Changes from previous;
0.171 Tue Aug 09 13:09:00 BST 2011
- re-disting because I failed to notice MYMETA.* in the dist
0.170 Tue Aug 09 12:17:00 BST 2011
- fix user inflation code to handle arbitrary usernames
Taking a hint from the similarly-named Java Cryptography Architecture,
QCA aims to provide a straightforward and cross-platform crypto
API, using Qt datatypes and conventions. QCA separates the API from
the implementation, using plugins known as Providers. The advantage
of this model is to allow applications to avoid linking to or
explicitly depending on any particular cryptographic library. This
allows one to easily change or upgrade crypto implementations
without even needing to recompile the application. QCA should work
everywhere Qt does, including Windows/Unix/MacOSX.
Capabilities:
TLS, CMS, X.509, RSA, DSA, Diffie-Hellman, PKCS#7, PKCS#12, SHA0,
SHA1, SHA224, SHA256, SHA384, SHA512, MD2, MD4, MD5, RIPEMD160,
Blowfish, DES, 3DES, AES128, AES192, AES256, CAST5, HMAC(SHA1, MD5,
RIPEMD160), PBKDF1(MD2, SHA1), PBKDF2(SHA1)
This is the GnuPG plugin.
Packaged by jfranz@bsdprojects.net.
1.17 2011.06.16
- Upgrade to Module::Install 1.01
- Added support for OpenSSL 1.0.0 dsaparam format change.
- Requires perl 5.6 now
- Fixes for 64-bit support
While here, fix SA46275, with upstream patch from
https://rt.cpan.org/Public/Bug/Display.html?id=71421
f-prot-antivirus6-ws-bin
f-prot-antivirus6-fs-bin
f-prot-antivirus6-ms-bin
pkgsrc change:
* Now binary of F-PROT Antivirus are built on NetBSD 4, previously it 2.
And it works on not only i386 but also amd64 netbsd32 compat.
From CHANGES:
* Scan engine upgraded from 4.5.1 to 4.6.2 with improved detection rates and
fewer false positives.
* Fixes and clarification in documentatioon.
* New switches introduced in fpscan.
* Bugfix in fpscand resolves some rare issues on OpenBSD.
* Bugfix in fpupdate resolves compatibility issues on some Linux distros.
* Bugfix in fp-milter resolves issues on BSDs.
* Bugfix in fp.so resolves some issues on multiple platforms.
* Bugfix on fpupdate for AIX resolves an rare issue.
* Minor fixes to scan-mail.pl to improve filehandling.
* Minor improvements in the installer.
* Startup scripts improved for several platforms.
Bugfixes:
* Bugfix #257: Error in ods-signerd, where a corrupted backup file results
in an invalid pointer free().
* Signer Engine: Mark that a zone has a valid signer configuration, after
recovering the zone from the backup files.
OpenDNSSEC 1.3.1
Bugfixes:
* Auditor: Fix 'ZSK in use too long' message to handle new signer behaviour.
* Bugfix #255: RHEL6 patch to contrib/opendnssec.spec. (Rick van Rein)
* Bugfix #256: Make sure argument in "ods-control signer" is not stripped off.
* Bugfix #259: ods-ksmutil: Prevent MySQL username or password being interpreted
by the shell when running "ods-ksmutil setup".
* Bugfix #260: "ods-ksmutil zone list" now handles empty zonelists.
* Enforcer: Unsigned comparison resulting in wrong error message.
* ods-ksmutil: fixed issue where first ds-seen command run on a zone would work,
but return an error code and not send a HUP to the enforcerd.
* Signer Engine: A threading issue occasionally puts the default validity
on NSEC(3) RRs and the denial validity on other RRs.
* Signer Engine: An update command could interrupt the signing process and the
zone would get missing signatures.
* Signer Engine: Fix an issue where some systems could not copy the zone file.
* Zonefetcher: Check inbound serial in transferred file, to prevent
redundant zone transfers.
* Can now read CKA_ALWAYS_AUTHENTICATE but does not use it.
* Encryption and decryption using CKM_RSA_PKCS.
* Support X.509 certificates. (Patch from Thomas Calderon)
* Updated backup instructions.
* Only a Security Officer can set CKA_TRUSTED to true.
* The softhsm tool can set the value of CKA_TRUSTED.
* Support Botan 1.10.0.
* Better signing performance with a single element cache for
the PK_Signer object.
* Document README.MinGW describes how to build on Windows.
(Text and patches contributed by Jaroslav Imrich)
Bugfixes:
* API changes in Botan created a namespace collision.
* API changes in Botan's state handling.
* BigInt::to_u32bit was accidently dropped in Botan. Adding it
as a compatibility function to SoftHSM.
* Better exception handling.
* CKF_USER_PIN_COUNT_LOW and CKF_SO_PIN_COUNT_LOW must be set
if an incorrect PIN has been entered at least once.
* Windows: Detect LoadLibrary.
* Windows: Set CRYPTOKI_EXPORTS.
* Windows: Load library correctly in softhsm.
* Windows: Compatibility function for getpass.
* Windows: Use _putenv and not setenv.
* Windows: Generate the DLL file.
* Windows: The softhsm tool will use the DLL file by default.
* Windows: Log to EventLog.
* Windows: Fix parsing of configuration file.
* Windows: The check program now links with a shared libgcc in order to
make the exceptions work.
Known issue:
* Firefox does improper setting of CKA_DERIVE attribute during PKCS#12
import. See https://bugzilla.mozilla.org/show_bug.cgi?id=515663
Take maintainership.
New in 2.1.25
-------------
* Make sure that a failed authorization doesn't preclude
further server-side SASL authentication attempts from working.
* Fixed a crash caused by aborted SASL authentication
and initiation of another one using the same SASL context.
* (Windows) Fixed the random number generator to actually produce random
output on each run.
* Be protective against calling sasl_server_step once authentication
has failed (multiple SASL plugins)
* Fixed several bugs in the mech_avail callback handling
in the server side code.
* Added support for channel bindings
* Added support for ordering SASL mechanisms by strength (on the client side),
or using the "client_mech_list" option.
* server_idle needs to obey server's SASL mechanism list from the server
context.
* Better server plugin API mismatch reporting
* Build:
- Updated config to the latest GNU snapshot
- Fixed SASL's libtool MacOS/X 64-bit file magic
* New SASL plugin: SCRAM
* New SASL plugin: GS2
* DIGEST-MD5 plugin:
- Allow DIGEST-MD5 plugin to be used for client-side and
server-side HTTP Digest, including running over non-persistent
connections (RFC 2617)
- Use the same username for reauthentication cache lookup and update
- Minimize the number of auxprop lookups in the server side DIGEST-MD5
plugin for the most common case when authentication and authorization
identities are the same.
- Updated digestmd5_server_mech_step2() to be more defensive against
empty client input.
- Fixed some memory leaks on failed plugin initialization.
Prevent potential race condition when freeding plugin state.
Set the freed reauthentication cache mutex to NULL, to make errors
due to mutex access after free more obvious.
- Test against broken UTF-8 based hashes if calculation using special
ISO-8859-1 code fails.
- Fixed an interop problem with some LDAP clients ignoring server
advertised realm and providing their own.
* GSSAPI plugin:
- Fix to build GSSAPI with Heimdal
- Properly set serveroutlen to 0 in one place.
Don't send empty challenge once server context establishment is done,
as this is in violation of the RFC 2222 and its successor.
- Don't send maxbuf, if no security layer can be established.
Added additional checks for buffer lengths.
* LDAPDB plugin:
- build fixes
New in 2.1.24
-------------
* Order advertised server-side SASL mechanisms per the specified 'mech_list'
option or by relative "strength"
* Make sure that sasl_set_alloc() has no effect once sasl_client_init()
or sasl_server_init() is called
* Fixed sasl_set_mutex() to disallow changing mutex management functions
once sasl_server_init()/sasl_client_init() is called (bug # 3083)
* Removed unused mutexes in lib/client.c and lib/server.c (bug # 3141)
* Added direct support for hashed password to auxprop API
* Don't treat a constraint violation as an error to store an auxprop property
* Extended libsasl (auxprop) to support user deletion
* Extended SASL auxprop_lookup to return error code
* Updated sasl_user_exists() so that it can handle passwordless accounts (e.g. disabled)
* (Windows) Free handles of shared libraries on Windows that were loaded
but are not SASL plugins (bug # 2089)
* Prevent freeing of common state on a subsequent call to _sasl_common_init.
Make sure that the last global callback always wins.
* Implemented sasl_client_done()/sasl_server_done()
* Added automatic hostname canonicalization inside libsasl
* Made sasl_config_init() public
* Strip trailing spaces from server config file option values (bug # 3139, bug # 3041)
* Fixed potential buffer overflow in saslautd_verify_password().
* Fixed segfault in dlclose() on HPUX
* Various bugfixes for 64bit platforms
* Fixed bug # 2895 (passing LF to sasl_decode64) in sample/sample-client.c,
sample/sample-server.c, utils/smtptest.c
* pluginviewer: Code cleanup, improved human readable messages
* Build:
- (Windows) Updated makefiles to build with VC 8.0 (VC++ 2005)
- (Windows) Added Windows64 build
- Updated to use .plugin extension on MacOS
- Changed 64bit HP-UX build to use .so for shared libraries
* saslauthd:
- Fixed bug counting double-quotes in username/password in
auth_rimap.c. Also fixed bug zeroing password.
- auth_krb.c: improved diagnostic in the k5support_verify_tgt() function.
- auth_sasldb.c: pid_file_lock is created with a mask of 644 instead of 0644
- auth_shadow.c: Define _XOPEN_SOURCE before including unistd.h,
so that crypt is correctly defined
- auth_getpwent.c: Fixed Solaris build
* SASLDB plugin:
- Fixed spurious 'user not found' errors caused by an attempt
to delete a non-existent property
- Added direct support for hashed password to auxprop API
- Sleepycat driver: Return SASL_NOUSER instead of SASL_FAIL when the database
file doesn't exist
- Ignore properties starting with '*' in the auxprop store function
* SQL plugin:
- Added support for SQLITE3
- Uninitialized variables can cause crash when the searched user is not found
- Added direct support for hashed password
- Ignore properties starting with '*' in the auxprop store function
* LDAPDB plugin:
- Added code to extend LDAPDB into a canon_user plugin in addition
to its existing auxprop plugin functionality
* PLAIN plugin:
- Advertise SASL_SEC_PASS_CREDENTIALS feature
* LOGIN plugin:
- Advertise SASL_SEC_PASS_CREDENTIALS feature
* DIGEST-MD5 plugin:
- Fixed a memory leak in the DIGEST-MD5 security layer
- Fixed memory leaks in client-side reauth and other places
- More detailed error reporting.
- Fixed parsing of challenges/responses with extra commas.
- Allow for multiple qop options from the server and require
a single qop option from the client.
* GSSAPI plugin:
- Check that params->serverFQDN is not NULL before using strlen on it
- Make auxprop lookup calls optional
* EXTERNAL plugin:
- Make auxprop lookup calls optional
* NTLM plugin:
- allow a comma separated list of servernames in 'ntlm_server' option
- Fixed crash in calculating NTv2 reponse
* OTP plugin:
- Don't use a stack variable for an OTP prompt (bug # 2822)
- Downgrade the failure to store OTP secret to debug level
* KERBEROS_V4 plugin:
- Make auxprop lookup calls optional
NEWS for the 2.4 release
This is a bugfix release only. It turned out ripemd160 in the
2.3 release was broken on all big-endian systems, due to a
missing include of config.h. nettle-2.4 fixes this.
The library is intended to be binary compatible with
nettle-2.2 and nettle-2.3. The shared library names are
libnettle.so.4.3 and libhogweed.so.2.1, with sonames still
libnettle.so.4 and libhogweed.so.2.
NEWS for the 2.3 release
* Support for the ripemd-160 hash function.
* Generates and installs nettle.pc and hogweed.pc files, for
use with pkg-config. Feedback appreciated. For projects
using autoconf, the traditional non-pkg-config ways of
detecting libraries, and setting LIBS and LDFLAGS, is still
recommended.
* Fixed a bug which made the testsuite fail in the GCM test on
certain platforms. Should not affect any documented features
of the library.
* Reorganization of the code for the various Merkle-Damg
hash functions. Some fields in the context structs for md4,
md5 and sha1 have been renamed, for consistency.
Applications should not peek inside these structs, and the
ABI is unchanged.
* In the manual, fixed mis-placed const in certain function
prototypes.
The library is intended to be binary compatible with
nettle-2.2. The shared library names are libnettle.so.4.2 and
libhogweed.so.2.1, with sonames still libnettle.so.4 and
libhogweed.so.2.
in its stable branch (ie firefox-6.0.2) too,
so deal with this in the mozilla-rootcerts script (this is not great -
it depends on syntactic details of the file where it should better
use checksums, but the perl script which is distributed with "curl"
works the same way),
and switch back to the certificate list in CVS HEAD
