On Wed, Oct 07, 2026 at 09:07:05PM -0500, izzy Meyer wrote:
> Hi,
> 
> Ping!
> 
> Now that the tree has been unlocked, could this be reviewed?

It mostly looks good to me. There is one warning that we should fix,
however, so I'd suggest I commit the diff below. The other warnings are
all harmless.

This will cause a crash if the code is ever hit:

../zoitechat-2.19.1/src/common/util.c:1463:108: warning: null passed to a callee that requires a non-null argument [-Wnonnull]
 1463 |         digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL);

The penultimate argument of HMAC must not be NULL on anything but
OpenSSL because there is no way to make the static buffer thread safe.
We removed this feature a while back and BoringSSL about a decade ago:

https://github.com/openbsd/src/commit/9cb045229698d08f09fbd7cf9ae7f3b9b8f8b848

The patch below fixes this.

Index: Makefile
===================================================================
RCS file: /cvs/ports/net/zoitechat/Makefile,v
diff -u -p -r1.2 Makefile
--- Makefile	9 Sep 2026 15:16:53 -0000	1.2
+++ Makefile	10 Oct 2026 10:26:31 -0000
@@ -1,6 +1,6 @@
 COMMENT =		GTK+ IRC Client
-PSL_COMMIT =		d91e55ea128af6218897d3b3723b28af7138c3d6
-DIST_TUPLE +=		github ZoiteChat zoitechat v2.19.0 .
+PSL_COMMIT =		3955e3ec29b94c3cca7bd4509c5f14a7c0959e26
+DIST_TUPLE +=		github ZoiteChat zoitechat v2.19.1 .
 DIST_TUPLE +=		github publicsuffix list ${PSL_COMMIT} \
 			src/common/publicsuffix
 CATEGORIES =		net x11
Index: distinfo
===================================================================
RCS file: /cvs/ports/net/zoitechat/distinfo,v
diff -u -p -r1.1.1.1 distinfo
--- distinfo	9 Sep 2026 15:15:21 -0000	1.1.1.1
+++ distinfo	10 Oct 2026 10:26:31 -0000
@@ -1,4 +1,4 @@
-SHA256 (ZoiteChat-zoitechat-v2.19.0.tar.gz) = oBlK3zuLIaXKBtxFNED3GuSRykjsch3YOczywndbVf4=
-SHA256 (publicsuffix-list-d91e55ea128af6218897d3b3723b28af7138c3d6.tar.gz) = rCQCD+233k9sBvifccjFk8U7/m+Ru6YG1bIeXCu4OMA=
-SIZE (ZoiteChat-zoitechat-v2.19.0.tar.gz) = 3522858
-SIZE (publicsuffix-list-d91e55ea128af6218897d3b3723b28af7138c3d6.tar.gz) = 306199
+SHA256 (ZoiteChat-zoitechat-v2.19.1.tar.gz) = pkJz7GFlhzCiFRTekUqhYLTrlU1WPF1VRQyoz+MyoJg=
+SHA256 (publicsuffix-list-3955e3ec29b94c3cca7bd4509c5f14a7c0959e26.tar.gz) = o1GFP6MCHOHTmVV5I6xXgSjB7EOtM8yZnMyz37u7HP8=
+SIZE (ZoiteChat-zoitechat-v2.19.1.tar.gz) = 3523177
+SIZE (publicsuffix-list-3955e3ec29b94c3cca7bd4509c5f14a7c0959e26.tar.gz) = 306310
Index: patches/patch-src_common_util_c
===================================================================
RCS file: patches/patch-src_common_util_c
diff -N patches/patch-src_common_util_c
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_common_util_c	10 Oct 2026 10:42:13 -0000
@@ -0,0 +1,24 @@
+warning: null passed to a callee that requires a non-null argument [-Wnonnull]
+ 1463 |         digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL);
+
+Index: src/common/util.c
+--- src/common/util.c.orig
++++ src/common/util.c
+@@ -1444,7 +1444,7 @@ challengeauth_response (const char *username, const ch
+ 	char *passhash;
+ 	char *key;
+ 	char *keyhash;
+-	unsigned char *digest;
++	unsigned char digest[SHA256_DIGEST_LENGTH];
+ 	GString *buf = g_string_new_len (NULL, SHA256_DIGEST_LENGTH * 2);
+ 
+ 	user = rfc_strlower (username); /* convert username to lowercase as per the RFC */
+@@ -1460,7 +1460,7 @@ challengeauth_response (const char *username, const ch
+ 	keyhash = str_sha256hash (key);
+ 	g_free (key);
+ 
+-	digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL);
++	HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), digest, NULL);
+ 	g_free (keyhash);
+ 
+ 	for (i = 0; i < SHA256_DIGEST_LENGTH; i++)