Abort package installation if alternatives fail to install #96
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* 2016-09-22: version 1.37 - added initial test suite - testing using travis-ci (https://travis-ci.org/schweikert/postgrey) - removed IP pool-detection code for --lookup-by-net, because it matched also the naming of some big hosters like facebook (NetBSD#32, Michal Petrucha, Andrew Ayer, Jon Sailor) - fix early logging of errors and warnings to syslog - simplified IP matching code - added support for IPv6 whitelists with netmask - add network-range based whitelist for Office 365 (Holger Stember) - updated whitelist
LibPST 0.6.76 (2021-03-27)
* Stuart C. Naifeh - fix rfc2231 encoding when saving messages
to both .eml and .msg formats.
v3.4:
* t-prot, t-prot.1: Release as t-prot 3.4.
* t-prot, t-prot.1: Make documentation match Getopt::Long syntax:
e.g. -c=1 is not supported, use -c1 instead.
v3.3:
* t-prot: Release as version 3.3.
* t-prot: Removed trailing whitespace.
* t-prot: Small speedup: Run --pgp-short specific code only with
--pgp-short.
* t-prot: Fixed a bug with -Mmutt and pgp signed and encrypted
MIME/Multipart messages. Thanks to Axel Beckert for reporting!
v3.2:
* t-prot: Release as version 3.2.
* t-prot: Make bigq work when MS Tofu is detected with no text
above the quote, as with ZimbraWebClient.
* t-prot.1: Fix spelling error.
* t-prot.1: Update date string.
v3.1:
* t-prot: Release as t-prot v3.1.
* t-prot, t-prot.1: Support mutt-kz
(https://github.com/karelzak/mutt-kz) using -Mmutt-kz. Many
thanks to Hugo Roy for testing and reporting.
* t-prot: Unicode fix for MS Outlook.
v3.0:
* t-prot: After a very long testing phase, finally the version
update to 3.0.
* t-prot: Umlauts always are so wrong. Hopefully Outlook mails in
German are handled fine now.
* t-prot.1: Make clear that --pgp-move and --pgp-move-vrf also work
on SSL output.
* t-prot: Coding style cleanup in pgp().
* t-prot: Fix detection of unified diffs in the message body when
using --diff.
* t-prot.1: Update year.
* contrib/t-prot.sl: Reflect transition to slang2 in comments.
* contrib/t-prot.sl: Drop support for slang-1, default to slang-2.
* t-prot, contrib/muttrc.t-prot: Drop support for mutt-1.4. Default
to mutt-1.5.x strings.
* t-prot: Fix eYou Webmail Tofu.
* t-prot: Fix text/plain content-type detection with several user
agents.
v2.101:
* t-prot: Release as v2.101.
* t-prot: Add just another of mutt's decryption messages to the
list. This seems not to be translated yet, so no gettext() is
inserted this time.
v2.100:
* t-prot: Release as v2.100.
* t-prot: Add line to make -m filter Lotus Domino Webserver
produced TOFU.
* t-prot: Use uniform syntax notation for parameters in command
line options.
* t-prot.1: Use uniform syntax notation for parameters in command
line options.
v2.99:
* t-prot: Release as v2.99.
* t-prot, t-prot.1: New command line option --fixind to fix broken
quoting (regarding to RFC 3676). Perhaps this should not be
default, as there might be false positives if the message is
already quoted correctly. Quotes with this particular brokenness
are quite common, though. Patch by Simon Ruderich, many thanks.
* t-prot: Use index() instead of regex for $indent. Patch by Simon
Ruderich.
* t-prot: Revert new handling of empty lines at the beginning of
the body, as it removes lines where it should not.
* t-prot: Another bug with -c: Empty lines before the signature
were not handled properly. Patch by Simon Ruderich.
* t-prot: This causes -c1 to not create an empty line at the
beginning of the message if there were empty lines at the start
of the body. Patch by Simon Ruderich.
* t-prot, t-prot.1: Typos and documentation fixes regarding
$indent. Many thanks to Simon Ruderich.
v2.98:
* t-prot: Release as v2.98.
* t-prot.1: Clarify --lax-security description.
* t-prot: Use descriptive temp variable names when parsing command
line.
* t-prot.1: Mention configuration files for Heirloom mailx and
metamail. Avoid false impression with --lax-security.
* t-prot.1: Another Typo.
* t-prot.1: Fix spelling error. Thanks to Gerfried Fuchs!
v2.97:
* t-prot: Release as v2.97.
* t-prot, t-prot.1: Standard diff(1) output now is protected by
--diff, too. Many thanks to Martin Neitzel and Matthias Kilian.
v2.96:
* t-prot: Release as v2.96.
* t-prot: Allow -o /dev/null without bitching around.
* t-prot.1: Give some emergency help how to write to /dev/null. You
never know.
* t-prot.1: Remove repetition.
* t-prot: More syntax help fixes.
* t-prot.1: Update date string.
* t-prot.1: Fix --version description.
* t-prot.1: More syntax fixes.
* t-prot.1: Change option order for footer options.
* t-prot.1: More grouping: Footers.
* t-prot.1: Fix typo.
* t-prot, t-prot.1: Special output to "NONE" is not required. You
can use /dev/null.
* t-prot.1: Improve word flow.
* t-prot.1: Fix -i and -o syntax.
* t-prot.1: Improve MIME handling description.
* t-prot.1: Explain grouping of options and what happens if none
are specified. Be specific how MIME is handled.
* contrib/: mailcap.t-prot, nailrc.t-prot: New files: configuration
samples for metamail and Heirloom mailx (a.k.a. nail). Many
thanks to Martin Neitzel!
* t-prot.1: Fix -S syntax.
* t-prot: Fix -S syntax help.
* t-prot.1: Group options by meaning, rather than alphabetically.
Thanks to Martin Neitzel for suggesting.
* t-prot: Fix --help output order.
* t-prot: Fix -c syntax in --help, too.
* t-prot.1: Precisify wording for --ms-smart.
* t-prot.1: Be a little more specific as to what --ms-smart really
does.
* t-prot.1: Specify more clearly what locale to specify with
--locale. Thanks to Martin Neitzel for suggesting.
* t-prot.1: Fix -c syntax help.
* t-prot: Fix bad typo. Thanks to Martin Neitzel.
v2.95:
* t-prot: Big changes, we step a great deal towards the next major
version number. Release as v2.95.
* t-prot: Since Getopt::Mixed would break existing configurations
with the new -c command line switch behaviour, the migration to
Getopt::Long has been finished by now: This commit merges the big
bad Getopt::Long patch. Hope the performance issue does not turn
out to be too grave. Thanks to everyone for testing and providing
feedback.
* t-prot, t-prot.1, contrib/muttrc.t-prot, contrib/t-prot.sl: The
command line option -c now accepts an optional parameter
specifying the number of empty lines to remain. Thanks to Simon
Ruderich.
* Changes in release 0.8.5 Various changes to make it compile with newer g++ and libcrypto. Manually parse /etc/resolv.conf, rather than attempting to make use of the res data structure (which at least on OpenBSD no longer actually contains the addresses of resolvers).
Version 3.12.1 fixes a number of bugs: - Fixed a bug that caused a multi-document transaction to fail when the first operation was large bulk write (>48MB) that required splitting a batched write command (`PYTHON-2915`_). - Fixed a bug that caused the ``tlsDisableOCSPEndpointCheck`` URI option to be applied incorrectly (`PYTHON-2866`_).
2.6.0: Unknown changes
Explain that we should probably use cmake's RPATH support instead of turning it off and passing it via LDFLAGS, but that this change seems somewhat risky. (This is a comment-only change.)
Packaging changes:
Use cmake instead of the now-deleted autotools, introducing a
regression in "make test" where the installed version is tested
instead of the build tree version.
Upstream changes:
Changes in 3.10.0
2021-10-20
- New things:
- CAPI: GEOSDistanceWithin, GEOSPreparedDistanceWithin
(#1124, Sandro Santilli)
- Output WKT using positional precision with the ryu
library (#868, Paul Ramsey)
- geosop CLI for GEOS (Martin Davis)
- Full doxygen of the C-API (Paul Ramsey)
- GeometryFixer class for validity enforcement (Martin Davis, Paul Ramsey)
- CAPI: GEOSDensify (Brendan Ward)
- CAPI: GEOSCoordSeq_copyFromArrays, GEOSCoordSeq_copyFromBuffer,
GEOSCoordSeq_copyToArrays, GEOSCoordSeq_copyToBuffer (Daniel Baston)
- CAPI: GEOSMakeValidWithParams new validity enforcement approach from
locationtech/jts#704, uses GeometryFixer
(Paul Ramsey, Martin Davis)
- CAPI: GEOSWKBWriter_getFlavor, GEOSWKBWriter_setFlavor support
outputting ISO or Extended WKB flavors (#466, Paul Ramsey)
- CAPI: GEOSConstrainedDelaunayTriangulation, builds a constrained
triangulation of an input Polygon or MultiPolygon,
returning a GeometryCollection(Polygon) of the triangles.
- Fixes/Improvements:
- Preserve ordering of lines in overlay results (Martin Davis)
- Check for invalid geometry before fixing polygonal result in Densifier
and DPSimplifier (Martin Davis)
- Fix overlay handling of flat interior lines (JTS-685, Martin Davis)
- Fix IsValidOp to correctly report invalid nested MultiPolygons (#1112, Martin Davis)
- Fix BufferOp to avoid artifacts in certain polygon buffers (#1101, Martin Davis)
- Fix IsValidOp to correctly report certain kinds of invalid LinearRings (Martin Davis)
- Improve STRtree performance through TemplateSTRtree implementation (Daniel Baston)
- Fix DiscreteFrechetDistance to use initial points of input lines (#1128, Martin Davis)
- Changes:
- Autoconf build system is dropped in favour of CMake
See README.md and INSTALL.md for examples of usage
- Libtool is no longer used for in favour of CMake
Therefor libgeos.la is no longer built/installed
- #1094, #1090: Drop inlines.cpp to address duplicate symbols on many platforms
(Regina Obe)
- GH475: Do not return NaN from GEOSProjectNormalized_r (Paul Ramsey)
- GH442: BufferOp now returns unique_ptr<Geometry> result (Paul Ramsey)
and whitespace rationalization
Changes in version 1.14.6, released on September 23, 2021
--- MAJOR NEW FEATURES ---
* mdoc(7): automatic tagging improved in many respects
* mdoc(7): new .Tg (tag) macro to explicitly mark a place as defining a term
* man(7): implement some automatic tagging support
* man(1): let -w without argument show the manpath, like in man-db and man-1.6
* -T html: wrap text and phrasing elements in paragraphs unless already
contained in flow containers; never put them directly into sections.
This helps to format paragraphs with the CSS class selector .Pp.
* man.conf(5): remove support for the "_whatdb" configuration directive
that was deprecated in 2015; please use "manpath" instead
--- MINOR NEW FEATURES ---
* man(1): switch the default pager from "more -s" to "less"
* man(1): in the fallback code to look for manual pages without using
mandoc.db(5), accept files "man<one-digit-section>/<name>.<full-section>"
in addition to the already supported "man<full-section>/name.[01-9]*"
* if messages are shown and output is printed without a pager, display
a heads-up on stderr at the end because otherwise, users may easily
miss the messages
* man.cgi(8): add a Content-Security-Policy HTTP header
* man.cgi(8): switch off autocomplete and autocapitalize
* mandoc.css: support prefers-color-scheme: dark
* -T html: add meta viewport element to help mobile devices
* -T html -O tag: let this pass a file:// URI to the pager
* tbl(7): implement the "nospaces" option
* tbl(7) -T html: implement the "a" (em indent) layout specification
* tbl(7) -T html: implement the "b" (bold) and "i" (italic) layout modifiers
* tbl(7): support two-character font names in the layout font modifier
* tbl(7) -T html: support horinzontal rulers in individual cells
* tbl(7) -T tree: print more details about columns, options, rows, and cells
* roff(7): implement the .break request (break out of a .while loop)
* roff(7): support the CB and CI fonts in \f and .ft
* -T lint: new STYLE message if a file name extension contradicts .Dt/.TH
* -T lint: new STYLE message about overlong text lines
* -W style: check .Xr links along the full manpath
--- RELIABILITY BUGFIXES ---
* man(1): do not segfault if /tmp/ is not writeable
* man(1): do not access a NULL pointer when both -l and -w are given
* makewhatis(8): do not crash when a manpath directory contains
a symbolic link that points to a directory
* man(7): fix an assertion failure caused by doubly nested next-line scopes
* tbl(7): fix a crash when the last column is only reached by spans
* tbl(7): fix a NULL pointer access in some cases of two spans on one row
* tbl(7) -T ascii: fix a NULL pointer access on empty data cells
* tbl(7) -T ascii: fix a NULL pointer access on a line next to a short row
* tbl(7): fix an assertion failure caused by excessive spacing modifiers
* tbl(7): fix an infinite loop for some overlapping horizontal spans
* roff(7): fix a rare case of writing one byte past the end of the input buffer
* roff(7): do not call abort(3) when \*[.T] is encountered
* roff(7): fix an assertion failure caused by a macro inside .ce .if
* roff(7): fix assertion failures for .ti and .po with excessive arguments
* roff(7): avoid near-infinte output for .ce inside explicit no-fill mode
* -T ascii/utf8: fix assertion failures caused by excessive spacing
* -T html: fix an assertion failure caused by .ft in rare situations
* -T man: fix an assertion failure caused by tbl(7) and eqn(7) input
--- PORTABILITY IMPROVEMENTS ---
* rename HOMEBREWDIR to READ_ALLOWED_PATH, allow it to contain more than
one directory, and explain how to use that for NixOS and GNU Guix Linux
* configure: stop trying to ask make(1) what the default compiler is
because that test was too fragile; just use "cc" by default
* configure: various simplifications and improved robustness
* configure: only compile compat_*.c implementations that are needed
* configure: provide feature tests for __attribute__(()) and mkstemps(3)
* compat_*: sync with upstreams for security, functionality, and style
* in regress.pl, avoid the non-portable options sed(1) -i and echo(1) -n
* in the regression suite, avoid file names that differ only by case
--- MINOR FUNCTIONAL IMPROVEMENTS ---
* man(1) -h: for pages lacking a SYNOPSIS, show the NAME section
* man(1): when the first argument starts with a digit, optionally
followed by a letter, and at least one more argument follows,
interpret the first argument as a section name even when additional
characters follow after the digit and letter
* man(1): with a specific section requested, try harder to find
the best match; use this order of preference:
1. The section in both the directory name and the file name matches exactly.
2. The section in the file name matches exactly.
3. The section in the directory name matches exactly.
4. Neither of them matches exactly.
* man(1): if no tags were generated at all, unlink(2) the empty tags file
as soon as the condition can be detected and do not pass it to less(1)
* makewhatis(8): handle both dangling symlinks and .so links
in manual page directories more gracefully
* man.cgi(8): for invalid queries and for valid queries returning
no result, return the appropriate 40x status code rather than 200
* mdoc(7): let .Dd concatenate all arguments and default to the empty string
* mdoc(7): convert ".Fl Fl" to ".Fl \-" during validation, improving -T html
* mdoc(7): improve output of .At 32v
* man(7): no longer print multiple blank lines before NAME and page footer
* tbl(7) -T utf8: improved rendering of horizontal lines
* tbl(7) -T html: in "n" cells, align by padding numbers on the right
* tbl(7): no longer leak tabulator settings to subsequent roff(7) code
* mdoc(7) -T html: for .Bl -tag, use "column-count: 1" rather
than "overflow: auto" to avoid the ugly side effects
* mdoc(7) -T html: render .Bd -unfilled in proportionally-spaced font
* mdoc(7) -T html: format .Nd with <span> rather than <div>
* mdoc(7) -T lint: do not warn about Mdocdate without an actual date
* mdoc(7) -T lint: do not complain about function types of the
form "ret_type (fname)(args)", but otherwise check names more strictly
* -T html: append .html suffix to temporary files to please browsers
* -T markdown: print a BAGARG message if called on man(7) input
--- MINOR BUGFIXES ---
* man(1): do the search for each name independently, and
show the results in the order of the command line argument
* man(1): escape shell wildcard characters in name arguments before glob(3)
* man(1): when asking for a single manual page by name, prefer file name
matches over .Dt/.TH matches over first NAME matches over later NAME
matches, but do not change the ordering for apropos(1) nor for man -a
* man(1): correctly extract the section name from the file name extension
of gzipped manual page files
* makewhatis(8): fix file type tests putting wrong data into mandoc.db(5)
* man.cgi(8): fix section number in the <title> element for preformatted pages
* tbl(7): correct handling of T& after horizontal rulers in the layout
* tbl(7): correct column widths if rows have different numbers of cells
* tbl(7): empty columns are 1n wide rather than 0n
* tbl(7): correctly calculate required column widths for tables containing
cells that horizontally span columns which contains "n" (number) formatted
cells on other rows
* tbl(7): skip escape sequences when looking for column separators
* eqn(7): skip whitespace before tokens
* roff(7): when calling an empty macro, do not clobber existing arguments
* roff(7): recognize \} on lines closing a macro definition request
* roff(7): do not throw a bogus warning for "'br\}" and similar lines
* roff(7): stop generating comment nodes when encountering the first content
* mandoc_char(7): make \0 (digit-width space) non-breaking
* mdoc(7) .Bl -column: parse Macro in .It "word<tab>word" Ta word Macro<eol>
* mdoc(7) -T html: display straight quotes, not curly quotes, for .Qq/.Qo
* -T html: remove some spurious line breaks, in particular inside <pre>
* -T html: use <br/> for a space character at the beginning of an input line
* -T html: use ~%d for ordinal fragment suffixes, reserve '~' for that purpose
--- STRUCTURAL IMPROVEMENTS ---
* introduce the concept of semantically transparent syntax tree nodes,
allowing improved decisions in various validators and formatters
* move some code out of the giant main() into separate functions
doing one well-defined task each
* clearly separate parser state (struct curparse) and formatter state
(struct outstate), don't mix them in the same struct
* in the HTML formatter, assert(3) that no HTML nesting violation occurs
* let html_close_paragraph() close any phrasing context
This version supports openssl 1.1, so re-enable it.
Release Notes - Heimdal - Version Heimdal 7.7
Bug fixes
- PKCS#11 hcrypto back-end
. initialize the p11_module_load function list
. verify that not only is a mechanism present but that its mechanism
info states that it offers the required encryption, decryption or
digest services
- krb5:
. Starting with 7.6, Heimdal permitted requesting authenticated
anonymous tickets. However, it did not verify that a KDC in fact
returned an anonymous ticket when one was requested.
- Cease setting the KDCOption reaquest_anonymous flag when issuing
S4UProxy (constrained delegation) TGS requests.
. when the Win2K PKINIT compatibility option is set, do
not require krbtgt otherName to match when validating KDC
certificate.
. set PKINIT_BTMM flag per Apple implementation
. use memset_s() instead of memset()
- kdc:
. When generating KRB5SignedPath in the AS, use the reply client name
rather than the one from the request, so validation will work
correctly in the TGS.
. allow checksum of PA-FOR-USER to be HMAC_MD5. Even if tgt used
an enctype with a different checksum. Per [MS-SFU] 2.2.1
PA-FOR-USER the checksum is always HMAC_MD5, and that's what
Windows and MIT clients send.
In heimdal both the client and kdc use instead the
checksum of the tgt, and therefore work with each other
but Windows and MIT clients fail against heimdal KDC.
Both Windows and MIT KDCs would allow any keyed checksum
to be used so Heimdal client interoperates with them.
Change Heimdal KDC to allow HMAC_MD5 even for non RC4
based tgt in order to support per-spec clients.
. use memset_s() instead of memset().
- Detect Heimdal 1.0 through 7.6 clients that issue S4UProxy
(constrained delegation) TGS Requests with the request
anonymous flag set. These requests will be treated as
S4UProxy requests and not anonymous requests.
- HDB:
. Set SQLite3 backend default page size to 8KB.
. Add hdb_set_sync() method
- kadmind:
. disable HDB sync during database load avoiding unnecessary disk i/o.
- ipropd:
. disable HDB sync during receive_everything. Doing an fsync
per-record when receiving the complete HDB is a performance
disaster. Among other things, if the HDB is very large, then
one slave receving a full HDB can cause other slaves to timeout
and, if HDB write activity is high enough to cause iprop log
truncation, then also need full syncs, which leads to a cycle of
full syncs for all slaves until HDB write activity drops.
Allowing the iprop log to be larger helps, but improving
receive_everything() performance helps even more.
- kinit:
. Anonymous PKINIT tickets discard the realm information used
to locate the issuing AS. Store the issuing realm in the
credentials cache in order to locate a KDC which can renew them.
. Do not leak the result of krb5_cc_get_config() when determining
anonymous PKINIT start realm.
- klist:
. Show transited-policy-checked, ok-as-delegate and anonymous
flags when listing credentials.
- tests:
. Regenerate certs so that they expire before the 2038 armageddon
so the test suite will pass on 32-bit operating systems until the
underlying issues can be resolved.
- Solaris:
. Define _STDC_C11_BCI for memset_s prototype
- build tooling:
. Convert from python 2 to python 3
- documentation
. rename verify-password to verify-password-quality
. hprop default mode is encrypt
. kadmind "all" permission does not include "get-keys"
. verify-password-quality might not be stateless
Release Notes - Heimdal - Version Heimdal 7.6
Security
- CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum
When the Heimdal KDC checks the checksum that is placed on the
S4U2Self packet by the server to protect the requested principal
against modification, it does not confirm that the checksum
algorithm that protects the user name (principal) in the request
is keyed. This allows a man-in-the-middle attacker who can
intercept the request to the KDC to modify the packet by replacing
the user name (principal) in the request with any desired user
name (principal) that exists in the KDC and replace the checksum
protecting that name with a CRC32 checksum (which requires no
prior knowledge to compute).
This would allow a S4U2Self ticket requested on behalf of user
name (principal) [email protected] to any service to be changed
to a S4U2Self ticket with a user name (principal) of
[email protected]. This ticket would then contain the
PAC of the modified user name (principal).
- CVE-2019-12098, client-only:
RFC8062 Section 7 requires verification of the PA-PKINIT-KX key excahnge
when anonymous PKINIT is used. Failure to do so can permit an active
attacker to become a man-in-the-middle.
Bug fixes
- Happy eyeballs: Don't wait for responses from known-unreachable KDCs.
- kdc: check return copy_Realm, copy_PrincipalName, copy_EncryptionKey
- kinit:
. cleanup temporary ccaches
. see man page for "kinit --anonymous" command line syntax change
- kdc: Make anonymous AS-requests more RFC8062-compliant.
- Updated expired test certificates
- Solaris:
. PKCS#11 hcrypto backend broken since 7.0.1
. Building with Sun Pro C
Features
- kuser: support authenticated anonymous AS-REQs in kinit
- kdc: support for anonymous TGS-REQs
- kgetcred support for anonymous service tickets
- Support builds with OpenSSL 1.1.1
Release Notes - Heimdal - Version Heimdal 7.5
Security
- Fix CVE-2017-17439, which is a remote denial of service
vulnerability:
In Heimdal 7.1 through 7.4, remote unauthenticated attackers
are able to crash the KDC by sending a crafted UDP packet
containing empty data fields for client name or realm.
Bug fixes
- Handle long input lines when reloading database dumps.
- In pre-forked mode (default on Unix), correctly clear
the process ids of exited children, allowing new child processes
to replace the old.
- Fixed incorrect KDC response when no-cross realm TGT exists,
allowing client requests to fail quickly rather than time
out after trying to get a correct answer from each KDC.
Release Notes - Heimdal - Version Heimdal 7.4
Security
- Fix CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation
This is a critical vulnerability.
In _krb5_extract_ticket() the KDC-REP service name must be obtained from
encrypted version stored in 'enc_part' instead of the unencrypted version
stored in 'ticket'. Use of the unecrypted version provides an
opportunity for successful server impersonation and other attacks.
Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
See https://www.orpheus-lyre.info/ for more details.
Release Notes - Heimdal - Version Heimdal 7.3
Security
- Fix transit path validation. Commit f469fc6 (2010-10-02) inadvertently
caused the previous hop realm to not be added to the transit path
of issued tickets. This may, in some cases, enable bypass of capath
policy in Heimdal versions 1.5 through 7.2.
Note, this may break sites that rely on the bug. With the bug some
incomplete [capaths] worked, that should not have. These may now break
authentication in some cross-realm configurations.
(CVE-2017-6594)
Release Notes - Heimdal - Version Heimdal 7.2
Bug fixes
- Portability improvements
- More strict parsing of encoded URI components in HTTP KDC
- Fixed memory leak in malloc error recovery in NTLM GSSAPI mechanism
- Avoid overly specific CPU info in krb5-config in aid of reproducible builds
- Don't do AFS string-to-key tests when feature is disabled
- Skip mdb_stat test when the command is not available
- Windows: update SHA2 timestamp server
- hdb: add missing export hdb_generate_key_set_password_with_ks_tuple
- Fix signature of hdb_generate_key_set_password()
- Windows: enable KX509 support in the KDC
- kdc: fix kx509 service principal match
- iprop: handle case where master sends nothing new
- ipropd-slave: fix incorrect error codes
- Allow choice of sqlite for HDB pref
- check-iprop: don't fail to kill daemons
- roken: pidfile -> rk_pidfile
- kdc: _kdc_do_kx509 fix use after free error
- Do not detect x32 as 64-bit platform.
- No sys/ttydefaults.h on CYGWIN
- Fix check-iprop races
- roken_detach_prep() close pipe
Release Notes - Heimdal - Version Heimdal 7.1
Security
- kx509 realm-chopping security bug
- non-authorization of alias additions/removals in kadmind
(CVE-2016-2400)
Feature
- iprop has been revamped to fix a number of race conditions that could
lead to inconsistent replication
- Hierarchical capath support
- AES Encryption with HMAC-SHA2 for Kerberos 5
draft-ietf-kitten-aes-cts-hmac-sha2-11
- hcrypto is now thread safe on all platforms
- libhcrypto has new backends: CNG (Windows), PKCS#11 (mainly for
Solaris), and OpenSSL. OpenSSL is now a first-class libhcrypto backend.
OpenSSL 1.0.x and 1.1 are both supported. AES-NI used when supported by
backend
- HDB now supports LMDB
- Thread support on Windows
- RFC 6113 Generalized Framework for Kerberos Pre-Authentication (FAST)
- New GSS APIs:
. gss_localname
- Allow setting what encryption types a principal should have with
[kadmin] default_key_rules, see krb5.conf manpage for more info
- Unify libhcrypto with LTC (libtomcrypto)
- asn1_compile 64-bit INTEGER functionality
- HDB key history support including --keepold kadmin password option
- Improved cross-realm key rollover safety
- New krb5_kuserok() and krb5_aname_to_localname() plug-in interfaces
- Improved MIT compatibility
. kadm5 API
. Migration from MIT KDB via "mitdb" HDB backend
. Capable of writing the HDB in MIT dump format
- Improved Active Directory interoperability
. Enctype selection issues for PAC and other authz-data signatures
. Cross realm key rollover (kvno 0)
- New [kdc] enctype negotiation configuration:
. tgt-use-strongest-session-key
. svc-use-strongest-session-key
. preauth-use-strongest-session-key
. use-strongest-server-key
- The KDC process now uses a multi-process model improving
resiliency and performance
- Allow batch-mode kinit with password file
- SIGINFO support added to kinit cmd
- New kx509 configuration options:
. kx509_ca
. kca_service
. kx509_include_pkinit_san
. kx509_template
- Improved Heimdal library/plugin version safety
- Name canonicalization
. DNS resolver searchlist
. Improved referral support
. Support host:port host-based services
- Pluggable libheimbase interface for DBs
- Improve IPv6 Support
- LDAP
. Bind DN and password
. Start TLS
- klist --json
- DIR credential cache type
- Updated upstream SQLite and libedit
- Removed legacy applications: ftp, kx, login, popper, push, rcp, rsh,
telnet, xnlock
- Completely remove RAND_egd support
- Moved kadmin and ktutil to /usr/bin
- Stricter fcache checks (see fcache_strict_checking krb5.conf setting)
. use O_NOFOLLOW
. don't follow symlinks
. require cache files to be owned by the user
. require sensible permissions (not group/other readable)
- Implemented gss_store_cred()
- Many more
Bug fixes
- iprop has been revamped to fix a number of race conditions that could
lead to data loss
- Include non-loopback addresses assigned to loopback interfaces
when requesting tickets with addresses
- KDC 1DES session key selection (for AFS rxkad-k5 compatibility)
- Keytab file descriptor and lock leak
- Credential cache corruption bugs
(NOTE: The FILE ccache is still not entirely safe due to the
fundamentally unsafe design of POSIX file locking)
- gss_pseudo_random() interop bug
- Plugins are now preferentially loaded from the run-time install tree
- Reauthentication after password change in init_creds_password
- Memory leak in the client kadmin library
- TGS client requests renewable/forwardable/proxiable when possible
- Locking issues in DB1 and DB3 HDB backends
- Master HDB can remain locked while waiting for network I/O
- Renewal/refresh logic when kinit is provided with a command
- KDC handling of enterprise principals
- Use correct bit for anon-pkinit
- Many more
its buildlink3.mk now includes openssl's buildlink3.mk
It was always set to yes.
netbsd-srcmastr
force-pushed
the
trunk
branch
from
d96f168
to
a06d19e
Compare
|
This should still be open, stupid GitHub auto-close on the wrong PR. For those looking, the commit here is 39f4b1c |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The INSTALL script is not run with "set -e" in general.
So to make if fail from inside the snippet for pkg_alterantives, one has to call exit explicitly.