summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2012-08-05Bump PKGREVISION for change of PostgreSQL default version to 9.1.obache1-2/+2
2012-08-02Avoid conflict between gets() and std::gets().jperkin2-1/+24
Fixes build on at least Solaris.
2012-07-28needs newer dbus to buildreed1-1/+2
2012-07-24update to 3.0.21drochner2-6/+6
changes -DTLS improvements -bugfixes
2012-07-22Update ruby-simple_oauth to 0.1.9.obache2-6/+6
bug fixes.
2012-07-21Remove "WWW: URL" from DESCR. Common in FreeBSD ports, but in pkgsrc thewiz1-1/+0
URL should be as HOMEPAGE in the Makefile.
2012-07-20Add back hashes for HPN, dropped in the last commitfhajny1-1/+4
2012-07-20Changes 7.6.4:adam8-119/+57
Bug fixes
2012-07-18security/zkt: Fix DragonFly regressionmarino1-1/+12
When this package was updated to version 1.1, it stopped building on DragonFly. The main issue is that DragonFly doesn't have bind in its base. NetBSD does, so it zkt finds it there, but otherwise it needs the configuration switch --enable-binutil-path to be used. This was added for DragonFly to point at ${PREFIX}/sbin. zkt requires bind to be installed in order to build. Unlike other packages like python, postgresql, and ruby where the mk.conf can define a version otherwise a default is used, no such mechanism exists to hand the four separate bind packages (at least I don't know about one). So the inclusion of bind99 is a hack I'm not too proud of, but I don't have a better solution. With it, it builds in clean environments like pbulk chroot and Tinderbox. If an individual user is building from source, they'll be smart enough to comment out this include if another version of bind is already installed (zkt will fail on a bind build conflict). I suspect DragonFly is rather unique in not having bind in base, so for now this is left as a DragonFly-specific section. Something like net/bind99/builtin.mk could possibly be used to determine if no builtin bind is available and thus follow DragonFly approach. I shall leave it to others to decide.
2012-07-18security/openvas-libraries: Fix regression due to upgrade to gnutils 3.0marino3-3/+24
GNUTLS deprecated gnutils_transport_set_lowat function in version 2.12.0 and finally removed it with version 3.0, breaking any packages that still reference it. The lowat feature is now disabled permanently I think. The patch uses the GNUTLS_VERSION_NUMBER macro to appropriately conceal the function reference. The same patch is widely seen on the 'net with other packages that use gnutls like OpenVAS.
2012-07-18Fix install on at least Solaris.jperkin1-1/+5
2012-07-17Take maintainership. FUKAUMI Naoki didn't object.cheusov1-2/+2
2012-07-17starttls.{el,elc} files are not provided by the package anymore. The problemcheusov2-6/+6
is starttls's implementation is incompatible with emacs 22, 23 and probably 24 too, as a result sending emails with ssl/tls authorization fail due to this conflict. emacs-21 has its own starttls.el too and I believe it is also sufficient. I wonder if someone still uses emacs-20 and its smtpmail.el for sending emails. This change was tested on NetBSD-6 and emacs-{22,23}. starttls package now DEPENDS on emacs-[0-9]*, that is any emacs flavour is good enough Set LICENSE to gnu-gpl-v2 ++pkgrevision
2012-07-17security/libgpg-error: Disable NLS on i386-DragonFlymarino2-13/+23
It seems that I386 DragonFly (x86_64 is okay), invoking libintl's bindtextdomain causes pkgsrc's libintl to segfault on a thread locking operation. Anything linking with libgpg-error on i386 will consequently core dump. Recognizing this treating the symptom, this patch disabled NLS on I386 DragonFly.
2012-07-16MASTER_SITES cosmetic changeadam1-2/+2
2012-07-16Changes 1.10.2:adam17-170/+131
This is a bugfix release. * Fix an interop issue with Windows Server 2008 R2 Read-Only Domain Controllers. * Update a workaround for a glibc bug that would cause DNS PTR queries to occur even when rdns = false. * Fix a kadmind denial of service issue (null pointer dereference), which could only be triggered by an administrator with the "create" privilege. [CVE-2012-1013] Changes 1.10.1: This is a bugfix release. * Fix access controls for KDB string attributes [CVE-2012-1012] * Make the ASN.1 encoding of key version numbers interoperate with Windows Read-Only Domain Controllers * Avoid generating spurious password expiry warnings in cases where the KDC sends an account expiry time without a password expiry time.
2012-07-15Fix a segfault of starttls(1) when run without argumentscheusov3-3/+19
Add LICENSE ++pkgrevision
2012-07-15Recursive bump for startup-notification* dependency change, requestedwiz1-2/+2
by Obache.
2012-07-14Update to 0.4.6, from Jaap Boender.wiz6-24/+27
0.4.6 (2011-10-16) ===== * Added write_certificate function. * Remove support for SSLv2, which was dropped upstream (thanks Dario Teixeira). * Added support for compiling under Win32 (thanks David Allsopp), see README.win32. * Check for pthreads in configure. 0.4.5 (2011-03-01) ===== * Use pthread mutexes for locking thread-safe version of ssl. 0.4.4 (2010-01-06) ===== * Use SSL_CTX_use_certificate_chain_file instead of SSL_CTX_use_certificate_file. * Added support for --enable-debugging configure option. * Don't link with unix library and don't build in custom mode. 0.4.3 (2008-12-18) ===== * Don't use blocking sections in finalizers since it causes segfaults (thanks Grégoire Henry and Stéphane Glondu).
2012-07-09update required version to 2.4, the new gnutls needs it.chs1-2/+2
2012-07-08Add missing zlib buildlink.sbd1-1/+3
Bump PKGREVISION.
2012-07-06Updating package for Perl 5 module Digest::MD5 in security/p5-Digest-MD5sno2-7/+6
from 2.51nb1 to 2.52. Upstream changes: 2012-06-08 Gisle Aas <gisle@ActiveState.com> Gisle Aas (3): Wrong version number in the changelog The t/threads.t was missing from the MANIFEST Update expected digests for files Andrew Fresh (1): Remove double the Lyle Hopkins (1): Digest::Perl::MD5 OO fallback didn't work [RT#66634] Peter J. Acklam (1): Fix typos (spelling errors) in cpan/Digest-MD5/* Shlomi Fish (1): Modernize the code in the POD. Zefram (1): Makes Digest::MD5 work on Perl 5.6 [RT#75032]
2012-07-06Updating package for Perl 5 module IO::Socket::SSL insno2-6/+6
security/p5-IO-Socket-SSL from 1.74 to 1.76. Upstream changes: v1.76 2012.06.18 - no longer depend on Socket.pm 1.95 for inet_pton, but use Socket6.pm if no current Socket.pm is available. Thanks to paul[AT]city-fan[DOT]org for pointing out the problem and providing first patch v1.75 2012.06.15 - made it possible to explicitly disable TLSv11 and TLSv12 in SSL_version
2012-07-05revbump for libpreluse requirement bumpdrochner2-4/+4
2012-07-05revursive revbump for gnutls updatedrochner7-14/+14
2012-07-05more PKGREV bumps for gnutls updatedrochner5-9/+10
2012-07-05make this build with gnutls-3, bump PKGREVdrochner4-3/+33
2012-07-04update to 3.4.1drochner3-11/+26
This switches to the gnome-3.4 branch (Seems to be source and binary compatible to the 2.32 one, no need to keep the old version.)
2012-07-03patch away special paths for MacOS X since they are not supported by pkgsrc.schwarz2-1/+28
Treat MacOS X just like any other UNIX system.
2012-07-03added LICENSE informationschwarz1-1/+2
2012-07-02update to 3.0,20drochner10-182/+161
This switches to the new stable release branch.
2012-07-02update to 2.0.3drochner2-6/+6
changes: -fix for pipe servers -build system improvements
2012-07-02update to 1.12.20drochner2-6/+6
changes: bugfixes: -Fixed memory leak in PKCS #8 key import -Check key identifiers when checking for an issuer pkgsrc note: This is just a last checkpoint on the 2.x branch, in case it will be needed for the Q2 branch. Will update to 3.x RSN.
2012-07-02Revbump after updating boostadam1-1/+2
2012-07-02Changes 0.97.5:adam3-14/+8
* libclamav: Scan output at end of truncated tar * libclamav: Fix handling of tar file with malformed header * libclamav: Scan chm with invalid handling * freshclam: give custom dbs higher priority during update * libclamav: detect read races and abort the scan with an error * libclamav/pe.c: drop old header check
2012-07-01Update security/py-ssh to 1.7.14gls2-6/+6
Upstream changes: ----------------- ## ssh 1.7.14 (2012-05-07) * #15: Implemented parameter substitution in SSHConfig, matching the implementation of `ssh_config(5)`. Thanks to Olle Lundberg for the patch. * #24: Switch some internal type checking to use `isinstance` to help prevent problems with client libraries using subclasses of builtin types. Thanks to Alex Morega for the patch. * [Fabric #562](https://github.com/fabric/fabric/issues/562): Agent forwarding would error out (with `Authentication response too long`) or freeze, when more than one remote connection to the local agent was active at the same time. This has been fixed. Thanks to Steven McDonald for assisting in troubleshooting/patching, and to GitHub user `@lynxis` for providing the final version of the patch.
2012-07-01Add desktopdb.mk and bump PKGREVISION for 118 packages as reported bydholland1-2/+3
pkglint. If any of these are wrong for some reason, please revert/adjust.
2012-06-30Mask this on apache24 as it doesn't compile.dholland1-1/+4
2012-06-29Update F-PROT Antivirus packages to 6.2.1.taca4-14/+14
=== F-PROT Antivirus for Unix, version 6.2.1 Compatibility for older Linux distros improved (glibc 2.3 for 32 bit version and glibc 2.4 for 64 bit version) Compatibility for older Solaris/SunOS version improved (both 32 and 64 bit versions are compatible with solaris 8 now) 64 bit FreeBSD now supported === F-PROT Antivirus for Unix, version 6.2.0 Scan engine upgraded from 4.6.2 to 4.6.5 with improved detection rates and fewer false positives. Multiple issues with the mail scanners have been fixed. === F-PROT Antivirus for Unix, version 6.1.1 fpupdate fix to prevent crash on certain 64 bit Linux systems.
2012-06-24Add missing INSTALLATION_DIRS.jperkin1-2/+2
2012-06-23Honor pkgsrc LIBS.dholland3-2/+17
2012-06-21OpenDNSSEC 1.3.9pettai2-7/+6
* OPENDNSSEC-277: Enforcer: Performance optimisation of database access. Bugfixes: * SUPPORT-27: ods-ksmutil: simplify zone delete so that it only marks keys as dead (rather than actually removing them). Leave the key removal to purge jobs. (Ok'ed by wiz@)
2012-06-16Not MAKE_JOBS_SAFE.dholland1-1/+3
2012-06-16Add patch I've been carrying around to fix the MAKE_JOBS build.dholland2-1/+17
2012-06-16zkt 1.1 -- 30. Jan 2012pettai3-20/+9
* misc Release numbering changed to three level "major.minor.revison" scheme * bug REMOVE_HOLD_TIME was set to 10 days only (Thanks to Chris Thompson) * doc Improved README file (Thanks to Jan-Piet Mens) * misc Fix of some typos in log messages * bug Fixed error in rollover.c (return code of genfirstkey() wasn't checked) * misc Default of KeySetDir changed from NULL to ".." (best for hierarchical mode) Default Sig Lifetime changed from 10 days to 3 weeks (21 days) Default ZSK lifetime changed from 3 months to 4 times the sig lifetime Default KSK lifetime changed from 1 year to 2 years Parameter checks in checkconfig() adapted. KSK random device changed back from /dev/urandom to BIND default (Be aware of some possibly long delay in key generation) * func New configure option to set the bind utility path manually (--enable-bindutil_path) BIND_UTIL_PATH in config_zkt.h will no longer used * bug If nsec3 is turned on and KeyAlgo (or AddKeyAlgo) is RSHASHA1 or DSA, genkey() uses algorithm type NSECRSASHA1 or NSEC3DSA instead. * bug Error in printconfigdiff() fixed. (Thanks to Holger Wirtz) * func Description added to (some of the) dnssec.conf parameters * func Adding a patch from Hrant Dadivanyan to always pre-publish ZSKs * misc Config file syntax changed to parameter names without underscores. zkt-conf uses ZKT_VERSION string as config version * bug "make install-man" now installs all man page * bug Bug fixed in zfparse.c. zkt-conf was unable to detect an already included dnskey.db file if another file was included. * misc destination dnssec-zkt removed from Makefile.in * func dki_prt_managedkeys() added to dki.c zkt_list_managedkeys() added to zkt.c zkt-ls has new option -M to print out a list of managed-keys * bug Bug fixed in the config parser (zconf.c). Couldn't parse agorithm RSASHA512 correctly (Thanks to Michael Sinatra)
2012-06-16Remove 52 from PHP_VERSIONS_ACCEPTED.dholland1-2/+2
2012-06-16pam-krb5 4.6pettai2-6/+6
* Add an anon_fast option that attempts anonymous authentication (generally implemented via anonymous PKINIT inside the Kerberos library) and then, if successful, uses those credentials for FAST armor. If fast_ccache and anon_fast are both specified, anonymous authentication will be used as a fallback if the specified FAST ticket cache doesn't exist. Based on patches from Yair Yarom. * Add a user_realm option to only set the realm for unqualified user principals. This differs from the existing realm option in that realm also changes the default realm for authorization decisions and for verification of credentials. Update the realm option documentation to clarify the differences and remove incorrect information. Patch from Roland C. Dowdeswell. * Add a no_prompt option to suppress the PAM module's prompt for the user's password and defer all prompting to the Kerberos library. This allows the Kerberos library to have complete control of the prompting process, which may be desireable if authentication mechanisms other than password are in use. Be aware that, with this option set, the PAM module has no control over the contents of the prompt and cannot store the user's password in the PAM data. Based on a patch by Yair Yarom. * Add a silent option to force the module to behave as if the application had passed in PAM_SILENT and suppress text messages and errors from the Kerberos library. Patch from Yair Yarom. * Add preliminary support for Kerberos trace logging via a trace option that enables trace logging if supported by the underlying Kerberos library. The option takes as an argument the file name to which to log trace output. This option does not yet work with any released version of Kerberos, but may work with the next release of MIT Kerberos. * MIT Kerberos does not add a colon and space to its password prompts, but Heimdal does. pam-krb5 previously unconditionally added a colon and space, resulting in doubled colons with Heimdal. Work around this inconsistency by not adding the colon and space if already present. * Fix alt_auth_map support to preserve the realm of the authentication identity when forming the alternate authentication principal, matching the documentation. * Document that the alt_auth_map format may contain a realm to force all mapped principals to be in that realm. In that case, don't add the realm of the authentication identity. Note that this can be used as a simple way to attempt authentication in an alternate realm first and then fall back to the local realm, although any complex attempt at authentication in multiple realms should instead run the module multiple times with different realm settings. * Avoid a NULL pointer dereference if krb5_init_context fails. * Fix initialization of time values in the module configuration on platforms (like S/390X) where krb5_deltat is not equivalent to long. * Close a memory leak when search_k5login is set but the user has no .k5login file. * Close several memory leaks in alt_auth_map support. * Suppress bogus error messages about unknown option for the realm option. The option was being parsed and honored despite the error. * Retry authentication under try_first_pass on several other errors in addition to decrypt integrity check errors to handle a wider array of possible "password incorrect" error messages from the KDC. * Update to rra-c-util 4.4: * Update to C TAP Harness 1.12:
2012-06-16Add pam.bl3.mk.pettai1-1/+3
2012-06-16+gnome-keyring-sharpdholland1-1/+2
2012-06-16Import gnome-keyring-sharp from wip (with only a couple trivial adjustments)dholland6-0/+76
so f-spot can use it.
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-16 13:07:30 +0000