summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2011-09-12fix configure check for libcurl, from John Marshall on the gnupg-develdrochner3-2/+17
mailing list bump PKGREV
2011-09-12update to 2.12.10drochner2-6/+6
changes: bugfixes
2011-09-08Update to 2.4:wiz4-47/+12
NEWS for the 2.4 release This is a bugfix release only. It turned out ripemd160 in the 2.3 release was broken on all big-endian systems, due to a missing include of config.h. nettle-2.4 fixes this. The library is intended to be binary compatible with nettle-2.2 and nettle-2.3. The shared library names are libnettle.so.4.3 and libhogweed.so.2.1, with sonames still libnettle.so.4 and libhogweed.so.2. NEWS for the 2.3 release * Support for the ripemd-160 hash function. * Generates and installs nettle.pc and hogweed.pc files, for use with pkg-config. Feedback appreciated. For projects using autoconf, the traditional non-pkg-config ways of detecting libraries, and setting LIBS and LDFLAGS, is still recommended. * Fixed a bug which made the testsuite fail in the GCM test on certain platforms. Should not affect any documented features of the library. * Reorganization of the code for the various Merkle-Damg hash functions. Some fields in the context structs for md4, md5 and sha1 have been renamed, for consistency. Applications should not peek inside these structs, and the ABI is unchanged. * In the manual, fixed mis-placed const in certain function prototypes. The library is intended to be binary compatible with nettle-2.2. The shared library names are libnettle.so.4.2 and libhogweed.so.2.1, with sonames still libnettle.so.4 and libhogweed.so.2.
2011-09-08mozilla has switched to a scheme of explicitly distrusting certificatesdrochner3-12/+21
in its stable branch (ie firefox-6.0.2) too, so deal with this in the mozilla-rootcerts script (this is not great - it depends on syntactic details of the file where it should better use checksums, but the perl script which is distributed with "curl" works the same way), and switch back to the certificate list in CVS HEAD
2011-09-08Missing commit for new patchesjoerg1-1/+3
2011-09-08Do not use nested functions. Add missing prototypes. Bump revision.joerg3-2/+57
2011-09-08Strictler template usage. Bump revision.joerg3-3/+109
2011-09-05Pass --tag=CC to libtool. This fixes build failurecheusov2-5/+5
2011-09-04simplify MASTER_SITES.obache1-2/+2
2011-09-04Update p5-IO-Socket-SSL to 1.44.hiramatsu2-7/+6
Changes from 1.35: v1.44 2011.05.27 - fix invalid call to inet_pton in verify_hostname_of_cert when identity should be verified as ipv6 address, because it contains colon. v1.43_1 2011.05.12 - try to make t/nonblock.t more stable, especially on Mac OS X v1.43 2011.05.11 - fix t/nonblock.t - stability improvements t/inet6.t v1.42 2011.05.10 - add SSL_create_ctx_callback to have a way to adjust context on creation. https://rt.cpan.org/Ticket/Display.html?id=67799 - describe problem of fake memory leak because of big session cache and how to fix it, see https://rt.cpan.org/Ticket/Display.html?id=68073 v1.41 2011.05.09 - fix issue in stop_SSL where it did not issue a shutdown of the SSL connection if it first received the shutdown from the other side. Thanks to fencingleo[AT]gmail[DOT]com for reporting - try to make t/nonblock.t more reliable, at least report the real cause of ssl connection errors v1.40 2011.05.02 - integrated patch from GAAS to get IDN support from URI. https://rt.cpan.org/Ticket/Display.html?id=67676 v1.39_1 2011.05.02 - fix in exampel/async_https_server. Thanks to DetlefPilzecker[AT]web[DOT]de for reporting v1.39 2011.03.03 - fixed documentation of http verification: wildcards in cn is allowed v1.38_1 2011.01.24 - close should undef _SSL_fileno, because the fileno is no longer valid (SSL connection and socket are closed) v1.38 2011.01.18 - fixed wildcards_in_cn setting for http (wrongly set in 1.34 to 1 instead of anywhere). Thanks to dagolden[AT]cpan[DOT]org for reporting https://rt.cpan.org/Ticket/Display.html?id=64864 v1.37 2010.12.09 - don't complain about invalid certificate locations if user explicitly set SSL_ca_path and SSL_ca_file to undef. Assume that user knows what he is doing and will work around the problems by itself. http://rt.cpan.org/Ticket/Display.html?id=63741 v1.36 2010.12.08 - update documentation for SSL_verify_callback based on https://rt.cpan.org/Ticket/Display.html?id=63743 https://rt.cpan.org/Ticket/Display.html?id=63740
2011-09-04Add p5-Mozilla-CA.hiramatsu1-1/+2
2011-09-04Import perl module Mozilla::CA as security/p5-Mozilla-CA.hiramatsu3-0/+29
Mozilla::CA provides a copy of Mozilla's bundle of Certificate Authority certificates in a form that can be consumed by modules and libraries based on OpenSSL.
2011-09-01PR/38394 -- disable KAFS detection for mit-krb5shattered1-1/+4
2011-08-31update to the version distributed with firefox-6.0.1, in responsedrochner2-6/+11
to the recent discovery of false certificates from diginotar (Recent versions from the source repository don't work, see the comment in Makefile.)
2011-08-31Remove stunnel/ component from SYSCONFDIR path. /stunnel/ is alreadyjym2-4/+4
set in PKG_SYSCONFDIR variable, so it is passed down to Makefile. Configuration final path ends up being etc/stunnel/stunnel/stunnel.conf, which is wrong.
2011-08-25Fix linking error under Mac OS X caused by duplicate definition oftron2-1/+41
a bunch of global variables.
2011-08-25Update ruby-net-ssh to 2.2.1.taca2-6/+6
=== 2.2.1 / 24 Aug 2011 * Do not prompt any passphrases before trying all identities from agent. [musybite] (see: http://net-ssh.lighthouseapp.com/projects/36253-net-ssh/tickets/30)
2011-08-25Update ruby-bcrypt to 3.0.0.taca3-12/+16
3.0.0 Aug 24, 2011 - Bcrypt C implementation replaced with a public domain implementation. - License changed to MIT
2011-08-25Reset maintainer.tron1-2/+2
2011-08-24Update "stunnel" package to version 4.42. Changes since version 4.39:tron4-20/+24
- New features - New verify level 0 to request and ignore peer certificate. This feature is useful with the new Windows GUI menu to save cached peer certificate chains, as SSL client certificates are not sent by default. - Manual page has been updated. - Removed support for changing Windows Service name with "service" option. - Hardcoded 2048-bit DH parameters are used as a fallback if DH parameters are not provided in stunnel.pem. - Default "ciphers" value updated to prefer ECDH: "ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH". - Default ECDH curve updated to "prime256v1". - Removed support for temporary RSA keys (used in obsolete export ciphers). - Bugfixes - The -quiet commandline option was applied to *all* message boxes. - Silent install (/S option) no longer attempts to create stunnel.pem.
2011-08-23Recursive bump from gdbm shlib bump.obache3-6/+6
2011-08-22Update to 2.12.9:wiz3-12/+12
* Version 2.12.9 (released 2011-08-21) ** libgnutls-extra: Replaced enumeration with unsigned int, in openssl.h to make it identical to the 3.0.0 version. This shouldn't introduce binary incompatibility. ** libgnutls: When asking for a PIN multiple times, the flags in the callback were not being updated to reflect for PIN low count or final try. ** API and ABI modifications: GNUTLS_PKCS11_PIN_WRONG: New flag for PIN callback
2011-08-22Update to 2.2. Update LICENSE (see below).wiz6-35/+42
NEWS for the 2.2 release Licensing change: * Relicensed as LGPL v2.1 or later (user's option). * Replaced blowfish and serpent implementation. New code is based on the LGPLed code in libgcrypt. New features: * Support for Galois/Counter Mode (GCM). * New interface for enumerating (most) available algorithms, contributed by Daniel Kahn Gillmor. * New tool nettle-hash. Can generate hash digests using any supported hash function, with output compatible with md5sum and friends from GNU coreutils. Checking (like md5sum -c) not yet implemented. Bug fixes: * The old serpent code had a byte order bug (introduced by yours truly about ten years ago). New serpent implementation does not interoperate with earlier versions of nettle. * Fixed ABI-dependent libdir default for Linux-based systems which do not follow the Linux File Hierarchy Standard, e.g., Debian GNU/Linux. Optimizations: * x86_64 implemention of serpent. * x86_64 implemention of camellia. * Optimized memxor using word rather than byte operations. Both generic C and x86_64 assembler. * Eliminated a memcpy for in-place CBC decrypt. Miscellaneous: * In command line tools, no longer support -? for requesting help, since using it without shell quoting is a dangerous habit. Use long option --help instead. The shared library names are libnettle.so.4.1 and libhogweed.so.2.1, with sonames libnettle.so.4 and libhogweed.so.2.
2011-08-19* fixes DEPENDS setting (missing `+').obache4-154/+25
* use perl5/module.mk and its stuff for perl module build * using packlist, so PLIST entries for perl modules are not required. * PKG_SYSCONFSUBDIR is handled automatically, no need to be in PLIST. * fix substitute handling with USE_DESTDIR=yes. Bump PKGREVISION.
2011-08-18Update sudo pacakge to 1.7.7. It is maintenance release.taca2-7/+7
What's new in Sudo 1.7.7 * I/O logging is now supported for commands run in background mode (using sudo's -b flag). * Group ownership of the sudoers file is now only enforced when the file mode on sudoers allows group readability or writability. * Visudo now checks the contents of an alias and warns about cycles when the alias is expanded. * If the user specifes a group via sudo's -g option that matches the target user's group in the password database, it is now allowed even if no groups are present in the Runas_Spec. * "sudo -i command" now works correctly with the bash version 2.0 and higher. Previously, the .bash_profile would not be sourced prior to running the command unless bash was built with NON_INTERACTIVE_LOGIN_SHELLS defined. * Multi-factor authentication is now supported on AIX. * Added support for non-RFC 4517 compliant LDAP servers that require that seconds be present in a timestamp, such as Tivoli Directory Server. * If the group vector is to be preserved, the PATH search for the command is now done with the user's original group vector. * For LDAP-based sudoers, the "runas_default" sudoOption now works properly in a sudoRole that contains a sudoCommand. * Spaces in command line arguments for "sudo -s" and "sudo -i" are now escaped with a backslash when checking the sudoers file.
2011-08-18Update ruby-net-ssh pacakge to 2.2.0.taca2-6/+6
=== 2.2.0 / 16 Aug 2011 * Add support for forward a local UNIX domain socket to a remote TCP socket. [Mark Imbriaco]
2011-08-18I forgot to update distinfo about latest patch file additiontaca2-3/+4
(patch-atomicio.c). Noted by wiz@ via private mail. Bump PKGREVISION.
2011-08-16+ p5-Digest-Perl-MD5.wiz1-1/+2
2011-08-16Initial import of p5-Digest-Perl-MD5-1.8:wiz3-0/+26
Perl implementation of Ron Rivests MD5 Algorithm.
2011-08-14Do not unwrap gpgme-config; it broke the script because the unwrappingwiz1-1/+3
stage removed a -I/usr/include|-I/include) line from a case statement. Bump PKGREVISION.
2011-08-14Insists on libassuan2-2.0.2, so make it depend on that version.wiz1-1/+2
2011-08-14Revision bump after updating perl5 to 5.14.1.obache56-105/+112
2011-08-11Changes 1.3.1:adam8-61/+35
* Ported to Windows CE. * Detect GPG versions not supporting ---passwd.
2011-08-11Changes 2.12.8:adam4-22/+21
* libgnutls: PKCS-11 back-end was replaced by p11-kit * libgnutls: gcrypt: replaced occurences of gcry_sexp_nth_mpi (..., 0) with gcry_sexp_nth_mpi (..., GCRYMPI_FMT_USG) to fix errors with 1.5.0. * libgnutls: Verify that a certificate liste specified using gnutls_certificate_set_x509_key*(), is sorted according to TLS specification * libgnutls: Added GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED flag for gnutls_x509_crt_list_import. It checks whether the list to be imported is properly sorted. * libgnutls: writev_emu: stop on the first incomplete write. * libgnutls: Fix zlib handling in gnutls.pc. * certtool: bug fixes in certificate request generation. * API and ABI modifications: GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED: New element in gnutls_certificate_import_flags
2011-08-11Changes 2.0.18:adam2-7/+6
* Bug fix for newer versions of Libgcrypt. * Support the SSH confirm flag and show SSH fingerprints in ssh related pinentries. * Improved dirmngr/gpgsm interaction for OCSP. * Allow generation of card keys up to 4096 bit.
2011-08-11Changes 2.0.2:adam2-7/+6
* A new flag may now be used to convey comments via assuan_transact. * A new flag value may now be used to disable logging. * The gpgcedev.c driver now provides a log device. * It is now possible to overwrite socket and connect functions in struct assuan_system_hooks.
2011-08-10Add a patch to avoid SSP side effect as NetBSD current.taca2-2/+22
Bump PKGREVISION.
2011-08-10fix the last change of DEPENDS pattern for p5-Digest-SHA.obache1-2/+2
PR#45228.
2011-08-09As noted in Changes 1.03, depend on p5-Digest-SHA instead of p5-Digest-SHA1.obache1-2/+2
2011-08-09Changes 0.02:adam2-17/+16
* Fixed a bug affecting input strings with an odd number of characters. Thanks to Ken T Takusagawa for the report. * Cleaned up Makefile.PL. * Removed magic svn keywords. * Added author tests (xt/) and modified SYNOPSIS for all modules to make them pass the compilation test.
2011-08-09Revision bump after updating perl to 5.14.1adam2-5/+5
2011-08-09Changes 1.03:adam2-18/+16
* Depend on Digest::SHA instead of Digest::SHA1 * Document the blocksize argument
2011-08-09Revision bump after updating perl to 5.14.1adam5-29/+30
2011-08-09Changes 5.62:adam2-16/+13
* removed unnecessary loading of MIME::Base64 module Changes 5.61: * corrected bug in 'algorithm' method * fixed -x option in Makefile.PL -- not often used since it deliberately excludes all 64-bit SHA transforms * addressed minor documentation oversights Changes 5.60: * added new SHA-512/224 and SHA-512/256 transforms -- ref. NIST Draft FIPS 180-4 (February 2011) * simplified shasum by removing duplicative text * improved efficiency of Addfile -- expensive -T test now occurs only in portable mode Changes 5.50: * adopted convention that '-' always means STDIN -- actual filename '-' accessed as './-' -- accords with behavior of sha1sum/md5sum * corrected undefined subroutine oversight in shasum -- inadvertent migration of _bail() from SHA.pm
2011-08-09Revision bump after updating perl to 5.14.1adam2-15/+13
2011-08-02Deal with c99 inline semantics.joerg3-1/+63
2011-08-02Fix prototype.joerg2-1/+15
2011-07-31Adds the symbols _kdc_db_fetch and _kdc_free_ent to globalgls3-2/+21
visibility, so that they can be referenced from kdc/digest-service. Fixes build on Dragonfly. From Alex Hornung in PR pkg/45195.
2011-07-28Changes since 1.6.0:pettai2-7/+9
* [SANTUARIO-268] - TXFMXPathFilter->evaluateExpr crashes on Windows * [SANTUARIO-270] - DSIGObject::load method crashes for ds:Object without Id att ribute * [SANTUARIO-271] - Bug when signing files with big RSA keys * [SANTUARIO-272] - Memory bug inside XENCCipherImpl::deSerialise * [SANTUARIO-274] - Function cleanURIEscapes always throws XSECException, when a ny escape sequence occurs * [SANTUARIO-275] - Function isHexDigit doesn't recognize invalid escape sequenc es. * [SANTUARIO-276] - Percent-encoded multibyte (UTF-8) sequences unrecognized * [SANTUARIO-280] - RSA-OAEP handler only allows SHA-1 digests
2011-07-28Update fixes CVE-2011-2516pettai3-9/+8
(See http://shibboleth.internet2.edu/secadv/secadv_20110706.txt for details)
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-22 09:42:42 +0000