<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Gary E. Miller pushed to branch jjy2 at <a href="https://gitlab.com/NTPsec/ntpsec">NTPsec / ntpsec</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/b592318e2724f6cdabda036b922098ecfa50cbbb">b592318e</a></strong>
<div>
<span> by Hal Murray </span> <i> at 2026-08-23T21:36:08-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>Updates to attic/cmac-timing and hmac-timing
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/a9e243fe0a0dfb01c3422426fbb72c4fc54ee6d1">a9e243fe</a></strong>
<div>
<span> by Hal Murray </span> <i> at 2026-08-23T21:36:08-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>Update NetBSD part of buildprep to python 3.14
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/ccee7465b6e0717ca2e1ed14d6342a2c5c9c7c76">ccee7465</a></strong>
<div>
<span> by Hal Murray </span> <i> at 2026-08-31T12:03:47-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>Fix for #896
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/c594931a2348ebaf541958b4da19703b02cc5993">c594931a</a></strong>
<div>
<span> by Hal Murray </span> <i> at 2026-09-01T15:10:38-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>Add note for Alpine to HOWTO-OpenSSL
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/f94032850fd743b96cd05cfb84d933b123646020">f9403285</a></strong>
<div>
<span> by Hal Murray </span> <i> at 2026-09-01T16:05:49-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>Cleanup NTS-KE server
The internal calling sequence was pretty ugly, mostly due to
passing around arguments to low level routines could provide
error text that was printed by the top level routine so we
could limit things to one log message per connection.
This change adds a struct that holds "everything" so we only
need to pass around one parameter.
The code now passes all the tests in ntske-test from
https://github.com/mlichvar/ntske-test
This cleanup was the result of chasing #892
The bug was a typo in unreleased code that I was testing.
It treated all unknown type codes as critical.
chrony is using one so that broke working with chrony.
https://chrony-project.org/doc/spec/nts-compliant-128gcm.html
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/df83f3c4f8a515970e33db0af7d3a50c8d6319b3">df83f3c4</a></strong>
<div>
<span> by Hal Murray </span> <i> at 2026-09-14T18:05:38-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>Fix for #899
First bug: The test for the length of CookiePlaceholders
matching the length of the cookie was broken. It would
accept 0 length placeholders if they came before the real
cookie.
Second bug: There was no limit on CookiePlaceholders.
So if you sent a batch of CookiePlaceholders before
the real cookie, it would try to send back a batch
of cookies which may not fit.
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/c277738752fae5d24b083da13e7f7f0ef88b9d09">c2777387</a></strong>
<div>
<span> by Hal Murray </span> <i> at 2026-09-14T23:36:48-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>Fix derecation warning from OpenSSL 4.1.0-alpha1
ASN1_STRING_length => ASN1_STRING_get_length
Also, turn on X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
which is used by my self-signed local testing.
I (and others?) probably need to find the option
to make this unnecessary.
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/7cc079387a0c8f94a4a82ebd0fc3cbe32f705557">7cc07938</a></strong>
<div>
<span> by Hal Murray </span> <i> at 2026-09-15T01:59:29-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>Fix #895
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/55f28be16cffcca8576b12adca843b870993ed44">55f28be1</a></strong>
<div>
<span> by Hal Murray </span> <i> at 2026-09-15T11:01:01-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>Add HMAC support for shared key authentication
It's now one of the options for NIST's authenticated service.
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/98539e26d0602fe093488366dedf734db215a7b4">98539e26</a></strong>
<div>
<span> by Matt Selsky </span> <i> at 2026-09-18T02:32:23-04:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>CI: Remove debian oldoldstable aka buster aka debian 11
As per https://wiki.debian.org/DebianReleases, EOL LTS was 2026-08-31. The
distribution was removed from the Debian repo servers and there are no more
security updates.
These CI changes remove some python2 test jobs, but python2 will be removed
fully soon enough so we won't take heroic measures to find another distribution
that carries python2.
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/2e4d583521a0a465c8d1650363c6a4b40da72055">2e4d5835</a></strong>
<div>
<span> by Gary E. Miller </span> <i> at 2026-09-22T12:57:30-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>ntpd/refclock_jjy.c: Replace tabs. // comments
No functional changes. Part 1 of 2 to fix several open issues.
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
28 changed files:
</h4>
<ul>
<li class="file-stats">
<a href="#a380595b9e6c9f06b92a4743a8871456b365f86c">
<span class="deleted-file">
−
.dockerfiles/python2
</span>
</a>
</li>
<li class="file-stats">
<a href="#587d266bb27a4dc3022bbed44dfa19849df3044c">
.gitlab-ci.yml
</a>
</li>
<li class="file-stats">
<a href="#c065ae77f8e308a44038382207aa8b6182653932">
.gitlab-docker-ci.yml
</a>
</li>
<li class="file-stats">
<a href="#9cfdb1ca6f275d1c6858e49459a47d423fe98378">
.gitlab-opttest-ci.yml
</a>
</li>
<li class="file-stats">
<a href="#e2db2bf8935a29abf75a3286bb2dc35bf833e9a0">
HOWTO-OpenSSL
</a>
</li>
<li class="file-stats">
<a href="#653458cabe0549b8c46be38150897af018763060">
NEWS.adoc
</a>
</li>
<li class="file-stats">
<a href="#01df101d0040c2107697ad7b1a14309e47de9836">
attic/cmac-timing.c
</a>
</li>
<li class="file-stats">
<a href="#de92898cc22a9203f8f3ca866f071ba47d8ba976">
<span class="new-file">
+
attic/hmac-timing.c
</span>
</a>
</li>
<li class="file-stats">
<a href="#353edc6a1ca8855c9d7d7745d89cc790c7a31302">
attic/wscript
</a>
</li>
<li class="file-stats">
<a href="#de331e64dac7affc1dd979221a7a47f257f8fe7b">
buildprep
</a>
</li>
<li class="file-stats">
<a href="#b549a7119634a1b6fbf0455cf52cd218652cafc3">
docs/includes/ntp.keys-body.adoc
</a>
</li>
<li class="file-stats">
<a href="#0b9fb3cc9b519538bb4767c907eabf80a028de81">
include/ntp_auth.h
</a>
</li>
<li class="file-stats">
<a href="#5d49edeefe38405c00cd44a3280eba2d607e4b94">
include/ntpd.h
</a>
</li>
<li class="file-stats">
<a href="#2d3b8ab7c6bc1924ae716eb90ef1caf21ce62341">
include/nts.h
</a>
</li>
<li class="file-stats">
<a href="#8197f8548d008c7bf8d84b9fac40330caea59a8f">
libntp/authkeys.c
</a>
</li>
<li class="file-stats">
<a href="#d0993b928332aee1147d0a7459fb849f6c52e4eb">
libntp/authreadkeys.c
</a>
</li>
<li class="file-stats">
<a href="#7872cf7240275a21578046e42fd44c27a795edba">
libntp/macencrypt.c
</a>
</li>
<li class="file-stats">
<a href="#6b8abb49690e9b8886dcf84fc85fcc46540126cf">
libntp/ssl_init.c
</a>
</li>
<li class="file-stats">
<a href="#1e60eda49b85967df279325efe9771b98e43f873">
ntpclients/ntpq.py
</a>
</li>
<li class="file-stats">
<a href="#f4db43d91d9d4fe0fe143a20b21c2b3cd3a01a15">
ntpd/ntp_config.c
</a>
</li>
<li class="file-stats">
<a href="#403246f0aef784495bc035a970fa42eae64e2b4a">
ntpd/ntp_control.c
</a>
</li>
<li class="file-stats">
<a href="#42435739d7e4b798d3ec03c6c0802641904a98a7">
ntpd/ntp_util.c
</a>
</li>
<li class="file-stats">
<a href="#4188e892f41c12f300287a7e79074f6da4611f73">
ntpd/nts_client.c
</a>
</li>
<li class="file-stats">
<a href="#1ff99aae534a910fa3ddd2012b99973e25e83a3a">
ntpd/nts_extens.c
</a>
</li>
<li class="file-stats">
<a href="#f2a76773af5c8626dfdd65c4c6ab3a967f644a4d">
ntpd/nts_server.c
</a>
</li>
<li class="file-stats">
<a href="#2e87d40540c9e6cab2dff8f570452bb385b9b841">
ntpd/refclock_jjy.c
</a>
</li>
<li class="file-stats">
<a href="#5da6cbc935b719ae66cda1f9735a860138af91b4">
tests/libntp/macencrypt.c
</a>
</li>
<li class="file-stats">
<a href="#e72afbecbd14111a3a55db63265ab28d20d9fe81">
tests/ntpd/nts_server.c
</a>
</li>
</ul>
<h5 style="margin-top: 10px; margin-bottom: 10px; font-size: .875rem;">
The diff was not included because it is too large.
</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #646163;">
—
<br>
<a href="https://gitlab.com/NTPsec/ntpsec/-/compare/ada2e3b04c2ceed98636f6c278e99a521833a180...2e4d583521a0a465c8d1650363c6a4b40da72055">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/NTPsec/ntpsec/-/compare/ada2e3b04c2ceed98636f6c278e99a521833a180...2e4d583521a0a465c8d1650363c6a4b40da72055 at 1790107052
</span>
</p>
</div>
</body>
</html>