head	1.10;
access;
symbols
	pkgsrc-2026Q3:1.7.0.2
	pkgsrc-2026Q3-base:1.7
	pkgsrc-2026Q2:1.4.0.4
	pkgsrc-2026Q2-base:1.4
	pkgsrc-2026Q1:1.4.0.2
	pkgsrc-2026Q1-base:1.4
	pkgsrc-2025Q4:1.3.0.2
	pkgsrc-2025Q4-base:1.3
	pkgsrc-2025Q3:1.1.0.2
	pkgsrc-2025Q3-base:1.1;
locks; strict;
comment	@# @;


1.10
date	2026.11.09.08.14.56;	author adam;	state Exp;
branches;
next	1.9;
commitid	mdVbwlvlRwt9fL2H;

1.9
date	2026.09.29.06.07.20;	author wiz;	state Exp;
branches;
next	1.8;
commitid	qal4xgy1mkCzPtXG;

1.8
date	2026.09.27.11.38.21;	author tnn;	state Exp;
branches;
next	1.7;
commitid	QJQtnAYom0oZIfXG;

1.7
date	2026.09.05.05.08.23;	author adam;	state Exp;
branches;
next	1.6;
commitid	vku457qWklDAioUG;

1.6
date	2026.09.02.19.04.14;	author wiz;	state Exp;
branches;
next	1.5;
commitid	vXszxoxOqka005UG;

1.5
date	2026.07.24.09.03.52;	author adam;	state Exp;
branches;
next	1.4;
commitid	PinmqtRbiEF8ZSOG;

1.4
date	2026.03.12.12.19.38;	author adam;	state Exp;
branches;
next	1.3;
commitid	WcbospUM0BfnnGxG;

1.3
date	2025.10.23.20.39.05;	author wiz;	state Exp;
branches;
next	1.2;
commitid	1V2hBZn9ypXaCJfG;

1.2
date	2025.10.21.18.31.28;	author adam;	state Exp;
branches;
next	1.1;
commitid	mq3nkrGy1O8SZsfG;

1.1
date	2025.07.14.05.35.36;	author adam;	state Exp;
branches;
next	;
commitid	xMLzUF0QPIeXSF2G;


desc
@@


1.10
log
@defguard: updatd to 2.2.0

2.2.0

Multi-step configurable MFA methods - build MFA flows from ordered steps, each with the factors allowed to pass it, enforce them per location and assign different flows to selected groups.
Use FIDO2 hardware key as MFA factor - add it using the Desktop Client, configure an MFA Flow with FIDO2 Security Key factor, assign it to your location and connect using the latest Desktop and Mobile Client (NFC).
Configuring MFA factors in the Desktop Client - when a location requires an MFA method a user hasn't set up, the desktop client shows Configure MFA and guides them through the setup, without re-enrolling the instance. Users can also add more methods at any time.
Bulk actions for Firewall module - select several rules to enable, disable, deploy or delete them at once.
Split-DNS for Defguard clients - only your internal domains are resolved by the location's DNS servers through the VPN, while all other names use the device's normal DNS (check this issue for context).
Handling multiple locations with DNS configuration connected simultaneously - each connected location's domains are resolved by that location's DNS servers, so users can stay connected to several locations at the same time.
Ability to apply custom MTU to the client apps - set the MTU sent to the client apps per location, with group-level overrides for selected groups.
Automatic WireGuard interface metric on Windows - in all traffic mode, the tunnel interface gets the highest priority to prevent traffic and DNS leaks outside the VPN.
Bulk action to put enrolment token in Active Directory for the auto-provisioning process - select users and store their enrollment tokens in an Active Directory attribute in one step, ready for client auto-provisioning.
Completely redesigned Mobile Client - update from Google Play, the App Store, or use the assets from the mobile release.
@
text
@# $NetBSD: Makefile,v 1.9 2026/09/29 06:07:20 wiz Exp $

.include "../../security/defguard/version.mk"

DISTNAME=	defguard-${DEFGUARD_VERSION}

COMMENT=	True Zero-Trust WireGuard VPN with 2FA/MFA

CARGO_GITHUB_CRATES=	DefGuard ldap3 65ae9ad320770c63f366233ebe121534e16b59a7#65ae9ad3

INSTALLATION_DIRS=	bin

do-install:
	${INSTALL_PROGRAM} ${WRKSRC}/target/release/defguard ${DESTDIR}${PREFIX}/bin/

.include "cargo-depends.mk"

.include "../../comms/libhidapi/buildlink3.mk"
.include "../../devel/libgit2/buildlink3.mk"
.include "../../lang/rust/cargo.mk"
.include "../../security/openssl/buildlink3.mk"
.include "../../mk/bsd.pkg.mk"
@


1.9
log
@*: recursive bump for pcre2 10.49
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.8 2026/09/27 11:38:21 tnn Exp $
a2 1
PKGREVISION= 2
d18 1
@


1.8
log
@*: revbump for pcre2 symbol versioning change
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.7 2026/09/05 05:08:23 adam Exp $
d3 1
a3 1
PKGREVISION= 1
@


1.7
log
@defguard*: updated to 2.1.0

2.1 makes the device itself part of the access decision - admins define the
security criteria a machine must meet, and non-compliant endpoints simply can't
establish a connection - and it ships a rebuilt Desktop Client whose tray mode
gets your users onto the VPN in two clicks.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.6 2026/09/02 19:04:14 wiz Exp $
d3 1
@


1.6
log
@*: recursive bump for pcre2 10.48
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.5 2026/07/24 09:03:52 adam Exp $
a2 1
PKGREVISION= 1
a5 1
GITHUB_TAG=	v${PKGVERSION_NOREV}
d9 1
a9 3
EXTRA_DIST+=	defguard-${DEFGUARD_VERSION}-proto${EXTRACT_SUFX}
# Building web requires pnpm, which can't be easily build.
EXTRA_DIST+=	${DISTNAME}-web-dist${EXTRACT_SUFX}
a12 3
post-extract:
	${RMDIR} ${WRKSRC}/proto && ${LN} -f -s ${WRKDIR}/proto ${WRKSRC}/proto

@


1.5
log
@defguard-gateway: updated to 2.0.3

2.0.3
Fix memory access problem on BSD.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.4 2026/03/12 12:19:38 adam Exp $
d3 1
@


1.4
log
@defguard: updated to 1.6.4

1.6.4

This is a security patch for the major 1.6 release.
It includes dependency updates to resolve the following CVEs:

CVE-2026-25537
GHSA-7587-4wv6-m68m
GHSA-8h58-w33p-wq3g
GHSA-c7ph-f7jm-xv4w
CVE-2026-25727
CVE-2026-25639
CVE-2026-2391
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.3 2025/10/23 20:39:05 wiz Exp $
d6 1
d10 1
d16 3
@


1.3
log
@*: recursive bump for pcre2

Running an old binary against the new pcre doesn't work:
/usr/pkg/lib/libpcre2-8.so.0: version PCRE2_10.47 required by /usr/pkg/lib/libglib-2.0.so.0 not defined
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.2 2025/10/21 18:31:28 adam Exp $
a2 1
PKGREVISION= 1
a11 5
USE_TOOLS+=	pkg-config
MAKE_ENV+=	OPENSSL_DIR=${BUILDLINK_PREFIX.openssl}
RUSTFLAGS+=	-C link-arg=${COMPILER_RPATH_FLAG}${BUILDLINK_PREFIX.libgit2}/lib
RUSTFLAGS+=	-C link-arg=${COMPILER_RPATH_FLAG}${BUILDLINK_PREFIX.openssl}/lib

@


1.2
log
@defguard*: updated to 1.5.1

1.5.1
This patch for version 1.5 includes fixes for vulnerabilities identified during our latest penetration test. As a fully transparent organization, Defguard publishes a Pentesting Security Report page where you can track the status of our vulnerability fixes.

1.5.0
This is the biggest, most feature packed (and fixes) release we have ever done!
We’ve introduced 11 major features! and nearly 100 bugfixes.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.1 2025/07/14 05:35:36 adam Exp $
d3 1
@


1.1
log
@defguard: added version 1.4.0

Defguard provides Comprehensive Access Control (a complete security platform):
* WireGuard VPN with 2FA/MFA - not 2FA to "access application" like most
  solutions
  - The only solution with automatic and real-time synchronization for users'
    desktop client settings (including all VPNs/locations).
  - Control users ability to manage devices and VPN options
* ACLs/Firewall Management for Linux and FreeBSD/OPNSense
* Integrated SSO based on OpenID Connect:
  - significant cost saving, simplifying deployment and maintenance
  - enabling features unavailable to VPN platforms relying upon 3rd party SSO
    integration
* Already using Google/Microsoft or other OpenID Provider? - external OpenID
  provider support
* Two way Active Directory/LDAP synchronization
* Only solution with secure remote user Enrollment & Onboarding
* Yubico YubiKey Hardware security key management and provisioning
* Secure and robust architecture, featuring components and micro-services
  seamlessly deployable in diverse network setups (eg. utilizing network
  segments like Demilitarized Zones, Intranet with no external access, etc),
  ensuring a secure environment.
* Enterprise ready (multiple Locations/Gateways/Kubernetes deployment, etc..)
* Built on WireGuard protocol which is faster than IPSec, and significantly
  faster than OpenVPN
* Built with Rust for speed and security
@
text
@d1 1
a1 1
# $NetBSD$
d9 1
a9 1
# Building web requires proto submodule and pnpm, which can't be easily build.
d12 1
d14 1
d24 1
@