pkgsrc, branch pkgsrc-2006Q1

1714

2006-06-28T16:46:02Z

Pullup ticket 1714 - requested by salo

2006-06-28T16:45:46Z

security update for hashcash Revisions pulled up: - pkgsrc/security/hashcash/Makefile 1.9 - pkgsrc/security/hashcash/distinfo 1.7 - pkgsrc/security/hashcash/patches/patch-aa removed - pkgsrc/security/hashcash/patches/patch-ab removed Module Name: pkgsrc Committed By: gdt Date: Mon Apr 17 12:44:02 UTC 2006 Modified Files: pkgsrc/security/hashcash: Makefile distinfo Removed Files: pkgsrc/security/hashcash/patches: patch-aa patch-ab Log Message: Update to 1.22. hashcash-1.22 - 08-Apr-2006 - Adam Back [BUG FIXES] hashcash-1.18 - 05-Jul-2005 - Adam Back * add a simpler minting API to make it easier to mint stamps from VB scripting hashcash-1.17 - 30-Mar-2005 - Adam Back [BUG FIXES] hashcash-1.15 - 12-Jan-2005 - Adam Back * make "Hashcash:" be accepted as well as "X-Hashcash:" suggestion by Simon Josefsson . This way if/when the X- is dropped from hashcash headers we will not have a backwards compatibility problem. (Well not after version 1.15). * implement the -Z option to compress stamps; in fact the usage changed so -Z takes an argument: 0, 1 or 2. 0 =3D not compressed, 1 =3D compressed but not so the counter + padding is split, and 2 =3D very compressed, but slow. (Due to a late discovered bug 2 is the same as 1 for now until I can fix that.) * added -O x -sv to request benchtest of core x only * make code work with -DOPENSSL, think this slipped during integration of Jonathan's libfastmint as it uses some lower level openssl APIs internally. I fixed it but it might be a bit openssl version specific, if they changed the state fields at any point. (This change coincidentally I think should work around the linking with openssl problem that Hal Finney reported). * add libhashcash.a intermediate target to make hashcash more convenient to link into other software on linux. (A suggestion from Hal Finney who was trying to link to his RPOW system.) hashcash-1.14 - 14-Dec-2004 - Adam Back * make hashcash -cX accept continuation lines starting with space as well as tab * add library function to wrap lines and use it from hashcash command line tool. * fix long vs time_t prototype mismatch that was giving compile errors on BSD; also cleaned up some warnings that can be obtained with gcc -Wall.

#1713.

2006-06-27T17:00:04Z

Pullup ticket 1713 - requested by salo

2006-06-27T16:59:27Z

security fix for mutt-devel Revisions pulled up: - pkgsrc/mail/mutt-devel/Makefile 1.50 - pkgsrc/mail/mutt-devel/distinfo 1.30 - pkgsrc/mail/mutt-devel/patches/patch-ae 1.5 Module Name: pkgsrc Committed By: tonio Date: Tue Jun 20 14:07:31 UTC 2006 Modified Files: pkgsrc/mail/mutt-devel: Makefile distinfo Log Message: Add fix for imap code from mutt's cvs repository: A malicious IMAP server could cause at least DoS Bomp PKGREVISION --- Module Name: pkgsrc Committed By: tonio Date: Tue Jun 20 14:08:05 UTC 2006 Added Files: pkgsrc/mail/mutt-devel/patches: patch-ae Log Message: The patch for imap/browse

#1711.

2006-06-26T07:07:19Z

Pullup ticket 1711 - requested by salo

2006-06-26T07:06:34Z

security update for netpbm Revisions pulled up: - pkgsrc/graphics/netpbm/Makefile 1.136, 1.137, 1.138, 1.142, 1.143 - pkgsrc/graphics/netpbm/distinfo 1.54, 1.56, 1.58, 1.59 - pkgsrc/graphics/netpbm/patches/patch-aa 1.37, 1.38 - pkgsrc/graphics/netpbm/patches/patch-ab 1.20 - pkgsrc/graphics/netpbm/patches/patch-ac removed - pkgsrc/graphics/netpbm/patches/patch-ag removed - pkgsrc/graphics/netpbm/patches/patch-ai removed - pkgsrc/graphics/netpbm/patches/patch-aj removed - pkgsrc/graphics/netpbm/patches/patch-ca 1.1 Module Name: pkgsrc Committed By: tron Date: Mon Apr 3 16:46:51 UTC 2006 Modified Files: pkgsrc/graphics/netpbm: Makefile Log Message: Make sure all documentation files are installed world readable. Bump package revision because this change affects the binary package. --- Module Name: pkgsrc Committed By: tron Date: Mon Apr 3 16:53:58 UTC 2006 Modified Files: pkgsrc/graphics/netpbm: Makefile Log Message: Make last change work with IRIX's old fashioned "find" command. --- Module Name: pkgsrc Committed By: adam Date: Mon Apr 17 08:11:17 UTC 2006 Modified Files: pkgsrc/graphics/netpbm: Makefile distinfo Removed Files: pkgsrc/graphics/netpbm/patches: patch-ag Log Message: Changes 10.33: Add pamtosvg. g3topbm: Add -width, -paper_size. libnetpbm / most newer programs: Fix bug that produces plain format output when it should be raw because pnm_readpaminit() does not set 'plainformat' and most programs just copy the input pam to the output pam. pamflip: fix bug with left/right flip of PBM that has width an even multiple of 8 plus something less than 8. pnmquant: turn on autoflush when creating seekable file. install: fix symbolic link pnmdepth -> pamdepth. build: fix some importinc dependencies. --- Module Name: pkgsrc Committed By: jlam Date: Wed May 10 17:19:00 UTC 2006 Modified Files: pkgsrc/graphics/netpbm: distinfo Added Files: pkgsrc/graphics/netpbm/patches: patch-ca Log Message: On FreeBSD 4.x, needs to be included first. --- Module Name: pkgsrc Committed By: minskim Date: Sun Jun 18 16:18:11 UTC 2006 Modified Files: pkgsrc/graphics/netpbm: Makefile distinfo pkgsrc/graphics/netpbm/patches: patch-aa Log Message: Build .dylib instead of .so on Darwin. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: adam Date: Sun Jun 25 06:35:58 UTC 2006 Modified Files: pkgsrc/graphics/netpbm: Makefile distinfo pkgsrc/graphics/netpbm/patches: patch-aa patch-ab Removed Files: pkgsrc/graphics/netpbm/patches: patch-ac patch-ag patch-ai patch-aj Log Message: This is a security update, which fixes a buffer overflow vulnerability. Changes 10.34: * Add pamthreshold, pamx, pamtoxvmini. * pammasksharpen: Add -threshold. * pnmtopng: make "N colors found" message verbose-only. * pnmtopng: make "no room in palette" message non-verbose. * picttoppm: Tolerate various PICT file corruptions. * picttoppm: Don't issue warning message when file named 'fontdir' doesn't exist. * libnetpbm: Add ppmd_fill_path(). * ppmtobmp: Fix for PBM input. * bmptopnm: Don't crash on BMP with no color map. * bmptopnm: Fix wrong file name in error messages. * ppmtogif: fix bug: always produces garbage output. * ppmtompeg: fix input from Standard Input. * pnmflip: fix bug: -rotate90, -rotate180, and -rotate270 (and synonyms) don't work when followed by other rotation options. * ppmtoilbm: Fig bug: generates more planes than necessary. * pamtofits: fix buffer overflow in asembling header. * picttoppm: fix bug - interprets some images wrong because of bogus "rowBytes" value. * Redo asprintfN(), etc. so as not to use va_list in a way that doesn't work on some machines. * cameratopam: remove definition of memmem() so it doesn't collide with same in some C libraries. Add memmemN() and MEMEQ to libnetpbm. * Fix build of filename.o.

1710

2006-06-25T09:06:35Z

Pullup ticket 1710 - requested by salo

2006-06-25T09:06:19Z

security fix for gnupg-devel Revisions pulled up: - pkgsrc/security/gnupg-devel/Makefile 1.17 - pkgsrc/security/gnupg-devel/distinfo 1.12 - pkgsrc/security/gnupg-devel/patches/patch-ba 1.1 Module Name: pkgsrc Committed By: shannonjr Date: Fri Jun 23 12:28:55 UTC 2006 Modified Files: pkgsrc/security/gnupg-devel: Makefile buildlink3.mk distinfo Added Files: pkgsrc/security/gnupg-devel/patches: patch-ba Log Message: Backport fix for CVE-2006-3082 from GnuPG: trunk/g10/

1709

2006-06-25T08:59:00Z

Pullup ticket 1709 - requested by salo

2006-06-25T08:58:13Z

security update for gnupg Revisions pulled up: - pkgsrc/security/gnupg/Makefile 1.83, 1.86 - pkgsrc/security/gnupg/PLIST 1.16 - pkgsrc/security/gnupg/distinfo 1.39, 1.40 - pkgsrc/security/gnupg/options.mk 1.6, 1.7 - pkgsrc/security/gnupg/patches/patch-aa 1.11 - pkgsrc/security/gnupg/patches/patch-ak 1.3 - pkgsrc/security/gnupg/patches/patch-ba 1.1 Module Name: pkgsrc Committed By: wiz Date: Tue Apr 4 21:16:37 UTC 2006 Modified Files: pkgsrc/security/gnupg: Makefile PLIST distinfo options.mk pkgsrc/security/gnupg/patches: patch-aa patch-ak Log Message: Update to 1.4.3: Noteworthy changes in version 1.4.3 (2006-04-03) ------------------------------------------------ * If available, cURL-based keyserver helpers are built that can retrieve keys using HKP or any protocol that cURL supports (HTTP, HTTPS, FTP, FTPS, etc). If cURL is not available, HKP and HTTP are still supported using a built-in cURL emulator. To force building the old pre-cURL keyserver helpers, use the configure option --enable-old-keyserver-helpers. Note that none of this affects finger or LDAP support, which are unchanged. Note also that a future version of GnuPG will remove the old keyserver helpers altogether. * Implemented Public Key Association (PKA) signature verification. This uses special DNS records and notation data to associate a mail address with an OpenPGP key to prove that mail coming from that address is legitimate without the need for a full trust path to the signing key. * When exporting subkeys, those specified with a key ID or fingerpint and the '!' suffix are now merged into one keyblock. * Added "gpg-zip", a program to create encrypted archives that can interoperate with PGP Zip. * Added support for signing subkey cross-certification "back signatures". Requiring cross-certification to be present is currently off by default, but will be changed to on by default in the future, once more keys use it. A new "cross-certify" command in the --edit-key menu can be used to update signing subkeys to have cross-certification. * The key cleaning options for --import-options and --export-options have been further polished. "import-clean" and "export-clean" replace the older import-clean-sigs/import-clean-uids and export-clean-sigs/export-clean-uids option pairs. * New "minimize" command in the --edit-key menu removes everything that can be removed from a key, rendering it as small as possible. There are corresponding "export-minimal" and "import-minimal" commands for --export-options and --import-options. * New --fetch-keys command to retrieve keys by specifying a URI. This allows direct key retrieval from a web page or other location that can be specified in a URI. Available protocols are HTTP and finger, plus anything that cURL supplies, if built with cURL support. * Files containing several signed messages are not allowed any longer as there is no clean way to report the status of such files back to the caller. To partly revert to the old behaviour the new option --allow-multisig-verification may be used. * The keyserver helpers can now handle keys in either ASCII armor or binary format. * New auto-key-locate option that takes an ordered list of methods to locate a key if it is not available at encryption time (-r or --recipient). Possible methods include "cert" (use DNS CERT as per RFC2538bis, "pka" (use DNS PKA), "ldap" (consult the LDAP server for the domain in question), "keyserver" (use the currently defined keyserver), as well as arbitrary keyserver URIs that will be contacted for the key. * Able to retrieve keys using DNS CERT records as per RFC-2538bis (currently in draft): http://www.josefsson.org/rfc2538bis pkgsrc change: make architecture-specific options really architecture-specific. --- Module Name: pkgsrc Committed By: drochner Date: Wed Apr 5 10:04:12 UTC 2006 Modified Files: pkgsrc/security/gnupg: options.mk Log Message: --with-libcurl is on per default, so revert the logics (no functional change, just more effective because a compile check is skipped) --- Module Name: pkgsrc Committed By: salo Date: Sat Jun 24 14:20:29 UTC 2006 Modified Files: pkgsrc/security/gnupg: Makefile distinfo Added Files: pkgsrc/security/gnupg/patches: patch-ba Log Message: Security fix for CVE-2006-3082: "parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length, which could lead to an integer overflow, as demonstrated using the --no-armor option." Patch from GnuPG CVS repository. Bump PKGREVISION.