* May 26 2010
Changes in XML Security Library 1.2.16 release:
* New xmlsec-gcrypt library.
* xmlsec-gcrypt: Added RSA with SHA1/SHA256/SHA384/SHA512/MD5/RIPEMD160, DSA
with SHA1, AES/DES KW support.
* xmlsec-gnutls: Added X509 support and converted the library to use xmlsec-
crypt library for all crypto operations.
* xmlsec-mscrypto: RSA/OAEP and AES/DES KW support.
* Several minor bug fixes and code cleanups.
* April 29 2010
Changes in XML Security Library 1.2.15 release:
* xmlsec-mscrypto: Added HMAC with MD5, SHA1, SHA256/384/512; RSA with MD5,
SHA256/384/512 support.
* xmlsec-mscrypto: Converted to Unicode (the non-Unicode builds are still
available as compile time option).
* xmlsec-nss: Added MD5 and SHA256/384/512 support for digest, HMAC and RSA
(the new minimum required version for NSS library is 3.9).
* xmlsec-gnutls: Added SHA256/384/512 for digest and HMAC; MD5 and RIPEMD160
digests support (the new minimum required version for GnuTLS library is
2.8.0).
* Fixed typo: "Copyrigth" should be "Copyright".
* Several critical bug fixes and code cleanups.
* December 5 2009
Changes in XML Security Library 1.2.14 release:
* XMLSec library is switched from built-in LTDL library to the system LTDL
library on Linux/Unix and native calls on Windows to fix security issue
(CVE-2009-3736) in LTDL.
* Fixed minor bugs (see log for complete list).
* Noteworthy changes in release 2.7 (2010-05-20) [stable]
- Doc: Build a PDF manual using GTK-PDC.
- Doc: Fix of asn1_check_version, documentation was missing from last release.
- Build: Avoid warnings about ignored visibility attributes on Windows.
For more detail: http://www.sudo.ws/sudo/alerts/secure_path.html
Summary:
Sudo "secure path" feature works by replacing the PATH environment
variable with a value specified in the sudoers file, or at
compile time if the --with-secure-path configure option is used.
The flaw is that sudo only replaces the first instance of PATH
in the environment. If the program being run through sudo uses
the last instance of PATH in the environment, an attacker may
be able to avoid the "secure path" restrictions.
Sudo versions affected:
Sudo 1.3.1 through 1.6.9p22 and Sudo 1.7.0 through 1.7.2p6.
OpenSSL CHANGES
_______________
Changes between 0.9.8n and 0.9.8o [01 Jun 2010]
*) Correct a typo in the CMS ASN1 module which can result in invalid memory
access or freeing data twice (CVE-2010-0742)
[Steve Henson, Ronald Moesbergen <intercommit@gmail.com>]
*) Add SHA2 algorithms to SSL_library_init(). SHA2 is becoming far more
common in certificates and some applications which only call
SSL_library_init and not OpenSSL_add_all_algorithms() will fail.
[Steve Henson]
*) VMS fixes:
Reduce copying into .apps and .test in makevms.com
Don't try to use blank CA certificate in CA.com
Allow use of C files from original directories in maketests.com
[Steven M. Schweda" <sms@antinode.info>]
+ avoid possible free() of new value passed to netpgp_setvar(),
with thanks to Anon Ymous.
+ netpgpkeys(1): print keys to stdout, not stderr - reported by Anon
Ymous.
+ fix DSA signatures and verification
+ simplify and shorten the internals of packet processing by getting rid of
the intermediate pseudo-abstraction layer, which detracted from understanding
and had no benefit whatsoever. Rename some enums and some definitions.
+ add some checking to new key generation, and don't try to read in
the keys after writing them - reported by Tyler Retzlaff
+ netpgpverify - avoid the separate codebase, and just use libnetpgp(3)
pkgsrc changes:
- patches/patch-aa no longer required
- Added LICENSE
Changelog:
ARC4 & CTR support, IP6 support, and various bug fixes (incl. an important
Windows random number generation fix)
2.2.91 - January 26th 2010
--------------------------
A new Perl binding, fix for backward compatibility with old versions of glib,
LassoLogout API is more robust since it does not need anymore for all SP logout
to finish to work, new macro lasso_list_add_new_xml_node, add support for
WS-Security UsernameToken (equivalent of poor man HTTP Digest Authentication),
make public internal APIs: lasso_session_add_assertion,
lasso_session_get_assertion and lasso_session_remove_assertion.
2.2.90 - January 18th 2010
--------------------------
Lots of internal changes and some external one too.
There is a new api to force, forbid or let Lasso sign messages, it is called
lasso_profile_set_signature_hint.
Big overhaul of the ID-WSF 1 and 2 codes, and of the SAML 2.0 profiles. Now all
SAML 2.0 profile use common internal functions from the lasso_saml20_profile_
namespace to handle bindings (SOAP,Redirect,POST,Artifact,PAOS). New internal
API to load SSL keys from many more formats from the public API.
In ID-WSF 2.0, Data Service Template has been simplified, we no more try to
apply queries, it is the responsability of the using code to handle them.
In bindings land, the file bindings/utils.py has been stuffed with utility
function to manipulate 'type' tuple, with are now used to transfer argument and
type description, their schema is (name, C-type, { dictionary of options } ),
they are now used everywhere in the different bindings. We support output
argument in PHP5, Python and Java, i.e. pointer of pointer arguments with are
written to in order to return multiple values. For language where the binding
convert error codes to exceptions (all of them now), the ouput value is
returned as the normal return value of the method, so only one output argument
is handled for now.
We now use GObject-introspection annotations in the documentation to transfer
to the binding generator the necessary metadata about the API (content of
lists, hashtables, wheter pointer are caller/callee owned, can be NULL or if
argument have a default value). The file bindings/override.xml is now
deprecated.
In documentation land, the main reference documentation was reorganizaed and
more symbols have been added to it. Many more functions are documented.
There is now tools to control the evolution of the ABI/API of Lasso.
Pkgsrc changes:
- placate pkglint
Upstream changes:
[Changes for 0.64 - Sun, 9 May 2010 00:50:11 +0200]
* Avoid creating gnupg configuration files for the user invoking Makefile.PL
(Closes RT#41978).
* Correctly detect the version of gnupg on cygwin and add tests for it
(Paul Fenwick) (Closes RT#39258).
- Addition of a "make clean" target. removal of runtests as it is currently
broken.
- New release process in Makefile and release.sh - keychain release tarball
will now contain pre-generated keychain, keychain.1 and keychain.spec so
that users do not need to run "make". Updated README.rst to refer to the
"source code" as a "release archive" since it contains both source code and
ready-to-go script and man page.
- GPG fix from Gentoo bug 203871; This fix will fix the issue with pinentry
starting in the background and not showing up in the terminal.
* keychain 2.7.0 (23 Oct 2009)
- lockfile() replacement from Parallels Inc. OpenVZ code, takelock() rewrite,
resulting in ~100 line code savings. Default lock timeout set to 5 seconds,
and now keychain will try to forcefully acquire the lock if the timeout
aborts, rather than simply failing and aborting.
- MacOS X/BSD improvements: fix sed call in Makefile for MacOS X and presumably
other *BSD environments. Rename COPYING to COPYING.txt + slight COPYING.txt
formatting change. Fixed POD errors (removed '=end').
- Disable "Identity added" messages when --quiet is specified.
(Gentoo bug #250328)
--help will print output to stdout (Gentoo bug #196060)
output cleanup and colorization changes - moving away from blue and over to
cyan as it displays better terminals with black background.
Also some additional colorization.
* keychain 2.6.9 (26 Jul 2009)
- Close Gentoo bug 222953 fix potential issues with GNU grep, Mac OS X color
fix when called with --eval.
- Perl 5.10 Makefile fix. Transition README to README.rst (reStructuredText).
Updated maintainership information.
Simplified default output
* Respect --disable-64bit
* Respect $DESTDIR for config files
* The binaries can now show the version number
* softhsm-keyconv could not handle --ttl properly
* Link softhsm static with libsofthsm
* Build libsofthsm.so without version number
* libsofthsm.so is now a loadable module
that manages the security of domain names on the Internet.
The project intends to drive adoption of Domain Name System Security Extensions
(DNSSEC) to further enhance Internet security.
Upstream changes:
v1.33 2010.03.17
- attempt to make t/memleak_bad_handshake.t more stable, it fails
for unknown reason on various systems
- fix hostname checking: an IP should only be checked against
subjectAltName GEN_IPADD, never against GEN_DNS or CN.
Thanks to rusch[AT]genua[DOT]de for bug report
* Noteworthy changes in release 2.6 (2010-04-20) [stable]
- Fix build failure on platforms without support for GNU LD version scripts.
- libtasn1: Simplified implementation of asn1_check_version.
- tests: Improved self-checks.
- Update gnulib files, fix many syntax-check nits, indent code,
fix license templates.
Changes since 0.0.8a:
- Decoder can now treat values of unknown types as opaque OctetString.
- Fix to Set/SetOf type decoder to handle uninitialized scalar SetOf
components correctly.
- API versioning mechanics retired (pyasn1.v1 -> pyasn1) what makes
it possible to zip-import pyasn1 sources (used by egg and py2exe).
- Allow any non-zero values in Boolean type BER decoder, as it's in
accordnance with the standard.
Sudo versions 1.7.2p6 and 1.6.9p22 are now available. These releases
fix a privilege escalation bug in the sudoedit functionality.
Summary:
A flaw exists in sudo's -e option (aka sudoedit) in sudo versions
1.6.8 through 1.7.2p5 that may give a user with permission to
run sudoedit the ability to run arbitrary commands. This bug
is related to, but distinct from, CVE 2010-0426.
Sudo versions affected:
1.6.8 through 1.7.2p5 inclusive.
k5start, and krenew are modified versions of kinit which add support
for running as a daemon to maintain a ticket cache, running a
command with credentials from a keytab and maintaining a ticket
cache until that command completes, obtaining AFS tokens (via an
external aklog) after obtaining tickets, and creating an AFS PAG
for a command. They are primarily useful in conjunction with
long-running jobs; for moving ticket handling code out of servers,
cron jobs, or daemons; and to obtain tickets and AFS tokens with
a single command.
- New features
- New service-level "libwrap" option for run-time control whether
/etc/hosts.allow and /etc/hosts.deny are used for access control.
Disabling libwrap significantly increases performance of stunnel.
- Log file reopen on USR1 signal was added.
- Graceful configuration reload with HUP signal on Unix
and with GUI on Windows.
- Bugfixes
- Inetd mode fixed
- Fixed a transfer() loop issue with SSLv2 connections.
- Fixed a "setsockopt IP_TRANSPARENT" warning with "local" option.
- Logging subsystem bugfixes and cleanup.
- Installer bugfixes for Vista and later versions of Windows.
- FIPS mode can be enabled/disabled at runtime.
either netcat or stunnel except that it is Kerberised. You can use
it to construct client/server applications while keeping the Kerberos
libraries out of your programs address space quickly and easily.
Changes between 0.9.8m and 0.9.8n [24 Mar 2010]
*) When rejecting SSL/TLS records due to an incorrect version number, never
update s->server with a new major version number. As of
- OpenSSL 0.9.8m if 'short' is a 16-bit type,
- OpenSSL 0.9.8f if 'short' is longer than 16 bits,
the previous behavior could result in a read attempt at NULL when
receiving specific incorrect SSL/TLS records once record payload
protection is active. (CVE-2010-0740)
[Bodo Moeller, Adam Langley <agl@chromium.org>]
*) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL
could be crashed if the relevant tables were not present (e.g. chrooted).
[Tomas Hoger <thoger@redhat.com>]
Upstream changes:
[Changes for 0.63 - Sun, 28 Mar 2010 04:46:27 +0100]
* Fix diagnostic message from Makefile.PL when the user dosn't have gnupg or
Crypt::OpenPGP (miyagawa).
[Changes for 0.62 - Tue, 23 Mar 2010 22:17:39 +0100]
* Change the default keyserver from the outdated pgp.mit.edu to
pool.sks-keyservers.net.
in src/lib as that is the location it wants to pick it up. Work around
the dependencies in other places by symlinking to that, effectively
reverting the direction. Link telnet(d) consistently. Add DESTDIR support.
pkgsrc changes:
- Adjust dependencies
- Add license definition
Upstream changes:
***0.16 March 12, 2010
Feature: KEY inherits DNSKEY
This helps maintenance in one part of the code.
Feature: keylength methode rt.cpan.org #53468
Added keylength method for RSA and DSA
Acknowledgements Hugo Salgado
Fix: rt.cpan.org #51778
Empty bitmap would cause error about undefined ARRAY in NSEC/NSEC3.
Now the code will allow empty bitmaps gracefully
Feature: New Algorithm Support (rt.cpan.org #51092)
SHA2 algorithm support, including NSEC3 algorithm parameters updated
Acknowledgement Jakob Shlyter
Fix: rt.cpan.org #42089
NSEC3 Algorithm support in NSEC3 broken
patch by Wes Hardaker
pkgsrc changes:
- Adding license definition
- Adjusting dependencies
Upstream changes:
version 0.008; 2010-03-11
* bugfix: avoid memory leak when returning block to Perl space
* check for required Perl version at runtime
* in XS, avoid using "class" as a variable name, for compatibility
with C++ compilers
* in Build.PL, explicitly declare configure-time requirements
* remove bogus "exit 0" from Build.PL
* Fixed bug with reading gzipped aide.db files
* Removed dead ustat code
Version 0.13
* Added support for selinux and xattr attributes
* Added support for the Linux Audit System
* Fixed usage of libgcrypt instead of libmhash
* Added file locking for output files
* Fixed bugs
Version 0.12
* Fixed bugs
* Allow http/https/ftp URLs through libcurl
* Support posix_fadvice() to avoid caching files
Version 0.11
* Fixed many bugs
* Updated automake/autoconf scripts
* Use snprintf by Mark Martinec if not in C library
* Support for more (legacy) Unix systems and cygwin
* Open files with O_NOATIME on supported Linux systems
* Added I/ANF/ARF directives
Changes to 2.99.1/20100313
+ add functionality to parse basic signature subkeys
+ in doing so, add expiration of keys
+ at the same time, add revocation of keys
+ recognise the primary user id, and use it when displaying user ids
+ recognise self signed keys and subkeys
+ rework the indentation of output
+ add the --list-sigs [userid] option to netpgpkeys(1)
+ use memcmp(3) rather than strcmp(3) when checking binary user ids to
be exported
+ add expiration display to subkey signature output
+ update libnetpgp library version major number to 3
The Zone Key Tool consist of two commands:
* dnssec-zkt to create and list dnssec zone keys and
* dnssec-signer to sign a zone and manage the lifetime of the zone signing keys
Both commands are simple wrapper commands around the dnssec-keygen(8) and
dnssec-signzone(8) commands provided by BIND.
PKCS#11 interface. You can use it to explore PKCS#11 without having a
Hardware Security Module. It is being developed as a part of the OpenDNSSEC
project. SoftHSM uses Botan for its cryptographic operations.
While here,
* set LICENSE=gnu-gpl-v2
* marked as user-destdir installation ready
* switch to use system argp
* add missing zlib buildlink
News for the 2.0.4 release
Fixed x11 forwarding bug in the lsh client.
News for the 2.0.3 release
At startup, lshd now tries to close any spurious open file
descriptors. New test case for lshd fd leakage.
lshd --daemonic --no-syslog now sets up a proper daemonic
environment, except that log messages are still sent to
stderr. Improved testing of this feature.
This PAM module support authentication, authorization (account
management) and accounting (session management) performed using
TACACS+ protocol designed by Cisco.
pkgsrc changes:
- Add recommeded minimum version for Crypt::CBC dependency
Upstream changes:
2.12 04 Mar 2010
- updated Changes to mesh with revision.
2.11 Feb 2010
- patched _blowfish.c to stop spurious warnings.
- updated POD
instead of rolling a private _llseek syscall using now-nonexistent type
declarations; (2) as noted in PR 33893 use errno.h instead of "extern int
errno".
Changes to 1.99.20/20100304
+ move args to some functions around to be consistent
+ use uint*_t where appropriate
+ fix bug in verify memory
+ add documentation to manual pages to show how to do combined
signing/encryption and decryption/verification
+ make verification of ascii-armoured memory work the same as binary
+ eliminate use of strdup(3), strcasecmp(3), and strptime(3).
NetBSD/pkgsrc PR 42922 applies - need to define
_XOPEN_SOURCE and _BSD_SOURCE for newer linux platforms with
glibc 2.10.1. solved a bit differently, by implementing
strdup(3) and strcasecmp(3) independently, and using regexps
to avoid calling strptime(3).
2009-08-15 - 0.9.29
- Fixing crash bugs with PHP 5.3.0 caused by unexpected NULL in
EG(active_symbol_table)
- Added more compatible way to retrieve ext/session globals
- Increased default length and count limit for POST variables (for
people not reading docu)
2009-08-14 - 0.9.28
- Fixed crash bug with PHP 5.2.10 caused by a change in extension
load order of ext/session
- Fixed harmless parameter order error in a bogus memset()
- Disable suhosin.session.cryptua by default because of Internet
Explorer 8 "features"
- Added suhosin.executor.include.allow_writable_files which can be
disabled to disallow inclusion of files writable by the webserver
The OpenSSL project team is pleased to announce the release of
version 0.9.8m of our open source toolkit for SSL/TLS. This new
OpenSSL version is a security and bugfix release which implements
RFC5746 to address renegotiation vulnerabilities mentioned in
CVE-2009-3555. For a complete list of changes,
please see http://www.openssl.org/source/exp/CHANGES.
Major changes between version 1.7.2p3 and 1.7.2p4:
* Fix a bug that could allow users with permission to run sudoedit
to run arbitrary commands.
Major changes between version 1.7.2p2 and 1.7.2p3:
* Fix printing of entries with multiple host entries on a single line.
* Fix use after free when sending error messages via email.
* Use setrlimit64(), if available, instead of setrlimit() when
setting AIX resource limits since rlim_t is 32bits.
* Fix size arg when realloc()ing include stack.
* Avoid a duplicate fclose() of the sudoers file.
modern NetBSD has PAM - add a patch so that this is recognised
there is no reason not to run this on modern NetBSD systems - remove the
old NOT_FOR_PLATFORM, since this runs just fine on NetBSD 5.99.20
Upstream changes:
v1.32 2010.02.22
- Makefile.PL: die if Scalar::Util has no dualvar support instead of
only complaining. Thanks to w[DOT]phillip[DOT]moore[AT]gmail[DOT]com
for reporting.
used less bytes in the system encoding than in the UTF8 passed to
the caller caused that the passphrase got truncated because only
the input length was accounted for
bump PKGREVISION
Upstream changes:
0.45 Feb 17, 2010
- support for taint mode
- use better IPv6 regexp
- bug in glob_quoter incorrectly handling empty strings solved
- document how $SIG{CHLD} can break some methods and add FAQ
- some typos corrected
- update copyright notices
pkgsrc changes:
- Add license definition
- Adjust dependencies
- Add module type
Upstream changes:
Authen-SASL 2.13 -- Thu Sep 24 17:27:47 CDT 2009
* RT#42191 Only use pass for GSSAPI credentials if it is an object of type GSSAPI::Cred
* RT#675 Authorization with Authen::SASL::Perl::External
* Call client_new and server_new inside eval so further plugins can be tried before failing
* Prefer to use Authen::SASL::XS over Authen::SASL::Cyrus
pkgsrc changes:
- Add license definition
- Add module type
- Order dependencies like in META.yml (upstream)
Upstream changes:
0.05 Tue Oct 13 11:04:46 JST 2009
* added a few new types for rndpassword(1).
* added 'endless mode' for rndpassword(1).
* cleaned code & pod up.
This is a bugfix release, no new features have been added.
Changes since OpenSSH 5.2
=========================
General Bugfixes:
* Do not limit home directory paths to 256 characters. bz#1615
* Several minor documentation and correctness fixes.
Portable OpenSSH Bugfixes:
* This release removes for support for very old versions of Cygwin and
for Windows 95/98/ME
* Move the deletion of PAM credentials on logout to after the session
close. bz#1534
* Make PrintLastLog work on AIX. bz#1595
* Avoid compile errors on FreeBSD from conflicts in glob.h. bz#1634
* Delay dropping of root privileges on AIX so chroot and pam_open_session
work correctly. bz#1249 and bz#1567
* Increase client IO buffer on Cygwin to 64K, realising a significant
performance improvement.
* Roll back bz#1241 (better handling for expired passwords on Tru64).
The change broke password logins on some configurations.
* Accept ENOSYS as a fallback error when attempting atomic
rename(). bz#1535
* Fix passing of variables to recursive make(1) invocations on Solaris.
bz#1505
* Skip the tcgetattr call on the pty master on Solaris, since it never
succeeds and can hang if large amounts of data is sent to the slave
(eg a copy-paste). bz#1528
* Fix detection of krb5-config. bz#1639
* Fix test for server-assigned remote forwarding port for non-root users.
bz#1578
* Fix detection of libresolv on OSX 10.6.
* keylookup:
+ Fixed typo noticed by lintian in manpage keylookup.1.
* caff:
+ Set the Sender header with the email address which is used for the From
header. This overrides the default value which was set by the
MIME::Entity Perl module based on the local hostname. (Closes: #556782)
Changes to 1.99.19/20100212
+ plug some memory leaks, from cppcheck via Thomas Klausner (thanks!)
+ make the singular of time units read correctly
+ print decryption key info properly when prompting for passphrase
Changes to 1.99.18/20100211
small steps, but lots of them - this is the first one.
+ print out the correct key information when signing files and memory.
what used to be printed out was the copy of the public key which is
stored as part of the private key. does not address the info shown
when decrypting, since that is done in a different way, by callback.
this whole part needs to be re-written, but will have to wait for two
good hands.
Changes to 1.99.17/20100206
+ get rid of last 2 static variables - use the __ops_printstate_t struct
passed down
+ get rid of 3 occurrences in reader.c where an automatic buffer was
addressed (as part of a subsequent callback) by a struct field from
a calling scope, and only valid within the callback. Found by
Flexelint and phk - many thanks.
+ print filename/"memory" when time problems occur when validating signatures
Changes to 1.99.16/20100205
+ minor simplifications to netpgp(1) internally
+ fix a bug in netpgp_verify_file where a non-existent file while listing
packets would cause a SIGSEGV
+ add duration arg to netpgp(1), and check for validity when verifying
signatures
+ add birthtime arg to netpgp(1), and check for validity when verifying
signatures
+ add netpgp commands to print pubkey, if desired
+ allow the passphrase for the signature to be taken from --pass-fd
+ get rid of static indent value when printing packet contents
+ print signature validity times when verifying a file's signature
pkgsrc changes:
- Adding license definition
- Adding pgp2-compat option which turns on idea dependency (defaultly off)
- Reordering and updating dependencies to cover fixes
Upstream changes:
1.04 2009.12.10
- Keyring lookup by uid is now case-insensitive to match the behavior
in GnuPG. Fixes http://rt.cpan.org/Public/Bug/Display.html?id=2225
- Got rid of a warning in Crypt::OpenPGP::SKSessionKey related to
broken calculation of the session_key; that session_key value was
never used, so I removed the code generating the key, hence removing
the warning. Addresses
http://rt.cpan.org/Public/Bug/Display.html?id=29950
- Default key and config file locations (in compatibility mode) now work
on Windows. Fixes http://rt.cpan.org/Public/Bug/Display.html?id=18815
- Updated to use Module::Install. Addresses
http://rt.cpan.org/Public/Bug/Display.html?id=35983 and
http://rt.cpan.org/Public/Bug/Display.html?id=31411
- Made all dependencies required, rather than optional based on
feature packages. Simplifies distribution and packaging, and addresses
http://rt.cpan.org/Public/Bug/Display.html?id=41426
- Removed sign() and auto_install() from Makefile.PL.
- Removed magic svn keywords.
- Converted test suite to Test::More.
- Added author tests (xt/) and modified SYNOPSIS for all modules to
make them pass the compilation test.
- Added support for checking permissions in cvm-qmail. See discussion
of $CVM_QMAIL_CHECK_PERMS in cvm-qmail.html
- Added support for I/O timeouts for cvm-local modules.
- Fixed the SQLite module to copy the row data.
- Fixed cvm-qmail dieing if control/locals is missing.
pkgsrc changes: set LICENSE and support DESTDIR.
pkgsrc changes:
- Adjusting dependencies
- Removing compatibility patches which are all applied upstream
Upstream changes:
1.36 30.01.2010
- Fix problems with building on GNU/kFreeBSD, to do with use of pack
instread of sockaddr_in. Patched by Debian Perl Group. (Closes RT#40144)
- Fixed a compile problem in t/local/ptr_cast_test.c for some gcc
versions. Reported by "Ryan McGuigan via RT". (Closes RT#52525)
- Improved OpenSSL detection on Win32/strawberry perl. Patch provided
by kmx. (Closes RT#49287)
- Fix test failures on some 64-bit platforms. (Closes RT#53585)
- Make X509_NAME_get_text_by_NID return its result without a trailing NUL.
Patched by Steffen Ullrich. (Closes RT#35754)
- SSL_set_session_secret_cb required for EAP-FAST is now enabled for both
SSL_F_SSL_SET_HELLO_EXTENSION and
SSL_F_SSL_SET_SESSION_TICKET_EXT. The name of this #define
changed after 0.9.8i. SSL_set_hello_extension is not available after
0.9.8i.
- Added SSL_CTX_get_client_CA_list sk_X509_NAME_free sk_X509_NAME_num
sk_X509_NAME_value SSL_get_client_CA_list, from patch provided by
Joerg Schneider
- Added EVP_add_digest and EVP_sha256 (if available)
- Improve documentation on callback functions.
- Stop looping forever when writing to broken connections. Patched by
Martin Mares. (Closes RT#44170)
- Patches from "Martijn van Beers via RT" to add SSL_SENT_SHUTDOWN
and SSL_RECEIVED_SHUTDOWN, remove broken URLs,
and to fix some documentation issues.
- Various changes to build with OpenSSL 1.0 beta1:
SSL_SESSION_cmp has been removed
return type of SSL_CTX_sessions changed in an ugly way
- Fixed a build problem reported by SISYPHUS:
On Windows Vista64, ActivePerl 5.10.0 (build 1004, x64), running 'nmake
test', the process hangs forever when it comes to building the test
executable (as the executable fails to build).
- Applied patch from ecmenifee in to improve handling of errors in
ssl_write_all. (Closes RT#48132)
- Patch to permit compile and testing on OS/2 submitted by Ilya
Zakharevich.
- Fixed compile problems with openssl-1.0.0-beta3 due to MD2 now being
optional. Reported by paul [...] city-fan.org.
- Fixed compile problems with openssl-0.9.7 and earlier with undefined
symbol EVP_sha256. Reported by paul [...] city-fan.org.
- Fixed a typo reported by Dan Dascalescu.
- added RIPEMD160 digest function. Patch provided by dkg.
Upstream changes:
0.44
- solve bug on rsync methods not correctly handling
pass-through options carrying an argument (bug report by
Daiju Kito)
- support several verbose levels in rsync methods
- document spurious warnings that appear when tty => 1 is
given and stdin is not attached to a tty
0.43 Dec 14, 2009
- call ssh with -tt instead of -t to force remote tty
allocation even when stdin is not attached to one locally
(bug report by Todd E. Rinaldo)
0.42 Dec 5, 2009
- add FAQ section
- add commercial support offering
- add pointer to my wishlist :-)
0.41_03 Nov 16, 2009
- add testing known_hosts to MANIFEST
- some bits where missing from 0.40
- allow also keyboard-interactive authentication when password
is given (bug report by Todd E. Rinaldo)
0.40 Nov 14, 2009
- DESTROY was clobbering $@ (bug report by Todd E. Rinaldo)
- when password authentication is requested add flags to ssh
master command to disable other auth. options
- document how to integrate Net::OpenSSH with Expect
0.39 Oct 10, 2009
- use SIGTERM instead of SIGHUP to kill lazy SSH master
- on 1_run.t remote commands could be aliased bug (report and
patch by Danijel Tasov)
- add methods for external master PID handling
- add 'all' tag to Net::OpenSSH::Constants
- check SSH client version from Makefile.PL
- work around L<Foo::Bar> links in POD being rendered as "the
Foo::Bar manpage" by some POD backends.
0.38 Sep 25, 2009
- remove alpha-status warning from docs!
- add debug support to master killing
- DESTROY was generating warnings when called before the
master connection had been established successfully
- add variable expansion feature
- minor doc corrections
0.37 Sep 15, 2009
- add support for stdout_file, stderr_file and stdin_file
options
Upstream changes:
0.26 Sun Nov 22 2009 11:01:13
- Change subclassing test to generate a 512 bit key in order to
work around an odd issue seen on some 64-bit redhat systems.
(CPAN bug 45498)
pkgsrc changes:
- Updating COMMENT to new short description from upstream
Upstream changes:
1.09 - Sun Jan 17 12:00:33 2010
* Clarify in the Makefile.PL that this is under LGPL.
* There are no code changes
scheduled import of www/p5-Catalyst-Authentication-Store-Htpasswd,
which is recommended by the update of editors/p5-Padre-Plugin-Catalyst.
This module provides a convenient, object-oriented interface to Apache-style
.htpasswd files. It supports passwords encrypted via MD5, SHA1, and crypt,
as well as plain (cleartext) passwords. Additional fields after username
and password, if present, are accessible via the extra_info array.
5.48 Mon Jan 4 16:32:52 MST 2010
- fixed "shasum -a0" option (ref. rt.cpan.org #53319)
-- incorrectly accepted 0 as a valid algorithm
-- thanks to Zefram for patch
- updated URL for NIST test vectors
-- ref. files t/nistbit.t, t/nistbyte.t
-- thanks to Leon Brocard for patch
Version 4.29, 2009.12.02, urgency: MEDIUM:
* New features sponsored by Searchtech Limited http://www.astraweb.com/
- sessiond, a high performance SSL session cache was built for stunnel.
A new service-level "sessiond" option was added. sessiond is
available for download on ftp://stunnel.mirt.net/stunnel/sessiond/ .
stunnel clusters will be a lot faster, now!
* Bugfixes
- "execargs" defaults to the "exec" parameter (thx to Peter Pentchev).
- Compilation fixes added for AIX and old versions of OpenSSL.
- Missing "fips" option was added to the manual.
Version 4.28, 2009.11.08, urgency: MEDIUM:
* New features
- Win32 DLLs for OpenSSL 0.9.8l.
- Transparent proxy support on Linux kernels >=2.6.28.
See the manual for details.
- New socket options to control TCP keepalive on Linux:
TCP_KEEPCNT, TCP_KEEPIDLE, TCP_KEEPINTVL.
- SSL options updated for the recent version of OpenSSL library.
* Bugfixes
- A serious bug in asynchronous shutdown code fixed.
- Data alignment updated in libwrap.c.
- Polish manual encoding fixed.
- Notes on compression implementation in OpenSSL added to the manual.
pkgsrc changes:
- Adjusting license definition
Upstream changes:
1.08 - Wed Dec 9 18:20:22 2009
* Promoting development release to full release.
* This release mainly clarifies the licensing.
1.07_02 - Tue Nov 4 02:21:27 2008
* RT #40511: Give a better warning when you try to use tainted
data as an initialization vector. If anyone wants to use
tainted data, they can patch the code to accept it.
1.07_01 - Tue Oct 14 08:59:58 2008
* Clarify that these files are under the Lesser GNU Public License
(also known as the Library GNU Public License).
changes:
* The default for --include-cert is now to include all certificates
in the chain except for the root certificate.
* Numerical values may now be used as an alternative to the
debug-level keywords.
* The GPGSM --audit-log feature is now more complete.
* GPG now supports DNS lookups for SRV, PKA and CERT on W32.
* New GPGSM option --ignore-cert-extension.
* New and changed passphrases are now created with an iteration count
requiring about 100ms of CPU work.
Approved by agc@.
Changes between 0.9.8k and 0.9.8l [5 Nov 2009]
*) Disable renegotiation completely - this fixes a severe security
problem (CVE-2009-3555) at the cost of breaking all
renegotiation. Renegotiation can be re-enabled by setting
SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION in s3->flags at
run-time. This is really not recommended unless you know what
you're doing.
[Ben Laurie]
* Not only interix-3, but also treat all interix release, allow to build on SUA.
* Gave up randomized image base, use 0x5e000000, as in mk/platform/Interix.mk.
It is workaround of PR 42369.
* Use -D_REENTRANT flags for threads.
* replace -Wl,soname= linker flags with -Wl,h, for Interix
Major changes between sudo 1.7.2p1 and 1.7.2p2:
* Fixed a a bug where the negation operator in a Cmnd_List
was not being honored.
* Sudo no longer produces a parse error when #includedir references
a directory that contains no valid filenames.
* The sudo.man.pl and sudoers.man.pl files are now included in
the distribution for people who wish to regenerate the man pages.
* Fixed the emulation of krb5_get_init_creds_opt_alloc() for MIT kerberos.
* When authenticating via PAM, set PAM_RUSER and PAM_RHOST early so
they can be used during authentication.
an "idea" option, but that was removed more than a year ago when it
got updated from 1.2 to 1.4
The patch was was used on gnupg2 in the "idea" case was just a four-line
memory initialization fix, there is no point in LICENSE restrictions
due to this, so I've pulled it in as regular patch so that it doesn't
get lost for the case someone fixes idea support in libgcrypt
(which isn't hard).
noticed by OBATA Akio per mail to pkgsrc-users.
This makes most sense to me since gnupg2 doesn't install a gpg-zip
intentionally. Since possible clients of gpg-zip should have a
dependency on gnupg1, we can't take over easily. Once we are sure
that gnupg2 can fully replace gnupg1, we might consider to install
eg symlinks gpg->gpg2 etc and make gnupg1 obsolete, but this needs
careful testing.
changes: many fixes and improvements
reviewed by John R. Shannon
pkgsrc notes:
-since S/MIME support is the biggest difference in functionality over
gnupg1, enable it per default -- my tests (with the s/mime plugin
of claws-mail) worked
-left the build against a private libassuan with GNU-pth support
alone for now, just updated libassuan to 1.0.5. We might build
pkgsrc/libassuan against pkgsrc/pth at some point, but this needs
to be checked for side effects. (As this pkg doesn't export a library
which might propagate the pth dependency, the possibility of
pthread-pth conflicts should be limited. Other uses of libassuan
need to be checked.)
changes:
* New option --url for the LOOKUP command and dirmngr-client.
* The LOOKUP command does now also consults the local cache. New
option --cache-only for it and --local for dirmngr-client.
* Port to Windows completed.
* Improved certificate chain construction.
* Support loading of PEM encoded CRLs via HTTP.
* Client based trust anchors are now supported.
* Configured certificates with the suffix ".der" are now also used.
* Libgcrypt 1.4 is now required.
reviewed by John R. Shannon
pkgsrc notes:
I've left the build against a private libassuan with GNU-pth support
alone for now, just updated libassuan to 1.0.5. We might build
pkgsrc/libassuan against pkgsrc/pth at some point, but this needs
to be checked for side effects. (As this pkg doesn't export a library
which might propagate the pth dependency, the possibility of
pthread-pth conflicts should be limited. Other uses of libassuan
need to be checked.)
Beiing here, support DESTDIR.
-don't pull in gnupg2's "gpgconf" if both gnupg1 and gnupg2 are installed
but we are building against gnupg1, this caused a build failure
-fix a selftest to work with gnupg2
Changes in version 2.28.2 are:
* Add license to reference documentation.
* Sent output of g_printerr to syslog.
* No error when can't unlock login keyring.
* Fix assertion when comparing attributes.
* Fix freeing of unallocated memory in test.
* Don't barf on certificates with unsupported algorithm.
* Fix some memory leaks.
[Changes for 0.61]
* Added "=encoding utf8" to POD to fix author name display.
No functional changes.
[Changes for 0.60]
* LICENSING CHANGE: This compilation and all individual files in it
are now under the nullary CC0 1.0 Universal terms:
To the extent possible under law, 唐鳳 has waived all copyright and
related or neighboring rights to Module-Signature.
* Updated Module::Install to 0.91, prompted by Florian Ragwitz.
0.42 Wed Sep 30 23:20:58 JST 2009
* Support for GPG2
0.41_01 Fri Sep 25 02:56:33 JST 2009
* Beginnings of support for GPG2
0.40_04 Tue Apr 21 19:50:12 JST 2009
* Use Any::Moose instead of Moose for Mouse celerity (Sartak)
0.40_1 Sat Nov 15 12:35:59 EST 2008
* [rt.cpan.org #40963] Replace Class::MethodMaker with Moose (Chris Prather)
Noteworthy changes in version 1.4.5 (2009-12-11)
------------------------------------------------
* Fixed minor memory leak in DSA key generation.
* No more switching to FIPS mode if /proc/version is not readable.
* Fixed a sigill during Padlock detection on old CPUs.
* Fixed a hang on some W2000 machines.
* Boosted SHA-512 performance by 30% on ia32 boxes and gcc 4.3;
SHA-256 went up by 25%.
Apart from infrastructure changes, there are the following functional ones:
+ Update to version 1.99.14/20091210
+ provide a new netpgp_match_list_keys(3) function to perform a
regular-expression based search of all the keys in the keyring. If no
pattern is specified to match, then all keys are returned.
+ provide a new netpgp_set_homedir(3) function, and use it to set the
home directory from the library, rather than individually in all the
programs which use the library
+ provide a new netpgp_incvar(3) function which will add a constant
increment (which may be negative) to the value of an internal
variable. This is primarily used for the verbosity level within the
library, and is again a movement of the function into the library from
the individual programs which use the library
+ move to the specification of an ssh key file by internal variable,
rather than the directory holding an ssh key file
+ autoconf infrastructure changes
+ take a hammer to the _GNU_SOURCE definitions problems
+ don't rely on strnlen(3) being present everywhere
+ add rudimentary support for ssh keys
+ add a netpgp library function - netpgp_get_key(3) - to print a
specific key
+ add functionality to call this function in netpgpkeys(1)
+ add test for netpgp_get_key
+ add a verbose switch to the tst script
+ add netpgp functions to expose the memory signing and verification
functions - netpgp_sign_memory(3) and netpgp_verify_memory(3)
+ coalesced signing and verification ops file functions
The seccure toolset implements a selection of asymmetric
algorithms based on elliptic curve cryptography (ECC). In
particular it offers public key encryption / decryption,
signature generation / verification and key establishment.
ECC schemes offer a much better key size to security ratio
than classical systems (RSA, DSA). Keys are short enough to
make direct specification of keys on the command line possible
(sometimes this is more convenient than the management of
PGP-like key rings). seccure builds on this feature and
therefore is the tool of choice whenever lightweight
asymmetric cryptography -- independent of key servers,
revocation certificates, the Web of Trust or even
configuration files -- is required.
collection - kudos to Jan Schaumann for pointing it out.
PAM module which permits authentication for arbitrary services
via ssh-agent. Written with sudo in mind, but like any auth
PAM module, can be used for for many purposes.
and "root" user-less platforms.
* replace one bash script shbang (for safe side, may bone shell is sufficient).
* fix PLIST for PR 40993.
add missing entries and back plist vars replaced for Darwin-apple excessively.
Bump PKGREVISION.
On SP initiated logout, the SP x509 certificate was included in the
HTTP redirect URL. First this was an SAML standard violation, and second
it inflated the URL beyond 2038 bytes, which is the maximum length for
IE7 and prior. As a result, SP initated single logout was broken with IE7
and prior versions.
changes:
-Support for the "aes128-ctr", "aes192-ctr", "aes256-ctr" ciphers
-Support for the "arcfour128" cipher
-Fix crash when server sends an invalid SSH_MSG_IGNORE message
1.) Use "hashlib" instead of "sha" module if possible.
2.) Use "subprocess" module instead of os.popen3().
Both changes tested with Python 2.4 and 2.6.
Pkgsrc-related improvements:
1.) Support "user-destdir" installation (no changes required).
2.) Set license to "gnu-gpl-v2".
3.) Reduce patches by recording the fact that the manual page gets
compressed automatically (which "pkgsrc" handles fine) instead
of trying to prevent that.
