summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn65-94/+130
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2008-01-17Update to openssl-0.9.8g. Provided by Jukka Salmi in pkgsrc-wip.tnn29-634/+262
pkgsrc notes: o Tested on NetBSD/i386 (Jukka Salmi), Mac OSX 10.5 (Adrian Portelli), Linux (Jeremy C. Reed), Tru64 5.1b (tnn), HP-UX 11i (tnn). Because the Makefile system has been rewamped, other platforms may require fixes. Please test if you can. o OpenSSL can now be built with installation to DESTDIR. Overview of important changes since 0.9.7i: o Add gcc 4.2 support. o DTLS improvements. o RFC4507bis support. o TLS Extensions support. o RFC3779 support. o New cipher Camellia o Updated ECC cipher suite support. o New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free(). o Zlib compression usage fixes. o Major work on the BIGNUM library for higher efficiency and to make operations more streamlined and less contradictory. This is the result of a major audit of the BIGNUM library. o Addition of BIGNUM functions for fields GF(2^m) and NIST curves, to support the Elliptic Crypto functions. o Major work on Elliptic Crypto; ECDH and ECDSA added, including the use through EVP, X509 and ENGINE. o New ASN.1 mini-compiler that's usable through the OpenSSL configuration file. o Added support for ASN.1 indefinite length constructed encoding. o New PKCS#12 'medium level' API to manipulate PKCS#12 files. o Complete rework of shared library construction and linking programs with shared or static libraries, through a separate Makefile.shared. o Rework of the passing of parameters from one Makefile to another. o Changed ENGINE framework to load dynamic engine modules automatically from specifically given directories. o New structure and ASN.1 functions for CertificatePair. o Changed the key-generation and primality testing "progress" mechanism to take a structure that contains the ticker function and an argument. o New engine module: GMP (performs private key exponentiation). o New engine module: VIA PadLOck ACE extension in VIA C3 Nehemiah processors. o Added support for IPv6 addresses in certificate extensions. See RFC 1884, section 2.2. o Added support for certificate policy mappings, policy constraints and name constraints. o Added support for multi-valued AVAs in the OpenSSL configuration file. o Added support for multiple certificates with the same subject in the 'openssl ca' index file. o Make it possible to create self-signed certificates using 'openssl ca -selfsign'. o Make it possible to generate a serial number file with 'openssl ca -create_serial'. o New binary search functions with extended functionality. o New BUF functions. o New STORE structure and library to provide an interface to all sorts of data repositories. Supports storage of public and private keys, certificates, CRLs, numbers and arbitrary blobs. This library is unfortunately unfinished and unused withing OpenSSL. o New control functions for the error stack. o Changed the PKCS#7 library to support one-pass S/MIME processing. o New FIPS 180-2 algorithms (SHA-224, -256, -384 and -512). o New X509_VERIFY_PARAM structure to support parametrisation of X.509 path validation. o Change the default digest in 'openssl' commands from MD5 to SHA-1. o Added support for DTLS. o New BIGNUM blinding. o Added support for the RSA-PSS encryption scheme o Added support for the RSA X.931 padding. o Added support for files larger than 2GB. o Added alternate pkg-config files.
2008-01-15Needs libz.rillig1-1/+2
From PR 37760.
2008-01-13-audit-packagesadrianp1-2/+1
2008-01-13Retire audit-packages in favour of pkg_install>=20070714.adrianp10-1037/+0
All functionality in this package is now in pkg_install>=20070714. As discussed on pkgsrc-users@ and OK'ed by agc@.
2008-01-13Update to 1.4.8:wiz2-6/+7
Noteworthy changes in version 1.4.8 (2007-12-20) ------------------------------------------------ ******************************************* * A decade of GnuPG: g10-0.0.0.tar.gz was * * released exactly 10 years ago. * ******************************************* * Changed the license to GPLv3. * Improved detection of keyrings specified multiple times. * Changes to better cope with broken keyservers. * Minor bug fixes. * The new OpenPGP standard is now complete, and has been published as RFC-4880. The GnuPG --openpgp mode (note this is not the default) has been updated to match the new standard. The --rfc2440 option can be used to return to the older RFC-2440 behavior. The main differences between the two are "--enable-dsa2 --no-rfc2440-text --escape-from-lines --require-cross-certification". * By default (i.e. --gnupg mode), --require-cross-certification is now on. --rfc2440-text and --force-v3-sigs are now off. * Allow encryption using legacy Elgamal sign+encrypt keys if option --rfc2440 is used. * Fixed the auto creation of the key stub for smartcards. * Fixed a rare bug in decryption using the OpenPGP card. * Fix RFC-4880 typo in the SHA-224 hash prefix. Old SHA-224 signatures will continue to work.
2008-01-11update to 2.20.3drochner2-6/+6
changes: minor fixes
2008-01-11update to 2.20.3drochner4-15/+15
changes: translation updates
2008-01-09Updated to version 1.32.heinz2-10/+18
Pkgsrc changes: - Requires p5-Test-Exception and p5-Test-Warn for building and p5-MIME-Base64 for running. The modules p5-Array-Compare, p5-Sub-Uplevel and p5-Tree-DAG_Node are only used through p5-Test-Warn. Opened bug id 32172 at rt.cpan.org for this. - Needs a C compiler. - Specified prefix for OpenSSL in order to avoid adding any search paths to inc/Module/Install/PRIVATE/Net/SSLeay.pm. - No more interactive questions (PERL_MM_USE_DEFAULT). Changes since version 1.30: =========================== - Mike McCauley and Florian Ragwitz maintain this module now 1.31_01 02.07.2007 - Only bind X509_STORE_set_trust #if OPENSSL_VERSION_NUMBER >= 0x0090800fL - Removed %Filenum_Objects from Net::SSLeay::Handle so unused handles will be freed. - Use ppport.h. - improved openssl path guessing, forcing openssl path now requires the -path flag (caution: incompatible flag change) Path guessing works on windows too. mikem, with patches from Stas Bekman - Added /usr/sfw/bin/openssl to path guessing for Open Solaris, suggested by Igor Boehme. - Fixed a problem with X509_get_subjectAltNames not working when the subjectAltNAmes are the first extension. Reported by Achim Grolms 1.31_02 14.07.2007 - Fix linking problems on Windows. Tested with VC++ 6.0, Shining Light 0.9.7L on Windows Server 2003 with ActivePerl 5.8.8.820. Also tested with OpenSSL 0.9.8e compiled from source. - Unable to get working systems when compiling with MS Visual Studio Express 2005. Contributions requested. This may be relevant: http://www.itwriting.com/blog/?postid=261&replyto=2542 - Fixed a number of minor compile warnings on Windows - Updated README.Win32 to define building procedures on Windows - Fixed incorrect test failure reports in 08_external. - Add parens to function calls in Makefile.PL to prevent warnings with some perls. - Tested on Sparc Solaris 8, Sparc Solaris 10, OpenSuSE 10.2 x64, OpenSuSE 10.0 x86, FreeBSD 6.0 x86, Ubuntu 6.10, Fedora Core 6 x86 - Changed type of SSL_set_info_callback args to stop compiler warnings on Windows - Removed auto_include from Makefile.PL - Removed build_requires('Test::NoWarnings') from Makefile.PL - Testing with Strawberry Perl on Windows XP SP2, added doc to README.Win32 - Testing with Perl CamelPack 5.8.7 on Windows XP SP2,added doc to README.Win32 1.32 03.08.2007 - Don't let the tests die when something unexpected happens. Just BAIL_OUT. - Some Win32 improvements.
2008-01-08Fix builds on Darwinadrianp1-2/+2
2008-01-08Updated to version 5.45.heinz2-6/+8
Pkgsrc changes: - Added explicit licence identification. Changes since version 5.44: =========================== 5.45 Tue Jun 26 02:36:00 MST 2007 - extended portability to earlier Perls -- works on Perl 5.003 and later -- thanks to Jim Doble for testing on legacy platforms - updated META.yml to conform to current META spec (1.3) - minor documentation fixes
2008-01-08Updated to version 0.25.heinz3-25/+12
Pkgsrc changes: - A C compiler is necessary. - Added explicit license identification. - Removed patch-ab (fixed upstream). Changes since version 0.24: =========================== 0.25 Sun May 20 2007 12:56:11 - Add a LICENSE file. - Fix a bug (reported by many) in rsa.t - we were incorrectly counting the number of tests in situations where use_sha512_hash was not available.
2008-01-08Updated to version 0.04.heinz2-7/+12
Pkgsrc changes: - The package supports installation to DESTDIR. - A C compiler is necessary. - Added explicit license identification. Changes since version 0.03: =========================== 0.04 Sun May 20 13:41:04 2007 - Add a LICENSE file. - Better use of types.
2008-01-08Updated to version 0.04.heinz2-7/+12
Pkgsrc changes: - The package supports installation to DESTDIR. - A C compiler is necessary. - Added explicit license identification. Changes since version 0.03: =========================== 0.04 Sun May 20 2007 13:08:23 - Add a LICENSE file. - Add -DOPENSSL_NO_KRB5 to DEFINE to keep redhat happy.
2008-01-07Fix builtin.mk logic for thread feature if no native OpenSSL exists.joerg1-2/+3
Fixes PR pkg/37699 from Aleksey Cheusov.
2008-01-06Update sudo package to 1.6.9p11.taca2-8/+6
637) Fixed a compilation problem on SCO related to how they store the high resolution timestamps in struct stat. 638) Avoid checking the passwd file group multiple times in the LDAP query when the user's passwd group is also listed in the supplemental group vector. 639) The URI specifier can now be used in ldap.conf even when the LDAP SDK doesn't support ldap_initialize(). 640) New %p prompt escape that expands to the user whose password is being prompted, as specified by the rootpw, targetpw and runaspw sudoers flags. Based on a diff from Patrick Schoenfeld.
2008-01-05Fixed a few pkglint warnings.rillig3-7/+8
2008-01-05Change MASTER_SITES to locatoin for old archive,obache1-2/+2
noticed by Zafer Aydogan in private mail.
2008-01-05Change MASTER_SITES to new location, noticed by Zafer Aydogan in private mail.obache1-3/+3
Also change HOMEPAGE.
2008-01-05Old url is not available now, noticed by Zafer Aydogan in private mail.obache1-4/+3
Switch HOMEPAGE and MASTER_SITES to new location.
2008-01-05*.tbz does not exist now, noticed by Zafer Aydogan in private mail.obache2-6/+6
Switch to *.tgz, no differ from *.tbz.
2008-01-05Change HOMEPAGE and MASTER_SITES to new location.obache1-3/+3
2008-01-04The package needs a C compiler.heinz1-1/+3
2008-01-04Removed the special-case handling of PKG_SYSCONFDIR for NetBSD. Now therillig1-6/+2
configuration files are installed in the usual pkgsrc place, not in /etc. PKGREVISION++ Ok'ed by jlam@.
2008-01-04Update to 2.1.4adrianp4-23/+20
27 Nov 2007 - 2.1.4 ------------------- * Updated included Core Ruleset to version 1.5 and noted in the docs that XML support is required to use the rules without modification. * Fixed an evasion FP, mistaking a multipart non-boundary for a boundary. * Fixed multiple warnings on Solaris and/or 64bit builds. * Do not process subrequests in phase 2-4, but do hand off the request data. * Fixed a blocking FP in the multipart parser, which affected Safari. 11 Sep 2007 - 2.1.3 ------------------- * Updated multipart parsing code adding variables to allow checking for various parsing issues (request body abnormalities). * Allow mod_rpaf and mod_extract_forwarded2 to work before ModSecurity. * Quiet some compiler warnings. * Do not block internal ErrorDocument requests after blocking request. * Added ability to compile without an external API (use -DNO_MODSEC_API). 27 Jul 2007 - 2.1.2 ------------------- * Cleaned up and clarified some documentation. * Update included core rules to latest version (1.4.3). * Enhanced ability to alert/audit failed requests. * Do not trigger "pause" action for internal requests. * Fixed issue with requests that use internal requests. These had the potential to be intercepted incorrectly when other Apache httpd modules that used internal requests were used with mod_security. * Added Solaris and Cygwin to the list of platforms not supporting the hidden visibility attribute. * Fixed decoding full-width unicode in t:urlDecodeUni. * Lessen some overhead of debugging messages and calculations. * Do not try to intercept a request after a failed rule. This fixes the issue associated with an "Internal Error: Asked to intercept request but was_intercepted is zero" error message. * Added SecAuditLog2 directive to allow redundent concurrent audit log index files. This will allow sending audit data to two consoles, etc. * Small performance improvement in memory management for rule execution.
2008-01-03Install the binaries readable for the owner, so that a package can berillig3-6/+7
created in unprivileged pkgsrc mode. PKGREVISION++
2008-01-02Look out for the case where audit-packages is already installed with theadrianp1-1/+10
base OS on NetBSD.
2007-12-30Replaced outdated mirrors by working mirrors.heinz1-4/+5
2007-12-30* Honor PKGMANDIR and PKG_SYSCONFBASE.obache4-8/+67
* Install config files by CONF_FILES instead of install directly. * Correct path of tools and config in sample config files and a manual page. * Add DESTDIR support. Bump PKGREVISION.
2007-12-28Recognize the MIT Kerberos bundled with Mac OS X Leopard.tron1-1/+7
2007-12-28This package uses BSD Makefile.obache3-2/+21
Honor PKGMANDIR and DESTDIR ready.
2007-12-28Require pre-created sbin directory.obache1-2/+2
2007-12-28DESTDIR ready.obache1-1/+3
2007-12-28Fixes invalid lvalue in assignment.obache2-1/+15
2007-12-28Also need for NetBSD.obache2-4/+4
2007-12-28Switch to SUBST framework.obache1-21/+19
2007-12-28Honor PKGMANDIR.obache1-2/+2
2007-12-27Remove deprecated "fee-based commercial use" license for idea, mdc2,gdt1-11/+8
rc5, and replace with {idea,mdc2,rc5}-nonlicense. Because pkgsrc does not yet handle multiple licenses, set LICENSE to openssl-patented-algorithms-nonlicense.
2007-12-27Add a PCRE bl3 depends to fix builds (found by DragonFly bulk builds)adrianp1-1/+3
PKGREVISION++
2007-12-27Explicitly depend on Perl. Bump revision.joerg1-2/+3
2007-12-27Change MASTER_SITES to archive directory, 1.4.11 only exsits in it.obache1-2/+2
2007-12-27Try to create target directories before install manuals.obache1-1/+3
2007-12-27Try to fix build problem on NetBSD, use the same strategies as DragonFly.obache1-1/+2
2007-12-25Now that package is installed into qt4 subdirectory, pkg-config can'tmarkd2-3/+7
find the qca2.pc file so copy to where it can. OKed jdolecek. Bump PKGREVISION.
2007-12-23restore security/qca-tls to state on pkgsrc-2007Q3-base tag (just beforejdolecek4-26/+29
the removal), rather then revision 1.1 of all files, used for original revival test compiled on Mac OS X 10.5
2007-12-22install qca2 files into qt4 subdirectory, so that qca 1.x and qca2 couldjdolecek1-4/+6
be installed at the same time bump PKGREVISION
2007-12-21I18N (PR 37581) and DESTDIR support.joerg2-3/+12
2007-12-21Update sudo pacakge to 1.6.9p10.taca2-7/+6
Major changes since Sudo 1.6.9p9: o Moved LDAP options into a table for simplified parsing/setting. o Fixed a problem with how some LDAP options were being applied. o Added support for connecting directly to LDAP servers via SSL/TLS for servers that don't support the start_tls extension.
2007-12-21install qca2 files into qt4 subdirectory, so that qca 1.x and qca2 couldjdolecek5-37/+60
be installed at the same time; also speedup build by disabling building tests and other miscellaneous cleanup bump PKGREVISION
2007-12-20put back qca-tls, add qca2 and qca2-ossljdolecek1-2/+4
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-06 20:07:55 +0000