summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2010-10-18SoftHSM 1.2.0 - 2010-09-30pettai2-8/+8
* Added mechanism CKM_RSA_X_509 (use Botan 1.9.7 to fix a bug when verifying these signatures) * The softhsm command now have the option --module <path> To use a PKCS#11 library other than SoftHSM. * The softhsm command now import all parts of the RSA key. CKA_EXPONENT_1, CKA_EXPONENT_2, and CKA_COEFFICIENT is not needed by SoftHSM but might be needed by other HSM:s. * Ticket #163: softhsm-keyconv now support BIND format v1.3 * Write message to stderr when the config file cannot be found * CKA_WRAP_WITH_TRUSTED was not handled correctly. But it has not been a problem since wrapping is not supported. * Set CKA_KEY_GEN_MECHANISM to CK_UNAVAILABLE_INFORMATION when importing objects. * C_GetInfo now returns CKR_CRYPTOKI_NOT_INITIALIZED if library is not initialized. * Force clean up if the app does not do C_Finalize (using auto_ptr) * Limit the scope of the session objects to the owner application * softhsm --optimize will clean up leftovers (session objects) from applications that haven't closed down properly. * Do not use CKF_HW, the mechanisms are not performed by a device. * The ulMinKeySize and ulMaxKeySize are not used for the digesting mechanisms, but we set them to zero for applications that forget this. * Used wrong buffer size for signatures. This was only a problem for keys where (key size % 8 == 1), e.g. 1025 bit keys. * C_Login now returns CKR_USER_ANOTHER_ALREADY_LOGGED_IN instead of CKR_USER_TOO_MANY_TYPES
2010-10-16Update to 2.10.2:wiz2-6/+6
* Version 2.10.2 (released 2010-09-30) ** Use Libtool 2.2.10 to ease MinGW64 builds. ** libgnutls: Add new extended key usage ipsecIKE. ** libgnutls: Is now more liberal in the PEM decoding. That is spaces and tabs are being skipped. ** libgnutls: Renamed NULL MAC to MAC-NULL to prevent clash with NULL cipher. This prevented the usage of the TLS ciphersuites with NULL cipher. See <http://thread.gmane.org/gmane.network.gnutls.general/2093>. ** libgnutls: The %COMPAT flag now allows larger records that violate the TLS spec. ** libgnutls: Fix asynchronous API handling. The code was clearing session hash data on EAGAIN. Problem reported by Sjoerd Simons <sjoerd.simons@collabora.co.uk> and Vivek Dasmohapatra <vivek@collabora.co.uk>. See <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4531>. ** gnutls-cli: Flush stdout/stderr before removing buffering. Reported by Knut Anders Hatlen see <http://savannah.gnu.org/support/?107481>.
2010-10-16Update to 2.8:wiz2-6/+6
* Noteworthy changes in release 2.8 (2010-09-25) [stable] - Update gnulib files. - Use Libtool 2.2.10 to ease MinGW64 builds.
2010-10-16Update ruby-roauth to 0.0.6.obache3-9/+11
* add tests * Corrected a bogus array initialization. * Effectively double-escaped the normalized params for inclusion in the signature base as required by sections 9.1.1 and 9.1.3 of the OAuth 1.0 specification.
2010-10-15postgresql82 had been removed from pkgsrc,obache1-2/+2
switch to use default PostgreSQL in pkgsrc for pgsql option (default off).
2010-10-12Sort out PLIST for i386. Bump revision.joerg2-6/+11
2010-10-10require elementtree module to build for python24.obache1-1/+6
2010-10-08Fix for CVE-2010-2939tez3-2/+18
2010-10-08* using perl in test.pl.obache1-3/+3
* missing dependency in p5-SHA package is fixed, then no included copy of SHA module will not be installed, conflict is resolved.
2010-10-08Add missing dependency on p5-Digest-SHA1.obache1-2/+4
Bump PKGREVISION.
2010-10-08set HOMEPAGE.obache1-1/+2
2010-10-04fixes patches for previous commit, not for generated file.obache4-29/+29
2010-10-04Remove redundant escape slash from *.pc file.obache5-2/+45
It's shell script style escape, not required in *.pc file and break build of security/lasso. Bump PKGREVISION.
2010-09-30Bump PKGREVISION by default mysql version changed from 5.0 to 5.1.obache4-6/+8
2010-09-28Reset maintainer.wiz2-5/+4
2010-09-24Update to 0.5.25. Add patch to not install odd extraversion.h file.gdt3-8/+25
2010-09-20 -- pycryptopp v0.5.25 * make setup backwards-compatible to Python 2.4 * fix incompatibilities between setup script and older versions of darcsver * don't attempt to compile Mac OS X extended attribute files (this fixes the build breaking) * include a version number of the specific version of Crypto++ in extraversion.h * small changes to docs 2010-09-18 -- pycryptopp v0.5.20 * fix bugs in assembly implementation of SHA-256 from Crypto++ * fix it to compile on *BSD (#39) * improve doc strings * add a quick start-up-self-test of SHA256 (#43) * execute the quick start-up-self-tests of AES and SHA256 on module import
2010-09-23Add and enable ruby-hmac.taca1-1/+2
2010-09-23Importing security/ruby-hmac 0.4.0.taca4-0/+39
This module provides common interface to HMAC functionality. HMAC is a kind of "Message Authentication Code" (MAC) algorithm whose standard is documented in RFC2104. Namely, a MAC provides a way to check the integrity of information transmitted over or stored in an unreliable medium, based on a secret key. Originally written by Daiki Ueno. Converted to a RubyGem by Geoffrey Grosenbach
2010-09-23Update security/ruby-net-scp to 1.0.4.taca2-6/+6
=== 1.0.4 / 16 Sep 2010 * maintain filename sanitization compatibility with ruby 1.8.6 [Sung Pae, Tim Charper]
2010-09-23+ lua-secobache1-1/+2
2010-09-21Import lua-sec-0.4 as security/lua-sec.fhajny6-0/+132
LuaSec is a binding for OpenSSL library to provide TLS/SSL communication. This version delegates to LuaSocket the TCP connection establishment between the client and server. Then LuaSec uses this connection to start a secure TLS/SSL session. (Based on wip/luasec.)
2010-09-21Updating security/p5-Digest-CRC from 0.14nb2 to 0.15sno2-7/+8
pkgsrc changes: - add license definition Upstream changes: 0.15 Sun Sep 12 13:46:13 2010 - added crc64 support, #50064 Thanks to Anders Ossowicki <aowi@novozymes.com> - added bit reversing per byte, #59575 Thanks to Joel Peshkin <joel@peshkin.net> - clone method nwo copies content too Thanks to Stefan Ochs <stefan.ochs@opentext.com>
2010-09-21* Fix PLIST when "ldap" is enabled in PKG_OPTIONS.taca6-21/+53
* Install README.LDAP when "ldap" is enabled in PKG_OPTIONS. * Fix build problem when "kerberos" is enabled in PKG_OPTIONS. Bump PKGREVISION since default PLIST has changed.
2010-09-19static link is not supported on MacOS X.obache2-7/+20
PR#39058
2010-09-15do missing dependency bump for glitz removaldrochner1-2/+2
2010-09-14More PKGREVISION bumps for pixman update.wiz3-6/+6
2010-09-14Bump dependency on pixman to 0.18.4 because cairo-1.10 needs thatwiz23-42/+46
version, and bump all depends. Per discussion on pkgsrc-changes.
2010-09-14The author pushed a new distfilepettai1-4/+4
2010-09-13Version 0.15.1pettai2-6/+6
* Fixed bug with DB_CHECKINODE Version 0.15 * Added new grouped option * Sort files in report by filename * Added support for e2fsattrs attribute * Added support for ftype attribute * Bug fixes
2010-09-13OpenDNSSEC 1.1.3:pettai2-6/+6
Bugfixes: * Bugreport #183: Partial zone could get signed if zone transfer failed when using zone_fetcher
2010-09-10updating to the latest and greatest (and less a bunch of securityspz6-95/+104
relevant bugs) version: Major changes between version 1.7.4p3 and 1.7.4p4: * A potential security issue has been fixed with respect to the handling of sudo's -g command line option when -u is also specified. The flaw may allow an attacker to run commands as a user that is not authorized by the sudoers file. * A bug has been fixed where "sudo -l" output was incomplete if multiple sudoers sources were defined in nsswitch.conf and there was an error querying one of the sources. * The log_input, log_output, and use_pty sudoers options now work correctly on AIX. Previously, sudo would hang if they were enabled. * Fixed "make install" when sudo is built in a directory other than the directory that holds the sources. * The runas_default sudoers setting now works properly in a per-command Defaults line. * Suspending and resuming the bash shell when PAM is in use now works properly. The SIGCONT signal was not being propagated to the child process. Major changes between version 1.7.4p2 and 1.7.4p3: * A bug has been fixed where duplicate HOME environment variables could be set when the env_reset setting was disabled and the always_set_home setting was enabled in sudoers. * The value of sysconfdir is now substituted into the path to the sudoers.d directory in the installed sudoers file. * Fixed compilation problems on Irix and other platforms. * If multiple PAM "auth" actions are specified and the user enters ^C at the password prompt, sudo will now abort any subsequent "auth" actions. Previously it was necessary to enter ^C once for each "auth" action. Major changes between version 1.7.4p1 and 1.7.4p2: * Fixed a bug where sudo could spin in a cpu loop waiting for the child process. * Packaging fixes for sudo.pp to better handle patchlevels. Major changes between version 1.7.4 and 1.7.4p1: * Fix a bug introduced in sudo 1.7.3 that prevented the -k and -K options from functioning when the tty_tickets sudoers option was enabled. * Sudo no longer prints a warning when the -k or -K options are specified and the ticket file does not exist. * Changes to the configure script to enable cross-compilation of Sudo. Major changes between version 1.7.3 and 1.7.4: * Sudoedit will now preserve the file extension in the name of the temporary file being edited. The extension is used by some editors (such as emacs) to choose the editing mode. * Time stamp files have moved from /var/run/sudo to either /var/db/sudo, /var/lib/sudo or /var/adm/sudo. The directories are checked for existence in that order. This prevents users from receiving the sudo lecture every time the system reboots. Time stamp files older than the boot time are ignored on systems where it is possible to determine this. * Ancillary documentation (README files, LICENSE, etc) is now installed in a sudo documentation directory. * Sudo now recognizes "tls_cacert" as an alias for "tls_cacertfile" in ldap.conf. * Defaults settings that are tied to a user, host or command may now include the negation operator. For example: Defaults:!millert lecture will match any user but millert. * The default PATH environment variable, used when no PATH variable exists, now includes /usr/sbin and /sbin. * Sudo now uses polypkg for cross-platform packing. * On Linux, sudo will now restore the nproc resource limit before executing a command, unless the limit appears to have been modified by pam_limits. This avoids a problem with bash scripts that open more than 32 descriptors on SuSE Linux, where sysconf(_SC_CHILD_MAX) will return -1 when RLIMIT_NPROC is set to RLIMIT_UNLIMITED (-1). * Visudo will now treat an unrecognized Defaults entry as a parse error (sudo will warn but still run). * The HOME and MAIL environment variables are now reset based on the target user's password database entry when the env_reset sudoers option is enabled (which is the case in the default configuration). Users wishing to preserve the original values should use a sudoers entry like: Defaults env_keep += HOME to preserve the old value of HOME and Defaults env_keep += MAIL to preserve the old value of MAIL. * The tty_tickets option is now on by default. * Fixed a problem in the restoration of the AIX authdb registry setting. * If PAM is in use, wait until the process has finished before closing the PAM session. * Fixed "sudo -i -u user" where user has no shell listed in the password database. * When logging I/O, sudo now handles pty read/write returning ENXIO, as seen on FreeBSD when the login session has been killed. * Sudo now performs I/O logging in the C locale. This avoids locale-related issues when parsing floating point numbers in the timing file. * Added support for Ubuntu-style admin flag dot files. Major changes between version 1.7.2p8 and 1.7.3: * Support for logging a command's input and output as well as the ability to replay sessions. For more information, see the documentation for the log_input and log_output Defaults options in the sudoers manual. Also see the sudoreplay manual for information on replaying I/O log sessions. * The use_pty sudoers option can be used to force a command to be run in a pseudo-pty, even when I/O logging is not enabled. * On some systems, sudo can now detect when a user has logged out and back in again when tty-based time stamps are in use. Supported systems include Solaris systems with the devices file system, Mac OS X, and Linux systems with the devpts filesystem (pseudo-ttys only). * On AIX systems, the registry setting in /etc/security/user is now taken into account when looking up users and groups. Sudo now applies the correct the user and group ids when running a command as a user whose account details come from a different source (e.g. LDAP or DCE vs. local files). * Support for multiple sudoers_base and uri entries in ldap.conf. When multiple entries are listed, sudo will try each one in the order in which they are specified. * Sudo's SELinux support should now function correctly when running commands as a non-root user and when one of stdin, stdout or stderr is not a terminal. * Sudo will now use the Linux audit system with configure with the --with-linux-audit flag. * Sudo now uses mbr_check_membership() on systems that support it to determine group membership. Currently, only Darwin (Mac OS X) supports this. * When the tty_tickets sudoers option is enabled but there is no terminal device, sudo will no longer use or create a tty-based ticket file. Previously, sudo would use a tty name of "unknown". As a consequence, if a user has no terminal device, sudo will now always prompt for a password. * The passwd_timeout and timestamp_timeout options may now be specified as floating point numbers for more granular timeout values. * Negating the fqdn option in sudoers now works correctly when sudo is configured with the --with-fqdn option. In previous versions of sudo the fqdn was set before sudoers was parsed.
2010-09-10Add --certstore-internal to fix packaging on some Linuces.wiz1-1/+2
From Aleksey Cheusov in PR 43849.
2010-09-10* Add LICENSE.taca3-4/+82
* Remove RUBY_HAS_ARCHLIB. * Chante PKG_DESTDIR_SUPPORT to user-destdir. * Add patch to support both ruby18 and ruby19.
2010-09-10* Use lang/ruby/gem.mk instead of misc/rubygems/rubygem.mk.taca2-10/+4
* Remove default value of GEM_BUILD.
2010-09-10* Add LICENSE.taca1-2/+3
* Update dependency according to gemspec.
2010-09-10* Use lang/ruby/gem.mk instead of misc/rubygems/rubygem.mk.taca2-10/+4
* Remove default value of GEM_BUILD.
2010-09-10* Use lang/ruby/gem.mk instead of misc/rubygems/rubygem.mk.taca3-14/+16
* Update HOMEPAGE. * Remove default value of GEM_BUILD. === 2.0.23 / 03 Jun 2010 * delay CHANNEL_EOF packet until output buffer is empty [Rich Lane] Previously, calling #eof! after #send_data would result in the CHANNEL_EOF packet being sent immediately, ahead of the data in the output buffer. Now buffer becomes empty. === 2.0.22 / 20 Apr 2010 * Fix for: "Parsing the config errors out because it coerces the "1" into an integer and then tries to split it on spaces for multiple host checking." (http://net-ssh.lighthouseapp.com/projects/36253/tickets/10) [Lee Marlow] === 2.0.21 / 20 Mar 2010 * Fix for "IdentifyFile" in ~/.ssh/config does not work if no "Host" statement is given (http://net-ssh.lighthouseapp.com/projects/36253/tickets/9-identifyfile-in-sshconfig-does-not-work-if-no-host-statement-is-given#ticket-9-5) [xbaldauf, Delano Mandelbaum] * Fix for client closes a forwarded connection, but the server is reading, net-ssh terminates with IOError socket closed (http://net-ssh.lighthouseapp.com/projects/36253/tickets/7) [Miklós Fazekas] * Fix for client force closes (RST) a forwarded connection, but server is reading, net-ssh terminates with exception [Miklós Fazekas] * Fix for server closes the sending side, the on_eof is not handled. [Miklós Fazekas] * Removed Hanna dependency in Rakefile [Delano Mandelbaum] === 2.0.20 / 10 Feb 2010 * Support "ProxyCommand none" directive [Andy Lo-A-Foe] === 2.0.19 / 16 Jan 2010 * Support plus sign in sshconfig hostname [Jason Weathered] === 2.0.18 / 15 Jan 2010 * Fix related to #recv(1) to #readpartial change in 2.0.16 [Hans de Graaff, Delano Mandelbaum] === 2.0.17 / 14 Dec 2009 * Don't load net/ssh/authentication/pageant on Windows with Ruby 1.9 [Travis Reeder, Delano Mandelbaum]
2010-09-10Update security/ruby-net-sftp to 2.0.5.taca2-10/+7
* Use lang/ruby/gem.mk instead of misc/rubygems/rubygem.mk. * Remove default value of GEM_BUILD. === 2.0.5 / 19 Aug 2010 * Fixed missing StringIO exception in download! [Toby Bryans, Delano Mandelbaum]
2010-09-10Update security/ruby-net-scp to 1.0.3.taca2-13/+7
* Use lang/ruby/gem.mk instead of misc/rubygems/rubygem.mk. * Remove default value of GEM_BUILD. * Ajust new ruby package's framework. === 1.0.3 / 17 Aug 2010 * replace :sanitize_file_name with a call to String#shellescape [Sung Pae] * Added gemspec file and removed echoe dependency [Miron Cuperman, Delano Mandelbaum] * Removed Hanna dependency in Rakefile [Delano Mandelbaum]
2010-09-10Update security/ruby-ezcrypto to 0.7.2.taca4-14/+40
* Use lang/ruby/gem.mk instead of misc/rubygems/rubygem.mk. * Add LICENSE. Changes are unknown.
2010-09-10* Ajust new ruby package's framework.taca1-2/+2
2010-09-09Use bundled M::I to avoid cyclic dependencysno1-2/+2
2010-09-09Updating security/p5-Data-SimplePassword from 0.05nb1 to 0.06sno2-8/+11
pkgsrc changes: - imported and added recommended dependency to Math::Random::MT - moved List::MoreUtils to run dependencies Upstream changes: 0.06 Tue Aug 31 15:37:15 JST 2010 * added a parameter 'provider' passed to Crypt::Random. now you can avoid annoying device lock to set the value for example to 'udevrandom' (means /dev/urandom), 'rand' etc.
2010-09-09Updating security/p5-Authen-SASL from 2.14nb1 to 2.15sno2-9/+7
pkgsrc changes: - add informational dependency to core module Digest::MD5 Upstream changes: Authen-SASL 2.15 -- Wed Jun 2 13:47:41 CDT 2010 * Makes sure that user callbacks are called [Yann Kerherve] Authen-SASL 2.1401 -- Mon Mar 29 14:22:54 CDT 2010 * Add META.yml to release
2010-09-09Updating security/p5-Net-OpenSSH from 0.48nb1 to 0.49sno2-7/+6
Upstream changes: 0.49 Aug 7, 2010 - do not kill master from forked processes (bug report by scotchie at PerlMonks) - some typos corrected
2010-09-08Updating security/p5-Module-Signature from 0.64nb1 to 0.66sno3-33/+38
pkgsrc changes: - switch from gnupg-1 (more or less depreciated) to Crypt::OpenPGP and a bunch of used encoders and digest modules - use Module::Install::Bundled module type - remove patch - works fine with current infrastructure for now Upstream changes: [Changes for 0.66 - Fri, 6 Sep 2010 22:51:37 +0200] * Fix incompatibility with EU::Manifest 1.54 to 1.57 (Paul Howarth) (Closes RT#61124). [Changes for 0.65 - Fri, 3 Sep 2010 21:38:02 +0200] * Skip MYMETA (Alexandr Ciornii)
2010-09-03Add and enable liboauthagc1-1/+2
2010-09-03Import liboauth-0.8.9 into the Packages Collection.agc6-0/+96
This is an updated version of the liboauth package in pkgsrc-wip by Kamel Derouiche, modified by myself not to have nss, doxygen, perl and graphviz pre-requisites. OAuth (Open Authorization) is an open standard that allows users to share their private resources (e.g. photos, videos, contact lists) stored on one site with another site without having to hand out their username and password. OAuth allows users to hand out tokens instead of usernames and passwords to their data hosted by a given service provider. Each token grants access to a specific site (e.g. a video editing site) for specific resources (e.g. just videos from a specific album) and for a defined duration (e.g. the next 2 hours). Thus OAuth allows a user to grant a third party site access to their information stored with another service provider, without sharing their access permissions or the full extent of their data. OAuth is a service that is complementary to but distinct from OpenID. liboauth is a collection of C functions implementing the OAuth Core 1.0 standard API. liboauth provides basic functions to escape and encode parameters according to OAuth specs and offers high-level functions to sign requests or verify signatures. Necessary these days for twitter applications; useful for flickr and many others...
2010-09-02Some fixes at update to 2.0.16.obache5-9/+25
* not using autogen.sh anymore, so remove some tools from USE_TOOLS. * patch-ak does not effect anymore for above reason, add patch-ao for it. this patch is required to avoid conflict with security/gnupg. Bump PKGREVISION.
2010-09-02Update ruby-oauth to 0.4.3.obache2-6/+6
== 0.4.3 2010-09-01 * Fix for em-http proxy (ichverstehe)
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-07 04:12:09 +0000