patch-ad: fix an #endif versus #else error
patch-cc: adds NetBSD bswap* to interface/utils.h as per utils.h
patch-ci: fix a crash on big-endian machines

(jdc)

Apply the patch from pkg/40683, which did not make it into the 6.17
update of the package.

(hauke)

Note update of security/openssl to 0.9.8mnb2.

(taca)

Add a patch for Fix for CVE-2010-0740, DoS problem.

http://www.openssl.org/news/secadv_20100324.txt

Bump PKGREVISION.

(taca)

Skip broken NaN and infinity handling on VAX. May not strictly be
"correct", but VAX doesn't support NaN and infinity in its floating point,
so this is just to make m4 build on VAX.

(jklos)

remove a redundant period.

(obache)

Recursive revision bump for GMP update, 2nd part.

(asau)

Updated
mail/spamassassin to 3.3.1

(heinz)

Updated to version 3.3.1.

Pkgsrc changes:
  - Removed most of the package options; using the options framework for
    those choices was not quite correct in the first place. Some have now
    fixed values (Perl warnings and taint checks always enabled), some
    got converted to variables settable from the make command line, see
    options.mk.
  - pkglint complained about the variable PLIST_ADD so I renamed it to
    DYNAMIC_PLIST.
  - SpamAssassin does not come with rules anymore. As a starting point
    the official archive of rules at the time of the SA release is
    included. At installation time this set of rules gets installed
    through the pkgsrc INSTALL file.
  - Removed patch-ba and patch-bc, both were integrated upstream.
  - Removed patch-be. The quick fix for the bad rule was replaced by
    a permanent solution.

Summary of major changes since 3.3.0
====================================

bug 6335: add Spamhaus DBL as URIBL_DBL_SPAM rule

Bug 6370: update ImageInfo plugin to latest release

bug 6215, bug 6294: RCVD_IN_CSS rule was broken.  the check_rbl_sub() syntax
was incorrect, resulting in missing hits

bug 6361: list 2tld and 3tld sub-domain hosters for URIBL/SURBL/DBL queries;
NOTE for SARE users: This file replaces the SARE file
http://www.rulesemporium.com/rules/90_2tld.cf, which will be deprecated as from
2010-05-01.

Bug 6369, 6356, 6373: WIN32 support for spamd improved

Bug 6267: Solaris 10 requires --syslog-socket=native

bug 6304 spamd is spawning and killing processes too often - Added spamd
adjustments to info level and more information for administrators + small fix
to Makefile.PL

Bug 6310: sa-learn --import gives Insecure dependency in open

Bug 6313: -Q or -q AND -x should not result in creation of a ~/.spamassassin
dir; plus: taint issues fixed

Bug 6342: make test failure on if_can under perl 5.6

Bug 6340: Impossible to find user home directory of VPOPMAIL alias

Bug 6072, 6343: POD warnings, documentation fixes

Bug 6304 (trivial), reduce sysadmin's stress level by lowercasing
the 'INTERRUPTED' in a logged message:
spamd: handled cleanup of child pid [...] due to SIGCHLD: INTERRUPTED

Bug 6329: POSIX::strftime in call under Win32 ActivePerl causes Perl to hang up;
formatting option %e is not in a POSIX standard, use %d instead and edit

Bug 6322: In DKIM ADSP eval test check_dkim_adsp() the '*' is handled incorrectly

Bug 6327: Fix calling argument in utility used to determine DCC's homedir

Bug 6316: DCC.pm, wrong options for dcc_proc, (plus: avoid a warning on undef
in logger when dccifd socket is not provided)

Bug 6287: improved DKIM plugin debugging

Bug 6321 - _TOKENSUMMARY_ not working in 3.3.0 (Plugin/Bayes.pm looks-up a tag
from wrong location)

Bug 6312 - uninitialized value $start_time in spamd

bug 5761: trivial doc fix: document SPAMD_LOCALHOST test-control env variable

Summary of major changes since 3.2.5
====================================
COMPATIBILITY WITH 3.2.5

- rules are no longer distributed with the package, but installed by
  sa-update - either automatically fetched from the network (preferably)
  or from a tar archive, which is available for downloading separately
  (see below, section INSTALLING RULES);

- CPAN module requirements:
  - minimum required version of ExtUtils::MakeMaker is 6.17;
  - modules now required: Time::HiRes, NetAddr::IP (4.000 or later),
    Archive::Tar (1.23 or later), IO::Zlib;
  - minimal version of Mail::DKIM is 0.31 (preferred: 0.37 or later);
    expect some tests in t/dkim2.t to fail with versions older than 0.36_5;
  - no longer used: Mail::DomainKeys, Mail::SPF::Query;
  - either Digest::SHA or the older Digest::SHA1 is required, though
    note that the DKIM plugin requires Digest::SHA for sha256 hashes
    and Razor agents still need Digest::SHA1;
  - some IPv6 functionality requires IO::Socket::INET6;

- if keeping the AWL database in SQL, the field awl.ip must be extended to
  40 characters. The change is necessary to allow AWL to keep track of IPv6
  addresses which may appear in a mail header even on non-IPv6 -enabled host.
  While at it, consider also adding a field 'signedby' to the SQL table 'awl'
  (and adding 'auto_whitelist_distinguish_signed 1' to local.cf);
  see sql/README.awl for details. The change need not be undone even if
  downgrading back to 3.2.* for some reason;

- fixing a protocol implementation error regarding a PING command required
  bumping up the SPAMC protocol version to 1.5.  Spamd retains compatibility
  with older spamc clients. Combining new spamc clients with pre-3.3 versions
  of a spamd daemon is not supported (but happens to work, except for the
  PING and SKIP commands);

- if using one of the plugins (FreeMail, PhishTag, Reuse) which were
  previously not part of the official package, please retire your local copy
  to avoid it conflicting with a new native plugin;

- as the plugin AWL is no longer loaded by default, to continue using it
  the following line is needed in one of the .pre files (e.g. local.pre):
    loadplugin Mail::SpamAssassin::Plugin::AWL

- it may be worth mentioning that a rule DKIM_VERIFIED has been renamed
  to DKIM_VALID to match its semantics;

- the DKIM plugin is now enabled by default for new installs, if the perl
  module Mail::DKIM is installed.  However, installation of SpamAssassin
  will not overwrite existing .pre configuration files, so to use DKIM when
  upgrading from a previous release that did not use DKIM, a directive:

    loadplugin Mail::SpamAssassin::Plugin::DKIM

  will need to be uncommented in file "v312.pre", or added to some
  other .pre file, such as local.pre;

- due to changes in some internal data structures (like Bug 6185, 6254),
  some third-party plugins may need to be updated. One such example is
  the ClamAVPlugin plugin - please find a fresh version, which can be used
  with both SpamAssassin versions 3.2.5 and 3.3.0, on its wiki page at
  http://wiki.apache.org/spamassassin/ClamAVPlugin

- versions of amavisd-new between 2.5.2 and 2.6.1 (inclusive) are incompatible
  with SpamAssassin 3.3; please upgrade amavisd to 2.6.2 or later, or apply
  a workaround https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6257

- support for versions of perl 5.6.* is being gradually revoked
  (may still work, but no promises and no support);

- preferred versions of perl are 5.8.8, 5.8.9, and 5.10.1 or later;

- on FreeBSD, please avoid using multithreaded versions of perl older
  than 5.10.0 due to small default main thread's stack size, which may
  not suffice for some regular expression evaluations;

INSTALLING RULES

Rules are normally installed by running a sa-update command.
The version of sa-update program should match the version of SpamAssassin
modules, so invoking sa-update should be performed only after installing
or upgrading SpamAssassin code, not before.

Installing rules from network is done with a single command,
normally run as root:
  sa-update

Installing rules from files:
  obtain all the following files:
    Mail-SpamAssassin-rules-xxx.tgz
    Mail-SpamAssassin-rules-xxx.tgz.asc
    Mail-SpamAssassin-rules-xxx.tgz.md5
    Mail-SpamAssassin-rules-xxx.tgz.sha1
      (where xxx may look something like '3.3.0.r893295')
  install rules from a compressed tar archive:
    sa-update --install Mail-SpamAssassin-rules-xxx.tgz
      (sa-update will need corresponding .asc and .sha1 files with the
      same base name in the same directory as the .tgz file)

MAIN NEW FEATURES

- IPv6 support was substantially improved (see below);

- many improvements to the DKIM plugin (understands author domain signatures,
  supports multiple signatures, ADSP support with overrides) - (see below);

- added 'if can(Class::method)' conditional statement, allowing configuration
  settings to be conditional on plugin capabilities without requiring
  new version releases to do so;

- added a --verbose option to the sa-update utility to show updated channels;

- added a configuration option 'time_limit', defaulting to 300 seconds
  or whatever the caller (like spamd) provides; attempting to gracefully
  terminate the checking when a time limit is reached, reporting the score
  and test hits that were collected so far, along with an added hit on
  a rule TIME_LIMIT_EXCEEDED;

- more expensive code sections are now instrumented with timing measurements;
  timing report is logged as a debug message by the end of processing,
  and made available to a caller and to 'add_header' directives through
  a TIMING tag;

- added a configuration option skip_uribl_checks to the URIDNSBL plugin,
  cross-documented it with skip_rbl_checks;

- preserve order of declared 'add_header' header fields;

- configurable network mask length for the AWL plugin (see below);

- added support for DCC reputations (see below);

- improved error handling and robustness (see below);

- added timestamps when logging on stderr;

- allowed debug areas to be excluded from debugging,
  e.g.: -D all,norules,noconfig,nodcc

BUILDING AND PACKAGING

- rules are no longer distributed with the package, but installed by
  sa-update

- Makefile.PL has been simplified and a bug fixed in a DESTDIR support
  by increasing the minimum required version of ExtUtils::MakeMaker to 6.17

- tools check_whitelist and check_spamd are now included in the distribution,
  now called 'sa-awl' and 'sa-check_spamd'

WORKAROUNDS TO PERL BUGS AND LIMITATIONS

- modified the Check.pm plugin to produce smaller chunks of source code
  from rules (60 kB) to avoid Perl compiler crashing on exceeding stack size;

- localized global variables $1, $2, etc at several places, avoiding taint
  issue from propagating;

- avoided Perl I/O bug by replacing line-by-line reading with read() where
  suitable, or played down the EBADF status in other places and only report
  it as a dbg instead of a die - while also providing a little speedup
  (10 .. 25 %) on reading a message;

- provided a new sub Message::split_into_array_of_short_lines to split
  a text into array of paragraph chunks of sizes between 1 kB and 2 kB,
  giving less opportunity to runaway regular expressions in rules;
  fixes bugs: 5717, 5644, 5795, 5486, 5801, 5041;

MEMORY FOOTPRINT

- as a side-effect of compiling rules in smaller chunks (to avoid compiler
  crashes), virtual memory footprint of SpamAssassin is reduced;

- saved some memory by not importing the Pod::Usage unless it is needed;

- saved 350k+ of memory in sa-compile by replacing DynaLoader with XSLoader;

- removed unneeded index from MySQL bayes_token table;

IPv6 SUPPORT

- added IPv6 support for trusted_networks, internal_networks, msa_networks,
  whitelist_from_rcvd, and other stuff that uses NetSet and the Received
  header field parser, using NetAddr::IP;

- allowed usage of a remote dccifd host through an INET or INET6 socket;

- added IPv6 support to AWL plugin and its utility modules; a network
  mask length is now configurable and defaults to /48, which controls
  what data is stored in an AWL database;

- sql/README.awl and sql/awl_*.sql: increased suggested awl.ip field width
  to 40 characters to be able to hold IPv6 addresses;

- IP_PRIVATE now includes ipv6 variants of private address space,
  as well as the ipv6-mapped ipv4 addresses.

- NetSet now understands that ::ffff:192.168.1.2 and 192.168.1.2 are
  the same address;

- IPv6 addresses are now properly read from Received header fields;

- when reading Received header fields, the "IPv6:" prefix is stripped from
  IPv6 addresses, and "::ffff:" is removed from IPv6-mapped IPv4 addresses
  (so strings can match them as simply IPv4 addresses);

- ::1/128 is always included in the trusted_networks/internal_networks set
  similar to 127.0.0.0/8;

- some of the IPv6 functionality in SpamAssassin requires that a perl module
  IO::Socket::INET6 is available (like accessing a DNS resolver over inet6,
  talking to a dccifd host over inet6 socket, SPAMC protocol);

SPAMC

- Mail::SpamAssasin::Client ping may erroneously result in broken pipe;
  bump spamc protocol version to 1.5, updated spamd, spamc and Client.pm;

- added -n / --connect-timeout switch to spamc, allowing to separate
  a connection timeout from communication timeout;

- added --filter-retries and --filter-retry-sleep;

- increased allowed line length in spamc.conf files to 8 KiB and report
  an error when the limit is exceeded;

- fixed issue where spamc would not time out connections to a hung spamd;

- spamc client library leaked the zlib compression buffer if compression
  is used;

- spamc long option '--dest' was broken;

SPAMD

- when spamd is started with the daemonize option do not exit the parent
  until a child signals that it has logged the pid, to allow a wrapper
  script to simply continue immediately after starting spamd;

- additional tempfile cleanup in kill_handler;

- added SPAMD_LOCALHOST option to "make test" to allow specifying
  non-127.0.0.1 IP address for use in FreeBSD jail;

API

- adding one optional argument to Mail::SpamAssassin::parse allows caller
  to pass additional out-of-band information to SpamAssassin (such as a
  deadline time, DKIM verification results, information about a SMTP session,
  or dynamic rule hits); this information is made available to plugins and
  the rest of the code through a 'suppl_attrib' hash;

- added option 'master_deadline' to the suppl_attrib argument of a
  Mail::SpamAssassin::parse method, allowing the caller to override a
  time_limit configuration setting;

- Plugin::Check - pick up 'rule_hits' from caller via the new mechanism
  and call got_hit() on them;

- simplified adding dynamic score hits and dynamic rules by plugins
  (such as AWL, CRM114, FuzzyOcr, Check) by letting got_hit() accept
  options tflags and description, and letting it store a supplied
  dynamic score for proper reporting;

- let the timing breakdown information be accessible to a caller through
  the existing get_tag mechanism (tag TIMING);

- let the generated header fields ('add_header' configuration options)
  be accessible to a caller through the existing get_tag mechanism
  (tags ADDEDHEADER, ADDEDHEADERHAM, ADDEDHEADERSPAM);

RULES

- rules are no longer distributed with the package;

- new scores were generated by a genetic algorithm (GA) and then manually
  tweaked based on cleaned datasets supplied by a dozen volunteers;

- dropped redundant rules or rules causing too many false positives;

- added or updated many rules; incomplete list in no particular order:
  vbounce, lotsa_money, muchmoney, image spam, fill_this_form, FreeMail,
  European Parliament, HTML attachments, uri_obfu*, urinsrhsbl, urinsrhssub,
  urifullnsrhsbl, URI_OBFU_X9_WS, rDNS=localhost, INVALID_DATE_TZ_ABSURD,
  RCVD_IN_PSBL, FRT_VALIUM*, BOUNCE_MESSAGE, VBOUNCE_MESSAGE,
  __BOUNCE_UNDELIVERABLE, HELO_STATIC_HOST, FILL_THIS_FORM_FRAUD_PHISH,
  CHALLENGE_RESPONSE, DKIM_VALID, DKIM_VALID_AU, DKIM_ADSP_*,
  NML_ADSP_CUSTOM_{LOW,MED,HIGH}, __VIA_ML, MIME_BASE64_TEXT, LOTTO_URI,
  FORGED_MUA_THEBAT_BOUN, FORGED_MUA_THEBAT_CS, UNRESOLVED_TEMPLATE,
  __THEBAT_MUA, __ANY_OUTLOOK_MUA, RP_MATCHES_RCVD, one-word X-Mailer,
  SPAN rules, skype and misquoted-HTML rules, HTML obfuscation and
  Google feedproxy URI rules, advance_fee updates including further
  evolved advance fee second-order metarules, test rule for
  postmaster+abuse missing, FROM_MISSPACED, fixed FROM_CONTAINS_TAB, a
  Facebook redirector pattern, fixed FPs with TVD_SPACE_RATIO regarding
  one-word emails and ISO-2022-JP, added exclusion for __ISO_2022_JP_DELIM
  to OBFUSCATING_COMMENT, GAPPY_SUBJECT, PLING_QUERY and FM_FRM_RN_L_BRACK
  rules, RATWARE_BOUNDARY plus variant, superseded all previous
  RATWARE_OUTLOOK stuff, resolved FP in obfuscated URI rule, fixed breakage
  in tbird image rule, fixed SUBJECT_FUZZY_MEDS FP on unobfuscated "meds",
  added misspaced From header field rule, numeric+cctld URI rule,
  updated FH_DATE_PAST_20XX, ...

- added PSBL blacklist - http://psbl.surriel.com/

- added support for http://www.spamhaus.org/css/

- replaces HABEAS, BSP and SSC with RP CERTIFIED;

- use ReturnPath's RNBL, replacing SSBL;

- added rule for plain text attachments with octet-stream MIME type;

- avoided false positives on ISO-2022-JP messages in several rules;

- removed massmailers from uridnsbl_skip_domain in 25_uribl.cf;

- updated various default whitelists, uridnsbl_skip_domain, adsp_override, ...

PLUGINS

- new plugins: FreeMail, PhishTag, Reuse;

- now enabled by default: DKIM;

- now disabled by default: AWL;

- retired plugin: DomainKeys;

AWL PLUGIN

- plugin AWL is now disabled by default;

- added new configuration options auto_whitelist_ipv4_mask_len and
  auto_whitelist_ipv6_mask_len to allow more control on what part of
  an IP address is stored into an AWL database;

- README.awl: increased a suggested awl.ip field width to 40 characters
  to support IPv6 addresses;

- AutoWhitelist.pm: allowed storing a canonicalized IPv6 address, cropped
  to a configurable network mask (previously causing SQL server errors:
  'value too long');

- let AWL with SQL keep separate records for DKIM-signed and unsigned mail
  (when auto_whitelist_distinguish_signed configuration option is true,
  and a field awl.signedby exists);

- avoided a race condition in SQLBasedAddrList.pm when multiple processes
  try to insert-or-update an awl SQL record: trying INSERT first, and if
  that fails go for UPDATE;

- gracefully handle NaN from corrupted database or a broken emulator or
  virtualizer;

DCC PLUGIN

- added support for DCC reputations, added setting dcc_rep_percent,
  new test check_dcc_reputation_range(), new tag DCCREP
  (DCC servers supply reputation data only to licensed clients);

- allowed usage of a remote dccifd host through an INET or INET6 socket;

DKIM PLUGIN

- the DKIM plugin is now enabled by default for new installs if the perl
  module Mail::DKIM is installed.  However, installing SpamAssassin will
  not overwrite existing .pre configuration files, so to use DKIM when
  upgrading from a previous release that did not use DKIM, the directive:

    loadplugin Mail::SpamAssassin::Plugin::DKIM

  will need to be uncommented in file "v312.pre", or added to some
  other .pre file, such as local.pre;

- absolute minimal version of Mail::DKIM is 0.31;
  support for ADSP requires Mail::DKIM 0.34;
  a DNS test (and rule) for NXDOMAIN is operational since Mail::DKIM 0.36_5,
  so effectively the recommended version is Mail::DKIM 0.37 or later;

- a perl module Digest::SHA is required if the DKIM plugin is enabled.
  If a perl module Digest::SHA is available, the module Digest::SHA1
  becomes optional as far as SpamAssassin is concerned, but is still
  needed by Razor agents;

- added support for multiple signatures (useful for whitelisting);

- plugin now distinguishes author domain signatures from third party
  signatures (useful for whitelisting);

- provides a tag DKIMIDENTITY (in addition to DKIMDOMAIN);

- DKIM now supports Author Domain Signing Practices - ADSP (RFC 5617);

- use the Mail::DKIM::AuthorDomainPolicy instead of Mail::DKIM::DkimPolicy,
  when available (since Mail::DKIM 0.34);

- implements an 'adsp_override' configuration directive and adds
  an eval:check_dkim_adsp check, which is used by new DKIM_ADSP_* rules;

- rules contain an initial set of 'adsp_override' directives, listing
  some of the more popular target domains for phishing (applicable only to
  domains which sign all their direct mail with a DKIM or DK signature);

- this plugin can now re-use Mail::DKIM verification results if made
  available by a caller, which saves resources and makes it possible
  for SpamAssassin to work on a truncated large mail without breaking
  DKIM signatures;

- check_dkim_signed and check_dkim_adsp eval rules can now take an optional
  list of domain names, which limits their action to listed domains only.
  It facilitates building DKIM-based rules for specific domains, without
  having to resort to meta rules;

- draft-ietf-dkim-ssp-10/RFC-5617 made Author Domain Signature based on 'd':
  updated ADSP code accordingly; changed whitelisting code to be based on
  SDID ('d') instead of AUID ('i');

- Plugin/DKIM.pm: terminology changes in comments and logging according
  to RFC 5617 and draft-ietf-dkim-rfc4871-errata-07;

BUG FIXES

- fixed Rule2XSBody segfaults;

- no longer treat user data as perl booleans (a string "0" is a false);

- avoid data from the wild be interpreted as perl regular expressions;

- ArchiveIterator: prevent _scan_directory from passing directories
  to _scan_file (on NFS it would fail with EISDIR on read(2);

- fixed inserting the SpamAssassin -generated header fields after a
  multiline Return-Path header field;

- fixed vpopmail support;

- fixed incorrect mode bits when creating lock files for AWL;

- fixed some cases where :addr headers were parsed incorrectly;

- fixed leakage of 'whitelist_from_rcvd' entries between spamd users;

- fixing run_and_catch, which failed to catch a non-timed run;

- 127/8 isn't an illegal IP;

- reworked the M::S::Timeout module to deal with nested timers as one would
  expect: an inner timer shouldn't be able to extend an outer timer's limit;
  account for time elapsed in the submitted subroutine when restarting an
  outer timer; reset() should have accounted for time already spent;
  deal with nested timed runs where alarm(0) does not provide remaining time;

- the 'exists:' evaluator in HEADER rules now works as documented
  and tests for existence of a header field, instead of testing for
  a header field body being nonempty; internally, the pms->get can
  also now distinguish between empty and nonexistent header fields;

- applied fixes to header fields parsing in several places: header field
  names are case-insensitive, whitespace is not required after a colon,
  obsolete rfc822 syntax allowed whitespace before a colon;
  VBounce: match "Received:" only at the beginning of a line;

- fixed bugs 6237 and 6295: 1.0.0.0/8 and 2.0.0.0/8 are now valid allocated
  address ranges, fixed a corresponding rule RCVD_ILLEGAL_IP;

- fixed bug 6205 comment 5 in URIDetail.pm;

- 'pyzor_options' in Plugin/Pyzor.pm was not untainted;

- made the URIDetail plugin taint safe;

- fixed parsing of multi-line Received header fields for
  BOUNCE_MESSAGE/VBOUNCE_MESSAGE et al;

- Bug 6206, Bug 2536: spamd: untaint directory as obtained from a password
  file or from vpopmail utilities, avoid implicit untainting; report error
  if user preferences file exists but cannot be accessed;

- avoided using raw data from DNS as a regexp in Plugin/ASN.pm;

- ensured the dbg() and info() calls always return the same value (true)
  regardless of log level;

- suppressed logging of $& when its value is not available (i.e. when
  no regexp has been evaluated during rule evaluation);

- Exporter never really worked in SA, was not enclosed in BEGIN {};

- masses/runGA and masses/mk-baseline-results: prevent a shell 'source'
  command from loading an unrelated file named 'config' which happens to be
  in the current PATH - must use a ./ in an arg to a 'source' command;

ERROR HANDLING, ROBUSTNESS

- improved error detection and reporting: test status of all system calls
  and I/O operations (or explicitly document where not), and report
  unexpected failures;

- eval calls now check for eval result instead of testing the $@, which
  is not always reliable;

- localized $@ and $! in DESTROY methods to prevent potential calls to eval
  and calls to system routines in code executed from a DESTROY method
  from clobbering global variables $@ and $!;

- Util::helper_app_pipe_open_unix: contain a failing exec with an eval
  to prevent additional cases of process cloning. The exec could fail
  this way when given tainted arguments;

- Util::helper_app_pipe_open_unix: flush stdout and stderr before forking,
  otherwise an error reported by exec (such as 'insecure dependency')
  was lost in a buffer;

- eval-protected an open($fh,'-|') to capture implied fork failures
  due to lack of system resource;

- explicit untainting: combine "use re 'taint'" with untaint_var(),
  avoiding implicit perl untainting, along with workarounds to prevent it;

- added 'use strict' where missing;

- avoided a bunch of warnings on "Use of uninitialized value";

- clearly report reasons for helper application process failures;

- t/SATest.pm: provide information about the process failure reason
  if a system() call fails;  improved its reporting of failures;

- improved error reporting in Plugin/DCC.pm on finding a DCC home directory
  to facilitate troubleshooting;

OTHER CHANGES

- pseudoheader "ALL:raw" returns a pristine header section,
  and pseudoheader "ALL" returns a cleaned header section

- total rewrite of URI detection in plain text body;

- many updates to the list of top level domains;

- added 'util_rb_3tld', allowing 3-level TLDs to be listed in URIBLs and
  allowing new 3TLDs to be added from rule updates;

- avoided trusted_networks bog down due to O(n^2) loop with millions
  of entries;

- applied fixes to Plugin/VBounce.pm, updated VBounce ruleset;

- added support for a 'Communigate Pro' Received header field;

- parse Communigate Pro "with HTTPU" auth token;

- let DependencyInfo.pm understand a concept of recommended module version,
  besides a required version;

- provided a workaround for Net::DNS::Packet::new inconsistency;

- let SpamAssassin use either Digest::SHA or Digest::SHA1, whichever is
  available (the Digest::SHA is now a base module since perl 5.10.0);

- improved parsing of eval-type rules: allow unquoted domain names as
  arguments, disallow unmatched quotes;

- provided a new module Mail::SpamAssassin::BayesStore::BDB. It should be
  treated as alpha-quality (needs more testing) and is not yet ready for
  production use;

- exposed existing function 'received_within_months' as an eval function
  in Plugin/HeaderEval.pm;

- moved rc script to /var/lock/subsys/spamd instead of
  /var/lock/subsys/spamassassin so 'service spamd status' will work;

- added feature to re-download MIRRRORED.BY files at least once a week, or if
  'sa-update --refreshmirrors' switch is used;

- input delimiter $/ can be corrupted by a plugin, localize $/ and $\ before
  calling a plugin;

- bumped the retry counter to 180 seconds for starting spamd on slow machines;

- resolved Bug 5325: syslog severity level in spamc/libspamc.c for max
  message size (changed LOG_ERR into LOG_NOTICE for the message:
  "skipped message, greater than max message size");

- added checker to avoid taint warnings if hostname is returned as '(none)';

- altered sa-update to produce an error message if a channel doesn't exist;

- Bug 6150, Bug 6127, Bug 5981, Bug 5950, Bug 6191: let spamd log/report
  a child process exit status or aborting condition in an informative way;

- added checker to detect accidental match-everything regexps in rules;

- updated garescorer for 3.3.0: use more epochs in GA runs for better scores;
  clarify some mass-check warning output, ensure rule name always appears at
  start of line; if a rule had no default/existing score in 50_scores.cf,
  don't tell the GA that 1.0 is an appropriate default value, instead pick
  the midway point of its score range. this produces better results;
  remove some dead code from masses/score-ranges-from-freqs;

- set garescorer.c to report performance as iterations per second;

- added test to ensure that all config settings are correctly handled when
  switching between users; added more config setting type metadata to enable
  those tests to work; and fix URIDetail to store config on the {conf} object,
  not on the plugin;

- moved 'release tests' to xt/ directory; mirror long-running, net-tests and
  stress tests with xt/50_testname.t scripts to enforce their run before a
  release;

- made numerous additional and updated self-tests;

- added a Test::Perl::Critic release-test;

- cleaned up some code based on suggestions by perl module Test::Perl::Critic,
  among others:
  . enable TestingAndDebugging::ProhibitNoStrict test but allow the
    use of 'no strict "refs"';
  . deal with BuiltinFunctions::RequireGlobFunction;
  . deal with ControlStructures::ProhibitMutatingListFunctions
    removing this exception from xt/60_perlcritic.t;
  . deal with BayesStore/BDB.pm, Variables::ProhibitConditionalDeclarations
  . now that the module Time::HiRes is a required module, we can afford
    to replace a select() with Time::HiRes::sleep, and remove exception
    BuiltinFunctions::ProhibitSleepViaSelect from xt/60_perlcritic.t;

- updated documentation, fixing numerous typos and mistakes in documentation
  text and in log messages;

- extensively improved development process:
  . automated testing through Hudson, a continuous integration tool;
  . improved mass-check system and rules oversight;

(heinz)

Updated net/tightvnc to 1.3.10nb4

(sbd)

Re-inlcude "platform.def" in Xvnc/config/cf/vnc.def as not include breaks
the build on linux. Fixes PR 42291.

Bump PKGREVISION.

Ok wiz@

(sbd)

Pickup maintainership.

(sbd)

Recursive revision bump for GMP update.

(asau)

vim-7.2.411

(martti)

Updated vim to 7.2.411

  1548  7.2.403  (after 7.2.400) compiler warning for pointer type
  1880  7.2.404  pointers for composing characters are not properly initialized
  1636  7.2.405  with small features match is not highlighted for ":s/p/r/c"
  4701  7.2.406  (after 7.2.119) uninit memory read
  1916  7.2.407  when using :s with an expression backslashes are dropped
  2152  7.2.408  ":g/the/s/a/b/" can set '[ and '] marks to an unchanged line
  1814  7.2.409  summary of number of substitutes is incorrect for ":folddo"
  2526  7.2.410  highlighting directories for completion doesn't work properly
  1462  7.2.411  when parsing 'cino' a comma isn't skipped properly

(martti)

Avoid overlap between custom library and system libutil.

(joerg)

Fix DESTDIR installation by not messing with ${PREFIX}/etc.

(joerg)

tnftpd 20100324

(lukem)

Update to tnftpd-20100324:
Security fix when globbing paths.
Install example configuration files.

(lukem)

Updated www/ja-trac to 0.11.7pl1

(obache)

Update ja-trac to 0.11.7pl1, aka Trac-0.11.7.ja1.

Trac-0.11.7.ja1 (Mar 11, 2010)
* Merge Trac-0.11.7
* Fix typos
  - trac/wiki/default-pages/InterTrac

Trac 0.11.7 (March 10, 2010)
http://svn.edgewall.org/repos/trac/tags/trac-0.11.7

Trac 0.11.7 is nearly identical to 0.11.7rc1 except for a few more fixes:
  - avoid an infinite loop when using an AtomicFile in a read-only
    directory (#9081)
  - don't report client disconnects during writes as internal errors (#9103)
  - don't reuse a closed cursor, which could happen in one specific case
    for the pysqlite backend (#9104)

Trac 0.11.7rc1 (February 23, 2010)
http://svn.edgewall.org/repos/trac/tags/trac-0.11.7rc1

Security fixes:
- Fixed a ticket validation issue that would allow unauthorized users to modify the status and resolution of a ticket (#8884)

Performance improvements:
- Trac wiki had some trouble handling very long unicode words (#9025) [[comment(intentionally kept vague, we don't want to advertize a DOS, do we?)]]
- Full text search was very slow if lots of custom fields were used (#8935)

Bug fixes:
- Fixed a race condition that could lead to the destruction of the trac.ini file (#8623)
- Fixed creation of new milestone which could have been a rename if performed after a name clash has been detected (#8816)
- Fixed display of value 0 in report cells (#7512)

(obache)

update gcpio & fix my initials in the gtar updates earlier today

(tez)

add patch for CVE-2010-0624

(tez)

note update of net/filezilla to 3.3.2.1

(zafer)

Update filezilla to 3.3.2.1

Changelog:

* Remember location of update download directory
* Cancel file renaming on actions that change the file list, such as changing sort order or performing a refresh
* Cancel file renaming if starting a drag&drop operation
* Filter invalid characters if downloading through double-clicking files or if adding from the search dialog
* Fix site-specific bookmarks menu
* The menu did not reflect initial value of preserve timestamp option properly
* MSW: Keep FileZilla subdirectory in startmenu when updating, preserves custom order
* MSW: Add AppID support to installer

(zafer)

Fix build by increasing BUILDLINK_API_DEPENDS.pangomm. Error was:

checking for GDKMM... configure: error: Package requirements (giomm-2.4 >= 2.22 pangomm-1.4 >= 2.26 gtk+-2.0 >= 2.18) were not met:

Requested 'pangomm-1.4 >= 2.26' but version of Pangomm is 2.24.0

(2.24.0 doesn't provide needed pangommconfig.h.)

While here remove now-irrelevant comment from buildlink3.mk.

(reed)

update gtar (includes CVE2010-0624 fix)

(tez)

Update gtar to 1.23 - fixes CVE2010-0624
Also:
# Improved record size autodetection
# Use of lseek on seekable archives
# New command line option --warning
# New command line option --level
# Improved behavior if some files were removed during incremental dumps
# Modification times of PAX extended headers
# Time references in the --pax-option argument
# Augmented environment of the --to-command script
# Bugfixes:
    * Fix handling of hard link targets by -c --transform
    * Fix hard links recognition with -c --remove-files
    * Fix restoring files from backup (debian bug #508199)
    * Correctly restore modes and permissions on existing directories
    * The --remove-files option removes files only if they were succesfully stored in the archive
    * Fix storing and listing of the volume labels in POSIX format
    * Improve algorithm for splitting long file names (ustar format)

(tez)

Install data files to share/examples to make sure they end up in the
binary package. Fixes DESTDIR installation at the same time. Bump revision.

(joerg)

Expand MACHINE_ARCH, it should always be "i386".
This fixes package on non-i386 platforms.

(asau)

DESTDIR support.
XXX still doesn't pass the world-writeable file check

(joerg)

Reset maintainer, lost his commit bit.

(wiz)

Update the PLIST to match what's being installed, overlooked
in previous update.  Should fix PR#43031.

(he)

Updated www/lighttpd to 1.4.26nb1

(gson)

Apply patch to fix the issue reported in
<http://redmine.lighttpd.net/issues/2157>.  Without this patch,
lighttpd 1.4.26 will fail to start if built with the pkgsrc OpenSSL
and configured to serve HTTPS.  Bump PKGREVISION.

(gson)

Fix test ==.
Reported by Robert Elz in PR 43046.

(wiz)

Update to firefox-3.6.2 proper. (no changes from the beta)

Also add patch for PR pkg/42988 crash, effectively disabling all
sound support until we decide on what sound API to use.
The current dlopen() guesswork is bad, mkay.

Bump PKGREVISION for this and previous changes.

(tnn)

Takeover maintainership.

(sbd)

Mark as unsupported for NetBSD 5+ as it wants to mess with kernel
internals no longer exported in the expected way.

(joerg)

Not MAKE_JOBS_SAFE.

(joerg)

Use /usr/include/dev/apm/* on AMD64. Add explicit failure message for
systems that have neither those nor /usr/include/machine/apmvar.h.
Mark as DESTDIR ready.

(joerg)

+ libmikmod-3.1.12 lshell-0.9.10

(obache)

pkglint clean.

(obache)

Updated textproc/mdoclint to 1.6

(wiz)

Fix previous (hi joerg!).
Bump version.

(wiz)

Fix desktop icon name (PR pkg/43036)

(tnn)

Update mail/imapproxy to 1.2.7

(manu)

Update to 1.2.7
Check http://www.imapproxy.org/downloads/ChangeLog for changes since 1.0

(manu)

Updated www/seamonkey-bin to 1.1.19

(obache)

Updte seamonkey-bin to 1.1.19.

New Features and Fixes:
Security fixes
END OF LIFE for SeaMonkey 1.x comes with this version, which does NOT fix all
issues. Only SeaMonkey 2.0 fixes all known issues, we strongly encourage all our
users to switch to that new release series.

Rough Changelog for SeaMonkey 1.1.19:
504523 Thunderbird 2 needs NSS 3.12.3.1
512187 1.1.18 candidate fails to connect with SSL/TLS secured sites, PSM fails to initialize
512085 tracking bug for build and release of SeaMonkey 1.1.18
523984 Old (1.9.0/1.8.1) Default Plugin.plugin Makefile uses non-portable "echo -n"
376192 Thunderbird crashes immediately upon accessing IMAP server (duplicate entries in .mailboxlist) [@  nsImapServerResponseParser::mailbox] - imap protocol log "Internal Syntax Error
494706 [1.8 branch only] Thunderbird creates 4 GB Trash file out of less than 200 kB of deleted mail (If data write to file for "target folder of mail move/copy" is temporary interfered by other software, Tb 2 generates file of file_size=4GB-1)
387502 Mailboxes are allowed to grow larger than 4gb in size
535193 DNS resolution in MakeSN of nsAuthSSPI causing issues for proxy servers that support NTLM auth
363455 Enhance PSM's SSL handling on blocking sockets
389087 nsILocalFileUnix affected by 32bit stat/statvfs/truncate, therefore does not work with large files
495098 Crash when using single XMLHttpRequest object for two simultaneous requests; test case included [@ nsXMLHttpRequest::StreamReaderFunc ]
537307 Update SeaMonkey's copyright strings to 2010
440982 To avoid calling JS at unsafe times from JS_GC, jsds_ScriptHookProc should not get the script hook unless it needs to and it is safe to call
305168 Too many recipients when copy/paste address line or sending from MS Access (increase max to 2000)
511521 downloading file with RTL override (RLO) presents conflicting filenames
344818 Linking - missing library deps
505305 Probably Exploitable - Read Access Violation on Block Data Move starting at MSVCR80D!memcpy+0x000000000000005a
440236 crash after connection lost [@ nsMsgDatabase::GetTableCreateIfMissing(char const*, char const*, nsIMdbTable**, unsigned int&, unsigned int&)], in v2 [@ nsMsgDatabase::GetTableCreateIfMissing]
483437 PSM doesn't properly escape AVA Values in Cert Viewer Details tab
483440 PSM doesn't detect invalid OID encodings in Cert Viewer Details tab
284876 Trunk TB10 crash while sending mail [@ nsMsgLocalMailFolder::WriteStartOfNewMessage() ]
516862 Array indexing error in js/src/dtoa.c's Balloc() leads to floating point memory vulnerability (SA36711)
506871 TreeColumns Dangling Pointer Vulnerability (ZDI-CAN-536)
519839 SVG fails to render correctly

(obache)

Updated www/viewvc to 1.0.10

(obache)

Update viewvc to 1.0.10.
While here, set LICENSE=2-clause-bsd.

Version 1.0.10 (released 10-Mar-2010)

  * security fix: escape user-provided query form input to avoid XSS attack
  * fix errors viewing remote Subversion paths with URI-unsafe characters
  * fix regexp input validation (issue #426, #427, #440)

(obache)

Revert unintentional part of last revision

(morr)

Use uwsgi-0.9.4.3 tarball. No changes to the code.

(joerg)

Updated net/nmap to 5.21

(pettai)

Nmap 5.21 [2010-01-27] (-> Nmap 5.00)

Some of highlights are:

o Dramatically improved the version detection database, integrating
  2,596 submissions that users contributed since February 3, 2009!
o Added 7 new NSE scripts for a grand total of 79!
o Performed a memory consumption audit and made changes to
  dramatically reduce Nmap's footprint.
o A major service detection submission integration.
o Added some new service detection probes
o Added 14 new NSE scripts for a grand total of 72! You can learn
  about them all at http://nmap.org/nsedoc/. Here are the new ones:
o Nmap's --traceroute has been rewritten for better performance.
o Integrated 1,349 fingerprints (and 81 corrections).
o [NSE] Default socket parallelism has been doubled from 10 to 20.
o [NSE] Now supports worker threads
o Zenmap now includes ports in the services view whenever Nmap found
  them "interesting," whatever their state.
o [Ncat, Ndiff] The exit codes of these programs now reflect whether
  they succeeded.
o Optimize MAC address prefix lookup by using an std::map
o Canonicalized the list of OS detection device types to a smaller set.
o Zenmap's UI performance has improved significantly.
o [NSE] socket garbage collection was rewritten for better performance.

Many many bugfixes!

For full changelog, see http://nmap.org/changelog.html

Ok'ed during freeze by wiz@

(pettai)

Upgrade proftpd to 1.3.3 (bug fixes, see the NEWS file for a full list).

(kim)

include gettext-lib buildlink; necessary to compile dependant packages
(such as php-pspell) on Mac OS X 10.6.2 - without that the compile fails
as libintl is not found

(jdolecek)

+ asterisk16-1.6.2.6, bison-2.4.2, dbus-1.2.22,
  epubcheck-1.0.5, etm-560, fotoxx-9.8, gdb-7.1, gnutls-2.8.6,
  ktorrent-3.3.4, libgdiplus-2.6.2, libnice-0.0.11, libtasn1-2.5,
  libxml2-2.7.7, mono-2.6.3, monodevelop-2.2.2, mpop-1.0.20,
  msmtp-1.4.20, p5-DateTime-Locale-0.45, p5-ExtUtils-CBuilder-0.2703,
  p5-IMDB-Film-0.45, p5-IO-Socket-INET6-2.59, p5-IO-Socket-SSL-1.33,
  p5-Mouse-0.51, p5-Text-Markdown-1.000031, py-libxml2-2.7.7,
  python26-2.6.5, tor-0.2.1.25, x264-devel-20100320.

(wiz)

add php5-enchant and php5-intl

(jdolecek)

explicitly disable sqlite3 and intl, we don't want to compile them into main PHP executable;
the extensions were not actually built since necessary libraries were not found due to pkgsrc
framework, but better be explicit

fix MESSAGE_SRC to use lang/php53 locations

bump PKGREVISION

(jdolecek)

move php53-enchant and php53-intl entries into common
section, they are no longer PHP 5.3.x only; also use textproc/php-intl

(jdolecek)

remove misc/php-intl in favor of textproc/php-intl (which supports both
PHP 5.2.* and PHP 5.3.*)

(jdolecek)

add php-intl

(jdolecek)

Add php-intl package, using PECL version 1.1.1, modified to compile with
both PHP 5.3.2 and PHP 5.3.12

compile tested on Mac OS X 10.6.2 and NetBSD 5.0.1

This module is an internationalization extension, enabling PHP programmers
to perform UCA-conformant collation and date/time/number/currency formatting
in their scripts.

It tends to closely follow ICU APIs, so that people having experience
working with ICU in either C/C++ or Java could easily use the PHP
API. Also, this way ICU documentation would be useful to understand
various ICU functions.

Intl consists of several modules, each of them exposes the corresponding ICU
API:
    * Collator: provides string comparison capability with support
      for appropriate locale-sensitive sort orderings.
    * Number Formatter: allows to display number according to the
      localized format or given pattern or set of rules, and to parse
      strings into numbers.
    * Message Formatter: allows to create messages incorporating
      data (such as numbers or dates) formatted according to given
      pattern and locale rules, and parse messages extracting data
      from them.
    * Normalizer: provides a function to transform text into one
      of the Unicode normalization forms, and provides a routine to
      test if a given string is already normalized.
    * Locale: provides interaction with locale identifiers in the
      form of functions to get subtags from locale identifier; parse,
      compose, match(lookup and filter) locale identifiers.

Status:

Vendor Tag: TNF
Release Tags: pkgsrc-base

(jdolecek)

Pick up maintainership.

(joerg)

libfetch-2.31:

PR 43013 by Brook Milligan: fetch(3) violates RFC 1738 for ftp:// URLs
if the home directory is not the root directory.

Remember the current directory the first time a CWD / CDUP has to be
issued. Use the document as full URL if the URL started with two /
(quoted or not), otherwise append it to the initial directory.

(joerg)

Apply patches from PR 34941 to match prototype and implementatio w.r.t
static.

(joerg)

Apply patch from PR 34942: Match prototype and body in staticness.

(joerg)

Use ISO C99 / POSIX types. Should fix PR 40416.

(joerg)

Reset maintainer, developer lost his commit bit.

(wiz)

Revert unintended commit.

(wiz)

Note update of sysutils/ruby-quota package to 0.5.1nb8.

(taca)

Improve portability (NULL v.s. 0).

Bump PKGREVISION.

(taca)

Note update of www/typolight28-translations package to 20100318.

(taca)

Update typolight28-translations package to 20100318.

Update Bosnian language files.

(taca)

Note update of mysql-server-5.1.44nb2.

(taca)

Add mysqlmanager, ndb-cluster and pstack PKG_OPTIONS.
These are control some optional functions for mysql51-server (leaf package).

Bump PKGREVISION.

(taca)

Add mysqlmanager, ndb-cluster and pstack options.

Thess are used by mysql51-server only.

(taca)

Some clean up to CONFIGURE_ARGS; remove obsolete options.

(taca)

Add new options for mysql51-server pacakge.

(taca)

Updated www/py-moin to 1.9.2

(pettai)

Updated py-moin (MoinMoin)

(pettai)

note update for php-enchant and addition of version for PHP 5.2

(jdolecek)

switch php-enchant to use PECL module (version 1.1.0), so that it's also usable with PHP 5.2.*

compilation tested with PHP 5.2.13 and 5.3.2 on Mac OS X 10.6.2, NetBSD 5.0.1

slightly adjust COMMENT

(jdolecek)