upstream changelog:
Changes in 2.6.5
* A new step in INN development has been achieved with the migration of
the INN project to GitHub. We now make use of the features GitHub
provides: issue tracker, pull requests, continuous integration, a
user-friendly interface to browse the code, etc. Our Subversion
repository has therefore been migrated to Git, and our Trac tickets to
the GitHub issue tracker.
* An up-to-date nocem.ctl file is provided with this release. You
should manually update your nocem.ctl file with the new information
recorded about NoCeM issuers, and make sure the right PGP keys are
present on your system.
* Up-to-date control.ctl and moderators files are provided with this
release. You should manually update them (notably for the fido7.*
hierarchy).
* Added a stricter validation of article numbers given in NNTP commands
so that numbers superior to 2^31 are correctly considered invalid.
Thanks to Richard Kettlewell for the patch.
* Added a check in rc.news for the existence of the *pathrun* directory.
INN won't start until this directory is writable. Previously, it
bailed out quickly after starting, without clear logs about why it
failed.
* Fixed parallel builds using "make -j". Thanks to Richard Kettlewell
for the path.
* nnrpd now properly gathers timer statistics when a compression layer
is active.
* nnrpd now properly discards data received from a news client after a
timeout when a TLS layer is active. It previously tried to read
incoming data before closing the socket, leading to decoding errors
from an underlying compression or SASL layer.
* innfeed and ovdb_stat now generate status reports in valid HTML
syntax.
* Fixed a bug in the buffindexed overview that prevented it from working
on several systems, amongst them FreeBSD. Unsupported, and useless,
permission bits were given to semaphores.
* Fixed the detection of library paths at configure time: multilib
directories (lib32 or lib64) are now also used if they exist, even it
the system does not use multilib. It will notably fix the detection
of the OpenSSL 3.0.0 library.
* The *tlscertfile* parameter in inn.conf now permits the use of a
complete certificate chain, instead of necessarily having to use
*tlscafile* for additional certificates.
* Added support for the new OpenSSL 3.0.0 API, which deprecated a few
functions.
* The inn.conf default value for *tlsprotocols* no longer contains TLS
versions 1.0 and 1.1, which have been deprecated by RFC 8996.
* A new inn.conf parameter has been added to tune the length of the
queue of pending connections to innd, nnrpd and the "ovdb" overview
storage method: the *maxlisten* parameter now permits configuring
their listen backlog, whose previously hard-coded values were 128 for
nnrpd and 25 for the others, which was not high enough for some uses.
The default value is now 128 for all of them, and configurable in
inn.conf. Thanks to Kevin Bowling for the patch.
* The name of seven man pages for routines built in libinn(3) are now
prefixed with libinn_ so as not to consume namespace and conflict with
other packages (notably, the list(3) and uwildmat(3) man pages are now
named libinn_list(3) and libinn_uwildmat(3)).
* Other minor bug fixes and documentation improvements, notably a
revised installation checklist and a section summarizing the most used
configuration at the beginning of a few complex man pages.
Changes in 2.6.4
* Added support for systemd notifications and socket activation. Use of
more features provided by systemd, including more notifications, will
come in future releases. Thanks to Marco d'Itri for this first
systemd integration into INN.
* nnrpd now adapts the length of the DH parameter used during a DHE key
exchange so as to comply with the security level OpenSSL 1.1.0 or
later expects. Thanks to Michael Baeuerle for the bug report.
* cnfsstat now also returns information about retired CNFS buffers:
buffers mentioned in cycbuff.conf as a cycbuff but not declared in a
metacycbuff.
* Switch default innreport behaviour to the common practice of
externalizing CSS into a separate file. Its name can be configured
with the *html_css_url* parameter in innreport.conf. If this
parameter is unset, the default innreport.css file name will be used
and innreport will generate this CSS file for you. Previously
generated reports are kept untouched, though, and will still contain
inline CSS if you had not already set the *html_css_url* parameter in
previous INN versions. Thanks to Richard Kettlewell for the patch.
* sm can now read and store any number of articles given in wire format
on its standard input when both -s and -R are used. Only native
format was previously possible. Thanks to Bo Lindbergh for the patch.
* Added new -a flag to rnews to disallow, if needed, the use of
additional unpackers from the rnews.libexec sub-directory of *pathbin*
(as set in inn.conf); only "rnews" and "cunbatch" will then be
recognized as valid batch commands.
* Added new -b flag to rnews to save rejected articles in the bad
sub-directory of *pathincoming* (as set in inn.conf). Otherwise,
rnews just logs and discards any articles that are rejected or cannot
be parsed for some reason.
* Added new -d flag to rnews to log via syslog the Message-ID and the
Path header value of each article rejected as a duplicate.
* Added new --enable-hardening-flags configure-time option, enabled by
default, to use hardening build flags like "-fPIE" and
"-fstack-protector-strong". This option can easily be disabled if the
compiler or the platform does not support them well. More hardening
build flags will eventually be added in future releases.
q
60e140d677