post-install chmod no longer necessary

(richard)

Back to the basic problem... check-perms.mk issues warnings/errors on text
files installed group and/or world writeable so only search and fix in DESTDIR.
This avoids touching any files used during build at the same time.

(richard)

Updated www/py-google-api-python-client to 1.5.1

(mef)

Updated www/py-google-api-python-client to 1.5.1
------------------------------------------------
  Version 1.5.1
  Bugfix release
  - Allow using versions of oauth2client < 2.0.0. (#197)
  - Check both current and new API discovery URL. (#202)
  - Retry http requests on connection errors and timeouts. (#218)
  - Retry http requests on rate limit responses. (#201)
  - Import guards for ssl (for Google App Engine). (#220)
  - Use named loggers instead of the root logger. (#206)
  - New search console example. (#212)

(mef)

Updated devel/dejagnu to 1.6

(mef)

Updated devel/dejagnu to 1.6
----------------------------------------------------
(from: https://www.gnu.org/software/dejagnu/manual/Release-Notes.html
or from info)
----------------------------------------------------------------------------
The following major, user-visible changes have been introduced since version
1.5.3.

1. Support for target communication via SSH has been added.
2. A large number of very old config and baseboard files have been removed. If
    you need to resurrect these, you can get them from version 1.5.3. If you
    can show that a board is still in use, it can be put back in the
    distribution.
3. The --status command line option is now the default. This means that any
    error in the testsuite Tcl scripts will cause runtest to abort with exit
    status code 2. The --status option has been removed from the documentation,
    but will continue to be accepted for backward compatibility.
4. runtest now exits with exit code 0 if the testsuite "passed", 1 if
    something unexpected happened (eg, FAIL, XPASS or UNRESOLVED), and 2 if an
    exception is raised by the Tcl interpreter.
5. runtest now exits with the standard exit codes of programs that are
    terminated by the SIGINT, SIGTERM and SIGQUIT signals.
6. The user-visible utility procedures absolute, psource and slay have been
    removed. If a testsuite uses any of these procedures, a copy of the
    procedure should be made and placed in the lib directory of the testsuite.
7. Support was added for testing the D compiler.
8. ~/.dejagnurc is now loaded last, not first. This allows the user to have
    the ability to override anything in their environment (even the site.exp
    file specified by $DEJAGNU).
9. The user-visible utility procedure unsetenv is deprecated and will be
    removed in the next release. If a testsuite uses this procedure, a copy
    should be made and placed in the lib directory of the testsuite.

(mef)

Add new jdk-8u92-linux-i586.tar.gz distinfo.

Verified via https://www.oracle.com/webfolder/s/digest/8u92checksum.html

(dsainty)

Reinstate old jce_policy-8.zip distinfo, and add new
jre-8u92-linux-i586.tar.gz distinfo.

Verified via https://www.oracle.com/webfolder/s/digest/8u92checksum.html

(dsainty)

Added devel/libindicator-tools version 12.10.1

(youri)

Import libindicator-tools-12.10.1 as devel/libindicator-tools.

A set of symbols and convience functions that all indicators would
like to use.

(youri)

+ libdbusmenu

(youri)

- libdbusmenu meta package.

(youri)

Added meta-pkgs/libdbusmenu version 12.10.2

(youri)

Import libdbusmenu-12.10.2 as meta-pkgs/libdbusmenu.

A small little library that was created by pulling out some comon code out of
indicator-applet. It passes a menu structure across DBus so that a program can
create a menu simply without worrying about how it is displayed on the other
side of the bus.

(youri)

Remove bogus entries.

(youri)

Sync Makefile.

(youri)

Added devel/libdbusmenu-tools version 12.10.2

(youri)

Import libdbusmenu-tools-12.10.2 as devel/libdbusmenu-tools.

A small little library that was created by pulling out some comon code out of
indicator-applet. It passes a menu structure across DBus so that a program can
create a menu simply without worrying about how it is displayed on the other
side of the bus.

This package provides development tools.

(youri)

Added devel/libdbusmenu-qt5 version 0.9.3.15.10.20150604nb2

(youri)

Added devel/libdbusmenu-qt version 0.9.3.15.10.20150604nb1

(youri)

Added devel/libdbusmenu-jsonloader version 12.10.2

(youri)

Import libdbusmenu-jsonloader-12.10.2 as devel/libdbusmenu-jsonloader.

A small little library that was created by pulling out some comon code out of
indicator-applet. It passes a menu structure across DBus so that a program can
create a menu simply without worrying about how it is displayed on the other
side of the bus.

This package provides Test lib.

(youri)

Added devel/libdbusmenu-gtk3 version 12.10.2

(youri)

Import libdbusmenu-gtk3-12.10.2 as devel/libdbusmenu-gtk3.

A small little library that was created by pulling out some comon code out of
indicator-applet. It passes a menu structure across DBus so that a program can
create a menu simply without worrying about how it is displayed on the other
side of the bus.

This package provides GTK3+ API.

(youri)

tyop

(youri)

Import libdbusmenu-gtk-doc-12.10.2 as devel/libdbusmenu-gtk-doc.

A small little library that was created by pulling out some comon code out of
indicator-applet. It passes a menu structure across DBus so that a program can
create a menu simply without worrying about how it is displayed on the other
side of the bus.

This package provides GTK+ API ducumentation.

(youri)

Added devel/libdbusmenu-gtk version 12.10.2

(youri)

Import libdbusmenu-gtk-12.10.2 as devel/libdbusmenu-gtk.

A small little library that was created by pulling out some comon code out of
indicator-applet. It passes a menu structure across DBus so that a program can
create a menu simply without worrying about how it is displayed on the other
side of the bus.

This package provides GTK2+ API.

(youri)

Added devel/libdbusmenu-glib version 12.10.2

(youri)

Import libdbusmenu-glib-12.10.2 as devel/libdbusmenu-glib.

A small little library that was created by pulling out some comon code out of
indicator-applet. It passes a menu structure across DBus so that a program can
create a menu simply without worrying about how it is displayed on the other
side of the bus.

This package provides GLib2 API.

(youri)

Added devel/libappindicator3 version 12.10.0

(youri)

Import libappindicator3-12.10.0 as devel/libappindicator3.

A library to allow applications to export a menu into the Unity Menu bar. Based
on KSNI it also works in KDE and will fallback to generic Systray support if
none of those are available.

(youri)

wip -> devel

(youri)

Added devel/libappindicator version 12.10.0

(youri)

Import libappindicator-12.10.0 as devel/libappindicator.

A library to allow applications to export a menu into the Unity Menu bar. Based
on KSNI it also works in KDE and will fallback to generic Systray support if
none of those are available.

(youri)

Added devel/libindicator3 version 12.10.1

(youri)

Import libindicator3-12.10.1 as devel/libindicator3.

A set of symbols and convience functions that all indicators would
like to use.

This package provide GTK3 API.

(youri)

Added devel/libindicator version 12.10.1

(youri)

Import libindicator-12.10.1 as devel/libindicator.

A set of symbols and convience functions that all indicators would
like to use.

(youri)

Remove duplicate entry, oops.

(youri)

+ spidermonkey17

(youri)

Added lang/spidermonkey17 version 17.0.0

(youri)

Update include for pkgsrc.

(youri)

Added lang/spidermonkey17 version 17.0.0

(youri)

Import spidermonkey17-17.0.0 as lang/spidermonkey17.

SpiderMonkey is the code-name for the Mozilla's C implementation of JavaScript.
This package contains SpiderMonkey 17.

(youri)

+ polkit

(youri)

Added security/polkit version 0.113nb1

(youri)

Import polkit-0.113nb1 as security/polkit.

PolicyKit is a toolkit for defining and handling authorizations.  It
is used for allowing unprivileged processes to speak to privileged
processes.

(youri)

Fix a test failure using upstream patch.

(wiz)

NONBINMODE is too restrictive, just remove the writable bit for
group and others.

(wiz)

Updated x11/p5-Alien-wxWidgets to 0.67

(mef)

Updated x11/p5-Alien-wxWidgets to 0.67 (although 0.67 is not listed below)
--------------------------------------
0.66  Tue Mar 10 2015
    - add support for wxWidgets 3.0.1 and 3.0.2
    - make default wxWidgets 3.0.2
    - graphics context included now default on Win32
    - build on MacOSX - xcode 5.x/6.x

0.65  Mon Mar 31 2014
    - Update default to wxWidgets 3.0.0
    - build on MacOSX Mavericks with Xcode 4.6.3
    - install builtins on wxMSW (used by some wxWidgets extensions)

0.64  Sat Apr 13 2013
    - Build IPC on Windows

0.63  Fri Oct 26 2012
    - Patches for wxGTK build fixing dir dialog issues

0.62  Tue Oct 2 2012
    - Fix patching on MSWin when buildpaths have spaces.
    - Allow addition of user patch - --wxWidgets-userpatch
    - Expand README.txt
    - Another Mac OS X SDK change

0.61  Fri Sep 21 2012
    - change default debug level for wxWidgets >= 2.9 to 1 ( was 0)
    - fix several incorrect wxWidgets version checks

(mef)

Depend on an nss providing nss-config, and remove workaround patch.

Bump PKGREVISION.

(wiz)

Updated mail/libmilter to 8.15.2nb1

(jperkin)

Bump PKGREVISION for SunOS -fPIC change.

(jperkin)

Build with -fPIC on SunOS to ensure third parties can pull in libmilter.a

(jperkin)

Updated devel/nss to 3.23nb1

(wiz)

Add nss-config script to match most Linux distributions.

Create nss.pc file earlier, not during installation.

Bump PKGREVISION.

(wiz)

#4965

(spz)

Pullup ticket #4965 - requested by bsiegert
www/h2o: security update

Revisions pulled up:
- www/h2o/Makefile                                              1.8
- www/h2o/PLIST                                                1.3
- www/h2o/distinfo                                              1.4

NOTE: the branch excludes the www/wslay dependency

-------------------------------------------------------------------
  Module Name:    pkgsrc
  Committed By:  adam
  Date:          Sat Apr 23 18:41:29 UTC 2016

  Modified Files:
          pkgsrc/www/h2o: Makefile PLIST distinfo

  Log Message:
  Changes 1.7.1:
  - [core] fix incorrect line no. reported in case of YAML syntax error
  - [core] fix build issue / memory leak when the poll backend is used
  - [core] when building, repect `EXTRA_LIBS` passed from command line
  - [core] fix memory leaks during start-up
  - [core] fix stability issue when receiving a signal
  - [fastcgi] fix off-by-one buffer overflow
  - [fastcgi][mruby] install missing script files
  - [mruby] truncate body to the size specified by `content-length`
  - [mruby] fix error when reading a ruby script >= 64K
  - [proxy] fix I/O error when transferring files over 2GB on FreeBSD / OS X
  - [ssl] bugfix: use of session ticket not disabled even when configured to
  - [libh2o] provide pkg-config .pc files
  - [libh2o] include version numbers in the .so filename
  - [doc] refine documentation

  To generate a diff of this commit:
  cvs rdiff -u -r1.7 -r1.8 pkgsrc/www/h2o/Makefile
  cvs rdiff -u -r1.2 -r1.3 pkgsrc/www/h2o/PLIST
  cvs rdiff -u -r1.3 -r1.4 pkgsrc/www/h2o/distinfo

(spz)

Updated sysutils/pciutils to 3.5.0

(msaitoh)

Update pciutils to 3.5.0.

2016-05-19  Martin Mares <mj@ucw.cz>

* Released as 3.5.0.

* New capabilities decoded: Downstream Port Containment,
  Precision Time Measurement. Thanks to Keith Busch and
  Jonathan Yong.

* Domain numbers extended to 31 bits. This will be used by the
  Linux kernel on some machines in near future.

* Enhanced allocation regions are now decoded on Linux.

* The NetBSD back-end supports PCIe extended configuration space.

* Updated pci.ids to the current snapshot of the database.

(msaitoh)

Updated security/botan-devel to 1.11.29

(joerg)

Updated security/botan to 1.10.12

(joerg)

Bump revisions for Botan update.

(joerg)

Update Botan to 1.10.12, the latest pre-C++11 version.
Includes various security fixes.

(joerg)

Update to Botan 1.11.29:
- CVE-2016-2849: side channel attack against DSA and ECDSA
- CVE-2016-2850: failure to enforce TLS policies could lead to weaker
  algorithms being choosen
- CVE-2016-2195: heap overflow in ECC point decoding
- CVE-2016-2196: heap overflow in P-521 reduction
- CVE-2016-2194: DOS against the modular reduction
- CVE-2015-7824: padding oracle attack against TLS CBC
- CVE-2015-7825: DOS due to certificate chains
- CVE-2015-7826: wildcard certifications verification failures
- CVE-2015-7827: protection against PKCS#1 side channel issues
- CVE-2015-5726: potential DOS with invalid zero-length BER
- CVE-2015-5727: unbound memory use with BER
- deprecation or removal of various insecure crypto primitives
- TLS heartbeat removed
- various other bugfixes and improvements.

(joerg)

fix PLIST when the official-mozilla-branding option is enabled

(snj)

Pullup tickets #5014 to #5016.

(bsiegert)

PKGMANDIR fixes.

(jperkin)

Pullup ticket #5016 - requested by sevan
emulators/qemu: security fix

Revisions pulled up:
- emulators/qemu/Makefile                                      1.149
- emulators/qemu/PLIST                                          1.46
- emulators/qemu/distinfo                                      1.115
- emulators/qemu/patches/patch-configure                        1.13
- emulators/qemu/patches/patch-default-configs_pci.mak          1.2
- emulators/qemu/patches/patch-hw_misc_ivshmem.c                1.1
- emulators/qemu/patches/patch-hw_ppc_mac__newworld.c          1.3
- emulators/qemu/patches/patch-hw_ppc_mac__oldworld.c          1.3
- emulators/qemu/patches/patch-memory.c                        1.10
- emulators/qemu/patches/patch-slirp_tcp__subr.c                1.7

---
  Module Name:    pkgsrc
  Committed By:  ryoon
  Date:          Sun May 15 01:25:15 UTC 2016

  Modified Files:
          pkgsrc/emulators/qemu: Makefile PLIST distinfo
          pkgsrc/emulators/qemu/patches: patch-configure
              patch-default-configs_pci.mak patch-hw_ppc_mac__newworld.c
              patch-hw_ppc_mac__oldworld.c patch-memory.c patch-slirp_tcp__subr.c
  Added Files:
          pkgsrc/emulators/qemu/patches: patch-hw_misc_ivshmem.c

  Log Message:
  Update to 2.6.0

  Changelog:
  System emulation
  Incompatible changes

      The aio=native option to "-drive" now requires the cache=none option, instead of silently disabling itself for other cache modes. The newly invalid combination had been warning since QEMU 2.3.
      Specifying block device parameter aio=native is now an error on POSIX systems if qemu is compiled without libaio support. The newly invalid combination had been warning since QEMU 2.3.
      The experimental x-drive option for the sdhci-pci device has been removed. Instead of passing a drive directly to the SD controller device you now must create an SD card object (which will
  automatically be plugged into the SD controller), so "-device sdhci-pci,x-drive=mydrive -drive id=mydrive,[...]" becomes "-device sdhci-pci -device sd-card,drive=mydrive -drive id=mydrive,[...]".
      The s390-virtio machine has been removed.
      Machine types pc-q35-1.4, pc-q35-1.5, pc-q35-1.6, pc-q35-1.7, pc-q35-2.0, pc-q35-2.1, pc-q35-2.2 and pc-q35-2.3 have been removed.
      The "virt" machine type's flash device has changed when TrustZone is active ("-machine virt,secure=on"). The first flash device is only available in secure memory, while the second is available
  in non-secure memory too.

  Future incompatible changes

      Three options are using different names on the command line and in configuration file. In particular:
          The "acpi" configuration file section matches command-line option "acpitable";
          The "boot-opts" configuration file section matches command-line option "boot";
          The "smp-opts" configuration file section matches command-line option "smp".

      -readconfig will standardize on the name for the command line option.

      Behavior of automatic calculation of SMP topology when some SMP topology options for -smp are omitted (sockets, cores, threads) will change in the future. If guest ABI needs to be preserved on
  upgrades while using the SMP topology options, users should either set set all options explicitly (sockets, cores, threads), or omit all of them.
      The original qcow2 image encryption is fatally flawed, and support for it will be disabled entirely from the system emulators. It'll remain available only in command line tools qemu-img, qemu-io,
  qemu-nbd to facilitate data liberation. It is recommended to use 'qemu-img convert' to convert qcow2 encrypted images to uncrypted ones. The new LUKS encryption driver can provide a secure
  replacement if raw files are acceptable, while a future release will integrate luks into qcow2 natively.
      A few devices will be configured with explicit properties instead of implicitly. Unlikely to affect users; for the full list, see the 2.3 ChangeLog.
      QMP command blockdev-add is still a work in progress. It doesn't support all block drivers, it lacks a matching blockdev-del, and more. It might change incompatibly.

  ARM

      Support for a separate EL3 address space
      System mode supports BE8 and BE32. Note that qemu-system-arm can emulate both big-endian and little-endian guests (unlike user-mode emulation which has separate qemu-arm and qemu-armeb binaries).
      Support for the SETEND instruction, used most notably on Raspbian through the arm-mem library (previously known as libcofi).
      Faster boot thanks to DMA support in fw_cfg
      The "virt" machine type supports a virtual power button and the "system_powerdown" monitor command
      The "virt" machine type supports configuring network cards with -nic in addition to -netdev
      The RAM limit for the "virt" machine type is now 255GB
      The "xlnz-zynqmp" machine type now includes SPI controllers
      The "xlnx-ep108" machine type now supports SPI flash
      New partial Raspberry Pi 2 emulation with "raspi2" machine type. For now, it can boot older releases of Windows and Raspbian, but lacks a number of devices including USB.
      New palmetto-bmc machine type using the new, partial ASPEED AST2400 SoC implementation

  KVM

      Support for guest debugging (software and hardware breakpoints, single step) on AArch64

  MIPS

      Support for FPU and MSA in KVM guests
      Support for R6 Virtual Processors
      Initial support for Cluster Power Controller and Global Configuration Registers allowing the guest to control the start of Virtual Processors
      Support for Inter-Thread Communication Unit
      Support for MAAR registers in P5600 CPU

  PowerPC

      Improved support for migration of g3beige and mac99 machines
      Fix serial ports for g3beige and mac99 machines (OpenBIOS)
      The gdb stub supports the VSX instruction set extensions

  pSeries

      pSeries machine types starting at pseries-2.6 use XHCI as the USB host controller instead of OHCI
      Support for more hypercalls (H_SET_SPRG0, H_SET_DABR, H_SET_XDABR and H_PAGE_INIT)
      Support for EEH on assigned PCI devices can use the normal spapr-pci-host-bridge instead of the special spapr-pci-vfio-host-bridge.

  s390

      Fixes and improvements in s390x PCI support
      Support for hotplug of s390x cpus via cpu-add
      Support for booting from virtio-scsi devices in the s390-ccw bios

  SH
  SPARC

      sun4m: Fix for ldstub instruction resolves several 32-bit Solaris bugs (MUTEX_HELD hang, libC error, Java WebStart segfault)
      sun4u: FreeBSD 10.3+ can now run under qemu-system-sparc64 in -nographic mode

  TileGX
  Tricore

      Support for context management, illegal opcode and opd traps
      Support for FPU instructions

  x86
  TCG

      Support for the XSAVE/XSAVEOPT, MPX, FSGSBASE and PKE features

  KVM

      Support for "split irqchip". In this mode, QEMU emulates the IOAPIC, PIC (i8259) and PIT (i8254) devices while leaving the local APIC emulation to the kernel. This mode reduces the attack surface
  of KVM.
      Support for the new PKU feature found in some Skylake processors
      Support for migrating the TSC rate

  Xen
  Q35

      Support resume (S3)
      Support for legacy Windows guests (XP/2003)

  Device emulation and assignment

      New IPMI emulation subsystem. QEMU can now emulate an internal BMC or attach to an external BMC simulator such as OpenIPMI's lanserv. IPMI however is not yet exposed in SMBIOS and ACPI tables (do
  we want to docume?)
      FIXME: what's the state of nvdimm?

  ACPI

      The floppy disk controller's characteristics are now exposed in the ACPI tables, which makes it possible to use floppies on Windows together with UEFI firmware.

  Block devices

      The floppy disk consk or an empty disk to a 2.88 MB disk
      Improved compatibility of the SD device model with various operating systems and firmwares
      The NVMe device supports the "bootindex" property.
      The SDHCI device supports reset.

    ivshmem

      No longer available on hosts lacking eventfd(2), because inter-vm interrupts don't work there
      New devices ivshmem-plain and ivshmem-doorbell, fully backwards compatible for guests, notable differences to ivshmem:
          PCI revision is 1 instead of 0
          ivshmem role=master becomes master=on, role=peer becomes master=off
          ivshmem x-memdev=ID becomes ivshmem-plain memdev=ID
          ivshmem shm=NAME,size=SZ becomes ivshmem-plain memdev=ID, with -object memory-backend-file,id=ID,mem-path=/dev/mem/NAME,size=SZ,share
          ivshmem chardev=ID becomes ivshmem-doorbell,chardev=ID
          Property ioeventfd defaults to on instead of off
          ivshmem-plain never has MSI-X capability, and ivshmem-doorbell always has MSI-X capability
      Device ivshmem is deprecated, and its experimental property x-memdev is gone
      Interrupting a peer that reuses an unplugged peer's ID works again (broken in v1.2.0)
      Unplug no longer destroys the character device, for consistency with other devices
      The funny "no shared memory, yet" state is no longer guest-visible, and can no longer fail or mess up migration
          Guests may require PCI revision 1 to make sure they're not exposed to the funny state
      docs/specs/ivshmem-spec.txt rewritten for completeness and accuracy.

  SCSI

      Support for the LSI SAS1068 HBA (also known as "MPT Fusion"). Note that some operating systems will not recognize disks attached to this adapter, unless the disks are assigned a world-wide name
  (WWN).

  PCI/PCIe

      PCIe Multi-root support (using the new pxb-pcie root-compex)

  USB

      MTP: initial support for events

  VFIO

      Support for AMD XGBE platform passthrough
      New sysfsdev property provides a more general way to specify the device to attach to.
      Provided PCI option ROMs are fixed to include the same vendor and device id as the device exposed to the guest. This facilitates changing the ids of the devices.

  virtio

      Performance improvements via optimized vring accesses
      The balloon driver statistics now include the amount of available memory (corresponding to "Available" in /proc/meminfo for Linux guests).

  Character devices

      The socket character device backend can now enable TLS over TCP connections, acting either as a TLS server:

  $QEMU -object tls-creds-x509,id=tls0,dir=$HOME/.pki/qemutls,endpoint=server \
        -chardev socket,id=s0,host=127.0.0.1,port=9000,tls-creds=tls0,server \
        -device isa-serial,chardev=s0 \
        ...other args...

  or a TLS client:

  $QEMU -object tls-creds-x509,id=tls0,dir=$HOME/.pki/qemutls,endpoint=client \
        -chardev socket,id=s0,host=127.0.0.1,port=9000,tls-creds=tls0 \
        -device isa-serial,chardev=s0 \
        ...other args...

  If operating in server mode, the same set of TLS credentials can be used for both character devices and the VNC server

      All character devices can have their output logged to a plain file

  $QEMU -chardev stdio,id=mon0,logfile=monitor.log \
        -mon chardev=mon0 \
        ...other args...

  will result in logging of all output on the HMP monitor. The logappend parameter controls whether the file is truncated at startup, defaulting to append.
  GUI

      SDL2 and SPICE now support OpenGL and virgl. For SPICE, Unix sockets are the only usable transport when OpenGL is enabled.
      The "-vnc" and "-display vnc" options support ipv4=off and ipv6=off. Previously, only "ipv4" and "ipv6" were available.
      Support getting input events directly from linux evdev devices, using "-object input-linux,id=$name,evdev=/dev/input/event$nr"
      Support for ncurses on Windows.

  Monitor

      Support for a new "detach" option to "dump-guest-memory". The option dumps memory in the background. Progress can be queried using the new commands "info dump" (human monitor) and "query-dump"
  (QMP), as well as through the QMP event DUMP_COMPLETED.
      Support for a new command "input-send-event" replacing the previous experimental command "x-input-send-event".
      The human monitor command "drive_add -n" allows creating block devices that do not have a BlockBackend (similar to QMP blockdev-add).

  Migration

      Postcopy is not experimental anymore; the x-postcopy-ram capability was renamed to postcopy-ram.

  Network

      SLIRP now supports IPv6 for ICMP, UDP, TCP and TFTP.
      mirror filter which can mirror traffic from netdev to socket chardev, vice versa.
      redirector filter which can redirect traffic from netdev to socket chardev, vice versa.

  Secret passing system

  There is a new standard mechanism for securely passing secret credentials to QEMU, which will be used in combination with other subsystems. For example, network block device passwords, block device
  decryption passphrases, or TLS private key passwords can all use the same mechanism.

      Passing credentials inline (insecure, only for developer testing)

  $QEMU -object secret,id=sec0,data=letmein

      Passing credentials via a plain file

  $QEMU -object secret,id=sec0,file=mypassword.txt

      Passing credentials via a base64 encoded file

  $QEMU -object secret,id=sec0,file=mypassword.txt,format=base64

      Passing credentials inline, encrypted with a master key (recommended for management apps)

    $QEMU -object secret,id=master0,file=mykey.b64,format=base64 \
          -object secret,id=sec0,data=[base64 ciphertext],\
                  keyid=master0,iv=[base64 IV],format=base64

  TLS credential handling

  It is now possible to use encrypted TLS private keys with credentials for TLS servers/clients in QEMU. The password for unlocking the private key is provided by a secret object whose id is specified
  via the passwordid' property

  $QEMU -object secret,id=tlskey0,file=mypassword.txt \
        -object tls-creds-x509,id=tls0,dir=$HOME/.pki/qemutls,endpoint=server,passwordid=tlskey0 \
        ...other args...

  Block devices

      Block device throttling now support specifying a burst length as well. While previously the burst could only be specified as a total number of IOPS (e.g. 10000 IOPS), more complex specifications
  such as "10000 IOPS for 10 seconds" are now possible. Note that, because of the implementation of the algorithm, a guest that is allowed "10000 IOPS for 10 seconds" will also be allowed to perform
  for example 5000 IOPS for 20 seconds.
      The curl block device driver now supports HTTP authentication and HTTP proxy authentication via the new properties 'username', 'password-secret', 'proxy-username' and 'proxy-password-secret'.

  $QEMU -object secret,id=sec0,file=password.txt \
        -object secret,id=sec1,file=proxy-password.txt \
        -drive driver=http,host=localhost,port=443,username=fred,password-secret=sec0,proxy-username=bob,proxy-password-secret=sec1 \
        ...other args...

      The RBD block device driver can now use the secret object type to securely receive the authentication password without exposing it in the command line args

  $QEMU -object secret,id=sec0,file=password.b64,format=base64 \
        -drive driver=rbd,filename=rbd:pool/image:id=myname:auth_supported=cephx,password-secret=sec0 \
        ...other args...

      The iSCSI block device driver can now use the secret object type to securely receive the authentication password without exposing it in the command line args

  $QEMU -object secret,id=sec0,file=password.txt \
        -iscsi user=fred,password-secret=sec0 \
        -drive file=iscsi://192.168.122.1:3260/iqn.2013-12.com.example%3Aiscsi-chap-netpool/1

  NB this syntax requires that all iSCSI backed drives use the same password

      The qemu-io tool gained support for new '--object' and '--image-opts' arguments. The --object argument allows 'secret' and 'tls-creds-x509' objects to be defined for use in association with a
  block device backend. The '--image-opts' argument instructs qemu-io to parse the image string as a set of image options, instead of a plain filename. For example, to connect qemu-io to an NBD server
  using TLS

  qemu-io -c "read 0 512" \
          --object tls-creds-x509,id=tls0,dir=$HOME/.pki/qemutls,endpoint=client \
          --image-opts driver=nbd,host=localhost,port=10809,tls-creds=tls0

      The qemu-nbd tool gained support for new '--object' and '--image-opts' arguments. The --object argument allows 'secret' and 'tls-creds-x509' objects to be defined for use in association with a
  block device backend or the NBD server. The '--image-opts' argument instructs qemu-io to parse the image string as a set of image options, instead of a plain filename. For example, to connect
  qemu-nbd to an HTTP server with authentication and export it over NBD using TLS

  qemu-nbd --readonly \
            --object secret,id=sec0,file=passwd.txt \
            --object tls-creds-x509,id=tls0,dir=$HOME/.pki/qemutls,endpoint=server \
            --image-opts driver=http,url=http://some.random.host/some/image,username=fred,password-secret=sec0

      The qemu-img tool gained support for new '--object' and '--image-opts' arguments. The --object argument allows 'secret' and 'tls-creds-x509' objects to be defined for use in association with a
  block device backend or the NBD server. The '--image-opts' argument instructs qemu-io to parse the image string as a set of image options, instead of a plain filename. For example, to a remote HTTP
  server with authentication

  qemu-img info --object secret,id=sec0,file=passwd.txt \
                --image-opts driver=http,url=http://some.random.host/some/image,username=fred,password-secret=sec0

      Support for deleting snapshots on Sheepdog devices.
      The NBD client and server now support use of TLS. When enabled, the server will mandate that the client also enable TLS and drop any client which attempts to continue in plain text. To run a
  qemu-nbd server with TLS:

  qemu-nbd --object tls-creds-x509,id=tls0,dir=$HOME/.pki/qemutls,endpoint=server \
            --tls-creds tls0 \
            /path/to/disk/image

  To connect to a server that requires TLS with qemu-img:

  qemu-img info --object tls-creds-x509,id=tls0,dir=$HOME/.pki/qemutls,endpoint=client \
                --image-opts driver=nbd,host=localhost,port=10809,tls-creds=tls0

  To start a VM pointing to the NBD server

  $QEMU -object tls-creds-x509,id=tls0,dir=$HOME/.pki/qemutls,endpoint=client \
        -drive driver=nbd,host=localhost,port=10809,tls-creds=tls0 \
        ...other args...

      The NBD server gained support for specifying an export name. When the client negotiates use of the new style NBD protocol the default export name is "". The --exportname argument allows this to
  be customized:

  qemu-nbd --exportname myvol  /path/to/myvol.qcow2

      QEMU gained support for volumes formatted with the LUKSv1 data format. To format a new LUKS volume

  qemu-img create -f luks \
                  --object secret,id=sec0,file=passphrase.txt \
                  -o key-secret=sec0 \
                  demo.luks 10G

  To boot a guest from a LUKS volume:

  $QEMU -object secret,id=sec0,file=passphrase.txt \
        -drive driver=luks,key-secret=sec0,file=demo.luks \
        ...other args...

  The LUKS implementation is intended to be compatible with that used by cryptsetup/dm-crypt, so it should be possible to use disk images interchangeably between them. The only caveat is that some less
  common cipher/hash algorithms are not yet supported by QEMU. It is also not yet possible to manage key-slots with qemu-img.
  TCG

      Record/replay support extended to cover character devices.

  Tracing

      The "stderr" tracing backend was replaced by the "log" tracing backend, which is now the default. This backend prints tracing messages to the destination specified with the "-D" option.
      In addition to the existing "-trace file=...", tracepoints can be enabled using "-trace [enable=]...". The new option also supports globbing, as in "-trace bdrv_aio_*".
      In addition to the existing "-trace file=...", tracepoints can be enabling using "-d trace:...". This option also supports globbing, as in "-d trace:bdrv_aio_*".
      When using "-daemonize", the "-D" option also provides the file to which QEMU's stderr output will be redirected.
      TCG supports a new "-dfilter" option to limit exec, out_asm, op and op_opt logging to a range of guest physical addresses. ARM also applies the filter to in_asm logging; this will be extended to
  other targets in future releases (FIXME: probably should do it now instead...)
      A "%d" substring in the log file name is replaced with QEMU's pid.

  User-mode emulation

      The default CPU for ppc64 and ppc64le is now POWER8

(bsiegert)

Pullup ticket #5015 - requested by sevan
www/firefox: security fix

Revisions pulled up:
- www/firefox/Makefile                                          1.249-1.250
- www/firefox/PLIST                                            1.105-1.106
- www/firefox/distinfo                                          1.242-1.243
- www/firefox/mozilla-common.mk                                1.73
- www/firefox/patches/patch-aa                                  1.45
- www/firefox/patches/patch-config_external_moz.build          1.11
- www/firefox/patches/patch-config_system-headers              1.18
- www/firefox/patches/patch-dom_media_gstreamer_GStreamerAllocator.cpp deleted
- www/firefox/patches/patch-dom_media_moz.build                1.3
- www/firefox/patches/patch-gfx_skia_generate__mozbuild.py      1.4
- www/firefox/patches/patch-gfx_skia_moz.build                  1.11
- www/firefox/patches/patch-gfx_skia_skia_src_core_SkUtilsArm.cpp 1.2
- www/firefox/patches/patch-gfx_skia_skia_src_opts_SkBitmapProcState__opts__arm.cpp deleted
- www/firefox/patches/patch-gfx_skia_skia_src_opts_memset.arm.S deleted
- www/firefox/patches/patch-gfx_thebes_moz.build                1.3
- www/firefox/patches/patch-media_libcubeb_src_cubeb.c          1.3
- www/firefox/patches/patch-media_libcubeb_src_cubeb__alsa.c    1.14
- www/firefox/patches/patch-media_libcubeb_src_moz.build        1.7
- www/firefox/patches/patch-media_libtheora_moz.build          1.5
- www/firefox/patches/patch-pb                                  deleted
- www/firefox/patches/patch-pc                                  deleted
- www/firefox/patches/patch-toolkit_library_moz.build          1.5
- www/firefox/patches/patch-xpcom_reflect_xptcall_md_unix_moz.build 1.5

---
  Module Name:    pkgsrc
  Committed By:  ryoon
  Date:          Wed Apr 13 20:37:33 UTC 2016

  Modified Files:
          pkgsrc/www/firefox: Makefile PLIST distinfo

  Log Message:
  Update to 45.0.2

  Changelog:
  Fixed:
      Fix an issue impacting the cookie header when third-party cookies are blocked (1257861)
      Fix a web compatibility regression impacting the srcset attribute of the image tag (1259482)
      Fix a regression with the copy and paste with some old versions of some Gecko applications like Thunderbird (1254980)
      Fix a crash impacting the video playback with Media Source Extension (1258562)
      Fix a regression impacting some specific uploads (1255735)

---
  Module Name:    pkgsrc
  Committed By:  ryoon
  Date:          Wed Apr 27 16:22:40 UTC 2016

  Modified Files:
          pkgsrc/www/firefox: Makefile PLIST distinfo mozilla-common.mk
          pkgsrc/www/firefox/patches: patch-aa patch-config_external_moz.build
              patch-config_system-headers patch-dom_media_moz.build
              patch-gfx_skia_generate__mozbuild.py patch-gfx_skia_moz.build
              patch-gfx_skia_skia_src_core_SkUtilsArm.cpp
              patch-gfx_thebes_moz.build patch-media_libcubeb_src_cubeb.c
              patch-media_libcubeb_src_cubeb__alsa.c
              patch-media_libcubeb_src_moz.build patch-media_libtheora_moz.build
              patch-toolkit_library_moz.build
              patch-xpcom_reflect_xptcall_md_unix_moz.build

  Removed Files:
          pkgsrc/www/firefox/patches:
              patch-dom_media_gstreamer_GStreamerAllocator.cpp
              patch-gfx_skia_skia_src_opts_SkBitmapProcState__opts__arm.cpp
              patch-gfx_skia_skia_src_opts_memset.arm.S patch-pb patch-pc

  Log Message:
  Update to 46.0

  * Drop buildlink to gstreamer1

  Changelog:
  New
      Improved security of the JavaScript Just In Time (JIT) Compiler
      GTK3 integration (GNU/Linux only)

  Fixed
      Correct rendering for scaled SVGs that use a clip and a mask
      Various security fixes
      Screen reader behavior with blank spaces in Google Docs corrected

  Changed
      WebRTC fixes to improve performance and stability

  Developer
      Display dominator trees in Memory tool
      Allocation and garbage collection pause profiling in the performance panel
      Launch responsive mode from the Style Editor @media sidebar

  HTML5
      Added support for document.elementsFromPoint
      Added HKDF support for Web Crypto API

  Fixed in Firefox 46
      2016-48 Firefox Health Reports could accept events from untrusted domains
      2016-47 Write to invalid HashMap entry through JavaScript.watch()
      2016-46 Elevation of privilege with chrome.tabs.update API in web extensions
      2016-45 CSP not applied to pages sent with multipart/x-mixed-replace
      2016-44 Buffer overflow in libstagefright with CENC offsets
      2016-43 Disclosure of user actions through JavaScript with motion and orientation sensors
      2016-42 Use-after-free and buffer overflow in Service Workers
      2016-41 Content provider permission bypass allows malicious application to access data
      2016-40 Privilege escalation through file deletion by Maintenance Service updater
      2016-39 Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8)

(bsiegert)

Pullup ticket #5014 - requested by sevan
devel/xulrunner38: security fix
www/firefox38: security fix

Revisions pulled up:
- devel/xulrunner38/Makefile                                    1.8
- devel/xulrunner38/PLIST                                      1.2
- www/firefox38/Makefile                                        1.19
- www/firefox38/distinfo                                        1.17

---
  Module Name:    pkgsrc
  Committed By:  ryoon
  Date:          Wed Apr 27 21:21:18 UTC 2016

  Modified Files:
          pkgsrc/www/firefox38: Makefile distinfo

  Log Message:
  Update to 38.8.0

  Changelog:
  Fixed in Firefox ESR 38.8
      2016-47 Write to invalid HashMap entry through JavaScript.watch()
      2016-44 Buffer overflow in libstagefright with CENC offsets
      2016-39 Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8)
      2016-36 Use-after-free during processing of DER encoded keys in NSS
      2016-29 Same-origin policy violation using performance.getEntries and history navigation with session restore
      2016-15 Use-after-free in NSS during SSL connections in low memory
      2016-07 Errors in mp_div and mp_exptmod cryptographic functions in NSS

---
  Module Name:    pkgsrc
  Committed By:  ryoon
  Date:          Wed May  4 09:56:26 UTC 2016

  Modified Files:
          pkgsrc/devel/xulrunner38: Makefile PLIST

  Log Message:
  Update to 38.8.0

  * Sync with firefox38-38.8.0

(bsiegert)

Set the PYTHON_INCLUDE_PATH form too, as used by e.g. weechat.

(jperkin)

Ensure python/ruby are found correctly.  Fixes build on Darwin.

(jperkin)

Updated x11/libxcb to 1.12

(wiz)

Updated libxcb to 1.12.

here is a new version of libxcb for you to enjoy. The highlights are the same as for the
new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker.

(wiz)

Updated x11/py-xcbgen to 1.12

(wiz)

Updated py-xcbgen to 1.12.

here is a new version of xcb-proto for you to enjoy. Highlights are lots of
improvements especially to the xinput extension, support for RandR 1.5 and an
automatic alignment checker.

(wiz)

Updated x11/xcb-proto to 1.12

(wiz)

Updated xcb-proto to 1.12.

here is a new version of xcb-proto for you to enjoy. Highlights are lots of
improvements especially to the xinput extension, support for RandR 1.5 and an
automatic alignment checker.

(wiz)

+geoclue

(snj)

add option to use geoclue. disabled by default.

(snj)

add libdrm

(snj)

Added x11/redshift version 1.11

(snj)

+redshift

(snj)

Import redshift-1.11 as x11/redshift.

Redshift adjusts the color temperature of your screen according to the
position of the sun.  A different color temperature is set during night and
daytime.  During twilight and early morning, the color temperature
transitions smoothly from night to daytime temperature to allow your eyes to
slowly adapt.  At night the color temperature should be set to match the
lamps in your room.  This is typically a low temperature at around
3000K-4000K.  During the day, the color temperature should match the light
from outside, typically around 5500K-6500K.

(snj)

Make some GCC warnings non-fatal.

(joerg)

Add missing rpath. Make a bunch of GCC warnings non-fatal. Bump
revision.

(joerg)

Pass CFLAGS and LDFLAGS to imake. Fixes MKPIE build.

(alnsn)

Updated pkgtools/x11-links to 1.02

(ryoon)

Update to 1.02

* Add freetype2 library of latest NetBSD-current native xorg

(ryoon)

Updated wm/openbox to 3.6.1.

(snj)