Link [ pkgsrc | NetBSD | pkgsrc git mirror | PR fulltext-search | netbsd commit viewer ]


   
        usage: [branch:branch] [user:user] [path[@revision]] keyword [... [-excludekeyword [...]]] (e.g. branch:MAIN pkgtools/pkg)




switch to index mode

recent branches: MAIN (5h)  pkgsrc-2024Q1 (14d)  pkgsrc-2023Q4 (42d)  pkgsrc-2023Q2 (74d)  pkgsrc-2023Q3 (154d) 

2024-05-13 05:44:50 UTC Now

2023-12-23 20:09:18 UTC MAIN commitmail json YAML

skalibs: update to 2.14.1.0. Changes:

- Bugfixes.
- Portability improvements.
- New socket_sendnb46_g() and socket_recvnb46_g() macros.

A bugfix release -- but an important one. All users should upgrade.

(schmonz)

2023-12-23 20:00:45 UTC MAIN commitmail json YAML

doc: Updated textproc/glow to 1.5.1

(bsiegert)

2023-12-23 20:00:23 UTC MAIN commitmail json YAML

glow: update to 1.5.1

- bugfixes

Also manually fix the following vulnerability:

Vulnerability #1: GO-2023-2402
    Man-in-the-middle attacker can compromise integrity of secure channel in
    golang.org/x/crypto
  More info: https://pkg.go.dev/vuln/GO-2023-2402
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e
    Fixed in: golang.org/x/crypto@v0.17.0

(bsiegert)

2023-12-23 19:34:09 UTC MAIN commitmail json YAML

doc: pkg-vulnerabilities: revert previous, we do not remove entries

Add an upper bound instead, or comment out if it's disputed.

(wiz)

2023-12-23 19:24:49 UTC MAIN commitmail json YAML

mk/blas.buildlink3.mk: add missing variables to effects, undef C ABI libs

(... if C interface was not desired)

(thor)

2023-12-23 19:12:51 UTC MAIN commitmail json YAML

pkg-vulnerabilities: drop R buffer overflow that applied to 3.3, ages ago

(thor)

2023-12-23 16:35:45 UTC MAIN commitmail json YAML

doc: Updated biology/chip-seq to 1.2

(bacon)

2023-12-23 16:35:39 UTC MAIN commitmail json YAML

biology/chip-seq: Update to 1.2

Update python versions to match py-macs2
Add sra-tools and a few commonly used archivers to metapkg

(bacon)

2023-12-23 16:23:29 UTC MAIN commitmail json YAML

doc: Updated biology/atac-seq to 1.3

(bacon)

2023-12-23 16:23:22 UTC MAIN commitmail json YAML

biology/atac-seq: Adjust python versions to match py-macs2

Add sra-tools and a few commonly used archivers to metapkg

(bacon)

2023-12-23 16:15:19 UTC MAIN commitmail json YAML

doc: Updated biology/py-macs2 to 2.2.9.1

(bacon)

2023-12-23 16:15:02 UTC MAIN commitmail json YAML

2023-12-23 14:59:24 UTC MAIN commitmail json YAML

doc: exim smtp smuggling vuln

(wiz)

2023-12-23 13:13:36 UTC MAIN commitmail json YAML

flang: fix build on non-darwin platfroms
Add patch to make sure CGPasses.h.inc
is generated.
Add LDLIBRARY_PATH on non-darwin
platforms so that flang-new can compile
the module files.
Make sure CMake generated directories
are not installed.
Soname is set on non-darwin platforms
so adapt the PLIST for this.

(nros)

2023-12-23 11:52:31 UTC MAIN commitmail json YAML

editors/fileobj: Update to v0.8.1

ChangeLog:
- Minor fixes and cleanups
- Fix D bug on block device (since v0.7.87)
- Add Python 3.12 support
- Change default scroll mode to line scroll

(tkusumi)

2023-12-23 10:12:01 UTC MAIN commitmail json YAML

2023-12-23 10:10:12 UTC MAIN commitmail json YAML

2023-12-23 10:06:49 UTC MAIN commitmail json YAML

2023-12-23 10:05:07 UTC MAIN commitmail json YAML

2023-12-23 10:03:26 UTC MAIN commitmail json YAML

2023-12-23 10:02:40 UTC MAIN commitmail json YAML

2023-12-23 09:58:52 UTC MAIN commitmail json YAML

update master site for pear. remove redundant

(zafer)

2023-12-23 09:52:14 UTC MAIN commitmail json YAML

2023-12-23 09:50:09 UTC MAIN commitmail json YAML

update master site and homepage

(zafer)

2023-12-23 09:46:13 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-23 09:45:05 UTC MAIN commitmail json YAML

2023-12-23 09:44:24 UTC MAIN commitmail json YAML

2023-12-23 09:42:37 UTC MAIN commitmail json YAML

2023-12-23 09:39:08 UTC MAIN commitmail json YAML

2023-12-23 09:37:41 UTC MAIN commitmail json YAML

2023-12-23 09:36:04 UTC MAIN commitmail json YAML

2023-12-23 09:34:10 UTC MAIN commitmail json YAML

2023-12-23 09:32:58 UTC MAIN commitmail json YAML

2023-12-23 09:27:16 UTC MAIN commitmail json YAML

2023-12-23 09:25:37 UTC MAIN commitmail json YAML

2023-12-23 09:23:23 UTC MAIN commitmail json YAML

update master site

(zafer)

2023-12-23 09:19:39 UTC MAIN commitmail json YAML

2023-12-23 09:15:58 UTC MAIN commitmail json YAML

2023-12-23 09:12:15 UTC MAIN commitmail json YAML

2023-12-23 09:08:09 UTC MAIN commitmail json YAML

2023-12-23 09:04:25 UTC MAIN commitmail json YAML

download.gnome.org is automatically redirecting to cloest mirror

(zafer)

2023-12-23 08:54:40 UTC MAIN commitmail json YAML

2023-12-23 08:50:33 UTC MAIN commitmail json YAML

2023-12-23 08:49:41 UTC MAIN commitmail json YAML

2023-12-23 08:47:32 UTC MAIN commitmail json YAML

2023-12-23 08:46:54 UTC MAIN commitmail json YAML

2023-12-23 08:46:15 UTC MAIN commitmail json YAML

2023-12-23 08:45:32 UTC MAIN commitmail json YAML

2023-12-23 08:44:34 UTC MAIN commitmail json YAML

2023-12-23 08:43:31 UTC MAIN commitmail json YAML

2023-12-23 08:38:24 UTC MAIN commitmail json YAML

2023-12-23 08:26:05 UTC MAIN commitmail json YAML

update master site

(zafer)

2023-12-23 08:23:31 UTC MAIN commitmail json YAML

update master site

(zafer)

2023-12-23 08:20:53 UTC MAIN commitmail json YAML

2023-12-23 08:16:19 UTC MAIN commitmail json YAML

2023-12-23 08:11:46 UTC MAIN commitmail json YAML

2023-12-23 08:09:39 UTC MAIN commitmail json YAML

2023-12-23 08:04:15 UTC MAIN commitmail json YAML

update homepage and master site

(zafer)

2023-12-23 03:08:05 UTC MAIN commitmail json YAML

2023-12-23 03:01:39 UTC MAIN commitmail json YAML

2023-12-23 02:43:38 UTC MAIN commitmail json YAML

2023-12-23 02:13:49 UTC MAIN commitmail json YAML

2023-12-23 02:10:14 UTC MAIN commitmail json YAML

2023-12-23 02:06:28 UTC MAIN commitmail json YAML

2023-12-23 02:02:48 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-23 02:01:00 UTC MAIN commitmail json YAML

2023-12-23 01:59:43 UTC MAIN commitmail json YAML

2023-12-23 01:57:59 UTC MAIN commitmail json YAML

2023-12-23 01:55:28 UTC MAIN commitmail json YAML

2023-12-23 01:53:45 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-23 01:49:25 UTC MAIN commitmail json YAML

2023-12-23 01:47:55 UTC MAIN commitmail json YAML

2023-12-23 01:45:01 UTC MAIN commitmail json YAML

2023-12-23 01:43:32 UTC MAIN commitmail json YAML

2023-12-23 01:42:40 UTC MAIN commitmail json YAML

2023-12-23 01:41:43 UTC MAIN commitmail json YAML

2023-12-23 01:40:26 UTC MAIN commitmail json YAML

2023-12-23 00:43:28 UTC MAIN commitmail json YAML

2023-12-23 00:41:50 UTC MAIN commitmail json YAML

update master site

(zafer)

2023-12-22 21:06:23 UTC MAIN commitmail json YAML

grantlee-qt5: remove -Wl,--fatal-warnings

This breaks the build because of warnings about missing includes
when linking against libutil on NetBSD-current.

(wiz)

2023-12-22 20:54:09 UTC MAIN commitmail json YAML

doc: Updated games/supertux to 0.6.3nb4

(prlw1)

2023-12-22 20:53:49 UTC MAIN commitmail json YAML

2023-12-22 20:07:29 UTC MAIN commitmail json YAML

libdsk-1.5.19

(zafer)

2023-12-22 20:00:03 UTC MAIN commitmail json YAML

2023-12-22 19:56:03 UTC MAIN commitmail json YAML

2023-12-22 19:53:54 UTC MAIN commitmail json YAML

clean-up master sites

(zafer)

2023-12-22 19:41:42 UTC MAIN commitmail json YAML

update homepage and master site

(zafer)

2023-12-22 19:37:02 UTC MAIN commitmail json YAML

2023-12-22 19:35:34 UTC MAIN commitmail json YAML

2023-12-22 19:30:03 UTC MAIN commitmail json YAML

2023-12-22 19:27:21 UTC MAIN commitmail json YAML

update master site

(zafer)

2023-12-22 19:25:13 UTC MAIN commitmail json YAML

2023-12-22 19:24:27 UTC MAIN commitmail json YAML

2023-12-22 19:22:24 UTC MAIN commitmail json YAML

2023-12-22 19:19:13 UTC MAIN commitmail json YAML

update homepage

(zafer)

2023-12-22 19:17:31 UTC MAIN commitmail json YAML

git-lfs vulnerability

(bsiegert)

2023-12-22 19:15:23 UTC MAIN commitmail json YAML

doc: Updated devel/git-lfs to 3.4.1

(bsiegert)

2023-12-22 19:15:06 UTC MAIN commitmail json YAML

update homepage. fetch from backup. needs update.

(zafer)

2023-12-22 19:14:43 UTC MAIN commitmail json YAML

git-lfs: update to 3.4.1 (security)

This fixes the following vulnerability:

Vulnerability: GO-2023-1571
    Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2023-1571
  Module: golang.org/x/net
    Found in: golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2
    Fixed in: golang.org/x/net@v0.7.0

3.4.1
-----
This is a bugfix release which resolves a bug introduced in the
v3.4.0 release, where Git LFS may crash if the Git credential manager
returns credentials containing one or more empty fields.

3.4.0
-----
This release is a feature release which includes support for generating
shell scripts for command-line tab-completion of Git LFS commands with
the new git-lfs-completion(1) command, providing multiple headers to Git
credential helpers (a new feature as of Git 2.41), and installing Git LFS
with a Git configuration file stored under the XDG configuration path.

(bsiegert)

2023-12-22 19:11:07 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-22 19:09:39 UTC MAIN commitmail json YAML

update master sites

(zafer)

2023-12-22 19:07:22 UTC MAIN commitmail json YAML

2023-12-22 18:51:13 UTC MAIN commitmail json YAML

2023-12-22 18:49:23 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-22 18:43:25 UTC MAIN commitmail json YAML

2023-12-22 18:37:42 UTC MAIN commitmail json YAML

add print/epstool-3.0.9

(zafer)

2023-12-22 18:34:26 UTC MAIN commitmail json YAML

2023-12-22 18:33:02 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-22 18:32:12 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-22 18:31:14 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-22 18:31:00 UTC MAIN commitmail json YAML

vulnerability entries for mysqld_exporter and postgres_exporter

(bsiegert)

2023-12-22 18:30:10 UTC MAIN commitmail json YAML

2023-12-22 18:28:42 UTC MAIN commitmail json YAML

2023-12-22 18:27:39 UTC MAIN commitmail json YAML

update homepage and master site

(zafer)

2023-12-22 18:26:20 UTC MAIN commitmail json YAML

update homepage and master site

(zafer)

2023-12-22 18:23:40 UTC MAIN commitmail json YAML

2023-12-22 18:22:42 UTC MAIN commitmail json YAML

2023-12-22 18:17:22 UTC MAIN commitmail json YAML

2023-12-22 18:16:32 UTC MAIN commitmail json YAML

2023-12-22 18:14:52 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-22 18:13:23 UTC MAIN commitmail json YAML

2023-12-22 18:12:01 UTC MAIN commitmail json YAML

update homepage and master site

(zafer)

2023-12-22 18:07:50 UTC MAIN commitmail json YAML

2023-12-22 18:06:53 UTC MAIN commitmail json YAML

remove dead master site

(zafer)

2023-12-22 18:04:31 UTC MAIN commitmail json YAML

2023-12-22 18:02:38 UTC MAIN commitmail json YAML

2023-12-22 17:59:34 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-22 17:51:18 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-22 17:49:32 UTC MAIN commitmail json YAML

fetch from backup

(zafer)

2023-12-22 17:46:24 UTC MAIN commitmail json YAML

add cvs2svn

(zafer)

2023-12-22 17:44:47 UTC MAIN commitmail json YAML

update homepage. fetch from backup.

(zafer)

2023-12-22 17:44:09 UTC MAIN commitmail json YAML

doc: Updated databases/postgres_exporter to 0.15.0

(bsiegert)

2023-12-22 17:43:57 UTC MAIN commitmail json YAML

postgres_exporter: update to 0.15.0 (security)

This fixes the following vulnerabilities:

Vulnerability: GO-2023-1571
    Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2023-1571
  Module: golang.org/x/net
    Found in: golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
    Fixed in: golang.org/x/net@v0.7.0

Vulnerability: GO-2022-1130
    Authentication bypass in github.com/prometheus/exporter-toolkit
  More info: https://pkg.go.dev/vuln/GO-2022-1130
  Module: github.com/prometheus/exporter-toolkit
    Found in: github.com/prometheus/exporter-toolkit@v0.7.1
    Fixed in: github.com/prometheus/exporter-toolkit@v0.8.2

0.15.0
------
- Add 1kB and 2kB units
- Add error log when probe collector creation fails
- Fix test build failures on 32-bit arch
- Adjust collector to use separate connection per scrape

0.14.0
------
- Add state label to pg_process_idle_seconds
- Change database connections to one per scrape

0.13.0
------
BREAKING CHANGES:

Please note, the following features are deprecated and may be removed in a future release:

    auto-discover-databases
    extend.query-path
    constantLabels
    exclude-databases
    include-databases

This exporter is meant to monitor PostgresSQL servers, not the user data/databases. If
you need a generic SQL report exporter https://github.com/burningalchemist/sql_exporter
is recommended.

0.12.0
------
BREAKING CHANGES:

This release changes support for multiple postgres servers to use the
multi-target exporter pattern. This makes it much easier to monitor multiple
PostgreSQL servers from a single exporter by passing the target via URL
params. See the Multi-Target Support section of the README.

(bsiegert)

2023-12-22 17:36:15 UTC MAIN commitmail json YAML

doc: Updated databases/mysqld_exporter to 0.15.1

(bsiegert)

2023-12-22 17:36:04 UTC MAIN commitmail json YAML

mysqld_exporter: update to 0.15.1 (security)

This fixes the following vulnerabilities:

Vulnerability #1: GO-2023-1571
    Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2023-1571
  Module: golang.org/x/net
    Found in: golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
    Fixed in: golang.org/x/net@v0.7.0

Vulnerability #2: GO-2022-1130
    Authentication bypass in github.com/prometheus/exporter-toolkit
  More info: https://pkg.go.dev/vuln/GO-2022-1130
  Module: github.com/prometheus/exporter-toolkit
    Found in: github.com/prometheus/exporter-toolkit@v0.7.1
    Fixed in: github.com/prometheus/exporter-toolkit@v0.8.2

0.15.1
------
Rebuild for dependency updates

0.15.0
------
BREAKING CHANGES:

The exporter no longer supports the monolithic DATA_SOURCE_NAME environment
variable.  To configure connections to MySQL you can either use a my.cnf style
config file or command line arguments.

For example:

export MYSQLD_EXPORTER_PASSWORD=secret
mysqld_exporter --mysqld.address=localhost:3306 --mysqld.username=exporter

We have also dropped some internal scrape metrics:

    mysql_exporter_scrapes_total
    mysql_exporter_scrape_errors_total
    mysql_last_scrape_failed

The default client configuration file is now .my.cnf in the process working
directory. Use --config.my-cnf="$HOME/.my.cnf" to retain the previous default.

(bsiegert)

2023-12-22 17:35:20 UTC MAIN commitmail json YAML

doc: postfix smtp smuggling vuln

(wiz)

2023-12-22 17:29:32 UTC MAIN commitmail json YAML

doc: Updated mail/postfix to 3.8.4

(wiz)

2023-12-22 17:29:18 UTC MAIN commitmail json YAML

postfix*: update to 3.8.4

20230815

Bugfix (bug introduced: 20140218): when opportunistic TLS fails
during or after the handshake, don't require that a probe
message spent a minimum time-in-queue before falling back to
plaintext. Problem reported by Serg. File: smtp/smtp.h.

20230819

Bugfix (defect introduced: 19980207): the valid_hostname()
check in the Postfix DNS client library was blocking unusual
but legitimate wildcard names (*.name) in some DNS lookup
results and lookup requests. Examples:

            name          class/type value
            *.one.example  IN CNAME *.other.example
            *.other.example IN A    10.0.0.1
            *.other.example IN TLSA  ..certificate info...

Such syntax is blesed in RFC 1034 section 4.3.3.

This problem was reported first in the context of TLSA
record lookups. Files: util/valid_hostname.[hc],
dns/dns_lookup.c.

20230929

Bugfix (defect introduced Postfix 2.5, 20080104): the Postfix
SMTP server was waiting for a client command instead of
replying immediately, after a client certificate verification
error in TLS wrappermode. Reported by Andreas Kinzler. File:
smtpd/smtpd.c.

20231006

Usability: the Postfix SMTP server now attempts to log the
SASL username after authentication failure. In Postfix
logging, this appends ", sasl_username=xxx" after the reason
for SASL authentication failure. The logging replaces an
unavailable reason with "(reason unavailable)", and replaces
an unavailable sasl_username with "(unavailable)". Based
on code by Jozsef Kadlecsik. Files: xsasl/xsasl_server.c,
xsasl/xsasl_cyrus_server.c, smtpd/smtpd_sasl_glue.c.

20231026

Bugfix (defect introduced: Postfix 2.11): in forward_path,
the expression ${recipient_delimiter} would expand to an
empty string when a recipient address had no recipient
delimiter. Fixed by restoring Postfix 2.10 behavior to use
a configured recipient delimiter value. Reported by Tod
A. Sandman. Files: proto/postconf.proto, local/local_expand.c.

20231221

Security: with "smtpd_forbid_bare_newline = yes" (default
"no" for Postfix < 3.9), reply with "Error: bare <LF>
received" and disconnect when an SMTP client sends a line
ending in <LF>, violating the RFC 5321 requirement that
lines must end in <CR><LF>. This prevents SMTP smuggling
attacks that target a recipient at a Postfix server. For
backwards compatibility, local clients are excluded by
default with "smtpd_forbid_bare_newline_exclusions =
$mynetworks". Files: mantools/postlink, proto/postconf.proto,
global/mail_params.h, global/smtp_stream.c, global/smtp_stream.h,
smtpd/smtpd.c.

(wiz)

2023-12-22 17:23:48 UTC MAIN commitmail json YAML

remove slash from path, since master site already contains trailing slash.

(zafer)

2023-12-22 17:11:31 UTC MAIN commitmail json YAML

Fix substitution of $PREFIX/bin/firefox115 for NetBSD native X11

No change for other platforms

Bump PKGREVISION

(abs)

2023-12-22 16:41:58 UTC MAIN commitmail json YAML

doc: note cargo-modules downgrade

(wiz)

2023-12-22 16:41:07 UTC MAIN commitmail json YAML

2023-12-22 15:35:44 UTC MAIN commitmail json YAML

graphics/opencv: avoid name-clash of complex macro for gcc<4.8

This adds #undef complex explicitly, to fix the build for older gccs that
don't have that in their headers for C++ code.

(thor)

2023-12-22 14:30:55 UTC MAIN commitmail json YAML

graphics/opencv: disable stupid extern "C" that broke NetBSD build

For no good reason, perhaps for ancient LAPACK headers, the wrapper header
puts the includes into extern "C". This causes some compilers to complain
because LAPACK headers do C++ stuff if they see a C++ compiler and then
add extern "C" themselves.

(thor)

2023-12-22 13:38:31 UTC MAIN commitmail json YAML

fsviewer: Fix build by getting WINGs library flags via pkg-config
fsviewers build breaks because it can't find pango/pango.h
The WINGs library has the settings for this in its pkg-config file.
fsviewer uses WINGs so get the settings missing when building
from pkg-config.

(nros)

2023-12-22 13:25:10 UTC MAIN commitmail json YAML

doc: Updated devel/py-nihtest to 1.3.0

(wiz)

2023-12-22 13:25:02 UTC MAIN commitmail json YAML

py-nihtest: update to 1.3.0.

# 1.3.0 [2023-12-22]

- Add set-modification-time.
- Fix inline stdin data.
- Improve error handling.
- Require python 3.9.

(wiz)

2023-12-22 08:00:47 UTC MAIN commitmail json YAML

doc: Updated mail/neomutt to 20231221

(wiz)

2023-12-22 08:00:38 UTC MAIN commitmail json YAML

neomutt: update to 20231221.

2023-12-21  Richard Russon  \<rich@flatcap.org\>
* Features
  - #4126 - add alias 'tags:'
* Bug Fixes
  - #4115 - create HelpBar after colours
  - #4116 - Fix Batch Sending of Emails
  - #4119 - Fix Header Cache Key Handling
  - #4121 - mutt_oauth2.py: error out if ENCRYPTION_PIPE was not supplied
  - #4124 - config: fix flag overlaps
  - #4125 - compose: restore view-text/pager/mailcap
  - color: fix attr_color_copy()
  - fix :color dump
  - fix leak in completion
  - force mail check on current mailbox after `<imap-fetch-mail>`
  - Allow sending an empty mail
  - mutt_oauth2.py: Use readline to overcome macOS input() restrictions
* Changed Config
  - add $history_format: '%s'
* Translations
  - 100% Czech
  - 100% German
  - 100% Lithuanian
  - 100% Serbian
  - 100% Slovak
  - 100% Turkish
  - 99% Spanish
  - 99% Hungarian
* Coverity defects
  - #4111 Educate Coverity about ARRAYs
  - fix defects
* Build
  - #4098 - build: use fallthrough attribute
  - #4100 - build: split maildir and mh types
  - #4101 - version: drop default features
  - #4108 - strip non-conditionals
  - #4122 - add github action to check for unused functions (xunused)
  - update fedora action
  - coverage: fix build for lcov v2
  - tests: fix error cases
* Code
  - #4097 - config: add DT_ON_STARTUP
  - #4104 - Change mutt_default_save() and addr_hook() to take a buffer
  - #4105 - Use buffer pool in tests
  - #4106 - Switch some buffers to use the buffer pool
  - #4109 - Improve the Progress Bar
  - #4117 - remove MxOps::path_parent() and mutt_path_parent()
  - #4120 - remove unused functions
  - #4131 - move editor test code
  - #4133 - move log_disp_null() into test folder
  - #4137 - move config string name functions into tests
  - add: hook_new()/hook_free()
  - fix more printf-style params
  - rename compare to equal
  - hcache: renaming for clarity

(wiz)

2023-12-22 07:35:45 UTC MAIN commitmail json YAML

doc: Updated graphics/opencv-contrib-face to 3.4.17

(thor)

2023-12-22 07:35:24 UTC MAIN commitmail json YAML

doc: Updated graphics/opencv to 3.4.17

(thor)

2023-12-22 07:35:07 UTC MAIN commitmail json YAML

opencv: version 3.4.17 with proper explicit BLAS (CBLAS + LAPACKE) usage

This does the small bugfix update from 3.4.16 to 3.4.17 and adds proper usage
of BLAS stuff. There was linkage to BLAS before via numpy, but the internal
explicit BLAS-using code was not built, as the CMake machinery did not find it.

This commit drops an actually counterproductive patch and adds pkg-config
calls to find the BLAS-related libraries. Note that vor opencv-contrib-face,
the BLAS choice during its build doesn't really enter the result, apparently,
but the build process does use it and it would not help to confuse matters there.

I am not sure if the buildlink3.mk should also add blas.buildlink3.mk now. It
does not feature numpy right now. Should it?

Next step should be move towards 4.x at least.

Upstream:

December, 2021

OpenCV 3.4.17 has been released. Bug fixes, optimizations and other enhancements
are propagated into OpenCV 4.5.5.

Long-lived OpenCV 3.x release series is here since 2015. We are going to reduce
support of 3.x branch in the future to move forward to OpenCV 5.0.

(thor)

2023-12-22 02:42:20 UTC MAIN commitmail json YAML

2023-12-21 22:28:59 UTC MAIN commitmail json YAML

doc/TODO: + libdrm-2.4.119, tor-browser-13.0.8.

(wiz)

2023-12-21 21:24:32 UTC MAIN commitmail json YAML

doc: Updated graphics/wallust to 2.8.0

(pin)

2023-12-21 21:24:09 UTC MAIN commitmail json YAML

graphics/wallust: update to 2.8.0

new minor version: 2.8.0
- automate the creation of wallust.toml (missing word wrapping) [82c2911b11]
- implement color saturation optionally [24afe5754f]
- and avaliable with --saturation cli flag [67f0fde295]
- ensure a readable contrast in between palettes [b9f35899b6]
- colorspaces:
    - labmixed: truly mix colors, instead of the old workaround of only mixing
      luminance, by converting to rgb. [7b015e7cbf]
    - internals:
        - implement gather_cols() [7f4df61f58]
            = gather_cols_lazy() [ed488ca9d7]
        - implement .set_luminance() [18ff9ac6b3]
        - store an additional array of most prominent first [45a0b0260a]
        - hardcode lightest and darkest values intead of calculating them,
          ensuring a constant palette, which probably fixed monochromes
          palettes a bit [c48e5c7460]
- filters:
    - resized: respect aspect ratio [62885455c0e034c3c0765bdecb085b28128344f0}
    - add 16 variation of all other filters schemes [0e3f8ff125]
    - internals: accept Cols instead of raw [u8] [be41968427]
- sort cli flags in alphabetical order [925e59aa72]
- sort subcommand cli flags in alphabetical order [53043d23e5]
- support "this-name" as well as "thisname" either in the config file and the
  command line (e.g. wallust image.png -c labmixed is the same as wallust
  image.png -c lab-mixed) [08f1b0559c]
- --update-current/-u cli flag to only update terminal colors in the current
  session [7f4df61f58]
- add alpha template variable inside wallust.toml [67ede320d7]
- add {alpha_dec} to templates variable, indicates a decimal representation
  for the alpha value [077440c8b1]
- add a debug subcommad [225543f7bb]
- reword a bit descriptions of wallust.toml
- update dependencies

(pin)

2023-12-21 16:34:12 UTC MAIN commitmail json YAML

yubikey-manager-qt: fix build

(wiz)

2023-12-21 14:18:15 UTC MAIN commitmail json YAML

update homepage and master site

(zafer)

2023-12-21 14:11:08 UTC MAIN commitmail json YAML

master site moved to gitlab. oldest version is 0.8.9. needs update.

(zafer)

2023-12-21 13:46:56 UTC MAIN commitmail json YAML

2023-12-21 13:10:01 UTC MAIN commitmail json YAML

2023-12-21 13:07:17 UTC MAIN commitmail json YAML

update homepage and master site

(zafer)

2023-12-21 12:24:37 UTC MAIN commitmail json YAML

geeqie: fix locale files installation when PKGLOCALEDIR is not share

(nros)

2023-12-21 10:46:15 UTC MAIN commitmail json YAML

2023-12-21 09:31:32 UTC MAIN commitmail json YAML

doc/TODO: + enigma-1.30.

(wiz)

2023-12-21 08:57:02 UTC MAIN commitmail json YAML

the previous change broke checksum, fix it

(spz)

2023-12-21 08:50:25 UTC MAIN commitmail json YAML

biolibc-tools: fix installation of manpages for users of a custom PKGMANDIR

(nros)

2023-12-21 08:16:56 UTC MAIN commitmail json YAML

2023-12-21 08:14:57 UTC MAIN commitmail json YAML

doc/TODO: + grub2-2.12.

(wiz)

2023-12-21 07:07:05 UTC MAIN commitmail json YAML

uhd: remove patch that was removed from distinfo during update

(wiz)

2023-12-21 07:04:57 UTC MAIN commitmail json YAML

doc: libssh2 terrapin vuln

(wiz)

2023-12-21 07:04:30 UTC MAIN commitmail json YAML

doc: Updated security/libssh2 to 1.11.0nb2

(wiz)

2023-12-21 07:04:19 UTC MAIN commitmail json YAML

2023-12-21 02:58:40 UTC MAIN commitmail json YAML

2023-12-21 02:55:38 UTC MAIN commitmail json YAML

2023-12-21 02:54:46 UTC MAIN commitmail json YAML

2023-12-21 02:53:53 UTC MAIN commitmail json YAML

2023-12-21 02:27:26 UTC MAIN commitmail json YAML

graphics/ImageMagick6: PKG_OPTIONS_VAR shouldn't conflict with graphics/ImageMagick

(charlotte)

2023-12-21 01:14:41 UTC MAIN commitmail json YAML

editors/xjed: Reset PKGREVISION

(should have happened with update)

Thanks to pin@ for pointing this out.

(gdt)

2023-12-20 21:37:26 UTC MAIN commitmail json YAML

doc: Updated devel/cargo-modules to 0.13.1

(pin)

2023-12-20 21:37:01 UTC MAIN commitmail json YAML

devel/cargo-modules: update to 0.13.1

[0.13.1] - 2023-12-20
Changed
- Bumped MSRV from 1.68.2 to 1.70.0
- Updated dependencies:
    - rust-analyzer from 0.0.189 to 0.0.190

(pin)

2023-12-20 21:01:53 UTC MAIN commitmail json YAML

doc/TODO: + qemu-8.2.

(wiz)

2023-12-20 18:52:12 UTC MAIN commitmail json YAML

py-progressbar2: also needs wheel to build wheel

(nros)

2023-12-20 18:48:02 UTC MAIN commitmail json YAML

doc: erlang terrapin vuln

(wiz)

2023-12-20 18:47:27 UTC MAIN commitmail json YAML

doc: erlang* updated to 26.2.1

(wiz)

2023-12-20 18:47:06 UTC MAIN commitmail json YAML

Fix build on case sensitive filesystems

No PKGREVISION bump as no change in any built packages

(abs)

2023-12-20 18:46:53 UTC MAIN commitmail json YAML

erlang*: update to 26.2.1

Contains a Terrapin fix for erlang ssh.

26.2.1

---------------------------------------------------------------------
--- POTENTIAL INCOMPATIBILITIES -------------------------------------
---------------------------------------------------------------------

  OTP-18897    Application(s): ssh

              With this change (being response to CVE-2023-48795),
              ssh can negotiate "strict KEX" OpenSSH extension with
              peers supporting it; also
              'chacha20-poly1305@openssh.com' algorithm becomes a
              less preferred cipher.

              If strict KEX availability cannot be ensured on both
              connection sides, affected encryption modes(CHACHA and
              CBC) can be disabled with standard ssh configuration.
              This will provide protection against vulnerability, but
              at a cost of affecting interoperability. See
              Configuring algorithms in SSH.

---------------------------------------------------------------------
--- OTP-26.2.1 ------------------------------------------------------
---------------------------------------------------------------------

--- Fixed Bugs and Malfunctions ---

  OTP-18903    Application(s): otp

              Updated copyright and license information.

---------------------------------------------------------------------
--- erts-14.2.1 -----------------------------------------------------
---------------------------------------------------------------------

The erts-14.2.1 application can be applied independently of other
applications on a full OTP 26 installation.

--- Fixed Bugs and Malfunctions ---

  OTP-18902    Application(s): erts

              Removed unnecessary PCRE source tar-ball.

26.2

Highlights #

    process_info/2 now supports lookup of values for specific keys in the process dictionary.

Potential incompatibilities: #

    common_test now returns an error when a suite with a badly defined group is executed.

(wiz)

2023-12-20 18:38:39 UTC MAIN commitmail json YAML

2023-12-20 17:10:09 UTC MAIN commitmail json YAML

doc: dropbear terrapin vuln

(wiz)

2023-12-20 17:09:45 UTC MAIN commitmail json YAML

doc: Updated security/dropbear to 2022.83nb1

(wiz)

2023-12-20 17:09:36 UTC MAIN commitmail json YAML

dropbear: update to 2022.83nb1.

Include terrapin fix and bump PKGREVISION to make clear this
is not 2022.83.

2022.83 - 14 November 2022

Features and Changes:
  Note >> for compatibility/configuration changes

- >> Disable DROPBEAR_DSS by default
  It is only 1024 bit and uses sha1, most distros disable it by default already.

- Added DROPBEAR_RSA_SHA1 option to allow disabling sha1 rsa signatures.
  >> RSA with sha1 will be disabled in a future release (rsa keys will continue
  to work OK, with sha256 signatures used instead).

- Add option for requiring both password and pubkey (-t)
  Patch from Jackkal

- Add 'no-touch-required' and 'verify-required' options for sk keys
  Patch from Egor Duda

  - >> DROPBEAR_SK_KEYS config option now replaces separate DROPBEAR_SK_ECDSA
  and DROPBEAR_SK_ED25519 options.

- Add 'permitopen' option for authorized_keys to restrict forwarded ports
  Patch from Tuomas Haikarainen

- >> Added LTM_CFLAGS configure argument to set flags for building
  bundled libtommath. This also restores the previous arguments used
  in 2020.81 (-O3 -funroll-loops). That gives a big speedup for RSA
  key generation, which regressed in 2022.82.
  There is a tradeoff with code size, so -Os can be used if required.
  https://github.com/mkj/dropbear/issues/174
  Reported by David Bernard

- Add '-z' flag to disable setting QoS traffic class. This may be necessary
  to work with broken networks or network drivers, exposed after changes to use
  AF21 in 2022.82
  https://github.com/mkj/dropbear/issues/193
  Reported by yuhongwei380, patch from Petr Å tetiar

- Allow overriding user shells with COMPAT_USER_SHELLS
  Based on a patch from Matt Robinson

- Improve permission error message
  Patch from k-kurematsu

- >> Remove HMAC_MD5 entirely

Regression fixes from 2022.82:

- Fix X11 build

- Fix build warning

- Fix compilation when disabling pubkey authentication
  Patch from MaxMougg

- Fix MAX_UNAUTH_CLIENTS regression
  Reported by ptpt52

- Avoid using slower prime testing in bundled libtomcrypt when DSS is disabled
  https://github.com/mkj/dropbear/issues/174
  Suggested by Steffen Jaeckel

- Fix Dropbear plugin support
  https://github.com/mkj/dropbear/issues/194
  Reported by Struan Bartlett

Other fixes:

- Fix long standing incorrect compression size check. Dropbear
  (client or server) would erroneously exit with
  "bad packet, oversized decompressed"
  when receiving a compressed packet of exactly the maximum size.

- Fix missing setsid() removed in 2020.79
  https://github.com/mkj/dropbear/issues/180
  Reported and debugged by m5jt and David Bernard

- Try keyboard-interactive auth before password, in dbclient.
  This was unintentionally changed back in 2013
  https://github.com/mkj/dropbear/pull/190
  Patch from Michele Giacomoli

- Drain the terminal when reading the fingerprint confirmation response
  https://github.com/mkj/dropbear/pull/191
  Patch from Michele Giacomoli

- Fix utx wtmp variable typo. This has been wrong for a long time but
  only recently became a problem when wtmp was detected.
  https://github.com/mkj/dropbear/pull/189
  Patch from Michele Giacomoli

- Improve configure test for hardening options.
  Fixes building on AIX
  https://github.com/mkj/dropbear/issues/158

- Fix debian/dropbear.init newline
  From wulei-student

Infrastructure:

- Test off-by-default compile options

- Set -Wundef to catch typos in #if statements

2022.82 - 1 April 2022

Features and Changes:
  Note >> for compatibility/configuration changes

- Implemented OpenSSH format private key handling for dropbearconvert.
  Keys can be read in OpenSSH format or the old PEM format.
  >> Keys are now written in OpenSSH format rather than PEM.
  ED25519 support is now correct. DSS keys are still PEM format.

- Use SHA256 for key fingerprints

- >> Reworked -v verbose printing, specifying multiple times will increase
  verbosity. -vvvv is equivalent to the old DEBUG_TRACE -v level, it
  can be configured at compile time in localoptions.h (see default_options.h)
  Lower -v options can be used to check connection progress or algorithm
  negotiation.
  Thanks to Hans Harder for the implementation

  localoptions.h DEBUG_TRACE should be set to 4 for the same result as the
  previous DEBUG_TRACE 1.

- Added server support for U2F/FIDO keys (ecdsa-sk and ed25519-sk) in
  authorized_keys. no-touch-required option isn't allowed yet.
  Thanks to Egor Duda for the implementation

- autoconf output (configure script etc) is now committed to version control.
  >> It isn't necessary to run "autoconf" any more on a checkout.

- sha1 will be omitted from the build if KEX/signing/MAC algorithms don't
  require it. Instead sha256 is used for random number generation.
  See sysoptions.h to see which algorithms require which hashes.

- Set SSH_PUBKEYINFO environment variable based on the authorized_keys
  entry used for auth. The first word of the comment after the key is used
  (must only have characters a-z A-Z 0-9 .,_-+@)
  Patch from Hans Harder, modified by Matt Johnston

- Let dbclient multihop mode be used with '-J'.
  Patch from Hans Harder

- Allow home-directory relative paths ~/path for various settings
  and command line options.
  *_PRIV_FILENAME DROPBEAR_PIDFILE SFTPSERVER_PATH MOTD_FILENAME
  Thanks to Begley Brothers Inc

  >> The default DROPBEAR_DEFAULT_CLI_AUTHKEY has now changed, it now needs
  a tilde prefix.

- LANG environment variable is carried over from the Dropbear server process
  From Maxim Kochetkov

- Add /usr/sbin and /sbin to $PATH when logging in as root.
  Patch from Raphaël Hertzog
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903403

- Added client option "-o DisableTrivialAuth". It disallows a server immediately
  giving successful authentication (without presenting any password/pubkey prompt).
  This avoids a UI confusion issue where it may appear that the user is accepting
  a SSH agent prompt from their local machine, but are actually accepting a prompt
  sent immediately by the remote server.
  CVE-2021-36369 though the description there is a bit confused. It only applies
  to Dropbear as a client.
  Thanks to Manfred Kaiser from Austrian MilCERT

- Add -q client option to hide remote banner, from Hans Harder

- Add -e option to pass all server environment variables to child processes.
  This should be used with caution.
  Patch from Roland Vollgraf (github #118)

- >> Use DSCP for QoS traffic classes. Priority (tty) traffic is now set to
  AF21 "interactive". Previously TOS classes were used, they are not used by
  modern traffic classifiers. Non-tty traffic is left at default priority.

- >> Disable dh-group1 key exchange by default. It has been disabled server
  side by default since 2018.

- >> Removed Twofish cipher

Fixes:

- Fix flushing channel data when pty was allocated (github #85)
  Data wasn't completely transmitted at channel close.
  Reported and initial patch thanks to Yousong Zhou

- Dropbear now re-executes itself rather than just forking for each connection
  (only on Linux). This allows ASLR to randomise address space for each
  connection as a security mitigation. It should not have any visible impact
  - if there are any performance impacts in the wild please report it.

- Check authorized_keys permissions as the user, fixes NFS squash root.
  Patch from Chris Dragan (github #107)

- A missing home directory is now non-fatal, starting in / instead

- Fixed IPv6 [address]:port parsing for dbclient -b
  Reported by Fabio Molinari

- Improve error logging so that they are logged on the server rather than being
  sent to the client over the connection

- Max window size is increased to 10MB, more graceful fallback if it's invalid.

- Fix correctness of Dropbear's handling of global requests.
  Patch from Dirkjan Bussink

- Fix some small bugs found by fuzzers, null pointer dereference crash and leaks
  (post authentication)

- $HOME variable is used before /etc/passwd when expanding paths such as
  ~/.ssh/id_dropbear (for the client). Patch from Matt Robinson

- C89 build fixes from Guillaume Picquet

Infrastructure:

- Improvements to fuzzers. Added post-auth fuzzer, and a mutator that can
  handle the structure of SSH packet streams. Added cifuzz to run on commits
  and pull requests.
  Thanks to OSS-Fuzz for the tools/clusters and reward funding.

- Dropbear source tarballs generated by release.sh are now reproducible from a
  Git or Mercurial checkout, they will be identical on any system. Tested
  on ubuntu and macos.

- Added some integration testing using pytest. Currently this has tests
  for various channel handling edge cases, ASLR fork randomisation,
  dropbearconvert, and SSH_PUBKEYINFO

- Set up github actions. This runs the pytest suite and other checks.
  - build matrix includes c89, dropbearmulti, bundled libtom, macos, DEBUG_TRACE
  - test for configure script regeneration
  - build a tarball for external reproducibility

(wiz)

2023-12-20 17:06:05 UTC MAIN commitmail json YAML

doc: terrapin for proftpd vuln

(wiz)

2023-12-20 17:05:15 UTC MAIN commitmail json YAML

doc: Updated net/proftpd to 1.3.8b

(wiz)

2023-12-20 17:05:01 UTC MAIN commitmail json YAML

proftpd*: update to 1.3.8b

1.3.8b - Released 19-Dec-2023
--------------------------------
- Issue 1735 - Compiling ProFTPD 1.3.8a mod_sftp, mod_tls using libressl 3.7.3
  fails.
- Issue 1756 - Build system fails for specific module names.
- Issue 1760 - mod_sftp is affected by "Terrapin" Prefix Truncation Attacks in
  SSH Specification (CVE-2023-48795).

1.3.8a - Released 08-Oct-2023
--------------------------------
- Issue 1581 - mod_sftp fails to handle SFTP requests to truncate files to
  zero size.
- Issue 1584 - mod_sftp improperly handles SFTP WRITE requests for files opened
  for appending.
- Issue 1568 - Build-time detection of Linux POSIX ACL support broken since
  1.3.8rc2.
- Issue 1590 - Unable to load mod_rewrite as a dynamic module due to
  incomplete/missing library linker flags.
- Issue 1597 - <Class> section is allowed to be in <Global>, but From directive
  is not.
- Issue 1617 - ExtendedLog SSH, SFTP classes not working as expected.
- Issue 1646 - mod_sftp does not handle multiple concurrent open file
  handles/transfers well for logging.
- Issue 1679 - "TLSRequired off" plus Protocols directive causes mod_tls to
  terminate the session abruptly.
- Issue 1689 - mod_tls fails to compile against OpenSSL 3.0.8 due to missing
  ENGINE_METHOD_ flags.
- Issue 1659 - Unknown named connection error when using different SQL backends.
- Issue 1697 - mod_sql is not properly closing all named backend connections on
  session exit.
- Issue 1694 - SSH key exchanges fail unexpectedly with "unable to write X
  bytes of raw data" errors due to small ProFTPD buffer.
- Issue 1678 - High session memory usage caused by SFTP outgoing data buffering.
- Issue 1683 - Out-of-bounds buffer read when handling FTP commands.
- Issue 1712 - SFTP algorithm settings in <Global> section not being used.

1.3.8 - Released 04-Dec-2022
--------------------------------
- Issue 1488 - 1.3.8rc4 failing to build mod_sftp with OpenSSL 1.1.0 due to
  X448 check.
- Issue 1494 - 1.3.8rc4 failing to build on Solaris due to missing type
  declarations.
- Issue 1500 - mod_ifsession doesn't change the effect of SFTPMaxChannels.
- Issue 1533 - mod_tls module unexpectedly allows TLS handshake after
  authentication in some configurations.
- Issue 1528 - Disable FSCachePolicy by default.
- Issue 1539 - Avoid logging "session closed" messages unless there is a
  corresponding "session opened" log message, to avoid user confusion.
- Issue 1550 - Implement support for the CSID FTP command.
- Bug 4491 - unable to verify signed data: signature type 'rsa-sha2-512' does
  not match publickey algorithm 'ssh-rsa'.
- Issue 1560 - mod_auth_otp improperly allows keyboard-interactive logins for
  users lacking OTP entries.

1.3.8rc4 - Released 23-Jul-2022
--------------------------------
- Issue 1434 - mod_sftp should fail on startup when SFTP and TLS are both
  enabled for a vhost.
- Issue 1440 - DelayTable not properly using documented default value.  This
  is a regression caused by the changes for Bug#4020.
- Issue 1444 - Support customizing SSH ciphers, digests, key exchanges via
  SFTPClientMatch.
- Issue 1448 - Ensure that mod_sftp algorithms work properly with OpenSSL 3.x.
- Issue 1445 - BanOnEvent BadProtocol triggers segfault.
- Issue 1439 - SFTP "check-file" implementation computes incorrect results.
- Issue 1457 - Implement SFTPHostKeys directive for configuring the SSH host
  key algorithms.
- Issue 1437 - Implement the "curve448-sha512" SSH key exchange algorithm.
- Issue 1472 - Include directive broken when using wildcards for directory
  components.
- Bug 4485 - mod_sftp fails to build using OpenSSL 1.0.x: undefined reference
  to `EVP_MD_CTX_reset'.
- Issue 1476 - Reload after omitting explicit ModulePath value causes fatal
  module load failures.

1.3.8rc3 - Released 23-Apr-2022
--------------------------------
- Issue 1323 - Support SSH hostkey rotation via OpenSSH extensions.
- Issue 1325 - NLST does not behave consistently for relative paths.
- Bug 3759 - Support AES Galois Counter Mode (AES-GCM) in SSH.  Support for
  the "aes128-gcm@openssh.com" and "aes256-gcm@openssh.com" ciphers has been
  added to mod_sftp.
- Issue 1333 - Implement an LDAPConnectTimeout directive, to configure the
  timeout used when connecting to LDAP servers.
- Issue 1330 - Implement OpenSSH "Encrypt-Then-MAC" (ETM) algorithm extensions.
- Issue 1346 - Implement AllowForeignAddress class matching for passive data
  transfers.
- Issue 1353 - Implement support for PCRE2.
- Bug 4466 - ProFTPD won't start with several locales.
- Issue 1367 - Auth sources providing space-bearing user/group names cause
  compliance issues with MLSD/MLST responses.
- Bug 4467 - DeleteAbortedStores removes successfully transferred files
  unexpectedly.
- Issue 1383 - Omit EPRT/EPSV from FEAT response when denied by <Limit>
  configuration.
- Issue 1379 - Support uploading to symlinked files.
- Issue 1401 - Keepalive socket options should be set using IPPROTO_TCP, not
  SOL_SOCKET.
- Issue 1402 - TCP keepalive SocketOptions should apply to control as well as
  data connection.
- Issue 1396 - ProFTPD always uses the same PassivePorts port for first
  transfer.
- Issue 1410 - mod_sftp needs to handle unknown SSH messages in an
  RFC-compliant manner, ignoring rather than disconnecting.
- Issue 1418 - Improve handling of some globally applied configuration
  directives.
- Issue 1369 - Name-based virtual hosts not working as expected after upgrade
  from 1.3.7a to 1.3.7b.

1.3.8rc2 - Released 29-Aug-2021
--------------------------------
- Bug 4401 - mod_sftp crashes when handling aes256-ctr OpenSSH-specific key
  with some old OpenSSL versions.
- Issue 1273 - Improve mod_tls log messages for unsupported older TLS protocol
  requests.
- Issue 1284 - Fix memory disclosure to RADIUS servers by mod_radius.
- Issue 1282 - Properly handle <VirtualHost> sections that use interface/device
  names.
- Bug 4315 - mod_ifsession fails to reset directory config lookup after
  <Directory> section merges.
- Issue 1296 - Support <Limit> configurations for HELP command.
- Issue 1300 - PCRE expressions with capture groups are not being handled
  properly.
- Issue 1307 - AuthUserFile permissions check fails during SIGHUP, causing
  ProFTPD to stop.
- Issue 1286 - Add support for the libidn2 library, over libidn, for e.g.
  mod_rewrite mappings.
- Bug 4443 - Changed the default behavior of mod_tls, such that TLS
  renegotiations on control/data connections are not requested by default.
  TLS renegotiations have a long and sordid history; many SSL/TLS libraries no
  longer implement them, or disable them by default.
- Issue 1319 - mod_auth_otp should honor RequireTableEntry semantics for SFTP
  logins.

1.3.8rc1 - Released 13-Jun-2021
--------------------------------
- Issue 1063 - FTPS data transfers using TLSv1.3 might segfault when session
  tickets cannot be decrypted.
- Issue 1070 - Implement support for Redis 6.x AUTH semantics.
- Issue 1068 - Define an OpenSSL API version compatibility macro, currently
  set to OpenSSL 1.0.0 and later.
- Bug 4405 - Memory use-after-free in mod_sftp causes unexpected
  login/authentication issues.
- Bug 4402 - Inappropriate handling of aborted FTP data transfers causes issues
  for some FTP clients.
- Issue 1084 - Implement support for configuring TLSv1.3 ciphersuites.
- Issue 1086 - Update TLSRenegotiate to work properly for TLSv1.3 sessions.
- Issue 1079 - prxs fails to detect module-specific configure/Makefile,
  leading to unexpected module load errors.
- Issue 1074 - TLS SNI connections to name-based VirtualHosts with
  TLSCertificateChainFile fail unexpectedly.
- Issue 1089 - Deprecate the MultilineRFC2228 directive.
- Issue 1067 - Generate new DH parameters for mod_tls, mod_sftp for 1.3.8.
- Issue 1101 - Update TLS minimum supported DH parameter size to 2048.
- Issue 811 - Support adding custom key/values to RedisLogOnCommand.
- Issue 1106 - TLS SNI can cause mod_quotatab to crash due to null pointer
  dereferences.
- Issue 1076 - TLS client-initiated renegotiations are supported unexpectedly.
- Issue 1105 - Improper handling of multiple IP addresses, ServerAliases in
  <VirtualHost> sections.
- Issue 1048 - Support using weak TLS certificates via the new AllowWeakSecurity
  TLSOption.
- Issue 1149 - mod_quotatab_sql failing due to SQL syntax errors.  This is a
  regression caused by Issue #392.
- Issue 1061 - Freeing uninitialized memory causes SFTP issues with ed25519
  keys.
- Issue 1111 - "Corrupted MAC on input" errors using SFTP umac-64@openssh.com
  digest.
- Issue 1171 - PassivePort randomization is broken due to SO_REUSEPORT option.
- Issue 1072 - Support configurable certificate settings in Redis SSL/TLS
  connections.
- Issue 369 - Provide function for obtaining memory pool information as e.g.
  JSON.
- Issue 1134 - AuthUserFile-based logins, directory listings are very slow due
  to unbuffered reads.
- Issue 1193 - Improper checking for reused TLS session for data transfers
  using OpenSSL 1.1.1.
- Issue 1168 - Improve error handling of OpenSSH host keys converted to PEM
  format.
- Issue 1179 - TLSRSACertificateKeyFile sanity checks fail unexpectedly for
  passphrase-protected keys.
- Issue 1174 - ftptop segfaults when using libncursesw on Gentoo.
- Issue 1204 - Once TLSTimeoutHandshake is reached, internal "timed out" flag
  never reset.
- Issue 1133 - Support include files in mod_wrap2 allow/deny tables.
- Issue 1200 - Disconnect SFTP clients that request unsupportable protocol
  versions.
- Issue 1207 - On Gentoo, "./configure --disable-ncurses" fails to link ftptop,
  due to "undefined reference to symbol 'stdscr'" error.
- Issue 1212 - mod_sql_mysql needs to quote table names due to reserved MySQL
  keywords.
- Issue 1175 - Unable to set per-user TLSOptions using mod_ifsession.
- Issue 754 - Some mod_snmp counters were not being incremented properly.
- Issue 548 - `make install` target should install only, not recompile any code.
- Bug 4428 - <VirtualHost> name resolution does not include all associated
  IPv6 records.
- Issue 1230 - Stack overflow due to unlimited recursion possible when parsing
  JSON text.
- Issue 1232 - Unable to use %{env:FTPS} in a SQLNamedQuery.  The fix is to now
  use %{note:FTPS} instead.
- Issue 1170 - Implement support for user/host combination bans in mod_ban.
- Issue 1246 - mod_sftp_sql crashes (sigsegv) on NULL key.
- Issue 1237 - ftpasswd should default to SHA256, not MD5.
- Issue 490 - Support syntax checks on AuthUserFiles, AuthGroupFiles on startup.

(wiz)

2023-12-20 16:43:12 UTC MAIN commitmail json YAML

doc: Added security/terrapin-scanner version 1.0.3

(schmonz)

2023-12-20 16:43:06 UTC MAIN commitmail json YAML

Add and enable terrapin-scanner.

(schmonz)

2023-12-20 16:43:04 UTC MAIN commitmail json YAML

Add terrapin-scanner: Scan SSH servers and clients for Terrapin vulnerability

The Terrapin Vulnerability Scanner is a small utility program written in
Go, which can be used to determine the vulnerability of an SSH client or
server against the Terrapin Attack. The vulnerability scanner requires a
single connection with the peer to gather all supported algorithms.
However, it does not perform a fully fledged SSH key exchange, will
never attempt authentication on a server, and does not perform the
attack in practice. Instead, vulnerability is determined by checking the
supported algorithms and support for known countermeasures (strict key
exchange). This may falsely claim vulnerability in case the peer
supports countermeasures unknown to this tool.

(schmonz)

2023-12-20 15:07:29 UTC MAIN commitmail json YAML

fcitx5-gtk: Fix linking with libxkbcommon on non-wayland platforms
fcitx5-gtk:s configure step claims that libxkbcommon is optional
but it always links to XKBCommon::XKBCommon. libxbcommon is pulled
in via buildlink3.mk from gtk3 on wayland platforms. On non-wayland
platforms it is not pulled in causing build breakage. Include
libxkbcommons buildlink3.mk in the Makefile to make sure it is
available unconditionally.
No revbump is done in this commit since it is a build fix, all
built packages are already linked to libxkbcommon.

(nros)

2023-12-20 12:03:25 UTC MAIN commitmail json YAML

2023-12-20 10:31:34 UTC MAIN commitmail json YAML

leptonica: fix build for packages that use liptonica with gcc 12 and C++ on Solaris

(nros)