For details see:
https://github.com/htop-dev/htop/blob/main/ChangeLog
"What's new in version 3.3.0
* Multiple refactorings and code improvements
* Shorten docker container IDs to 12 characters
* Settings: preserve empty header
* Fix execlp() argument without pointer cast
* OpenFilesScreen: Make column sizing dynamic for file size, offset and inode
* Add support for "truss" (FreeBSD equivalent of "strace")
* Darwin: add NetworkIOMeter support
* HeaderLayout: add "3 columns - 40/30/30", "... 30/40/30" & "... 30/30/40"
* Meter: use correct unicode characters for digit '9'
* Note in manual re default memory units of KiB
* Add column for process container name
* Add logic to filter the container name (+type) from the CGroup name
* Change NetworkIOMeter value unit from KiB/s to bytes/second
* Cap DiskIOMeter "utilisation" percentage at 100%
* PCP platform implementation of frontswap and zswap accounting
* Shorten podman/libpod container IDs to 12 characters
* Write configuration to temporary file first
* Incorporate shared memory in bar text
* Move shared memory next to used memory
* Correct order of memory meter in help
* Add recalculate to Ctrl-L refresh
* Update process list on thread visibility toggling
* Support dynamic screens with 'top-most' entities beyond processes
* Introduce Row and Table classes for screens beyond top-processes
* Rework ZramMeter and remove MeterClass.comprisedValues
* More robust logic for CPU process percentages (Linux & PCP)
* Show year as start time for processes older than a year
* Short-term fix for docker container detection
* default color preset: use bold blue for better visibility
* Document 'O' keyboard shortcut
* Implement logic for '--max-iterations'
* Update F5 key label on tab switch (Tree <-> List)
* Force re-sorting of the process list view after switching between list/treeview mode
* Linux: (hack) work around the fact that Zswapped pages may be SwapCached
* Linux: implement zswap support
* {Memory,Swap}Meter: add "compressed memory" metrics
* Darwin: add DiskIOMeter support
* Fix scroll relative to followed process
* ZramMeter: update bar mode
* Use shared real memory on FreeBSD
* Increase Search and Filter max string length to 128
* Improve CPU computation code
* Remove LXC special handling for the CPU count
* Create new File Descriptor meter
* PCP: add IRQ PSI meter
* Linux: add IRQ PSI meter
* Linux: highlight username if process has elevated privileges
* Add support for scheduling policies
* Add a systemd user meter to monitor user units.
* FreeBSD: remove duplicate zfs ARC size subtraction"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
According to the source tarball's NEWS file:
- Improvements
- Allow passing a path to modprobe so the module is loaded from
anywhere from the filesystem, but still handling the module
dependencies recorded in the indexes. This is mostly intended for kernel
developers to speedup testing their kernel modules without having to load the
dependencies manually or override the module in /usr/lib/modules/.
Now it's possible to do:
# modprobe ./drivers/gpu/drm/i915/i915.ko
As long as the dependencies didn't change, this should do the right thing
- Use in-kernel decompression if available. This will check the runtime support
in the kernel for decompressing modules and use it through finit_module().
Previously kmod would fallback to the older init_module() when using
compressed modules since there wasn't a way to instruct the kernel to
uncompress it on load or check if the kernel supported it or not.
This requires a recent kernel (>= 6.4) to have that support and
in-kernel decompression properly working in the kernel.
- Make modprobe fallback to syslog when stderr is not available, as was
documented in the man page, but not implemented
- Better explaing `modprobe -r` and how it differentiates from rmmod
- depmod learned a `-o <dir>` option to allow using a separate output
directory. With this, it's possible to split the output files from
the ones used as input from the kernel build system
- Add compat with glibc >= 2.32.9000 that dropped __xstat
- Improve testsuite to stop skipping tests when sysconfdir is something
other than /etc
- Build system improvements and updates
- Change a few return codes from -ENOENT to -ENODATA to avoid confusing output
in depmod when the module itself lacks a particular ELF section due to e.g.
CONFIG_MODVERSIONS=n in the kernel.
- Bug Fixes
- Fix testsuite using uninitialized memory when testing module removal
with --wait
- Fix testsuite not correctly overriding the stat syscall on 32-bit
platforms. For most architectures this was harmless, but for MIPS it
was causing some tests to fail.
- Fix handling unknown signature algorithm
- Fix linking with a static liblzma, libzstd or zlib
- Fix memory leak when removing module holders
- Fix out-of-bounds access when using very long paths as argument to rmmod
- Fix warnings reported by UBSan
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Noteworthy changes in this release, according to
https://lists.gnu.org/archive/html/info-gnu/2023-05/msg00001.html :
* New option --ignore-dirnlink
Valid in copy-out mode, it instructs cpio to ignore the actual number
of links reported for each directory member and always store 2
instead.
* Changes in --reproducible option
The --reproducible option implies --ignore-dirlink. In other words,
it is equivalent to --ignore-devno --ignore-dirnlink --renumber-inodes.
* Use GNU ls algorithm for deciding timestamp format in -tv mode
* Bugfixes
** Fix cpio header verification.
** Fix handling of device numbers on copy out.
** Fix calculation of CRC in copy-out mode.
** Rewrite the fix for CVE-2015-1197.
** Fix combination of --create --append --directory.
** Fix appending to archives bigger than 2G.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 3.8.3 to 3.8.4
- Update of rootfile not required
- Permanent fix for smtp smuggling will be in version 3.9. However the fix has been
backported into version 3.8.4 but with the default for the parameter of "no".
- This patch sets the defaults for all the main.cf parameters highlighted by Wietse
Venema in http://www.postfix.org/smtp-smuggling.html
- Additionally the implementation of smtpd_forbid_bare_newline = yes has been added to
the install.sh pak for postfix so that it will be included into any main.cf file being
restored from backup. This parameter is available for the first time in 3.8.4 so will
not be in any backup prior to this release and can therefore be safely applied to
restored versions of main.cf.
- This fix in install.sh will be able to be removed when version 3.9 is released early
in 2024 as the default for that parameter in that version onwards will then be "yes"
- Changelog
3.8.4
Security: with "smtpd_forbid_bare_newline = yes" (default
"no" for Postfix < 3.9), reply with "Error: bare <LF>
received" and disconnect when an SMTP client sends a line
ending in <LF>, violating the RFC 5321 requirement that
lines must end in <CR><LF>. This prevents SMTP smuggling
attacks that target a recipient at a Postfix server. For
backwards compatibility, local clients are excluded by
default with "smtpd_forbid_bare_newline_exclusions =
$mynetworks". Files: mantools/postlink, proto/postconf.proto,
global/mail_params.h, global/smtp_stream.c, global/smtp_stream.h,
smtpd/smtpd.c.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update the patches to include patches 16 to 21
- Update of rootfile not required
- Changelog
patch 21: fix for expanding command substitutions in a word expansion in a
here-document
patch 20: allow time reserved word as first token in command substitution
patch 19: fix case where background job set the terminal process group
patch 18: fix for returning unknown tokens to the bison parser
patch 17: fix for optimizing forks when using the . builtin in a subshell
patch 16: fix for a crash if one of the expressions in an arithmetic for command
expands to NULL
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
openssl 3.x need correct arch configuration or disable
asm optimisation with no-asm config parameter.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Changes in version 0.4.8.10 - 2023-12-08
This is a security release fixing a high severity bug (TROVE-2023-007)
affecting Exit relays supporting Conflux. We strongly recommend to update as
soon as possible.
o Major bugfixes (TROVE-2023-007, exit):
- Improper error propagation from a safety check in conflux leg
linking lead to a desynchronization of which legs were part of a
conflux set, ultimately causing a UAF and NULL pointer dereference
crash on Exit relays. Fixes bug 40897; bugfix on 0.4.8.1-alpha.
o Minor features (fallbackdir):
- Regenerate fallback directories generated on December 08, 2023.
o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2023/12/08.
o Minor bugfixes (bridges, statistics):
- Correctly report statistics for client count over Pluggable
transport. Fixes bug 40871; bugfix on 0.4.8.4
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 2.2.0 to 2.3.0
- Update of rootfile
2.3.0
- Changes:
* Rename PLIST_UINT to PLIST_INT and add plist_new_int() and plist_get_int_val()
* Add support for JSON format
* Add support for OpenStep format
* Introduce error codes and format constants
* Add return value to import/export functions to allow returning error codes
* Add new plist_sort function
* Add several human-readable output-only formats
* Add new plist_write_to_string/_stream/_file functions
* Add new plist_print function
* Add new plist_read_from_file function
* Add new plist_mem_free() function
* Add a few C++ methods
* Add C++ interface test
* Add PLIST_NULL type
* Some code housekeeping (mostly clang-tidy)
- Breaking:
* plist_from_memory() gets additional parameter
- Bugfixes:
* Fix multiple bugs in all of the parsers
* Fix handling of PLIST_UID nodes
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version commit ad384f9ed3b2cc31e97012ab6bfe5a214ffc65a2 (between 1.2.1 and
1.2.2) to 1.2.4
- Update of rootfile not required
- Changelog
1.2.4
Following on from the security update of 1.2.3, some further changes are
introduced to make the communication path between NQPTP and Shairport Sync
resistant to outside interference. On Linux, nqptp now runs as a restricted user
but with special permission to access ports 319 and 320.
These changes have necessitated changing the SMI interface. The SMI interface is
now at version 10, and Shairport Sync must also be updated to be compatible with
it.
Before updating, it is important that you remove the startup service file as
described in the README.
Please read the Release Notes for more details.
1.2.3
This important update fixes a crashing bug whereby a maliciously-crafted message
to the control port could crash NQPTP. (Supersedes 1.2.2.)
1.2.2
Superseded by version 1.2.3
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 4.1.1 to 4.3.2
- Update of rootfile not required.
- Updating shairport-sync to 4.2 or later also requires an update of nqptp as the newer
version of shairport-sync requires NQPTP with Shared Memory Interface Version smi9 and
will not work with older versions.
- Changelog
4.3.2
This update contains a brand new PipeWire backend with full synchronisation --
your feedback is welcome on this. The update also contains a number of bug fixes.
Enhancements
A totally new PipeWire backend featuring full synchronisation.
Bug Fixes
Stability improvements for the PulseAudio backend.
Fix a crash when the Avahi subsystem became disconnected. This is normally a
rare occurrence, but Shairport Sync was not dereferencing obsolete data
correctly when it happened.
Set and reset Bonjour flags correctly when it's a Classic Airplay session in
AirPlay 2 operation.
Fix a number of FreeBSD compilation errors and warnings.
Fix various errors when breaking into an existing session to terminate it.
Thanks again to aaronk6.
Fix some debug message errors, sigh. Thanks to Nathan Gray.
4.3.1
Bug Fixes
This release, 4.3.1, fixes a bug in Version 4.3 that prevented Shairport
Sync from being added to Home.
4.3
This update contains important security updates, bug fixes and enhancements.
NQPTP must also be updated, and it should be updated before updating Shairport
Sync.
The Shared Memory Interface version of both Shairport Sync and NQPTP is now 10,
i.e. smi10.
Notes
When updating NQPTP on Linux, be sure to remove the old service file as
directed in the README.
Having completed both updates and installations, remember to restart NQPTP
first and then restart Shairport Sync.
Security Updates
A crashing bug in NQPTP has been fixed.
The communications protocol used between NQPTP and Shairport Sync has been
revised and made more resilient to attempted misuse.
In Linux systems, NQPTP no longer runs as root -- instead it runs as the
restriced user nqptp, with access to ports 319 and 320 set by the installer
via the setcap utility.
Enhancements
A new volume control profile called dasl-tapered has been added in which
halving the volume control setting halves the output level.
For example, moving the volume slider from full to half reduces the output
level by 10dB, which roughly corresponds with a perceived halving of the
audio volume level.
Moving the volume slider from half to a quarter reduces the output level by
a further 10dB.
The tapering rate is slightly modified at the lower end of the range if the
device's attenuation range is restricted (less than about 55dB).
To activate the dasl-tapered profile, set the volume_control_profile to
"dasl_tapered" in the configuration file and restart Shairport Sync.
Many thanks to David Leibovic, aka dasl-, for this.
On graceful shutdown, an active_end signal should now be generated if the
system was in the active state. Addresses issue #1647. Thanks to Tucker
Kern for raising the issue.
Bug Fixes
Fixed a bug that causes the Docker image to crash occasionally when OwnTone
interrupted an existing iOS session. Thanks to aaronk6 for the report.
Fixed a cross-compliation error caused by not looking for the correct
version of the ar tool. The fix was to substitute the correct version
during the autoreconf phase. Thanks to sternenseemann for raising the
issue and the PR containing the fix.
Updated the mDNS strings for the Classic AirPlay feature of AP2, so that it
does not appear to provide MFi authentication. Addresses this discussion.
Always uses a revision number of 1 when looking for status updates on the
DACP remote control port. This follows a suggestion in Issue #1658. Thanks
to ejurgensen, as ever, for the report and the suggested fix.
Fixed a statistics bug (the minimum buffer size was incorrectly logged) and
also tidy up the statistics logging interval logic for resetting min and
max counters.
Added an important missing format string argument to a call in the Jack
Audio backend. Many thanks to michieldwitte for their PR.
Maintenance
Stopped using a deprecated FFmpeg data structure reference.
Stopped using deprecated OpenSSL calls. Thanks to yubiuser for their PR --
which did some of the updating -- and for their guidance.
Run workflow-based tests on PRs automatically. Thanks to yubiuser for their PR.
4.2
This release consists of enhancements and important bug fixes to Shairport Sync
Version 4.1. For information on the new features of 4.1, including AirPlay 2
support, please see the Version 4.1 Release Note.
Important
If you are updating an existing installation of Shairport Sync, you must
also update NQPTP. The reason is that this update to Shairport Sync
requires NQPTP with Shared Memory Interface Version smi9 and will not
work with older versions.
For details of the enhancements and bug fixes in this release, please
refer to the RELEASENOTES.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 1.9.15p4 to 1.9.15p5
- Update of rootfile not required
- Changelog
1.9.15p5
Fixed evaluation of the lecture, listpw, verifypw, and fdexec sudoers Defaults
settings when used without an explicit value. Previously, if specified
without a value they were evaluated as boolean false, even when the negation
operator (’!’) was not present.
Fixed a bug introduced in sudo 1.9.14 that prevented LDAP netgroup queries
using the NETGROUP_BASE setting from being performed.
Sudo will now transparently rename a user’s lecture file from the older
name-based path to the newer user-ID-based path. GitHub issue #342.
Fixed a bug introduced in sudo 1.9.15 that could cause a memory allocation
failure if sysconf(_SC_LOGIN_NAME_MAX) fails. Bug #1066
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 2.5.4 to 2.5.5
- Update of rootfile
- Changelog
2.5.5 - December 1, 2023
* Update the syscall table for Linux v6.7-rc3
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 3.12 to 3.16
- Update of rootfile not required
- Changelog
3.16 2023-11-30
* Notable user-visible changes
* Multiple test streams started with -P/--parallel will now be
serviced by different threads. This allows iperf3 to take
advantage of multiple CPU cores on modern processors, and will
generally result in significant throughput increases (PR #1591).
* OpenSSL 3 is now detected at build time. If OpenSSL 3 is found,
various older, deprecated, APIs will not be used. iperf3 will
continue to work with OpenSSL 1.1.1. OpenSSL is used as a part
of the iperf3 authentication functionality (Issue #1300, PR
#1589).
* The authorized users file used by the authentication functionality
is now checked for accessibility much earlier during the program
startup, as opposed to being checked near the start of a
test (Issue #1583, PR #1585).
* Developer-visible changes
* BREAKING CHANGE: iperf3 now requires pthreads and C atomic
variables to compile and run.
3.15 2023-09-14
* Notable user-visible changes
* Several bugs that could allow the iperf3 server to hang waiting
for input on the control connection has been fixed. ESnet thanks
Jorge Sancho Larraz from Canonical for reporting this issue. For
more information, see:
https://downloads.es.net/pub/iperf/esnet-secadv-2023-0002.txt.asc
* A bug that caused garbled output with UDP tests on 32-bit hosts
has been fixed (PR #1554, PR #1556). This bug was introduced in
iperf-3.14.
* A bug in counting UDP messages has been fixed (PR #1367, PR
#1380).
3.14 2023-07-07
* Notable user-visible changes
* A memory allocation hazard was fixed (Issue #1542/PR #1543). For
more information see:
https://downloads.es.net/pub/iperf/esnet-secadv-2023-0001.txt.asc
* JSON output was improved, such as print JSON numbers as signed (PR
#1539, Issue #1435), the exit code when doing JSON output was
fixed (PR #1523), and client_api was fixed so that it still
returns an error code when JSON is enabled (Issue #1405). Also,
duplicate fields when using multiple streams was removed from the
JSON output (#1492).
* Prevent UDP packet count and operations overflow (PR #1536/Issue
#1534).
* Statistics are fixed when --omit is used (Issue #1489/PR #1498).
* Developer-visible changes
* CI builds and tests using GitHub actions have been added (PR
#1519).
* A fix for Android "unable to create a new stream error" was added
(PR #1506).
* Support for Voice Admit DSCP code point from RFC 5865 was added
(PR #1490).
* A fix for preventing a crash when RSA public key path doesn't
exist was fixed (PR #1488/Issue #1471).
3.13 2023-02-16
* Notable user-visible changes
* fq-rate (PR #1461, Issue #1366), and bidirectional flag (Issue #1428,
PR #1429) were added to the JSON output.
* Added support for OpenBSD including cleaning up endian handling (PR #1396)
and support for TCP_INFO on systems where it was implemented (PR #1397).
* Fixed bug in how TOS is set in mapped v4 (PR #1427).
* Corrected documentation, such as updating binary download links and text
(Issue #1459), updating version on iperf3 websites, and fixing an
incorrect error message (Issue #1441).
* Fixed crash on rcv-timeout with JSON logfile (#1463, #1460, issue #1360,
PR #1369).
* Fixed a bug that prevented TOS/DSCP from getting set correctly for reverse
tests (PR #1427, Issue #638).
* Developer-visible changes
* Getter and setter are now available for bind_dev (PR #1419).
* Added missing getter for bidirectional tests (PR #1453).
* Added minor changes to clean up .gitignore and error messages (#1408).
* Made sure configure scripts are runnable with /bin/sh (PR #1398).
* Cleaned up RPM spec, such as adding missing RPM build dependencies, dropping
EL5 and removing outdated %changelog (PR #1401) to make.
* Added a fix for a resource leak bug in function iperf_create_pidfile(#1443).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 2.14.1 to 2.15.0
- Update of rootfile
- Autogen no longer required
- fcobjshash.h is no longer in tarball from version 2.13.1
- Changelog
2.15
Do not change the order of orth files
Convert tabs to spaces
Convert more tabs to spaces in docs
src/meson.build: Store correct paths to fontconfig.pc.
Fix a typo in description for HAVE_STDATOMIC_PRIMITIVES
Report more detailed logs instead of assertion.
Add some missing constant names for weight.
Adujst indentation between programlisting in fontconfig-user.sgml
Bump version to 2.14.2
Clean up unused code
Add another test case for flatpak
Update 65-nonlatin.conf for macOS
Change the order of the properties to the order of fontconfig cache format
Add missing property descriptions
Add namedinstance property
Remove the problematic language from code and doc
Fix a typo
Fix a typo for FcCharSetDelChar doc
Fix a typo in scalable property
Use 'outline' instead of 'scalable' for bitmaps
Add more docs about selectfont
Rework CI implementation
Fix a typo
Rework CI implementation v2
Apply a fix of ci-templates
Fix uninitialized memory access when failing memory allocation.
Create a symlink with relative path
Fix an error of "initializer element is not constant"
Update CaseFolding.txt to Unicode 15.1
Update the encoding table for Simplified Chinese
Retry to decode strings in the name table as UTF-16BE in some cases.
Work around decoding strings in Macintosh encoding for the name table.
Add iconv detection for meson build
.gitlab-ci: Update
CI: Update
CI: static build only for rawhide
Use memmove instead of memcpy
Rename README to NEWS and add README.md
Update so version
Fix leak of `reason` in _FcConfigParse when not complaining
Ignore LC_CTYPE if set to "UTF-8"
Some doc clarifications
Add FC_FONT_WRAPPER
Detect standalone CFF fonts for FC_FONT_WRAPPER
Add anp.orth, bhb.orth, hif.orth, mag.orth, raj.orth, and the.orth
Add {agr,ayc,bem,ckb,cmn,dsb,hak,lij,lzh,mfe,mhr,miq,mjw,mnw,nan,nhn,niu,rif,sgs,shn,szl,tcy,tpi,unm,wae,yue,yuw}.orth
Change index type to 16 bit and bump cache version to 9
Expand ~ in glob
Add optional 11-lcdfilter-none configuration
Fix filepaths added when scanning with sysroot
Fix false-positive CFI failure
In fcfreetype.c, `GetScriptTags`: fix `use_of_uninitialized_value` and return the correct number of parsed tags in case the font file contains less tags than indicated.
meson: Support any compiler with gcc or msvc argument syntax
fix typo
Reload MM/VF metadata for each font face in font collection
fixed typos in fc-conflist.sgml
Add aliases for Helvetica LT Std
2.14.2
Fix the build issue on meson when -g option is added to c_args
Store artifacts for meson windows CI
Add FC_DESKTOP_NAME property
Add --with-default-sub-pixel-rendering option
Update po-conf/POTFILES.in
Ignore null pointer on Fc*Destroy functions
Convert tabs to spaces
Convert more tabs to spaces in docs
src/meson.build: Store correct paths to fontconfig.pc.
Fix a typo in description for HAVE_STDATOMIC_PRIMITIVES
Report more detailed logs instead of assertion.
Add some missing constant names for weight.
Adujst indentation between programlisting in fontconfig-user.sgml
meson: modify gperf test to remove sh dependency
meson: Update freetype2 git repository to upstream
Ignore LC_CTYPE if set to "UTF-8"
Expand ~ in glob
fix typo
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 6.14 to 7.0
- Update of rootfile not required
- Changelog
7.0
3165220 cifs-utils: bump version to 7.0
7b91873 cifs-utils: don't return uninitialized value in cifs_gss_get_req
d9f5447 cifs-utils: make GSSAPI usage compatible with Heimdal
5e5aa50 cifs-utils: work around missing krb5_free_string in Heimdal
dc60353 fix warnings for -Waddress-of-packed-member
c4c94ad setcifsacl: fix memory allocation for struct cifs_ace
4ad2c50 setcifsacl: fix comparison of actions reported by covscan
9b074db cifs.upcall: remove unused variable and fix syslog message
2981686 cifs.upcall: Switch to RFC principal type naming
8a288d6 man-pages: Update cifs.upcall to mention GSS_USE_PROXY
aeee690 cifs.upcall: fix compiler warning
e2430c0 cifs.upcall: add gssproxy support
6.15
- CVE-2022-27239: mount.cifs: fix length check for ip option parsing
In cifs-utils through 6.14, a stack-based buffer overflow when parsing
the mount.cifs ip= command-line argument could lead to local attackers
gaining root privileges.
- CVE-2022-29869: mount.cifs: fix verbose messages on option parsing
cifs-utils through 6.14, with verbose logging, can cause an
information leak when a file contains = (equal sign) characters but is
not a valid credentials file.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- libxml2 since version 2.12.0 has removed a variable that was specified in the apache
apache mod_xml2enc code.
- This dependency caused the apache2 build to fail with the updated libxml2.
- This patch removes the dependency. It will be able to be removed when the next apache
update is carried out as the patch was created from an apache commit.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 2.11.4 to 2.12.3
- Update of rootfile
- Changelog
2.12.3: Dec 12 2023
### Regressions
- parser: Fix namespaces redefined from default attributes
### Build fixes
- include: Rename XML_EMPTY helper macro
- include: Move declaration of xmlInitGlobals
- include: Add missing includes
- include: Move globals from xmlsave.h to parser.h
- include: Readd circular dependency between tree.h and parser.h
2.12.2: Dec 5 2023
### Regressions
- parser: Fix invalid free in xmlParseBalancedChunkMemoryRecover
- globals: Disable TLS in static Windows builds
- html: Reenable buggy detection of XML declarations
- tree: Fix regression when copying DTDs
- parser: Make CRLF increment line number
### Build fixes
- build: Disable compiler TLS by default
- cmake: Update config.h.cmake.in
- tests: Fix tests --with-valid --without-xinclude
2.12.1: Nov 23 2023
### Regressions
- hash: Fix deletion of entries during scan
- parser: Only enable SAX2 if there are SAX2 element handlers
### Build fixes
- autotools: Stop checking for snprintf
- dict: Fix '__thread' before 'static'
- fix: pthread weak references in globals.c (Mike Dalessio)
- tests: Fix build with older MSVC
2.12.0: Nov 16 2023
### Major changes
Most of the known issues leading to quadratic behavior in the XML parser
were fixed. Internal hash tables were rewritten to reduce memory
consumption.
Starting with this release, it should be enough to add the --with-legacy
configuration option to provide maximum ABI compatibility. For example,
if a code module was removed from the default configuration, the option
will add stubs for the removed symbols.
libxml2 will now store global variables in thread-local storage if supported
by the compiler. This avoids allocating the data lazily which can result in
a fatal error condition. A new API function xmlCheckThreadLocalStorage
was added so the allocation can be checked earlier if compiler TLS is not
supported. To prepare for future improvements, some API functions now expect
or return a const xmlError struct.
Several cyclic dependencies in public header files were fixed. As a result,
certain headers won't include other headers as before.
Refactoring of the encoding code has been mostly completed. Calling
xmlSwitchEncoding from client code is now fully supported, for example to
override the encoding for the push parser.
When parsing data from memory, libxml2 will now stream data chunk by chunk
instead of copying the whole buffer (possibly twice with encodings),
reducing peak memory consumption considerably.
A new API function xmlCtxtSetMaxAmplification was added to allow parsing
of files that would otherwise trigger the billion laughs protection.
Several bugs in the regex determinism checks were fixed. Invalid XML
Schemas which previous versions erroneously accepted will now be
rejected.
### Deprecations
- globals: Deprecate xmlLastError
- parser: Deprecate global parser options
- win32: Deprecate old Windows build system
### Bug fixes
- parser: Stop switching to ISO-8859-1 on encoding errors
- parser: Support encoded external PEs in entity values
- string: Fix UTF-8 validation in xmlGetUTF8Char
- SAX2: Allow multiple top-level elements
- parser: Update line number after coalescing text nodes
- parser: Check for truncated multi-byte sequences
### Improvements
- error: Make more xmlError structs constant
- parser: Remove redundant IS_CHAR check in xmlCurrentChar
- parser: Fix stack handling in xmlParseTryOrFinish
- parser: Protect against quadratic default attribute expansion
- parser: Missing checks for disableSAX
- entities: Make xmlFreeEntity public
- examples: Don't use sprintf
- encoding: Suppress -Wcast-align warnings
- parser: Use hash tables to avoid quadratic behavior
- parser: Don't skip CR in xmlCurrentChar
- dict: Rewrite dictionary hash table code
- hash: Rewrite hash table code
- malloc-fail: Report malloc failure in xmlFARegExec
- malloc-fail: Report malloc failure in xmlRegEpxFromParse
- parser: Simplify xmlStringCurrentChar
- regexp: Fix status codes and handle invalid UTF-8
- error: Make xmlGetLastError return a const error
- html: Fix logic in htmlAutoClose
- globals: Move globals back to correct header files
- globals: Use thread-local storage if available
- globals: Rework global state destruction on Windows
- globals: Define globals using macros
- globals: Introduce xmlCheckThreadLocalStorage
- globals: Make xmlGlobalState private
- threads: Move library initialization code to threads.c
- debug: Remove debugging code
- globals: Move code from threads.c to globals.c
- parser: Avoid undefined behavior in xmlParseStartTag2
- schemas: Fix memory leak of annotations in notations
- dict: Update hash function
- dict: Use thread-local storage for PRNG state
- dict: Use xoroshiro64** as PRNG
- xmllint: Fix error messages
- parser: Fix detection of null bytes
- parser: Improve error handling in push parser
- parser: Don't check inputNr in xmlParseTryOrFinish
- parser: Remove push parser debugging code
- tree: Fix copying of DTDs
- legacy: Add stubs for disabled modules
- parser: Allow to set maximum amplification factor
- entities: Don't change doc when encoding entities
- parser: Never use UTF-8 encoding handler
- encoding: Remove debugging code
- malloc-fail: Fix unsigned integer overflow in xmlTextReaderPushData
- html: Remove encoding hack in htmlCreateFileParserCtxt
- parser: Decode all data in xmlCharEncInput
- parser: Stream data when reading from memory
- parser: Optimize xmlLoadEntityContent
- parser: Don't overwrite EOF parser state
- parser: Simplify input pointer updates
- parser: Don't reinitialize parser input members
- encoding: Move rawconsumed accounting to xmlCharEncInput
- parser: Rework encoding detection
- parser: Always create UTF-8 in xmlParseReference
- html: Remove some debugging code in htmlParseTryOrFinish
- malloc-fail: Fix memory leak in xmlCompileAttributeTest
- parser: Recover more input from encoding errors
- malloc-fail: Handle malloc failures in xmlAddEncodingAlias
- malloc-fail: Fix null-deref with xmllint --copy
- xpath: Ignore entity ref nodes when computing node hash
- malloc-fail: Fix null deref after xmlXIncludeNewRef
- SAX: Always validate xml:ids
- Stop using sprintf
- Fix compiler warning on GCC < 8
- regexp: Fix determinism checks
- regexp: Fix checks for eliminated transitions
- regexp: Simplify xmlFAReduceEpsilonTransitions
- regexp: Fix cycle check in xmlFAReduceEpsilonTransitions
- schemas: Fix filename in xmlSchemaValidateFile
- schemas: Fix line numbers in streaming validation
- writer: Add error check in xmlTextWriterEndDocument
- encoding: Stop calling xmlEncodingErr
- xmlIO: Remove some calls to xmlIOErr
- parser: Improve handling of encoding and IO errors
- parser: Move xmlFatalErr to parserInternals.c
- encoding: Rework error codes
- .gitignore: Split up and rearrange .gitignore files
- .gitignore: Add runsuite.log
- Stop calling xmlMemoryDump
- examples: Don't call xmlCleanupParser and xmlMemoryDump
- xpath: Remove remaining references to valueFrame
### Portability
- python: Make it compatible with python3.12 (Daniel Garcia Moreno)
### Build systems
- cmake: Check whether static linking dependencies found in config files
(James Le Cuirot)
- autotools: Make --with-minimum disable lzma support
- build: Remove some GCC warnings
- Handle NOCONFIG case when setting locations from CMake target properties
(Markus Rickert)
- cmake: Generate better pkg-config file for SYSROOT builds under CMake
(James Le Cuirot)
- autoconf: Include non-pkg-config dependency flags in the pkg-config file
(James Le Cuirot)
- autoconf: Don't bake build time CFLAGS into pkg-config file (James Le Cuirot)
- build: Generate better pkg-config files for static-only builds (James
Le Cuirot)
- build: Generate better pkg-config file for SYSROOT builds (James Le Cuirot)
- autoconf: Allow custom --with-icu configure option
### Tests
- tests: Also test xmlNextChar in testchar.c
- tests: Start with testparser.c for extra tests
- fuzz: Raise rss_limit_mb
- fuzz: Test xmlTextReaderRead after EOF or failure
- fuzz: Test XML_PARSE_XINCLUDE | XML_PARSE_VALID
- tests: Handle entities in SAX tests
- fuzz: Disable XML_PARSE_SAX1 option in xml fuzzer
- tests: Add more tests for redefined attributes
- hash: Add hash table tests
- tests: Add ATTRIBUTE_NO_SANITIZE_INTEGER macro
- fuzz: Allow to fuzz without push, reader or output modules
- gitlab-ci: Add a "medium" config build
- python: Fix tests on MinGW
- test: Add push parser test with overridden encoding
- testapi: test_xmlSAXDefaultVersion() leaves xmlSAX2DefaultVersionValue set
to 1 with LIBXML_SAX1_ENABLED (David Kilzer)
- gitlab-ci: Lower _XOPEN_SOURCE value
- testapi: Don't set http_proxy environment variable
- test: Add push parser tests for split UTF-8 sequences
- xinclude: Lower initial table size when fuzzing
- tests: Test streaming schema validation
- runtest: Skip element name in schema error messages
### Documentation
- doc: Add notes about runtest to MAINTAINERS.md
- doc: Don't document internal macros in xmlversion.h
- doc: Allow 'unsigned' without 'int'
- doc: Improve documentation of configuration options
2.11.6: Nov 16 2023
### Regressions
- threads: Fix --with-thread-alloc
- xinclude: Fix 'last' pointer in xmlXIncludeCopyNode
### Bug fixes
- parser: Fix potential use-after-free in xmlParseCharDataInternal
2.11.5: Aug 9 2023
### Regressions
- parser: Make xmlSwitchEncoding always skip the BOM
- autotools: Improve iconv check
### Bug fixes
- valid: Fix c1->parent pointer in xmlCopyDocElementContent
- encoding: Always call ucnv_convertEx with flush set to false
### Portability
- autotools: fix Python module file ext for cygwin/msys2 (Christoph Reiter)
### Tests
- runtest: Fix compilation without LIBXML_HTML_ENABLED
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 3.8.0 to 3.8.2
- Update of rootfile
- Changelog
3.8.2 (released 2023-11-14)
** libgnutls: Fix timing side-channel inside RSA-PSK key exchange.
[GNUTLS-SA-2023-10-23, CVSS: medium] [CVE-2023-5981]
** libgnutls: Add API functions to perform ECDH and DH key agreement
The functionality has been there for a long time though they were
not available as part of the public API. This enables applications
to implement custom protocols leveraging non-interactive key
agreement with ECDH and DH.
** libgnutls: Added support for AES-GCM-SIV ciphers (RFC 8452)
The new algorithms GNUTLS_CIPHER_AES_128_SIV_GCM and
GNUTLS_CIPHER_AES_256_SIV_GCM have been added to be used through
the AEAD interface. Note that, unlike
GNUTLS_CIPHER_AES_{128,256}_SIV_GCM, the authentication tag is
appended to the ciphertext, not prepended.
** libgnutls: transparent KTLS support is extended to FreeBSD kernel
The kernel TLS feature can now be enabled on FreeBSD as well as
Linux when compiled with the --enable-ktls configure option.
** gnutls-cli: New option --starttls-name
Depending on deployment, application protocols such as XMPP may
require a different origin address than the external address to be
presented prior to STARTTLS negotiation. The --starttls-name can
be used to specify specify the addresses separately.
** API and ABI modifications:
gnutls_pubkey_import_dh_raw: New function
gnutls_privkey_import_dh_raw: New function
gnutls_pubkey_export_dh_raw: New function
gnutls_privkey_export_dh_raw: New function
gnutls_x509_privkey_import_dh_raw: New function
gnutls_privkey_derive_secret: New function
GNUTLS_KEYGEN_DH: New enum member of gnutls_keygen_types_t
GNUTLS_CIPHER_AES_128_SIV_GCM: Added
GNUTLS_CIPHER_AES_256_SIV_GCM: Added
3.8.1 (released 2023-08-03)
** libgnutls: ClientHello extensions are randomized by default
To make fingerprinting harder, TLS extensions in ClientHello
messages are shuffled. As this behavior may cause compatibility
issue with legacy applications that do not accept the last
extension without payload, the behavior can be reverted with the
%NO_SHUFFLE_EXTENSIONS priority keyword.
** libgnutls: Add support for RFC 9258 external PSK importer.
This enables to deploy the same PSK across multiple TLS versions
(TLS 1.2 and TLS 1.3) in a secure manner. To use, the application
needs to set up a callback that formats the PSK identity using
gnutls_psk_format_imported_identity().
** libgnutls: %GNUTLS_NO_EXTENSIONS has been renamed to
%GNUTLS_NO_DEFAULT_EXTENSIONS.
** libgnutls: Add additional PBKDF limit checks in FIPS mode as
defined in SP 800-132. Minimum salt length is 128 bits and
minimum iterations bound is 1000 for PBKDF in FIPS mode.
** libgnutls: Add a mechanism to control whether to enforce extended
master secret (RFC 7627). FIPS 140-3 mandates the use of TLS
session hash (extended master secret, EMS) in TLS 1.2. To enforce
this, a new priority keyword %FORCE_SESSION_HASH is added and if
it is set and EMS is not set, the peer aborts the connection. This
behavior is the default in FIPS mode, though it can be overridden
through the configuration file with the "tls-session-hash" option.
In either case non-EMS PRF is reported as a non-approved operation
through the FIPS service indicator.
** New option --attime to specify current time.
To make testing with different timestamp to the system easier, the
tools doing certificate verification now provide a new option
--attime, which takes an arbitrary time.
** API and ABI modifications:
gnutls_psk_client_credentials_function3: New typedef
gnutls_psk_server_credentials_function3: New typedef
gnutls_psk_set_server_credentials_function3: New function
gnutls_psk_set_client_credentials_function3: New function
gnutls_psk_format_imported_identity: New function
GNUTLS_PSK_KEY_EXT: New enum member of gnutls_psk_key_flags
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 1.8.9 to 1.8.10
- Update of rootfile not required
- Changelog
1.8.10
build: use pkg-config for libpcap
iptables-test.py: make explicit use of python3
xtables-eb: fix crash when opts isn't reallocated
iptables-nft: make builtin tables static
iptables-nft: remove unused function argument
include: update nf_tables uapi header
ebtables-nft: add broute table emulation
nft-ruleparse: parse meta mark set as MARK target
iptables: Fix setting of ipv6 counters
iptables: Fix handling of non-existent chains
xshared: dissolve should_load_proto
nft: move processing logic out of asserts
man: string: document BM false negatives
ip6tables: Fix checking existence of rule
nft: check for source and destination address in first place
nft: use payload matching for layer 4 protocol
nft-bridge: pass context structure to ops->add() to improve anonymous set support
configure: Bump version for 1.8.10 release
extensions: NAT: Fix for -Werror=format-security
etc: Drop xtables.conf
Proper fix for "unknown argument" error message
ebtables: Refuse unselected targets' options
ebtables-translate: Drop exec_style
ebtables-translate: Use OPT_* from xshared.h
ebtables-translate: Ignore '-j CONTINUE'
ebtables-translate: Print flush command after parsing is finished
tests: xlate: Support testing multiple individual files
tests: CLUSTERIP: Drop test file
nft-shared: Lookup matches in iptables_command_state
nft-shared: Use nft_create_match() in one more spot
nft-shared: Simplify using nft_create_match()
tests: xlate: Properly split input in replay mode
tests: xlate: Print file names even if specified
extensions: libebt_redirect: Fix target translation
extensions: libebt_redirect: Fix for wrong syntax in translation
extensions: libebt_ip: Do not use 'ip dscp' for translation
extensions: libebt_ip: Translation has to match on ether type
ebtables: ip and ip6 matches depend on protocol match
xtables-translate: Support insert with index
include: Add missing linux/netfilter/xt_LOG.h
nft-restore: Fix for deletion of new, referenced rule
tests: shell: Test for false-positive rule check
utils: nfbpf_compile: Replace pcap_compile_nopcap()
nft-shared: Drop unused include
arptables: Fix parsing of inverted 'arp operation' match
arptables: Don't omit standard matches if inverted
xshared: Fix parsing of option arguments in same word
nft: Introduce nft-ruleparse.{c,h}
nft: Extract rule parsing callbacks from nft_family_ops
nft: ruleparse: Create family-specific source files
tests: shell: Sanitize nft-only/0009-needless-bitwise_0
nft: Special casing for among match in compare_matches()
nft: More verbose extension comparison debugging
nft: Do not pass nft_rule_ctx to add_nft_among()
nft: Include sets in debug output
*tables-restore: Enforce correct counters syntax if present
*tables: Reject invalid chain names when renaming
ebtables: Improve invalid chain name detection
tests: shell: Fix and extend chain rename test
iptables-restore: Drop dead code
iptables-apply: Eliminate shellcheck warnings
extensions: libipt_icmp: Fix confusion between 255/255 and any
tests: libipt_icmp.t: Enable tests with numeric output
man: iptables.8: Extend exit code description
man: iptables.8: Trivial spelling fixes
man: iptables.8: Fix intra page reference
man: iptables.8: Clarify --goto description
man: Use HTTPS for links to netfilter.org
man: iptables.8: Trivial font fixes
man: iptables-restore.8: Fix --modprobe description
man: iptables-restore.8: Consistently document -w option
man: iptables-restore.8: Drop -W option from synopsis
man: iptables-restore.8: Put 'file' in italics in synopsis
man: iptables-restore.8: Start paragraphs in upper-case
man: Trivial: Missing space after comma
man: iptables-save.8: Clarify 'available tables'
man: iptables-save.8: Fix --modprobe description
man: iptables-save.8: Start paragraphs in upper-case
extensions: libip6t_icmp: Add names for mld-listener types
nft-ruleparse: Introduce nft_create_target()
tests: iptables-test: Fix command segfault reports
nft: Create builtin chains with counters enabled
Revert "libiptc: fix wrong maptype of base chain counters on restore"
tests: shell: Test chain policy counter behaviour
Use SOCK_CLOEXEC/O_CLOEXEC where available
nft: Pass nft_handle to add_{target,action}()
nft: Introduce and use bool nft_handle::compat
Add --compat option to *tables-nft and *-nft-restore commands
tests: Test compat mode
Revert --compat option related commits
tests: shell: Fix for ineffective 0007-mid-restore-flush_0
nft: Fix for useless meta expressions in rule
include: linux: Update kernel.h
build: Bump dependency on libnftnl
extensions: Fix checking of conntrack --ctproto 0
doc: fix example of xt_cpu
xt_sctp: add the missing chunk types in sctp_help
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 2.14 to 2.16
- Update of rootfile
- Changelog
2.16 Featured release
New import .CUBE files as RGB devicelinks
New Read/Write MHC2 tags for Windows GPU access
New Support for UTF8 on multilocalized unicode functions
New Suppot for OkLab color space, built-in and formatter.
Improved floating point transforms float -> integer are now honored as float
Improved MSYS2, mingw is now supported
Improved proferred CMM, platform and creator now survives profile edition.
Fixed tificc now can deal with Lab TIFF
Fixed code can now be compiled by a C++17 compiler, "register" keywork use detected at compile time.
Fixed Reverted postcript creation that corrupted some interpreters.
2.15 Maintenance release
New MESON build system, many thanks to amispark and Lovell Fuller for bringing this.
Fixed a bug that caused memory corruption on colord
cmsReadRawTag can read portions of tags again. Removing this caused colord to segfault when dumping profiles
Added more checks based of fuzzer discoveries.
MSYS2 can now compile lcms2
Checked on Apple Silicon M1 and M2
Fixed a bug of fastfloat plug-in that affected Krita CMYK color selector
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 0.9.30 to 0.9.31
- Update of rootfile not required
- Changelog
0.9.31 Release (2023/07/10)
ITS#8447 - Fix cursor_put(MDB_CURRENT) on DUPSORT DB with different sized data
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 4.98.0 to 4.99.3
- Update of rootfile not required
- Changelog
4.99.3
Fix a spaces vs. tabs issue in 00DIST.
4.99.2
Fix version file for CI
4.99.1
Fix compilation error when HASIPv6 is not defined. (@chenrui333)
Add configure option --disable-liblsof to disable installation
of liblsof. (@subnut, #300)
[freebsd] fix segfault from fs info (FreeBSD bug 267760)
4.99.0
[netbsd] Get device numer of tmpfs instead of reporting zero
[openbsd] Rewrite OpenBSD support because OpenBSD disallows
kernel memory access and lsof has to switch to user mode API.
Currently, most features are working, but file path reporting
and lock status are not working for lack of kernel support.
As a consequence, OpenBSD dialect is separated in a new folder.
[darwin] Remove /dev/kmem backend because it no longer exists on
current macOS releases. Use libproc backend instead.
[linux] Do not hard-code fd numbers in epoll test, fixing tests
on Void Linux
[freebsd] Use kf_file_nlink if provided by kernel instead of
stat(). This commit requires kernel with
https://reviews.freebsd.org/D38169. It brings back the ability
to list deleted files via `lsof +L1`. Closes#264.
[linux] Add --with-selinux configure option.
[solaris] Re-introduce support for recent Solaris & OpenIndiana
releases.
[darwin] Display kern ctl info, learned from apple lsof version.
[linux] Improve performance by using closefrom(). Closes#281.
[aix] Fix compilation on AIX 7.2 and add autotools build system
support for AIX.
[aix] Suppress warnings properly on AIX version greater than
5.0. Closes#187.
Introduce alpha version of liblsof which allows users to use
lsof functionality via C functions instead of spawning a
subprocess and parsing the output. This version may contain BUGs
and memory leaks, and the API may change before it stablizes.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 0.25.2 to 0.25.3
- Update of rootfile
- Changelog
0.25.3
rpc: fix serialization of NULL mechanism pointer [PR#601]
fix meson build failure in macOS (appleframeworks not found) [PR#603]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 4.19.2 to 4.19.3
- Update of rootfile not required
- I don't believe that the CVE from this version will affect IPFire users as Samba on
IPFire is not run as an Active Directory Domain Controller. That functionality was
removed some time ago.
- Changelog
4.19.3
This is the latest stable release of the Samba 4.19 release series.
It contains the security-relevant bugfix CVE-2018-14628:
Wrong ntSecurityDescriptor values for "CN=Deleted Objects"
allow read of object tombstones over LDAP
(Administrator action required!)
https://www.samba.org/samba/security/CVE-2018-14628.html
Description of CVE-2018-14628
All versions of Samba from 4.0.0 onwards are vulnerable to an
information leak (compared with the established behaviour of
Microsoft's Active Directory) when Samba is an Active Directory Domain
Controller.
When a domain was provisioned with an unpatched Samba version,
the ntSecurityDescriptor is simply inherited from Domain/Partition-HEAD-Object
instead of being very strict (as on a Windows provisioned domain).
This means also non privileged users can use the
LDAP_SERVER_SHOW_DELETED_OID control in order to view,
the names and preserved attributes of deleted objects.
No information that was hidden before the deletion is visible, but in
with the correct ntSecurityDescriptor value in place the whole object
is also not visible without administrative rights.
There is no further vulnerability associated with this error, merely an
information disclosure.
Action required in order to resolve CVE-2018-14628!
The patched Samba does NOT protect existing domains!
The administrator needs to run the following command
(on only one domain controller)
in order to apply the protection to an existing domain:
samba-tool dbcheck --cross-ncs --attrs=nTSecurityDescriptor --fix
The above requires manual interaction in order to review the
changes before they are applied. Typicall question look like this:
Reset nTSecurityDescriptor on CN=Deleted Objects,DC=samba,DC=org back to provision default?
Owner mismatch: SY (in ref) DA(in current)
Group mismatch: SY (in ref) DA(in current)
Part dacl is different between reference and current here is the detail:
(A;;LCRPLORC;;;AU) ACE is not present in the reference
(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY) ACE is not present in the reference
(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;DA) ACE is not present in the reference
(A;;CCDCLCSWRPWPSDRCWDWO;;;SY) ACE is not present in the current
(A;;LCRP;;;BA) ACE is not present in the current
[y/N/all/none] y
Fixed attribute 'nTSecurityDescriptor' of 'CN=Deleted Objects,DC=samba,DC=org'
The change should be confirmed with 'y' for all objects starting with
'CN=Deleted Objects'.
Changes since 4.19.2
* BUG 15520: sid_strings test broken by unix epoch > 1700000000.
* BUG 15487: smbd crashes if asked to return full information on close of a
stream handle with delete on close disposition set.
* BUG 15521: smbd: fix close order of base_fsp and stream_fsp in
smb_fname_fsp_destructor().
* BUG 15499: Improve logging for failover scenarios.
* BUG 15093: Files without "read attributes" NFS4 ACL permission are not
listed in directories.
* BUG 13595: CVE-2018-14628 [SECURITY] Deleted Object tombstones visible in
AD LDAP to normal users.
* BUG 15492: Kerberos TGS-REQ with User2User does not work for normal
accounts.
* BUG 15507: vfs_gpfs stat calls fail due to file system permissions.
* BUG 15513: Samba doesn't build with Python 3.12
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 1.9.15p2 to 1.9.15p4
- Update of rootfile not required
- Changelog
1.9.15p4
* Fixed a bug introduced in sudo 1.9.15 that could prevent a user's
privileges from being listed by "sudo -l" if the sudoers entry
in /etc/nsswitch.conf contains "[SUCCESS=return]". This did not
affect the ability to run commands via sudo. Bug #1063.
1.9.15p3
* Always disable core dumps when sudo sends itself a fatal signal.
Fixes a problem where sudo could potentially dump core dump when
it re-sends the fatal signal to itself. This is only an issue
if the command received a signal that would normally result in
a core dump but the command did not actually dump core.
* Fixed a bug matching a command with a relative path name when
the sudoers rule uses shell globbing rules for the path name.
Bug #1062.
* Permit visudo to be run even if the local host name is not set.
GitHub issue #332.
* Fixed an editing error introduced in sudo 1.9.15 that could
prevent sudoreplay from replaying sessions correctly.
GitHub issue #334.
* Fixed a bug introduced in sudo 1.9.15 where "sudo -l > /dev/null"
could hang on Linux systems. GitHub issue #335.
* Fixed a bug introduced in sudo 1.9.15 where Solaris privileges
specified in sudoers were not applied to the command being run.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 9.5p1 to 9.6p1
- Update of rootfile not required
- Changelog is too large to include here. See details in the file ChangeLog in the
source tarball
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 3.1.4 to 3.2.0
- Update of rootfile
- Changelog
3.2.0
This release incorporates the following potentially significant or incompatible
changes:
* The default SSL/TLS security level has been changed from 1 to 2.
* The `x509`, `ca`, and `req` apps now always produce X.509v3 certificates.
* Subject or issuer names in X.509 objects are now displayed as UTF-8 strings
by default.
From my understanding these above changes should not create any problem for
IPFire.
This release adds the following new features:
* Support for client side QUIC, including support for
multiple streams (RFC 9000)
* Support for Ed25519ctx, Ed25519ph and Ed448ph in addition
to existing support for Ed25519 and Ed448 (RFC 8032)
* Support for deterministic ECDSA signatures (RFC 6979)
* Support for AES-GCM-SIV, a nonce-misuse-resistant AEAD (RFC 8452)
* Support for the Argon2 KDF, along with supporting thread pool
functionality (RFC 9106)
* Support for Hybrid Public Key Encryption (HPKE) (RFC 9180)
* Support for SM4-XTS
* Support for Brainpool curves in TLS 1.3
* Support for TLS Raw Public Keys (RFC 7250)
* Support for TCP Fast Open on Linux, macOS and FreeBSD,
where enabled and supported (RFC 7413)
* Support for TLS certificate compression, including library
support for zlib, Brotli and zstd (RFC 8879)
* Support for provider-based pluggable signature algorithms
in TLS 1.3 with supporting CMS and X.509 functionality
With a suitable provider this enables the use of post-quantum/quantum-safe
cryptography.
* Support for using the Windows system certificate store as a source of
trusted root certificates
This is not yet enabled by default and must be activated using an
environment variable. This is likely to become enabled by default
in a future feature release.
* Support for using the IANA standard names in TLS ciphersuite configuration
* Multiple new features and improvements to CMP protocol support
The following known issues are present in this release and will be rectified
in a future release:
* Provider-based signature algorithms cannot be configured using the
SignatureAlgorithms configuration file parameter (#22761)
This release incorporates the following documentation enhancements:
* Added multiple tutorials on the OpenSSL library and in particular
on writing various clients (using TLS and QUIC protocols) with libssl
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 11.6.1 to 11.7.0
- Update of rootfile
- Changelog
11.7.0
* Define CPACK_NSIS_MODIFY_PATH for the Windows builds so the
official installers will offer to modify PATH when installing
qpdf. Fixes#1054.
* Add QPDFAcroFormDocumentHelper::disableDigitalSignatures, which
disables any digital signature fields, leaving their visual
representations intact. The --remove-restrictions command-line
argument now calls this. Fixes#1015.
* Generate a more complete qpdf "man page" from the same source as
qpdf --help. Fixes#1064.
* Allow the syntax "--encrypt --user-password=user-password
--owner-password=owner-password --bits={40,128,256}" when
encrypting PDF files. This is an alternative to the syntax
"--encrypt user-password owner-password {40,128,256}", which will
continue to be supported. The new syntax works better with shell
completion and allows creation of passwords that start with "-".
Fixes#874.
* When setting a check box value, allow any value other than /Off
to mean checked. This is permitted by the spec. Previously, any
value other than /Yes or /Off was rejected. Fixes#1056.
* Fix to QPDF JSON: a floating point number that appears in
scientific notation will be converted to fixed-point notation,
rounded to six digits after the decimal point. Fixes#1079.
* Fix to QPDF JSON: the syntax "n:/pdf-syntax" is now accepted as
an alternative way to represent names. This can be used for any
name (e.g. "n:/text#2fplain"), but it is necessary when the name
contains binary characters. For example, /one#a0two must be
represented as "n:/one#a0two" since the single byte a0 is not
valid in JSON. Fixes#1072.
* From M. Holger: Refactor QPDFParser for performance. See #1059
for a discussion.
* Update code and tests so that qpdf's test suite no longer
depends on the output of any specific zlib implementation. This
makes it possible to get a fully passing test suite with any
API-compatible zlib library. CI tests with the default zlib as
well as zlib-ng (including verifying that zlib-ng is not the
default), but any zlib implementation should work. Fixes#774.
* Bug fix: with --compress-streams=n, don't compress object, XRef,
or linearization hint streams.
* Add new C++ functions "qpdf_c_get_qpdf" and "qpdf_c_wrap" to
qpdf-c.h that make it possible to write your own extern "C"
functions in C++ that interoperate with the C API. See
examples/extend-c-api for more information.
* Bug fix from M. Holger: the default for /Columns in PNG filter
is 1, but libqpdf was acting like it was 0.
* Enhancement from M. Holger: add methods to Buffer to work more
easily with std::string.
11.6.4
* Install fix: include cmake files with the dev component.
* Build AppImage with an older Linux distribution to support AWS
Lambda. Fixes#1086.
11.6.3
* Tweak linearization code to better handle files between 2 GB and
4 GB in size. Fixes#1023.
* Fix data loss bug: qpdf could discard a the character after an
escaped octal string consisting of less than three digits. For
content, this would only happen with QDF or when normalizing
content. Outside of content, it could have happened in any binary
string, such as /ID, if the encoding software used octal escape
strings with less than three digits. This bug was introduced
between 10.6.3 and 11.0.0. Fixes#1050.
11.6.2
* Bug fix: when piping stream data, don't call finish on failure
if the failure was caused by a previous call to finish. Fixes
#1042.
* Push .idea directory with the beginning of a sharable JetBrains
CLion configuration.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 2.42.1 to 2.43.0
- Update of rootfile not required
- Changelog
2.43.0
Backward Compatibility Notes
* The "--rfc" option of "git format-patch" used to be a valid way to
override an earlier "--subject-prefix=<something>" on the command
line and replace it with "[RFC PATCH]", but from this release, it
merely prefixes the string "RFC " in front of the given subject
prefix. If you are negatively affected by this change, please use
"--subject-prefix=PATCH --rfc" as a replacement.
* In Git 2.42, "git rev-list --stdin" learned to take non-revisions
(like "--not") from the standard input, but the way such a "--not" was
handled was quite confusing, which has been rethought. The updated
rule is that "--not" given from the command line only affects revs
given from the command line that comes but not revs read from the
standard input, and "--not" read from the standard input affects
revs given from the standard input and not revs given from the
command line.
UI, Workflows & Features
* A message written in olden time prevented a branch from getting
checked out, saying it is already checked out elsewhere. But these
days, we treat a branch that is being bisected or rebased just like
a branch that is checked out and protect it from getting modified
with the same codepath. The message has been rephrased to say that
the branch is "in use" to avoid confusion.
* Hourly and other schedules of "git maintenance" jobs are randomly
distributed now.
* "git cmd -h" learned to signal which options can be negated by
listing such options like "--[no-]opt".
* The way authentication related data other than passwords (e.g.,
oauth token and password expiration data) are stored in libsecret
keyrings has been rethought.
* Update the libsecret and wincred credential helpers to correctly
match which credential to erase; they erased the wrong entry in
some cases.
Git GUI updates.
* "git format-patch" learned a new "--description-file" option that
lets cover letter description to be fed; this can be used on
detached HEAD where there is no branch description available, and
also can override the branch description if there is one.
* Use of the "--max-pack-size" option to allow multiple packfiles to
be created is now supported even when we are sending unreachable
objects to cruft packs.
* "git format-patch --rfc --subject-prefix=<foo>" used to ignore the
"--subject-prefix" option and used "[RFC PATCH]"; now we will add
"RFC" prefix to whatever subject prefix is specified.
* "git log --format" has been taught the %(decorate) placeholder for
further customization over what the "--decorate" option offers.
* The default log message created by "git revert", when reverting a
commit that records a revert, has been tweaked, to encourage people
to describe complex "revert of revert of revert" situations better in
their own words.
* The command-line completion support (in contrib/) learned to
complete "git commit --trailer=" for possible trailer keys.
* "git update-index" learned the "--show-index-version" option to
inspect the index format version used by the on-disk index file.
* "git diff" learned the "diff.statNameWidth" configuration variable,
to give the default width for the name part in the "--stat" output.
* "git range-diff --notes=foo" compared "log --notes=foo --notes" of
the two ranges, instead of using just the specified notes tree,
which has been corrected to use only the specified notes tree.
* The command line completion script (in contrib/) can be told to
complete aliases by including ": git <cmd> ;" in the alias to tell
it that the alias should be completed in a similar way to how "git
<cmd>" is completed. The parsing code for the alias has been
loosened to allow ';' without an extra space before it.
* "git for-each-ref" and friends learned to apply mailmap to
authorname and other fields in a more flexible way than using
separate placeholder letters like %a[eElL] every time we want to
come up with small variants.
* "git repack" machinery learned to pay attention to the "--filter="
option.
* "git repack" learned the "--max-cruft-size" option to prevent cruft
packs from growing without bounds.
* "git merge-tree" learned to take strategy backend specific options
via the "-X" option, like "git merge" does.
* "git log" and friends learned the "--dd" option that is a
short-hand for "--diff-merges=first-parent -p".
* The attribute subsystem learned to honor the "attr.tree"
configuration variable that specifies which tree to read the
.gitattributes files from.
* "git merge-file" learns a mode to read three variants of the
contents to be merged from blob objects.
Performance, Internal Implementation, Development Support etc.
* "git check-attr" has been taught to work better with sparse-index.
* It may be tempting to leave the help text NULL for a command line
option that is either hidden or too obvious, but "git subcmd -h"
and "git subcmd --help-all" would have segfaulted if done so. Now
the help text is truly optional.
* Tests that are known to pass with LSan are now marked as such.
* Flaky "git p4" tests, as well as "git svn" tests, are now skipped
in the (rather expensive) sanitizer CI job.
* Tests with LSan from time to time seem to emit harmless messages
that make our tests unnecessarily flaky; we work around it by
filtering the uninteresting output.
* Unused parameters to functions are marked as such, and/or removed,
in order to bring us closer to "-Wunused-parameter" clean.
* The code to keep track of existing packs in the repository while
repacking has been refactored.
* The "streaming" interface used for bulk-checkin codepath has been
narrowed to take only blob objects for now, with no real loss of
functionality.
* GitHub CI workflow has learned to trigger Coverity check.
* Test coverage for trailers has been improved.
* The code to iterate over loose references has been optimized to
reduce the number of lstat() system calls.
* The codepaths that read "chunk" formatted files have been corrected
to pay attention to the chunk size and notice broken files.
* Replace macos-12 used at GitHub CI with macos-13.
(merge 682a868f67 js/ci-use-macos-13 later to maint).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 2023c to 2023d
- Update of rootfile not required
- Changelog
2023d
Briefly:
Ittoqqortoormiit, Greenland changes time zones on 2024-03-31.
Vostok, Antarctica changed time zones on 2023-12-18.
Casey, Antarctica changed time zones five times since 2020.
Code and data fixes for Palestine timestamps starting in 2072.
A new data file zonenow.tab for timestamps starting now.
Changes to future timestamps
Ittoqqortoormiit, Greenland (America/Scoresbysund) joins most of
the rest of Greenland's timekeeping practice on 2024-03-31, by
changing its time zone from -01/+00 to -02/-01 at the same moment
as the spring-forward transition. Its clocks will therefore not
spring forward as previously scheduled. The time zone change
reverts to its common practice before 1981.
Fix predictions for DST transitions in Palestine in 2072-2075,
correcting a typo introduced in 2023a.
Changes to past and future timestamps
Vostok, Antarctica changed to +05 on 2023-12-18. It had been at
+07 (not +06) for years. (Thanks to Zakhary V. Akulov.)
Change data for Casey, Antarctica to agree with timeanddate.com,
by adding five time zone changes since 2020. Casey is now at +08
instead of +11.
Changes to past tm_isdst flags
Much of Greenland, represented by America/Nuuk, changed its
standard time from -03 to -02 on 2023-03-25, not on 2023-10-28.
This does not affect UTC offsets, only the tm_isdst flag.
(Thanks to Thomas M. Steenholdt.)
New data file
A new data file zonenow.tab helps configure applications that use
timestamps dated from now on. This simplifies configuration,
since users choose from a smaller Zone set. The file's format is
experimental and subject to change.
Changes to code
localtime.c no longer mishandles TZif files that contain a single
transition into a DST regime. Previously, it incorrectly assumed
DST was in effect before the transition too. (Thanks to Alois
Treindl for debugging help.)
localtime.c's timeoff no longer collides with OpenBSD 7.4.
The C code now uses _Generic only if __STDC_VERSION__ says the
compiler is C11 or later.
tzselect now optionally reads zonenow.tab, to simplify when
configuring only for timestamps dated from now on.
tzselect no longer creates temporary files.
tzselect no longer mishandles the following:
Spaces and most other special characters in BUGEMAIL, PACKAGE,
TZDIR, and VERSION.
TZ strings when using mawk 1.4.3, which mishandles regular
expressions of the form /X{2,}/.
ISO 6709 coordinates when using an awk that lacks the GNU
extension of newlines in -v option-arguments.
Non UTF-8 locales when using an iconv command that lacks the GNU
//TRANSLIT extension.
zic no longer mishandles data for Palestine after the year 2075.
Previously, it incorrectly omitted post-2075 transitions that are
predicted for just before and just after Ramadan. (Thanks to Ken
Murchison for debugging help.)
zic now works again on Linux 2.6.16 and 2.6.17 (2006).
(Problem reported by Rune Torgersen.)
Changes to build procedure
The Makefile is now more compatible with POSIX:
* It no longer defines AR, CC, CFLAGS, LDFLAGS, and SHELL.
* It no longer uses its own 'cc' in place of CC.
* It now uses ARFLAGS, with default specified by POSIX.
* It does not use LFLAGS incompatibly with POSIX.
* It uses the special .POSIX target.
* It quotes special characters more carefully.
* It no longer mishandles builds in an ISO 8859 locale.
Due to the CC changes, TZDIR is now #defined in a file tzfile.h
built by 'make', not in a $(CC) -D option. Also, TZDEFAULT is
now treated like TZDIR as they have similar roles.
Changes to commentary
Limitations and hazards of the optional support for obsolescent
C89 platforms are documented better, along with a tentative
schedule for removing this support.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
the kernel has no CONFIG_MICROCODE_{AMD|INTEL} anymore so this patch change the check
to CONFIG_MICROCODE.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
