OpenSSL version 0.9.8q released
===============================
OpenSSL - The Open Source toolkit for SSL/TLS
http://www.openssl.org/
The OpenSSL project team is pleased to announce the release of
version 0.9.8q of our open source toolkit for SSL/TLS. This new
OpenSSL version is a security and bugfix release. For a complete
list of changes, please see
http://www.openssl.org/source/exp/CHANGES.
The most significant changes are:
o Fix for security issue CVE-2010-4180
o Fix for CVE-2010-4252
0.50 Nov 21, 2010
- shell_quote in t/1_run.t was escaping '_' (bug report by
Andreas J. König)
- some typos corrected
- initial implementation of scp_cat
v1.34 2010.11.01
- schema http for certificate verification changed to
wildcards_in_cn=1, because according to rfc2818 this is valid and
also seen in the wild
- if upgrading socket from inet to ssl fails due to handshake problems
the socket gets downgraded, but is still open.
See https://rt.cpan.org/Ticket/Display.html?id=61466
- deprecate kill_socket, just use close()
2010-09-30 Gisle Aas <gisle@ActiveState.com>
Release 2.51
Florian Ragwitz (1):
Fix compilation with c++ compilers
Gisle Aas (1):
Fix repository specification in META.yml
2010-09-25 Gisle Aas <gisle@ActiveState.com>
Release 2.50
Chris 'BinGOs' Williams (1):
Amended tests to work with perl core.
Florian Ragwitz (3):
Attach context pointers using sv magic
Add failing test for thread cloning
Clone MD5 contexts on thread cloning
get_md5_ctx should never return anything but a valid pointer
Gisle Aas (1):
perl-5.6 no longer supported
Jesse Vincent (1):
Preserve utf8ness of argument [RT#44927]
LibTomCrypt is a fairly comprehensive, modular and portable
cryptographic toolkit that provides developers with a vast array of
well known published block ciphers, one-way hash functions, chaining
modes, pseudo-random number generators, public key cryptography and a
plethora of other routines. LibTomCrypt has been designed from the
ground up to be very simple to use. It has a modular and standard API
that allows new ciphers, hashes and PRNGs to be added or removed
without change to the overall end application. It features easy to
use functions and a complete user manual which has many source snippet
examples.
* Block Ciphers
* Blowfish
* XTEA
* RC5
* RC6
* SAFER+
* Rijndael (aka AES)
* Twofish
* SAFER (K64, SK64, K128, SK128)
* RC2
* DES, 3DES
* CAST5
* Noekeon
* Skipjack
* Anubis (with optional tweak as proposed by the developers)
* Khazad
* KASUMI
* SEED
* Chaining Modes
* ECB
* CBC
* OFB
* CFB
* CTR
* IEEE LRW mode
* F8 Chaining Mode
* One-Way Hash Functions
* MD2
* MD4
* MD5
* SHA-1
* SHA-224/256/384/512
* TIGER-192
* RIPE-MD 128/160/256/320
* WHIRLPOOL
* Message Authentication
* FIPS-198 HMAC (supports all hashes)
* CMAC, also known as OMAC1 (supports all ciphers)
* PMAC Authentication
* F9-MAC
* Pelican MAC
* Message Encrypt+Authenticate Modes
* EAX Mode
* OCB Mode
* CCM Mode (NIST spec)
* GCM Mode (IEEE spec)
* Pseudo-Random Number Generators
* Yarrow (based algorithm)
* RC4
* Support for /dev/random, /dev/urandom and the Win32 CSP RNG
* Fortuna
* SOBER-128
* Public Key Algorithms
* RSA (using PKCS #1 v1.5 and v2.1)
* ECC (EC-DSA X9.62 signatures, X9.63 EC-DH)
o With fast Fixed Point ECC support as well
o X9.63 import/export of public keys
* DSA (Users make their own groups)
* The math routines are pluggable which means you can use your own
math provider if you want.
* Other standards
* PKCS #1 (v1.5 and v2.1 padding)
* PKCS #5
* ASN.1 DER
OpenSSL version 0.9.8p released
===============================
OpenSSL - The Open Source toolkit for SSL/TLS
http://www.openssl.org/
The OpenSSL project team is pleased to announce the release of
version 0.9.8p of our open source toolkit for SSL/TLS. This new
OpenSSL version is a security and bugfix release which addresses
CVE-2010-3864. For a complete list of changes,
please see http://www.openssl.org/source/exp/CHANGES.
The PBC (Pairing-Based Cryptography) library is a free C library built
on the GMP library that performs the mathematical operations
underlying pairing-based cryptosystems.
It provides routines such as elliptic curve generation, elliptic curve
arithmetic and pairing computation.
The API is abstract enough that the PBC library can be used even if
the programmer possesses only an elementary understanding of pairings.
There is no need to learn about elliptic curves or much of number
theory. (The minimum requirement is some knowledge of cyclic groups
and properties of the pairing.)
Boneh-Lynn-Shacham short signatures
Hess identity-based signatures
Joux tripartite Diffie-Hellman
Paterson identity-based signatures
Yuan-Li identity-based authenticated key agreement
Zhang-Kim identity-based blind/ring signatures
Zhang-Safavi-Naini-Susilo signatures
Bug Fixes
* amavisd failed to start when spam scanning was disabled either
by @bypass_spam_checks_maps=(1) or by @spam_scanners=(), giving:
Can't locate object method "new" via package "Amavis::SpamControl"
As a workaround one could use a @spam_scanners=(undef) to disable spam
scanning;
* several decoders failed to propagate "Exceeded storage quota" exception,
so the protection of AV scanners against mail bombs was ineffective;
reported by Jorgen Lundman;
* milter usage (AM.PDP): verbatim header edits inserted a header body of
"1" instead of the correct string
* updated AV entry for BitDefender's bdscan to recognize tabs around
a colon in its output; contributed by Steve;
* fix parsing of a combined result from DSPAM (option --classify), as
earlier versions of DSPAM did not include a signature with a combined
result line; problem reported by Marijan Vidmar;
New Features
* provide a true SNMP agent and a MIB, facilitating monitoring the health
of a content filtering system, its performance and mail characteristics;
* a new AV interface to SMTP-based antivirus scanners;
* allow customizing SMTP-status response reason text for blocked messages;
* prevent inserting fake copies of certain important mail header fields
without breaking a DKIM signature;
Changes from previous version (20100601)
Changes to 3.99.13/20101104
+ fix up GNU autoconf framework to reflect new structure
+ add ability in netpgpkeys(1) and netpgp(1) to specify the cipher
(symmetric algorithm)
+ add the camellia cipher implementation from openssl as specified in RFC 5581
+ changes from Peter Pentchev to get rid of an exit(3) in library context
+ changes from Peter Pentchev for manual page hyphens
+ changes from Peter Pentchev to clean up after tests
+ changes from Arnaud Ysmal to avoid dereferencing possible NULL pointers
+ change from Arnaud Ysmal to clean up usage message in netpgpkeys(1)
+ avoid calling bzlib functions if they aren't present
+ when writing out the key as an ssh key, don't include the user id
information at the end, in-line with expectations about standard ssh
key formats
+ since the signing key changed its "menu line" entry from "pub" to
"signature", the offset of the key id moved 7 chars to the right, so
take this into consideration when generating new keys
+ allow the user specification of the secret key file as the
--sshkeyfile or -S argument, and check that the public key file exists
before trying to read it
Changes to 3.99.12/20100907
+ add a pretty print function mj_pretty(3) to libmj
+ added netpgp_write_sshkey(3) to libnetpgp
+ added pgp2ssh(1)
+ added preliminary support for ElGamal decryption, needed for DSA keys
as yet untested, unworking, and a WIP
+ add support for using all ssh keys, even those protected by a passphrase,
for decryption and signing. This rounds off ssh key file support in netpgp.
+ add a single character alias (-S file) for [--sshkeyfile file] to
netpgpkeys(1) and netpgp(1)
Changes to 3.99.11/20100809
+ update hkpd(8) to reflect the -S argument to hkpd(8)
+ add reachover Makefile support for hkpd(8) and hkpc(1)
+ regen autoconf with new version and date information
Changes to 3.99.10/20100809
+ check return value from option setting function in netpgpkeys(1)
+ be smarter when checking for a null id
+ add test for crap being returned when listing specific keys in netpgpkeys(1)
+ take the public key from the pubring, not the secring when exporting
keys
+ allow hkpd to serve ssh keys in pgp format
+ test on whether a seckey is needed, not on a userid needed, for ssh keys
Changes to 3.99.9/20100809
+ add single character options to netpgp(1) and netpgpkeys(1)
+ add -o long-option (=value)? to netpgp(1) and netpgpkeys(1)
+ save subkeys when parsing keys. when listing keys, note that the first
subkey is for encryption
+ rationalise birthtime/expiration timestamps into a single function
+ clean up some 64-bit (amd64) lint
Changes to 3.99.8/20100805
+ free a regular expression after using it
+ be a bit less typedef-happy when it's not needed
+ added minimalist JSON (libmj) to distribution
+ add a function in ops layer to construct JSON serialised text from keys
+ use json output from the library in netpgpkeys(1)
+ added check for alternative openssl location
Changes to 3.99.7/20100701
+ recognise ascii-armoured encrypted messages properly, in memory and
in files
+ fix a bug when printing out the public key when prompting for a secret
key
+ print error message and exit for now when trying to encrypt with a DSA key
+ fix bug reported by dyoung when trying to print out the encryption key
fingerprint
Changes to 3.99.6/20100701
+ make some synonyms for --ssh-keys
+ make proper defaults for home dir for ssh key files as well as pgp files
+ modify regression test script to ensure that ssh-keygen and netpgpkey's
idea of ssh keys are the same
+ return any error codes when reading ssh pub or private keys
Changes to 3.99.5/20100613
+ make ssh fingerprints (md5) match netpgp listing
+ use the more functional hexdump function from ssh2pgp in place of the
older hexdump function from openpgpsdk
+ pass hash type down from command line where needed
+ add test for netpgp/ssh key fingerprint matching
+ make netpgpkeys(1) take a --hash= option
=== 0.4.4 2010-10-31
* Fix LoadError rescue in tests: return can't be used in this context
(Hans de G raaff)
* HTTP headers should be strings. (seancribbs)
* ensure consumer uri gets set back to original config even if an error occurs
(Brian Finney)
* Yahoo uses & to split records in OAuth headers (Brian Finney)
* Added support for Rails 3 in client/action_controller_request (Pelle)
* fix: LDAP write on userPassword fails when chasing referral and cached
policy error is POLICY_ERROR_PASSWORD_EXPIRED
* fix: only request attributes that are actually used
* fix: canonicalize PAM_USER name
Noteworthy changes in version 1.4.11 (2010-10-18)
-------------------------------------------------
* Bug fixes and portability changes.
* Minor changes for better interoperability with GnuPG-2.
* Added mechanism CKM_RSA_X_509 (use Botan 1.9.7 to fix a bug
when verifying these signatures)
* The softhsm command now have the option --module <path>
To use a PKCS#11 library other than SoftHSM.
* The softhsm command now import all parts of the RSA key.
CKA_EXPONENT_1, CKA_EXPONENT_2, and CKA_COEFFICIENT is not needed
by SoftHSM but might be needed by other HSM:s.
* Ticket #163: softhsm-keyconv now support BIND format v1.3
* Write message to stderr when the config file cannot be found
* CKA_WRAP_WITH_TRUSTED was not handled correctly. But it has not
been a problem since wrapping is not supported.
* Set CKA_KEY_GEN_MECHANISM to CK_UNAVAILABLE_INFORMATION when
importing objects.
* C_GetInfo now returns CKR_CRYPTOKI_NOT_INITIALIZED if library
is not initialized.
* Force clean up if the app does not do C_Finalize (using auto_ptr)
* Limit the scope of the session objects to the owner application
* softhsm --optimize will clean up leftovers (session objects)
from applications that haven't closed down properly.
* Do not use CKF_HW, the mechanisms are not performed by a device.
* The ulMinKeySize and ulMaxKeySize are not used for the digesting
mechanisms, but we set them to zero for applications that forget
this.
* Used wrong buffer size for signatures. This was only a problem
for keys where (key size % 8 == 1), e.g. 1025 bit keys.
* C_Login now returns CKR_USER_ANOTHER_ALREADY_LOGGED_IN instead of
CKR_USER_TOO_MANY_TYPES
* Version 2.10.2 (released 2010-09-30)
** Use Libtool 2.2.10 to ease MinGW64 builds.
** libgnutls: Add new extended key usage ipsecIKE.
** libgnutls: Is now more liberal in the PEM decoding.
That is spaces and tabs are being skipped.
** libgnutls: Renamed NULL MAC to MAC-NULL to prevent clash with NULL cipher.
This prevented the usage of the TLS ciphersuites with NULL cipher.
See <http://thread.gmane.org/gmane.network.gnutls.general/2093>.
** libgnutls: The %COMPAT flag now allows larger records that violate the
TLS spec.
** libgnutls: Fix asynchronous API handling.
The code was clearing session hash data on EAGAIN. Problem reported
by Sjoerd Simons <sjoerd.simons@collabora.co.uk> and Vivek
Dasmohapatra <vivek@collabora.co.uk>. See
<http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4531>.
** gnutls-cli: Flush stdout/stderr before removing buffering.
Reported by Knut Anders Hatlen see
<http://savannah.gnu.org/support/?107481>.
* add tests
* Corrected a bogus array initialization.
* Effectively double-escaped the normalized params for inclusion in the
signature base as required by sections 9.1.1 and 9.1.3 of the OAuth 1.0
specification.
2010-09-20 -- pycryptopp v0.5.25
* make setup backwards-compatible to Python 2.4
* fix incompatibilities between setup script and older versions of darcsver
* don't attempt to compile Mac OS X extended attribute files (this fixes the build breaking)
* include a version number of the specific version of Crypto++ in extraversion.h
* small changes to docs
2010-09-18 -- pycryptopp v0.5.20
* fix bugs in assembly implementation of SHA-256 from Crypto++
* fix it to compile on *BSD (#39)
* improve doc strings
* add a quick start-up-self-test of SHA256 (#43)
* execute the quick start-up-self-tests of AES and SHA256 on module import
This module provides common interface to HMAC functionality. HMAC is a
kind of "Message Authentication Code" (MAC) algorithm whose standard
is documented in RFC2104. Namely, a MAC provides a way to check the
integrity of information transmitted over or stored in an unreliable
medium, based on a secret key.
Originally written by Daiki Ueno. Converted to a RubyGem by Geoffrey Grosenbach
LuaSec is a binding for OpenSSL library to provide TLS/SSL communication.
This version delegates to LuaSocket the TCP connection establishment
between the client and server. Then LuaSec uses this connection to start
a secure TLS/SSL session.
(Based on wip/luasec.)
pkgsrc changes:
- add license definition
Upstream changes:
0.15 Sun Sep 12 13:46:13 2010
- added crc64 support, #50064
Thanks to Anders Ossowicki <aowi@novozymes.com>
- added bit reversing per byte, #59575
Thanks to Joel Peshkin <joel@peshkin.net>
- clone method nwo copies content too
Thanks to Stefan Ochs <stefan.ochs@opentext.com>
* Install README.LDAP when "ldap" is enabled in PKG_OPTIONS.
* Fix build problem when "kerberos" is enabled in PKG_OPTIONS.
Bump PKGREVISION since default PLIST has changed.
* Fixed bug with DB_CHECKINODE
Version 0.15
* Added new grouped option
* Sort files in report by filename
* Added support for e2fsattrs attribute
* Added support for ftype attribute
* Bug fixes
relevant bugs) version:
Major changes between version 1.7.4p3 and 1.7.4p4:
* A potential security issue has been fixed with respect to the
handling of sudo's -g command line option when -u is also
specified. The flaw may allow an attacker to run commands as a
user that is not authorized by the sudoers file.
* A bug has been fixed where "sudo -l" output was incomplete if
multiple sudoers sources were defined in nsswitch.conf and there
was an error querying one of the sources.
* The log_input, log_output, and use_pty sudoers options now work
correctly on AIX. Previously, sudo would hang if they were
enabled.
* Fixed "make install" when sudo is built in a directory other
than the directory that holds the sources.
* The runas_default sudoers setting now works properly in a
per-command Defaults line.
* Suspending and resuming the bash shell when PAM is in use now
works properly. The SIGCONT signal was not being propagated to
the child process.
Major changes between version 1.7.4p2 and 1.7.4p3:
* A bug has been fixed where duplicate HOME environment variables
could be set when the env_reset setting was disabled and the
always_set_home setting was enabled in sudoers.
* The value of sysconfdir is now substituted into the path to the
sudoers.d directory in the installed sudoers file.
* Fixed compilation problems on Irix and other platforms.
* If multiple PAM "auth" actions are specified and the user enters
^C at the password prompt, sudo will now abort any subsequent
"auth" actions. Previously it was necessary to enter ^C once for
each "auth" action.
Major changes between version 1.7.4p1 and 1.7.4p2:
* Fixed a bug where sudo could spin in a cpu loop waiting for the
child process.
* Packaging fixes for sudo.pp to better handle patchlevels.
Major changes between version 1.7.4 and 1.7.4p1:
* Fix a bug introduced in sudo 1.7.3 that prevented the -k and -K
options from functioning when the tty_tickets sudoers option was
enabled.
* Sudo no longer prints a warning when the -k or -K options are
specified and the ticket file does not exist.
* Changes to the configure script to enable cross-compilation of
Sudo.
Major changes between version 1.7.3 and 1.7.4:
* Sudoedit will now preserve the file extension in the name of the
temporary file being edited. The extension is used by some
editors (such as emacs) to choose the editing mode.
* Time stamp files have moved from /var/run/sudo to either
/var/db/sudo, /var/lib/sudo or /var/adm/sudo. The directories
are checked for existence in that order. This prevents users
from receiving the sudo lecture every time the system reboots.
Time stamp files older than the boot time are ignored on systems
where it is possible to determine this.
* Ancillary documentation (README files, LICENSE, etc) is now
installed in a sudo documentation directory.
* Sudo now recognizes "tls_cacert" as an alias for "tls_cacertfile"
in ldap.conf.
* Defaults settings that are tied to a user, host or command may
now include the negation operator. For example:
Defaults:!millert lecture
will match any user but millert.
* The default PATH environment variable, used when no PATH variable
exists, now includes /usr/sbin and /sbin.
* Sudo now uses polypkg for cross-platform packing.
* On Linux, sudo will now restore the nproc resource limit before
executing a command, unless the limit appears to have been
modified by pam_limits. This avoids a problem with bash scripts
that open more than 32 descriptors on SuSE Linux, where
sysconf(_SC_CHILD_MAX) will return -1 when RLIMIT_NPROC is set
to RLIMIT_UNLIMITED (-1).
* Visudo will now treat an unrecognized Defaults entry as a parse
error (sudo will warn but still run).
* The HOME and MAIL environment variables are now reset based on
the target user's password database entry when the env_reset
sudoers option is enabled (which is the case in the default
configuration). Users wishing to preserve the original values
should use a sudoers entry like:
Defaults env_keep += HOME
to preserve the old value of HOME and
Defaults env_keep += MAIL
to preserve the old value of MAIL.
* The tty_tickets option is now on by default.
* Fixed a problem in the restoration of the AIX authdb registry
setting.
* If PAM is in use, wait until the process has finished before
closing the PAM session.
* Fixed "sudo -i -u user" where user has no shell listed in the
password database.
* When logging I/O, sudo now handles pty read/write returning ENXIO,
as seen on FreeBSD when the login session has been killed.
* Sudo now performs I/O logging in the C locale. This avoids
locale-related issues when parsing floating point numbers in the
timing file.
* Added support for Ubuntu-style admin flag dot files.
Major changes between version 1.7.2p8 and 1.7.3:
* Support for logging a command's input and output as well as the
ability to replay sessions. For more information, see the
documentation for the log_input and log_output Defaults options
in the sudoers manual. Also see the sudoreplay manual for
information on replaying I/O log sessions.
* The use_pty sudoers option can be used to force a command to be
run in a pseudo-pty, even when I/O logging is not enabled.
* On some systems, sudo can now detect when a user has logged out
and back in again when tty-based time stamps are in use.
Supported systems include Solaris systems with the devices file
system, Mac OS X, and Linux systems with the devpts filesystem
(pseudo-ttys only).
* On AIX systems, the registry setting in /etc/security/user is
now taken into account when looking up users and groups.
Sudo now applies the correct the user and group ids when running
a command as a user whose account details come from a different
source (e.g. LDAP or DCE vs. local files).
* Support for multiple sudoers_base and uri entries in ldap.conf.
When multiple entries are listed, sudo will try each one in the
order in which they are specified.
* Sudo's SELinux support should now function correctly when running
commands as a non-root user and when one of stdin, stdout or stderr
is not a terminal.
* Sudo will now use the Linux audit system with configure with the
--with-linux-audit flag.
* Sudo now uses mbr_check_membership() on systems that support it
to determine group membership. Currently, only Darwin (Mac OS X)
supports this.
* When the tty_tickets sudoers option is enabled but there is no
terminal device, sudo will no longer use or create a tty-based
ticket file. Previously, sudo would use a tty name of "unknown".
As a consequence, if a user has no terminal device, sudo will now
always prompt for a password.
* The passwd_timeout and timestamp_timeout options may now be
specified as floating point numbers for more granular timeout
values.
* Negating the fqdn option in sudoers now works correctly when sudo
is configured with the --with-fqdn option. In previous versions
of sudo the fqdn was set before sudoers was parsed.
* Update HOMEPAGE.
* Remove default value of GEM_BUILD.
=== 2.0.23 / 03 Jun 2010
* delay CHANNEL_EOF packet until output buffer is empty [Rich Lane]
Previously, calling #eof! after #send_data would result in the CHANNEL_EOF
packet being sent immediately, ahead of the data in the output buffer. Now
buffer becomes empty.
=== 2.0.22 / 20 Apr 2010
* Fix for: "Parsing the config errors out because it coerces the "1" into an integer and then tries to split it on spaces for multiple host checking." (http://net-ssh.lighthouseapp.com/projects/36253/tickets/10) [Lee Marlow]
=== 2.0.21 / 20 Mar 2010
* Fix for "IdentifyFile" in ~/.ssh/config does not work if no "Host" statement is given (http://net-ssh.lighthouseapp.com/projects/36253/tickets/9-identifyfile-in-sshconfig-does-not-work-if-no-host-statement-is-given#ticket-9-5) [xbaldauf, Delano Mandelbaum]
* Fix for client closes a forwarded connection, but the server is reading, net-ssh terminates with IOError socket closed (http://net-ssh.lighthouseapp.com/projects/36253/tickets/7) [Miklós Fazekas]
* Fix for client force closes (RST) a forwarded connection, but server is reading, net-ssh terminates with exception [Miklós Fazekas]
* Fix for server closes the sending side, the on_eof is not handled. [Miklós Fazekas]
* Removed Hanna dependency in Rakefile [Delano Mandelbaum]
=== 2.0.20 / 10 Feb 2010
* Support "ProxyCommand none" directive [Andy Lo-A-Foe]
=== 2.0.19 / 16 Jan 2010
* Support plus sign in sshconfig hostname [Jason Weathered]
=== 2.0.18 / 15 Jan 2010
* Fix related to #recv(1) to #readpartial change in 2.0.16 [Hans de Graaff, Delano Mandelbaum]
=== 2.0.17 / 14 Dec 2009
* Don't load net/ssh/authentication/pageant on Windows with Ruby 1.9 [Travis Reeder, Delano Mandelbaum]
* Use lang/ruby/gem.mk instead of misc/rubygems/rubygem.mk.
* Remove default value of GEM_BUILD.
=== 2.0.5 / 19 Aug 2010
* Fixed missing StringIO exception in download! [Toby Bryans, Delano Mandelbaum]
* Use lang/ruby/gem.mk instead of misc/rubygems/rubygem.mk.
* Remove default value of GEM_BUILD.
* Ajust new ruby package's framework.
=== 1.0.3 / 17 Aug 2010
* replace :sanitize_file_name with a call to String#shellescape [Sung Pae]
* Added gemspec file and removed echoe dependency [Miron Cuperman, Delano Mandelbaum]
* Removed Hanna dependency in Rakefile [Delano Mandelbaum]
pkgsrc changes:
- imported and added recommended dependency to Math::Random::MT
- moved List::MoreUtils to run dependencies
Upstream changes:
0.06 Tue Aug 31 15:37:15 JST 2010
* added a parameter 'provider' passed to Crypt::Random.
now you can avoid annoying device lock to set the value for example
to 'udevrandom' (means /dev/urandom), 'rand' etc.
pkgsrc changes:
- add informational dependency to core module Digest::MD5
Upstream changes:
Authen-SASL 2.15 -- Wed Jun 2 13:47:41 CDT 2010
* Makes sure that user callbacks are called [Yann Kerherve]
Authen-SASL 2.1401 -- Mon Mar 29 14:22:54 CDT 2010
* Add META.yml to release
pkgsrc changes:
- switch from gnupg-1 (more or less depreciated) to Crypt::OpenPGP and a
bunch of used encoders and digest modules
- use Module::Install::Bundled module type
- remove patch - works fine with current infrastructure for now
Upstream changes:
[Changes for 0.66 - Fri, 6 Sep 2010 22:51:37 +0200]
* Fix incompatibility with EU::Manifest 1.54 to 1.57
(Paul Howarth) (Closes RT#61124).
[Changes for 0.65 - Fri, 3 Sep 2010 21:38:02 +0200]
* Skip MYMETA (Alexandr Ciornii)
This is an updated version of the liboauth package in pkgsrc-wip by
Kamel Derouiche, modified by myself not to have nss, doxygen, perl and
graphviz pre-requisites.
OAuth (Open Authorization) is an open standard that allows users to
share their private resources (e.g. photos, videos, contact lists)
stored on one site with another site without having to hand out their
username and password.
OAuth allows users to hand out tokens instead of usernames and
passwords to their data hosted by a given service provider. Each
token grants access to a specific site (e.g. a video editing site)
for specific resources (e.g. just videos from a specific album) and
for a defined duration (e.g. the next 2 hours).
Thus OAuth allows a user to grant a third party site access to their
information stored with another service provider, without sharing
their access permissions or the full extent of their data.
OAuth is a service that is complementary to but distinct from OpenID.
liboauth is a collection of C functions implementing the OAuth
Core 1.0 standard API. liboauth provides basic functions to
escape and encode parameters according to OAuth specs and
offers high-level functions to sign requests or verify
signatures.
Necessary these days for twitter applications; useful for flickr and many
others...
* not using autogen.sh anymore, so remove some tools from USE_TOOLS.
* patch-ak does not effect anymore for above reason, add patch-ao for it.
this patch is required to avoid conflict with security/gnupg.
Bump PKGREVISION.
changes:
-bugfixes
-New command --passwd for GPG
-Make use of libassuan 2.0 which is available as a DSO
-The gpg-agent commands KILLAGENT and RELOADAGENT are now available
on all platforms
* Report correct file type in "Detailed information
about changes" section
* Bug fixes
Version 0.14.1
* Added aide-attributes.sh contrib script
* Bug fixes
Version 0.14
* Renewed autoconf mechanism
* Resolved licensing conflicts
* New feature to summarize changes
* Added prelink support
* Many bugfixes
Dnsruby 1.49 now required (for correct zone parsing)
ldns 1.6.6 is required to fix the zone fetcher bug
Bugfixes:
* ods-control stop did not stopped zone fetcher (bug was introduced in 1.1.0)
* Auditor correctly handles chains of empty nonterminals
* Zone fetcher can block zone transfers if AXFR once failed.
This is a bug in ldns versions 1.6.5 and lower.
See KNOWN_ISSUES for more information.
* Bugreport #165: Ensure Output SOA serial is always bigger than Input SOA serial.
* Bugreport #166: Correct exit value from signer.
* Bugreport #167: Zone fetcher now also picks up changes when zonelist is reloaded
* Bugreport #168: ods-control with tightened control for the Enforcer
* Bugreport #169: Do not include config.h in the distribution
* Bugreport #170: Typo in a man page (ods-signer)
* Bugreport #172: Correction of some macros in a man page (ods-timing)
* Bugreport #173: A man page used a macro that does not exist (ods-ksmutil)
Upstream changes:
[Changes for 0.30 - 16 Aug 2010]
* Updated dist metadata and M::I
[Changes for 0.29 (unreleased) - 11 Sep, 2007]
* T::P::P->generate($len) works
* Fix behavior:
T::P::P->new(2,10)->generate(6)
was equivalent to
T::P::P->generate(6,10)
which is too subtle. Now it works just as
T::P::P->generate(6,6)
* Improved warnings on bad arguments
Upstream changes:
0.58 2010-08-25 14:06:30 UTC
- Bump version number for Crypt::SSLeay to 0.58 and Net::SSL to 2.85 in
preparation for release.
- Fix typo in POD is SSLeay.pm s/PEM0encoded/PEM encoded/ (checked
9a1582ee1e/SSLeay.pm)
- Update Changes and TODO. Regenerate README and META.yml. Update package
author. Minor POD fixes.
0.57_05 2010-08-15 17:41:21 UTC
- Fix for NO_PROXY support in Net::SSL (bug #57836)
- Bump Net::SSL version number to 2.84_02 after changes
- Fix file/dir permissions (bug #60338)
- Review warnings when compiling SSLeay.xs against older versions of OpenSSL.
Warnings are due to OpenSSL.
- Add clarification regarding $ENV{HTTPS_CA_FILE} and $ENV{HTTPS_CA_DIR} to the
POD.
- Other POD related changes:
* Remove historic information in README about platforms where the package
was successfully built.
* Reformat acknowledgements. TODO: Add more people.
* Fix link to Net-SSLeay.
* Add note about the --live-tests command line option
* Generate README from POD.
* Formatting fixes.
* Update copyright notice.
0.57_04 2010-08-11 00:22:33 UTC
- Reorganize Makefile.PL to break individual steps in to subroutines so as to
facilitate localized future modifications. Whether there was any point to
this remains to be seen.
- In Makefile.PL, accommodate ActiveState+MingW configuration.
- Pick the correct lib location for Strawberry Perl (bug #60230).
- Apply fixes in bug reports #59312 and #33954 to Net/SSL.pm.
- Bump version number in Net/SSL.pm to indicate development release.
0.57_03 2010-08-09 20:12:30 UTC
- If the last component of $inc_dir is 'openssl', set $inc_dir to its parent
and set $prefix to 'openssl'. Otherwise, leave $inc_dir as is and set $prefix
to '' (I hope this fixes bugs #28431, #28680, #32084, #43084, #54103 without
breaking anything).
- Improved OpenSSL detection on Win32/Strawberry Perl (bug #49285).
- Add MIME::Base64 as a prerequisite as Net::SSL needs it.
- exit 0 if OpenSSL can't be found to avoid superfluous reports from CPAN
Testers.
- Add \ to $opt_bench in eg/net-ssl-test (bugs #30931, #39363).
0.57_02 2010-08-08 18:27:40 UTC
- Refactor the version detection algorithm in Makefile.PL to handle all known
variations of version number encoding. Should fix bug #52408.
0.57_01 2008-02-18 14:42:32 UTC
- use #include <..> rather than #include "..." in
crypt_ssleay_version.h.
- add command-line switch to avoid live tests (bug #30268).
- skip tests in t/01-connect.t if 443 is already in use (bug #30985).
- make code gcc -Wwrite-strings compatible (bug #31926).
to trigger/signal a rebuild for the transition 5.10.1 -> 5.12.1.
The list of packages is computed by finding all packages which end
up having either of PERL5_USE_PACKLIST, BUILDLINK_API_DEPENDS.perl,
or PERL5_PACKLIST defined in their make setup (tested via
"make show-vars VARNAMES=..."), minus the packages updated after
the perl package update.
sno@ was right after all, obache@ kindly asked and he@ led the
way. Thanks!
Noteworthy changes in version 2.0.1 (2010-08-09)
------------------------------------------------
* Support for WindowsCE.
* Input and output notification handler can now really access the
parsed fd as stated in the manual.
* Cleaned up the logging.
* Interface changes relative to the 2.0.0 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
assuan_free NEW.
_assuan_w32ce_create_pipe NEW.
ASSUAN_LOG_CONTROL NEW.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
changes:
-Beautified the qt4 pinentry
-Minor enhancements
Thanks to Sverre Froyen for testing the qt4 version and finding
a patch which makes the dialog stay on top.
Upstream changes:
0.48 Aug 2, 2010
- bug quoting escaped scalars as globs solved
- new faq for "can't change directory"
- support calling shell_quote and shell_quote_args as class
methods
- more tests
- minor doc corrections
== 0.4.1 2010-06-16
* Added support for using OAuth with proxies (Marsh Gardiner)
* Rails 3 Compatibility fixes (Pelle Braendgaard)
* Fixed load errors on tests for missing (non-required) libraries
## The "S" is for "Signs" ##
*SOAuth* is a Ruby library that **creates HTTP headers for OAuth Authorization**
using previously-obtained OAuth keys/secrets. Useful if you want to make your
own HTTP request objects instead of using the ones created for you using the
[commonly-used OAuth gem](security/ruby-oauth).
It should be noted that this was developed without edge cases in mind -- it was
pretty much abstracted from my "by-hand" signing of OAuth requests in [Prey
Fetcher](http://preyfetcher.com), so don't consider it production-quality code
(though it [is running in production](http://preyfetcher.com)).
Upstream changes:
0.47 Apr 13, 2010
- document how to make it work under Solaris
- some docs reorganization and improvements
0.46_02 Mar 29, 2010
- add suport for default_stdin_file, default_stdin_discard and
similar options
- add stdinout_socket feature and open2socket shortcut method
- rename some internal methods to more meaningfull names
- add open_tunnel and capture_tunnel methods
- add support for tunnel feature and docs
- document mod_perl/mod_perl2 integration
- document not-a-real-file-handle errors
- some minor doc updates
- run tests with StrictHostKeyChecking=no
- disable tty allocation for control commands
- better debugging for _io3
0.46_01 Mar 25, 2010
- do not depend on STDIN, STDOUT and STDERR being file
descriptors 0, 1, and 2 respectively as it happens, for
instance, under mod_perl (bug report by eserte via
PerlMonks)
- use POSIX::dup2 to duplicate file descriptors, instead of
perl open builtin
- set stdin_discard to when running control commands as it may
be closed or tied
- better debugging for waitpid and _io3
- error in example in documentation corrected (reported by
Slaven Rezic)
pkgsrc changes:
- add license definition
Upstream changes:
0.28 Do 3. Jun 12:11:21 UTC 2010
- Fixed Lenght-problem in typemap, T_BUFFER_STR_OUT for Heimdal.
Thanks to Slaven Rezic <slaven@rezic.de> for report and patch.
pkgsrc changes:
- adjust dependencies
Upstream changes:
2010-07-03 - Release 2.40 - Gisle Aas <gisle@ActiveState.com>
Marc Pignat (1):
Safer alignment test [RT#35823]
Robin Barker (1):
consting in new ext/
Gisle Aas (1):
Remove the MacOS branch of this test
* New variants of the TIGER algorithm.
* New cipher algorithm mode for AES-WRAP.
* Interface changes relative to the 1.4.2 release:
GCRY_MD_TIGER1 NEW.
GCRY_MD_TIGER2 NEW.
GCRY_CIPHER_MODE_AESWRAP NEW.
While one would expect a python wrapper for a library to link with the
library, this packages's source has files from crypto++, and it
doesn't try to link against the installed crypto++.
Python extensions using OpenSSL which contains hashing algorithms,
This package more or less supersedes py-amkCrypto.
chaffing/winnowing, random number generation, various utility modules,
and several block encryption and digital signature algorithms.
Bugfixes:
* Bugreport #127: Large SOA serial numbers were not handled properly by signer
* Bugreport #133: Better handling of SOA serial when setting is 'keep'
* Bugreport #136: quicksorter could not handle standard bind format SOA rdata
* The Auditor could not handle the new way of rolling KSKs
* One log message in the Enforcer referred to an old command
* The Enforcer forgot to publish certain keys during transition between states
changes:
-bugfixes
-Add dbus activation service file for org.freedesktop.secrets
pkgsrc note: removed dependency on libgnome-keyring; child pkgs
should have been updated to list this dependency explicitely
Major changes between sudo 1.7.2p7 and 1.7.2p8:
* Fixed a crash on AIX when LDAP support is in use.
* Fixed problems with the QAS non-Unix group support
crpytographic PKCS#11 tokens such as smart cards and usb crypto
tokens for local authentication.
Pam_p11 implements two authentication modules:
* pam_p11_openssh authenticates the user against public keys found
in OpenSSH ~/.ssh/authorized_keys file.
* pam_p11_opensc authenticates the user against certificates found
in ~/.eid/authorized_certificates.
pkgsrc changes:
* Fix PKGNAME to really intended to.
* Some permission problem with using scan-mail.pl
6.0.3 (Initially NetBSD only):
- Scanning inside NSIS (Nullsoft) installer files
- Generic IFRAME exploit detection
- Numerous additions to the Eldorado heuristic engine, making it
significantly more powerful than before - Scanning of 7-Zip, ACE
and "solid RAR" archives - Improved scanning of JavaScript files
- List of detected malware now includes Eldorado heuristic detections
- Much faster initial loading of ANTIVIR.DEF
- Scan engine updated
* Partial Auditor added
* Dnsruby-1.46 required
* Improved error messages when the system runs out of keys
* Optimise communication of signconfs for multiple zones sharing keys.
Group zones in zonelist.xml by policy to get this benefit.
* Bugreport #101: Signer Engine now maintains its own pidfile.
* Jitter redefined: now in the range of [-jitter, ..., +jitter]
* Optimized sorter: quicksorter (sorter becomes obsolete).
* Optimized zone_reader, includes nseccing/nsec3ing (nseccer and nsec3er
become obsolete).
* Enable database selection using --with-database-backend={sqlite3|mysql}
* Enable the EPP-client using --enable-eppclient
For sending DS RR to the parent zone (experimental)
* Turn NSEC3 OptOut off by default
* Install kasp2html XML stylesheet
* Add simple kasp2html conversion script
* DNSKEY records communicated to an external script if configured
* The command 'ods-signer restart' is removed.
* Signer Engine now also reuses signatures after a change in NSEC(3)
configuration or rolling keys.
* Quicksorter defaults to class IN.
And a lot of bugfixes...
* authldapescape.c: Factor out LDAP string escape function.
* authldap.schema: Various fixes
* authldap.ldif (olcObjectClasses): Create LDIF format schema from
authldap.schema
* authoption.c (auth_getoptionenvint): For account options that
are parsed to an int, an option value that begins with t, T, y, or Y
is evaluated as 1, other alphabetic values as 0; so that 'true'
or 'yes' get evaluated as 1.
(See the Changelog for the previous releases)
Based on patch(es) from PR pkg/42989 by Brian Candler
The patch looks wrong to me, though, because stdint.h should be
generated in lib/gllib/ if the system does not have it (or if it is not
correct), and the -I's should make the code find the local file instead.
Thus, the code should be able to unconditionally include the header
file.
(missed those and *emacs* the first time round because they pull
in their png dependencies via default-on options; they were included
in the test bulk build though)
Lots of changes, including
* After a transition period of about 10 years, this release disables
SSH protocol 1 by default. Clients and servers that need to use the
legacy protocol must explicitly enable it in ssh_config / sshd_config
or on the command-line.
* Remove the libsectok/OpenSC-based smartcard code and add support for
PKCS#11 tokens. This support is automatically enabled on all
platforms that support dlopen(3) and was inspired by patches written
by Alon Bar-Lev. Details in the ssh(1) and ssh-add(1) manpages.
* Add support for certificate authentication of users and hosts using a
new, minimal OpenSSH certificate format (not X.509). Certificates
contain a public key, identity information and some validity
constraints and are signed with a standard SSH public key using
ssh-keygen(1). CA keys may be marked as trusted in authorized_keys
or via a TrustedUserCAKeys option in sshd_config(5) (for user
authentication), or in known_hosts (for host authentication).
Documentation for certificate support may be found in ssh-keygen(1),
sshd(8) and ssh(1) and a description of the protocol extensions in
PROTOCOL.certkeys.
* Added a 'netcat mode' to ssh(1): "ssh -W host:port ..." This connects
stdio on the client to a single port forward on the server. This
allows, for example, using ssh as a ProxyCommand to route connections
via intermediate servers. bz#1618
This switches to the gnome-2.30 release branch
pkgsrc note: temporarily add a dependency on libgnome-keyring which
was split out of the old gnome-keyring pkg, so that client pkgs
get the same as before
Noteworthy changes in version 1.8 (2010-05-06)
----------------------------------------------
* Support for WindowsCE.
* New option --list for gpg-error.
* Interface changes relative to the 1.7 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GPG_ERR_NOT_ENABLED NEW.
GPG_ERR_SOURCE_G13 NEW.
GPG_ERR_NO_ENGINE NEW.
gpg_err_set_errno NEW.
* May 26 2010
Changes in XML Security Library 1.2.16 release:
* New xmlsec-gcrypt library.
* xmlsec-gcrypt: Added RSA with SHA1/SHA256/SHA384/SHA512/MD5/RIPEMD160, DSA
with SHA1, AES/DES KW support.
* xmlsec-gnutls: Added X509 support and converted the library to use xmlsec-
crypt library for all crypto operations.
* xmlsec-mscrypto: RSA/OAEP and AES/DES KW support.
* Several minor bug fixes and code cleanups.
* April 29 2010
Changes in XML Security Library 1.2.15 release:
* xmlsec-mscrypto: Added HMAC with MD5, SHA1, SHA256/384/512; RSA with MD5,
SHA256/384/512 support.
* xmlsec-mscrypto: Converted to Unicode (the non-Unicode builds are still
available as compile time option).
* xmlsec-nss: Added MD5 and SHA256/384/512 support for digest, HMAC and RSA
(the new minimum required version for NSS library is 3.9).
* xmlsec-gnutls: Added SHA256/384/512 for digest and HMAC; MD5 and RIPEMD160
digests support (the new minimum required version for GnuTLS library is
2.8.0).
* Fixed typo: "Copyrigth" should be "Copyright".
* Several critical bug fixes and code cleanups.
* December 5 2009
Changes in XML Security Library 1.2.14 release:
* XMLSec library is switched from built-in LTDL library to the system LTDL
library on Linux/Unix and native calls on Windows to fix security issue
(CVE-2009-3736) in LTDL.
* Fixed minor bugs (see log for complete list).
* Noteworthy changes in release 2.7 (2010-05-20) [stable]
- Doc: Build a PDF manual using GTK-PDC.
- Doc: Fix of asn1_check_version, documentation was missing from last release.
- Build: Avoid warnings about ignored visibility attributes on Windows.
For more detail: http://www.sudo.ws/sudo/alerts/secure_path.html
Summary:
Sudo "secure path" feature works by replacing the PATH environment
variable with a value specified in the sudoers file, or at
compile time if the --with-secure-path configure option is used.
The flaw is that sudo only replaces the first instance of PATH
in the environment. If the program being run through sudo uses
the last instance of PATH in the environment, an attacker may
be able to avoid the "secure path" restrictions.
Sudo versions affected:
Sudo 1.3.1 through 1.6.9p22 and Sudo 1.7.0 through 1.7.2p6.
