Pullup ticket #4126 - requested by tron
databases/phpmyadmin: security update

Revisions pulled up:
- databases/phpmyadmin/Makefile                                1.115
- databases/phpmyadmin/distinfo                                1.73

-------------------------------------------------------------------
  Module Name: pkgsrc
  Committed By: tron
  Date: Wed Apr 24 20:06:02 UTC 2013

  Modified Files:
  pkgsrc/databases/phpmyadmin: Makefile distinfo

  Log Message:
  Update "phpmyadmin" package to version 3.5.8.1. Changes since 3.5.8:
  - [security] Remote code execution (preg_replace), reported by Janek Vind
    (see PMASA-2013-2)
  - [security] Locally Saved SQL Dump File Multiple File Extension Remote Code
    Execution, reported by Janek Vind (see PMASA-2013-3)

  To generate a diff of this commit:
  cvs rdiff -u -r1.114 -r1.115 pkgsrc/databases/phpmyadmin/Makefile
  cvs rdiff -u -r1.72 -r1.73 pkgsrc/databases/phpmyadmin/distinfo

(spz)

Updated www/py-django-cms to 2.4.1

(adam)

Changes 2.4.1:
* USE_I18N=False fixed
* some frontend css stuff fixed
* check_copy_relations fixed for abstract classes
* non public frontend languages fixed

Changes 2.4.0:
* Compatibility with Django 1.4 and 1.5 (1.3 support dropped)
* Support for Python 2.5 dropped
* CMS_MAX_PAGE_PUBLISH_REVERSIONS has been added
* Reversion integration has changed to limit DB size
* CMS_LANGUAGE setting has changed
* CMS_HIDE_UNTRANSLATED setting removed
* CMS_LANGUAGE_FALLBACK setting removed
* CMS_LANGUAGE_CONF setting removed
* CMS_SITE_LANGUAGES setting removed
* CMS_FRONTEND_LANGUAGES setting removed
* MultilingualMiddleware has been removed
* CMS_FLAT_URLS has been removed
* CMS_MODERATOR has been removed and replaced with simple publisher.
* PlaceholderAdmin has now language tabs and has support for django-hvad
* Added `cms.middleware.language.LanguageCookieMiddleware`
* Added CMS_RAW_ID_USERS

(adam)

Avoid format string warnings with clang by adding proper format
attribution.

(joerg)

suckless downloads seem to change the file around so moved to ftp.netbsd.org

(mspo)

Unreak build on SmartOS (seen in pbulk logs, untested)

(shattered)

Removing DIST_SUBDIR since the package was renamed. Resolves PR pkg/47769

(rodent)

pload does not "know how to configure for Darwin." and neither do I.

(shattered)

skip chown/chmod with empty user/group speficication, and user-destdir support.

(obache)

Updated devel/jq to 1.2

(jperkin)

Update jq to version 1.2.  This is the version which should have been added
in the first place, but I somehow missed it.

Unfortunately there is no changelog, just a git history, with no indication
of which are the important changes.  However a lot of bugfixes are included.

The main pkgsrc change in 1.2 is that there is now a manual page.

(jperkin)

Updated fonts/libfontenc to 1.1.2

(wiz)

Update to 1.1.2:

This minor bugfix release corrects mistakes in some of the ISO-8859 to
Unicode mappings, fixes a memory management bug, and updates the build
configuration.

Adam Jackson (1):
      configure: Remove AM_MAINTAINER_MODE

Alan Coopersmith (2):
      Replace deprecated Automake INCLUDES variable with AM_CPPFLAGS
      libfontenc 1.1.2

Colin Walters (1):
      autogen.sh: Implement GNOME Build API

James Cloos (2):
      Fix ISO-8859-6 → ISO-10646 mapping.
      Fix ISO-8859-7 → ISO-10646 mapping.

Nickolai Zeldovich (1):
      libfontenc: setCode(): fix realloc invocation

(wiz)

Updated graphics/png to 1.6.2

(wiz)

Update to 1.6.2:

Version 1.6.2rc01 [April 18, 2013]
  Added contrib/tools/fixitxt.c, to repair the erroneous iTXt chunk length
    written by libpng-1.6.0 and 1.6.1.
  Disallow storing sRGB information when the sRGB is not supported.

Version 1.6.2rc02 [April 18, 2013]
  Merge pngtest.c with libpng-1.7.0

Version 1.6.2rc03 [April 22, 2013]
  Trivial spelling cleanup.

Version 1.6.2rc04 and 1.6.2rc05 [omitted]

Version 1.6.2rc06 [April 24, 2013]
  Reverted to version 1.6.2rc03.  Recent changes to arm/neon support
    have been ported to libpng-1.7.0beta09 and will reappear in version
    1.6.3beta01.

(wiz)

- remove USERGROUP_PHASE=pre-install.  Makes binary packages usable on
  systems other than the build host.
- don't install dvd-handler -- DVD support is disabled since version 5.
- install query.sql in client-only package too.

(shattered)

Note addition of security-ent version 19981020

(agc)

Add and enable ent

(agc)

Import ent-19981020 into the Packages Collection.

Originally packaged for wip by evaldo - thanks!

ent is a program which applies various tests to sequences of
bytes stored in files and reports the results of those tests.
The program is useful for those evaluating pseudorandom number
generators for encryption and statistical sampling
applications, compression algorithms, and other applications
where the information density of a file is of interest.

(Modified by me only to hold the distfile in a DIST_SUBDIR, since
the random.zip filename has the possibility to clash with other things)

An example of its usage:

% dd if=/dev/urandom bs=1k count=10 | ent
10+0 records in
10+0 records out
10240 bytes transferred in 0.001 secs (10240000 bytes/sec)
Entropy = 7.977398 bits per byte.

Optimum compression would reduce the size
of this 10240 byte file by 0 percent.

Chi square distribution for 10240 samples is 321.50, and randomly
would exceed this value 0.30 percent of the times.

Arithmetic mean value of data bytes is 128.5722 (127.5 = random).
Monte Carlo value for Pi is 3.195779601 (error 1.72 percent).
Serial correlation coefficient is -0.003620 (totally uncorrelated = 0.0).
%

Status:

Vendor Tag: TNF
Release Tags: pkgsrc-base

(agc)

Updated www/apache-tomcat7 to 7.0.39

(ryoon)

Update to 7.0.39

Changelog:
    There have been multiple improvements in the bytes to/from characters conversion process. The core conversion process has been refactored to use the NIO APIs. This has resulted in a number of improvements including invalid UTF-8 byte sequences at the end of a series of bytes now trigger a conversion error rather than being silently swallowed. Errors detected in request URIs will be replaced with the replacement character (allowing the application to respond to the invalid URI as it wishes) and errors in request bodies will trigger an IOException. The use of the JVM provided UTF-8 decoder has been replaced by a better UTF-8 decoder derived from Apache Harmony. This improved decoder has earlier detection of error conditions and more closely follows the Unicode specification regarding the use of replacement characters.

    The annotation scanning process now provides more information if the scan fails due to broken class dependencies. There is now enough information to identify the class(es) at fault. The JAR scanning process that supports annotation scanning has also seen multiple improvements and fixes including the exclusion by default of the Bootstrap class path from the scan.

    Upgraded a number of Tomcat's dependencies including Commons Daemon to 1.0.14, Commons IO to 2.4 and Commons FileUpload to r1458500. A new dependency on Commons Codec was added to replace Tomcat's internal Base64 encoder/decoder.

(ryoon)

Update sun-{jre,jdk}6 to 6.0.45.

(ryoon)

Update to 6.0.45

Changelog:
* Update timezone data to 2012i
* Bugfixes

(ryoon)

Update to 6.0.45

Changelog:
* Update timezone data to 2012i
* Bugfixes

(ryoon)

also reset LC_ALL as C.

(obache)

Restrict to Ruby 1.9.3 to match dependency.

(joerg)

Don't complain about non-literal format strings in a number of fix the
build with clang.

(joerg)

Updated www/nginx to 1.4.0nb1

(imil)

Updated the naxsi WAF module to 0.50. Forms multipart parsing improved.

(imil)

+ ed-1.8, nettle-2.7, viewvc-1.1.20.

(wiz)

Updated www/nginx to 1.4.0

(imil)

Updated nginx stable to 1.4.0. Notable improvements regarding latest stable
version are:

. SPDY protocol support
. WebSocket connections
. OCSP Stapling
. gunzip module
. flood prevention through rejection codes

Full changelog:

Changes with nginx 1.4.0                                        24 Apr 2013

    *) Bugfix: nginx could not be built with the ngx_http_perl_module if the
      --with-openssl option was used; the bug had appeared in 1.3.16.

    *) Bugfix: in a request body handling in the ngx_http_perl_module; the
      bug had appeared in 1.3.9.

Changes with nginx 1.3.16                                        16 Apr 2013

    *) Bugfix: a segmentation fault might occur in a worker process if
      subrequests were used; the bug had appeared in 1.3.9.

    *) Bugfix: the "tcp_nodelay" directive caused an error if a WebSocket
      connection was proxied into a unix domain socket.

    *) Bugfix: the $upstream_response_length variable has an incorrect value
      "0" if buffering was not used.
      Thanks to Piotr Sikora.

    *) Bugfix: in the eventport and /dev/poll methods.

Changes with nginx 1.3.15                                        26 Mar 2013

    *) Change: opening and closing a connection without sending any data in
      it is no longer logged to access_log with error code 400.

    *) Feature: the ngx_http_spdy_module.
      Thanks to Automattic for sponsoring this work.

    *) Feature: the "limit_req_status" and "limit_conn_status" directives.
      Thanks to Nick Marden.

    *) Feature: the "image_filter_interlace" directive.
      Thanks to Ian Babrou.

    *) Feature: $connections_waiting variable in the
      ngx_http_stub_status_module.

    *) Feature: the mail proxy module now supports IPv6 backends.

    *) Bugfix: request body might be transmitted incorrectly when retrying a
      request to the next upstream server; the bug had appeared in 1.3.9.
      Thanks to Piotr Sikora.

    *) Bugfix: in the "client_body_in_file_only" directive; the bug had
      appeared in 1.3.9.

    *) Bugfix: responses might hang if subrequests were used and a DNS error
      happened during subrequest processing.
      Thanks to Lanshun Zhou.

    *) Bugfix: in backend usage accounting.

Changes with nginx 1.3.14                                        05 Mar 2013

    *) Feature: $connections_active, $connections_reading, and
      $connections_writing variables in the ngx_http_stub_status_module.

    *) Feature: support of WebSocket connections in the
      ngx_http_uwsgi_module and ngx_http_scgi_module.

    *) Bugfix: in virtual servers handling with SNI.

    *) Bugfix: new sessions were not always stored if the "ssl_session_cache
      shared" directive was used and there was no free space in shared
      memory.
      Thanks to Piotr Sikora.

    *) Bugfix: multiple X-Forwarded-For headers were handled incorrectly.
      Thanks to Neal Poole for sponsoring this work.

    *) Bugfix: in the ngx_http_mp4_module.
      Thanks to Gernot Vormayr.

Changes with nginx 1.3.13                                        19 Feb 2013

    *) Change: a compiler with name "cc" is now used by default.

    *) Feature: support for proxying of WebSocket connections.
      Thanks to Apcera and CloudBees for sponsoring this work.

    *) Feature: the "auth_basic_user_file" directive supports "{SHA}"
      password encryption method.
      Thanks to Louis Opter.

Changes with nginx 1.3.12                                        05 Feb 2013

    *) Feature: variables support in the "proxy_bind", "fastcgi_bind",
      "memcached_bind", "scgi_bind", and "uwsgi_bind" directives.

    *) Feature: the $pipe, $request_length, $time_iso8601, and $time_local
      variables can now be used not only in the "log_format" directive.
      Thanks to Kiril Kalchev.

    *) Feature: IPv6 support in the ngx_http_geoip_module.
      Thanks to Gregor Kaliｨnik.

    *) Bugfix: in the "proxy_method" directive.

    *) Bugfix: a segmentation fault might occur in a worker process if
      resolver was used with the poll method.

    *) Bugfix: nginx might hog CPU during SSL handshake with a backend if
      the select, poll, or /dev/poll methods were used.

    *) Bugfix: the "[crit] SSL_write() failed (SSL:)" error.

    *) Bugfix: in the "client_body_in_file_only" directive; the bug had
      appeared in 1.3.9.

    *) Bugfix: in the "fastcgi_keep_conn" directive.

Changes with nginx 1.3.11                                        10 Jan 2013

    *) Bugfix: a segmentation fault might occur if logging was used; the bug
      had appeared in 1.3.10.

    *) Bugfix: the "proxy_pass" directive did not work with IP addresses
      without port specified; the bug had appeared in 1.3.10.

    *) Bugfix: a segmentation fault occurred on start or during
      reconfiguration if the "keepalive" directive was specified more than
      once in a single upstream block.

    *) Bugfix: parameter "default" of the "geo" directive did not set
      default value for IPv6 addresses.

Changes with nginx 1.3.10                                        25 Dec 2012

    *) Change: domain names specified in configuration file are now resolved
      to IPv6 addresses as well as IPv4 ones.

    *) Change: now if the "include" directive with mask is used on Unix
      systems, included files are sorted in alphabetical order.

    *) Change: the "add_header" directive adds headers to 201 responses.

    *) Feature: the "geo" directive now supports IPv6 addresses in CIDR
      notation.

    *) Feature: the "flush" and "gzip" parameters of the "access_log"
      directive.

    *) Feature: variables support in the "auth_basic" directive.

    *) Bugfix: nginx could not be built with the ngx_http_perl_module in
      some cases.

    *) Bugfix: a segmentation fault might occur in a worker process if the
      ngx_http_xslt_module was used.

    *) Bugfix: nginx could not be built on MacOSX in some cases.
      Thanks to Piotr Sikora.

    *) Bugfix: the "limit_rate" directive with high rates might result in
      truncated responses on 32-bit platforms.
      Thanks to Alexey Antropov.

    *) Bugfix: a segmentation fault might occur in a worker process if the
      "if" directive was used.
      Thanks to Piotr Sikora.

    *) Bugfix: a "100 Continue" response was issued with "413 Request Entity
      Too Large" responses.

    *) Bugfix: the "image_filter", "image_filter_jpeg_quality" and
      "image_filter_sharpen" directives might be inherited incorrectly.
      Thanks to Ian Babrou.

    *) Bugfix: "crypt_r() failed" errors might appear if the "auth_basic"
      directive was used on Linux.

    *) Bugfix: in backup servers handling.
      Thanks to Thomas Chen.

    *) Bugfix: proxied HEAD requests might return incorrect response if the
      "gzip" directive was used.

Changes with nginx 1.3.9                                        27 Nov 2012

    *) Feature: support for chunked transfer encoding while reading client
      request body.

    *) Feature: the $request_time and $msec variables can now be used not
      only in the "log_format" directive.

    *) Bugfix: cache manager and cache loader processes might not be able to
      start if more than 512 listen sockets were used.

    *) Bugfix: in the ngx_http_dav_module.

Changes with nginx 1.3.8                                        30 Oct 2012

    *) Feature: the "optional_no_ca" parameter of the "ssl_verify_client"
      directive.
      Thanks to Mike Kazantsev and Eric O'Connor.

    *) Feature: the $bytes_sent, $connection, and $connection_requests
      variables can now be used not only in the "log_format" directive.
      Thanks to Benjamin Gr�ssing.

    *) Feature: the "auto" parameter of the "worker_processes" directive.

    *) Bugfix: "cache file ... has md5 collision" alert.

    *) Bugfix: in the ngx_http_gunzip_filter_module.

    *) Bugfix: in the "ssl_stapling" directive.

Changes with nginx 1.3.7                                        02 Oct 2012

    *) Feature: OCSP stapling support.
      Thanks to Comodo, DigiCert and GlobalSign for sponsoring this work.

    *) Feature: the "ssl_trusted_certificate" directive.

    *) Feature: resolver now randomly rotates addresses returned from cache.
      Thanks to Anton Jouline.

    *) Bugfix: OpenSSL 0.9.7 compatibility.

Changes with nginx 1.3.6                                        12 Sep 2012

    *) Feature: the ngx_http_gunzip_filter_module.

    *) Feature: the "memcached_gzip_flag" directive.

    *) Feature: the "always" parameter of the "gzip_static" directive.

    *) Bugfix: in the "limit_req" directive; the bug had appeared in 1.1.14.
      Thanks to Charles Chen.

    *) Bugfix: nginx could not be built by gcc 4.7 with -O2 optimization if
      the --with-ipv6 option was used.

Changes with nginx 1.3.5                                        21 Aug 2012

    *) Change: the ngx_http_mp4_module module no longer skips tracks in
      formats other than H.264 and AAC.

    *) Bugfix: a segmentation fault might occur in a worker process if the
      "map" directive was used with variables as values.

    *) Bugfix: a segmentation fault might occur in a worker process if the
      "geo" directive was used with the "ranges" parameter but without the
      "default" parameter; the bug had appeared in 0.8.43.
      Thanks to Zhen Chen and Weibin Yao.

    *) Bugfix: in the -p command-line parameter handling.

    *) Bugfix: in the mail proxy server.

    *) Bugfix: of minor potential bugs.
      Thanks to Coverity.

    *) Bugfix: nginx/Windows could not be built with Visual Studio 2005
      Express.
      Thanks to HAYASHI Kentaro.

Changes with nginx 1.3.4                                        31 Jul 2012

    *) Change: the "ipv6only" parameter is now turned on by default for
      listening IPv6 sockets.

    *) Feature: the Clang compiler support.

    *) Bugfix: extra listening sockets might be created.
      Thanks to Roman Odaisky.

    *) Bugfix: nginx/Windows might hog CPU if a worker process failed to
      start.
      Thanks to Ricardo Villalobos Guevara.

    *) Bugfix: the "proxy_pass_header", "fastcgi_pass_header",
      "scgi_pass_header", "uwsgi_pass_header", "proxy_hide_header",
      "fastcgi_hide_header", "scgi_hide_header", and "uwsgi_hide_header"
      directives might be inherited incorrectly.

Changes with nginx 1.3.3                                        10 Jul 2012

    *) Feature: entity tags support and the "etag" directive.

    *) Bugfix: trailing dot in a source value was not ignored if the "map"
      directive was used with the "hostnames" parameter.

    *) Bugfix: incorrect location might be used to process a request if a
      URI was changed via a "rewrite" directive before an internal redirect
      to a named location.

Changes with nginx 1.3.2                                        26 Jun 2012

    *) Change: the "single" parameter of the "keepalive" directive is now
      ignored.

    *) Change: SSL compression is now disabled when using all versions of
      OpenSSL, including ones prior to 1.0.0.

    *) Feature: it is now possible to use the "ip_hash" directive to balance
      IPv6 clients.

    *) Feature: the $status variable can now be used not only in the
      "log_format" directive.

    *) Bugfix: a segmentation fault might occur in a worker process on
      shutdown if the "resolver" directive was used.

    *) Bugfix: a segmentation fault might occur in a worker process if the
      ngx_http_mp4_module was used.

    *) Bugfix: in the ngx_http_mp4_module.

    *) Bugfix: a segmentation fault might occur in a worker process if
      conflicting wildcard server names were used.

    *) Bugfix: nginx might be terminated abnormally on a SIGBUS signal on
      ARM platform.

    *) Bugfix: an alert "sendmsg() failed (9: Bad file number)" on HP-UX
      while reconfiguration.

Changes with nginx 1.3.1                                        05 Jun 2012

    *) Security: now nginx/Windows ignores trailing dot in URI path
      component, and does not allow URIs with ":$" in it.
      Thanks to Vladimir Kochetkov, Positive Research Center.

    *) Feature: the "proxy_pass", "fastcgi_pass", "scgi_pass", "uwsgi_pass"
      directives, and the "server" directive inside the "upstream" block,
      now support IPv6 addresses.

    *) Feature: the "resolver" directive now supports IPv6 addresses and an
      optional port specification.

    *) Feature: the "least_conn" directive inside the "upstream" block.

    *) Feature: it is now possible to specify a weight for servers while
      using the "ip_hash" directive.

    *) Bugfix: a segmentation fault might occur in a worker process if the
      "image_filter" directive was used; the bug had appeared in 1.3.0.

    *) Bugfix: nginx could not be built with ngx_cpp_test_module; the bug
      had appeared in 1.1.12.

    *) Bugfix: access to variables from SSI and embedded perl module might
      not work after reconfiguration.
      Thanks to Yichun Zhang.

    *) Bugfix: in the ngx_http_xslt_filter_module.
      Thanks to Kuramoto Eiji.

    *) Bugfix: memory leak if $geoip_org variable was used.
      Thanks to Denis F. Latypoff.

    *) Bugfix: in the "proxy_cookie_domain" and "proxy_cookie_path"
      directives.

Changes with nginx 1.3.0                                        15 May 2012

    *) Feature: the "debug_connection" directive now supports IPv6 addresses
      and the "unix:" parameter.

    *) Feature: the "set_real_ip_from" directive and the "proxy" parameter
      of the "geo" directive now support IPv6 addresses.

    *) Feature: the "real_ip_recursive", "geoip_proxy", and
      "geoip_proxy_recursive" directives.

    *) Feature: the "proxy_recursive" parameter of the "geo" directive.

    *) Bugfix: a segmentation fault might occur in a worker process if the
      "resolver" directive was used.

    *) Bugfix: a segmentation fault might occur in a worker process if the
      "fastcgi_pass", "scgi_pass", or "uwsgi_pass" directives were used and
      backend returned incorrect response.

    *) Bugfix: a segmentation fault might occur in a worker process if the
      "rewrite" directive was used and new request arguments in a
      replacement used variables.

    *) Bugfix: nginx might hog CPU if the open file resource limit was
      reached.

    *) Bugfix: nginx might loop infinitely over backends if the
      "proxy_next_upstream" directive with the "http_404" parameter was
      used and there were backup servers specified in an upstream block.

    *) Bugfix: adding the "down" parameter of the "server" directive might
      cause unneeded client redistribution among backend servers if the
      "ip_hash" directive was used.

    *) Bugfix: socket leak.
      Thanks to Yichun Zhang.

    *) Bugfix: in the ngx_http_fastcgi_module.

(imil)

Updated math/ruby-spreadsheet to 0.8.5

(obache)

Update ruby-spreadsheet to 0.8.5.

=== 0.8.5 / 24.04.2013

* Applied Patch by Joao Almeida: When editing an existing sheet, cells merge was not working.
* https://github.com/voraz/spreadsheet/pull/14.patch

(obache)

Restore checksum for ecj-4.5.jar (hi adam!)

(wiz)

Add jq.

(jperkin)

Note addition of devel/jq, version 1.1.

(jperkin)

Import jq-1.1 as devel/jq into pkgsrc.

jq is a lightweight and flexible command-line JSON processor.

jq is like sed for JSON data – you can use it to slice and filter and
map and transform structured data with the same ease that sed, awk, grep
and friends let you play with text.

(jperkin)

Fix after rename.

(wiz)

Fix CONFLICTS.

(wiz)

webkit-gtk and webkit-gtk3 need to include x11/libXdamage/buildlink3.mk in
their buildlink3.mk files.

(sbd)

Updated sysutils/hal to 0.5.14nb10

(sbd)

udev(7) rules must go in /etc/udev/rules.d

(sbd)

Remove unused files.

(sbd)

For all packages include ghostscript.buildlink3.mk:

s/ghostscript.buildlink3.mk/buildlink3.mk/

Bump PKGREVISIONs

(sbd)

sort

(jnemeth)

Add print/ghostscript/buildlink3.mk

(sbd)

Pullup ticket #4125.

(tron)

Pullup ticket #4125 - requested by bouyer
sysutils/xenkernel41: security patch

Revisions pulled up:
- sysutils/xenkernel41/Makefile                                1.19-1.20
- sysutils/xenkernel41/distinfo                                1.15-1.16
- sysutils/xenkernel41/patches/patch-CVE-2013-1917-1            1.1
- sysutils/xenkernel41/patches/patch-CVE-2013-1917-2            1.1
- sysutils/xenkernel41/patches/patch-CVE-2013-1917-3            1.1
- sysutils/xenkernel41/patches/patch-CVE-2013-1920              1.1
- sysutils/xenkernel41/patches/patch-CVE-2013-1964-1            1.1
- sysutils/xenkernel41/patches/patch-CVE-2013-1964-2            1.1
- sysutils/xenkernel41/patches/patch-Config.mk                  1.1
- sysutils/xenkernel41/patches/patch-xen_Makefile              1.1
- sysutils/xenkernel41/patches/patch-xen_arch_x86_Rules.mk      1.1
- sysutils/xenkernel41/patches/patch-xen_arch_x86_cpu_mcheck_vmce.c 1.1
- sysutils/xenkernel41/patches/patch-xen_arch_x86_time.c        1.1

---
  Module Name:    pkgsrc
  Committed By:  joerg
  Date:          Thu Apr 11 19:57:53 UTC 2013

  Modified Files:
          pkgsrc/sysutils/xenkernel3: Makefile distinfo
          pkgsrc/sysutils/xenkernel3/patches: patch-cw
          pkgsrc/sysutils/xenkernel33: Makefile distinfo
          pkgsrc/sysutils/xenkernel41: Makefile distinfo
          pkgsrc/sysutils/xentools3: Makefile distinfo
          pkgsrc/sysutils/xentools3-hvm: Makefile distinfo
          pkgsrc/sysutils/xentools3/patches: patch-.._patch-Config.mk patch-cg
          pkgsrc/sysutils/xentools33: Makefile distinfo
          pkgsrc/sysutils/xentools33/patches: patch-ab
          pkgsrc/sysutils/xentools41: Makefile distinfo
  Added Files:
          pkgsrc/sysutils/xenkernel3/patches: patch-xen_arch_x86_hvm_io.c
              patch-xen_arch_x86_string.c
          pkgsrc/sysutils/xenkernel33/patches: patch-Config.mk patch-xen_Makefile
              patch-xen_arch_x86_Rules.mk
          pkgsrc/sysutils/xenkernel41/patches: patch-Config.mk patch-xen_Makefile
              patch-xen_arch_x86_Rules.mk patch-xen_arch_x86_cpu_mcheck_vmce.c
              patch-xen_arch_x86_time.c
          pkgsrc/sysutils/xentools3-hvm/patches: patch-.._patch-Config.mk
          pkgsrc/sysutils/xentools3/patches: patch-libxc_xc__dom__x86.c
          pkgsrc/sysutils/xentools33/patches: patch-blktap_drivers_block-qcow.c
              patch-ioemu_block-vvfat.c
          pkgsrc/sysutils/xentools41/patches:
              patch-.._.._ipxe_src_arch_i386_include_librm.h
              patch-.._.._ipxe_src_core_settings.c patch-.._.._ipxe_src_net_tls.c
              patch-.._Config.mk patch-firmware_hvmloader_Makefile
              patch-libcx_xc__dom__boot.c patch-xenstat_libxenstat_Makefile

  Log Message:
  Allow building Xen infrastructure with Clang. Fix various bugs in
  xenkernel3, xenkernel41, xentools3 and xentools41 exposed by Clang
  default warnings. Bump revisions for those.

---
  Module Name:    pkgsrc
  Committed By:  bouyer
  Date:          Fri Apr 19 14:02:46 UTC 2013

  Modified Files:
          pkgsrc/sysutils/xenkernel41: Makefile distinfo
  Added Files:
          pkgsrc/sysutils/xenkernel41/patches: patch-CVE-2013-1917-1
              patch-CVE-2013-1917-2 patch-CVE-2013-1917-3 patch-CVE-2013-1920
              patch-CVE-2013-1964-1 patch-CVE-2013-1964-2

  Log Message:
  Add patches from Xen security advisory:
  http://lists.xen.org/archives/html/xen-announce/2013-04/msg00000.html
  http://lists.xen.org/archives/html/xen-announce/2013-04/msg00005.html
  http://lists.xen.org/archives/html/xen-announce/2013-04/msg00006.html

  bump PKGREVISION

(tron)

Pullup tickets #4123 and #4124.

(tron)

Pullup ticket #4124 - requested by bouyer
sysutils/xentools41: security patch

Revisions pulled up:
- sysutils/xentools41/Makefile                                  1.30-1.31
- sysutils/xentools41/distinfo                                  1.27-1.28
- sysutils/xentools41/patches/patch-.._.._ipxe_src_arch_i386_include_librm.h 1.1
- sysutils/xentools41/patches/patch-.._.._ipxe_src_core_settings.c 1.1
- sysutils/xentools41/patches/patch-.._.._ipxe_src_net_tls.c    1.1
- sysutils/xentools41/patches/patch-.._Config.mk                1.1
- sysutils/xentools41/patches/patch-CVE-2013-0215-1            1.1
- sysutils/xentools41/patches/patch-CVE-2013-0215-2            1.1
- sysutils/xentools41/patches/patch-firmware_hvmloader_Makefile 1.1
- sysutils/xentools41/patches/patch-libcx_xc__dom__boot.c      1.1
- sysutils/xentools41/patches/patch-xenstat_libxenstat_Makefile 1.1

---
  Module Name:    pkgsrc
  Committed By:  joerg
  Date:          Thu Apr 11 19:57:53 UTC 2013

  Modified Files:
          pkgsrc/sysutils/xenkernel3: Makefile distinfo
          pkgsrc/sysutils/xenkernel3/patches: patch-cw
          pkgsrc/sysutils/xenkernel33: Makefile distinfo
          pkgsrc/sysutils/xenkernel41: Makefile distinfo
          pkgsrc/sysutils/xentools3: Makefile distinfo
          pkgsrc/sysutils/xentools3-hvm: Makefile distinfo
          pkgsrc/sysutils/xentools3/patches: patch-.._patch-Config.mk patch-cg
          pkgsrc/sysutils/xentools33: Makefile distinfo
          pkgsrc/sysutils/xentools33/patches: patch-ab
          pkgsrc/sysutils/xentools41: Makefile distinfo
  Added Files:
          pkgsrc/sysutils/xenkernel3/patches: patch-xen_arch_x86_hvm_io.c
              patch-xen_arch_x86_string.c
          pkgsrc/sysutils/xenkernel33/patches: patch-Config.mk patch-xen_Makefile
              patch-xen_arch_x86_Rules.mk
          pkgsrc/sysutils/xenkernel41/patches: patch-Config.mk patch-xen_Makefile
              patch-xen_arch_x86_Rules.mk patch-xen_arch_x86_cpu_mcheck_vmce.c
              patch-xen_arch_x86_time.c
          pkgsrc/sysutils/xentools3-hvm/patches: patch-.._patch-Config.mk
          pkgsrc/sysutils/xentools3/patches: patch-libxc_xc__dom__x86.c
          pkgsrc/sysutils/xentools33/patches: patch-blktap_drivers_block-qcow.c
              patch-ioemu_block-vvfat.c
          pkgsrc/sysutils/xentools41/patches:
              patch-.._.._ipxe_src_arch_i386_include_librm.h
              patch-.._.._ipxe_src_core_settings.c patch-.._.._ipxe_src_net_tls.c
              patch-.._Config.mk patch-firmware_hvmloader_Makefile
              patch-libcx_xc__dom__boot.c patch-xenstat_libxenstat_Makefile

  Log Message:
  Allow building Xen infrastructure with Clang. Fix various bugs in
  xenkernel3, xenkernel41, xentools3 and xentools41 exposed by Clang
  default warnings. Bump revisions for those.

---
  Module Name:    pkgsrc
  Committed By:  bouyer
  Date:          Fri Apr 19 14:03:52 UTC 2013

  Modified Files:
          pkgsrc/sysutils/xentools41: Makefile distinfo
  Added Files:
          pkgsrc/sysutils/xentools41/patches: patch-CVE-2013-0215-1
              patch-CVE-2013-0215-2

  Log Message:
  Add patch from Xen security advisory:
  http://lists.xen.org/archives/html/xen-announce/2013-02/msg00005.html

(tron)

Pullup ticket #4123 - requested by bsiegert
shells/tcsh: build fix

Revisions pulled up:
- shells/tcsh/distinfo                                          1.31
- shells/tcsh/patches/patch-configure                          1.1

---
  Module Name:    pkgsrc
  Committed By:  bsiegert
  Date:          Tue Apr  2 20:37:55 UTC 2013

  Modified Files:
          pkgsrc/shells/tcsh: distinfo
  Added Files:
          pkgsrc/shells/tcsh/patches: patch-configure

  Log Message:
  Fix build under MirBSD.

(tron)

Note update of the "phpmyadmin" package to version 3.5.8.1.

(tron)

Update "phpmyadmin" package to version 3.5.8.1. Changes since 3.5.8:
- [security] Remote code execution (preg_replace), reported by Janek Vind
  (see PMASA-2013-2)
- [security] Locally Saved SQL Dump File Multiple File Extension Remote Code
  Execution, reported by Janek Vind (see PMASA-2013-3)

(tron)

Updated lang/gcc47 to 4.7.3

(adam)

Updated devel/p5-XSLoader to 0.16.

(hiramatsu)

Update p5-XSLoader to 0.16.

Changes from previous:
----------------------
0.16 - 2012.09.03 - SAPER
    - [CODE] Synced from bleadperl.
    - [DOC] CPAN-RT #77294: Fixed some spelling and grammer errors.
    - [TESTS] CPAN-RT #77557: Tests started to fail with Perl 5.15.5
    - [DIST] Perl-RT #114050: Added meta-information in Makefile.PL to
      reflect that the module is maintained by P5P.

(hiramatsu)

Updated textproc/p5-Text-Xslate to 2.0001

(wen)

Update to 2.0001
Adjust DEPENDS

Upstream changes:
2.0001 2013-04-24 16:24:22
    [FEATURES]
    - Support PUREPERL_ONLY build
      See the Lancaster Consensu:
      https://github.com/sjn/toolchain-site/blob/219db464af9b2f19b04fec05547ac10180a469f3/lancaster-consensus.md#specifying-pure-perl-builds

2.0000 2013-02-20 09:21:08
    - No code change from 1.9999_01

1.9999_01 2013-02-16 15:44:31
    [CHANGES]
    - Migrate from Any::Moose to Mouse because Any::Moose is deprecated

1.6002 2012-12-19 22:54:55
    [BUG FIXES]
    - Fix a bug where TTerse created no variable scopes (thanks to Yappo)

(wen)

Updated devel/p5-Mouse to 1.08

(wen)

Update to 1.08

Upstream changes:
1.08 2013-04-24 16:20:53
    [FEATURES]
    - Support PUREPERL_ONLY
      See the Lancaster Consensus:
      https://github.com/sjn/toolchain-site/blob/219db464af9b2f19b04fec05547ac10180a469f3/lancaster-consensus.md#specifying-pure-perl-builds

1.07 2013-04-24 08:47:17
    [BUG FIXES]
    - Make trigger pass in the old value for Moose compatibility
      (PR#6 by schwern)

    [TEST FIXES]
    - Get perlcritic tests working for PC 1.118 (PR#6 by schwern)

1.06 2013-04-09 23:40:02
    [TEST FIXES]
    - Resolve RT#84518 caused by hash randomization

1.05 2013-02-08 00:32:33
    [BUG FIXES]
    - Fix a memory leak introduced by v1.04 (creaktive & aiyumi, pull-req #4)

(wen)

Changes 4.7.3:
http://gcc.gnu.org/gcc-4.7/changes.html

(adam)

+ py-polib

(obache)

Added devel/py-polib version 1.0.3

(obache)

Import py27-polib-1.0.3 as devel/py-polib.
Based on PR pkg/47459 by Richard PALO.

polib is a library to manipulate, create, modify gettext files (pot, po and mo
files). You can load existing files, iterate through its entries, add, modify
entries, comments or metadata, etc. or create new po files from scratch.

polib supports out of the box any version of python ranging from 2.4 to latest
3.X version.

polib is pretty stable now and is used by many opensource projects.

polib is completely free and opensource, the license used is the MIT license.
It was developed back in 2006 by David Jean Louis and it is still actively
maintained.

(obache)

Updated databases/couchdb to 1.3.0

(jperkin)

Update databases/couchdb to 1.3.0.  Changes since 1.2.1:

Version 1.3.0
-------------

HTTP Interface:

* No longer rewrites the X-CouchDB-Requested-Path during recursive calls to the
  rewriter.
* Limit recursion depth in the URL rewriter. Defaults to a maximum of 100
  invocations but is configurable.
* Fix _session for IE7.
* Added Server-Sent Events protocol to db changes API. See
  http://www.w3.org/TR/eventsource/ for details.
* Make password hashing synchronous when using the /_config/admins API.
* Include user name in show/list ETags.
* Experimental support for Cross-Origin Resource Sharing (CORS). See
  http://www.w3.org/TR/cors/ for details.

Replicator:

* The replicator will use a new server-wide UUID in checkpoint IDs to
  improve the chances of an efficient resume.

Storage System:

* Fixed unnecessary conflict when deleting and creating a
  document in the same batch.

View Server:

* Additional response headers may be varied prior to send().
* GetRow() is now side-effect free.

Futon:

* Disabled the link to the Futon test suite. These tests were causing problems
  when run from a browser, and are now available via the CLI instead.
* Added view request duration to Futon.
* Disable buttons for actions that the user doesn't have permissions to.

Security:

* Passwords are now hashed using the PBKDF2 algorithm with a configurable work
  factor.

Test Suite:

* Moved the JS test suite to the CLI.
* Improved tracebacks printed by the JS CLI tests.
* Improved the reliability of a number of tests.

UUID Algorithms:

* Added the utc_id algorithm.

URL Rewriter & Vhosts:

* Database name is encoded during rewriting (allowing embedded /'s, etc).
* Reset rewrite counter on new request, avoiding unnecessary request failures
  due to bogus rewrite limit reports.

Build System:

* C/C++ compiler detection has been improved.
* Autoconf v2.63 is now required if building from Git checkout directly. See
  DEVELOPERS file for more details.
* Fixed issue in couchdb script where stopped status returns before process
  exits.

Version 1.2.2
-------------

HTTP Interface:

* Reset rewrite counter on new request, avoiding unnecessary request failures
  due to bogus rewrite limit reports.

Build System:

* Fixed issue in couchdb script where stopped status returns before process
  exits.

(jperkin)

+ispell-gl

(rodent)

Added textproc/ispell-gl version 0.5

(rodent)

Import ispell-gl-0.5 as textproc/ispell-gl.

This an ispell dictionary for Galician, using the "Minimos" standard. It's
freely available under the terms of the GNU GPL, version 2. You can freely
redistribute and/or use it for spell checking with the program ispell.

(rodent)

Set to CONFLICT with previous PKGNAME. Fixed PKGNAME in ispell-* packages.
Fixed PLIST for ispell-en_GB.

(rodent)

Moved -> Renamed for the ispell changes.

(rodent)

Instead of having a DEPENDS+=ghostscript... have USE_TOOLS+=gs:run

Bump PKGREVISION

(sbd)

Instead of having a DEPENDS+=ghostscript... have USE_TOOLS+=gs:run

Bump PKGREVISION

(sbd)

Instead of having a DEPENDS+=ghostscript... have USE_TOOLS+=gs:run

Bump PKGREVISION

(sbd)

Instead of having a DEPENDS+=ghostscript... have USE_TOOLS+=gs:run

Bump PKGREVISION

(sbd)

Instead of having a DEPENDS+=ghostscript... have USE_TOOLS+=gs:run

Bump PKGREVISION

(sbd)

Revbump for all packages that have USE_TOOLS+=gs

(sbd)

Use the ghostscript meta-package instead of ghostscript-gpl or
ghostscript-agpl.

Reverts revisions 1.255 and 1.254

  ----------------------------
  revision 1.255
  date: 2013/03/16 23:03:33;  author: dholland;  state: Exp;  lines: +3 -3
  print/ghostscript -> print/ghostscript-agpl
  ----------------------------
  revision 1.254
  date: 2013/03/16 21:47:14;  author: dholland;  state: Exp;  lines: +13 -3
  Choose ghostscript package for ghostscript tools based on whether
  gnu-agpl-* is in ACCEPTABLE_LICENSES.

  This is mostly the same as the old ghostscript type logic that was
  removed in version 1.223.

(sbd)

Re-add ghostscript

(sbd)

Updated print/ghostscript to 9.05nb4

(sbd)

Add print/ghostscript meta-package to allow selection of the prefered
ghostscript. i.e: ghostscript-gpl or ghostscript-agpl

(sbd)

Updated sysutils/cdrtools to 3.01alpha14

(wiz)

Update to 3.01a14:

All:

- Fixed a typo in include/schily/stat.h related to nanosecond
handling for NetBSD and OpenBSD

- New autoconf tests for sys/capability.h and cap_*() functions
from Linux -lcap

WARNING: If you do not see this:

checking for cap_get_proc in -lcap... yes
checking for cap_get_proc... yes
checking for cap_set_proc... yes
checking for cap_set_flag... yes
checking for cap_clear_flag... yes

your Linux installation is insecure in case you ever use the
command "setcap" to set up file capabilities for executable commands.

Note that cdrtools (as any other command) need to be capabylity aware
in order to avoid security leaks with enhanced privileges. In most
cases, privileges are only needed for a very limited set of operations.
If cdrtools (cdrecord, cdda2wav, readcd) are installed suid-root, the
functions to control privileges are in the basic set of supported
functions and thus there is no problem for any program to control it's
privileges - if they have been obtained via suid root, you are on a
secure system.

If you are however on an incomplete installation, that supports to
raise privileges via fcaps but that does not include developer support
for caps, the programs get the privileges without being able to know
about the additional privileges and thus keep them because they cannot
control them.

WARNING: If you are on a Linux system that includes support for
fcaps (this is seems to be true for all newer systems with
Linux >= 2.6.24) and there is no development support for capabilities
in the base system, you are on an inherently insecure system that allows
to compile and set up programs with enhanced privileges that cannot
control them.

In such a case, try to educate the security manager for the related
Linux distribution. Note that you may turn your private installation
into a secure installation by installing development support for libcap.

- The autofconf tests for broken Linux kernel headers now avoid to
warn for /usr/src/linux/include if this directory is missing.

- include/schily/priv.h now includes sys/capabilitiy.h if available.

Libscg:

- Trying to support suid-root-less installation of librscg users on Linux.
librscg now understands that a non-root program may be able to
create sockets for a privileged port.

Cdrecord:

- Trying to support suid-root-less installation of cdrecord on Linux.
NOTE: You need "file caps" support built into your Linux installation.

Call:

setcap cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep /opt/schily/bin/cdrecord
To set up the capabilities on Linux.

Cdda2wav (Maintained/enhanced by J�rg Schilling, originated by Heiko Eiﾟfeldt heiko@hexco.de):

- Trying to support suid-root-less installation of cdda2wav on Linux.
NOTE: You need "file caps" support built into your Linux installation.

Call:

setcap cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_sys_rawio+ep /opt/schily/bin/cdda2wav
To set up the capabilities on Linux.

Readcd:

- Trying to support suid-root-less installation of readcd on Linux.
NOTE: You need "file caps" support built into your Linux installation.

Call:

setcap cap_dac_override,cap_sys_admin,cap_net_bind_service,cap_sys_rawio+ep /opt/schily/bin/readcd
To set up the capabilities on Linux.

Scgcheck:

- Link now against $(LIB_CAP) also as librscg needs it on Linux

Scgskeleton:

- Link now against $(LIB_CAP) also as librscg needs it on Linux

Btcflash:

- Link now against $(LIB_CAP) also as librscg needs it on Linux

Mkisofs (Maintained/enhanced by J�rg Schilling since 1997, originated by Eric Youngdale):

- -new-dir-mode now just superseeds the effect of -dir-mode on
directories that have been "invented" by mkisofs.
This is a more intuitive behavior.

- Link now against $(LIB_CAP) also as librscg needs it on Linux

(wiz)

Updated lang/gcc-aux to 4.7.3 [marino 2013-04-12]

(wiz)

CUPS_SERVERBIN is always "$exec_prefix/libexec/cups"

(sbd)

Revive MASTER_SITES

(kim)

Add PLIST.Linux

Bump PKGREVISION

(sbd)