https://gitlab.synchro.net/main/sbbs/-/commit/8f954ccff39d37bd9e7a021e
Added Files:
src/xptls/test_xp_tls.cpp xp_cipher.h xp_cipher_botan3.cpp xp_cipher_none.c xp_cipher_openssl.c xp_crypto.h xp_crypto_botan3.cpp xp_crypto_common.c xp_crypto_none.c xp_crypto_openssl.c xp_key.h xp_key_internal.h xp_key_pkcs11_openssl.c xp_key_store.c xp_tls_credentials.c xp_tls_internal.h
Modified Files:
src/syncterm/webget.c src/xptls/CMakeLists.txt test_xp_ca.c test_xp_crypto.c test_xp_crypto_none.c xp_ca.h xp_ca_botan3.cpp xp_ca_none.c xp_ca_openssl.c xp_sign.h xp_tls.h xp_tls_botan3.cpp xp_tls_none.c xp_tls_openssl.c
Log Message:
xptls: add provider-neutral crypto APIs

Synchronet's remaining Cryptlib callers need key management, symmetric encryption, certificate issuance, and TLS server features without tying
callers to one provider's native API.

Add generic key handles, persistent stores, PKCS#11 access, symmetric
ciphers, expanded CA operations, and TLS server credentials. Implement
the same contracts for Botan 3 and OpenSSL, with explicit unsupported
results from no-crypto builds.

Add bounded TLS operations, session inspection, shutdown semantics, and
tests for certificates, PSKs, client authentication, concurrency, and
close handling. Preserve authenticated Botan plaintext when application
data arrives with close_notify, and harden SyncTERM webget's buffered
TLS and EOF handling.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net