diff --git a/Z-Botan.cabal b/Z-Botan.cabal
--- a/Z-Botan.cabal
+++ b/Z-Botan.cabal
@@ -1,6 +1,6 @@
 cabal-version:      2.4
 name:               Z-Botan
-version:            0.1.1.0
+version:            0.1.1.1
 synopsis:           Crypto for Haskell
 description:        Crypto for Haskell, based on <http://botan.randombit.net/ Botan>
 license:            BSD-3-Clause
@@ -21,6 +21,8 @@
   third_party/botan/configure.py
   third_party/botan/src/**/*.cpp
   third_party/botan/src/**/*.h
+  third_party/botan/src/**/*.in
+  third_party/botan/src/**/*.txt
   third_party/botan/build/include/external/cabal.placeholder
   third_party/cacert.md
   third_party/cacert.pem
diff --git a/third_party/botan/src/build-data/arch/alpha.txt b/third_party/botan/src/build-data/arch/alpha.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/alpha.txt
@@ -0,0 +1,7 @@
+endian little
+wordsize 64
+
+<aliases>
+axp
+alphaaxp
+</aliases>
diff --git a/third_party/botan/src/build-data/arch/arm32.txt b/third_party/botan/src/build-data/arch/arm32.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/arm32.txt
@@ -0,0 +1,20 @@
+endian little
+family arm
+
+<aliases>
+arm
+armeb
+armel # For Debian
+armhf # For Debian
+evbarm # For NetBSD
+
+armv7
+armv7l
+armv7-a
+
+armv8l # For AlpineLinux
+</aliases>
+
+<isa_extensions>
+neon
+</isa_extensions>
diff --git a/third_party/botan/src/build-data/arch/arm64.txt b/third_party/botan/src/build-data/arch/arm64.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/arm64.txt
@@ -0,0 +1,19 @@
+endian little
+wordsize 64
+
+family arm
+
+<aliases>
+aarch64
+armv8
+armv8-a
+</aliases>
+
+<isa_extensions>
+neon
+armv8crypto
+armv8sm3
+armv8sm4
+armv8sha3
+armv8sha512
+</isa_extensions>
diff --git a/third_party/botan/src/build-data/arch/generic.txt b/third_party/botan/src/build-data/arch/generic.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/generic.txt
@@ -0,0 +1,4 @@
+
+# This target can be used when building an amalgamation which must
+# be built on multiple architectures, or when targetting a CPU
+# which the build system doesn't know about.
diff --git a/third_party/botan/src/build-data/arch/hppa.txt b/third_party/botan/src/build-data/arch/hppa.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/hppa.txt
@@ -0,0 +1,8 @@
+<aliases>
+hp-pa
+parisc
+parisc64
+pa-risc
+hp-parisc
+hp-pa-risc
+</aliases>
diff --git a/third_party/botan/src/build-data/arch/ia64.txt b/third_party/botan/src/build-data/arch/ia64.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/ia64.txt
@@ -0,0 +1,6 @@
+wordsize 64
+
+<aliases>
+itanium
+itanic
+</aliases>
diff --git a/third_party/botan/src/build-data/arch/llvm.txt b/third_party/botan/src/build-data/arch/llvm.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/llvm.txt
@@ -0,0 +1,1 @@
+wordsize 64
diff --git a/third_party/botan/src/build-data/arch/m68k.txt b/third_party/botan/src/build-data/arch/m68k.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/m68k.txt
@@ -0,0 +1,6 @@
+endian big
+
+<aliases>
+680x0
+68k
+</aliases>
diff --git a/third_party/botan/src/build-data/arch/mips32.txt b/third_party/botan/src/build-data/arch/mips32.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/mips32.txt
@@ -0,0 +1,6 @@
+<aliases>
+mips
+mipsbe # RedHat
+mipsle # RedHat
+mipsel # Debian
+</aliases>
diff --git a/third_party/botan/src/build-data/arch/mips64.txt b/third_party/botan/src/build-data/arch/mips64.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/mips64.txt
@@ -0,0 +1,5 @@
+wordsize 64
+
+<aliases>
+mips64el
+</aliases>
diff --git a/third_party/botan/src/build-data/arch/powerpcspe.txt b/third_party/botan/src/build-data/arch/powerpcspe.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/powerpcspe.txt
@@ -0,0 +1,3 @@
+endian big
+
+family ppc
diff --git a/third_party/botan/src/build-data/arch/ppc32.txt b/third_party/botan/src/build-data/arch/ppc32.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/ppc32.txt
@@ -0,0 +1,12 @@
+endian big
+
+family ppc
+
+<aliases>
+powerpc
+ppc
+</aliases>
+
+<isa_extensions>
+altivec
+</isa_extensions>
diff --git a/third_party/botan/src/build-data/arch/ppc64.txt b/third_party/botan/src/build-data/arch/ppc64.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/ppc64.txt
@@ -0,0 +1,16 @@
+endian big
+
+family ppc
+wordsize 64
+
+<aliases>
+powerpc64
+powerpc64le
+ppc64le
+ppc64el
+</aliases>
+
+<isa_extensions>
+altivec
+powercrypto
+</isa_extensions>
diff --git a/third_party/botan/src/build-data/arch/riscv64.txt b/third_party/botan/src/build-data/arch/riscv64.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/riscv64.txt
@@ -0,0 +1,2 @@
+family riscv
+endian little
diff --git a/third_party/botan/src/build-data/arch/s390.txt b/third_party/botan/src/build-data/arch/s390.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/s390.txt
@@ -0,0 +1,1 @@
+endian big
diff --git a/third_party/botan/src/build-data/arch/s390x.txt b/third_party/botan/src/build-data/arch/s390x.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/s390x.txt
@@ -0,0 +1,2 @@
+endian big
+wordsize 64
diff --git a/third_party/botan/src/build-data/arch/sparc32.txt b/third_party/botan/src/build-data/arch/sparc32.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/sparc32.txt
@@ -0,0 +1,7 @@
+endian big
+
+family sparc
+
+<aliases>
+sparc
+</aliases>
diff --git a/third_party/botan/src/build-data/arch/sparc64.txt b/third_party/botan/src/build-data/arch/sparc64.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/sparc64.txt
@@ -0,0 +1,3 @@
+family sparc
+wordsize 64
+endian big
diff --git a/third_party/botan/src/build-data/arch/superh.txt b/third_party/botan/src/build-data/arch/superh.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/superh.txt
@@ -0,0 +1,4 @@
+
+<aliases>
+sh4
+</aliases>
diff --git a/third_party/botan/src/build-data/arch/x32.txt b/third_party/botan/src/build-data/arch/x32.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/x32.txt
@@ -0,0 +1,16 @@
+endian little
+
+family x86
+
+<isa_extensions>
+aesni
+avx2
+bmi2
+rdrand
+rdseed
+sha
+sse2
+sse41
+sse42
+ssse3
+</isa_extensions>
diff --git a/third_party/botan/src/build-data/arch/x86_32.txt b/third_party/botan/src/build-data/arch/x86_32.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/x86_32.txt
@@ -0,0 +1,32 @@
+endian little
+
+family x86
+
+<aliases>
+ia32
+x86
+ix86
+80x86
+i86pc # for Solaris
+x86pc # for QNX
+bepc  # for Haiku
+
+i686-at386 # for Hurd
+
+i686
+i586
+i386
+</aliases>
+
+<isa_extensions>
+aesni
+avx2
+bmi2
+rdrand
+rdseed
+sha
+sse2
+sse41
+sse42
+ssse3
+</isa_extensions>
diff --git a/third_party/botan/src/build-data/arch/x86_64.txt b/third_party/botan/src/build-data/arch/x86_64.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/arch/x86_64.txt
@@ -0,0 +1,25 @@
+endian little
+wordsize 64
+
+family x86
+
+<aliases>
+amd64
+x86-64
+em64t
+x64
+x86_amd64
+</aliases>
+
+<isa_extensions>
+aesni
+avx2
+bmi2
+rdrand
+rdseed
+sha
+sse2
+sse41
+sse42
+ssse3
+</isa_extensions>
diff --git a/third_party/botan/src/build-data/bakefile.in b/third_party/botan/src/build-data/bakefile.in
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/bakefile.in
@@ -0,0 +1,51 @@
+toolsets = vs2013;
+shared-library botan {
+   defines = "BOTAN_DLL=__declspec(dllexport)";
+   sources {
+%{for lib_srcs}
+      %{i}
+%{endfor}
+   }
+}
+
+program cli {
+   deps = botan;
+   sources {
+%{for cli_srcs}
+      %{i}
+%{endfor}
+   }
+
+   headers {
+%{for cli_headers}
+      %{i}
+%{endfor}
+   }
+
+}
+
+program tests {
+   deps = botan;
+   sources {
+%{for test_srcs}
+      %{i}
+%{endfor}
+   }
+}
+
+includedirs += build/include/;
+includedirs += build/include/external;
+
+%{for libs_used}
+libs += "%{i}";
+%{endfor}
+
+archs = %{bakefile_arch};
+
+vs2013.option.ClCompile.DisableSpecificWarnings = "4250;4251;4275";
+vs2013.option.ClCompile.WarningLevel = Level4;
+vs2013.option.ClCompile.ExceptionHandling = SyncCThrow;
+vs2013.option.ClCompile.RuntimeTypeInfo = true;
+if ( $(config) == Release ) {
+   vs2013.option.Configuration.WholeProgramOptimization = true;
+}
diff --git a/third_party/botan/src/build-data/botan.doxy.in b/third_party/botan/src/build-data/botan.doxy.in
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/botan.doxy.in
@@ -0,0 +1,223 @@
+# Doxyfile 1.5.4
+
+PROJECT_NAME           = Botan
+PROJECT_NUMBER         = %{version}
+PROJECT_BRIEF          = Crypto&nbsp;and&nbsp;TLS&nbsp;for&nbsp;C&#43;&#43;11
+OUTPUT_DIRECTORY       = %{doc_output_dir}/doxygen
+DOXYFILE_ENCODING      = UTF-8
+CREATE_SUBDIRS         = NO
+OUTPUT_LANGUAGE        = English
+BRIEF_MEMBER_DESC      = YES
+REPEAT_BRIEF           = YES
+ABBREVIATE_BRIEF       =
+ALWAYS_DETAILED_SEC    = NO
+INLINE_INHERITED_MEMB  = YES
+FULL_PATH_NAMES        = YES
+STRIP_FROM_PATH        =
+STRIP_FROM_INC_PATH    =
+SHORT_NAMES            = NO
+JAVADOC_AUTOBRIEF      = NO
+QT_AUTOBRIEF           = NO
+MULTILINE_CPP_IS_BRIEF = NO
+INHERIT_DOCS           = YES
+SEPARATE_MEMBER_PAGES  = NO
+TAB_SIZE               = 8
+ALIASES                =
+OPTIMIZE_OUTPUT_FOR_C  = NO
+OPTIMIZE_OUTPUT_JAVA   = NO
+BUILTIN_STL_SUPPORT    = NO
+CPP_CLI_SUPPORT        = NO
+SIP_SUPPORT            = NO
+DISTRIBUTE_GROUP_DOC   = NO
+SUBGROUPING            = YES
+TYPEDEF_HIDES_STRUCT   = NO
+
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+
+# Set this to NO to get warnings about undocumented members/classes
+EXTRACT_ALL            = YES
+EXTRACT_PRIVATE        = NO
+EXTRACT_STATIC         = NO
+EXTRACT_LOCAL_CLASSES  = NO
+EXTRACT_LOCAL_METHODS  = NO
+EXTRACT_ANON_NSPACES   = NO
+HIDE_UNDOC_MEMBERS     = NO
+HIDE_UNDOC_CLASSES     = NO
+HIDE_FRIEND_COMPOUNDS  = NO
+HIDE_IN_BODY_DOCS      = NO
+INTERNAL_DOCS          = NO
+CASE_SENSE_NAMES       = YES
+HIDE_SCOPE_NAMES       = NO
+SHOW_INCLUDE_FILES     = YES
+INLINE_INFO            = YES
+SORT_MEMBER_DOCS       = YES
+SORT_BRIEF_DOCS        = YES
+SORT_BY_SCOPE_NAME     = NO
+GENERATE_TODOLIST      = YES
+GENERATE_TESTLIST      = YES
+GENERATE_BUGLIST       = YES
+GENERATE_DEPRECATEDLIST= YES
+ENABLED_SECTIONS       =
+MAX_INITIALIZER_LINES  = 30
+SHOW_USED_FILES        = YES
+FILE_VERSION_FILTER    =
+
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+QUIET                  = YES
+WARNINGS               = YES
+WARN_IF_UNDOCUMENTED   = YES
+WARN_IF_DOC_ERROR      = YES
+WARN_NO_PARAMDOC       = YES
+WARN_FORMAT            = "$file:$line: $text"
+WARN_LOGFILE           =
+
+%{if maintainer_mode}
+WARN_AS_ERROR          = YES
+%{endif}
+
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+INPUT                  = %{src_dir}/lib
+INPUT_ENCODING         = UTF-8
+FILE_PATTERNS          =
+RECURSIVE              = YES
+EXCLUDE                =
+EXCLUDE_SYMLINKS       = NO
+EXCLUDE_PATTERNS       = */wrap/*
+EXCLUDE_SYMBOLS        =
+EXAMPLE_PATH           =
+EXAMPLE_PATTERNS       =
+EXAMPLE_RECURSIVE      = NO
+IMAGE_PATH             =
+INPUT_FILTER           =
+FILTER_PATTERNS        =
+FILTER_SOURCE_FILES    = NO
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+SOURCE_BROWSER         = YES
+INLINE_SOURCES         = YES
+STRIP_CODE_COMMENTS    = NO
+REFERENCED_BY_RELATION = YES
+REFERENCES_RELATION    = YES
+REFERENCES_LINK_SOURCE = YES
+USE_HTAGS              = NO
+VERBATIM_HEADERS       = YES
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+ALPHABETICAL_INDEX     = YES
+COLS_IN_ALPHA_INDEX    = 5
+IGNORE_PREFIX          =
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+GENERATE_HTML          = YES
+HTML_OUTPUT            = .
+HTML_FILE_EXTENSION    = .html
+HTML_HEADER            =
+HTML_FOOTER            =
+HTML_STYLESHEET        =
+GENERATE_HTMLHELP      = NO
+HTML_DYNAMIC_SECTIONS  = NO
+CHM_FILE               =
+HHC_LOCATION           =
+GENERATE_CHI           = NO
+BINARY_TOC             = NO
+TOC_EXPAND             = NO
+DISABLE_INDEX          = NO
+ENUM_VALUES_PER_LINE   = 4
+GENERATE_TREEVIEW      = NO
+TREEVIEW_WIDTH         = 250
+
+#---------------------------------------------------------------------------
+# Configuration options related to other output formats
+#---------------------------------------------------------------------------
+GENERATE_LATEX = NO
+GENERATE_MAN = NO
+GENERATE_RTF = NO
+GENERATE_XML = NO
+
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+ENABLE_PREPROCESSING   = YES
+MACRO_EXPANSION        = YES
+EXPAND_ONLY_PREDEF     = NO
+SEARCH_INCLUDES        = YES
+INCLUDE_PATH           =
+INCLUDE_FILE_PATTERNS  =
+PREDEFINED             = BOTAN_HAS_AES_ARMV8 \
+                         BOTAN_HAS_AES_NI \
+                         BOTAN_HAS_AES_POWER8 \
+                         BOTAN_HAS_AES_VPERM \
+                         BOTAN_HAS_CHACHA_SIMD32 \
+                         BOTAN_HAS_CHACHA_AVX2 \
+                         BOTAN_HAS_IDEA_SSE2 \
+                         BOTAN_HAS_NOEKEON_SIMD \
+                         BOTAN_HAS_SERPENT_SIMD \
+                         BOTAN_HAS_SERPENT_AVX2 \
+                         BOTAN_HAS_SHA1_SSE2 \
+                         BOTAN_HAS_SHA2_32_X86 \
+                         BOTAN_HAS_SHA2_32_X86_BMI2 \
+                         BOTAN_HAS_SHA2_64_BMI2 \
+                         BOTAN_HAS_SHA3_BMI2 \
+                         BOTAN_HAS_SHACAL2_SIMD \
+                         BOTAN_HAS_SHACAL2_AVX2 \
+                         BOTAN_HAS_SHACAL2_X86 \
+                         BOTAN_HAS_SM4_ARMV8 \
+                         BOTAN_HAS_THREEFISH_512_AVX2 \
+                         BOTAN_DEPRECATED(msg)= \
+                         BOTAN_PUBLIC_API(maj,min)= \
+                         BOTAN_HAS_TLS \
+                         BOTAN_HAS_BOOST_ASIO \
+                         BOOST_VERSION=106600
+
+
+EXPAND_AS_DEFINED      =
+SKIP_FUNCTION_MACROS   = YES
+
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references
+#---------------------------------------------------------------------------
+TAGFILES               =
+GENERATE_TAGFILE       =
+ALLEXTERNALS           = NO
+EXTERNAL_GROUPS        = YES
+
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+CLASS_DIAGRAMS         = YES
+HIDE_UNDOC_RELATIONS   = YES
+HAVE_DOT               = NO
+CLASS_GRAPH            = YES
+COLLABORATION_GRAPH    = YES
+GROUP_GRAPHS           = YES
+UML_LOOK               = NO
+TEMPLATE_RELATIONS     = NO
+INCLUDE_GRAPH          = YES
+INCLUDED_BY_GRAPH      = YES
+CALL_GRAPH             = NO
+CALLER_GRAPH           = NO
+GRAPHICAL_HIERARCHY    = YES
+DIRECTORY_GRAPH        = YES
+DOT_IMAGE_FORMAT       = png
+DOT_PATH               =
+DOTFILE_DIRS           =
+DOT_GRAPH_MAX_NODES    = 50
+MAX_DOT_GRAPH_DEPTH    = 0
+DOT_TRANSPARENT        = YES
+DOT_MULTI_TARGETS      = NO
+GENERATE_LEGEND        = YES
+DOT_CLEANUP            = YES
+
+#---------------------------------------------------------------------------
+# Configuration::additions related to the search engine
+#---------------------------------------------------------------------------
+SEARCHENGINE           = NO
diff --git a/third_party/botan/src/build-data/botan.pc.in b/third_party/botan/src/build-data/botan.pc.in
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/botan.pc.in
@@ -0,0 +1,12 @@
+prefix=%{prefix}
+exec_prefix=${prefix}
+libdir=%{libdir}
+includedir=${prefix}/include/botan-%{version_major}
+
+Name: Botan
+Description: Crypto and TLS for C++11
+Version: %{version}
+
+Libs: -L${libdir} -l%{libname} %{cxx_abi_flags}
+Libs.private: %{link_to}
+Cflags: -I${includedir}
diff --git a/third_party/botan/src/build-data/buildh.in b/third_party/botan/src/build-data/buildh.in
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/buildh.in
@@ -0,0 +1,268 @@
+#ifndef BOTAN_BUILD_CONFIG_H_
+#define BOTAN_BUILD_CONFIG_H_
+
+/*
+* Build configuration for Botan %{version}
+*
+* Automatically generated from
+* '%{command_line}'
+*
+* Target
+*  - Compiler: %{cxx} %{cxx_abi_flags} %{cc_lang_flags} %{cc_compile_flags}
+*  - Arch: %{arch}
+*  - OS: %{os}
+*/
+
+#define BOTAN_VERSION_MAJOR %{version_major}
+#define BOTAN_VERSION_MINOR %{version_minor}
+#define BOTAN_VERSION_PATCH %{version_patch}
+#define BOTAN_VERSION_DATESTAMP %{version_datestamp}
+
+%{if version_suffix}
+#define BOTAN_VERSION_SUFFIX %{version_suffix}
+#define BOTAN_VERSION_SUFFIX_STR "%{version_suffix}"
+%{endif}
+
+#define BOTAN_VERSION_RELEASE_TYPE "%{release_type}"
+
+#define BOTAN_VERSION_VC_REVISION "%{version_vc_rev}"
+
+#define BOTAN_DISTRIBUTION_INFO "%{distribution_info}"
+
+/* How many bits per limb in a BigInt */
+#define BOTAN_MP_WORD_BITS %{mp_bits}
+
+%{if fuzzer_mode}
+#define BOTAN_UNSAFE_FUZZER_MODE
+%{endif}
+%{if fuzzer_type}
+#define BOTAN_FUZZER_IS_%{fuzzer_type}
+%{endif}
+
+#define BOTAN_INSTALL_PREFIX R"(%{prefix})"
+#define BOTAN_INSTALL_HEADER_DIR R"(%{includedir}/botan-%{version_major})"
+#define BOTAN_INSTALL_LIB_DIR R"(%{libdir})"
+#define BOTAN_LIB_LINK "%{link_to}"
+#define BOTAN_LINK_FLAGS "%{cxx_abi_flags}"
+
+%{if system_cert_bundle}
+#define BOTAN_SYSTEM_CERT_BUNDLE "%{system_cert_bundle}"
+%{endif}
+
+#ifndef BOTAN_DLL
+  #define BOTAN_DLL %{visibility_attribute}
+#endif
+
+/* Target identification and feature test macros */
+
+#define BOTAN_TARGET_OS_IS_%{os_name|upper}
+
+%{for os_features}
+#define BOTAN_TARGET_OS_HAS_%{i|upper}
+%{endfor}
+
+#define BOTAN_BUILD_COMPILER_IS_%{cc_macro}
+
+%{for sanitizer_types}
+#define BOTAN_HAS_SANITIZER_%{i|upper}
+%{endfor}
+
+%{if test_mode}
+#define BOTAN_TEST_MODE
+%{endif}
+
+#define BOTAN_TARGET_ARCH_IS_%{arch|upper}
+%{if endian}
+#define BOTAN_TARGET_CPU_IS_%{endian|upper}_ENDIAN
+%{endif}
+%{if cpu_family}
+#define BOTAN_TARGET_CPU_IS_%{cpu_family|upper}_FAMILY
+%{endif}
+%{if cpu_is_64bit}
+#define BOTAN_TARGET_CPU_HAS_NATIVE_64BIT
+%{endif}
+
+%{for cpu_features}
+#define BOTAN_TARGET_SUPPORTS_%{i|upper}
+%{endfor}
+
+%{if with_valgrind}
+#define BOTAN_HAS_VALGRIND
+%{endif}
+
+%{if with_openmp}
+#define BOTAN_TARGET_HAS_OPENMP
+%{endif}
+
+%{if with_debug_asserts}
+#define BOTAN_ENABLE_DEBUG_ASSERTS
+%{endif}
+
+%{if optimize_for_size}
+#define BOTAN_OPTIMIZE_FOR_SIZE
+%{endif}
+
+/*
+* Module availability definitions
+*/
+%{for module_defines}
+#define BOTAN_HAS_%{i}
+%{endfor}
+
+/*
+* Local/misc configuration options (if any) follow
+*/
+%{local_config}
+
+/*
+* Things you can edit (but probably shouldn't)
+*/
+
+#if !defined(BOTAN_DEPRECATED_PUBLIC_MEMBER_VARIABLES)
+
+  #if defined(BOTAN_NO_DEPRECATED)
+     #define BOTAN_DEPRECATED_PUBLIC_MEMBER_VARIABLES private
+  #else
+     #define BOTAN_DEPRECATED_PUBLIC_MEMBER_VARIABLES public
+  #endif
+
+#endif
+
+/* How much to allocate for a buffer of no particular size */
+#define BOTAN_DEFAULT_BUFFER_SIZE 1024
+
+/*
+* Total maximum amount of RAM (in KiB) we will lock into memory, even
+* if the OS would let us lock more
+*/
+#define BOTAN_MLOCK_ALLOCATOR_MAX_LOCKED_KB 512
+
+/*
+* If BOTAN_MEM_POOL_USE_MMU_PROTECTIONS is defined, the Memory_Pool
+* class used for mlock'ed memory will use OS calls to set page
+* permissions so as to prohibit access to pages on the free list, then
+* enable read/write access when the page is set to be used. This will
+* turn (some) use after free bugs into a crash.
+*
+* The additional syscalls have a substantial performance impact, which
+* is why this option is not enabled by default.
+*/
+#if defined(BOTAN_HAS_VALGRIND) || defined(BOTAN_ENABLE_DEBUG_ASSERTS)
+   #define BOTAN_MEM_POOL_USE_MMU_PROTECTIONS
+#endif
+
+/*
+* If enabled uses memset via volatile function pointer to zero memory,
+* otherwise does a byte at a time write via a volatile pointer.
+*/
+#define BOTAN_USE_VOLATILE_MEMSET_FOR_ZERO 1
+
+/*
+* Normally blinding is performed by choosing a random starting point (plus
+* its inverse, of a form appropriate to the algorithm being blinded), and
+* then choosing new blinding operands by successive squaring of both
+* values. This is much faster than computing a new starting point but
+* introduces some possible corelation
+*
+* To avoid possible leakage problems in long-running processes, the blinder
+* periodically reinitializes the sequence. This value specifies how often
+* a new sequence should be started.
+*/
+#define BOTAN_BLINDING_REINIT_INTERVAL 64
+
+/*
+* Userspace RNGs like HMAC_DRBG will reseed after a specified number
+* of outputs are generated. Set to zero to disable automatic reseeding.
+*/
+#define BOTAN_RNG_DEFAULT_RESEED_INTERVAL 1024
+#define BOTAN_RNG_RESEED_POLL_BITS 256
+
+#define BOTAN_RNG_AUTO_RESEED_TIMEOUT std::chrono::milliseconds(10)
+#define BOTAN_RNG_RESEED_DEFAULT_TIMEOUT std::chrono::milliseconds(50)
+
+/*
+* Specifies (in order) the list of entropy sources that will be used
+* to seed an in-memory RNG.
+*/
+#define BOTAN_ENTROPY_DEFAULT_SOURCES \
+   { "rdseed", "hwrng", "p9_darn", "getentropy", "dev_random", \
+     "system_rng", "proc_walk", "system_stats" }
+
+/* Multiplier on a block cipher's native parallelism */
+#define BOTAN_BLOCK_CIPHER_PAR_MULT 4
+
+/*
+* These control the RNG used by the system RNG interface
+*/
+#define BOTAN_SYSTEM_RNG_DEVICE "/dev/urandom"
+#define BOTAN_SYSTEM_RNG_POLL_DEVICES { "/dev/urandom", "/dev/random" }
+
+/*
+* This directory will be monitored by ProcWalking_EntropySource and
+* the contents provided as entropy inputs to the RNG. May also be
+* usefully set to something like "/sys", depending on the system being
+* deployed to. Set to an empty string to disable.
+*/
+#define BOTAN_ENTROPY_PROC_FS_PATH "/proc"
+
+/*
+* These paramaters control how many bytes to read from the system
+* PRNG, and how long to block if applicable. The timeout only applies
+* to reading /dev/urandom and company.
+*/
+#define BOTAN_SYSTEM_RNG_POLL_REQUEST 64
+#define BOTAN_SYSTEM_RNG_POLL_TIMEOUT_MS 20
+
+/*
+* When a PBKDF is self-tuning parameters, it will attempt to take about this
+* amount of time to self-benchmark.
+*/
+#define BOTAN_PBKDF_TUNING_TIME std::chrono::milliseconds(10)
+
+/*
+* If no way of dynamically determining the cache line size for the
+* system exists, this value is used as the default. Used by the side
+* channel countermeasures rather than for alignment purposes, so it is
+* better to be on the smaller side if the exact value cannot be
+* determined. Typically 32 or 64 bytes on modern CPUs.
+*/
+#if !defined(BOTAN_TARGET_CPU_DEFAULT_CACHE_LINE_SIZE)
+  #define BOTAN_TARGET_CPU_DEFAULT_CACHE_LINE_SIZE 32
+#endif
+
+/**
+* Controls how AutoSeeded_RNG is instantiated
+*/
+#if !defined(BOTAN_AUTO_RNG_HMAC)
+
+  #if defined(BOTAN_HAS_SHA2_64)
+    #define BOTAN_AUTO_RNG_HMAC "HMAC(SHA-384)"
+  #elif defined(BOTAN_HAS_SHA2_32)
+    #define BOTAN_AUTO_RNG_HMAC "HMAC(SHA-256)"
+  #elif defined(BOTAN_HAS_SHA3)
+    #define BOTAN_AUTO_RNG_HMAC "HMAC(SHA-3(256))"
+  #elif defined(BOTAN_HAS_SHA1)
+    #define BOTAN_AUTO_RNG_HMAC "HMAC(SHA-1)"
+  #endif
+  /* Otherwise, no hash found: leave BOTAN_AUTO_RNG_HMAC undefined */
+
+#endif
+
+/* Check for a common build problem */
+
+#if defined(BOTAN_TARGET_ARCH_IS_X86_64) && ((defined(_MSC_VER) && !defined(_WIN64)) || \
+                                             (defined(__clang__) && !defined(__x86_64__)) || \
+                                             (defined(__GNUG__) && !defined(__x86_64__)))
+    #error "Trying to compile Botan configured as x86_64 with non-x86_64 compiler."
+#endif
+
+#if defined(BOTAN_TARGET_ARCH_IS_X86_32) && ((defined(_MSC_VER) && defined(_WIN64)) || \
+                                             (defined(__clang__) && !defined(__i386__)) || \
+                                             (defined(__GNUG__) && !defined(__i386__)))
+
+    #error "Trying to compile Botan configured as x86_32 with non-x86_32 compiler."
+#endif
+
+#include <botan/compiler.h>
+
+#endif
diff --git a/third_party/botan/src/build-data/cc/clang.txt b/third_party/botan/src/build-data/cc/clang.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cc/clang.txt
@@ -0,0 +1,82 @@
+macro_name CLANG
+
+binary_name clang++
+
+lang_flags "-std=c++11 -D_REENTRANT"
+
+warning_flags "-Wall -Wextra -Wpedantic -Wshadow -Wstrict-aliasing -Wstrict-overflow=5 -Wcast-align -Wmissing-declarations -Wpointer-arith -Wcast-qual"
+
+werror_flags "-Werror -Wno-error=unused-parameter -Wno-error=unreachable-code -Wno-error=unused-lambda-capture"
+
+maintainer_warning_flags "-Wunreachable-code -Wdocumentation -Qunused-arguments"
+
+optimization_flags "-O3"
+sanitizer_optimization_flags "-O1 -fno-optimize-sibling-calls -fno-omit-frame-pointer"
+size_optimization_flags "-Os"
+
+add_sysroot_option "--sysroot="
+
+<sanitizers>
+default   -> address,undefined
+
+address   -> "-fsanitize=address"
+undefined -> "-fsanitize=undefined -fno-sanitize-recover=undefined"
+coverage  -> "-fsanitize=fuzzer-no-link"
+memory    -> "-fsanitize=memory"
+</sanitizers>
+
+shared_flags "-fPIC"
+coverage_flags "--coverage"
+stack_protector_flags "-fstack-protector"
+
+visibility_build_flags "-fvisibility=hidden"
+visibility_attribute '__attribute__((visibility("default")))'
+
+<so_link_commands>
+macos         -> "$(CXX) -dynamiclib -fPIC -install_name $(INSTALLED_LIB_DIR)/{soname_abi} -current_version {macos_so_current_ver} -compatibility_version {macos_so_compat_ver}"
+
+# The default works for GNU ld and several other Unix linkers
+default       -> "$(CXX) -shared -fPIC -Wl,-soname,{soname_abi}"
+</so_link_commands>
+
+<binary_link_commands>
+default       -> "$(LINKER)"
+llvm          -> "llvm-link"
+emscripten    -> "em++"
+</binary_link_commands>
+
+<isa_flags>
+sse2   -> "-msse2"
+ssse3  -> "-mssse3"
+sse41  -> "-msse4.1"
+sse42  -> "-msse4.2"
+avx2   -> "-mavx2"
+bmi2   -> "-mbmi -mbmi2"
+aesni  -> "-maes -mpclmul"
+rdrand -> "-mrdrnd"
+rdseed -> "-mrdseed"
+sha    -> "-msha"
+altivec -> "-maltivec"
+
+arm64:armv8crypto -> "-march=armv8+crypto"
+
+arm32:neon    -> "-mfpu=neon"
+arm64:neon    -> ""
+</isa_flags>
+
+<cpu_flags>
+llvm    -> "-emit-llvm -fno-use-cxa-atexit"
+</cpu_flags>
+
+<mach_abi_linking>
+all!haiku,llvm -> "-pthread"
+
+openmp  -> "-fopenmp"
+
+x86_32  -> "-m32"
+x86_64  -> "-m64"
+ppc64   -> "-m64"
+
+macos   -> "-stdlib=libc++"
+ios     -> "-stdlib=libc++"
+</mach_abi_linking>
diff --git a/third_party/botan/src/build-data/cc/ekopath.txt b/third_party/botan/src/build-data/cc/ekopath.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cc/ekopath.txt
@@ -0,0 +1,17 @@
+macro_name PATHSCALE
+
+binary_name pathCC
+
+optimization_flags "-O3"
+
+lang_flags "-D_REENTRANT -ansi -Wno-long-long"
+warning_flags "-W -Wall"
+
+ar_command pathCC
+ar_options "-ar -o"
+
+shared_flags "-fPIC"
+
+<so_link_commands>
+default -> "$(CXX) -shared -fPIC -Wl,-soname,{soname_abi}"
+</so_link_commands>
diff --git a/third_party/botan/src/build-data/cc/gcc.txt b/third_party/botan/src/build-data/cc/gcc.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cc/gcc.txt
@@ -0,0 +1,98 @@
+macro_name GCC
+
+binary_name g++
+
+lang_flags "-std=c++11 -D_REENTRANT"
+
+# This should only contain flags which are included in GCC 4.8
+warning_flags "-Wall -Wextra -Wpedantic -Wstrict-aliasing -Wcast-align -Wmissing-declarations -Wpointer-arith -Wcast-qual -Wzero-as-null-pointer-constant -Wnon-virtual-dtor"
+
+# Boost headers have 0 as nullptr and non-virtual-dtor issues so we can't werror on them
+werror_flags "-Werror -Wno-error=strict-overflow -Wno-error=zero-as-null-pointer-constant -Wno-error=non-virtual-dtor"
+
+maintainer_warning_flags "-Wstrict-overflow=5 -Wold-style-cast -Wsuggest-override -Wshadow -Wextra-semi"
+
+optimization_flags "-O3"
+sanitizer_optimization_flags "-O1 -fno-optimize-sibling-calls -fno-omit-frame-pointer"
+size_optimization_flags "-Os"
+
+shared_flags "-fPIC"
+coverage_flags "--coverage"
+stack_protector_flags "-fstack-protector"
+
+add_sysroot_option "--sysroot="
+
+<sanitizers>
+default   -> iterator,address
+
+iterator  -> "-D_GLIBCXX_DEBUG"
+address   -> "-fsanitize=address"
+undefined -> "-fsanitize=undefined -fno-sanitize-recover=undefined"
+</sanitizers>
+
+visibility_build_flags "-fvisibility=hidden"
+visibility_attribute '__attribute__((visibility("default")))'
+
+<so_link_commands>
+# The default works for GNU ld and several other Unix linkers
+default       -> "$(CXX) -shared -fPIC -Wl,-soname,{soname_abi}"
+
+# macOS, HP-UX, and Solaris linkers use different syntax
+macos   -> "$(CXX) -dynamiclib -fPIC -install_name $(INSTALLED_LIB_DIR)/{soname_abi}"
+hpux    -> "$(CXX) -shared -fPIC -Wl,+h,{soname_abi}"
+solaris -> "$(CXX) -shared -fPIC -Wl,-h,{soname_abi}"
+
+# AIX and OpenBSD don't use sonames at all
+aix     -> "$(CXX) -shared -fPIC"
+openbsd -> "$(CXX) -shared -fPIC"
+</so_link_commands>
+
+<binary_link_commands>
+default       -> "$(LINKER)"
+</binary_link_commands>
+
+<isa_flags>
+sse2    -> "-msse2"
+ssse3   -> "-mssse3"
+sse41   -> "-msse4.1"
+sse42   -> "-msse4.2"
+avx2    -> "-mavx2"
+bmi2    -> "-mbmi -mbmi2"
+aesni   -> "-maes -mpclmul"
+rdrand  -> "-mrdrnd"
+rdseed  -> "-mrdseed"
+sha     -> "-msha"
+altivec -> "-maltivec"
+
+powercrypto -> "-mcrypto"
+
+arm64:armv8crypto -> ""
+arm64:armv8sm3 -> "-march=armv8.2-a+sm4"
+arm64:armv8sm4 -> "-march=armv8.2-a+sm4"
+arm64:armv8sha512 -> "-march=armv8.2-a+sha3"
+arm64:armv8sha3 -> "-march=armv8.2-a+sha3"
+
+# For Aarch32 -mfpu=neon is required
+# For Aarch64 NEON is enabled by default
+arm32:neon    -> "-mfpu=neon"
+arm64:neon    -> ""
+</isa_flags>
+
+# Flags set here are included at compile and link time
+<mach_abi_linking>
+all!haiku,qnx,none -> "-pthread"
+
+openmp  -> "-fopenmp"
+
+s390    -> "-m31"
+s390x   -> "-m64"
+sparc32 -> "-m32 -mno-app-regs"
+sparc64 -> "-m64 -mno-app-regs"
+ppc64   -> "-m64"
+x86_32  -> "-m32"
+x86_64  -> "-m64"
+x32     -> "-mx32"
+
+qnx     -> "-fexceptions"
+cygwin  -> "-U__STRICT_ANSI__"
+</mach_abi_linking>
diff --git a/third_party/botan/src/build-data/cc/hpcc.txt b/third_party/botan/src/build-data/cc/hpcc.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cc/hpcc.txt
@@ -0,0 +1,18 @@
+macro_name HP_ACC
+
+binary_name aCC
+
+lang_flags "-AA -ext +eh -z"
+optimization_flags "+O2"
+warning_flags "+w"
+shared_flags "+Z"
+
+<mach_abi_linking>
+hppa1.0 -> "+DAportable"
+hppa1.1 -> "+DA1.1"
+hppa2.0 -> "+DA2.0W"
+</mach_abi_linking>
+
+<so_link_commands>
+default -> "$(CXX) +Z -b -Wl,+h,{soname_abi}" # Documented in cc(1), but not CC(1) (?)
+</so_link_commands>
diff --git a/third_party/botan/src/build-data/cc/icc.txt b/third_party/botan/src/build-data/cc/icc.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cc/icc.txt
@@ -0,0 +1,24 @@
+macro_name INTEL
+
+binary_name icpc
+
+optimization_flags "-O2"
+size_optimization_flags "-Os"
+
+lang_flags "-std=c++11"
+warning_flags "-w1"
+shared_flags "-fPIC"
+
+<isa_flags>
+sse2    -> "-msse2"
+ssse3   -> "-mssse3"
+sse41   -> "-msse4.1"
+sse42   -> "-msse4.2"
+avx2    -> "-march=core-avx2"
+aesni   -> "-march=corei7"
+rdrand  -> "-march=core-avx-i"
+</isa_flags>
+
+<so_link_commands>
+default -> "$(CXX) -fPIC -shared -Wl,-soname,{soname_abi}"
+</so_link_commands>
diff --git a/third_party/botan/src/build-data/cc/msvc.txt b/third_party/botan/src/build-data/cc/msvc.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cc/msvc.txt
@@ -0,0 +1,84 @@
+macro_name MSVC
+
+binary_name cl
+linker_name link
+
+output_to_object "/Fo"
+output_to_exe "/OUT:"
+
+add_include_dir_option "/I"
+add_lib_dir_option "/LIBPATH:"
+add_compile_definition_option "/D"
+add_lib_option "%s.lib"
+
+compile_flags "/nologo /c"
+
+optimization_flags "/O2 /Oi"
+size_optimization_flags "/O1 /Os"
+
+# for debug info in the object file:
+#debug_info_flags "/Z7"
+
+# for using a PDB file:
+debug_info_flags "/Zi /FS"
+
+preproc_flags "/nologo /EP"
+
+lang_flags "/EHs /GR"
+
+# 4250: diamond inheritence warning
+# 4251: STL types used in DLL interface
+# 4275: ???
+# 4127: conditional expression is constant, consider using if constexpr
+warning_flags "/W4 /wd4250 /wd4251 /wd4275 /wd4127"
+
+werror_flags "/WX"
+
+visibility_build_flags "/DBOTAN_DLL=__declspec(dllexport)"
+visibility_attribute "__declspec(dllimport)"
+
+ar_command lib
+ar_options "/nologo"
+ar_output_to "/OUT:"
+
+<sanitizers>
+default -> iterator
+
+iterator -> "/D_ITERATOR_DEBUG_LEVEL=1"
+</sanitizers>
+
+<isa_flags>
+sse2   -> ""
+ssse3  -> ""
+sse41 -> ""
+sse42 -> ""
+x86_64:avx2   -> "/arch:AVX"
+bmi2   -> ""
+aesni  -> ""
+clmul  -> ""
+rdrand -> ""
+rdseed -> ""
+sha    -> ""
+</isa_flags>
+
+<lib_flags>
+debug -> "/Fd%{build_dir}/%{libname}%{lib_suffix}.pdb"
+</lib_flags>
+
+<so_link_commands>
+default       -> "$(LINKER) /DLL"
+default-debug -> "$(LINKER) /DLL /DEBUG"
+</so_link_commands>
+
+<binary_link_commands>
+default       -> "$(LINKER)"
+default-debug -> "$(LINKER) /DEBUG"
+</binary_link_commands>
+
+<mach_abi_linking>
+all              -> "/bigobj"
+
+# These can be overridden with --msvc-runtime option
+rt               -> "/MD"
+rt-debug         -> "/MDd"
+</mach_abi_linking>
diff --git a/third_party/botan/src/build-data/cc/pgi.txt b/third_party/botan/src/build-data/cc/pgi.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cc/pgi.txt
@@ -0,0 +1,15 @@
+macro_name PGI
+
+binary_name pgc++
+
+lang_flags "-std=c++11"
+
+optimization_flags "-O3"
+shared_flags "-fPIC"
+
+visibility_build_flags "-fvisibility=hidden"
+visibility_attribute '__attribute__((visibility("default")))'
+
+<so_link_commands>
+default -> "$(CXX) -shared -fPIC -Wl,-soname,{soname_abi}"
+</so_link_commands>
diff --git a/third_party/botan/src/build-data/cc/sunstudio.txt b/third_party/botan/src/build-data/cc/sunstudio.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cc/sunstudio.txt
@@ -0,0 +1,39 @@
+macro_name SUN_STUDIO
+
+binary_name CC
+
+optimization_flags "-xO2"
+
+shared_flags "-KPIC"
+warning_flags "+w -erroff=truncwarn,wnoretvalue,wlessrestrictedthrow"
+lang_flags "-std=c++11 +p -features=extensions"
+
+ar_command CC
+ar_options "-xar -o"
+
+<so_link_commands>
+default -> "$(CXX) -G -h{soname_abi}"
+</so_link_commands>
+
+<mach_abi_linking>
+# Needed on some Linux distros
+linux      -> "-library=stlport4"
+
+sparc64    -> "-m64 -xarch=sparc"
+x86_64     -> "-m64"
+</mach_abi_linking>
+
+<isa_flags>
+# Botan needs C++11, and that requires Sun Studio 12.4 or above.
+#  Sun Studio 12.4 supports upto -xarch=avx2, but the processor must support it
+#  AESNI requires -xarch=aes, and RDRAND requires -xarch=avx_i.
+#  https://docs.oracle.com/cd/E37069_01/html/E37074/bjapp.html#OSSCGbkazd
+sse2       -> "-xarch=sse2"
+ssse3      -> "-xarch=ssse3"
+sse41      -> "-xarch=sse4.1"
+sse42      -> "-xarch=sse4.2"
+aesni      -> "-xarch=aes"
+avx        -> "-xarch=avx"
+rdrand     -> "-xarch=avx_i"
+avx2       -> "-xarch=avx2"
+</isa_flags>
diff --git a/third_party/botan/src/build-data/cc/xlc.txt b/third_party/botan/src/build-data/cc/xlc.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cc/xlc.txt
@@ -0,0 +1,26 @@
+macro_name XLC
+
+binary_name xlC
+
+optimization_flags "-O2"
+
+lang_flags "-std=c++11"
+
+visibility_build_flags "-fvisibility=hidden"
+visibility_attribute '__attribute__((visibility("default")))'
+
+<isa_flags>
+altivec -> "-qaltivec"
+</isa_flags>
+
+<so_link_commands>
+default -> "$(CXX) -qmkshrobj"
+</so_link_commands>
+
+<sanitizers>
+default   -> address
+
+all       -> "-qcheck=all"
+address   -> "-qcheck=bounds:stackclobber:unset"
+undefined -> "-qcheck=nullptr:divzero"
+</sanitizers>
diff --git a/third_party/botan/src/build-data/cmake.in b/third_party/botan/src/build-data/cmake.in
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/cmake.in
@@ -0,0 +1,73 @@
+cmake_minimum_required(VERSION 2.8.0)
+project(botan)
+
+if(POLICY CMP0042)
+cmake_policy(SET CMP0042 NEW)
+endif()
+
+set(BOTAN_SOURCES
+%{for lib_srcs}
+    "%{i}"
+%{endfor}
+)
+
+set(BOTAN_CLI
+%{for cli_srcs}
+    "%{i}"
+%{endfor}
+)
+
+set(BOTAN_TESTS
+%{for test_srcs}
+    "%{i}"
+%{endfor}
+)
+
+%{for isa_build_info}
+set_source_files_properties("%{src}" PROPERTIES COMPILE_FLAGS "%{isa_flags}")
+%{endfor}
+
+option(ENABLED_OPTIONAL_WARINIGS "If enabled more strict warning policy will be used" OFF)
+option(ENABLED_LTO "If enabled link time optimization will be used" OFF)
+
+set(COMPILER_FEATURES_RELEASE %{cc_lang_flags} %{cc_compile_opt_flags} %{cxx_abi_opt_flags})
+set(COMPILER_FEATURES_DEBUG %{cc_lang_flags} %{cc_compile_debug_flags} %{cxx_abi_debug_flags})
+set(COMPILER_FEATURES $<$<NOT:$<CONFIG:DEBUG>>:${COMPILER_FEATURES_RELEASE}>  $<$<CONFIG:DEBUG>:${COMPILER_FEATURES_DEBUG}>)
+set(SHARED_FEATURES %{cmake_lib_flags})
+set(STATIC_FEATURES -DBOTAN_DLL=)
+set(COMPILER_WARNINGS %{cc_warning_flags})
+set(COMPILER_INCLUDE_DIRS %{compiler_include_dirs})
+if(ENABLED_LTO)
+    set(COMPILER_FEATURES ${COMPILER_FEATURES} -lto)
+endif()
+if(ENABLED_OPTIONAL_WARINIGS)
+    set(COMPILER_OPTIONAL_WARNINGS -Wsign-promo -Wctor-dtor-privacy -Wdeprecated -Winit-self -Wnon-virtual-dtor -Wunused-macros -Wold-style-cast -Wuninitialized)
+endif()
+
+add_library(${PROJECT_NAME} STATIC ${BOTAN_SOURCES})
+target_link_libraries(${PROJECT_NAME} PUBLIC  %{cmake_link_to})
+target_compile_options(${PROJECT_NAME} PUBLIC ${COMPILER_WARNINGS} ${COMPILER_FEATURES} ${COMPILER_OPTIONAL_WARNINGS} PRIVATE ${STATIC_FEATURES})
+target_include_directories(${PROJECT_NAME} PUBLIC ${COMPILER_INCLUDE_DIRS})
+
+set_target_properties(${PROJECT_NAME} PROPERTIES OUTPUT_NAME ${PROJECT_NAME}-static)
+
+add_library(${PROJECT_NAME}_shared SHARED ${BOTAN_SOURCES})
+target_link_libraries(${PROJECT_NAME}_shared PUBLIC  %{cmake_link_to})
+target_compile_options(${PROJECT_NAME}_shared PUBLIC ${COMPILER_WARNINGS} ${COMPILER_FEATURES} ${COMPILER_OPTIONAL_WARNINGS} PRIVATE ${SHARED_FEATURES})
+target_include_directories(${PROJECT_NAME}_shared PUBLIC ${COMPILER_INCLUDE_DIRS})
+set_target_properties(${PROJECT_NAME}_shared PROPERTIES OUTPUT_NAME ${PROJECT_NAME})
+
+add_executable(${PROJECT_NAME}_cli ${BOTAN_CLI})
+target_link_libraries(${PROJECT_NAME}_cli PRIVATE ${PROJECT_NAME}_shared  )
+set_target_properties(${PROJECT_NAME}_cli PROPERTIES OUTPUT_NAME ${PROJECT_NAME}-cli)
+
+add_executable(${PROJECT_NAME}_tests ${BOTAN_TESTS})
+target_link_libraries(${PROJECT_NAME}_tests PRIVATE ${PROJECT_NAME}_shared  )
+set_target_properties(${PROJECT_NAME}_tests PROPERTIES OUTPUT_NAME botan-test)
+
+set(GLOBAL_CONFIGURATION_FILES configure.py .gitignore news.rst readme.rst)
+file(GLOB_RECURSE CONFIGURATION_FILES src/configs/* )
+file(GLOB_RECURSE DOCUMENTATION_FILES doc/* )
+file(GLOB_RECURSE HEADER_FILES src/*.h )
+file(GLOB_RECURSE INFO_FILES src/lib/*info.txt )
+add_custom_target(CONFIGURATION_DUMMY SOURCES ${GLOBAL_CONFIGURATION_FILES} ${CONFIGURATION_FILES} ${DOCUMENTATION_FILES} ${INFO_FILES} ${HEADER_FILES})
diff --git a/third_party/botan/src/build-data/innosetup.in b/third_party/botan/src/build-data/innosetup.in
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/innosetup.in
@@ -0,0 +1,73 @@
+; A script for packaging botan with InnoSetup
+
+[Setup]
+AppName=Botan
+AppVerName=Botan %{version}
+
+AppPublisher=Jack Lloyd
+AppPublisherURL=https://botan.randombit.net/
+AppVersion=%{version}
+
+VersionInfoCopyright=Copyright (C) 1999-2012 Jack Lloyd and others
+VersionInfoVersion=%{version_major}.%{version_minor}.%{version_patch}.0
+
+; Require at least Windows XP
+MinVersion=5.1
+
+ArchitecturesAllowed=%{innosetup_arch}
+ArchitecturesInstallIn64BitMode=%{innosetup_arch}
+
+DefaultDirName={pf}\botan
+DefaultGroupName=botan
+
+SolidCompression=yes
+
+OutputDir=.
+OutputBaseFilename=botan-%{version}-%{arch}
+
+[Types]
+Name: "user"; Description: "User"
+Name: "devel"; Description: "Developer"
+Name: "custom"; Description: "Custom"; Flags: iscustom
+
+[Components]
+name: "dll"; Description: "Runtime DLLs"; Types: user devel custom; Flags: fixed
+name: "implib"; Description: "Import Library"; Types: devel
+name: "includes"; Description: "Include Files"; Types: devel
+name: "docs"; Description: "Developer Documentation"; Types: devel
+
+[Files]
+; DLL and license file is always included
+Source: "..\doc\license.rst"; DestDir: "{app}"; Components: dll; AfterInstall: ConvertLineEndings
+Source: "..\botan.dll"; DestDir: "{app}"; Components: dll
+Source: "..\botan.dll.manifest"; DestDir: "{app}"; Components: dll; Flags: skipifsourcedoesntexist
+
+Source: "include\botan\*"; DestDir: "{app}\include\botan"; Components: includes; AfterInstall: ConvertLineEndings
+
+Source: "..\doc\*.rst"; DestDir: "{app}\doc"; Excludes: "license.rst"; Components: docs; AfterInstall: ConvertLineEndings
+
+Source: "..\doc\examples\*.cpp"; DestDir: "{app}\doc\examples"; Components: docs; AfterInstall: ConvertLineEndings
+
+Source: "..\botan.exp"; DestDir: "{app}"; Components: implib
+Source: "..\botan.lib"; DestDir: "{app}"; Components: implib
+
+[Code]
+const
+   LF = #10;
+   CR = #13;
+   CRLF = CR + LF;
+
+procedure ConvertLineEndings();
+  var
+     FilePath : String;
+     FileContents : String;
+begin
+   FilePath := ExpandConstant(CurrentFileName)
+
+   if ExtractFileName(CurrentFileName) <> 'build.h' then
+   begin
+      LoadStringFromFile(FilePath, FileContents);
+      StringChangeEx(FileContents, LF, CRLF, False);
+      SaveStringToFile(FilePath, FileContents, False);
+   end;
+end;
diff --git a/third_party/botan/src/build-data/makefile.in b/third_party/botan/src/build-data/makefile.in
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/makefile.in
@@ -0,0 +1,146 @@
+
+# This makefile was generated using '%{command_line}'
+
+# Paths to relevant programs
+
+CXX            = %{cxx}
+LINKER         = %{linker}
+AR             = %{ar_command}
+AR_OPTIONS     = %{ar_options}
+PYTHON_EXE     = %{python_exe}
+
+# Compiler Flags
+
+ABI_FLAGS      = %{cc_sysroot} %{cxx_abi_flags}
+LANG_FLAGS     = %{cc_lang_flags} %{os_feature_macros}
+CXXFLAGS       = %{cc_compile_flags} -DBOTAN_IS_BEING_BUILT
+WARN_FLAGS     = %{cc_warning_flags}
+LIB_FLAGS      = %{lib_flags}
+LDFLAGS        = %{ldflags}
+
+EXE_LINK_CMD   = %{exe_link_cmd}
+
+LIB_LINKS_TO   = %{link_to}
+EXE_LINKS_TO   = %{link_to_botan} $(LIB_LINKS_TO)
+
+BUILD_FLAGS    = $(ABI_FLAGS) $(LANG_FLAGS) $(CXXFLAGS) $(WARN_FLAGS)
+
+SCRIPTS_DIR    = %{scripts_dir}
+INSTALLED_LIB_DIR = %{libdir}
+
+# The primary target
+all: %{all_targets}
+
+# Executable targets
+CLI           = %{cli_exe}
+TEST          = %{test_exe}
+LIBRARIES     = %{library_targets}
+
+cli: $(CLI)
+tests: $(TEST)
+libs: $(LIBRARIES)
+docs: %{doc_stamp_file}
+
+# Misc targets
+
+%{if make_supports_phony}
+.PHONY: all cli libs tests check docs clean distclean install
+%{endif}
+
+%{doc_stamp_file}: %{doc_dir}/*.rst %{doc_dir}/api_ref/*.rst %{doc_dir}/dev_ref/*.rst
+	$(PYTHON_EXE) $(SCRIPTS_DIR)/build_docs.py --build-dir="%{build_dir}"
+
+clean:
+	$(PYTHON_EXE) $(SCRIPTS_DIR)/cleanup.py --build-dir="%{build_dir}"
+
+distclean:
+	$(PYTHON_EXE) $(SCRIPTS_DIR)/cleanup.py --build-dir="%{build_dir}" --distclean
+
+install: %{install_targets}
+	$(PYTHON_EXE) $(SCRIPTS_DIR)/install.py --prefix="%{prefix}" --build-dir="%{build_dir}" --bindir=%{bindir} --libdir=%{libdir} --docdir=%{docdir} --includedir=%{includedir}
+
+check: tests
+	$(PYTHON_EXE) $(SCRIPTS_DIR)/check.py --build-dir="%{build_dir}"
+
+# Object Files
+LIBOBJS = %{join lib_objs}
+
+CLIOBJS = %{join cli_objs}
+
+TESTOBJS = %{join test_objs}
+
+# Executable targets
+
+$(CLI): $(LIBRARIES) $(CLIOBJS)
+	$(EXE_LINK_CMD) $(ABI_FLAGS) $(CLIOBJS) $(LDFLAGS) $(EXE_LINKS_TO) %{output_to_exe}$@
+
+$(TEST): $(LIBRARIES) $(TESTOBJS)
+	$(EXE_LINK_CMD) $(ABI_FLAGS) $(TESTOBJS) $(LDFLAGS) $(EXE_LINKS_TO) %{output_to_exe}$@
+
+%{if build_fuzzers}
+
+FUZZERS = %{fuzzer_bin}
+
+fuzzers: $(LIBRARIES) $(FUZZERS)
+
+fuzzer_corpus:
+	git clone --depth=1 https://github.com/randombit/crypto-corpus.git fuzzer_corpus
+
+fuzzer_corpus_zip: fuzzer_corpus
+	./src/scripts/create_corpus_zip.py fuzzer_corpus %{fuzzobj_dir}
+
+%{endif}
+
+%{if build_bogo_shim}
+
+bogo_shim: %{out_dir}/botan_bogo_shim
+
+# BoGo shim
+%{out_dir}/botan_bogo_shim: %{bogo_shim_src} $(LIBRARIES)
+	$(CXX) $(BUILD_FLAGS) %{include_paths} %{bogo_shim_src} $(LDFLAGS) $(EXE_LINKS_TO) %{output_to_exe}$@
+
+%{endif}
+
+# Library targets
+
+%{if build_static_lib}
+
+%{out_dir}/%{static_lib_name}: $(LIBOBJS)
+	$(AR) $(AR_OPTIONS) %{ar_output_to}$@ $(LIBOBJS)
+
+%{endif}
+
+%{if build_shared_lib}
+
+%{out_dir}/%{shared_lib_name}: $(LIBOBJS)
+	%{lib_link_cmd} $(ABI_FLAGS) $(LDFLAGS) $(LIBOBJS) $(LIB_LINKS_TO) %{output_to_exe}$@
+%{endif}
+%{if symlink_shared_lib}
+	cd %{out_dir} && ln -fs %{shared_lib_name} %{soname_base}
+	cd %{out_dir} && ln -fs %{shared_lib_name} %{soname_patch}
+%{endif}
+
+# Build Commands
+
+%{for lib_build_info}
+%{obj}: %{src}
+	$(CXX) $(LIB_FLAGS) $(BUILD_FLAGS) %{isa_flags} %{include_paths} %{dash_c} %{src} %{dash_o}$@
+%{endfor}
+
+%{for cli_build_info}
+%{obj}: %{src}
+	$(CXX) $(BUILD_FLAGS) %{isa_flags} %{include_paths} %{dash_c} %{src} %{dash_o}$@
+%{endfor}
+
+%{for test_build_info}
+%{obj}: %{src}
+	$(CXX) $(BUILD_FLAGS) %{isa_flags} %{include_paths} %{dash_c} %{src} %{dash_o}$@
+%{endfor}
+
+%{for fuzzer_build_info}
+%{obj}: %{src}
+	$(CXX) $(BUILD_FLAGS) %{isa_flags} %{include_paths} %{dash_c} %{src} %{dash_o}$@
+
+%{exe}: %{obj} $(LIBRARIES)
+	$(EXE_LINK_CMD) $(ABI_FLAGS) %{obj} $(EXE_LINKS_TO) %{fuzzer_lib} %{output_to_exe}$@
+%{endfor}
diff --git a/third_party/botan/src/build-data/oids.txt b/third_party/botan/src/build-data/oids.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/oids.txt
@@ -0,0 +1,335 @@
+# Regenerate with ./src/scripts/oids.py oids > src/lib/asn1/oid_maps.cpp
+# AND             ./src/scripts/oids.py dn_ub > src/lib/x509/x509_dn_ub.cpp
+# (if you modified something under [dn]
+# AND             ./src/scripts/oids.py pads > src/lib/pk_pad/padding.cpp
+# (if you modified something under [signature]
+
+# Public key types
+[pubkey]
+1.2.840.113549.1.1.1 = RSA
+2.5.8.1.1 = RSA
+1.2.840.10040.4.1 = DSA
+1.2.840.10046.2.1 = DH
+1.3.6.1.4.1.3029.1.2.1 = ElGamal
+1.3.6.1.4.1.25258.1.3 = McEliece
+1.3.101.110 = Curve25519
+1.3.101.112 = Ed25519
+
+# XMSS
+1.3.6.1.4.1.25258.1.5 = XMSS-draft6
+1.3.6.1.4.1.25258.1.8 = XMSS-draft12
+# draft-vangeest-x509-hash-sigs-03
+0.4.0.127.0.15.1.1.13.0 = XMSS
+
+# X9.62 ecPublicKey, valid for ECDSA and ECDH (RFC 3279 sec 2.3.5)
+1.2.840.10045.2.1 = ECDSA
+1.3.132.1.12 = ECDH
+
+1.2.156.10197.1.301.1 = SM2_Sig
+1.2.156.10197.1.301.1 = SM2
+1.2.156.10197.1.301.2 = SM2_Kex
+1.2.156.10197.1.301.3 = SM2_Enc
+
+# ecgPublicKey (see https://www.teletrust.de/projekte/oid/)
+1.3.36.3.3.2.5.2.1 = ECGDSA
+
+# EC-KCDSA mechanism (Elliptic Curve KCDSA)
+1.0.14888.3.0.5 = ECKCDSA
+
+1.2.643.2.2.19 = GOST-34.10
+1.2.643.7.1.1.1.1 = GOST-34.10-2012-256
+1.2.643.7.1.1.1.2 = GOST-34.10-2012-512
+
+# OpenPGP (RFC4880bis)
+1.3.6.1.4.1.11591.15.1 = OpenPGP.Ed25519
+1.3.6.1.4.1.3029.1.5.1 = OpenPGP.Curve25519
+
+[cipher]
+# Cipher modes
+1.3.14.3.2.7 = DES/CBC
+1.2.840.113549.3.7 = TripleDES/CBC
+1.2.840.113533.7.66.10 = CAST-128/CBC
+2.16.840.1.101.3.4.1.2 = AES-128/CBC
+2.16.840.1.101.3.4.1.22 = AES-192/CBC
+2.16.840.1.101.3.4.1.42 = AES-256/CBC
+1.2.410.200004.1.4 = SEED/CBC
+1.2.156.10197.1.104.2 = SM4/CBC
+
+1.2.840.113549.1.9.16.3.18 = ChaCha20Poly1305
+
+2.16.840.1.101.3.4.1.6 = AES-128/GCM
+2.16.840.1.101.3.4.1.26 = AES-192/GCM
+2.16.840.1.101.3.4.1.46 = AES-256/GCM
+
+2.16.840.1.101.3.4.1.7 = AES-128/CCM
+2.16.840.1.101.3.4.1.27 = AES-192/CCM
+2.16.840.1.101.3.4.1.47 = AES-256/CCM
+
+1.2.392.200011.61.1.1.1.2 = Camellia-128/CBC
+1.2.392.200011.61.1.1.1.3 = Camellia-192/CBC
+1.2.392.200011.61.1.1.1.4 = Camellia-256/CBC
+
+0.3.4401.5.3.1.9.6 = Camellia-128/GCM
+0.3.4401.5.3.1.9.26 = Camellia-192/GCM
+0.3.4401.5.3.1.9.46 = Camellia-256/GCM
+
+1.2.156.10197.1.104.8 = SM4/GCM
+
+1.3.6.1.4.1.25258.3.1 = Serpent/CBC
+1.3.6.1.4.1.25258.3.2 = Threefish-512/CBC
+1.3.6.1.4.1.25258.3.3 = Twofish/CBC
+
+1.3.6.1.4.1.25258.3.101 = Serpent/GCM
+1.3.6.1.4.1.25258.3.102 = Twofish/GCM
+
+1.3.6.1.4.1.25258.3.2.1 = AES-128/OCB
+1.3.6.1.4.1.25258.3.2.2 = AES-192/OCB
+1.3.6.1.4.1.25258.3.2.3 = AES-256/OCB
+1.3.6.1.4.1.25258.3.2.4 = Serpent/OCB
+1.3.6.1.4.1.25258.3.2.5 = Twofish/OCB
+1.3.6.1.4.1.25258.3.2.6 = Camellia-128/OCB
+1.3.6.1.4.1.25258.3.2.7 = Camellia-192/OCB
+1.3.6.1.4.1.25258.3.2.8 = Camellia-256/OCB
+
+1.2.156.10197.1.104.100 = SM4/OCB
+
+1.3.6.1.4.1.25258.3.4.1 = AES-128/SIV
+1.3.6.1.4.1.25258.3.4.2 = AES-192/SIV
+1.3.6.1.4.1.25258.3.4.3 = AES-256/SIV
+1.3.6.1.4.1.25258.3.4.4 = Serpent/SIV
+1.3.6.1.4.1.25258.3.4.5 = Twofish/SIV
+1.3.6.1.4.1.25258.3.4.6 = Camellia-128/SIV
+1.3.6.1.4.1.25258.3.4.7 = Camellia-192/SIV
+1.3.6.1.4.1.25258.3.4.8 = Camellia-256/SIV
+1.3.6.1.4.1.25258.3.4.9 = SM4/SIV
+
+[hash]
+# Hash functions
+1.2.840.113549.2.5 = MD5
+1.3.6.1.4.1.11591.12.2 = Tiger(24,3)
+1.2.156.10197.1.401 = SM3
+1.3.14.3.2.26 = SHA-160
+1.3.36.3.2.1 = RIPEMD-160
+1.2.643.7.1.1.2.2 = Streebog-256
+1.2.643.7.1.1.2.3 = Streebog-512
+
+# From NIST:
+2.16.840.1.101.3.4.2.1 = SHA-256
+2.16.840.1.101.3.4.2.2 = SHA-384
+2.16.840.1.101.3.4.2.3 = SHA-512
+2.16.840.1.101.3.4.2.4 = SHA-224
+2.16.840.1.101.3.4.2.6 = SHA-512-256
+2.16.840.1.101.3.4.2.7 = SHA-3(224)
+2.16.840.1.101.3.4.2.8 = SHA-3(256)
+2.16.840.1.101.3.4.2.9 = SHA-3(384)
+2.16.840.1.101.3.4.2.10 = SHA-3(512)
+2.16.840.1.101.3.4.2.11 = SHAKE-128
+2.16.840.1.101.3.4.2.12 = SHAKE-256
+
+[mac]
+# MACs
+1.2.840.113549.2.7 = HMAC(SHA-160)
+1.2.840.113549.2.8 = HMAC(SHA-224)
+1.2.840.113549.2.9 = HMAC(SHA-256)
+1.2.840.113549.2.10 = HMAC(SHA-384)
+1.2.840.113549.2.11 = HMAC(SHA-512)
+1.2.840.113549.2.13 = HMAC(SHA-512-256)
+
+[keywrap]
+# Keywrap algorithms
+1.2.840.113549.1.9.16.3.6 = KeyWrap.TripleDES
+1.2.840.113533.7.66.15 = KeyWrap.CAST-128
+2.16.840.1.101.3.4.1.5 = KeyWrap.AES-128
+2.16.840.1.101.3.4.1.25 = KeyWrap.AES-192
+2.16.840.1.101.3.4.1.45 = KeyWrap.AES-256
+
+[compression]
+1.2.840.113549.1.9.16.3.8 = Compression.Zlib
+
+# Signature algos
+[signature]
+1.2.840.113549.1.1.4 = RSA/EMSA3(MD5)
+1.2.840.113549.1.1.5 = RSA/EMSA3(SHA-160)
+1.2.840.113549.1.1.8 = MGF1
+1.2.840.113549.1.1.10 = RSA/EMSA4
+1.2.840.113549.1.1.11 = RSA/EMSA3(SHA-256)
+1.2.840.113549.1.1.12 = RSA/EMSA3(SHA-384)
+1.2.840.113549.1.1.13 = RSA/EMSA3(SHA-512)
+1.2.840.113549.1.1.14 = RSA/EMSA3(SHA-224)
+1.2.840.113549.1.1.16 = RSA/EMSA3(SHA-512-256)
+1.3.36.3.3.1.2 = RSA/EMSA3(RIPEMD-160)
+
+1.2.156.10197.1.501 = SM2_Sig/SM3
+1.2.156.10197.1.504 = RSA/EMSA3(SM3)
+
+1.2.840.10040.4.3 = DSA/EMSA1(SHA-160)
+
+2.16.840.1.101.3.4.3.1 = DSA/EMSA1(SHA-224)
+2.16.840.1.101.3.4.3.2 = DSA/EMSA1(SHA-256)
+2.16.840.1.101.3.4.3.3 = DSA/EMSA1(SHA-384)
+2.16.840.1.101.3.4.3.4 = DSA/EMSA1(SHA-512)
+2.16.840.1.101.3.4.3.5 = DSA/EMSA1(SHA-3(224))
+2.16.840.1.101.3.4.3.6 = DSA/EMSA1(SHA-3(256))
+2.16.840.1.101.3.4.3.7 = DSA/EMSA1(SHA-3(384))
+2.16.840.1.101.3.4.3.8 = DSA/EMSA1(SHA-3(512))
+
+2.16.840.1.101.3.4.3.9 = ECDSA/EMSA1(SHA-3(224))
+2.16.840.1.101.3.4.3.10 = ECDSA/EMSA1(SHA-3(256))
+2.16.840.1.101.3.4.3.11 = ECDSA/EMSA1(SHA-3(384))
+2.16.840.1.101.3.4.3.12 = ECDSA/EMSA1(SHA-3(512))
+
+2.16.840.1.101.3.4.3.13 = RSA/EMSA3(SHA-3(224))
+2.16.840.1.101.3.4.3.14 = RSA/EMSA3(SHA-3(256))
+2.16.840.1.101.3.4.3.15 = RSA/EMSA3(SHA-3(384))
+2.16.840.1.101.3.4.3.16 = RSA/EMSA3(SHA-3(512))
+
+1.2.840.10045.4.1 = ECDSA/EMSA1(SHA-160)
+1.2.840.10045.4.3.1 = ECDSA/EMSA1(SHA-224)
+1.2.840.10045.4.3.2 = ECDSA/EMSA1(SHA-256)
+1.2.840.10045.4.3.3 = ECDSA/EMSA1(SHA-384)
+1.2.840.10045.4.3.4 = ECDSA/EMSA1(SHA-512)
+
+1.3.36.3.3.2.5.4.1 = ECGDSA/EMSA1(RIPEMD-160)
+1.3.36.3.3.2.5.4.2 = ECGDSA/EMSA1(SHA-160)
+1.3.36.3.3.2.5.4.3 = ECGDSA/EMSA1(SHA-224)
+1.3.36.3.3.2.5.4.4 = ECGDSA/EMSA1(SHA-256)
+1.3.36.3.3.2.5.4.5 = ECGDSA/EMSA1(SHA-384)
+1.3.36.3.3.2.5.4.6 = ECGDSA/EMSA1(SHA-512)
+
+1.2.410.200004.1.100.4.3 = ECKCDSA/EMSA1(SHA-1)
+1.2.410.200004.1.100.4.4 = ECKCDSA/EMSA1(SHA-224)
+1.2.410.200004.1.100.4.5 = ECKCDSA/EMSA1(SHA-256)
+
+1.2.643.2.2.3 = GOST-34.10/EMSA1(GOST-R-34.11-94)
+
+1.2.643.7.1.1.3.2 = GOST-34.10-2012-256/EMSA1(Streebog-256)
+1.2.643.7.1.1.3.3 = GOST-34.10-2012-512/EMSA1(Streebog-512)
+
+1.3.6.1.4.1.25258.1.6.1 = GOST-34.10-2012-256/EMSA1(SHA-256)
+
+# Encryption algos
+[encryption]
+1.2.840.113549.1.1.7 = RSA/OAEP
+
+# DN with upper bounds from RFC 5280, Appendix A
+[dn]
+2.5.4.3 = X520.CommonName = 64
+2.5.4.4 = X520.Surname = 40
+2.5.4.5 = X520.SerialNumber = 64
+2.5.4.6 = X520.Country = 3
+2.5.4.7 = X520.Locality = 128
+2.5.4.8 = X520.State = 128
+2.5.4.9 = X520.StreetAddress = 128
+2.5.4.10 = X520.Organization = 64
+2.5.4.11 = X520.OrganizationalUnit = 64
+2.5.4.12 = X520.Title = 64
+# the following three types are naming attributes of type "X520name" and inherit its bound
+2.5.4.42 = X520.GivenName = 32768
+2.5.4.43 = X520.Initials = 32768
+2.5.4.44 = X520.GenerationalQualifier = 32768
+2.5.4.46 = X520.DNQualifier = 64
+2.5.4.65 = X520.Pseudonym = 128
+
+[pbe]
+1.2.840.113549.1.5.12 = PKCS5.PBKDF2
+1.2.840.113549.1.5.13 = PBES2
+1.2.840.113549.1.5.13 = PBE-PKCS5v20
+
+1.3.6.1.4.1.11591.4.11 = Scrypt
+
+[pkcs9]
+1.2.840.113549.1.9.1 = PKCS9.EmailAddress
+1.2.840.113549.1.9.2 = PKCS9.UnstructuredName
+1.2.840.113549.1.9.3 = PKCS9.ContentType
+1.2.840.113549.1.9.4 = PKCS9.MessageDigest
+1.2.840.113549.1.9.7 = PKCS9.ChallengePassword
+1.2.840.113549.1.9.14 = PKCS9.ExtensionRequest
+
+[pkix]
+2.5.29.14 = X509v3.SubjectKeyIdentifier
+2.5.29.15 = X509v3.KeyUsage
+2.5.29.16 = X509v3.PrivateKeyUsagePeriod
+2.5.29.17 = X509v3.SubjectAlternativeName
+2.5.29.18 = X509v3.IssuerAlternativeName
+2.5.29.19 = X509v3.BasicConstraints
+2.5.29.20 = X509v3.CRLNumber
+2.5.29.21 = X509v3.ReasonCode
+2.5.29.23 = X509v3.HoldInstructionCode
+2.5.29.24 = X509v3.InvalidityDate
+2.5.29.28 = X509v3.CRLIssuingDistributionPoint
+2.5.29.30 = X509v3.NameConstraints
+2.5.29.31 = X509v3.CRLDistributionPoints
+2.5.29.32 = X509v3.CertificatePolicies
+2.5.29.35 = X509v3.AuthorityKeyIdentifier
+2.5.29.36 = X509v3.PolicyConstraints
+2.5.29.37 = X509v3.ExtendedKeyUsage
+1.3.6.1.5.5.7.1.1 = PKIX.AuthorityInformationAccess
+
+2.5.29.32.0 = X509v3.AnyPolicy
+
+1.2.643.100.111 = GOST.SubjectSigningTool
+1.2.643.100.112 = GOST.IssuerSigningTool
+
+1.2.643.100.1 = GOST.OGRN
+1.2.643.3.131.1.1 = GOST.INN
+
+1.3.6.1.5.5.7.3.1 = PKIX.ServerAuth
+1.3.6.1.5.5.7.3.2 = PKIX.ClientAuth
+1.3.6.1.5.5.7.3.3 = PKIX.CodeSigning
+1.3.6.1.5.5.7.3.4 = PKIX.EmailProtection
+1.3.6.1.5.5.7.3.5 = PKIX.IPsecEndSystem
+1.3.6.1.5.5.7.3.6 = PKIX.IPsecTunnel
+1.3.6.1.5.5.7.3.7 = PKIX.IPsecUser
+1.3.6.1.5.5.7.3.8 = PKIX.TimeStamping
+1.3.6.1.5.5.7.3.9 = PKIX.OCSPSigning
+
+1.3.6.1.5.5.7.8.5 = PKIX.XMPPAddr
+
+1.3.6.1.5.5.7.48.1 = PKIX.OCSP
+1.3.6.1.5.5.7.48.1.1 = PKIX.OCSP.BasicResponse
+1.3.6.1.5.5.7.48.2 = PKIX.CertificateAuthorityIssuers
+
+1.3.6.1.4.1.311.20.2.2 = Microsoft SmartcardLogon
+1.3.6.1.4.1.311.20.2.3 = Microsoft UPN
+
+2.16.840.1.113730.1.13 = Certificate Comment
+
+# ECC param sets
+[ecc_param]
+1.3.132.0.8 = secp160r1
+1.3.132.0.9 = secp160k1
+1.3.132.0.10 = secp256k1
+1.3.132.0.30 = secp160r2
+1.3.132.0.31 = secp192k1
+1.3.132.0.32 = secp224k1
+1.3.132.0.33 = secp224r1
+1.3.132.0.34 = secp384r1
+1.3.132.0.35 = secp521r1
+1.3.6.1.4.1.8301.3.1.2.9.0.38 = secp521r1
+
+1.2.840.10045.3.1.1 = secp192r1
+1.2.840.10045.3.1.2 = x962_p192v2
+1.2.840.10045.3.1.3 = x962_p192v3
+1.2.840.10045.3.1.4 = x962_p239v1
+1.2.840.10045.3.1.5 = x962_p239v2
+1.2.840.10045.3.1.6 = x962_p239v3
+1.2.840.10045.3.1.7 = secp256r1
+
+1.2.156.10197.1.301 = sm2p256v1
+
+1.3.36.3.3.2.8.1.1.1 = brainpool160r1
+1.3.36.3.3.2.8.1.1.3 = brainpool192r1
+1.3.36.3.3.2.8.1.1.5 = brainpool224r1
+1.3.36.3.3.2.8.1.1.7 = brainpool256r1
+1.3.36.3.3.2.8.1.1.9 = brainpool320r1
+1.3.36.3.3.2.8.1.1.11 = brainpool384r1
+1.3.36.3.3.2.8.1.1.13 = brainpool512r1
+
+1.2.250.1.223.101.256.1 = frp256v1
+
+1.2.643.7.1.2.1.1.1 = gost_256A
+1.2.643.7.1.2.1.1.2 = gost_256B
+1.2.643.7.1.2.1.2.1 = gost_512A
+1.2.643.7.1.2.1.2.2 = gost_512B
+1.2.643.2.2.35.1 = gost_256A
+1.2.643.2.2.36.0 = gost_256A
diff --git a/third_party/botan/src/build-data/os/aix.txt b/third_party/botan/src/build-data/os/aix.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/aix.txt
@@ -0,0 +1,18 @@
+
+soname_suffix "so"
+
+use_stack_protector no
+
+<target_features>
+posix1
+posix_mlock
+clock_gettime
+dev_random
+proc_fs
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
diff --git a/third_party/botan/src/build-data/os/android.txt b/third_party/botan/src/build-data/os/android.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/android.txt
@@ -0,0 +1,26 @@
+
+soname_suffix "so"
+
+<target_features>
+posix1
+posix_mlock
+clock_gettime
+
+# arc4random_buf preferably backed-up by Chacha20 rather
+# than RC4. can possibly be disabled by --without-os-feature=arc4random
+arc4random
+dev_random
+
+# getauxval is available in Android NDK for min API 18 and in Crystax NDK
+# for all min API levels. Use --without-os-feature=getauxval to disable
+getauxval
+
+# Added in API 28
+#getentropy
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
diff --git a/third_party/botan/src/build-data/os/cygwin.txt b/third_party/botan/src/build-data/os/cygwin.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/cygwin.txt
@@ -0,0 +1,20 @@
+
+program_suffix .exe
+
+# Cygwin supports shared libs fine, but there are problems with making a Botan
+# shared library when libraries it depends on are static-only (such as libz).
+# So until I can figure out a work-around, it's disabled.
+
+install_root c:\Botan
+doc_dir docs
+
+<target_features>
+posix1
+dev_random
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
diff --git a/third_party/botan/src/build-data/os/dragonfly.txt b/third_party/botan/src/build-data/os/dragonfly.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/dragonfly.txt
@@ -0,0 +1,17 @@
+
+soname_suffix "so"
+
+<target_features>
+posix1
+posix_mlock
+clock_gettime
+proc_fs
+dev_random
+arc4random
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
diff --git a/third_party/botan/src/build-data/os/emscripten.txt b/third_party/botan/src/build-data/os/emscripten.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/emscripten.txt
@@ -0,0 +1,17 @@
+
+obj_suffix bc
+
+static_suffix a
+program_suffix .bc
+
+ar_command emar
+ar_options cr
+
+use_stack_protector no
+
+<target_features>
+atomics
+filesystem
+dev_random
+posix1
+</target_features>
diff --git a/third_party/botan/src/build-data/os/freebsd.txt b/third_party/botan/src/build-data/os/freebsd.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/freebsd.txt
@@ -0,0 +1,22 @@
+
+soname_suffix "so"
+
+default_compiler clang
+
+<target_features>
+posix1
+posix_mlock
+clock_gettime
+dev_random
+arc4random
+explicit_bzero
+cap_enter
+elf_aux_info
+getentropy
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
diff --git a/third_party/botan/src/build-data/os/haiku.txt b/third_party/botan/src/build-data/os/haiku.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/haiku.txt
@@ -0,0 +1,25 @@
+
+soname_suffix "so"
+
+install_root /boot
+header_dir develop/headers
+lib_dir system/lib
+doc_dir system/documentation
+
+use_stack_protector no
+
+<target_features>
+posix1
+clock_gettime
+dev_random
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
+
+<aliases>
+beos
+</aliases>
diff --git a/third_party/botan/src/build-data/os/hpux.txt b/third_party/botan/src/build-data/os/hpux.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/hpux.txt
@@ -0,0 +1,20 @@
+
+# It is "sl" on HP-PA, but HP-UX on PA is EOL
+soname_suffix "so"
+
+<target_features>
+posix1
+posix_mlock
+clock_gettime
+dev_random
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
+
+<aliases>
+hp-ux
+</aliases>
diff --git a/third_party/botan/src/build-data/os/hurd.txt b/third_party/botan/src/build-data/os/hurd.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/hurd.txt
@@ -0,0 +1,19 @@
+
+soname_suffix "so"
+
+<target_features>
+posix1
+posix_mlock
+dev_random
+clock_gettime
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
+
+<aliases>
+gnu
+</aliases>
diff --git a/third_party/botan/src/build-data/os/includeos.txt b/third_party/botan/src/build-data/os/includeos.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/includeos.txt
@@ -0,0 +1,5 @@
+<target_features>
+posix1
+dev_random
+atomics
+</target_features>
diff --git a/third_party/botan/src/build-data/os/ios.txt b/third_party/botan/src/build-data/os/ios.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/ios.txt
@@ -0,0 +1,23 @@
+
+default_compiler clang
+
+uses_pkg_config no
+
+doc_dir doc
+
+<target_features>
+posix1
+posix_mlock
+arc4random
+
+commoncrypto
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
+
+<aliases>
+</aliases>
diff --git a/third_party/botan/src/build-data/os/linux.txt b/third_party/botan/src/build-data/os/linux.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/linux.txt
@@ -0,0 +1,26 @@
+
+soname_suffix "so"
+
+<target_features>
+posix1
+posix_mlock
+
+dev_random
+proc_fs
+clock_gettime
+getauxval
+
+# these are not enabled by default as only available in newer kernel/glibc
+#getrandom
+#getentropy
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
+
+<aliases>
+linux-gnu
+</aliases>
diff --git a/third_party/botan/src/build-data/os/llvm.txt b/third_party/botan/src/build-data/os/llvm.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/llvm.txt
@@ -0,0 +1,15 @@
+
+obj_suffix bc
+
+static_suffix bc
+program_suffix .bc
+
+ar_command llvm-link
+ar_options -o
+
+use_stack_protector no
+
+<target_features>
+filesystem
+atomics
+</target_features>
diff --git a/third_party/botan/src/build-data/os/macos.txt b/third_party/botan/src/build-data/os/macos.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/macos.txt
@@ -0,0 +1,32 @@
+
+default_compiler clang
+
+soname_pattern_base  "lib{libname}.dylib"
+soname_pattern_abi   "lib{libname}.{abi_rev}.dylib"
+soname_pattern_patch "lib{libname}.{abi_rev}.{version_minor}.{version_patch}.dylib"
+
+doc_dir doc
+
+<target_features>
+posix1
+posix_mlock
+arc4random
+getentropy
+dev_random
+clock_gettime
+
+commoncrypto
+apple_keychain
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
+
+<aliases>
+darwin
+macosx
+osx
+</aliases>
diff --git a/third_party/botan/src/build-data/os/mingw.txt b/third_party/botan/src/build-data/os/mingw.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/mingw.txt
@@ -0,0 +1,33 @@
+
+program_suffix .exe
+obj_suffix o
+static_suffix a
+
+install_root /mingw
+header_dir include
+lib_dir lib
+doc_dir share/doc
+
+# see https://sourceforge.net/p/mingw-w64/bugs/755/
+use_stack_protector no
+
+<feature_macros>
+_WIN32_WINNT=0x0600
+</feature_macros>
+
+<aliases>
+msys
+mingw32.*
+</aliases>
+
+<target_features>
+win32
+rtlgenrandom
+virtual_lock
+
+atomics
+threads
+thread_local
+filesystem
+certificate_store
+</target_features>
diff --git a/third_party/botan/src/build-data/os/nacl.txt b/third_party/botan/src/build-data/os/nacl.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/nacl.txt
@@ -0,0 +1,6 @@
+
+
+<target_features>
+threads
+thread_local
+</target_features>
diff --git a/third_party/botan/src/build-data/os/netbsd.txt b/third_party/botan/src/build-data/os/netbsd.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/netbsd.txt
@@ -0,0 +1,21 @@
+
+soname_suffix "so"
+
+<target_features>
+posix1
+posix_mlock
+clock_gettime
+dev_random
+arc4random
+explicit_memset
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
+
+<feature_macros>
+_NETBSD_SOURCE
+</feature_macros>
diff --git a/third_party/botan/src/build-data/os/none.txt b/third_party/botan/src/build-data/os/none.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/none.txt
@@ -0,0 +1,4 @@
+
+<target_features>
+</target_features>
+
diff --git a/third_party/botan/src/build-data/os/openbsd.txt b/third_party/botan/src/build-data/os/openbsd.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/openbsd.txt
@@ -0,0 +1,25 @@
+
+soname_pattern_base  "lib{libname}.so"
+soname_pattern_abi   "lib{libname}.so.{abi_rev}.{version_minor}"
+soname_pattern_patch "lib{libname}.so.{abi_rev}.{version_minor}"
+
+shared_lib_symlinks no
+
+default_compiler clang
+
+<target_features>
+posix1
+posix_mlock
+clock_gettime
+dev_random
+arc4random
+getentropy
+explicit_bzero
+pledge
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
diff --git a/third_party/botan/src/build-data/os/qnx.txt b/third_party/botan/src/build-data/os/qnx.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/qnx.txt
@@ -0,0 +1,18 @@
+soname_suffix "so"
+
+<target_features>
+posix1
+posix_mlock
+clock_gettime
+dev_random
+
+atomics
+sockets
+threads
+thread_local
+filesystem
+</target_features>
+
+<feature_macros>
+_QNX_SOURCE
+</feature_macros>
diff --git a/third_party/botan/src/build-data/os/solaris.txt b/third_party/botan/src/build-data/os/solaris.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/solaris.txt
@@ -0,0 +1,21 @@
+
+soname_suffix "so"
+
+<target_features>
+posix1
+posix_mlock
+clock_gettime
+dev_random
+proc_fs
+
+atomics
+threads
+thread_local
+sockets
+filesystem
+setppriv
+</target_features>
+
+<aliases>
+sunos
+</aliases>
diff --git a/third_party/botan/src/build-data/os/uwp.txt b/third_party/botan/src/build-data/os/uwp.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/uwp.txt
@@ -0,0 +1,25 @@
+
+# ?
+program_suffix .exe
+obj_suffix obj
+static_suffix lib
+
+install_root c:\\Botan
+doc_dir docs
+
+<target_features>
+win32
+winsock2
+crypto_ng
+
+rtlsecurezeromemory
+
+atomics
+threads
+thread_local
+filesystem
+</target_features>
+
+<aliases>
+winphone
+</aliases>
diff --git a/third_party/botan/src/build-data/os/windows.txt b/third_party/botan/src/build-data/os/windows.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/os/windows.txt
@@ -0,0 +1,48 @@
+
+cli_exe_name botan-cli
+
+program_suffix .exe
+obj_suffix obj
+static_suffix lib
+lib_prefix ''
+
+shared_lib_symlinks no
+
+default_compiler msvc
+
+uses_pkg_config no
+
+# For historical reasons? the library does not have the major number on Windows
+# This should probably be fixed in a future major release.
+library_name 'botan{suffix}'
+
+soname_pattern_base "{libname}.dll"
+
+install_root c:\\Botan
+doc_dir docs
+
+<feature_macros>
+_WIN32_WINNT=0x0600
+</feature_macros>
+
+<target_features>
+win32
+winsock2
+
+rtlgenrandom
+rtlsecurezeromemory
+
+virtual_lock
+
+atomics
+threads
+thread_local
+filesystem
+
+certificate_store
+</target_features>
+
+<aliases>
+win32
+MSWin32
+</aliases>
diff --git a/third_party/botan/src/build-data/policy/bsi.txt b/third_party/botan/src/build-data/policy/bsi.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/policy/bsi.txt
@@ -0,0 +1,188 @@
+<required>
+# block
+aes
+
+# modes
+ccm
+gcm
+cbc
+mode_pad
+
+# stream
+ctr
+
+# hash
+sha2_32
+sha2_64
+sha3
+
+# mac
+cmac
+hmac
+gmac
+
+# kdf
+kdf1_iso18033
+sp800_108
+sp800_56c
+
+# pk_pad
+eme_oaep
+emsa_pssr
+emsa1
+iso9796
+
+# pubkey
+dlies
+dh
+rsa
+dsa
+ecdsa
+ecgdsa
+ecies
+eckcdsa
+ecdh
+xmss
+
+# rng
+auto_rng
+hmac_drbg
+</required>
+
+<if_available>
+# block
+aes_ni
+aes_vperm
+aes_armv8
+aes_power8
+
+# modes
+ghash_cpu
+ghash_vperm
+
+# hash
+sha2_32_x86
+sha2_32_armv8
+sha2_32_bmi2
+sha2_64_bmi2
+sha3_bmi2
+
+# entropy sources
+dev_random
+proc_walk
+rdseed
+win32_stats
+
+# rng
+processor_rng
+system_rng
+
+# utils
+http_util # needed by x509 for OCSP online checks
+locking_allocator
+simd
+</if_available>
+
+<prohibited>
+# block
+aria
+blowfish
+camellia
+cascade
+cast128
+cast256
+des
+gost_28147
+idea
+idea_sse2
+kasumi
+lion
+misty1
+noekeon
+noekeon_simd
+seed
+serpent
+serpent_simd
+serpent_avx2
+shacal2
+shacal2_x86
+shacal2_simd
+sm4
+threefish_512
+threefish_512_avx2
+twofish
+xtea
+
+# modes
+chacha20poly1305
+eax
+ocb
+siv
+cfb
+
+# stream
+chacha
+chacha_simd32
+chacha_avx2
+ofb
+rc4
+salsa20
+shake_cipher
+
+# kdf
+hkdf
+kdf1
+kdf2
+prf_x942
+sp800_56a
+
+# pubkey
+cecpq1
+curve25519
+ed25519
+elgamal
+gost_3410
+mce
+mceies
+rfc6979
+newhope
+sm2
+
+# pk_pad
+#eme_pkcs1 // needed for tls
+#emsa_pkcs1 // needed for tls
+emsa_raw
+emsa_x931
+
+# hash
+blake2
+comb4p
+gost_3411
+md4
+md5
+rmd160
+shake
+skein
+#sha1 // needed for x509
+sm3
+streebog
+tiger
+whirlpool
+keccak
+
+# rng
+chacha_rng
+
+# mac
+cbc_mac
+poly1305
+siphash
+x919_mac
+
+# misc
+bcrypt
+
+# tls
+tls_10
+
+</prohibited>
diff --git a/third_party/botan/src/build-data/policy/modern.txt b/third_party/botan/src/build-data/policy/modern.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/policy/modern.txt
@@ -0,0 +1,131 @@
+<required>
+aes
+serpent
+threefish_512
+chacha
+
+sha2_32
+sha2_64
+blake2
+skein
+keccak
+sha3
+
+gcm
+ocb
+chacha20poly1305
+
+kdf2
+hkdf
+cmac
+hmac
+poly1305
+siphash
+
+pbkdf2
+bcrypt
+
+# required for private key encryption
+pbes2
+
+ed25519
+curve25519
+ecdh
+ecdsa
+rsa
+rfc6979
+
+eme_oaep
+emsa_pssr
+emsa1
+
+auto_rng
+hmac_drbg
+</required>
+
+<if_available>
+ffi
+
+tls
+prf_tls
+newhope
+ed25519
+
+ghash_cpu
+ghash_vperm
+
+locking_allocator
+http_util # needed by x509 for OCSP online checks
+
+aes_ni
+aes_vperm
+aes_armv8
+aes_power8
+serpent_simd
+serpent_avx2
+threefish_512_avx2
+chacha_simd32
+chacha_avx2
+
+sha1_sse2
+sha1_x86
+sha1_armv8
+sha2_32_x86
+sha2_32_armv8
+sha2_32_bmi2
+sha2_64_bmi2
+sha3_bmi2
+
+simd
+
+sessions_sql
+certstor_sql
+
+system_rng
+processor_rng
+
+# entropy sources
+dev_random
+proc_walk
+rdseed
+win32_stats
+</if_available>
+
+<prohibited>
+# Just say no to TLS 1.0
+tls_cbc
+
+cast128
+cast256
+des
+gost_28147
+idea
+idea_sse2
+kasumi
+lion
+misty1
+rc4
+seed
+xtea
+
+cbc_mac
+x919_mac
+
+# MD5 and SHA1 are broken but not prohibited. They are widely in use
+# in non-crypto contexts and are required by TLS currently
+md4
+gost_3411
+
+cfb
+ofb
+
+elgamal
+gost_3410
+
+emsa_x931
+pbkdf1
+prf_x942
+
+passhash9
+cryptobox
+</prohibited>
diff --git a/third_party/botan/src/build-data/policy/nist.txt b/third_party/botan/src/build-data/policy/nist.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/policy/nist.txt
@@ -0,0 +1,187 @@
+<required>
+des
+aes
+
+gcm
+ccm
+ctr
+cbc
+mode_pad
+
+# hash
+sha2_32
+sha2_64
+sha3
+
+# mac
+cmac
+hmac
+gmac
+
+# kdf
+sp800_108
+sp800_56a
+sp800_56c
+
+shake
+
+# pk_pad
+eme_oaep
+emsa_pssr
+emsa1
+
+# pubkey
+dh
+rsa
+dsa
+ecdsa
+ecdh
+
+# rng
+auto_rng
+hmac_drbg
+
+# keywrap
+rfc3394
+</required>
+
+<if_available>
+# block
+aes_ni
+aes_vperm
+aes_armv8
+aes_power8
+
+# hash
+sha2_32_x86
+sha2_32_armv8
+sha2_32_bmi2
+sha2_64_bmi2
+sha3_bmi2
+
+# modes
+ghash_cpu
+ghash_vperm
+
+# hash
+sha2_32_x86
+sha2_32_armv8
+
+# entropy sources
+dev_random
+proc_walk
+rdseed
+win32_stats
+
+# rng
+system_rng
+
+# utils
+http_util # needed by x509 for OCSP online checks
+locking_allocator
+simd
+</if_available>
+
+<prohibited>
+# block
+aria
+blowfish
+camellia
+cascade
+cast128
+cast256
+gost_28147
+idea
+idea_sse2
+kasumi
+lion
+misty1
+noekeon
+noekeon_simd
+seed
+serpent
+serpent_simd
+serpent_avx2
+sm4
+shacal2
+shacal2_x86
+shacal2_simd
+threefish_512
+threefish_512_avx2
+twofish
+xtea
+
+# modes
+chacha20poly1305
+eax
+ocb
+siv
+cfb
+
+# stream
+chacha
+chacha_simd32
+chacha_avx2
+shake_cipher
+ofb
+rc4
+salsa20
+
+# kdf
+hkdf
+kdf1
+kdf2
+prf_x942
+
+# pubkey
+curve25519
+ed25519
+ecgdsa
+eckcdsa
+elgamal
+gost_3410
+mce
+mceies
+rfc6979
+newhope
+cecpq1
+xmss
+sm2
+
+# pk_pad
+#eme_pkcs1 // needed for tls
+#emsa_pkcs1 // needed for tls
+emsa_raw
+emsa_x931
+
+# hash
+blake2
+comb4p
+gost_3411
+md5
+md4
+rmd160
+skein
+#sha1 // needed for x509
+sm3
+streebog
+tiger
+whirlpool
+
+# rng
+chacha_rng
+
+# mac
+cbc_mac
+poly1305
+siphash
+x919_mac
+
+# misc
+bcrypt
+
+# tls
+tls_10
+tls_cbc
+
+</prohibited>
diff --git a/third_party/botan/src/build-data/version.txt b/third_party/botan/src/build-data/version.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/build-data/version.txt
@@ -0,0 +1,11 @@
+
+release_major = 2
+release_minor = 17
+release_patch = 0
+release_suffix = ''
+release_so_abi_rev = 17
+
+# These are set by the distribution script
+release_vc_rev = None
+release_datestamp = 0
+release_type = 'unreleased'
diff --git a/third_party/botan/src/lib/asn1/info.txt b/third_party/botan/src/lib/asn1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/asn1/info.txt
@@ -0,0 +1,7 @@
+<defines>
+ASN1 -> 20171109
+</defines>
+
+<requires>
+bigint
+</requires>
diff --git a/third_party/botan/src/lib/base/info.txt b/third_party/botan/src/lib/base/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/base/info.txt
@@ -0,0 +1,17 @@
+<header:public>
+botan.h
+buf_comp.h
+init.h
+key_spec.h
+lookup.h
+secmem.h
+scan_name.h
+sym_algo.h
+symkey.h
+</header:public>
+
+<requires>
+hex
+rng
+utils
+</requires>
diff --git a/third_party/botan/src/lib/block/aes/aes_armv8/info.txt b/third_party/botan/src/lib/block/aes/aes_armv8/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/aes/aes_armv8/info.txt
@@ -0,0 +1,12 @@
+<defines>
+AES_ARMV8 -> 20170903
+</defines>
+
+<isa>
+armv8crypto
+</isa>
+
+<cc>
+gcc:5
+clang:3.8
+</cc>
diff --git a/third_party/botan/src/lib/block/aes/aes_ni/info.txt b/third_party/botan/src/lib/block/aes/aes_ni/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/aes/aes_ni/info.txt
@@ -0,0 +1,9 @@
+<defines>
+AES_NI -> 20131128
+</defines>
+
+<isa>
+sse2
+ssse3
+aesni
+</isa>
diff --git a/third_party/botan/src/lib/block/aes/aes_power8/info.txt b/third_party/botan/src/lib/block/aes/aes_power8/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/aes/aes_power8/info.txt
@@ -0,0 +1,11 @@
+<defines>
+AES_POWER8 -> 20180223
+</defines>
+
+<arch>
+ppc64
+</arch>
+
+<isa>
+powercrypto
+</isa>
diff --git a/third_party/botan/src/lib/block/aes/aes_vperm/info.txt b/third_party/botan/src/lib/block/aes/aes_vperm/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/aes/aes_vperm/info.txt
@@ -0,0 +1,36 @@
+<defines>
+AES_VPERM -> 20190901
+</defines>
+
+endian little
+
+<isa>
+x86_32:sse2
+x86_64:sse2
+x86_32:ssse3
+x86_64:ssse3
+arm32:neon
+arm64:neon
+ppc32:altivec
+ppc64:altivec
+</isa>
+
+<arch>
+x86_32
+x86_64
+arm32
+arm64
+ppc32
+ppc64
+</arch>
+
+<requires>
+simd
+</requires>
+
+<cc>
+gcc
+clang
+msvc:19.10 # VC 2017
+sunstudio
+</cc>
diff --git a/third_party/botan/src/lib/block/aes/info.txt b/third_party/botan/src/lib/block/aes/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/aes/info.txt
@@ -0,0 +1,3 @@
+<defines>
+AES -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/block/aria/info.txt b/third_party/botan/src/lib/block/aria/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/aria/info.txt
@@ -0,0 +1,7 @@
+<defines>
+ARIA -> 20170415
+</defines>
+
+<header:public>
+aria.h
+</header:public>
diff --git a/third_party/botan/src/lib/block/blowfish/info.txt b/third_party/botan/src/lib/block/blowfish/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/blowfish/info.txt
@@ -0,0 +1,3 @@
+<defines>
+BLOWFISH -> 20180718
+</defines>
diff --git a/third_party/botan/src/lib/block/camellia/info.txt b/third_party/botan/src/lib/block/camellia/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/camellia/info.txt
@@ -0,0 +1,7 @@
+<defines>
+CAMELLIA -> 20150922
+</defines>
+
+<header:public>
+camellia.h
+</header:public>
diff --git a/third_party/botan/src/lib/block/cascade/info.txt b/third_party/botan/src/lib/block/cascade/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/cascade/info.txt
@@ -0,0 +1,7 @@
+<defines>
+CASCADE -> 20131128
+</defines>
+
+<header:public>
+cascade.h
+</header:public>
diff --git a/third_party/botan/src/lib/block/cast128/info.txt b/third_party/botan/src/lib/block/cast128/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/cast128/info.txt
@@ -0,0 +1,12 @@
+<defines>
+CAST -> 20131128
+CAST_128 -> 20171203
+</defines>
+
+<header:internal>
+cast_sboxes.h
+</header:internal>
+
+<header:public>
+cast128.h
+</header:public>
diff --git a/third_party/botan/src/lib/block/cast256/info.txt b/third_party/botan/src/lib/block/cast256/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/cast256/info.txt
@@ -0,0 +1,7 @@
+<defines>
+CAST_256 -> 20171203
+</defines>
+
+<requires>
+cast128
+</requires>
diff --git a/third_party/botan/src/lib/block/des/info.txt b/third_party/botan/src/lib/block/des/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/des/info.txt
@@ -0,0 +1,3 @@
+<defines>
+DES -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/block/gost_28147/info.txt b/third_party/botan/src/lib/block/gost_28147/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/gost_28147/info.txt
@@ -0,0 +1,3 @@
+<defines>
+GOST_28147_89 -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/block/idea/idea_sse2/info.txt b/third_party/botan/src/lib/block/idea/idea_sse2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/idea/idea_sse2/info.txt
@@ -0,0 +1,7 @@
+<defines>
+IDEA_SSE2 -> 20131128
+</defines>
+
+<isa>
+sse2
+</isa>
diff --git a/third_party/botan/src/lib/block/idea/info.txt b/third_party/botan/src/lib/block/idea/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/idea/info.txt
@@ -0,0 +1,3 @@
+<defines>
+IDEA -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/block/info.txt b/third_party/botan/src/lib/block/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/info.txt
@@ -0,0 +1,7 @@
+<defines>
+BLOCK_CIPHER -> 20131128
+</defines>
+
+<header:public>
+block_cipher.h
+</header:public>
diff --git a/third_party/botan/src/lib/block/kasumi/info.txt b/third_party/botan/src/lib/block/kasumi/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/kasumi/info.txt
@@ -0,0 +1,3 @@
+<defines>
+KASUMI -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/block/lion/info.txt b/third_party/botan/src/lib/block/lion/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/lion/info.txt
@@ -0,0 +1,8 @@
+<defines>
+LION -> 20131128
+</defines>
+
+<requires>
+stream
+hash
+</requires>
diff --git a/third_party/botan/src/lib/block/misty1/info.txt b/third_party/botan/src/lib/block/misty1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/misty1/info.txt
@@ -0,0 +1,3 @@
+<defines>
+MISTY1 -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/block/noekeon/info.txt b/third_party/botan/src/lib/block/noekeon/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/noekeon/info.txt
@@ -0,0 +1,3 @@
+<defines>
+NOEKEON -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/block/noekeon/noekeon_simd/info.txt b/third_party/botan/src/lib/block/noekeon/noekeon_simd/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/noekeon/noekeon_simd/info.txt
@@ -0,0 +1,8 @@
+<defines>
+NOEKEON_SIMD -> 20160903
+</defines>
+
+<requires>
+noekeon
+simd
+</requires>
diff --git a/third_party/botan/src/lib/block/seed/info.txt b/third_party/botan/src/lib/block/seed/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/seed/info.txt
@@ -0,0 +1,3 @@
+<defines>
+SEED -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/block/serpent/info.txt b/third_party/botan/src/lib/block/serpent/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/serpent/info.txt
@@ -0,0 +1,11 @@
+<defines>
+SERPENT -> 20131128
+</defines>
+
+<header:public>
+serpent.h
+</header:public>
+
+<header:internal>
+serpent_sbox.h
+</header:internal>
diff --git a/third_party/botan/src/lib/block/serpent/serpent_avx2/info.txt b/third_party/botan/src/lib/block/serpent/serpent_avx2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/serpent/serpent_avx2/info.txt
@@ -0,0 +1,17 @@
+<defines>
+SERPENT_AVX2 -> 20180824
+</defines>
+
+<isa>
+avx2
+</isa>
+
+<requires>
+simd_avx2
+</requires>
+
+# We must exclude MSVC due to #2120
+<cc>
+gcc
+clang
+</cc>
diff --git a/third_party/botan/src/lib/block/serpent/serpent_simd/info.txt b/third_party/botan/src/lib/block/serpent/serpent_simd/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/serpent/serpent_simd/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SERPENT_SIMD -> 20160903
+</defines>
+
+<requires>
+simd
+</requires>
diff --git a/third_party/botan/src/lib/block/shacal2/info.txt b/third_party/botan/src/lib/block/shacal2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/shacal2/info.txt
@@ -0,0 +1,5 @@
+<defines>
+SHACAL2 -> 20170813
+</defines>
+
+
diff --git a/third_party/botan/src/lib/block/shacal2/shacal2_avx2/info.txt b/third_party/botan/src/lib/block/shacal2/shacal2_avx2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/shacal2/shacal2_avx2/info.txt
@@ -0,0 +1,11 @@
+<defines>
+SHACAL2_AVX2 -> 20180826
+</defines>
+
+<isa>
+avx2
+</isa>
+
+<requires>
+simd_avx2
+</requires>
diff --git a/third_party/botan/src/lib/block/shacal2/shacal2_simd/info.txt b/third_party/botan/src/lib/block/shacal2/shacal2_simd/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/shacal2/shacal2_simd/info.txt
@@ -0,0 +1,8 @@
+<defines>
+SHACAL2_SIMD -> 20170813
+</defines>
+
+<requires>
+shacal2
+simd
+</requires>
diff --git a/third_party/botan/src/lib/block/shacal2/shacal2_x86/info.txt b/third_party/botan/src/lib/block/shacal2/shacal2_x86/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/shacal2/shacal2_x86/info.txt
@@ -0,0 +1,20 @@
+<defines>
+SHACAL2_X86 -> 20170814
+</defines>
+
+<requires>
+shacal2
+</requires>
+
+<isa>
+sha
+sse2
+ssse3
+</isa>
+
+<cc>
+gcc:5.0
+clang:3.9
+msvc:19.0 # MSVS 2015
+</cc>
+
diff --git a/third_party/botan/src/lib/block/sm4/info.txt b/third_party/botan/src/lib/block/sm4/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/sm4/info.txt
@@ -0,0 +1,3 @@
+<defines>
+SM4 -> 20170716
+</defines>
diff --git a/third_party/botan/src/lib/block/sm4/sm4_armv8/info.txt b/third_party/botan/src/lib/block/sm4/sm4_armv8/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/sm4/sm4_armv8/info.txt
@@ -0,0 +1,11 @@
+<defines>
+SM4_ARMV8 -> 20180709
+</defines>
+
+<isa>
+armv8sm4
+</isa>
+
+<cc>
+gcc:8
+</cc>
diff --git a/third_party/botan/src/lib/block/threefish_512/info.txt b/third_party/botan/src/lib/block/threefish_512/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/threefish_512/info.txt
@@ -0,0 +1,3 @@
+<defines>
+THREEFISH_512 -> 20131224
+</defines>
diff --git a/third_party/botan/src/lib/block/threefish_512/threefish_512_avx2/info.txt b/third_party/botan/src/lib/block/threefish_512/threefish_512_avx2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/threefish_512/threefish_512_avx2/info.txt
@@ -0,0 +1,14 @@
+<defines>
+THREEFISH_512_AVX2 -> 20160903
+</defines>
+
+<isa>
+avx2
+</isa>
+
+<cc>
+gcc
+clang
+msvc
+icc
+</cc>
diff --git a/third_party/botan/src/lib/block/twofish/info.txt b/third_party/botan/src/lib/block/twofish/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/twofish/info.txt
@@ -0,0 +1,3 @@
+<defines>
+TWOFISH -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/block/xtea/info.txt b/third_party/botan/src/lib/block/xtea/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/block/xtea/info.txt
@@ -0,0 +1,3 @@
+<defines>
+XTEA -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/codec/base32/info.txt b/third_party/botan/src/lib/codec/base32/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/codec/base32/info.txt
@@ -0,0 +1,3 @@
+<defines>
+BASE32_CODEC -> 20180418
+</defines>
diff --git a/third_party/botan/src/lib/codec/base58/info.txt b/third_party/botan/src/lib/codec/base58/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/codec/base58/info.txt
@@ -0,0 +1,8 @@
+<defines>
+BASE58_CODEC -> 20181209
+</defines>
+
+<requires>
+sha2_32
+bigint
+</requires>
diff --git a/third_party/botan/src/lib/codec/base64/info.txt b/third_party/botan/src/lib/codec/base64/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/codec/base64/info.txt
@@ -0,0 +1,3 @@
+<defines>
+BASE64_CODEC -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/codec/hex/info.txt b/third_party/botan/src/lib/codec/hex/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/codec/hex/info.txt
@@ -0,0 +1,3 @@
+<defines>
+HEX_CODEC -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/compat/sodium/info.txt b/third_party/botan/src/lib/compat/sodium/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/compat/sodium/info.txt
@@ -0,0 +1,17 @@
+<defines>
+SODIUM_API -> 20190615
+</defines>
+
+<requires>
+chacha
+salsa20
+poly1305
+chacha20poly1305
+curve25519
+ed25519
+sha2_32
+sha2_64
+hmac
+siphash
+system_rng
+</requires>
diff --git a/third_party/botan/src/lib/compression/bzip2/info.txt b/third_party/botan/src/lib/compression/bzip2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/compression/bzip2/info.txt
@@ -0,0 +1,9 @@
+<defines>
+BZIP2 -> 20160412
+</defines>
+
+load_on vendor
+
+<libs>
+all -> bz2
+</libs>
diff --git a/third_party/botan/src/lib/compression/info.txt b/third_party/botan/src/lib/compression/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/compression/info.txt
@@ -0,0 +1,11 @@
+<defines>
+COMPRESSION -> 20141117
+</defines>
+
+<header:internal>
+compress_utils.h
+</header:internal>
+
+<header:public>
+compression.h
+</header:public>
diff --git a/third_party/botan/src/lib/compression/lzma/info.txt b/third_party/botan/src/lib/compression/lzma/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/compression/lzma/info.txt
@@ -0,0 +1,9 @@
+<defines>
+LZMA -> 20160412
+</defines>
+
+load_on vendor
+
+<libs>
+all -> lzma
+</libs>
diff --git a/third_party/botan/src/lib/compression/zlib/info.txt b/third_party/botan/src/lib/compression/zlib/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/compression/zlib/info.txt
@@ -0,0 +1,10 @@
+<defines>
+ZLIB -> 20160412
+</defines>
+
+load_on vendor
+
+<libs>
+all!windows -> z
+windows -> zlib
+</libs>
diff --git a/third_party/botan/src/lib/entropy/dev_random/info.txt b/third_party/botan/src/lib/entropy/dev_random/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/entropy/dev_random/info.txt
@@ -0,0 +1,11 @@
+<defines>
+ENTROPY_SRC_DEV_RANDOM -> 20131128
+</defines>
+
+<header:internal>
+dev_random.h
+</header:internal>
+
+<os_features>
+dev_random,posix1
+</os_features>
diff --git a/third_party/botan/src/lib/entropy/getentropy/info.txt b/third_party/botan/src/lib/entropy/getentropy/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/entropy/getentropy/info.txt
@@ -0,0 +1,11 @@
+<defines>
+ENTROPY_SRC_GETENTROPY -> 20170327
+</defines>
+
+<header:internal>
+getentropy.h
+</header:internal>
+
+<os_features>
+getentropy
+</os_features>
diff --git a/third_party/botan/src/lib/entropy/info.txt b/third_party/botan/src/lib/entropy/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/entropy/info.txt
@@ -0,0 +1,7 @@
+<defines>
+ENTROPY_SOURCE -> 20151120
+</defines>
+
+<requires>
+rng
+</requires>
diff --git a/third_party/botan/src/lib/entropy/proc_walk/info.txt b/third_party/botan/src/lib/entropy/proc_walk/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/entropy/proc_walk/info.txt
@@ -0,0 +1,11 @@
+<defines>
+ENTROPY_SRC_PROC_WALKER -> 20131128
+</defines>
+
+<header:internal>
+proc_walk.h
+</header:internal>
+
+<os_features>
+posix1,proc_fs
+</os_features>
diff --git a/third_party/botan/src/lib/entropy/rdseed/info.txt b/third_party/botan/src/lib/entropy/rdseed/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/entropy/rdseed/info.txt
@@ -0,0 +1,19 @@
+<defines>
+ENTROPY_SRC_RDSEED -> 20151218
+</defines>
+
+<isa>
+rdseed
+sse2 # for mm_pause see #2139
+</isa>
+
+<header:internal>
+rdseed.h
+</header:internal>
+
+<cc>
+gcc
+clang
+icc
+msvc
+</cc>
diff --git a/third_party/botan/src/lib/entropy/win32_stats/info.txt b/third_party/botan/src/lib/entropy/win32_stats/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/entropy/win32_stats/info.txt
@@ -0,0 +1,15 @@
+<defines>
+ENTROPY_SRC_WIN32 -> 20200209
+</defines>
+
+<header:internal>
+es_win32.h
+</header:internal>
+
+<os_features>
+win32
+</os_features>
+
+<libs>
+windows -> user32
+</libs>
diff --git a/third_party/botan/src/lib/ffi/info.txt b/third_party/botan/src/lib/ffi/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/ffi/info.txt
@@ -0,0 +1,31 @@
+<defines>
+FFI -> 20191214
+</defines>
+
+<header:internal>
+ffi_mp.h
+ffi_pkey.h
+ffi_rng.h
+ffi_util.h
+</header:internal>
+
+<header:public>
+ffi.h
+</header:public>
+
+<requires>
+block
+stream
+hash
+aead
+kdf
+pbkdf
+pubkey
+pem
+bigint
+sha2_32
+#x509
+#tls
+system_rng
+auto_rng
+</requires>
diff --git a/third_party/botan/src/lib/filters/fd_unix/info.txt b/third_party/botan/src/lib/filters/fd_unix/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/filters/fd_unix/info.txt
@@ -0,0 +1,7 @@
+<defines>
+PIPE_UNIXFD_IO -> 20131128
+</defines>
+
+<os_features>
+posix1
+</os_features>
diff --git a/third_party/botan/src/lib/filters/info.txt b/third_party/botan/src/lib/filters/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/filters/info.txt
@@ -0,0 +1,31 @@
+<defines>
+FILTERS -> 20160415
+CODEC_FILTERS -> 20131128
+</defines>
+
+<header:public>
+basefilt.h
+comp_filter.h
+cipher_filter.h
+buf_filt.h
+key_filt.h
+
+b64_filt.h
+hex_filt.h
+
+secqueue.h
+
+data_snk.h
+filter.h
+filters.h
+pipe.h
+</header:public>
+
+<header:internal>
+out_buf.h
+</header:internal>
+
+<requires>
+modes
+base64
+</requires>
diff --git a/third_party/botan/src/lib/hash/blake2/info.txt b/third_party/botan/src/lib/hash/blake2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/blake2/info.txt
@@ -0,0 +1,3 @@
+<defines>
+BLAKE2B -> 20130131
+</defines>
diff --git a/third_party/botan/src/lib/hash/checksum/adler32/info.txt b/third_party/botan/src/lib/hash/checksum/adler32/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/checksum/adler32/info.txt
@@ -0,0 +1,3 @@
+<defines>
+ADLER32 -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/hash/checksum/crc24/info.txt b/third_party/botan/src/lib/hash/checksum/crc24/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/checksum/crc24/info.txt
@@ -0,0 +1,3 @@
+<defines>
+CRC24 -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/hash/checksum/crc32/info.txt b/third_party/botan/src/lib/hash/checksum/crc32/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/checksum/crc32/info.txt
@@ -0,0 +1,3 @@
+<defines>
+CRC32 -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/hash/checksum/info.txt b/third_party/botan/src/lib/hash/checksum/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/checksum/info.txt
@@ -0,0 +1,4 @@
+
+<requires>
+hash
+</requires>
diff --git a/third_party/botan/src/lib/hash/comb4p/info.txt b/third_party/botan/src/lib/hash/comb4p/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/comb4p/info.txt
@@ -0,0 +1,3 @@
+<defines>
+COMB4P -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/hash/gost_3411/info.txt b/third_party/botan/src/lib/hash/gost_3411/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/gost_3411/info.txt
@@ -0,0 +1,7 @@
+<defines>
+GOST_34_11 -> 20131128
+</defines>
+
+<requires>
+gost_28147
+</requires>
diff --git a/third_party/botan/src/lib/hash/info.txt b/third_party/botan/src/lib/hash/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/info.txt
@@ -0,0 +1,7 @@
+<defines>
+HASH -> 20180112
+</defines>
+
+<header:public>
+hash.h
+</header:public>
diff --git a/third_party/botan/src/lib/hash/keccak/info.txt b/third_party/botan/src/lib/hash/keccak/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/keccak/info.txt
@@ -0,0 +1,7 @@
+<defines>
+KECCAK -> 20131128
+</defines>
+
+<requires>
+sha3
+</requires>
diff --git a/third_party/botan/src/lib/hash/md4/info.txt b/third_party/botan/src/lib/hash/md4/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/md4/info.txt
@@ -0,0 +1,7 @@
+<defines>
+MD4 -> 20131128
+</defines>
+
+<requires>
+mdx_hash
+</requires>
diff --git a/third_party/botan/src/lib/hash/md5/info.txt b/third_party/botan/src/lib/hash/md5/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/md5/info.txt
@@ -0,0 +1,7 @@
+<defines>
+MD5 -> 20131128
+</defines>
+
+<requires>
+mdx_hash
+</requires>
diff --git a/third_party/botan/src/lib/hash/mdx_hash/info.txt b/third_party/botan/src/lib/hash/mdx_hash/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/mdx_hash/info.txt
@@ -0,0 +1,5 @@
+<defines>
+MDX_HASH_FUNCTION -> 20131128
+</defines>
+
+load_on dep
diff --git a/third_party/botan/src/lib/hash/par_hash/info.txt b/third_party/botan/src/lib/hash/par_hash/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/par_hash/info.txt
@@ -0,0 +1,3 @@
+<defines>
+PARALLEL_HASH -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/hash/rmd160/info.txt b/third_party/botan/src/lib/hash/rmd160/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/rmd160/info.txt
@@ -0,0 +1,7 @@
+<defines>
+RIPEMD_160 -> 20131128
+</defines>
+
+<requires>
+mdx_hash
+</requires>
diff --git a/third_party/botan/src/lib/hash/sha1/info.txt b/third_party/botan/src/lib/hash/sha1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha1/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SHA1 -> 20131128
+</defines>
+
+<requires>
+mdx_hash
+</requires>
diff --git a/third_party/botan/src/lib/hash/sha1/sha1_armv8/info.txt b/third_party/botan/src/lib/hash/sha1/sha1_armv8/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha1/sha1_armv8/info.txt
@@ -0,0 +1,12 @@
+<defines>
+SHA1_ARMV8 -> 20170117
+</defines>
+
+<isa>
+armv8crypto
+</isa>
+
+<cc>
+gcc:4.9
+clang:3.8
+</cc>
diff --git a/third_party/botan/src/lib/hash/sha1/sha1_sse2/info.txt b/third_party/botan/src/lib/hash/sha1/sha1_sse2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha1/sha1_sse2/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SHA1_SSE2 -> 20160803
+</defines>
+
+<isa>
+sse2
+</isa>
diff --git a/third_party/botan/src/lib/hash/sha1/sha1_x86/info.txt b/third_party/botan/src/lib/hash/sha1/sha1_x86/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha1/sha1_x86/info.txt
@@ -0,0 +1,16 @@
+<defines>
+SHA1_X86_SHA_NI -> 20170518
+</defines>
+
+<isa>
+sha
+sse2
+ssse3
+sse41
+</isa>
+
+<cc>
+clang:3.9
+gcc:5.0
+msvc:19.0 # MSVS 2015
+</cc>
diff --git a/third_party/botan/src/lib/hash/sha2_32/info.txt b/third_party/botan/src/lib/hash/sha2_32/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha2_32/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SHA2_32 -> 20131128
+</defines>
+
+<requires>
+mdx_hash
+</requires>
diff --git a/third_party/botan/src/lib/hash/sha2_32/sha2_32_armv8/info.txt b/third_party/botan/src/lib/hash/sha2_32/sha2_32_armv8/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha2_32/sha2_32_armv8/info.txt
@@ -0,0 +1,12 @@
+<defines>
+SHA2_32_ARMV8 -> 20170117
+</defines>
+
+<isa>
+armv8crypto
+</isa>
+
+<cc>
+gcc:4.9
+clang:3.8
+</cc>
diff --git a/third_party/botan/src/lib/hash/sha2_32/sha2_32_bmi2/info.txt b/third_party/botan/src/lib/hash/sha2_32/sha2_32_bmi2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha2_32/sha2_32_bmi2/info.txt
@@ -0,0 +1,12 @@
+<defines>
+SHA2_32_X86_BMI2 -> 20180526
+</defines>
+
+<isa>
+bmi2
+</isa>
+
+<cc>
+gcc
+clang
+</cc>
diff --git a/third_party/botan/src/lib/hash/sha2_32/sha2_32_x86/info.txt b/third_party/botan/src/lib/hash/sha2_32/sha2_32_x86/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha2_32/sha2_32_x86/info.txt
@@ -0,0 +1,16 @@
+<defines>
+SHA2_32_X86 -> 20170518
+</defines>
+
+<isa>
+sha
+sse2
+ssse3
+sse41
+</isa>
+
+<cc>
+gcc:5.0
+clang:3.9
+msvc:19.0 # MSVS 2015
+</cc>
diff --git a/third_party/botan/src/lib/hash/sha2_64/info.txt b/third_party/botan/src/lib/hash/sha2_64/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha2_64/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SHA2_64 -> 20131128
+</defines>
+
+<requires>
+mdx_hash
+</requires>
diff --git a/third_party/botan/src/lib/hash/sha2_64/sha2_64_bmi2/info.txt b/third_party/botan/src/lib/hash/sha2_64/sha2_64_bmi2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha2_64/sha2_64_bmi2/info.txt
@@ -0,0 +1,17 @@
+<defines>
+SHA2_64_BMI2 -> 20190117
+</defines>
+
+<isa>
+bmi2
+</isa>
+
+# Needs 64-bit registers to be useful
+<arch>
+x86_64
+</arch>
+
+<cc>
+gcc
+clang
+</cc>
diff --git a/third_party/botan/src/lib/hash/sha3/info.txt b/third_party/botan/src/lib/hash/sha3/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha3/info.txt
@@ -0,0 +1,3 @@
+<defines>
+SHA3 -> 20161018
+</defines>
diff --git a/third_party/botan/src/lib/hash/sha3/sha3_bmi2/info.txt b/third_party/botan/src/lib/hash/sha3/sha3_bmi2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sha3/sha3_bmi2/info.txt
@@ -0,0 +1,17 @@
+<defines>
+SHA3_BMI2 -> 20190117
+</defines>
+
+<isa>
+bmi2
+</isa>
+
+# Needs 64-bit registers to be useful
+<arch>
+x86_64
+</arch>
+
+<cc>
+gcc
+clang
+</cc>
diff --git a/third_party/botan/src/lib/hash/shake/info.txt b/third_party/botan/src/lib/hash/shake/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/shake/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SHAKE -> 20161009
+</defines>
+
+<requires>
+sha3
+</requires>
diff --git a/third_party/botan/src/lib/hash/skein/info.txt b/third_party/botan/src/lib/hash/skein/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/skein/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SKEIN_512 -> 20131128
+</defines>
+
+<requires>
+threefish_512
+</requires>
diff --git a/third_party/botan/src/lib/hash/sm3/info.txt b/third_party/botan/src/lib/hash/sm3/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/sm3/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SM3 -> 20170402
+</defines>
+
+<requires>
+mdx_hash
+</requires>
diff --git a/third_party/botan/src/lib/hash/streebog/info.txt b/third_party/botan/src/lib/hash/streebog/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/streebog/info.txt
@@ -0,0 +1,3 @@
+<defines>
+STREEBOG -> 20170623
+</defines>
diff --git a/third_party/botan/src/lib/hash/tiger/info.txt b/third_party/botan/src/lib/hash/tiger/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/tiger/info.txt
@@ -0,0 +1,7 @@
+<defines>
+TIGER -> 20131128
+</defines>
+
+<requires>
+mdx_hash
+</requires>
diff --git a/third_party/botan/src/lib/hash/whirlpool/info.txt b/third_party/botan/src/lib/hash/whirlpool/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/hash/whirlpool/info.txt
@@ -0,0 +1,7 @@
+<defines>
+WHIRLPOOL -> 20131128
+</defines>
+
+<requires>
+mdx_hash
+</requires>
diff --git a/third_party/botan/src/lib/kdf/hkdf/info.txt b/third_party/botan/src/lib/kdf/hkdf/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/hkdf/info.txt
@@ -0,0 +1,7 @@
+<defines>
+HKDF -> 20170927
+</defines>
+
+<requires>
+hmac
+</requires>
diff --git a/third_party/botan/src/lib/kdf/info.txt b/third_party/botan/src/lib/kdf/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/info.txt
@@ -0,0 +1,12 @@
+<defines>
+KDF_BASE -> 20131128
+</defines>
+
+<requires>
+mac
+hash
+</requires>
+
+<header:public>
+kdf.h
+</header:public>
diff --git a/third_party/botan/src/lib/kdf/kdf1/info.txt b/third_party/botan/src/lib/kdf/kdf1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/kdf1/info.txt
@@ -0,0 +1,7 @@
+<defines>
+KDF1 -> 20131128
+</defines>
+
+<requires>
+hash
+</requires>
diff --git a/third_party/botan/src/lib/kdf/kdf1_iso18033/info.txt b/third_party/botan/src/lib/kdf/kdf1_iso18033/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/kdf1_iso18033/info.txt
@@ -0,0 +1,7 @@
+<defines>
+KDF1_18033 -> 20160128
+</defines>
+
+<requires>
+hash
+</requires>
diff --git a/third_party/botan/src/lib/kdf/kdf2/info.txt b/third_party/botan/src/lib/kdf/kdf2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/kdf2/info.txt
@@ -0,0 +1,7 @@
+<defines>
+KDF2 -> 20131128
+</defines>
+
+<requires>
+hash
+</requires>
diff --git a/third_party/botan/src/lib/kdf/prf_tls/info.txt b/third_party/botan/src/lib/kdf/prf_tls/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/prf_tls/info.txt
@@ -0,0 +1,8 @@
+<defines>
+TLS_V10_PRF -> 20131128
+TLS_V12_PRF -> 20131128
+</defines>
+
+<requires>
+hmac
+</requires>
diff --git a/third_party/botan/src/lib/kdf/prf_x942/info.txt b/third_party/botan/src/lib/kdf/prf_x942/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/prf_x942/info.txt
@@ -0,0 +1,8 @@
+<defines>
+X942_PRF -> 20131128
+</defines>
+
+<requires>
+asn1
+sha1
+</requires>
diff --git a/third_party/botan/src/lib/kdf/sp800_108/info.txt b/third_party/botan/src/lib/kdf/sp800_108/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/sp800_108/info.txt
@@ -0,0 +1,8 @@
+<defines>
+SP800_108 -> 20160128
+</defines>
+
+<requires>
+mac
+hmac
+</requires>
diff --git a/third_party/botan/src/lib/kdf/sp800_56a/info.txt b/third_party/botan/src/lib/kdf/sp800_56a/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/sp800_56a/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SP800_56A -> 20170501
+</defines>
+
+<requires>
+hmac
+</requires>
diff --git a/third_party/botan/src/lib/kdf/sp800_56c/info.txt b/third_party/botan/src/lib/kdf/sp800_56c/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/kdf/sp800_56c/info.txt
@@ -0,0 +1,8 @@
+<defines>
+SP800_56C -> 20160211
+</defines>
+
+<requires>
+sp800_108
+hmac
+</requires>
diff --git a/third_party/botan/src/lib/mac/cbc_mac/info.txt b/third_party/botan/src/lib/mac/cbc_mac/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/mac/cbc_mac/info.txt
@@ -0,0 +1,7 @@
+<defines>
+CBC_MAC -> 20131128
+</defines>
+
+<requires>
+block
+</requires>
diff --git a/third_party/botan/src/lib/mac/cmac/info.txt b/third_party/botan/src/lib/mac/cmac/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/mac/cmac/info.txt
@@ -0,0 +1,8 @@
+<defines>
+CMAC -> 20131128
+</defines>
+
+<requires>
+block
+poly_dbl
+</requires>
diff --git a/third_party/botan/src/lib/mac/gmac/info.txt b/third_party/botan/src/lib/mac/gmac/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/mac/gmac/info.txt
@@ -0,0 +1,8 @@
+<defines>
+GMAC -> 20160207
+</defines>
+
+<requires>
+ghash
+block
+</requires>
diff --git a/third_party/botan/src/lib/mac/hmac/info.txt b/third_party/botan/src/lib/mac/hmac/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/mac/hmac/info.txt
@@ -0,0 +1,7 @@
+<defines>
+HMAC -> 20131128
+</defines>
+
+<requires>
+hash
+</requires>
diff --git a/third_party/botan/src/lib/mac/info.txt b/third_party/botan/src/lib/mac/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/mac/info.txt
@@ -0,0 +1,7 @@
+<defines>
+MAC -> 20150626
+</defines>
+
+<header:public>
+mac.h
+</header:public>
diff --git a/third_party/botan/src/lib/mac/poly1305/info.txt b/third_party/botan/src/lib/mac/poly1305/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/mac/poly1305/info.txt
@@ -0,0 +1,7 @@
+<defines>
+POLY1305 -> 20141227
+</defines>
+
+<header:public>
+poly1305.h
+</header:public>
diff --git a/third_party/botan/src/lib/mac/siphash/info.txt b/third_party/botan/src/lib/mac/siphash/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/mac/siphash/info.txt
@@ -0,0 +1,3 @@
+<defines>
+SIPHASH -> 20150110
+</defines>
diff --git a/third_party/botan/src/lib/mac/x919_mac/info.txt b/third_party/botan/src/lib/mac/x919_mac/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/mac/x919_mac/info.txt
@@ -0,0 +1,7 @@
+<defines>
+ANSI_X919_MAC -> 20131128
+</defines>
+
+<requires>
+des
+</requires>
diff --git a/third_party/botan/src/lib/math/bigint/info.txt b/third_party/botan/src/lib/math/bigint/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/math/bigint/info.txt
@@ -0,0 +1,14 @@
+<defines>
+BIGINT -> 20131128
+</defines>
+
+<header:public>
+bigint.h
+divide.h
+</header:public>
+
+<requires>
+mp
+hex
+rng
+</requires>
diff --git a/third_party/botan/src/lib/math/mp/info.txt b/third_party/botan/src/lib/math/mp/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/math/mp/info.txt
@@ -0,0 +1,10 @@
+<defines>
+BIGINT_MP -> 20151225
+</defines>
+
+<header:internal>
+mp_core.h
+mp_madd.h
+mp_asmi.h
+mp_monty.h
+</header:internal>
diff --git a/third_party/botan/src/lib/math/numbertheory/info.txt b/third_party/botan/src/lib/math/numbertheory/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/math/numbertheory/info.txt
@@ -0,0 +1,22 @@
+<defines>
+NUMBERTHEORY -> 20131128
+</defines>
+
+<header:public>
+curve_nistp.h
+numthry.h
+pow_mod.h
+reducer.h
+monty.h
+</header:public>
+
+<header:internal>
+primality.h
+monty_exp.h
+</header:internal>
+
+<requires>
+bigint
+hash
+rng
+</requires>
diff --git a/third_party/botan/src/lib/misc/aont/info.txt b/third_party/botan/src/lib/misc/aont/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/misc/aont/info.txt
@@ -0,0 +1,9 @@
+<defines>
+PACKAGE_TRANSFORM -> 20131128
+</defines>
+
+<requires>
+ctr
+rng
+filters
+</requires>
diff --git a/third_party/botan/src/lib/misc/cryptobox/info.txt b/third_party/botan/src/lib/misc/cryptobox/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/misc/cryptobox/info.txt
@@ -0,0 +1,14 @@
+<defines>
+CRYPTO_BOX -> 20131128
+</defines>
+
+<requires>
+base64
+ctr
+hmac
+modes
+pbkdf2
+pem
+serpent
+sha2_64
+</requires>
diff --git a/third_party/botan/src/lib/misc/fpe_fe1/info.txt b/third_party/botan/src/lib/misc/fpe_fe1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/misc/fpe_fe1/info.txt
@@ -0,0 +1,10 @@
+<defines>
+FPE_FE1 -> 20131128
+</defines>
+
+<requires>
+bigint
+hmac
+numbertheory
+sha2_32
+</requires>
diff --git a/third_party/botan/src/lib/misc/hotp/info.txt b/third_party/botan/src/lib/misc/hotp/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/misc/hotp/info.txt
@@ -0,0 +1,9 @@
+<defines>
+HOTP -> 20180816
+TOTP -> 20180816
+</defines>
+
+<requires>
+hmac
+utils
+</requires>
diff --git a/third_party/botan/src/lib/misc/nist_keywrap/info.txt b/third_party/botan/src/lib/misc/nist_keywrap/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/misc/nist_keywrap/info.txt
@@ -0,0 +1,7 @@
+<defines>
+NIST_KEYWRAP -> 20171119
+</defines>
+
+<requires>
+block
+</requires>
diff --git a/third_party/botan/src/lib/misc/rfc3394/info.txt b/third_party/botan/src/lib/misc/rfc3394/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/misc/rfc3394/info.txt
@@ -0,0 +1,8 @@
+<defines>
+RFC3394_KEYWRAP -> 20131128
+</defines>
+
+<requires>
+aes
+nist_keywrap
+</requires>
diff --git a/third_party/botan/src/lib/misc/roughtime/info.txt b/third_party/botan/src/lib/misc/roughtime/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/misc/roughtime/info.txt
@@ -0,0 +1,10 @@
+<defines>
+ROUGHTIME -> 20190220
+</defines>
+
+<requires>
+ed25519
+rng
+sha2_64
+socket
+</requires>
diff --git a/third_party/botan/src/lib/misc/srp6/info.txt b/third_party/botan/src/lib/misc/srp6/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/misc/srp6/info.txt
@@ -0,0 +1,8 @@
+<defines>
+SRP6 -> 20161017
+</defines>
+
+<requires>
+bigint
+dl_group
+</requires>
diff --git a/third_party/botan/src/lib/misc/tss/info.txt b/third_party/botan/src/lib/misc/tss/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/misc/tss/info.txt
@@ -0,0 +1,10 @@
+<defines>
+THRESHOLD_SECRET_SHARING -> 20131128
+</defines>
+
+<requires>
+rng
+hex
+sha1
+sha2_32
+</requires>
diff --git a/third_party/botan/src/lib/modes/aead/ccm/info.txt b/third_party/botan/src/lib/modes/aead/ccm/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/aead/ccm/info.txt
@@ -0,0 +1,7 @@
+<defines>
+AEAD_CCM -> 20131128
+</defines>
+
+<requires>
+block
+</requires>
diff --git a/third_party/botan/src/lib/modes/aead/chacha20poly1305/info.txt b/third_party/botan/src/lib/modes/aead/chacha20poly1305/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/aead/chacha20poly1305/info.txt
@@ -0,0 +1,8 @@
+<defines>
+AEAD_CHACHA20_POLY1305 -> 20180807
+</defines>
+
+<requires>
+chacha
+poly1305
+</requires>
diff --git a/third_party/botan/src/lib/modes/aead/eax/info.txt b/third_party/botan/src/lib/modes/aead/eax/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/aead/eax/info.txt
@@ -0,0 +1,8 @@
+<defines>
+AEAD_EAX -> 20131128
+</defines>
+
+<requires>
+cmac
+ctr
+</requires>
diff --git a/third_party/botan/src/lib/modes/aead/gcm/info.txt b/third_party/botan/src/lib/modes/aead/gcm/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/aead/gcm/info.txt
@@ -0,0 +1,9 @@
+<defines>
+AEAD_GCM -> 20131128
+</defines>
+
+<requires>
+block
+ctr
+ghash
+</requires>
diff --git a/third_party/botan/src/lib/modes/aead/info.txt b/third_party/botan/src/lib/modes/aead/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/aead/info.txt
@@ -0,0 +1,3 @@
+<defines>
+AEAD_MODES -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/modes/aead/ocb/info.txt b/third_party/botan/src/lib/modes/aead/ocb/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/aead/ocb/info.txt
@@ -0,0 +1,8 @@
+<defines>
+AEAD_OCB -> 20131128
+</defines>
+
+<requires>
+block
+poly_dbl
+</requires>
diff --git a/third_party/botan/src/lib/modes/aead/siv/info.txt b/third_party/botan/src/lib/modes/aead/siv/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/aead/siv/info.txt
@@ -0,0 +1,9 @@
+<defines>
+AEAD_SIV -> 20131202
+</defines>
+
+<requires>
+cmac
+ctr
+poly_dbl
+</requires>
diff --git a/third_party/botan/src/lib/modes/cbc/info.txt b/third_party/botan/src/lib/modes/cbc/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/cbc/info.txt
@@ -0,0 +1,8 @@
+<defines>
+MODE_CBC -> 20131128
+</defines>
+
+<requires>
+block
+mode_pad
+</requires>
diff --git a/third_party/botan/src/lib/modes/cfb/info.txt b/third_party/botan/src/lib/modes/cfb/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/cfb/info.txt
@@ -0,0 +1,7 @@
+<defines>
+MODE_CFB -> 20131128
+</defines>
+
+<requires>
+block
+</requires>
diff --git a/third_party/botan/src/lib/modes/info.txt b/third_party/botan/src/lib/modes/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/info.txt
@@ -0,0 +1,9 @@
+<defines>
+MODES -> 20150626
+CIPHER_MODES -> 20180124
+</defines>
+
+<header:public>
+cipher_mode.h
+stream_mode.h
+</header:public>
diff --git a/third_party/botan/src/lib/modes/mode_pad/info.txt b/third_party/botan/src/lib/modes/mode_pad/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/mode_pad/info.txt
@@ -0,0 +1,3 @@
+<defines>
+CIPHER_MODE_PADDING -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/modes/xts/info.txt b/third_party/botan/src/lib/modes/xts/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/modes/xts/info.txt
@@ -0,0 +1,8 @@
+<defines>
+MODE_XTS -> 20131128
+</defines>
+
+<requires>
+block
+poly_dbl
+</requires>
diff --git a/third_party/botan/src/lib/passhash/bcrypt/info.txt b/third_party/botan/src/lib/passhash/bcrypt/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/passhash/bcrypt/info.txt
@@ -0,0 +1,9 @@
+<defines>
+BCRYPT -> 20131128
+</defines>
+
+<requires>
+blowfish
+rng
+base64
+</requires>
diff --git a/third_party/botan/src/lib/passhash/passhash9/info.txt b/third_party/botan/src/lib/passhash/passhash9/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/passhash/passhash9/info.txt
@@ -0,0 +1,9 @@
+<defines>
+PASSHASH9 -> 20131128
+</defines>
+
+<requires>
+pbkdf2
+rng
+base64
+</requires>
diff --git a/third_party/botan/src/lib/pbkdf/argon2/info.txt b/third_party/botan/src/lib/pbkdf/argon2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pbkdf/argon2/info.txt
@@ -0,0 +1,9 @@
+<defines>
+ARGON2 -> 20190824
+</defines>
+
+<requires>
+blake2
+base64
+</requires>
+
diff --git a/third_party/botan/src/lib/pbkdf/bcrypt_pbkdf/info.txt b/third_party/botan/src/lib/pbkdf/bcrypt_pbkdf/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pbkdf/bcrypt_pbkdf/info.txt
@@ -0,0 +1,8 @@
+<defines>
+PBKDF_BCRYPT -> 20190531
+</defines>
+
+<requires>
+blowfish
+sha2_64
+</requires>
diff --git a/third_party/botan/src/lib/pbkdf/info.txt b/third_party/botan/src/lib/pbkdf/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pbkdf/info.txt
@@ -0,0 +1,13 @@
+<defines>
+PBKDF -> 20180902
+</defines>
+
+<requires>
+mac
+hash
+</requires>
+
+<header:public>
+pwdhash.h
+pbkdf.h
+</header:public>
diff --git a/third_party/botan/src/lib/pbkdf/pbkdf1/info.txt b/third_party/botan/src/lib/pbkdf/pbkdf1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pbkdf/pbkdf1/info.txt
@@ -0,0 +1,7 @@
+<defines>
+PBKDF1 -> 20131128
+</defines>
+
+<requires>
+hash
+</requires>
diff --git a/third_party/botan/src/lib/pbkdf/pbkdf2/info.txt b/third_party/botan/src/lib/pbkdf/pbkdf2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pbkdf/pbkdf2/info.txt
@@ -0,0 +1,7 @@
+<defines>
+PBKDF2 -> 20180902
+</defines>
+
+<requires>
+hmac
+</requires>
diff --git a/third_party/botan/src/lib/pbkdf/pgp_s2k/info.txt b/third_party/botan/src/lib/pbkdf/pgp_s2k/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pbkdf/pgp_s2k/info.txt
@@ -0,0 +1,7 @@
+<defines>
+PGP_S2K -> 20170527
+</defines>
+
+<requires>
+hash
+</requires>
diff --git a/third_party/botan/src/lib/pbkdf/scrypt/info.txt b/third_party/botan/src/lib/pbkdf/scrypt/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pbkdf/scrypt/info.txt
@@ -0,0 +1,10 @@
+<defines>
+SCRYPT -> 20180902
+</defines>
+
+<requires>
+salsa20
+pbkdf2
+hmac
+sha2_32
+</requires>
diff --git a/third_party/botan/src/lib/pk_pad/eme_oaep/info.txt b/third_party/botan/src/lib/pk_pad/eme_oaep/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/eme_oaep/info.txt
@@ -0,0 +1,7 @@
+<defines>
+EME_OAEP -> 20180305
+</defines>
+
+<requires>
+mgf1
+</requires>
diff --git a/third_party/botan/src/lib/pk_pad/eme_pkcs1/info.txt b/third_party/botan/src/lib/pk_pad/eme_pkcs1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/eme_pkcs1/info.txt
@@ -0,0 +1,4 @@
+<defines>
+EME_PKCS1v15 -> 20131128
+EME_PKCS1 -> 20190426
+</defines>
diff --git a/third_party/botan/src/lib/pk_pad/eme_raw/info.txt b/third_party/botan/src/lib/pk_pad/eme_raw/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/eme_raw/info.txt
@@ -0,0 +1,3 @@
+<defines>
+EME_RAW -> 20150313
+</defines>
diff --git a/third_party/botan/src/lib/pk_pad/emsa1/info.txt b/third_party/botan/src/lib/pk_pad/emsa1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/emsa1/info.txt
@@ -0,0 +1,3 @@
+<defines>
+EMSA1 -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/pk_pad/emsa_pkcs1/info.txt b/third_party/botan/src/lib/pk_pad/emsa_pkcs1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/emsa_pkcs1/info.txt
@@ -0,0 +1,7 @@
+<defines>
+EMSA_PKCS1 -> 20140118
+</defines>
+
+<requires>
+hash_id
+</requires>
diff --git a/third_party/botan/src/lib/pk_pad/emsa_pssr/info.txt b/third_party/botan/src/lib/pk_pad/emsa_pssr/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/emsa_pssr/info.txt
@@ -0,0 +1,7 @@
+<defines>
+EMSA_PSSR -> 20131128
+</defines>
+
+<requires>
+mgf1
+</requires>
diff --git a/third_party/botan/src/lib/pk_pad/emsa_raw/info.txt b/third_party/botan/src/lib/pk_pad/emsa_raw/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/emsa_raw/info.txt
@@ -0,0 +1,3 @@
+<defines>
+EMSA_RAW -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/pk_pad/emsa_x931/info.txt b/third_party/botan/src/lib/pk_pad/emsa_x931/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/emsa_x931/info.txt
@@ -0,0 +1,7 @@
+<defines>
+EMSA_X931 -> 20140118
+</defines>
+
+<requires>
+hash_id
+</requires>
diff --git a/third_party/botan/src/lib/pk_pad/hash_id/info.txt b/third_party/botan/src/lib/pk_pad/hash_id/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/hash_id/info.txt
@@ -0,0 +1,3 @@
+<defines>
+HASH_ID -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/pk_pad/info.txt b/third_party/botan/src/lib/pk_pad/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/info.txt
@@ -0,0 +1,18 @@
+<defines>
+PK_PADDING -> 20131128
+</defines>
+
+<requires>
+asn1
+rng
+pubkey
+</requires>
+
+<header:internal>
+padding.h
+</header:internal>
+
+<header:public>
+eme.h
+emsa.h
+</header:public>
diff --git a/third_party/botan/src/lib/pk_pad/iso9796/info.txt b/third_party/botan/src/lib/pk_pad/iso9796/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/iso9796/info.txt
@@ -0,0 +1,9 @@
+<defines>
+ISO_9796 -> 20161121
+</defines>
+
+<requires>
+mgf1
+hash_id
+</requires>
+
diff --git a/third_party/botan/src/lib/pk_pad/mgf1/info.txt b/third_party/botan/src/lib/pk_pad/mgf1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pk_pad/mgf1/info.txt
@@ -0,0 +1,3 @@
+<defines>
+MGF1 -> 20140118
+</defines>
diff --git a/third_party/botan/src/lib/prov/commoncrypto/info.txt b/third_party/botan/src/lib/prov/commoncrypto/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/prov/commoncrypto/info.txt
@@ -0,0 +1,19 @@
+<defines>
+COMMONCRYPTO -> 20180903
+</defines>
+
+load_on vendor
+
+<header:internal>
+commoncrypto.h
+commoncrypto_utils.h
+</header:internal>
+
+<os_features>
+commoncrypto
+</os_features>
+
+<requires>
+modes
+block
+</requires>
diff --git a/third_party/botan/src/lib/prov/openssl/info.txt b/third_party/botan/src/lib/prov/openssl/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/prov/openssl/info.txt
@@ -0,0 +1,21 @@
+<defines>
+OPENSSL -> 20151219
+</defines>
+
+load_on vendor
+
+<header:internal>
+openssl.h
+</header:internal>
+
+<libs>
+all!windows -> crypto
+windows -> libeay32
+</libs>
+
+<requires>
+block
+stream
+modes
+pubkey
+</requires>
diff --git a/third_party/botan/src/lib/prov/pkcs11/info.txt b/third_party/botan/src/lib/prov/pkcs11/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/prov/pkcs11/info.txt
@@ -0,0 +1,34 @@
+<defines>
+PKCS11 -> 20160219
+</defines>
+
+<requires>
+dyn_load
+rng
+pubkey
+pk_pad
+</requires>
+
+<header:internal>
+p11_mechanism.h
+</header:internal>
+
+<header:external>
+pkcs11.h
+pkcs11f.h
+pkcs11t.h
+</header:external>
+
+<header:public>
+p11.h
+p11_ecc_key.h
+p11_ecdh.h
+p11_ecdsa.h
+p11_module.h
+p11_object.h
+p11_randomgenerator.h
+p11_rsa.h
+p11_session.h
+p11_slot.h
+p11_x509.h
+</header:public>
diff --git a/third_party/botan/src/lib/prov/tpm/info.txt b/third_party/botan/src/lib/prov/tpm/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/prov/tpm/info.txt
@@ -0,0 +1,16 @@
+<defines>
+TPM -> 20151126
+</defines>
+
+load_on vendor
+
+<libs>
+all -> tspi
+</libs>
+
+<requires>
+uuid
+hash_id
+rsa
+rng
+</requires>
diff --git a/third_party/botan/src/lib/psk_db/info.txt b/third_party/botan/src/lib/psk_db/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/psk_db/info.txt
@@ -0,0 +1,11 @@
+<defines>
+PSK_DB -> 20171119
+</defines>
+
+<requires>
+aes
+hmac
+base64
+sha2_32
+nist_keywrap
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/cecpq1/info.txt b/third_party/botan/src/lib/pubkey/cecpq1/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/cecpq1/info.txt
@@ -0,0 +1,9 @@
+<defines>
+CECPQ1 -> 20161116
+</defines>
+
+<requires>
+newhope
+curve25519
+</requires>
+
diff --git a/third_party/botan/src/lib/pubkey/curve25519/info.txt b/third_party/botan/src/lib/pubkey/curve25519/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/curve25519/info.txt
@@ -0,0 +1,8 @@
+<defines>
+CURVE_25519 -> 20170621
+X25519 -> 20180910
+</defines>
+
+<header:public>
+curve25519.h
+</header:public>
diff --git a/third_party/botan/src/lib/pubkey/dh/info.txt b/third_party/botan/src/lib/pubkey/dh/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/dh/info.txt
@@ -0,0 +1,13 @@
+<defines>
+DIFFIE_HELLMAN -> 20131128
+</defines>
+
+<header:public>
+dh.h
+</header:public>
+
+<requires>
+dl_algo
+dl_group
+numbertheory
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/dl_algo/info.txt b/third_party/botan/src/lib/pubkey/dl_algo/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/dl_algo/info.txt
@@ -0,0 +1,10 @@
+<defines>
+DL_PUBLIC_KEY_FAMILY -> 20131128
+</defines>
+
+<requires>
+asn1
+dl_group
+numbertheory
+rng
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/dl_group/info.txt b/third_party/botan/src/lib/pubkey/dl_group/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/dl_group/info.txt
@@ -0,0 +1,10 @@
+<defines>
+DL_GROUP -> 20131128
+</defines>
+
+<requires>
+asn1
+bigint
+numbertheory
+pem
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/dlies/info.txt b/third_party/botan/src/lib/pubkey/dlies/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/dlies/info.txt
@@ -0,0 +1,10 @@
+<defines>
+DLIES -> 20160713
+</defines>
+
+<requires>
+dh
+kdf
+mac
+modes
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/dsa/info.txt b/third_party/botan/src/lib/pubkey/dsa/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/dsa/info.txt
@@ -0,0 +1,12 @@
+<defines>
+DSA -> 20131128
+</defines>
+
+<requires>
+dl_algo
+dl_group
+keypair
+numbertheory
+emsa1
+sha2_32
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/ec_group/info.txt b/third_party/botan/src/lib/pubkey/ec_group/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/ec_group/info.txt
@@ -0,0 +1,20 @@
+<defines>
+ECC_GROUP -> 20170225
+EC_CURVE_GFP -> 20131128
+</defines>
+
+<requires>
+asn1
+numbertheory
+pem
+</requires>
+
+<header:internal>
+point_mul.h
+</header:internal>
+
+<header:public>
+curve_gfp.h
+ec_group.h
+point_gfp.h
+</header:public>
diff --git a/third_party/botan/src/lib/pubkey/ecc_key/info.txt b/third_party/botan/src/lib/pubkey/ecc_key/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/ecc_key/info.txt
@@ -0,0 +1,11 @@
+<defines>
+ECC_PUBLIC_KEY_CRYPTO -> 20131128
+ECC_KEY -> 20190801
+</defines>
+
+<requires>
+asn1
+bigint
+ec_group
+numbertheory
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/ecdh/info.txt b/third_party/botan/src/lib/pubkey/ecdh/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/ecdh/info.txt
@@ -0,0 +1,10 @@
+<defines>
+ECDH -> 20131128
+</defines>
+
+<requires>
+asn1
+ec_group
+ecc_key
+numbertheory
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/ecdsa/info.txt b/third_party/botan/src/lib/pubkey/ecdsa/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/ecdsa/info.txt
@@ -0,0 +1,14 @@
+<defines>
+ECDSA -> 20131128
+</defines>
+
+<requires>
+asn1
+ec_group
+ecc_key
+keypair
+numbertheory
+rng
+emsa1
+sha2_32
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/ecgdsa/info.txt b/third_party/botan/src/lib/pubkey/ecgdsa/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/ecgdsa/info.txt
@@ -0,0 +1,15 @@
+<defines>
+ECGDSA -> 20160301
+</defines>
+
+<requires>
+asn1
+bigint
+ec_group
+ecc_key
+keypair
+numbertheory
+rng
+emsa1
+sha2_32
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/ecies/info.txt b/third_party/botan/src/lib/pubkey/ecies/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/ecies/info.txt
@@ -0,0 +1,10 @@
+<defines>
+ECIES -> 20160128
+</defines>
+
+<requires>
+kdf
+mac
+ecdh
+modes
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/eckcdsa/info.txt b/third_party/botan/src/lib/pubkey/eckcdsa/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/eckcdsa/info.txt
@@ -0,0 +1,17 @@
+<defines>
+ECKCDSA -> 20160413
+</defines>
+
+<requires>
+asn1
+bigint
+ec_group
+ecc_key
+emsa1
+hash
+keypair
+numbertheory
+pk_pad
+rng
+sha2_32
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/ed25519/info.txt b/third_party/botan/src/lib/pubkey/ed25519/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/ed25519/info.txt
@@ -0,0 +1,17 @@
+<defines>
+ED25519 -> 20170607
+</defines>
+
+<requires>
+sha2_64
+</requires>
+
+<header:public>
+ed25519.h
+</header:public>
+
+<header:internal>
+ed25519_fe.h
+ed25519_internal.h
+</header:internal>
+
diff --git a/third_party/botan/src/lib/pubkey/elgamal/info.txt b/third_party/botan/src/lib/pubkey/elgamal/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/elgamal/info.txt
@@ -0,0 +1,10 @@
+<defines>
+ELGAMAL -> 20131128
+</defines>
+
+<requires>
+dl_algo
+dl_group
+keypair
+numbertheory
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/gost_3410/info.txt b/third_party/botan/src/lib/pubkey/gost_3410/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/gost_3410/info.txt
@@ -0,0 +1,12 @@
+<defines>
+GOST_34_10_2001 -> 20131128
+GOST_34_10_2012 -> 20190801
+</defines>
+
+<requires>
+asn1
+ec_group
+ecc_key
+numbertheory
+rng
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/info.txt b/third_party/botan/src/lib/pubkey/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/info.txt
@@ -0,0 +1,31 @@
+<defines>
+PUBLIC_KEY_CRYPTO -> 20131128
+</defines>
+
+<header:public>
+blinding.h
+pk_algs.h
+pk_keys.h
+pk_ops.h
+pk_ops_fwd.h
+pkcs8.h
+pubkey.h
+workfactor.h
+x509_key.h
+</header:public>
+
+<header:internal>
+pk_ops_impl.h
+</header:internal>
+
+<requires>
+asn1
+bigint
+kdf
+pem
+pk_pad
+numbertheory
+rng
+hash
+hex
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/keypair/info.txt b/third_party/botan/src/lib/pubkey/keypair/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/keypair/info.txt
@@ -0,0 +1,6 @@
+<defines>
+KEYPAIR_TESTING -> 20131128
+</defines>
+
+<requires>
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/mce/info.txt b/third_party/botan/src/lib/pubkey/mce/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/mce/info.txt
@@ -0,0 +1,18 @@
+<defines>
+MCELIECE -> 20150922
+</defines>
+
+<header:public>
+mceliece.h
+polyn_gf2m.h
+gf2m_small_m.h
+</header:public>
+
+<header:internal>
+code_based_util.h
+mce_internal.h
+</header:internal>
+
+<requires>
+sha2_64
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/mceies/info.txt b/third_party/botan/src/lib/pubkey/mceies/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/mceies/info.txt
@@ -0,0 +1,10 @@
+<defines>
+MCEIES -> 20150706
+</defines>
+
+<requires>
+aes
+mce
+ocb
+kdf1
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/newhope/info.txt b/third_party/botan/src/lib/pubkey/newhope/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/newhope/info.txt
@@ -0,0 +1,12 @@
+<defines>
+NEWHOPE -> 20161018
+</defines>
+
+<requires>
+sha3
+shake_cipher
+
+sha2_32
+ctr
+aes
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/pbes2/info.txt b/third_party/botan/src/lib/pubkey/pbes2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/pbes2/info.txt
@@ -0,0 +1,10 @@
+<defines>
+PKCS5_PBES2 -> 20141119
+</defines>
+
+<requires>
+asn1
+cbc
+hmac
+pbkdf2
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/pem/info.txt b/third_party/botan/src/lib/pubkey/pem/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/pem/info.txt
@@ -0,0 +1,7 @@
+<defines>
+PEM_CODEC -> 20131128
+</defines>
+
+<requires>
+base64
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/rfc6979/info.txt b/third_party/botan/src/lib/pubkey/rfc6979/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/rfc6979/info.txt
@@ -0,0 +1,8 @@
+<defines>
+RFC6979_GENERATOR -> 20140321
+</defines>
+
+<requires>
+bigint
+hmac_drbg
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/rsa/info.txt b/third_party/botan/src/lib/pubkey/rsa/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/rsa/info.txt
@@ -0,0 +1,10 @@
+<defines>
+RSA -> 20160730
+</defines>
+
+<requires>
+keypair
+numbertheory
+emsa_pssr
+sha2_32
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/sm2/info.txt b/third_party/botan/src/lib/pubkey/sm2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/sm2/info.txt
@@ -0,0 +1,14 @@
+<defines>
+SM2 -> 20180801
+</defines>
+
+<requires>
+asn1
+ec_group
+ecc_key
+keypair
+numbertheory
+rng
+sm3
+kdf2
+</requires>
diff --git a/third_party/botan/src/lib/pubkey/xmss/info.txt b/third_party/botan/src/lib/pubkey/xmss/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/pubkey/xmss/info.txt
@@ -0,0 +1,41 @@
+<defines>
+XMSS_RFC8391 -> 20190623
+</defines>
+
+<header:public>
+atomic.h
+xmss.h
+xmss_hash.h
+xmss_index_registry.h
+xmss_address.h
+xmss_parameters.h
+xmss_key_pair.h
+xmss_privatekey.h
+xmss_publickey.h
+xmss_tools.h
+xmss_wots_parameters.h
+xmss_wots_privatekey.h
+xmss_wots_publickey.h
+
+# future internal:
+xmss_common_ops.h
+</header:public>
+
+<header:internal>
+xmss_wots_addressed_privatekey.h
+xmss_wots_addressed_publickey.h
+xmss_signature.h
+xmss_signature_operation.h
+xmss_verification_operation.h
+</header:internal>
+
+<requires>
+asn1
+rng
+hash
+sha2_32
+</requires>
+
+<os_features>
+atomics
+</os_features>
diff --git a/third_party/botan/src/lib/rng/auto_rng/info.txt b/third_party/botan/src/lib/rng/auto_rng/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/rng/auto_rng/info.txt
@@ -0,0 +1,8 @@
+<defines>
+AUTO_SEEDING_RNG -> 20160821
+AUTO_RNG -> 20161126
+</defines>
+
+<requires>
+hmac_drbg
+</requires>
diff --git a/third_party/botan/src/lib/rng/chacha_rng/info.txt b/third_party/botan/src/lib/rng/chacha_rng/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/rng/chacha_rng/info.txt
@@ -0,0 +1,10 @@
+<defines>
+CHACHA_RNG -> 20170728
+</defines>
+
+<requires>
+hmac
+sha2_32
+chacha
+stateful_rng
+</requires>
diff --git a/third_party/botan/src/lib/rng/hmac_drbg/info.txt b/third_party/botan/src/lib/rng/hmac_drbg/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/rng/hmac_drbg/info.txt
@@ -0,0 +1,8 @@
+<defines>
+HMAC_DRBG -> 20140319
+</defines>
+
+<requires>
+hmac
+stateful_rng
+</requires>
diff --git a/third_party/botan/src/lib/rng/info.txt b/third_party/botan/src/lib/rng/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/rng/info.txt
@@ -0,0 +1,3 @@
+<requires>
+entropy
+</requires>
diff --git a/third_party/botan/src/lib/rng/processor_rng/info.txt b/third_party/botan/src/lib/rng/processor_rng/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/rng/processor_rng/info.txt
@@ -0,0 +1,16 @@
+<defines>
+PROCESSOR_RNG -> 20200508
+</defines>
+
+<cc>
+gcc
+clang
+icc
+msvc
+</cc>
+
+<arch>
+x86_32
+x86_64
+ppc64
+</arch>
diff --git a/third_party/botan/src/lib/rng/rdrand_rng/info.txt b/third_party/botan/src/lib/rng/rdrand_rng/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/rng/rdrand_rng/info.txt
@@ -0,0 +1,13 @@
+<defines>
+RDRAND_RNG -> 20160619
+</defines>
+
+<requires>
+processor_rng
+</requires>
+
+# Avoid building RDRAND_RNG on non-x86 since that would be confusing
+<arch>
+x86_32
+x86_64
+</arch>
diff --git a/third_party/botan/src/lib/rng/stateful_rng/info.txt b/third_party/botan/src/lib/rng/stateful_rng/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/rng/stateful_rng/info.txt
@@ -0,0 +1,3 @@
+<defines>
+STATEFUL_RNG -> 20160819
+</defines>
diff --git a/third_party/botan/src/lib/rng/system_rng/info.txt b/third_party/botan/src/lib/rng/system_rng/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/rng/system_rng/info.txt
@@ -0,0 +1,18 @@
+<defines>
+SYSTEM_RNG -> 20141202
+</defines>
+
+<os_features>
+dev_random,posix1
+arc4random
+rtlgenrandom
+crypto_ng
+</os_features>
+
+<libs>
+uwp -> bcrypt
+</libs>
+
+<requires>
+rtlgenrandom?dyn_load
+</requires>
diff --git a/third_party/botan/src/lib/stream/chacha/chacha_avx2/info.txt b/third_party/botan/src/lib/stream/chacha/chacha_avx2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/stream/chacha/chacha_avx2/info.txt
@@ -0,0 +1,11 @@
+<defines>
+CHACHA_AVX2 -> 20180418
+</defines>
+
+<isa>
+avx2
+</isa>
+
+<requires>
+simd_avx2
+</requires>
diff --git a/third_party/botan/src/lib/stream/chacha/chacha_simd32/info.txt b/third_party/botan/src/lib/stream/chacha/chacha_simd32/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/stream/chacha/chacha_simd32/info.txt
@@ -0,0 +1,7 @@
+<defines>
+CHACHA_SIMD32 -> 20181104
+</defines>
+
+<requires>
+simd
+</requires>
diff --git a/third_party/botan/src/lib/stream/chacha/info.txt b/third_party/botan/src/lib/stream/chacha/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/stream/chacha/info.txt
@@ -0,0 +1,3 @@
+<defines>
+CHACHA -> 20180807
+</defines>
diff --git a/third_party/botan/src/lib/stream/ctr/info.txt b/third_party/botan/src/lib/stream/ctr/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/stream/ctr/info.txt
@@ -0,0 +1,7 @@
+<defines>
+CTR_BE -> 20131128
+</defines>
+
+<requires>
+block
+</requires>
diff --git a/third_party/botan/src/lib/stream/info.txt b/third_party/botan/src/lib/stream/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/stream/info.txt
@@ -0,0 +1,7 @@
+<defines>
+STREAM_CIPHER -> 20131128
+</defines>
+
+<header:public>
+stream_cipher.h
+</header:public>
diff --git a/third_party/botan/src/lib/stream/ofb/info.txt b/third_party/botan/src/lib/stream/ofb/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/stream/ofb/info.txt
@@ -0,0 +1,7 @@
+<defines>
+OFB -> 20131128
+</defines>
+
+<requires>
+block
+</requires>
diff --git a/third_party/botan/src/lib/stream/rc4/info.txt b/third_party/botan/src/lib/stream/rc4/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/stream/rc4/info.txt
@@ -0,0 +1,3 @@
+<defines>
+RC4 -> 20131128
+</defines>
diff --git a/third_party/botan/src/lib/stream/salsa20/info.txt b/third_party/botan/src/lib/stream/salsa20/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/stream/salsa20/info.txt
@@ -0,0 +1,3 @@
+<defines>
+SALSA20 -> 20171114
+</defines>
diff --git a/third_party/botan/src/lib/stream/shake_cipher/info.txt b/third_party/botan/src/lib/stream/shake_cipher/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/stream/shake_cipher/info.txt
@@ -0,0 +1,7 @@
+<defines>
+SHAKE_CIPHER -> 20161018
+</defines>
+
+<requires>
+sha3
+</requires>
diff --git a/third_party/botan/src/lib/tls/asio/info.txt b/third_party/botan/src/lib/tls/asio/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/tls/asio/info.txt
@@ -0,0 +1,15 @@
+<defines>
+TLS_ASIO_STREAM -> 20181218
+</defines>
+
+<header:public>
+asio_context.h
+asio_stream.h
+asio_error.h
+asio_async_ops.h
+</header:public>
+
+<requires>
+boost
+tls
+</requires>
diff --git a/third_party/botan/src/lib/tls/info.txt b/third_party/botan/src/lib/tls/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/tls/info.txt
@@ -0,0 +1,54 @@
+<defines>
+TLS -> 20191210
+</defines>
+
+<header:public>
+credentials_manager.h
+tls_alert.h
+tls_algos.h
+tls_blocking.h
+tls_callbacks.h
+tls_channel.h
+tls_ciphersuite.h
+tls_client.h
+tls_exceptn.h
+tls_extensions.h
+tls_handshake_msg.h
+tls_magic.h
+tls_messages.h
+tls_server_info.h
+tls_policy.h
+tls_server.h
+tls_session.h
+tls_session_manager.h
+tls_version.h
+</header:public>
+
+<header:internal>
+tls_handshake_hash.h
+tls_handshake_io.h
+tls_handshake_state.h
+tls_reader.h
+tls_record.h
+tls_seq_numbers.h
+tls_session_key.h
+</header:internal>
+
+<requires>
+aead
+aes
+asn1
+dh
+ecdh
+ecdsa
+eme_pkcs1
+emsa_pkcs1
+gcm
+hmac
+prf_tls
+rng
+rsa
+sha2_32
+sha2_64
+x509
+</requires>
diff --git a/third_party/botan/src/lib/tls/sessions_sql/info.txt b/third_party/botan/src/lib/tls/sessions_sql/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/tls/sessions_sql/info.txt
@@ -0,0 +1,7 @@
+<defines>
+TLS_SESSION_MANAGER_SQL_DB -> 20141219
+</defines>
+
+<requires>
+pbkdf2
+</requires>
diff --git a/third_party/botan/src/lib/tls/sessions_sqlite3/info.txt b/third_party/botan/src/lib/tls/sessions_sqlite3/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/tls/sessions_sqlite3/info.txt
@@ -0,0 +1,8 @@
+<defines>
+TLS_SQLITE3_SESSION_MANAGER -> 20131128
+</defines>
+
+<requires>
+sessions_sql
+sqlite3
+</requires>
diff --git a/third_party/botan/src/lib/tls/tls_10/info.txt b/third_party/botan/src/lib/tls/tls_10/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/tls/tls_10/info.txt
@@ -0,0 +1,10 @@
+<defines>
+TLS_V10 -> 20191109
+</defines>
+
+<requires>
+md5
+sha1
+par_hash
+tls_cbc
+</requires>
diff --git a/third_party/botan/src/lib/tls/tls_cbc/info.txt b/third_party/botan/src/lib/tls/tls_cbc/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/tls/tls_cbc/info.txt
@@ -0,0 +1,12 @@
+<defines>
+TLS_CBC -> 20161008
+</defines>
+
+<header:internal>
+tls_cbc.h
+</header:internal>
+
+<requires>
+cbc
+hmac
+</requires>
diff --git a/third_party/botan/src/lib/utils/boost/info.txt b/third_party/botan/src/lib/utils/boost/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/boost/info.txt
@@ -0,0 +1,9 @@
+<defines>
+BOOST_ASIO -> 20131228
+</defines>
+
+load_on vendor
+
+<libs>
+all -> boost_system
+</libs>
diff --git a/third_party/botan/src/lib/utils/cpuid/info.txt b/third_party/botan/src/lib/utils/cpuid/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/cpuid/info.txt
@@ -0,0 +1,7 @@
+<defines>
+CPUID -> 20170917
+</defines>
+
+<header:public>
+cpuid.h
+</header:public>
diff --git a/third_party/botan/src/lib/utils/dyn_load/info.txt b/third_party/botan/src/lib/utils/dyn_load/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/dyn_load/info.txt
@@ -0,0 +1,18 @@
+<defines>
+DYNAMIC_LOADER -> 20160310
+</defines>
+
+load_on dep
+
+<os_features>
+posix1
+win32
+</os_features>
+
+<libs>
+android -> dl
+linux -> dl
+solaris -> dl
+macos -> dl
+hurd -> dl
+</libs>
diff --git a/third_party/botan/src/lib/utils/ghash/ghash_cpu/info.txt b/third_party/botan/src/lib/utils/ghash/ghash_cpu/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/ghash/ghash_cpu/info.txt
@@ -0,0 +1,33 @@
+<defines>
+GHASH_CLMUL_CPU -> 20201002
+</defines>
+
+endian little
+
+<requires>
+simd
+</requires>
+
+<isa>
+x86_32:sse2
+x86_32:ssse3
+x86_32:aesni
+x86_64:sse2
+x86_64:ssse3
+x86_64:aesni
+arm64:neon
+arm64:armv8crypto
+ppc64:powercrypto
+</isa>
+
+<arch>
+x86_32
+x86_64
+arm64
+ppc64
+</arch>
+
+<cc>
+gcc:4.9
+clang:3.8
+</cc>
diff --git a/third_party/botan/src/lib/utils/ghash/ghash_vperm/info.txt b/third_party/botan/src/lib/utils/ghash/ghash_vperm/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/ghash/ghash_vperm/info.txt
@@ -0,0 +1,8 @@
+<defines>
+GHASH_CLMUL_VPERM -> 20201002
+</defines>
+
+<isa>
+sse2
+ssse3
+</isa>
diff --git a/third_party/botan/src/lib/utils/ghash/info.txt b/third_party/botan/src/lib/utils/ghash/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/ghash/info.txt
@@ -0,0 +1,3 @@
+<defines>
+GHASH -> 20201002
+</defines>
diff --git a/third_party/botan/src/lib/utils/http_util/info.txt b/third_party/botan/src/lib/utils/http_util/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/http_util/info.txt
@@ -0,0 +1,11 @@
+<defines>
+HTTP_UTIL -> 20171003
+</defines>
+
+<header:public>
+http_util.h
+</header:public>
+
+<requires>
+socket
+</requires>
diff --git a/third_party/botan/src/lib/utils/info.txt b/third_party/botan/src/lib/utils/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/info.txt
@@ -0,0 +1,43 @@
+<defines>
+UTIL_FUNCTIONS -> 20180903
+</defines>
+
+load_on always
+
+<header:public>
+assert.h
+bswap.h
+calendar.h
+charset.h
+compiler.h
+data_src.h
+database.h
+exceptn.h
+loadstor.h
+mem_ops.h
+mul128.h
+mutex.h
+parsing.h
+rotate.h
+types.h
+version.h
+stl_compatibility.h
+</header:public>
+
+<header:internal>
+bit_ops.h
+codec_base.h
+ct_utils.h
+donna128.h
+filesystem.h
+os_utils.h
+prefetch.h
+rounding.h
+safeint.h
+stl_util.h
+timer.h
+</header:internal>
+
+<requires>
+cpuid
+</requires>
diff --git a/third_party/botan/src/lib/utils/locking_allocator/info.txt b/third_party/botan/src/lib/utils/locking_allocator/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/locking_allocator/info.txt
@@ -0,0 +1,12 @@
+<defines>
+LOCKING_ALLOCATOR -> 20131128
+</defines>
+
+<os_features>
+posix1
+virtual_lock
+</os_features>
+
+<requires>
+mem_pool
+</requires>
diff --git a/third_party/botan/src/lib/utils/mem_pool/info.txt b/third_party/botan/src/lib/utils/mem_pool/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/mem_pool/info.txt
@@ -0,0 +1,7 @@
+<defines>
+MEM_POOL -> 20180309
+</defines>
+
+<header:internal>
+mem_pool.h
+</header:internal>
diff --git a/third_party/botan/src/lib/utils/poly_dbl/info.txt b/third_party/botan/src/lib/utils/poly_dbl/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/poly_dbl/info.txt
@@ -0,0 +1,7 @@
+<defines>
+POLY_DBL -> 20170927
+</defines>
+
+<header:internal>
+poly_dbl.h
+</header:internal>
diff --git a/third_party/botan/src/lib/utils/simd/info.txt b/third_party/botan/src/lib/utils/simd/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/simd/info.txt
@@ -0,0 +1,27 @@
+<defines>
+SIMD_32 -> 20131128
+</defines>
+
+<header:internal>
+simd_32.h
+</header:internal>
+
+<isa>
+x86_32:sse2
+x86_64:sse2
+x32:sse2
+arm32:neon
+arm64:neon
+ppc32:altivec
+ppc64:altivec
+</isa>
+
+<arch>
+x86_32
+x86_64
+x32
+arm32
+arm64
+ppc32
+ppc64
+</arch>
diff --git a/third_party/botan/src/lib/utils/simd/simd_avx2/info.txt b/third_party/botan/src/lib/utils/simd/simd_avx2/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/simd/simd_avx2/info.txt
@@ -0,0 +1,21 @@
+<defines>
+SIMD_AVX2 -> 20180824
+</defines>
+
+<isa>
+avx2
+</isa>
+
+<header:internal>
+simd_avx2.h
+</header:internal>
+
+<cc>
+gcc
+clang
+msvc
+
+# Intel C++ 2020 doesn't support target attribute on overloaded
+# operators, see GH #2260
+#icc
+</cc>
diff --git a/third_party/botan/src/lib/utils/socket/info.txt b/third_party/botan/src/lib/utils/socket/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/socket/info.txt
@@ -0,0 +1,18 @@
+<defines>
+SOCKETS -> 20171216
+</defines>
+
+<header:internal>
+uri.h
+socket.h
+socket_udp.h
+</header:internal>
+
+<libs>
+linux -> rt
+mingw -> ws2_32
+windows -> ws2_32
+haiku -> network
+solaris -> socket,nsl
+qnx -> socket
+</libs>
diff --git a/third_party/botan/src/lib/utils/sqlite3/info.txt b/third_party/botan/src/lib/utils/sqlite3/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/sqlite3/info.txt
@@ -0,0 +1,13 @@
+<defines>
+SQLITE3 -> 20171118
+</defines>
+
+load_on vendor
+
+<libs>
+all -> sqlite3
+</libs>
+
+<header:public>
+sqlite3.h
+</header:public>
diff --git a/third_party/botan/src/lib/utils/thread_utils/info.txt b/third_party/botan/src/lib/utils/thread_utils/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/thread_utils/info.txt
@@ -0,0 +1,14 @@
+<defines>
+THREAD_UTILS -> 20190922
+</defines>
+
+<header:internal>
+rwlock.h
+barrier.h
+semaphore.h
+thread_pool.h
+</header:internal>
+
+<os_features>
+threads
+</os_features>
diff --git a/third_party/botan/src/lib/utils/uuid/info.txt b/third_party/botan/src/lib/utils/uuid/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/utils/uuid/info.txt
@@ -0,0 +1,8 @@
+<defines>
+UUID -> 20180930
+</defines>
+
+<requires>
+rng
+hex
+</requires>
diff --git a/third_party/botan/src/lib/x509/certstor_flatfile/info.txt b/third_party/botan/src/lib/x509/certstor_flatfile/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/x509/certstor_flatfile/info.txt
@@ -0,0 +1,12 @@
+<defines>
+CERTSTOR_FLATFILE -> 20190410
+</defines>
+
+<os_features>
+filesystem
+</os_features>
+
+<header:public>
+certstor_flatfile.h
+</header:public>
+
diff --git a/third_party/botan/src/lib/x509/certstor_sql/info.txt b/third_party/botan/src/lib/x509/certstor_sql/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/x509/certstor_sql/info.txt
@@ -0,0 +1,3 @@
+<defines>
+CERTSTOR_SQL -> 20160818
+</defines>
diff --git a/third_party/botan/src/lib/x509/certstor_sqlite3/info.txt b/third_party/botan/src/lib/x509/certstor_sqlite3/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/x509/certstor_sqlite3/info.txt
@@ -0,0 +1,8 @@
+<defines>
+CERTSTOR_SQLITE3 -> 20160818
+</defines>
+
+<requires>
+certstor_sql
+sqlite3
+</requires>
diff --git a/third_party/botan/src/lib/x509/certstor_system/info.txt b/third_party/botan/src/lib/x509/certstor_system/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/x509/certstor_system/info.txt
@@ -0,0 +1,8 @@
+<defines>
+CERTSTOR_SYSTEM -> 20190411
+</defines>
+
+<os_features>
+apple_keychain
+filesystem
+</os_features>
diff --git a/third_party/botan/src/lib/x509/certstor_system_macos/info.txt b/third_party/botan/src/lib/x509/certstor_system_macos/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/x509/certstor_system_macos/info.txt
@@ -0,0 +1,15 @@
+<defines>
+CERTSTOR_MACOS -> 20190207
+</defines>
+
+<os_features>
+apple_keychain
+</os_features>
+
+<header:public>
+certstor_macos.h
+</header:public>
+
+<frameworks>
+macos -> CoreFoundation,Security
+</frameworks>
diff --git a/third_party/botan/src/lib/x509/certstor_system_windows/info.txt b/third_party/botan/src/lib/x509/certstor_system_windows/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/x509/certstor_system_windows/info.txt
@@ -0,0 +1,16 @@
+<defines>
+CERTSTOR_WINDOWS -> 20190430
+</defines>
+
+<os_features>
+win32,certificate_store
+</os_features>
+
+<header:public>
+certstor_windows.h
+</header:public>
+
+<libs>
+windows -> crypt32
+mingw -> crypt32
+</libs>
diff --git a/third_party/botan/src/lib/x509/info.txt b/third_party/botan/src/lib/x509/info.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/lib/x509/info.txt
@@ -0,0 +1,12 @@
+<defines>
+X509_CERTIFICATES -> 20151023
+X509 -> 20180911
+OCSP -> 20161118
+</defines>
+
+<requires>
+asn1
+pubkey
+sha1
+sha2_32
+</requires>
diff --git a/third_party/botan/src/scripts/tls_scanner/boa.txt b/third_party/botan/src/scripts/tls_scanner/boa.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/scripts/tls_scanner/boa.txt
@@ -0,0 +1,1 @@
+bankofamerica.com
diff --git a/third_party/botan/src/scripts/tls_scanner/policy.txt b/third_party/botan/src/scripts/tls_scanner/policy.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/scripts/tls_scanner/policy.txt
@@ -0,0 +1,19 @@
+allow_tls10=true
+allow_tls11=true
+allow_tls12=true
+allow_dtls10=false
+allow_dtls12=false
+
+# Camellia first just to see if there is anyone out there who will negotiate it with us
+ciphers=Camellia-128 Camellia-256 Camellia-128/GCM Camellia-256/GCM ChaCha20Poly1305 AES-256/GCM AES-128/GCM AES-256 AES-128
+signature_hashes=SHA-384 SHA-256 SHA-1
+macs=AEAD SHA-384 SHA-256 SHA-1
+key_exchange_methods=CECPQ1 ECDH DH RSA
+signature_methods=ECDSA RSA DSA IMPLICIT
+ecc_curves=x25519 secp256r1 secp384r1
+minimum_dh_group_size=1024
+minimum_ecdh_group_size=255
+minimum_rsa_bits=2048
+
+allow_insecure_renegotiation=false
+allow_server_initiated_renegotiation=false
diff --git a/third_party/botan/src/scripts/tls_scanner/readme.txt b/third_party/botan/src/scripts/tls_scanner/readme.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/scripts/tls_scanner/readme.txt
@@ -0,0 +1,5 @@
+
+Simple script to scan hosts to check basic TLS client compatability.
+
+URL list chosen mostly from large tech/software vendors, feel free to
+send suggestions.
diff --git a/third_party/botan/src/scripts/tls_scanner/urls.txt b/third_party/botan/src/scripts/tls_scanner/urls.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/scripts/tls_scanner/urls.txt
@@ -0,0 +1,58 @@
+adobe.com
+adp.com
+airbnb.com
+akamai.com
+amazon.com
+apache.org
+apple.com
+bbc.co.uk
+bing.com
+ca.com
+cisco.com
+citrix.com
+cloudflare.com
+craigslist.org
+dell.com
+ebay.com
+facebook.com
+github.com
+gmail.com
+google.com
+hp.com
+huawei.com
+ibm.com
+ietf.org
+intuit.com
+linkedin.com
+medium.com
+microsoft.com
+mikestoolbox.org
+netflix.com
+openssl.org
+oracle.com
+chase.com
+bankofamerica.com
+citibank.com
+wellsfargo.com
+ebay.com
+paypal.com
+randombit.net
+reddit.com
+redhat.com
+salesforce.com
+sas.com
+siemens.com
+sony.com
+stripe.com
+symantec.com
+tls.mbed.org
+twitter.com
+uber.com
+vmware.com
+whatsapp.com
+wikipedia.org
+www.iso.org
+www.lg.com
+yahoo.com
+yandex.ru
+youtube.com
diff --git a/third_party/botan/src/tests/data/asn1_print/output1.txt b/third_party/botan/src/tests/data/asn1_print/output1.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/asn1_print/output1.txt
@@ -0,0 +1,8 @@
+  d= 0, l=  32: SEQUENCE
+  d= 1, l=   1:  INTEGER                                    05
+  d= 1, l=   6:  PRINTABLE STRING                           string
+  d= 1, l=   6:  SET
+  d= 2, l=   1:   BOOLEAN                                   true
+  d= 2, l=   1:   INTEGER                                   63
+  d= 1, l=   5:  OCTET STRING                               0000000000
+  d= 1, l=   4:  BIT STRING                                 FFFFFF
diff --git a/third_party/botan/src/tests/data/asn1_print/output2.txt b/third_party/botan/src/tests/data/asn1_print/output2.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/asn1_print/output2.txt
@@ -0,0 +1,11 @@
+  d= 0, l=  38: SEQUENCE
+  d= 1, l=   1:  INTEGER                                    00
+  d= 1, l=   6:  OCTET STRING                               public
+  d= 1, l=  25:  cons [0] context
+  d= 2, l=   1:   INTEGER                                   26
+  d= 2, l=   1:   INTEGER                                   00
+  d= 2, l=   1:   INTEGER                                   00
+  d= 2, l=  14:   SEQUENCE
+  d= 3, l=  12:    SEQUENCE
+  d= 4, l=   8:     OBJECT                                  1.3.6.1.2.1.1.2.0
+  d= 4, l=   0:     NULL
diff --git a/third_party/botan/src/tests/data/asn1_print/output3.txt b/third_party/botan/src/tests/data/asn1_print/output3.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/asn1_print/output3.txt
@@ -0,0 +1,20 @@
+  d= 0, l= 397: cons [33] appl
+  d= 1, l= 333:  cons [78] appl
+  d= 2, l=   1:   [41] appl                                 5F290100
+  d= 2, l=  16:   [2] appl                                  421044454356437F45504153533030303031
+  d= 2, l= 253:   cons [73] appl
+  d= 3, l=  10:    OBJECT                                   0.4.0.127.0.7.2.2.2.2.2
+  d= 3, l=  28:    [1] context                              811CD7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF
+  d= 3, l=  28:    [2] context                              821C68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43
+  d= 3, l=  28:    [3] context                              831C2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B
+  d= 3, l=  57:    [4] context                              8439040D9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD
+  d= 3, l=  28:    [5] context                              851CD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F
+  d= 3, l=  57:    [6] context                              8639045FE7B42614096E67E3B25675EFBBD94B9F1244B17228F109F07856D285867B1F72FA60E4929D88C0BF61035A7C3ECF17CA2C81532308C390
+  d= 3, l=   1:    [7] context                              870101
+  d= 2, l=  16:   [32] appl                                 5F201044454356434145504153533030303031
+  d= 2, l=  14:   cons [76] appl
+  d= 3, l=   9:    OBJECT                                   0.4.0.127.0.7.3.1.2.1
+  d= 3, l=   1:    [19] appl                                5301C1
+  d= 2, l=   6:   [37] appl                                 5F2506000700080108
+  d= 2, l=   6:   [36] appl                                 5F2406010000080108
+  d= 1, l=  56:  [55] appl                                  5F37386978982008CBD24950ADBECEE03A1675660B7FAFBD2D77CF17A5D128CFD9609B5BD0518D28D4D212CAE337F4F47495EDE92C0D7D15EA657D
diff --git a/third_party/botan/src/tests/data/asn1_print/output4.txt b/third_party/botan/src/tests/data/asn1_print/output4.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/asn1_print/output4.txt
@@ -0,0 +1,11 @@
+  d= 0, l= 235: cons [7] appl
+  d= 1, l= 154:  cons [33] appl
+  d= 2, l=  92:   cons [78] appl
+  d= 3, l=   1:    [41] appl                                5F290100
+  d= 3, l=  71:    cons [73] appl
+  d= 4, l=  10:     OBJECT                                  0.4.0.127.0.7.2.2.2.2.2
+  d= 4, l=  57:     [6] context                             8639044E4EC55A2E6596F030E7FA5CD42BBC034891A0A8C1EF7C1A007A8047B6D5A883C1D5E2A8FC7CE08CF7F07B063EB8EE3E2AF1836BE7DA1577
+  d= 3, l=  11:    [32] appl                                5F200B444531222A20237EFF20AD
+  d= 2, l=  56:   [55] appl                                 5F3738571A971D19B664F9B03AEF178D32E5EDF9DB5C4945D449D5E4AE63B102DABFF3D4DF00D1BC83BB582981D6B48ED41F89F0FC628C7F89A0F5
+  d= 1, l=  16:  [2] appl                                   4210444531222A20237EFF20AD3030303130
+  d= 1, l=  56:  [55] appl                                  5F3738423A93F9E40B0A3488AF6F716848531A24BAB3A2613BD6D830470D2936B1F93061A00A4B6BAA9C3A180272A60F91FD975DB3CF8D8179370C
diff --git a/third_party/botan/src/tests/data/asn1_print/output5.txt b/third_party/botan/src/tests/data/asn1_print/output5.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/asn1_print/output5.txt
@@ -0,0 +1,134 @@
+  d= 0, l=1779: SEQUENCE
+  d= 1, l=1499:  SEQUENCE
+  d= 2, l=   3:   cons [0] context
+  d= 3, l=   1:    INTEGER                                  02
+  d= 2, l=  16:   INTEGER                                   03EB7E1D9B4C4C7B145FF6A902CE81F9
+  d= 2, l=  13:   SEQUENCE
+  d= 3, l=   9:    OBJECT                                   RSA/EMSA3(SHA-256) [1.2.840.113549.1.1.11]
+  d= 3, l=   0:    NULL
+  d= 2, l= 126:   SEQUENCE
+  d= 3, l=  11:    SET
+  d= 4, l=   9:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Country [2.5.4.6]
+  d= 5, l=   2:      PRINTABLE STRING                       US
+  d= 3, l=  29:    SET
+  d= 4, l=  27:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Organization [2.5.4.10]
+  d= 5, l=  20:      PRINTABLE STRING                       Symantec Corporation
+  d= 3, l=  31:    SET
+  d= 4, l=  29:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.OrganizationalUnit [2.5.4.11]
+  d= 5, l=  22:      PRINTABLE STRING                       Symantec Trust Network
+  d= 3, l=  47:    SET
+  d= 4, l=  45:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.CommonName [2.5.4.3]
+  d= 5, l=  38:      PRINTABLE STRING                       Symantec Class 3 Secure Server CA - G4
+  d= 2, l=  30:   SEQUENCE
+  d= 3, l=  13:    UTC TIME                                 2017/04/07 00:00:00 UTC
+  d= 3, l=  13:    UTC TIME                                 2019/04/08 23:59:59 UTC
+  d= 2, l= 128:   SEQUENCE
+  d= 3, l=  11:    SET
+  d= 4, l=   9:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Country [2.5.4.6]
+  d= 5, l=   2:      PRINTABLE STRING                       US
+  d= 3, l=  19:    SET
+  d= 4, l=  17:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.State [2.5.4.8]
+  d= 5, l=  10:      UTF8 STRING                            Washington
+  d= 3, l=  16:    SET
+  d= 4, l=  14:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Locality [2.5.4.7]
+  d= 5, l=   7:      UTF8 STRING                            Redmond
+  d= 3, l=  30:    SET
+  d= 4, l=  28:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Organization [2.5.4.10]
+  d= 5, l=  21:      UTF8 STRING                            Microsoft Corporation
+  d= 3, l=  14:    SET
+  d= 4, l=  12:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.OrganizationalUnit [2.5.4.11]
+  d= 5, l=   5:      UTF8 STRING                            MSCOM
+  d= 3, l=  26:    SET
+  d= 4, l=  24:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.CommonName [2.5.4.3]
+  d= 5, l=  17:      UTF8 STRING                            www.microsoft.com
+  d= 2, l= 290:   SEQUENCE
+  d= 3, l=  13:    SEQUENCE
+  d= 4, l=   9:     OBJECT                                  RSA [1.2.840.113549.1.1.1]
+  d= 4, l=   0:     NULL
+  d= 3, l= 271:    BIT STRING
+  d= 4, l= 266:     SEQUENCE
+  d= 5, l= 257:      INTEGER                                B5AA73E7BDFFA06C6A1D0F0E116386ACB98C55C27EEC1FDF0164539D337F4D66EE0824CE6355927411770262AC284619AE06F2BAADF3D9E03E40850F42846F821AF49219E7EF8434AEF76DB5E3E9F17AFB5CE04E45959B77CC9B55819EC501B5979F345DF10051AC456926A48CD44F0EC8FBD3E8E91D5A76C35C882DC8FA95275AC2150ACF990D4019B96E55497CB1F46A842643C64168DFD8A31AC4A1E808DF710C53363ADAF82B5F62C9A2AAEE1FEC64880D951E7D48BDB3FDF724E25F67F373D2EC1426B7E4BA2B60442A42320D3FEF96640B6E795CF8C4FEB28E1608CB968BBB83B65F96BB5175682095310CE5FD02805AA9273326F7A9E8B33730EB8EDD
+  d= 5, l=   3:      INTEGER                                010001
+  d= 2, l= 872:   cons [3] context
+  d= 3, l= 868:    SEQUENCE
+  d= 4, l= 153:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.SubjectAlternativeName [2.5.29.17]
+  d= 5, l= 145:      OCTET STRING
+  d= 6, l= 142:       SEQUENCE
+  d= 7, l=   7:        [2] context                          privacy.microsoft.com
+  d= 7, l=   7:        [2] context                          c.s-microsoft.com
+  d= 7, l=   7:        [2] context                          microsoft.com
+  d= 7, l=   7:        [2] context                          i.s-microsoft.com
+  d= 7, l=   7:        [2] context                          staticview.microsoft.com
+  d= 7, l=   7:        [2] context                          www.microsoft.com
+  d= 7, l=   7:        [2] context                          wwwqa.microsoft.com
+  d= 4, l=   9:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.BasicConstraints [2.5.29.19]
+  d= 5, l=   2:      OCTET STRING
+  d= 6, l=   0:       SEQUENCE
+  d= 4, l=  14:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.KeyUsage [2.5.29.15]
+  d= 5, l=   1:      BOOLEAN                                true
+  d= 5, l=   4:      OCTET STRING
+  d= 6, l=   2:       BIT STRING                            A0
+  d= 4, l=  29:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.ExtendedKeyUsage [2.5.29.37]
+  d= 5, l=  22:      OCTET STRING
+  d= 6, l=  20:       SEQUENCE
+  d= 7, l=   8:        OBJECT                               PKIX.ServerAuth [1.3.6.1.5.5.7.3.1]
+  d= 7, l=   8:        OBJECT                               PKIX.ClientAuth [1.3.6.1.5.5.7.3.2]
+  d= 4, l=  97:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.CertificatePolicies [2.5.29.32]
+  d= 5, l=  90:      OCTET STRING
+  d= 6, l=  88:       SEQUENCE
+  d= 7, l=  86:        SEQUENCE
+  d= 8, l=   6:         OBJECT                              2.23.140.1.2.2
+  d= 8, l=  76:         SEQUENCE
+  d= 9, l=  35:          SEQUENCE
+  d=10, l=   8:           OBJECT                            1.3.6.1.5.5.7.2.1
+  d=10, l=  23:           IA5 STRING                        https://d.symcb.com/cps
+  d= 9, l=  37:          SEQUENCE
+  d=10, l=   8:           OBJECT                            1.3.6.1.5.5.7.2.2
+  d=10, l=  25:           SEQUENCE
+  d=11, l=  23:            UTF8 STRING                      https://d.symcb.com/rpa
+  d= 4, l=  31:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.AuthorityKeyIdentifier [2.5.29.35]
+  d= 5, l=  24:      OCTET STRING
+  d= 6, l=  22:       SEQUENCE
+  d= 7, l=  20:        [0] context                          80145F60CF619055DF8443148A602AB2F57AF44318EF
+  d= 4, l=  43:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.CRLDistributionPoints [2.5.29.31]
+  d= 5, l=  36:      OCTET STRING
+  d= 6, l=  34:       SEQUENCE
+  d= 7, l=  32:        SEQUENCE
+  d= 8, l=  30:         cons [0] context
+  d= 9, l=  28:          cons [0] context
+  d=10, l=  10:           [6] context                       http://ss.symcb.com/ss.crl
+  d= 4, l=  87:     SEQUENCE
+  d= 5, l=   8:      OBJECT                                 PKIX.AuthorityInformationAccess [1.3.6.1.5.5.7.1.1]
+  d= 5, l=  75:      OCTET STRING
+  d= 6, l=  73:       SEQUENCE
+  d= 7, l=  31:        SEQUENCE
+  d= 8, l=   8:         OBJECT                              PKIX.OCSP [1.3.6.1.5.5.7.48.1]
+  d= 8, l=   8:         [6] context                         http://ss.symcd.com
+  d= 7, l=  38:        SEQUENCE
+  d= 8, l=   8:         OBJECT                              PKIX.CertificateAuthorityIssuers [1.3.6.1.5.5.7.48.2]
+  d= 8, l=   8:         [6] context                         http://ss.symcb.com/ss.crt
+  d= 4, l= 384:     SEQUENCE
+  d= 5, l=  10:      OBJECT                                 1.3.6.1.4.1.11129.2.4.2
+  d= 5, l= 368:      OCTET STRING
+  d= 6, l= 364:       OCTET STRING                          016A007600DDEB1D2B7A0D4FA6208B81AD8168707E2E8E9D01D55C888D3D11C4CDB6ECBECC0000015B49E33F30000004030047304502202C120993A99E062A5225B952D481EF4E5EB16E03621BF872A7AAD42A3F16EC23022100C985D52BE92DB9B762A275F2A7E0F49771EA0ACE86743858AA4CF80290DA8145007700A4B90990B418581487BB13A2CC67700A3C359804F91BDFB8E377CD0EC80DDC100000015B49E33F7000000403004830460221008B6517805EB1D97BEC542B71A306D951919A939F2636F2FB040E0DB6028B4C64022100E93EC6DBE9CB33EC35E648B57B8E9C9FC689B41E7F16BEA3DF2E925D8689CA57007700EE4BBDB775CE60BAE142691FABE19E66A30F7E5FB072D88300C47B897AA8FDCB0000015B49E3412F0000040300483046022100DC119C89231AE57213DA754DF08E0E8EE64B3761515E473E2FB8364757C56ED6022100C824C1810D0338256ABE99EC7A862AB73EDEA1EF796EA10F79C1E755F1FCC59F
+  d= 1, l=  13:  SEQUENCE
+  d= 2, l=   9:   OBJECT                                    RSA/EMSA3(SHA-256) [1.2.840.113549.1.1.11]
+  d= 2, l=   0:   NULL
+  d= 1, l= 257:  BIT STRING                                 462713C195078A607A226FB4279E2CBA8C363DA6F4696B88677E83E1E8BA5773681BA2EABA141A425CB2E9E065EF2D1037353C7BD31F39C63CB2B0449F0AF1BFBC7E90C175C335437AAED10AA0A15BB67B357E8E9F7DFF2C3D25A467D12878809E114717EEA877175DF255954728BABC5E616B55262EDC494019B6E8301D8D8D676D86731FCECAAF040C6D8D93BA608AD7F76D4065A83BB6E9AEDE3208BE4574213D478764AF0634773B4FA5543AA3523ED795DC1AFC76D8A8AAEA09E0B259ABC6924A82C2F1D5E6F7F18B131EEC9B163CE11A8339FAA52426105F053136B245E51B8BE836EFE6A75671F1FC02CC6F5BF6BE19AE00171E27FE157FD1DC323784
diff --git a/third_party/botan/src/tests/data/asn1_print/output6.txt b/third_party/botan/src/tests/data/asn1_print/output6.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/asn1_print/output6.txt
@@ -0,0 +1,145 @@
+  d= 0, l=2049: SEQUENCE
+  d= 1, l=1513:  SEQUENCE
+  d= 2, l=   3:   cons [0] context
+  d= 3, l=   1:    INTEGER                                  02
+  d= 2, l=   9:   INTEGER                                   C1E986160DA8E982
+  d= 2, l=  13:   SEQUENCE
+  d= 3, l=   9:    OBJECT                                   RSA/EMSA3(SHA-512) [1.2.840.113549.1.1.13]
+  d= 3, l=   0:    NULL
+  d= 2, l= 149:   SEQUENCE
+  d= 3, l=  17:    SET
+  d= 4, l=  15:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Organization [2.5.4.10]
+  d= 5, l=   8:      PRINTABLE STRING                       Free TSA
+  d= 3, l=  16:    SET
+  d= 4, l=  14:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.OrganizationalUnit [2.5.4.11]
+  d= 5, l=   7:      PRINTABLE STRING                       Root CA
+  d= 3, l=  24:    SET
+  d= 4, l=  22:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.CommonName [2.5.4.3]
+  d= 5, l=  15:      PRINTABLE STRING                       www.freetsa.org
+  d= 3, l=  34:    SET
+  d= 4, l=  32:     SEQUENCE
+  d= 5, l=   9:      OBJECT                                 PKCS9.EmailAddress [1.2.840.113549.1.9.1]
+  d= 5, l=  19:      IA5 STRING                             busilezas@gmail.com
+  d= 3, l=  18:    SET
+  d= 4, l=  16:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Locality [2.5.4.7]
+  d= 5, l=   9:      PRINTABLE STRING                       Wuerzburg
+  d= 3, l=  15:    SET
+  d= 4, l=  13:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.State [2.5.4.8]
+  d= 5, l=   6:      PRINTABLE STRING                       Bayern
+  d= 3, l=  11:    SET
+  d= 4, l=   9:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Country [2.5.4.6]
+  d= 5, l=   2:      PRINTABLE STRING                       DE
+  d= 2, l=  30:   SEQUENCE
+  d= 3, l=  13:    UTC TIME                                 2016/03/13 01:57:39 UTC
+  d= 3, l=  13:    UTC TIME                                 2026/03/11 01:57:39 UTC
+  d= 2, l= 265:   SEQUENCE
+  d= 3, l=  17:    SET
+  d= 4, l=  15:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Organization [2.5.4.10]
+  d= 5, l=   8:      PRINTABLE STRING                       Free TSA
+  d= 3, l=  12:    SET
+  d= 4, l=  10:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.OrganizationalUnit [2.5.4.11]
+  d= 5, l=   3:      PRINTABLE STRING                       TSA
+  d= 3, l= 118:    SET
+  d= 4, l= 116:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 2.5.4.13
+  d= 5, l= 109:      PRINTABLE STRING                       This certificate digitally signs documents and time stamp requests made using the freetsa.org online services
+  d= 3, l=  24:    SET
+  d= 4, l=  22:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.CommonName [2.5.4.3]
+  d= 5, l=  15:      PRINTABLE STRING                       www.freetsa.org
+  d= 3, l=  34:    SET
+  d= 4, l=  32:     SEQUENCE
+  d= 5, l=   9:      OBJECT                                 PKCS9.EmailAddress [1.2.840.113549.1.9.1]
+  d= 5, l=  19:      IA5 STRING                             busilezas@gmail.com
+  d= 3, l=  18:    SET
+  d= 4, l=  16:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Locality [2.5.4.7]
+  d= 5, l=   9:      PRINTABLE STRING                       Wuerzburg
+  d= 3, l=  11:    SET
+  d= 4, l=   9:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.Country [2.5.4.6]
+  d= 5, l=   2:      PRINTABLE STRING                       DE
+  d= 3, l=  15:    SET
+  d= 4, l=  13:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X520.State [2.5.4.8]
+  d= 5, l=   6:      PRINTABLE STRING                       Bayern
+  d= 2, l= 546:   SEQUENCE
+  d= 3, l=  13:    SEQUENCE
+  d= 4, l=   9:     OBJECT                                  RSA [1.2.840.113549.1.1.1]
+  d= 4, l=   0:     NULL
+  d= 3, l= 527:    BIT STRING
+  d= 4, l= 522:     SEQUENCE
+  d= 5, l= 513:      INTEGER                                B591048C4E486F34E9DC08627FC2375162236984B82CB130BEFF517CFC38F84BCE5C65A874DAB2621AE0BCE7E33563E0EDE934FD5F8823159F07848808227460C1ED88261706F4281334359DFBB81BD1353FC179610AF1A8C8C865DC00EA23B3A89BE6BD03BA85A9EC827D60565905E22D6A584ED1380AE150280CEE397E98A012F380464007862443BC077CB95F421AF31712D9683CDB6DFFBAF3C8BA5BA566AE523D459D6177346D4D840E27886B7C01C5B890D78A2E27BBA8DD2F9A2812E157D62F921C65962548069DCDB7D06DE181DE0E9570D66F87220CE28B628AB55906F3EE0C210F7051E8F4858AF8B9A92D09E46AF2D9CBA5BFCFAD168CDF604491A4B06603B114CAF7031F065E7EEEFA53C575F3490C059D2E32DDC76AC4D4C4C710683B97FD1BE591BC61055186D88F9A0391B307B6F91ED954DAA36F9ACD6A1E14AA2E4ADF17464B54DB18DBB6FFE30080246547370436CE4E77BAE5DE6FE0F3F9D6E7FFBEB461E794E92FB0951F8AAE61A412CCE9B21074635C8BE327AE1A0F6B4A646EB0F8463BC63BF845530435D19E802511EC9F66C3496952D8BECB69B0AA4D4C41F60515FE7DCBB89319CDDA59BA6AEA4BE3CEAE718E6FCB6CCD7DB9FC50BB15B12F3665B0AA307289C2E6DD4B111CE48BA2D9EFDB5A6B9A506069334FB34F6FC7AE330F0B34208AAC80DF3266FDD90465876BA2CB898D9505315B6E7B
+  d= 5, l=   3:      INTEGER                                010001
+  d= 2, l= 475:   cons [3] context
+  d= 3, l= 471:    SEQUENCE
+  d= 4, l=   9:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.BasicConstraints [2.5.29.19]
+  d= 5, l=   2:      OCTET STRING
+  d= 6, l=   0:       SEQUENCE
+  d= 4, l=  29:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.SubjectKeyIdentifier [2.5.29.14]
+  d= 5, l=  22:      OCTET STRING
+  d= 6, l=  20:       OCTET STRING                          6E760B7B4E4F9CE160CA6D2CE927A2A294B37737
+  d= 4, l=  31:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.AuthorityKeyIdentifier [2.5.29.35]
+  d= 5, l=  24:      OCTET STRING
+  d= 6, l=  22:       SEQUENCE
+  d= 7, l=  20:        [0] context                          8014FA550D8C346651434CF7E7B3A76C95AF7AE6A497
+  d= 4, l=  11:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.KeyUsage [2.5.29.15]
+  d= 5, l=   4:      OCTET STRING
+  d= 6, l=   2:       BIT STRING                            C0
+  d= 4, l=  22:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.ExtendedKeyUsage [2.5.29.37]
+  d= 5, l=   1:      BOOLEAN                                true
+  d= 5, l=  12:      OCTET STRING
+  d= 6, l=  10:       SEQUENCE
+  d= 7, l=   8:        OBJECT                               PKIX.TimeStamping [1.3.6.1.5.5.7.3.8]
+  d= 4, l=  99:     SEQUENCE
+  d= 5, l=   8:      OBJECT                                 PKIX.AuthorityInformationAccess [1.3.6.1.5.5.7.1.1]
+  d= 5, l=  87:      OCTET STRING
+  d= 6, l=  85:       SEQUENCE
+  d= 7, l=  42:        SEQUENCE
+  d= 8, l=   8:         OBJECT                              PKIX.CertificateAuthorityIssuers [1.3.6.1.5.5.7.48.2]
+  d= 8, l=   8:         [6] context                         http://www.freetsa.org/tsa.crt
+  d= 7, l=  39:        SEQUENCE
+  d= 8, l=   8:         OBJECT                              PKIX.OCSP [1.3.6.1.5.5.7.48.1]
+  d= 8, l=   8:         [6] context                         http://www.freetsa.org:2560
+  d= 4, l=  55:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.CRLDistributionPoints [2.5.29.31]
+  d= 5, l=  48:      OCTET STRING
+  d= 6, l=  46:       SEQUENCE
+  d= 7, l=  44:        SEQUENCE
+  d= 8, l=  42:         cons [0] context
+  d= 9, l=  40:          cons [0] context
+  d=10, l=  38:           [6] context                       8626687474703A2F2F7777772E667265657473612E6F72672F63726C2F726F6F745F63612E63726C
+  d= 4, l= 198:     SEQUENCE
+  d= 5, l=   3:      OBJECT                                 X509v3.CertificatePolicies [2.5.29.32]
+  d= 5, l= 190:      OCTET STRING
+  d= 6, l= 187:       SEQUENCE
+  d= 7, l= 184:        SEQUENCE
+  d= 8, l=   1:         OBJECT                              0.0
+  d= 8, l= 178:         SEQUENCE
+  d= 9, l=  51:          SEQUENCE
+  d=10, l=   8:           OBJECT                            1.3.6.1.5.5.7.2.1
+  d=10, l=  39:           IA5 STRING                        http://www.freetsa.org/freetsa_cps.html
+  d= 9, l=  50:          SEQUENCE
+  d=10, l=   8:           OBJECT                            1.3.6.1.5.5.7.2.1
+  d=10, l=  38:           IA5 STRING                        http://www.freetsa.org/freetsa_cps.pdf
+  d= 9, l=  71:          SEQUENCE
+  d=10, l=   8:           OBJECT                            1.3.6.1.5.5.7.2.2
+  d=10, l=  59:           SEQUENCE
+  d=11, l=  57:            VISIBLE STRING                   FreeTSA trusted timestamping Software as a Service (SaaS)
+  d= 1, l=  13:  SEQUENCE
+  d= 2, l=   9:   OBJECT                                    RSA/EMSA3(SHA-512) [1.2.840.113549.1.1.13]
+  d= 2, l=   0:   NULL
+  d= 1, l= 513:  BIT STRING                                 A5C944E2C6FAC0A14D930A7FD0A0B172B41FC1483C3E957C68A2BCD9B9764F1A950161FD72472D41A5EED277786203B5422240FB3A26CDE176087B6FB1011DF4CC19E2571AA4A051109665E94C46F50BD2ADEE6AC4137E251B25A39DABDA451515D8FF9E07209E8EC20B7874F7E1A0EDE7C00937FE84A334F8B3265CED2D8ED9DF61396583677FEB382C1EE3B23E6EA5F05DF30DE7B9F89005D25266F612F39C8B4F6DABA6D7BFBAC19632B90637329F52A6F066A10E43EAA81F849A6C5FE3FE8B5EA23275F687F2052E502EA6C30762A668CCE07871DD8E97E315BBA929E25589977A0A312CE96C5106B1437C779F2B361B182888F3EE8A234374FA063E956192627F7C431073965D1260928EBA009E803429AE324CF96F042354F37BCA5AFDDC79F79346AB388BFC79F01DC9861254EA6CC129941076B83D20556F3BE51326837F2876F7833B370E7C3D410523827D4F53400C72218D75229FF10C6F8893A9A3A1C0C42BB4C898C13DF41C7F6573B4FC56515971A610A7B0D2857C8225A9FB204EACECA2E8971AA1AF87886A2AE3C72FE0A0AAE842980A77BEF16B92115458090D982B5946603764E75A0AD3D11454B9986F678B9AB6AFE8497033AE3ABFD4EB43B7BC9DEE68815949E6481582A82E785277F2282107EFE390200E0508ACB8EA82EA2505276F3C9DA2A3D3B4AD38BBF8842BDA36FC2448291F558DC02DD1E0
diff --git a/third_party/botan/src/tests/data/tls-policy/bsi.txt b/third_party/botan/src/tests/data/tls-policy/bsi.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/tls-policy/bsi.txt
@@ -0,0 +1,22 @@
+allow_tls10 = false
+allow_tls11 = false
+allow_tls12 = true
+allow_dtls10 = false
+allow_dtls12 = false
+
+ciphers = AES-256/GCM AES-128/GCM AES-256/CCM AES-128/CCM AES-256 AES-128
+signature_hashes = SHA-512 SHA-384 SHA-256
+macs = AEAD SHA-384 SHA-256
+key_exchange_methods = ECDH DH ECDHE_PSK DHE_PSK
+signature_methods = ECDSA RSA DSA
+key_exchange_groups = brainpool512r1 brainpool384r1 brainpool256r1 secp384r1 secp256r1 ffdhe/ietf/4096 ffdhe/ietf/3072 ffdhe/ietf/2048
+minimum_dh_group_size = 2000
+minimum_dsa_group_size = 2000
+minimum_ecdh_group_size = 250
+minimum_ecdsa_group_size = 250
+minimum_rsa_bits = 2000
+
+allow_insecure_renegotiation = false
+allow_server_initiated_renegotiation = true
+server_uses_own_ciphersuite_preferences = true
+negotiate_encrypt_then_mac = true
diff --git a/third_party/botan/src/tests/data/tls-policy/compat.txt b/third_party/botan/src/tests/data/tls-policy/compat.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/tls-policy/compat.txt
@@ -0,0 +1,30 @@
+# There is no corresponding type for this text policy but it is useful
+# for interop testing and fuzz testing
+
+# It is based on the default policy, but allows 3DES, SHA-1 signatures,
+# static RSA, reduces the ephemeral key sizes, and removes some
+# non-standard ciphersuites
+
+allow_tls10 = true
+allow_tls11 = true
+allow_tls12 = true
+allow_dtls10 = false
+allow_dtls12 = false
+ciphers = ChaCha20Poly1305 AES-256/GCM AES-128/GCM AES-256 AES-128 3DES
+macs = AEAD SHA-256 SHA-384 SHA-1
+signature_hashes = SHA-512 SHA-384 SHA-256 SHA-1
+signature_methods = ECDSA RSA IMPLICIT
+key_exchange_methods = ECDH DH RSA
+key_exchange_groups = x25519 secp256r1 secp521r1 secp384r1 brainpool256r1 brainpool384r1 brainpool512r1 ffdhe/ietf/2048 ffdhe/ietf/3072 ffdhe/ietf/4096 ffdhe/ietf/6144 ffdhe/ietf/8192
+allow_insecure_renegotiation = false
+include_time_in_hello_random = true
+allow_client_initiated_renegotiation = true
+allow_server_initiated_renegotiation = false
+hide_unknown_users = false
+server_uses_own_ciphersuite_preferences = true
+negotiate_encrypt_then_mac = true
+session_ticket_lifetime = 86400
+minimum_dh_group_size = 1024
+minimum_ecdh_group_size = 255
+minimum_rsa_bits = 1024
+minimum_signature_strength = 80
diff --git a/third_party/botan/src/tests/data/tls-policy/datagram.txt b/third_party/botan/src/tests/data/tls-policy/datagram.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/tls-policy/datagram.txt
@@ -0,0 +1,23 @@
+allow_tls10 = false
+allow_tls11 = false
+allow_tls12 = false
+allow_dtls10 = false
+allow_dtls12 = true
+ciphers = ChaCha20Poly1305 AES-256/GCM AES-128/GCM
+macs = AEAD
+signature_hashes = SHA-512 SHA-384 SHA-256
+signature_methods = ECDSA RSA
+key_exchange_methods = CECPQ1 ECDH DH
+key_exchange_groups = x25519 secp256r1 brainpool256r1 secp384r1 brainpool384r1 secp521r1 brainpool512r1 ffdhe/ietf/2048 ffdhe/ietf/3072 ffdhe/ietf/4096 ffdhe/ietf/6144 ffdhe/ietf/8192
+allow_insecure_renegotiation = false
+include_time_in_hello_random = true
+allow_server_initiated_renegotiation = false
+hide_unknown_users = false
+server_uses_own_ciphersuite_preferences = true
+negotiate_encrypt_then_mac = true
+session_ticket_lifetime = 86400
+dh_group = modp/ietf/2048
+minimum_dh_group_size = 2048
+minimum_ecdh_group_size = 255
+minimum_rsa_bits = 2048
+minimum_signature_strength = 110
diff --git a/third_party/botan/src/tests/data/tls-policy/default.txt b/third_party/botan/src/tests/data/tls-policy/default.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/tls-policy/default.txt
@@ -0,0 +1,22 @@
+allow_tls10 = false
+allow_tls11 = false
+allow_tls12 = true
+allow_dtls10 = false
+allow_dtls12 = true
+ciphers = ChaCha20Poly1305 AES-256/GCM AES-128/GCM
+macs = AEAD SHA-256 SHA-384 SHA-1
+signature_hashes = SHA-512 SHA-384 SHA-256
+signature_methods = ECDSA RSA
+key_exchange_methods = CECPQ1 ECDH DH
+key_exchange_groups = x25519 secp256r1 brainpool256r1 secp384r1 brainpool384r1 secp521r1 brainpool512r1 ffdhe/ietf/2048 ffdhe/ietf/3072 ffdhe/ietf/4096 ffdhe/ietf/6144 ffdhe/ietf/8192
+allow_insecure_renegotiation = false
+include_time_in_hello_random = true
+allow_server_initiated_renegotiation = false
+hide_unknown_users = false
+server_uses_own_ciphersuite_preferences = true
+negotiate_encrypt_then_mac = true
+session_ticket_lifetime = 86400
+minimum_dh_group_size = 2048
+minimum_ecdh_group_size = 255
+minimum_rsa_bits = 2048
+minimum_signature_strength = 110
diff --git a/third_party/botan/src/tests/data/tls-policy/strict.txt b/third_party/botan/src/tests/data/tls-policy/strict.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/tls-policy/strict.txt
@@ -0,0 +1,22 @@
+allow_tls10 = false
+allow_tls11 = false
+allow_tls12 = true
+allow_dtls10 = false
+allow_dtls12 = true
+ciphers = ChaCha20Poly1305 AES-256/GCM AES-128/GCM
+macs = AEAD
+signature_hashes = SHA-512 SHA-384
+signature_methods = ECDSA RSA
+key_exchange_methods = CECPQ1 ECDH
+key_exchange_groups = x25519 secp256r1 brainpool256r1 secp384r1 brainpool384r1 secp521r1 brainpool512r1 ffdhe/ietf/2048 ffdhe/ietf/3072 ffdhe/ietf/4096 ffdhe/ietf/6144 ffdhe/ietf/8192
+allow_insecure_renegotiation = false
+include_time_in_hello_random = true
+allow_server_initiated_renegotiation = false
+hide_unknown_users = false
+server_uses_own_ciphersuite_preferences = true
+negotiate_encrypt_then_mac = true
+session_ticket_lifetime = 86400
+minimum_dh_group_size = 2048
+minimum_ecdh_group_size = 255
+minimum_rsa_bits = 2048
+minimum_signature_strength = 110
diff --git a/third_party/botan/src/tests/data/tls-policy/suiteb_128.txt b/third_party/botan/src/tests/data/tls-policy/suiteb_128.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/tls-policy/suiteb_128.txt
@@ -0,0 +1,22 @@
+allow_tls10 = false
+allow_tls11 = false
+allow_tls12 = true
+allow_dtls10 = false
+allow_dtls12 = false
+ciphers = AES-128/GCM
+macs = AEAD
+signature_hashes = SHA-256
+signature_methods = ECDSA
+key_exchange_methods = ECDH
+key_exchange_groups = secp256r1
+allow_insecure_renegotiation = false
+include_time_in_hello_random = true
+allow_server_initiated_renegotiation = false
+hide_unknown_users = false
+server_uses_own_ciphersuite_preferences = true
+negotiate_encrypt_then_mac = true
+session_ticket_lifetime = 86400
+minimum_dh_group_size = 2048
+minimum_ecdh_group_size = 255
+minimum_rsa_bits = 2048
+minimum_signature_strength = 128
diff --git a/third_party/botan/src/tests/data/tls-policy/suiteb_192.txt b/third_party/botan/src/tests/data/tls-policy/suiteb_192.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/tls-policy/suiteb_192.txt
@@ -0,0 +1,22 @@
+allow_tls10 = false
+allow_tls11 = false
+allow_tls12 = true
+allow_dtls10 = false
+allow_dtls12 = false
+ciphers = AES-256/GCM
+macs = AEAD
+signature_hashes = SHA-384
+signature_methods = ECDSA
+key_exchange_methods = ECDH
+key_exchange_groups = secp384r1
+allow_insecure_renegotiation = false
+include_time_in_hello_random = true
+allow_server_initiated_renegotiation = false
+hide_unknown_users = false
+server_uses_own_ciphersuite_preferences = true
+negotiate_encrypt_then_mac = true
+session_ticket_lifetime = 86400
+minimum_dh_group_size = 2048
+minimum_ecdh_group_size = 255
+minimum_rsa_bits = 2048
+minimum_signature_strength = 192
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_01/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_01/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_01/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_01
+
+Purpose: Checks the behaviour of the application when it cannot locate revocation information about the certificate. This path is invalid because revocation information for a certificate is not available.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_02/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_02/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_02/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_02
+
+Purpose: Checks the behaviour of the application when the target certificate is contained in a CRL. This path is invalid because the target certificate is revoked.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_03/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_03/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_03/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_03
+
+Purpose: Checks the behaviour of the application when an intermediate certificate is contained in a CRL. This path is invalid because a CA certificate is revoked.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_04/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_04/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_04/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_04
+
+Purpose: Checks the behaviour of the application when the signature of the CRL is wrong. The target certificate is not contained in the CRL. This path is invalid because the signature of a CRL is wrong.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_05/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_05/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_05/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_05
+
+Purpose: Checks the behaviour of the application when a CRL contains an unknown non-critical extension. The target certificate is contained in this CRL. This path is invalid because it is allowed for an application to ignore unknown non-critical extensions.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_06/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_06/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_06/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_06
+
+Purpose: Checks the behaviour of the application when a CRL contains an unknown critical extension. The target certificate is not contained in this CRL. This path is invalid because it is not allowed for an application to ignore unknown critical extensions.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_07/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_07/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_07/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_07
+
+Purpose: Checks the behaviour of the application when the target certificate is contained in a CRL that does not contain the Authority Key Identifier extension. This path is invalid because even if this mandatory extension is missing the CRL is still a valid source for revocation information.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_08/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_08/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_08/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_08
+
+Purpose: Checks the behaviour of the application when a CRL is not valid yet (now < thisUpdate). The target certificate is not contained in the CRL. This path is invalid because the CRL is not valid yet.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_09/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_09/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_09/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_09
+
+Purpose: Checks the behaviour of the application when a CRL has expired (now > nextUpdate). The target certificate is not contained in the CRL. This path is invalid because the CRL has expired.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_10/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_10/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_10/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_10
+
+Purpose: Checks the behaviour of the application when the target certificate is contained in a CRL and this certificate has a negative serial number. This path is invalid because the certificate, even if malformed, is revoked.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_11/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_11/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_11/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_11
+
+Purpose: Checks the behaviour of the application when a CRL contains a CRL Entry with an unknown critical extension. This path is invalid because the application cannot process the critical extension.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_12/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_12/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_12/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_12
+
+Purpose: Checks the behaviour of the application when the CRL's signature can be verified by a certificate whose certification path is invalid. This path is invalid because revocation information for a certificate is not available.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_13/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_13/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_13/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_13
+
+Purpose: Checks the behaviour of the application when the certificate's CRL distribution point and the issuing distribution point of a CRL issued by the issuer of the certificate do not match. The target certificate is not contained in the CRL. This path is invalid because the CRL located at the CRLDP of the certificate has a different distribution point and no other CRLs for determining the status of the certificate are available.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_14/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_14/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_14/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_14
+
+Purpose: Checks the behaviour of the application when the CRL does not have a signature. This path is invalid because the integrity and authenticity of the source of revocation information cannot be verified.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_15/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_15/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_15/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_15
+
+Purpose: Checks the behaviour of the application when the CRL for an intermediate certificate is missing. This path is invalid because revocation information for a CA certificate in the path is not available. Furthermore, no CRL with matching distribution point can be found.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_16/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_16/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_CRL_16/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRL_16
+
+Purpose: Checks the behaviour of the application when the intermediate certificate is revoked. This path is invalid because a CA certificate in the path is revoked.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_algo_strength_01/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_algo_strength_01/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_algo_strength_01/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_ALGO_STRENGTH_01
+
+Purpose: Checks the behaviour of the application when an insecure hash algorithm has been used in the production of the intermediate certificate's signature. This path is not valid, because the hash algorithm is insecure.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_algo_strength_02/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_algo_strength_02/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_algo_strength_02/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_ALGO_STRENGTH_02
+
+Purpose: Checks the behaviour of the application when an insecure hash algorithm has been used in the production of the target certificate's signature. This path is not valid, because the hash algorithm is insecure.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_algo_strength_03/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_algo_strength_03/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_algo_strength_03/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_ALGO_STRENGTH_03
+
+Purpose: Checks the behaviour of the application when the last intermediate certificate contains an RSA public key with exponent e=3 and the target certificate features a malformed signature the acceptance of which indicates an implementation flaw that allows the Bleichenbacher's Low Exponent Attack. This path is invalid because the certificate's signature is invalid.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_01/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_01/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_01/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_01
+
+Purpose: Positive test checking whether the application can verify certificates. This path conforms to RFC 5280 specification and is valid.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_02/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_02/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_02/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_02
+
+Purpose: Checks the behaviour of the application when no certificate is on the application's set of trust anchors. This path is not valid, because the application cannot build a path to one trust anchor.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_03/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_03/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_03/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_03
+
+Purpose: Checks the behaviour of the application when the signature algorithm in the TBS part of the certificate and the one outside the TBS part are not the same. This path is not valid, because the application cannot decide which algorithm to use for validating the certificate's signature.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_04/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_04/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_04/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_04
+
+Purpose: Checks the behaviour of the application when the signature algorithm of the target certificate is unknown. This path is not valid, because the application cannot verify the certificate's signature.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_05/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_05/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_05/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_05
+
+Purpose: Checks the behaviour of the application when a certificate has a wrong DER encoding. This path is not valid, because the certificate is not a properly encoded structure.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_06/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_06/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_06/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_06
+
+Purpose: Checks the behaviour of the application when the serial number of the certificate is negative. This path is not valid, because serial number must be positive integers. However, negative numbers should be gracefully handled.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_07/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_07/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_07/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_07
+
+Purpose: Checks the behaviour of the application when an intermediate certificate is not valid yet (now < notBefore). This path is not valid, because one CA certificate is not valid yet.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_08/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_08/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_08/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_08
+
+Purpose: Checks the behaviour of the application when an intermediate certificate has expired (now > notAfter). This path is not valid, because one CA certificate has expired.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_09/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_09/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_09/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_09
+
+Purpose: Checks the behaviour of the application when the target certificate is not valid yet (now < notBefore). This path is not valid, because the target certificate is not valid yet.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_10/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_10/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_10/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_10
+
+Purpose: Checks the behaviour of the application when the target certificate has expired (now > notAfter). This path is not valid, because the target certificate has expired.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_11/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_11/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_11/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_11
+
+Purpose: Checks the behaviour of the application when a certificate contains an invalid version (e.g. 5). This path is not valid, because the certificate has an invalid version.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_12/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_12/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_12/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_12
+
+Purpose: Checks the behaviour of the application when a component of the subjectDN is longer than the allowed length. This path is not valid, because the length of one component of the subjectDN is longer than allowed. However, applications may decide to gracefully handle longer names.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_13/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_13/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_13/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_13
+
+Purpose: Checks the behaviour of the application when a self-issued certificate is found in the path. This path is not invalid, because self-issued certificates are allowed in the path and processing rules have been specified.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_common_14/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_14/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_common_14/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_COMMON_14
+
+Purpose: Checks the behaviour of the application when it should construct and validate a path based on a set of certificates, for which a valid path can be constructed but where invalid paths can be constructed as well. Failing this test indicates that the application does not perform an exhaustive search for all possible paths.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_crypt_01/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_crypt_01/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_crypt_01/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRYPT_01
+
+Purpose: Checks the behaviour of the application when the signature of the intermediate certificate is wrong. This path is invalid because the signature of a CA certificate is invalid.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_crypt_02/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_crypt_02/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_crypt_02/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_CRYPT_02
+
+Purpose: Checks the behaviour of the application when the signature of the target certificate is wrong. This path is invalid because the signature of the target certificate is invalid.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_01/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_01/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_01/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_01
+
+Purpose: Checks the behaviour of the application when a v1 certificate contains extensions. Certificates of version v1 are not allowed to contain extensions and therefore this path is invalid.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_02/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_02/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_02/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_02
+
+Purpose: Checks the behaviour of the application when a v2 certificate contains extensions. Certificates of version v2 are not allowed to contain extensions and therefore this path is invalid.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_03/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_03/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_03/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_03
+
+Purpose: Checks the behaviour of the application when a v3 certificate contains an unknown non-critical extension. This path is valid because a client application does not necessarily need to be able to parse and interpret such extensions.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_04/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_04/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_04/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_04
+
+Purpose: Checks the behaviour of the application when a v3 certificate contains an unknown critical extension. This path is invalid because a client application must parse and interpret such extensions.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_05/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_05/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_05/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_05
+
+Purpose: Checks the behaviour of the application when a certificate contains an extension two times, possibly with different values. This path is invalid because this is not allowed and additionally the client could not decide which to use.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_06/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_06/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_06/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_06
+
+Purpose: Checks the behaviour of the application when an intermediate certificate does not have the Basic Constraints extension. This path is invalid because this extension must be placed in every intermediate certificate and an application must check that an intermediate certificate is allowed to issue other certificates.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_07/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_07/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_07/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_07
+
+Purpose: Checks the behaviour of the application when an intermediate certificate has cA=false in the Basic Constraints extension. This path is invalid because an intermediate certificate must contain the Basic Constraints extensions with the value cA=true.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_08/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_08/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_08/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_08
+
+Purpose: Checks the behaviour of the application when the first intermediate certificate in a certification path of length 3 has pathLenConstraint=0 in the Basic Constraints extension. This path is invalid because the last intermediate certificate is not allowed to issue other certificates.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_09/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_09/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_09/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_09
+
+Purpose: Checks the behaviour of the application when the target certificate does not contain the Authority Key Identifier Extension. This path is valid, although this certificate does not support path construction because of the missing AKIE.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_10/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_10/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_10/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_10
+
+Purpose: Checks the behaviour of the application when a critical extension has a wrong value. This path is invalid because a client application must parse and interpret critical extensions.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_11/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_11/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_11/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_11
+
+Purpose: Checks the behaviour of the application when an intermediate certificate does not contain the keyCertSign value in the Key Usage extension. This path is invalid because an intermediate certificate must have this value in this extension.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_12/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_12/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_12/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_12
+
+Purpose: Checks the behaviour of the application when the target certificate contains a policy OID two times in the Certificates Policies Extension. A policy OID is allowed to be contained only one time within this extension and therefore this path is invalid.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_13/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_13/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_13/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_13
+
+Purpose: Checks the behaviour of the application when the intermediate certificate contains a Policy Mappings Extension which maps a policy to anyPolicy. This path is invalid because it is not allowed to map a concrete policy to the special anyPolicy.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_14/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_14/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_14/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_14
+
+Purpose: Checks the behaviour of the application when the target certificate is a CA certificate that contains a Policy Mappings Extension which maps a policy to the anyPolicy. This path is invalid because it is not allowed to map a concrete policy to the special anyPolicy. The RFC 5280 validation algorithm does not explicitly verify that.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_15/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_15/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_15/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_15
+
+Purpose: Checks the behaviour of an application when the target certificate, which is not a CA, contains the Name Constraints extension. Name Constraints is only allowed in CA certificates and therefore this path is invalid.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_16/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_16/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_16/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_16
+
+Purpose: Checks the behaviour of an application when the intermediate certificate contains a non-critical Name Constraints extension. This path is invalid because this extension must be critical.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_17/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_17/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_17/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_17
+
+Purpose: Checks the behaviour of an application when the intermediate certificate contains a non-critical Policy Constraints extension. This path is invalid because this extension must be critical.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_18/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_18/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_18/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_18
+
+Purpose: Checks the behaviour of an application when the intermediate certificate contains a Policy Constraints extension with requireExplicitPolicy=0 and the target certificate does not have the Certificate Policies extension. This path is invalid because an explicit policy is required but the last certificate in the path renders it impossible.
diff --git a/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_19/description.txt b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_19/description.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/cert_path_ext_19/description.txt
@@ -0,0 +1,3 @@
+Test Case: CERT_PATH_EXT_19
+
+Purpose: Checks the behaviour of an application when the first intermediate certificate in a certification path of length 3 contains a Policy Constraints extension with inhibitPolicyMapping=0 and requireExplicitPolicy=0. The next certificate in the path has a Policy Mappings extension which maps the only valid policy of the path to another policy. Every certificate has the same policy. This path is invalid because the inhibited policy mapping renders it impossible to have a valid policy.
diff --git a/third_party/botan/src/tests/data/x509/bsi/expected.txt b/third_party/botan/src/tests/data/x509/bsi/expected.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/expected.txt
@@ -0,0 +1,54 @@
+cert_path_algo_strength_01$Hash function used is considered too weak for security
+cert_path_algo_strength_02$Hash function used is considered too weak for security
+cert_path_algo_strength_03$Signature error
+cert_path_common_01$Verified
+cert_path_common_02$Cannot establish trust
+cert_path_common_03$CERTIFICATE decoding failed with X.509 Certificate had differing algorithm identifers in inner and outer ID fields
+cert_path_common_04$Certificate signed with unknown/unavailable algorithm
+cert_path_common_05$CERTIFICATE decoding failed with BER: Value truncated
+cert_path_common_06$Warning: Certificate serial number is negative
+cert_path_common_07$Certificate is not yet valid
+cert_path_common_08$Certificate has expired
+cert_path_common_09$Certificate is not yet valid
+cert_path_common_10$Certificate has expired
+cert_path_common_11$CERTIFICATE decoding failed with Unknown X.509 cert version 5
+cert_path_common_12$Warning: Distinguished name too long
+cert_path_common_13$Verified
+cert_path_common_14$Verified
+cert_path_CRL_01$No revocation data
+cert_path_CRL_02$Certificate is revoked
+cert_path_CRL_03$Certificate is revoked
+cert_path_CRL_04$CRL bad signature
+cert_path_CRL_05$Certificate is revoked
+cert_path_CRL_06$Certificate is revoked
+cert_path_CRL_07$Certificate is revoked
+cert_path_CRL_08$CRL response is not yet valid
+cert_path_CRL_09$CRL has expired
+cert_path_CRL_10$Certificate is revoked
+cert_path_CRL_11$Certificate is revoked
+cert_path_CRL_12$No revocation data
+cert_path_CRL_13$No CRL with matching distribution point for certificate
+cert_path_CRL_14$X509 CRL decoding failed with BER: Tag mismatch when decoding object got EOF expected BIT STRING/UNIVERSAL
+cert_path_CRL_15$No CRL with matching distribution point for certificate
+cert_path_CRL_16$Certificate is revoked
+cert_path_crypt_01$Signature error
+cert_path_crypt_02$Signature error
+cert_path_ext_01$Encountered extension in certificate with version that does not allow it
+cert_path_ext_02$Encountered extension in certificate with version that does not allow it
+cert_path_ext_03$Verified
+cert_path_ext_04$Unknown critical extension encountered
+cert_path_ext_05$Duplicate certificate extension encountered
+cert_path_ext_06$CA certificate not allowed to issue certs
+cert_path_ext_07$CA certificate not allowed to issue certs
+cert_path_ext_08$Certificate chain too long
+cert_path_ext_09$Verified
+cert_path_ext_10$Unknown critical extension encountered
+cert_path_ext_11$CA certificate not allowed to issue certs
+cert_path_ext_12$Certificate contains duplicate policy
+cert_path_ext_13$Unknown critical extension encountered
+cert_path_ext_14$Unknown critical extension encountered
+cert_path_ext_15$Certificate does not pass name constraint
+cert_path_ext_16$Certificate does not pass name constraint
+#cert_path_ext_17$
+cert_path_ext_18$Unknown critical extension encountered
+cert_path_ext_19$Unknown critical extension encountered
diff --git a/third_party/botan/src/tests/data/x509/bsi/readme.txt b/third_party/botan/src/tests/data/x509/bsi/readme.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/bsi/readme.txt
@@ -0,0 +1,14 @@
+The test cases were developed during a project with the German BSI.
+
+Each test case contains
+* An end certificate that is to be validated: contains "TC" in its certificate file name
+* A trusted CA certificate: contains "TA" in its certificate file name
+* A set of sub CA certificates that may or may not be needed to construct a patht from TC to TA
+* A description.txt file that explains what the is meant to be tested
+
+expected.txt contains the status code that is expected as the path validation
+output for each test case. The expected output may also be the message string
+of an exception.
+
+Certificate revocation lists must be checked if and only if the test directory
+has "CRL" in its filename.
diff --git a/third_party/botan/src/tests/data/x509/extended/expected.txt b/third_party/botan/src/tests/data/x509/extended/expected.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/extended/expected.txt
@@ -0,0 +1,3 @@
+01:Verified
+02:Verified
+03:Verified
diff --git a/third_party/botan/src/tests/data/x509/nist/expected.txt b/third_party/botan/src/tests/data/x509/nist/expected.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/nist/expected.txt
@@ -0,0 +1,76 @@
+test01:Verified
+test02:Signature error
+test03:Signature error
+test04:Verified
+test05:Certificate is not yet valid
+test06:Certificate is not yet valid
+test07:Verified
+test08:Certificate is not yet valid
+test09:Certificate has expired
+test10:Certificate has expired
+test11:Certificate has expired
+test12:Verified
+test13:Certificate issuer not found
+test14:Certificate issuer not found
+test15:Verified
+test16:Verified
+test17:Verified
+test18:Verified
+test19:No revocation data
+test20:Certificate is revoked
+test21:Certificate is revoked
+test22:CA certificate not allowed to issue certs
+test23:CA certificate not allowed to issue certs
+test24:Verified
+test25:CA certificate not allowed to issue certs
+test26:Verified
+test27:Verified
+test28:CA certificate not allowed to issue certs
+test29:CA certificate not allowed to issue certs
+test30:Verified
+test31:CA certificate not allowed to issue CRLs
+test32:CA certificate not allowed to issue CRLs
+test33:Verified
+test34:Verified
+test35:Verified
+test36:Verified
+test37:Verified
+test38:Verified
+test39:Verified
+test40:Verified
+test41:Verified
+test42:Verified
+test43:Verified
+test44:Verified
+#test45:Explicit policy required
+#test46:
+#test47:Explicit policy required
+test48:Verified
+test49:Verified
+test50:Verified
+test51:Verified
+test52:Verified
+test53:Verified
+test54:Certificate chain too long
+test55:Certificate chain too long
+test56:Verified
+test57:Verified
+test58:Certificate chain too long
+test59:Certificate chain too long
+test60:Certificate chain too long
+test61:Certificate chain too long
+test62:Verified
+test63:Verified
+test64:CRL bad signature
+test65:No revocation data
+test66:No revocation data
+test67:Verified
+test68:Certificate is revoked
+test69:Certificate is revoked
+test70:Certificate is revoked
+test71:Certificate is revoked
+test72:CRL has expired
+test73:CRL has expired
+test74:Verified
+#test75:
+#test76:
diff --git a/third_party/botan/src/tests/data/x509/pss_certs/01/README.txt b/third_party/botan/src/tests/data/x509/pss_certs/01/README.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/pss_certs/01/README.txt
@@ -0,0 +1,1 @@
+default params
diff --git a/third_party/botan/src/tests/data/x509/pss_certs/02/README.txt b/third_party/botan/src/tests/data/x509/pss_certs/02/README.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/pss_certs/02/README.txt
@@ -0,0 +1,1 @@
+empty params
diff --git a/third_party/botan/src/tests/data/x509/pss_certs/109/README.txt b/third_party/botan/src/tests/data/x509/pss_certs/109/README.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/pss_certs/109/README.txt
@@ -0,0 +1,1 @@
+crl with invalid signature
diff --git a/third_party/botan/src/tests/data/x509/pss_certs/97/README.txt b/third_party/botan/src/tests/data/x509/pss_certs/97/README.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/pss_certs/97/README.txt
@@ -0,0 +1,1 @@
+SigHash != MGF Hash
diff --git a/third_party/botan/src/tests/data/x509/pss_certs/98/README.txt b/third_party/botan/src/tests/data/x509/pss_certs/98/README.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/pss_certs/98/README.txt
@@ -0,0 +1,1 @@
+bad salt length
diff --git a/third_party/botan/src/tests/data/x509/pss_certs/99/README.txt b/third_party/botan/src/tests/data/x509/pss_certs/99/README.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/pss_certs/99/README.txt
@@ -0,0 +1,1 @@
+bad signature
diff --git a/third_party/botan/src/tests/data/x509/pss_certs/Sources.txt b/third_party/botan/src/tests/data/x509/pss_certs/Sources.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/pss_certs/Sources.txt
@@ -0,0 +1,6 @@
+01-02: http://www.kaiser.cx/x509Pss.html
+03-04: R&S Cybersecurity GmbH (Daniel Neus)
+05-96: golang/go - GitHub User @lwithers - https://github.com/golang/go/issues/15958
+97-106: mbed TLS / PolarSSL GitHub Repo
+107: unknown
+108-118: mbed TLS / PolarSSL GitHub Repo
diff --git a/third_party/botan/src/tests/data/x509/pss_certs/expected.txt b/third_party/botan/src/tests/data/x509/pss_certs/expected.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/pss_certs/expected.txt
@@ -0,0 +1,118 @@
+01:Verified
+02:Verified
+03:Verified
+04:Verified
+05:Verified
+06:Verified
+07:Verified
+08:Verified
+09:Verified
+10:Verified
+11:Verified
+12:Verified
+13:Verified
+14:Verified
+15:Verified
+16:Verified
+17:Verified
+18:Verified
+19:Verified
+20:Verified
+21:Verified
+22:Verified
+23:Verified
+24:Verified
+25:Verified
+26:Verified
+27:Verified
+28:Verified
+29:Verified
+30:Verified
+31:Verified
+32:Verified
+33:Verified
+34:Verified
+35:Verified
+36:Verified
+37:Verified
+38:Verified
+39:Verified
+40:Verified
+41:Verified
+42:Verified
+43:Verified
+44:Verified
+45:Verified
+46:Verified
+47:Verified
+48:Verified
+49:Verified
+50:Verified
+51:Verified
+52:Verified
+53:Verified
+54:Verified
+55:Verified
+56:Verified
+57:Verified
+58:Verified
+59:Verified
+60:Verified
+61:Verified
+62:Verified
+63:Verified
+64:Verified
+65:Verified
+66:Verified
+67:Verified
+68:Verified
+69:Verified
+70:Verified
+71:Verified
+72:Verified
+73:Verified
+74:Verified
+75:Verified
+76:Verified
+77:Verified
+78:Verified
+79:Verified
+80:Verified
+81:Verified
+82:1
+83:1
+84:1
+85:1
+86:1
+87:1
+88:1
+89:1
+90:1
+91:1
+92:1
+93:1
+94:1
+95:1
+96:1
+97:Certificate signature has invalid parameters
+98:Signature error
+99:Signature error
+100:Verified
+101:Verified
+102:Verified
+103:Verified
+104:Verified
+105:Verified
+106:Verified
+107:1
+108:Verified
+109:CRL bad signature
+110:Verified
+111:Verified
+112:Verified
+113:Verified
+114:1
+115:1
+116:1
+117:1
+118:1
diff --git a/third_party/botan/src/tests/data/x509/pss_certs/validation_times.txt b/third_party/botan/src/tests/data/x509/pss_certs/validation_times.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/pss_certs/validation_times.txt
@@ -0,0 +1,118 @@
+01:2016
+02:2016
+03:2017
+04:2017
+05:2017
+06:2017
+07:2017
+08:2017
+09:2017
+10:2017
+11:2016
+12:2015
+13:2015
+14:2015
+15:2016
+16:2017
+17:2017
+18:2017
+19:2017
+20:2017
+21:2017
+22:2017
+23:2017
+24:2017
+25:2017
+26:2017
+27:2017
+28:2017
+29:2017
+30:2017
+31:2017
+32:2017
+33:2017
+34:2017
+35:2017
+36:2017
+37:2017
+38:2017
+39:2017
+40:2017
+41:2017
+42:2016
+43:2017
+44:2017
+45:2015
+46:2017
+47:2017
+48:2017
+49:2017
+50:2017
+51:2017
+52:2017
+53:2017
+54:2017
+55:2017
+56:2017
+57:2017
+58:2017
+59:2017
+60:2017
+61:2017
+62:2017
+63:2017
+64:2017
+65:2017
+66:2016
+67:2015
+68:2015
+69:2017
+70:2017
+71:2017
+72:2017
+73:2017
+74:2017
+75:2017
+76:2017
+77:2017
+78:2017
+79:2017
+80:2017
+81:2017
+82:2017
+83:2017
+84:2017
+85:2017
+86:2017
+87:2017
+88:2017
+89:2017
+90:2017
+91:2017
+92:2017
+93:2017
+94:2017
+95:2017
+96:2017
+97:2017
+98:2017
+99:2017
+100:2017
+101:2017
+102:2017
+103:2017
+104:2017
+105:2017
+106:2017
+107:2017
+108:2017
+109:2017
+110:2017
+111:2017
+112:2017
+113:2017
+114:2017
+115:2017
+116:2017
+117:2017
+118:2017
diff --git a/third_party/botan/src/tests/data/x509/x509test/expected.txt b/third_party/botan/src/tests/data/x509/x509test/expected.txt
new file mode 100644
--- /dev/null
+++ b/third_party/botan/src/tests/data/x509/x509test/expected.txt
@@ -0,0 +1,41 @@
+InvalidExtendedKeyUsage.pem:Certificate does not allow the requested usage
+InvalidIntCAFlag.pem:CA certificate not allowed to issue certs
+InvalidIntCAKeyUsage.pem:CA certificate not allowed to issue certs
+InvalidIntCALen.pem:Certificate chain too long
+InvalidIntCALoop.pem:Loop in certificate chain
+InvalidIntCASelfSign.pem:Cannot establish trust
+InvalidIntCAVersionOne.pem:CA certificate not allowed to issue certs
+InvalidIntCAVersionTwo.pem:CA certificate not allowed to issue certs
+InvalidKeyUsage.pem:Certificate does not allow the requested usage
+InvalidName.pem:Certificate does not match provided name
+InvalidNameAltName.pem:Certificate does not match provided name
+InvalidNameAltNameWithSubj.pem:Certificate does not match provided name
+InvalidNameConstraintExclude.pem:Certificate does not pass name constraint
+InvalidNameConstraintPermit.pem:Certificate does not pass name constraint
+InvalidNameConstraintPermitRight.pem:Certificate does not pass name constraint
+InvalidNameConstraintPermitThenExclude.pem:Certificate does not pass name constraint
+InvalidNotAfter.pem:Certificate has expired
+InvalidNotAfterChained.pem:Certificate has expired
+InvalidSelfSign.pem:Cannot establish trust
+InvalidWildcardAll.pem:Certificate does not match provided name
+InvalidWildcardAllAltName.pem:Certificate does not match provided name
+InvalidWildcardLeft.pem:Certificate does not match provided name
+InvalidWildcardLeftAltName.pem:Certificate does not match provided name
+InvalidWildcardMid.pem:Certificate does not match provided name
+InvalidWildcardMidAltName.pem:Certificate does not match provided name
+InvalidWildcardMidMixed.pem:Certificate does not match provided name
+InvalidWildcardMidMixedAltName.pem:Certificate does not match provided name
+InvalidWildcardSingle.pem:Certificate does not match provided name
+InvalidWildcardSingleAltName.pem:Certificate does not match provided name
+MissingIntCABasicConstraintWithCertSign.pem:CA certificate not allowed to issue certs
+MissingIntCAExtensions.pem:CA certificate not allowed to issue certs
+ValidAltName.pem:Verified
+ValidCert.pem:Verified
+ValidChained.pem:Verified
+ValidNameConstraint.pem:Verified
+ValidIntCALen.pem:Verified
+ValidWildcard.pem:Verified
+
+# Need to fix date settings in x509test and regen
+#InvalidNotBefore.pem:Certificate is not yet valid
+#InvalidNotBeforeChained.pem:Certificate is not yet valid
