Changelog:
2014-09-26 Herbert Xu <herbert@gondor.apana.org.au>
* Small optimisation of command -pv change.
* Set command -p path to /usr/sbin:/usr/bin:/sbin:/bin.
* Change "characters" for printf precision to "bytes".
* Release 0.5.8.
2014-09-26 Jonathan Nieder <jrnieder@gmail.com>
* Clarify "trap '' signals" syntax in manual page.
2014-09-26 Adam Buchbinder <adam.buchbinder@gmail.com>
* Clarify that 0 and EXIT are both acceptable for exit traps.
2014-09-26 Harald van Dijk <harald@gigawatt.nl>
* command: allow combining -p with -v.
* getjob: Fix off-by-one error for multiple of four job numbers
2013-08-23 Herbert Xu <herbert@gondor.apana.org.au>
* Propagate EXP_QPAT in subevalvar.
* Initialise OPTIND after importing environment.
* Fixed argument parsing crash in test.
2013-03-12 Peter Rosin <peda@lysator.liu.se>
* Add newline when tracing in poplocalvars.
2013-01-10 Jérémie Courrèges-Anglas <jca+dash@wxcvbn.org>
* Markup fixes in manual for mandoc 1.12.1.
2012-12-03 Harald van Dijk <harald@gigawatt.nl>
* Use PRIdMAX instead of %j in printf.
2012-07-20 Kimo Rosenbaum <kimor79@yahoo.com>
* Fix typo for wait in manual.
2012-06-09 Christoph Mathys <eraserix@gmail.com>
* Add support for ulimit -r.
2012-03-11 Jim Meyering <meyering@redhat.com>
* Avoid overflow for very long variable name.
$ perl -le 'print "v"x(2**31+1) ."=1"' | dash
2012-02-25 Herbert Xu <herbert@gondor.apana.org.au>
* Sanitise environment variable names on entry.
2011-08-17 David S. Miller <davem@davemloft.net>
* Allow building without LINEO support.
* Add top-level autogen.sh.
2011-07-26 Harald van Dijk <harald@gigawatt.nl>
* Avoid imaxdiv when only one of the results is wanted.
2010-07-09 maximilian attems <max@stro.at>
* Fix klibc DEBUG compilation.
2011-07-09 Herbert Xu <herbert@gondor.apana.org.au>
* Merge SKIPFUNC/SKIPFILE and only clear SKIPFUNC when leaving dotcmd.
* Include bugfix,
ac26fafa03/
Changelog:
Changes from 5.0.7 to 5.0.8
---------------------------
- Global aliases can be created for syntactic tokens such as command
separators (";", "&", "|", "&&", "||"), redirection operators, etc.
Use at your own risk! The POSIX_ALIASES option is interpreted more
strictly to prevent expansion of these and other alias names containing
quotes, glob metacharacters, parameter references, etc.
- There have been various further improvements to builtin handling
with the POSIX_BUILTINS option (off by default) for compatibility with
the POSIX standard.
- 'whence -v' is now more informative, and 'whence -S' shows you
how a full chain of symbolic links resolves to a command.
- The 'p' parameter flag now allows an argument to be specified
as a reference to a variable, e.g. ${(ps.$sep.)foo} to split $foo
on a string given by $sep.
- The option FORCE_FLOAT now forces variables, not just constants,
to floating point in arithmetic expressions.
- The type of an assignment in arithmetic expressions, e.g. the
type seen by the variable res in $(( res = a = b )), is now
more logical and C-like.
- The default binding of 'u' in vi command mode has changed to undo
multiple changes when invoked repeatedly. '^R' is now bound to redo
changes. To revert to toggling of the last edit use:
bindkey -a u vi-undo-change
- Compatibility with Vim has been improved for vi editing mode. Most
notably, Vim style text objects are supported and the region can be
manipulated with vi commands in the same manner as Vim's visual mode.
- Elements of the watch variable may now be patterns.
- The logic for retrying history locking has been improved.
- Some rationalisations have been made to the zsh/db/gdbm module that
should make it more useful and predictable in operation.
Upstream changes:
R50f is a required security and bugfix release:
[tg] Add a patch marker for vendor patch versioning to mksh.1
[tg] SECURITY: make unset HISTFILE actually work
[tg] Document some more issues with the current history code
[tg] Remove some unused code
[tg] RCSID-only sync with OpenBSD, for bogus and irrelevant changes
[tg] Also disable field splitting for alias 'local=\typeset'
[tg] Fix read -n-1 to not be identical to read -N-1
[tg] Several fixes and improvements to lksh(1) and mksh(1) manpages
[tg] More code (int size_t), comment and testsuite fixes
[tg] Make dot.mkshrc more robust (LP#1441853)
[tg] Fix issues with IFS='\' read, found by edualbus
[enh, tg] Fix integer overflows related to file descriptor parsing, found by Pawel Wylecial (LP#1440685); reduce memory usage for I/O redirs
[tg] Document in the manpage how to set ±U according to the current locale settings via LANG/LC_* parameters (cf. Debian #782225)
[igli, tg] Some code cleanup and restructuring
[tg, oksh] Handle number parsing and storing more carefully
R50e is a required bugfix release:
[tg] Add more tests detailing behaviour difference from GNU bash
[tg] Introduce a memory leak for x=<< fixing use of freed memory instead, bug tracked as LP#1380389 still live
[tg] Add x+=<< parallel to x=<<
[tg, ormaaj, jilles] POSIX "command" loses builtin special-ness
[tg] Fix LP#1381965 and LP#1381993 (more field splitting)
[jilles] Update location of FreeBSD testsuite for test(1)
[Martin Natano] Remove dead NULL elements from Emacs keybindings
[tg, Stéphane Chazelas, Geoff Clare] Change several testcases for $*/$@ expansion with/without quotes to expected-fail, with even more to come ☹
[tg] Fix miscalculating required memory for encoding the double-quoted parts of a here document or here string delimiter, leading to a buffer overflow; discovered by zacts from IRC
[RT] Rename a function conflicting with a MacRelix system header
[tg] Use size_t (and ssize_t) consistently, stop using ptrdiff_t; fixes some arithmetics and S/390 bugs
[tg] Remove old workarounds for Clang 3.2 scan-build
[tg] Remove all Clang/Coverity assertions, making room for new checks
[tg] Fix NSIG generation on Debian sid gcc-snapshot
[tg] Make a testcase not fail in a corner case
[tg] Fix issues detected by GCC’s new sanitisers: data type of a value to be shifted constantly must be unsigned (what not, in C…); shebang check array accesses are always unsigned char
[tg] Be even more explicit wrt. POSIX in the manpage
[tg] Fix shebang / file magic decoding
[tg] More int → bool conversion
[tg] Let Build.sh be run by GNU bash 1.12.1 (Slackware 1.01)
[Stéphane Chazelas, tg] Fix here string parsing issue
[tg] Point out more future changes in the manpage
[tg] Call setgid(2), setegid(2), setuid(2) before seteuid(2)
[tg] Fix spurious empty line after ENOENT “whence -v”, found by Ypnose
[tg] Optimise dot.mkshrc and modernise it a bit
[tg] Use MAXPATHLEN from <sys/param.h> for PATH_MAX fallback
[tg] Some code cleanup and warnings fixes
[tg] Add options -a argv0 and -c to exec
[jsg] Prevent use-after-free when hitting multiple errors unwinding
[tg] Fix use of $* and $@ in scalar context: within [[ … ]] and after case (spotted by Stéphane Chazelas) and in here documents (spotted by tg@); fix here document expansion
[tg] Unbreak when $@ shares double quotes with others
[tg] Fix set -x in PS4 expansion infinite loop
---------------- (from debian/changelog)
posh (0.12.4) unstable; urgency=medium
* Correct misspelling of "--". closes: #774004.
* Patch from Chris Lamb to make the build reproducible.
closes: #777395.
* Patch from John Salmon to use memmove instead of memcpy in
debunk(). closes: #777493.
-- Clint Adams <clint@debian.org> Sun, 26 Apr 2015 14:20:19 -0400
Changelog:
* Written in C++ now.
* Fix security issues
CVE-2014-2914
CVE-2014-2906 and CVE-2014-3856
CVE-2014-2905
CVE-2014-3219
* Many bugfixes.
* Many new features.
See http://fishshell.com/release_notes.html .
autojump is a faster way to navigate your filesystem. It works by
maintaining a database of the directories you use the most from
the command line.
Directories must be visited first before they can be jumped to.
git-sh is a customized bash shell suitable for git work.
The git-sh command starts an interactive bash shell tweaked for
heavy git interaction:
* All git commands available at top-level (checkout master = git
checkout master)
* All git aliases defined in the [alias] section of ~/.gitconfig
available at top-level.
* Shawn O. Pearce's excellent bash completion strapped onto all
core commands and git aliases.
* Custom prompt with current branch, repository, and work tree
dirty indicator.
* Customizable via /etc/gitshrc and ~/.gitshrc config files; for
creating aliases, changing the prompt, etc.
* Runs on top of normal bash (~/.bashrc) and readline (~/.inputrc)
configurations.
already in /bin. Otherwise, building and installing it naively clobbers
the native tcsh, which isn't what anyone wants.
I believe these platforms to be: NetBSD, OpenBSD, Solaris -- if anyone
can confirm that others (especially old ones I can't readily check)
don't have a native tcsh, please add.
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=104260
---------------------------
The MASTER_SITES for shells/mudsh is invalid. The email
address of the submitter of the port is no longer valid.
The app itself is a single perl script with no author in it.
---------------------------
Thanks wiz@ for review.
5.0.7
This is version 5.0.7 of the shell. This is a stable release.
There are minor new features as well as bug fixes since 5.0.6.
Note in particular there is a security fix to disallow evaluation
of the initial values of integer variables imported from the
environment (they are instead treated as literal numbers). That
could allow local privilege escalation, under some specific and
atypical conditions where zsh is being invoked in privilege elevation
contexts when the environment has not been properly sanitized, such
as when zsh is invoked by sudo on systems where "env_reset" has
been disabled.
5.0.6
This is version 5.0.6 of the shell. This is a stable release.
There are minor new features as well as bug fixes since 5.0.5.
R50d is a required bugfix release:
- [Goodbox] Fix NULL pointer dereference on “unset x; nameref x”
- [tg] Fix severe regression in field splitting (LP#1378208)
- [tg] Add a warning about not using tainted user input (including from
the environ(7)ment) in arithmetics, until Stéphane writes it up nicely
R50c is a security fix release:
- [tg] Know more rare signals when generating sys_signame[] replacement
- [tg] OpenBSD sync (mostly RCSID only)
- [tg] Document HISTSIZE limit; found by luigi_345 on IRC
- [zacts] Fix link to Debian .mkshrc
- [tg] Cease exporting $RANDOM (Debian #760857)
- [tg] Fix C99 compatibility
- [tg] Work around klibc bug causing a coredump (Debian #763842)
- [tg] Use issetugid(2) as additional check if we are FPRIVILEGED
- [tg] SECURITY: do not permit += from environment
- [tg] Fix more field splitting bugs reported by Stephane Chazelas and
mikeserv; document current status wrt. ambiguous ones as testcases too
Fixes CVE-2014-6278:
A combination of nested command substitutions and function importing
from the environment can cause bash to execute code appearing in
the environment variable value following the function definition.
