botan3 3.14.1-1
Package Information
| Description | multiplatform crypto library (3.x version) Botan is a C++ library which provides support for many common cryptographic operations, including encryption, authentication, and X.509v3 certificates and CRLs. A wide variety of algorithms is supported, including RSA, DSA, DES, AES, MD5, and SHA-1. This package contains the 3.x version of Botan. |
|---|---|
| Maintainer | Laszlo Boszormenyi (GCS) <gcs@debian.org> |
| Changed By | Laszlo Boszormenyi (GCS) <gcs@debian.org> |
| Sponsor | gcs@debian.org |
| Distribution | experimental |
| Architecture | any all |
| Closes | #1145052 |
| Popcon Installs | 2541 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/botan3 |
| Uploaded | 2 hours ago |
New Package Report
.changes
| Changed-By | Laszlo Boszormenyi (GCS) <gcs@debian.org> |
|---|---|
| Architecture | source amd64 all |
| Distribution | experimental |
| Date | Sat, 14 Nov 2026 19:24:35 +0100 |
| Source | botan3 |
| Version | 3.14.1-1 |
Changelog
botan3 (3.14.1-1) experimental; urgency=medium . * New upstream release. * Library transition from libbotan-3-13 to libbotan-3-14 . * OASIS licensed PKCS #11 headers are removed (closes: #1145052). * Update copyright file.
.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | botan deb libdevel optional arch=any libbotan-3-14 deb libs optional arch=any libbotan-3-dev deb libdevel optional arch=any libbotan-3-doc deb doc optional arch=all python3-botan deb python optional arch=any |
| Section | libdevel |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: botan
Upstream-Contact: Jack Lloyd <jack@randombit.net>
Source: https://github.com/randombit/botan
Files: *
Copyright: 1999-2025 The Botan Authors,
1999-2025 Jack Lloyd <jack@randombit.net>
License: BSD-2-clause
Files: configure.py
Copyright: 2009,2010,2011,2012,2013,2014,2015,2016,2017,2018 Jack Lloyd <jack@randombit.net>,
2015,2016,2017 Simon Warta (Kullo GmbH)
License: BSD-2-clause
Files: src/build-data/botan-config.cmake.in src/build-data/botan-config-version.cmake.in
Copyright: 2023- The Botan Authors
License: MIT
Files: src/cli/*
Copyright: 2015,2017 Simon Warta (Kullo GmbH),
2018 Ribose Inc,
1999-2010,2014,2015,2016,2017,2018 Jack Lloyd <jack@randombit.net>,
2015-2016 René Korthaus,
2016 Juraj Somorovsky <juraj.somorovsky@hackmanit.de>,
2017 Neverhub
License: BSD-2-clause
Files: src/lib/pbkdf/*
Copyright: 1999-2007,2012,2017,2018 Jack Lloyd <jack@randombit.net>,
2018 Ribose Inc
License: BSD-2-clause
Files: src/lib/pk_pad/*
Copyright: 1999-2008 Jack Lloyd <jack@randombit.net>,
2016 Tobias Niemann, Hackmanit GmbH,
2017 Fabian Weissberg, Rohde & Schwarz Cybersecurity
License: BSD-2-clause
Files: src/lib/prov/commoncrypto/*
Copyright: 2018 Jose Luis Pereira
License: BSD-2-clause
Files: src/lib/prov/pkcs11/pkcs11.h
Copyright: 2025 Simo Sorce
License: public-domain
These files were granted to the public domain.
.
No copyright is claimed. This code is in the public domain; do with
it what you wish.
Files: src/lib/pubkey/eckcdsa/*
Copyright: 2016 René Korthaus, Sirrix AG,
2018 Jack Lloyd <jack@randombit.net>
License: BSD-2-clause
Files: src/lib/pubkey/dlies/*
Copyright: 1999-2007 Jack Lloyd <jack@randombit.net>,
2016 Daniel Neus, Rohde & Schwarz Cybersecurity
License: BSD-2-clause
Files: src/lib/pubkey/ec_group/*
Copyright: 2007 Martin Doering,
2007,2017 Christoph Ludwig,
2007 Falko Strenzke, FlexSecure GmbH,
2008,2018 Jack Lloyd <jack@randombit.net>,
2018 Tobias Niemann
License: BSD-2-clause
Files: src/lib/pubkey/ecc_key/*
Copyright: 2007 Manuel Hartl, FlexSecure GmbH,
2007 Falko Strenzke, FlexSecure GmbH,
2008-2010 Jack Lloyd <jack@randombit.net>
License: BSD-2-clause
Files: src/lib/pubkey/ecgdsa/*
Copyright: 2016 René Korthaus,
2018 Jack Lloyd <jack@randombit.net>
License: BSD-2-clause
Files: src/lib/pubkey/ecies/*
Copyright: 2016 Philipp Weber,
2016 Daniel Neus, Rohde & Schwarz Cybersecurity
License: BSD-2-clause
Files: src/lib/pubkey/gost_3410/*
Copyright: 2007 Falko Strenzke, FlexSecure GmbH,
2008-2010,2015,2018 Jack Lloyd
License: BSD-2-clause
Files: src/lib/pubkey/mce/*
Copyright: Projet SECRET, INRIA, Rocquencourt,
Bhaskar Biswas and Nicolas Sendrier,
2014 cryptosource GmbH,
2014 Falko Strenzke <fstrenzke@cryptosource.de>
2014,2015 Jack Lloyd
License: BSD-2-clause
Files: src/lib/pubkey/pbes2/*
Copyright: 1999-2008,2014 Jack Lloyd,
2018 Ribose Inc
License: BSD-2-clause
Files: src/lib/pubkey/sm2/*
Copyright: 1999-2008,2014,2018 Jack Lloyd,
2017,2018 Ribose Inc
License: BSD-2-clause
Files: src/lib/pubkey/xmss/*
Copyright: 2016,2017,2018 Matthias Gierlings
License: BSD-2-clause
Files: src/lib/tls/*
Copyright: 2004-2011,2013,2016,2017 Jack Lloyd,
2016 Matthias Gierlings,
2016 Juraj Somorovsky
License: BSD-2-clause
Files: src/lib/tls/tls12/tls_cbc/*
Copyright: 2012,2013,2014,2015,2016 Jack Lloyd,
2016 Juraj Somorovsky,
2016 Matthias Gierlings,
2016 Daniel Neus, Rohde & Schwarz Cybersecurity
License: BSD-2-clause
Files: src/lib/utils/*
Copyright: 1999-2008,2009,2010,2012,2018 Jack Lloyd,
Copyright Projet SECRET, INRIA, Rocquencourt,
Bhaskar Biswas and Nicolas Sendrier,
2007 Yves Jerschow,
2018 Erwan Chaussy,
2010 Falko Strenzke,
2014 cryptosource GmbH,
2014 Falko Strenzke <fstrenzke@cryptosource.de>,
2015 Simon Warta (Kullo GmbH),
2016 Daniel Neus,
2016 Joel Low
2017 René Korthaus, Rohde & Schwarz Cybersecurity,
2017 Tomasz Frydrych,
2018 Ribose Inc
License: BSD-2-clause
Files: src/lib/x509/*
Copyright: 1999-2010,2013,2016,2018 Jack Lloyd,
2015,2016 Kai Michaelis, Rohde & Schwarz Cybersecurity,
2016 René Korthaus, Rohde & Schwarz Cybersecurity,
2017 Fabian Weissberg, Rohde & Schwarz Cybersecurity,
License: BSD-2-clause
Files: debian/*
Copyright: 2017- Laszlo Boszormenyi (GCS) <gcs@debian.org>
License: BSD-2-clause
License: BSD-2-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
License: MIT
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
( copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
DFSG Assistant LLM REVIEW 1 blocker, 0 important, 1 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 1 hour ago.
Report
DFSG NEW review for botan3 version 3.14.1-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 1 blocker, 0 important, 1 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 408 found (368 not listed by the scan, so not checked)
Licensing
The licences themselves are DFSG-free and compatible: practically every file states 'Botan is released under the Simplified BSD License', the two src/build-data/botan-config*.cmake.in templates are MIT, src/lib/prov/pkcs11/pkcs11.h is the public-domain PKCS#11 v3.2 header, and the code derived from public-domain or CC0 reference implementations carries no additional terms. debian/copyright is DEP-5 with the BSD-2-clause and MIT texts reproduced and the correct Format URL, but it is not an accurate description of the tree: dozens of holders named in the headers of files compiled into libbotan-3-14 (Elektrobit Automotive GmbH, neXenio GmbH, Volkswagen AG, CARIAD SE, MTG AG, genua GmbH, Sirrix AG, several individuals) appear nowhere in it, and the per-directory stanzas that do exist for src/lib/tls/* and src/lib/x509/* are stale and omit holders of files in exactly those directories.
Packaging
The packaging is small, conventional and in good shape: debhelper-compat 13 with a plain 'dh $@ --with python3', no patches, a working library-transition scheme (libbotan-3-14), the full test suite run at build time under LD_LIBRARY_PATH, correct per-package install/link/docs files, a doc-base entry and an upstream signing key. Standards-Version 4.7.2 is current. Only one quality issue: libbotan-3-doc depends on sphinx-doc, the documentation of the Sphinx build tool, solely so that three of its JavaScript assets can be symlinked into the handbook. There is no autopkgtest suite; the tests only run during the build.
Issues
blocker licensing 1. debian/copyright does not name the holders of many files compiled into libbotan-3-14 (Elektrobit Automotive GmbH, neXenio GmbH, Volkswagen AG, CARIAD SE, MTG AG, genua GmbH, Sirrix AG and others) ◂
- Files:
debian/copyright (Files: * stanza; Files: src/lib/tls/* stanza; Files: src/lib/x509/* stanza),src/lib/tls/tls12/tls_extensions_12.h:4,src/lib/tls/tls13/msg_certificate_13.cpp:4,src/lib/tls/tls12/tls_null/tls_null.cpp:2-3,src/lib/entropy/getentropy/getentropy.cpp:3,src/lib/hash/blake2s/blake2s.cpp:3-5,src/lib/pubkey/xmss/xmss_tree_builder.cpp:5,src/lib/ffi/ffi_cert_ext.cpp:3,src/lib/ffi/ffi_tls/ffi_tls.cpp:2,src/lib/prov/pkcs11/p11.h:3,src/lib/hash/checksum/crc24/crc24.cpp:4,src/lib/x509/x509_ext.cpp:5,src/lib/mac/poly1305/poly1305.cpp:5 - Basis: checked, in the package or with a reference tool
- Evidence: src/lib/tls/tls12/tls_extensions_12.h:
* (C) 2021 Elektrobit Automotive GmbH,* (C) 2022 René Meusel, Hannes Rantzsch - neXenio GmbH; src/lib/tls/tls13/msg_certificate_13.cpp:* 2022 Hannes Rantzsch, René Meusel - neXenio GmbH; src/lib/tls/tls12/tls_null/tls_null.cpp:* (C) 2024 Sebastian Ahrens, Dirk Dobkowitz, André Schomburg (Volkswagen AG)and* (C) 2024 Lars Dürkop (CARIAD SE); src/lib/pubkey/xmss/xmss_tree_builder.cpp:* (C) 2026 Johannes Roth - MTG AG; src/lib/entropy/getentropy/getentropy.cpp:* (C) 2017 Alexander Bluhm (genua GmbH); src/lib/prov/pkcs11/p11.h:* (C) 2016 Daniel Neus, Sirrix AG. debian/copyright has onlyFiles: */Copyright: 1999-2025 The Botan Authors, 1999-2025 Jack Lloyd <jack@randombit.net>, and for the tls directoryFiles: src/lib/tls/*/Copyright: 2004-2011,2013,2016,2017 Jack Lloyd, 2016 Matthias Gierlings, 2016 Juraj Somorovsky. - Problem: Every one of these files is compiled into libbotan-3-14 (and the internal headers are not installed, so no shipped text reproduces their notices). The BSD-2-clause licence requires that the copyright notice be retained in source and binary distributions, so Debian Policy 2.3 requires these notices verbatim in debian/copyright. Naming a collective 'The Botan Authors' is not enough where the file itself names a company or individual, and the
src/lib/tls/*andsrc/lib/x509/*stanzas are stale in the same way (x509_ext.cpp names(C) 2024 Anton Einax, Dominik Schricker, blake2s.cpp names(C) 2023, 2025 Richard Huveneersand(C) 2025 Kagan Can Sit, crc24.cpp namesRibose Inc ... Krzysztof Kwiatkowski, ffi_cert_ext.cpp names(C) 2026 Dominik Schricker). - Fix: Add the missing holders to debian/copyright, either by extending the existing per-directory stanzas (src/lib/tls/, src/lib/x509/, src/lib/utils/) or by adding stanzas for src/lib/tls/tls12/, src/lib/tls/tls13/, src/lib/ffi/, src/lib/pubkey/kyber/, src/lib/pubkey/module_lattice/, src/lib/hash/blake2s/, src/lib/prov/pkcs11/, src/lib/mac/poly1305/* and so on. doc/authors.txt lists all of them and is a good checklist.
minor packaging 2. libbotan-3-doc depends on sphinx-doc only to symlink three JavaScript files out of its documentation ◂
- Files:
debian/control (Package: libbotan-3-doc),debian/libbotan-3-doc.links - Basis: checked, in the package or with a reference tool
- Evidence:
Depends: ${misc:Depends}, sphinx-docand/usr/share/doc/sphinx-doc/html/_static/doctools.js usr/share/doc/libbotan-3-doc/handbook/_static/doctools.js(with language_data.js and searchtools.js). - Problem: The handbook is built with python3-sphinx and its _static already contains these three files version-matched to the Sphinx that generated the HTML; the .links file replaces them with links into the Sphinx documentation package, and sphinx-doc plus its dependency chain (docutils-doc, node-mathjax-full, python3-doc, python-requests-doc, libjs-sphinxdoc) is pulled into every installation of the C++ library's HTML documentation for that. The links are also unchecked by dh_link, so they would silently become dangling if sphinx-doc ever moved its HTML tree.
- Fix: Ship the generated _static files (drop the three .links lines and the sphinx-doc dependency), or use dh_sphinxdoc / libjs-sphinxdoc, which is what Debian keeps those assets in.
Verified ◂
- Every file the scan listed as unrecognised binary data is a test fixture under src/tests/data/ and none is installed: dh_install takes only the upstream install tree under /usr, and the tests read this data at build time. The ASN.1 cases are src/tests/data/asn1_print/input1.der, src/tests/data/asn1_print/input2.der, src/tests/data/asn1_print/input3.der, src/tests/data/asn1_print/input4.der, src/tests/data/asn1_print/input5.der, src/tests/data/asn1_print/input6.der, src/tests/data/asn1_print/input7.der and src/tests/data/asn1_print/input8.der, each an encoded ASN.1 value with its expected output in output1.txt ... output8.txt beside it; the PKCS#12 cases are src/tests/data/pkcs12/*.p12 and .pfx; the rest are DER/PEM certificates of the BSI TR-03110/eID and NIST path-validation suites under src/tests/data/x509/* (the BSI suite's readme.txt says the cases were developed in a project with the German BSI), and a SQLite session-store fixture, src/tests/data/tls-sessions/botan-2.19.3.sqlite.
- src/tests/data/pubkey/xmss_invalid.vec is the 4.2 MB text file the scan could only read in part; it holds hexadecimal test vectors for invalid XMSS signatures, is test data, and is not installed.
- A glob for images, fonts, PDFs, archives, object files and bytecode over the whole tree found nothing, so the binary files above are the complete set.
- src/lib/pubkey/curve25519/x25519/x25519_fe.h: the Google Inc notice the scan lists reads
Copyright 2008, Google Inc. / All rights reserved. / Code released into the public domain.It imposes no retention requirement, and the header is not installed, so it is not a missing holder. - src/lib/prov/pkcs11/pkcs11.h is the public-domain PKCS#11 v3.2 header created by Simo Sorce, matching the
Files: src/lib/prov/pkcs11/pkcs11.h/License: public-domainstanza; the same file is in botan3_3.14.1.orig.tar.gz, consistent with the changelog's 'OASIS licensed PKCS #11 headers are removed' and with dropping the +dfsg suffix. - Licence evidence: every source header sampled (src/lib, src/cli, src/fuzzers, src/tests, configure.py, .github, .devcontainer) says 'Botan is released under the Simplified BSD License' or 'Distributed under the terms given in license.txt'; the only other licence in the tree is MIT, in src/build-data/botan-config.cmake.in and botan-config-version.cmake.in, which the MIT stanza covers. No SPDX tags, and no GPL, LGPL, Apache, MPL, CC0-with-attribution or other licence text anywhere outside the public-domain notes for derived code (aria, aes_vperm, kuznyechik, sha1/sha2 SIMD, classic_mceliece, sphincsplus, x25519).
- A search for non-free wording (non-commercial, no modification, field-of-use, 'Good, not Evil', research-only) found only TLS-test and X.509-comment hits, no licence terms.
- debian/ read in full: changelog, control, copyright, rules, watch, clean, not-installed, all .install/.docs/.examples/.links files, libbotan-3-doc.doc-base, source/format and upstream/signing-key.asc. There is no debian/patches and no debian/tests.
- Not-installed upstream docs are limited to doc/authors.txt, license.txt and pgpkey.txt, which are correctly whitelisted in debian/not-installed because upstream's install target puts them in /usr/share/doc/botan-3.14.1/.
- Install paths, Multi-Arch and per-package dependencies in debian/control are consistent with the install files (libbotan-3-14 ships libbotan-3.so.*, the -dev package headers/static lib/CMake/pkgconfig plus the pkg-config private-lib -dev packages, python3-botan the extension module); no compat-14 substvar omissions apply at compat 13, and ${misc:Depends}/${shlibs:Depends}/${python3:Depends} are present where they matter.
- uscan found the packaged version as the newest upstream release (upstream
3.14.1, packaged3.14.1).
Not confirmed ◂
- That botan3_3.14.1.orig.tar.gz is byte-identical to upstream's 3.14.1 release: there is no network to compare with, and no Files-Excluded entry or repack marker in the package; the src/lib/prov/pkcs11 directory of the tarball and of the tree are identical, which is all that could be checked directly.
- Whether sphinx-doc in unstable still ships html/_static/{doctools,language_data,searchtools}.js, the targets of libbotan-3-doc.links: sphinx-doc is not installed on the reviewing system, and apt-cache only shows that it depends on libjs-sphinxdoc (>= 9.0), which suggests the files are there as symlinks.
Proposed changes ◂
None.
Uploader's response to the LLM review
Waiting for the uploader's response until , because the review found serious issues.
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 3.13.0+dfsg-1 | 48f4769b… | 2026-08-23 13:30 | 2026-08-23 13:34 | mechtilde | accepted | VIEW |
| 3.12.0+dfsg-1 | 40c47778… | 2026-05-12 12:58 | 2026-05-12 13:10 | mechtilde | accepted | VIEW |
| 3.11.0+dfsg-1 | bfaff894… | 2026-03-22 10:10 | 2026-03-22 10:17 | mechtilde | rejected | VIEW |
| 3.11.0+dfsg-1 | f8269505… | 2026-03-22 14:21 | 2026-03-22 14:24 | mechtilde | accepted | VIEW |