continuation chunk buffer overflow

- - - - -
e4c7e32f by Matt Selsky at 2026-07-30T23:55:50-04:00
Update NEWS and PIVOT date

- - - - -
42b57033 by Matt Selsky at 2026-07-31T00:27:11-04:00
version 1.2.5

Signed-off-by: Matt Selsky <matthew.selsky at twosigma.com>

- - - - -
48c82923 by Matt Selsky at 2026-07-31T00:52:56-04:00
Ready for more development

- - - - -
676d82c4 by Gary E. Miller at 2026-08-04T22:13:07-07:00
ntpd/refclock_jjy.c: Just remove tabs.  Weird comments...

- - - - -
b2ca71a7 by Gary E. Miller at 2026-08-06T10:14:33-07:00
ntpd/nts_server.c: Remove tabs, Single line /* comments to //

- - - - -
4d7554c9 by Gary E. Miller at 2026-08-06T10:15:46-07:00
attic/aes-siv-timing.c: Remove tabs, Single line /* comments to //

No functional changes.

- - - - -
d73d3498 by Gary E. Miller at 2026-08-06T10:16:50-07:00
tests/ntpd/nts_cookie.c: Remove tabs, Single line /* comments to //

No functional changes.

- - - - -
2255add0 by Gary E. Miller at 2026-08-06T10:16:50-07:00
tests/ntpd/nts_cookie.c: restore previous comment indents

No functional changes.

- - - - -
e69a219e by Gary E. Miller at 2026-08-06T10:17:37-07:00
tests/ntpd/nts.c: Remove tabs, Single line /* comments to //

No functional changes.

- - - - -
d9279df1 by Gary E. Miller at 2026-08-06T10:22:00-07:00
include/nts.h: Remove tabs, Single line /* comments to //

- - - - -
d0c7791a by Gary E. Miller at 2026-08-06T10:31:20-07:00
ntpd/nts_cookie.c: Remove tabs, Single line /* comments to //

- - - - -
76bc1031 by Gary E. Miller at 2026-08-06T10:51:10-07:00
ntpd/nts_client.c: Remove tabs, Single line /* comments to //

- - - - -
beacee22 by Gary E. Miller at 2026-08-06T11:05:53-07:00
ntpd/nts.c: Remove tabs, Single line /* comments to //

- - - - -
38d2c1c8 by Gary E. Miller at 2026-08-06T11:45:19-07:00
ntpd/refclock_truetime.c: Remove tabs, Single line /* comments to //

- - - - -
96d607cb by Gary E. Miller at 2026-08-06T11:58:16-07:00
ntpd/refclock_trimble.c: Remove tabs, Single line /* comments to //

- - - - -
778ca3dc by Gary E. Miller at 2026-08-06T12:10:30-07:00
ntpd/ntp_scanner.c: Remove tabs, Single line /* comments to //

- - - - -
9eb5ae85 by Gary E. Miller at 2026-08-06T12:18:46-07:00
ntpd/refclock_spectracom.c: Remove tabs, Single line /* comments to //

- - - - -
9b08138f by Gary E. Miller at 2026-08-06T12:26:15-07:00
ntpd/refclock_shm.c: Remove tabs, Single line /* comments to //

No functional changes.

- - - - -
95263fdc by Gary E. Miller at 2026-08-06T12:26:15-07:00
ntpd/refclock_shm.c restore previous comment indents

No functional changes.

- - - - -
81dd4880 by Gary E. Miller at 2026-08-06T12:31:15-07:00
ntpd/refclock_nmea.c: Remove tabs, Single line /* comments to //

- - - - -
9870cd6f by Gary E. Miller at 2026-08-06T12:36:37-07:00
ntpd/refclock_modem.c: Remove tabs, Single line /* comments to //

- - - - -
b21f67f4 by Gary E. Miller at 2026-08-06T12:40:37-07:00
ntpd/refclock_hpgps.c: Remove tabs. Single line /* commnents to //

- - - - -
5f3a525e by Gary E. Miller at 2026-08-06T12:52:55-07:00
ntpd/refclock_arbiter.c: remove tabs, Single line /* comments to //

- - - - -
8c88a1f2 by Gary E. Miller at 2026-08-06T12:57:40-07:00
ntpd/ntp_control.c: remove tabs, change /* comments to //

- - - - -
fa2a4798 by Gary E. Miller at 2026-08-06T12:58:59-07:00
include/ntp_refclock.h: remove tabs.  Change /* to // comments

- - - - -
9e79f192 by Gary E. Miller at 2026-08-23T20:33:29-07:00
.gitlab-ci.yml: Fix Gentoo CI  pipeline.

- - - - -
b592318e by Hal Murray at 2026-08-23T21:36:08-07:00
Updates to attic/cmac-timing and hmac-timing

- - - - -
a9e243fe by Hal Murray at 2026-08-23T21:36:08-07:00
Update NetBSD part of buildprep to python 3.14

- - - - -
ccee7465 by Hal Murray at 2026-08-31T12:03:47-07:00
Fix for #896

- - - - -
c594931a by Hal Murray at 2026-09-01T15:10:38-07:00
Add note for Alpine to HOWTO-OpenSSL

- - - - -
f9403285 by Hal Murray at 2026-09-01T16:05:49-07:00
Cleanup NTS-KE server

The internal calling sequence was pretty ugly, mostly due to
passing around arguments to low level routines could provide
error text that was printed by the top level routine so we
could limit things to one log message per connection.

This change adds a struct that holds "everything" so we only
need to pass around one parameter.

The code now passes all the tests in ntske-test from
  https://github.com/mlichvar/ntske-test

This cleanup was the result of chasing #892
The bug was a typo in unreleased code that I was testing.
It treated all unknown type codes as critical.
chrony is using one so that broke working with chrony.
  https://chrony-project.org/doc/spec/nts-compliant-128gcm.html

- - - - -
df83f3c4 by Hal Murray at 2026-09-14T18:05:38-07:00
Fix for #899

First bug:  The test for the length of CookiePlaceholders
matching the length of the cookie was broken.  It would
accept 0 length placeholders if they came before the real
cookie.

Second bug: There was no limit on CookiePlaceholders.
So if you sent a batch of CookiePlaceholders before
the real cookie, it would try to send back a batch
of cookies which may not fit.

- - - - -
c2777387 by Hal Murray at 2026-09-14T23:36:48-07:00
Fix derecation warning from OpenSSL 4.1.0-alpha1
   ASN1_STRING_length => ASN1_STRING_get_length

Also, turn on X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
which is used by my self-signed local testing.
I (and others?) probably need to find the option
to make this unnecessary.

- - - - -
7cc07938 by Hal Murray at 2026-09-15T01:59:29-07:00
Fix #895

- - - - -
55f28be1 by Hal Murray at 2026-09-15T11:01:01-07:00
Add HMAC support for shared key authentication

It's now one of the options for NIST's authenticated service.

- - - - -
98539e26 by Matt Selsky at 2026-09-18T02:32:23-04:00
CI: Remove debian oldoldstable aka buster aka debian 11

As per https://wiki.debian.org/DebianReleases, EOL LTS was 2026-08-31.  The
distribution was removed from the Debian repo servers and there are no more
security updates.

These CI changes remove some python2 test jobs, but python2 will be removed
fully soon enough so we won't take heroic measures to find another distribution
that carries python2.

- - - - -
45578ffc by Gary E. Miller at 2026-09-23T17:39:37-07:00
ntpd/refclock_jjy.c: Replace tabs. // comments

No functional changes.  Part 1 of 2 to fix several open issues.

- - - - -
52535ce8 by Gary E. Miller at 2026-09-23T17:43:53-07:00
ntpd/refclock_oncore.c: Expand tabs. // comments.

No functional changes.  Part of issue 895, part 3.

- - - - -
4819b314 by Gary E. Miller at 2026-09-23T18:00:41-07:00
ntpd/nts_extens.c: remove tabs, //comments, fix over-long lines.

No functional changes.

- - - - -
eb6a3a8e by Gary E. Miller at 2026-09-23T18:01:27-07:00
ntpd/refclock_zyfer.c: remove tabs, single line /* comments to //

- - - - -
1a1dc695 by Gary E. Miller at 2026-09-23T18:01:54-07:00
ntpd/ntp_scanner.c: Change opendir() to scandir().

Along the way: fix a gcc warning, a heap leak, a buffer under-read,
and some strlen() to strnlen(), etc.

- - - - -
ac011669 by Gary E. Miller at 2026-09-25T17:46:56-07:00
ntpd/ntp_scanner.c: Pacify Coverity CID 656341, uninited var.

The initializer value gets overwritten, but coverity does not
understand.

- - - - -
d4fded1d by Gary E. Miller at 2026-09-25T18:31:11-07:00
include/ntp_refclock.h: Make lencode unsigned.

This avoids adding a whole bunch of checks to ensure lencode is not
negative.  Part of Issue #895

- - - - -
22a09b3a by Gary E. Miller at 2026-09-28T17:16:17-07:00
ntpd/refclock_oncore.c: tbl[4] index overflow. xiPart of issue #895

Unchecked user byte used as index to array of length 4.

- - - - -
c8610c97 by Gary E. Miller at 2026-09-29T14:25:42-07:00
ntpd/nts_extens.c: Fix another int/unsigned conflict.

- - - - -
62a454f6 by Gary E. Miller at 2026-09-29T17:00:36-07:00
ntpd/refclock_jjy.c: Don't allow iTimeStampCount to overflow.

By making it unsigned, and checking for MAX_TIMESTAMP.

- - - - -
d22ba60a by Gary E. Miller at 2026-09-29T17:32:36-07:00
ntpd/refclock_generic.c: remove tabs, // comments.

No functional changes.

- - - - -
96315808 by Gary E. Miller at 2026-09-29T18:04:28-07:00
ntpd/refclock_generic.c: Take a stab at CID 583320.

srclen was underflowing and wrapping, somewhere...

- - - - -
b6c8155e by Matt Selsky at 2026-10-02T02:39:35-04:00
libparse/clk_trimtsip.c: fix copy-paste bug in TSIP week unwrap

t_week (current GPS week) and t_weekleap (week of the next scheduled
leap-second correction) are distinct fields. When t_week needed epoch
unwrap, the code set it from t_weekleap+GPSWEEKS instead of
t_week+GPSWEEKS - introduced in d21c57eec (2015-03-19), a mechanical
type-cast cleanup that got the adjacent near-identical
t_weekleap/t_week blocks crossed. Coverity correctly flagged this as
a copy-paste error in b1fa16c58 (2015-11-04), but the finding was
suppressed rather than investigated ("More Coverity cleanup. No logic
changes.").

Impact - t_week's only consumer in this file is the leap-imminent
check (t_weekleap - t_week) < 5, which decides whether to raise the
driver's leap-second warning (ADDSECOND/DELSECOND):

- The bug does not affect the time value this refclock reports -
  only that advisory flag.
- Since t_weekleap is already unwrapped by this point, the buggy line
  sets t_week = t_weekleap + GPSWEEKS, so t_weekleap - t_week is
  exactly -1024 (not close to zero) - and -1024 < 5 unconditionally,
  every time. A server using the Trimble TSIP refclock would tell
  every client polling it, via the standard NTP leap-indicator bits,
  that a leap second is imminent as soon as the receiver has any leap
  correction queued at all - weeks or months before the intended
  ~5-week window, deterministically, not just occasionally missing
  the window.
- GPSWRAP is 990 of a 1024-week range, so the buggy branch executes
  on ~97% of CMD_RUTCPARAM messages, but the effect is only visible
  when the receiver also has a genuinely pending leap-second change
  (tlsf != tls) - an infrequent real-world event (most recently Dec
  2016). A given deployment could run for years without observing
  this, despite the code path itself being live almost always.
- Local hardware refclock parsing, not network-facing - a
  false-early leap-indicator bug, not a security issue.

Restore the original t_week += GPSWEEKS form (the pre-2015 code, and
what the fixed logic actually needs) rather than the explicit-cast
reassignment - the cast was never required (unsigned short += int is
well-defined, and the max resulting value here is 2013) and the
project doesn't build with -Wconversion, so it was solely a leftover
of that unrelated 2015 cleanup pass. Drop the now-stale coverity[]
suppression comment along with it.

- - - - -
4fcb67de by Matt Selsky at 2026-10-02T19:31:25+00:00
.dockerfiles/gentoo: fix FROM...AS casing

Docker warns when FROM and its AS alias don't match case
(FromAsCasing). Cosmetic only, unrelated to the BuildKit
layer-registration failure fixed separately.

- - - - -
1f7b83a9 by Mark Atwood at 2026-10-02T20:55:41-07:00
build: require OpenSSL >= 3.0 (LibreSSL exempt)

Replace the narrow "reject only OpenSSL 1.1.1a" probe with a real version
floor: OpenSSL must be 3.0.0 or newer. The check still runs only in the
NTS path (gated by DISABLE_NTS), so distros that build --disable-nts are
unaffected.

LibreSSL is exempted: it reports OPENSSL_VERSION_NUMBER as 0x2000000fL but
remains a supported platform, so dropping it is left as a separate
decision. This bump does not yet enable removing the vendored libaes_siv.

Rename check_openssl_bad_version -> check_openssl_version accordingly.

- - - - -
57d2a56f by Mark Atwood at 2026-10-02T20:55:41-07:00
fix: update stale comment referencing libaes_siv

- - - - -
8bc0f46e by Mark Atwood at 2026-10-02T20:55:41-07:00
fix: correct OpenSSL version in comment (3.0+, not 3.2+)

- - - - -
873808ce by Mark Atwood at 2026-10-02T20:55:41-07:00
fix: guard OPENSSL_cleanse for NULL output in decrypt

- - - - -
3fd2e88c by Mark Atwood at 2026-10-02T20:55:41-07:00
feat: replace libaes_siv with OpenSSL 3.x native AES-SIV

Remove the bundled libaes_siv library (~2400 LOC) and replace it with
a thin EVP wrapper (~285 LOC) using OpenSSL 3.x native AES-SIV.

OpenSSL 3.0+ provides AES-SIV via EVP_CIPHER, eliminating the need for
the bundled implementation. This simplifies the codebase and enables
future use of OpenSSL providers (e.g., wolfProvider for FIPS).

- Add include/aes_siv_evp.h: API-compatible header
- Add libntp/aes_siv_evp.c: EVP-based implementation
- Delete libaes_siv/: remove bundled library (14 files)
- Update wscripts: remove libaes_siv, add aes_siv_evp.c
- Update includes: aes_siv.h -> aes_siv_evp.h

- - - - -
d8748e6e by Mark Atwood at 2026-10-02T20:55:41-07:00
fix: handle empty plaintext in AES-SIV wrapper

OpenSSL before 3.5.0 cannot produce an AES-SIV tag for an empty
plaintext: the SIV provider returns early on zero-length input and
the final step fails. NTS authenticates client packets with an empty
plaintext, so extens_client_send() hit exit(1). Compute that tag
directly with RFC 5297 S2V over AES-CMAC, and verify tag-only input
with CRYPTO_memcmp(). Remove once supported distributions ship
OpenSSL >= 3.5.0.

Copy the received tag into a local buffer instead of casting away
const for EVP_CTRL_AEAD_SET_TAG, which broke -Werror=cast-qual builds.

Build aes_siv_evp.c only when NTS is enabled. The OpenSSL >= 3.0
check is NTS-only, so --disable-nts builds against older OpenSSL
failed to compile it.

Verified bit-exact against the removed libaes_siv for 32/48/64-byte
keys and plaintext lengths 0-64 on OpenSSL 3.0.13, 3.3.7 and 3.5.9.

- - - - -
69c5b056 by Mark Atwood at 2026-10-02T20:55:41-07:00
fix: build attic AES-SIV tools against EVP

attic/aes-siv-timing.c and attic/aead-timing.c still included the
removed libaes_siv header, breaking the feature-attic CI job. Include
aes_siv_evp.h, which provides the same API, and drop the stale
../libaes_siv include path and aes_siv use from attic/wscript. These
tools are already built only when NTS is enabled.

- - - - -
5c84ad96 by Mark Atwood at 2026-10-02T21:47:31-07:00
refactor: share S2V step, update AES-SIV docs

Fold the duplicated CMAC/dbl/xor blocks in siv_empty_tag() into
siv_s2v_step() so S2V component order lives in one place. Keep keying
CMAC on every step: on OpenSSL 3.0.0-3.0.2, EVP_MAC_init() with a NULL
key does not restart CMAC, so the cheaper restart gives wrong tags.

Reject plaintext, AD and nonce lengths above INT_MAX in
AES_SIV_Encrypt() and AES_SIV_Decrypt() before any OpenSSL call or
output write, since they are passed to EVP as int.

Reformat libntp/aes_siv_evp.c to the converted-file style used on
master: 8-space indent without tabs, // for one-line comments, lines
of at most 80 columns. No behavioural change beyond the length checks.

Document in aes_siv_evp.h that plaintext (encrypt) and out (decrypt)
may be NULL only for empty plaintext, and that *out_len is updated
only on success.

Update devel/hacking.adoc and devel/nts.adoc, which still described a
vendored libaes_siv, and note that OpenSSL 3.0 or newer is required
when NTS is enabled.

- - - - -
a931f952 by Mark Atwood at 2026-10-02T21:47:31-07:00
test: add AES-SIV known-answer tests

The NTS tests only round-trip through aes_siv_evp.c, so a consistent
error would pass them. Add known-answer tests for:

- empty plaintext with 32/48/64-byte keys, including tag-only decrypt
  with out=NULL and rejection of every single-bit tag flip
- empty plaintext with no AD and with no nonce
- non-empty plaintext with AD and nonce for 32/48/64-byte keys, and
  rejection of tampered ciphertext, AD and nonce
- the RFC 5297 A.1 vector
- rejection of bad key lengths, short output buffers and ciphertext
  shorter than the tag, leaving *out_len unchanged

Expected values come from the removed libaes_siv and from
pycryptodome AES MODE_SIV, which agree byte for byte. The group runs
only when NTS is enabled.

Also drop the stale ../libaes_siv include and aes_siv use from
test_ntpd in tests/wscript.

- - - - -

86 changed files:

- .dockerfiles/gentoo
- + .dockerfiles/rocky
- .dockerfiles/python2 → .dockerfiles/ubuntu-devel
- .gitlab-ci.yml
- .gitlab-docker-ci.yml
- .gitlab-opttest-ci.yml
- HOWTO-OpenSSL
- NEWS.adoc
- PIVOT.h
- VERSION
- attic/aead-timing.c
- attic/aes-siv-timing.c
- attic/cmac-timing.c
- attic/digest-timing.c
- + attic/hmac-timing.c
- attic/sign-timing.c
- attic/wscript
- buildprep
- devel/hacking.adoc
- devel/nts.adoc
- docs/includes/ntp.keys-body.adoc
- docs/includes/ntpmon-body.adoc
- docs/includes/ntpq-body.adoc
- + include/aes_siv_evp.h
- include/ntp_auth.h
- include/ntp_refclock.h
- include/ntpd.h
- include/nts.h
- − libaes_siv/AES_SIV_CTX_new.adoc
- − libaes_siv/AES_SIV_Encrypt.adoc
- − libaes_siv/AES_SIV_Init.adoc
- − libaes_siv/COPYING
- − libaes_siv/External-Version.txt
- − libaes_siv/README.md
- − libaes_siv/aes_siv.c
- − libaes_siv/aes_siv.h
- − libaes_siv/aes_siv_test.c
- − libaes_siv/bench.c
- − libaes_siv/config.h.in
- − libaes_siv/demo.c
- − libaes_siv/tests.c
- − libaes_siv/wscript
- + libntp/aes_siv_evp.c
- libntp/authkeys.c
- libntp/authreadkeys.c
- libntp/macencrypt.c
- libntp/socktoa.c
- libntp/ssl_init.c
- libntp/wscript
- libparse/clk_trimtsip.c
- ntpclients/ntpmon.py
- ntpclients/ntpq.py
- ntpd/keyword-gen.c
- ntpd/ntp_config.c
- ntpd/ntp_control.c
- ntpd/ntp_scanner.c
- ntpd/ntp_util.c
- ntpd/nts.c
- ntpd/nts_client.c
- ntpd/nts_cookie.c
- ntpd/nts_extens.c
- ntpd/nts_server.c
- ntpd/refclock_arbiter.c
- ntpd/refclock_generic.c
- ntpd/refclock_hpgps.c
- ntpd/refclock_jjy.c
- ntpd/refclock_modem.c
- ntpd/refclock_nmea.c
- ntpd/refclock_oncore.c
- ntpd/refclock_shm.c
- ntpd/refclock_spectracom.c
- ntpd/refclock_trimble.c
- ntpd/refclock_truetime.c
- ntpd/refclock_zyfer.c
- ntpd/wscript
- pylib/util.py
- tests/common/tests_main.c
- + tests/libntp/aes_siv_evp.c
- tests/libntp/macencrypt.c
- tests/ntpd/nts.c
- tests/ntpd/nts_cookie.c
- tests/ntpd/nts_extens.c
- tests/ntpd/nts_server.c
- tests/wscript
- wafhelpers/openssl.py
- wscript

The diff was not included because it is too large.

View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/ed629edd48258eb416c45e21cf8c65369f698529...a931f952965ba3a9e3b34cf09efcb82e4aa3229f

-- 
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/ed629edd48258eb416c45e21cf8c65369f698529...a931f952965ba3a9e3b34cf09efcb82e4aa3229f
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20261003/1774217c/attachment-0001.htm>