Index: head/net/syncthing/Makefile
===================================================================
--- head/net/syncthing/Makefile	(revision 546102)
+++ head/net/syncthing/Makefile	(revision 546103)
@@ -1,64 +1,65 @@
 # $FreeBSD$
 
 PORTNAME=	syncthing
 PORTVERSION=	1.8.0
+PORTREVISION=	1
 DISTVERSIONPREFIX=	v
 CATEGORIES=	net
 MASTER_SITES=	https://github.com/syncthing/syncthing/releases/download/v${PORTVERSION}/
 DISTNAME=	${PORTNAME}-source-${DISTVERSIONPREFIX}${PORTVERSION}
 DISTFILES=	${DISTNAME}${EXTRACT_SUFX}
 
 MAINTAINER=	swills@FreeBSD.org
 COMMENT=	Encrypted file sync tool
 
 LICENSE=	MPL20
 LICENSE_FILE=	${WRKSRC}/${PORTNAME}/LICENSE
 
 USES=		go
 
 USE_GITHUB=	nodefault
 GH_TUPLE=	lucas-clemente:quic-go:3fa290f:quicgo \
 		marten-seemann:qtls-go115:f94d2ad:qtlsgo115
 
 USE_RC_SUBR=	syncthing syncthing-discosrv syncthing-relaysrv syncthing-relaypoolsrv
 
 BINS=		syncthing stdiscosrv strelaysrv strelaypoolsrv
 
 .for x in ${BINS}
 PLIST_FILES+=	bin/${x}
 .endfor
 
 PORTDOCS=	*
 
 USERS=		syncthing
 GROUPS=		syncthing
 
 OPTIONS_DEFINE=	DOCS
 
 NO_WRKSUBDIR=	yes
 
 post-patch:
 	${RM} -r ${WRKSRC}/syncthing/vendor/github.com/lucas-clemente/quic-go
 	${MV} ${WRKSRC}/quic-go-3fa290f ${WRKSRC}/syncthing/vendor/github.com/lucas-clemente/quic-go
 	${MV} ${WRKSRC}/qtls-go115-f94d2ad ${WRKSRC}/syncthing/vendor/github.com/marten-seemann/qtls-go115
 
 do-build:
 	@( cd ${WRKSRC}/${PORTNAME} ; \
 		${SETENV} ${MAKE_ENV} CGO_ENABLED=0 GOFLAGS="-mod=vendor" go run build.go -version v${PORTVERSION} -no-upgrade build ; \
 		${SETENV} ${MAKE_ENV} CGO_ENABLED=0 GOFLAGS="-mod=vendor" go run build.go -version v${PORTVERSION} -no-upgrade build stdiscosrv ; \
 		${SETENV} ${MAKE_ENV} CGO_ENABLED=0 GOFLAGS="-mod=vendor" go run build.go -version v${PORTVERSION} -no-upgrade build strelaysrv ; \
 		${SETENV} ${MAKE_ENV} CGO_ENABLED=0 GOFLAGS="-mod=vendor" go run build.go -version v${PORTVERSION} -no-upgrade build strelaypoolsrv ; \
 		)
 
 do-install:
 .for x in ${BINS}
 	${INSTALL_PROGRAM} ${WRKSRC}/${PORTNAME}/${x} \
 		${STAGEDIR}${PREFIX}/bin/
 .endfor
 	${MKDIR} ${STAGEDIR}${DOCSDIR}
 .for x in AUTHORS LICENSE README.md
 	${INSTALL_DATA} ${WRKSRC}/${PORTNAME}/${x} \
 		${STAGEDIR}${DOCSDIR}
 .endfor
 
 .include <bsd.port.mk>
Index: head/net/syncthing/files/patch-syncthing_lib_api_api.go
===================================================================
--- head/net/syncthing/files/patch-syncthing_lib_api_api.go	(nonexistent)
+++ head/net/syncthing/files/patch-syncthing_lib_api_api.go	(revision 546103)
@@ -0,0 +1,47 @@
+--- syncthing/lib/api/api.go.orig	2020-08-11 08:56:46 UTC
++++ syncthing/lib/api/api.go
+@@ -149,7 +149,7 @@ func (s *service) getListener(guiCfg config.GUIConfigu
+ 	// If the certificate has expired or will expire in the next month, fail
+ 	// it and generate a new one.
+ 	if err == nil {
+-		err = checkExpiry(cert)
++		err = shouldRegenerateCertificate(cert)
+ 	}
+ 	if err != nil {
+ 		l.Infoln("Loading HTTPS certificate:", err)
+@@ -1736,7 +1736,11 @@ func addressIsLocalhost(addr string) bool {
+ 	}
+ }
+ 
+-func checkExpiry(cert tls.Certificate) error {
++// shouldRegenerateCertificate checks for certificate expiry or other known
++// issues with our API/GUI certificate and returns either nil (leave the
++// certificate alone) or an error describing the reason the certificate
++// should be regenerated.
++func shouldRegenerateCertificate(cert tls.Certificate) error {
+ 	leaf := cert.Leaf
+ 	if leaf == nil {
+ 		// Leaf can be nil or not, depending on how parsed the certificate
+@@ -1752,10 +1756,19 @@ func checkExpiry(cert tls.Certificate) error {
+ 		}
+ 	}
+ 
+-	if leaf.Subject.String() != leaf.Issuer.String() ||
+-		len(leaf.DNSNames) != 0 || len(leaf.IPAddresses) != 0 {
+-		// The certificate is not self signed, or has DNS/IP attributes we don't
++	if leaf.Subject.String() != leaf.Issuer.String() || len(leaf.IPAddresses) != 0 {
++		// The certificate is not self signed, or has IP attributes we don't
+ 		// add, so we leave it alone.
++		return nil
++	}
++	if len(leaf.DNSNames) > 1 {
++		// The certificate has more DNS SANs attributes than we ever add, so
++		// we leave it alone.
++		return nil
++	}
++	if len(leaf.DNSNames) == 1 && leaf.DNSNames[0] != leaf.Issuer.CommonName {
++		// The one SAN is different from the issuer, so it's not one of our
++		// newer self signed certificates.
+ 		return nil
+ 	}
+ 

Property changes on: head/net/syncthing/files/patch-syncthing_lib_api_api.go
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Index: head/net/syncthing/files/patch-syncthing_lib_api_api__test.go
===================================================================
--- head/net/syncthing/files/patch-syncthing_lib_api_api__test.go	(nonexistent)
+++ head/net/syncthing/files/patch-syncthing_lib_api_api__test.go	(revision 546103)
@@ -0,0 +1,38 @@
+--- syncthing/lib/api/api_test.go.orig	2020-08-11 08:56:46 UTC
++++ syncthing/lib/api/api_test.go
+@@ -1136,7 +1136,7 @@ func TestPrefixMatch(t *testing.T) {
+ 	}
+ }
+ 
+-func TestCheckExpiry(t *testing.T) {
++func TestShouldRegenerateCertificate(t *testing.T) {
+ 	dir, err := ioutil.TempDir("", "syncthing-test")
+ 	if err != nil {
+ 		t.Fatal(err)
+@@ -1149,7 +1149,7 @@ func TestCheckExpiry(t *testing.T) {
+ 	if err != nil {
+ 		t.Fatal(err)
+ 	}
+-	if err := checkExpiry(crt); err == nil {
++	if err := shouldRegenerateCertificate(crt); err == nil {
+ 		t.Error("expected expiry error")
+ 	}
+ 
+@@ -1158,7 +1158,7 @@ func TestCheckExpiry(t *testing.T) {
+ 	if err != nil {
+ 		t.Fatal(err)
+ 	}
+-	if err := checkExpiry(crt); err != nil {
++	if err := shouldRegenerateCertificate(crt); err != nil {
+ 		t.Error("expected no error:", err)
+ 	}
+ 
+@@ -1168,7 +1168,7 @@ func TestCheckExpiry(t *testing.T) {
+ 		if err != nil {
+ 			t.Fatal(err)
+ 		}
+-		if err := checkExpiry(crt); err == nil {
++		if err := shouldRegenerateCertificate(crt); err == nil {
+ 			t.Error("expected expiry error")
+ 		}
+ 	}

Property changes on: head/net/syncthing/files/patch-syncthing_lib_api_api__test.go
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Index: head/net/syncthing/files/patch-syncthing_lib_connections_service.go
===================================================================
--- head/net/syncthing/files/patch-syncthing_lib_connections_service.go	(nonexistent)
+++ head/net/syncthing/files/patch-syncthing_lib_connections_service.go	(revision 546103)
@@ -0,0 +1,15 @@
+--- syncthing/lib/connections/service.go.orig	2020-08-11 08:56:46 UTC
++++ syncthing/lib/connections/service.go
+@@ -305,7 +305,11 @@ func (s *service) handle(ctx context.Context) {
+ 		if certName == "" {
+ 			certName = s.tlsDefaultCommonName
+ 		}
+-		if err := remoteCert.VerifyHostname(certName); err != nil {
++		if remoteCert.Subject.CommonName == certName {
++			// All good. We do this check because our old style certificates
++			// have "syncthing" in the CommonName field and no SANs, which
++			// is not accepted by VerifyHostname() any more as of Go 1.15.
++		} else if err := remoteCert.VerifyHostname(certName); err != nil {
+ 			// Incorrect certificate name is something the user most
+ 			// likely wants to know about, since it's an advanced
+ 			// config. Warn instead of Info.

Property changes on: head/net/syncthing/files/patch-syncthing_lib_connections_service.go
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Index: head/net/syncthing/files/patch-syncthing_lib_tlsutil_tlsutil.go
===================================================================
--- head/net/syncthing/files/patch-syncthing_lib_tlsutil_tlsutil.go	(nonexistent)
+++ head/net/syncthing/files/patch-syncthing_lib_tlsutil_tlsutil.go	(revision 546103)
@@ -0,0 +1,10 @@
+--- syncthing/lib/tlsutil/tlsutil.go.orig	2020-08-11 08:56:46 UTC
++++ syncthing/lib/tlsutil/tlsutil.go
+@@ -106,6 +106,7 @@ func NewCertificate(certFile, keyFile, commonName stri
+ 		Subject: pkix.Name{
+ 			CommonName: commonName,
+ 		},
++		DNSNames:              []string{commonName},
+ 		NotBefore:             notBefore,
+ 		NotAfter:              notAfter,
+ 		SignatureAlgorithm:    x509.ECDSAWithSHA256,

Property changes on: head/net/syncthing/files/patch-syncthing_lib_tlsutil_tlsutil.go
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property