- Update from version 20230804 to 20231030
- Update of rootfile - process defined by Peter Mueller used on rootfile to identify
changes and check if the entries were commented out in previous rootfile.
This is second time that I have used this approach so probably still worthwhile for
Peter to confirm I got it correct.
- Patch for amd family 19h removed as it is now included in the source tarball.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 5.9.11 to 5.9.12
- Update of rootfile
- Changelog
5.9.12
Vulnerabilities
Fixed a vulnerability in charon-tkm (the TKM-backed version of the charon IKE
daemon) related to processing DH public values that can lead to a buffer
overflow and potentially remote code execution. This vulnerability has been
registered as CVE-2023-41913. Please refer to our blog for details.
New Feature Additions
The new pki --ocsp command produces OCSP responses based on certificate status
information provided by implementations of the new ocsp_responder_t interface
(#1958).
Two sources are currently available, the openxpki plugin that directly
accesses the OpenXPKI database and the command's --index argument, which
reads certificate status information from OpenSSL-style index.txt files
(multiple CAs are supported concurrently).
The new cert-enroll script handles the initial enrollment of an X.509 host
certificate with a PKI server via the EST or SCEP protocols.
Run as a systemd timer or via a crontab entry, the script checks the
expiration date of the host certificate daily. When a given deadline is
reached, the host certificate is automatically renewed via EST or SCEP
re-enrollment based on the possession of the old private key and the
matching certificate.
Added a global option (charon.reject_trusted_end_entity) to prevent peers
from authenticating with certificates that are locally trusted, in
particular, our own local certificate, which safeguards against accidental
reuse of certificates on multiple peers. As the name suggests, all trusted
end-entity certificates are rejected if enabled, so peer certificates can't
be configured explicitly anymore (e.g. via remote.certs in swanctl.conf).
The --priv argument for charon-cmd allows the use of any type of private key
(previously, only RSA keys were supported).
The openssl plugin now supports the nameConstraints extension in X.509
certificates (#1990).
Support for nameConstraints of type iPAddress are now supported by the x509,
openssl and constraints plugins (#1991).
Support for encoding subjectAlternativeName extensions of type
uniformResourceIdentifier in X.509 certificates has been added via the uri:
prefix (e.g. for URNs, #1983).
Support for password-less PKCS#12 and PKCS#8 files has been added (#1955).
Enhancements and Optimizations
Because of a relatively recent NIAP requirement (TD0527, Test 8b), loading of
certificates with ECDSA keys that explicitly encode the curve parameters is
rejected if possible. Explicit encoding is pretty rare to begin with and
e.g. wolfSSL already rejects such keys, by default. All crypto plugins that
support ECDSA enforce this by rejecting such public keys, except when using
older versions of OpenSSL (< 1.1.1h) or Botan (< 3.2.0) (#1949).
Make the NetworkManager plugin (charon-nm) actually use the XFRM interface it
creates since 5.9.10. This involves setting interface IDs on SAs and
policies, and installing routes via the interface. To avoid routing loops if
the remote traffic selectors include the VPN server, IKE and ESP packets are
marked to bypass the routing table that contains the routes via XFRM
interface (69e0c11).
If available, the plugin now also adopts the interface name configured in
connection.interface-name in a *.nmconnection file as name for the XFRM
interface instead of generating one randomly (e8f8d32).
The resolve plugin tries to maintain the order of DNS servers it installs via
resolvconf or resolv.conf (6440975, 8238ad4).
The kernel-libipsec plugin now always installs routes to remote networks even
if no address is found in the local traffic selectors, which allows
forwarding traffic from networks the VPN host is not part of (190d8cb).
Increased the default receive buffer size for Netlink sockets to 8 MiB
(doubled by the kernel to account for overhead) and simplified the
configuration (no need for a separate option to force overriding rmem_max).
It's now also set for event sockets, which previously could cause issues on
hosts with e.g. lots of route changes (#1757).
When issuing certificates, the subjectKeyIdentifier of the issuing
certificate, if available, is now copied as authorityKeyIdentifier, instead
of always generating a SHA-1 hash of the issuer's subjectPublicKey
(#1992, 6941dcb).
Explicitly request permission to display notifications on Android 13+
(ddf84c1), also enabled hardware acceleration for the Android-specific
OpenSSL build.
Fixes
Fixed issues while reestablishing multiple CHILD_SAs (e.g. after a DPD
timeout) that could cause a reqid to get assigned to multiple CHILD_SAs with
unrelated traffic selectors (#1855).
Fixed an issue in watcher_t with handling errors on sockets (e.g. if the
receive buffer is full), which caused an infinite loop if poll() only
signaled POLLERR as event (#1757).
Fixed an issue in the IKE_SA_INIT tracking code that was added with 5.9.6,
which did not correctly untrack invalid messages with non-zero message IDs
or SPIs (0b47357).
Fixed a regression introduced with 5.9.8 when handling IKE redirects during
IKE_AUTH (595fa07).
Fixed adding the XFRMA_REPLAY_ESN_VAL attribute twice when updating SAs in
the kernel-netlink plugin, which prevented MOBIKE updates if a large
anti-replay window was used (#1967).
Fixed a race condition in the kernel-pfroute plugin when adding virtual IPs
if the TUN device is activated after the address was already added
internally, which caused the installed route not to go via TUN device in
order to force the virtual IP as source address (#1807).
Fixed an issue in libtls that could cause the wrong ECDH group to get
instantiated (b5e4bf4).
Fixed the encoding of the CHILD_SA_NOT_FOUND notify if a CHILD_SA is not
found during rekeying. It was previously empty, now contains the SPI and
sets the protocol to the values received in the REKEY_SA notify (849c2c9).
Fixed a possible issue with MOBIKE in the Android client on certain devices
(#1691).
For Developers
The new ocsp_responder_t interface can be implemented to provide certificate
status information to the pki --ocsp command. Responders can be
(un-)registered via the ocsp_responders_t instance at lib->ocsp.
For the watcher_t component, WATCHER_EXCEPT has been removed as there is no
way to explicitly listen for errors on sockets and poll() actually can
return POLLERR for any FD and it might even be the only signaled event
(which caused an infinite loop previously). Now we simply notify the
registered callbacks. The error is then reported by e.g. recvfrom(), which
was already the case before if POLLERR was returned together with
e.g. POLLIN.
The reqids allocated for CHILD_SAs (including trap policies) via
kernel_interface_t::alloc_reqid() are now refcounted. When recreating a
CHILD_SA, a reference to the reqid can be requested via
child_sa_t::get_reqid_ref(). If another reference is required afterwards,
one can be acquired directly via kernel_interface_t::ref_reqid(). Each
reference has to be released via kernel_interface_t::release_reqid(), whose
interface was simplified.
The testing environment is now based on Debian 12 (bookworm), by default.
Also, when copying files to guests, the guest-specific files are now copied
after the default files, which allows overriding files per guest (fixes an
issue with winnetou's /etc/fstab and mounting the test results).
Refer to the 5.9.12 milestone for a list of all closed issues and pull requests.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 0.24.13 to 0.24.14
- Update of rootfile not required
- Changelog
0.23.14 (2023/10/08)
* decoder
- flac: fix scanning files with non-ASCII names on Windows
- mad: fix calculation of LAME peak values
* mixer
- wasapi: fix problem setting volume
* more libfmt 10 fixes
* fix auto-detected systemd unit directory
* Android
- require Android 7 or newer
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 2.8 to 2.9
- Update of rootfile
- Changelog
This file (NEWS) lists the most important changes to
the previous released version. For a full list of changes
please refer to the ChangeLog file.
New for version 2.9:
- Change Hardware Flow Control Default to No.
- Timestamping mode is now saved and restored.
- Split "Screen and Keyboard" menu into two menus.
- Update to gettext-0.21.
- Change return values of --help and --version to success.
- Support higher baud rates on MacOS
- Save character send delay to config file
- Save newline send delay to config file
- Update translations: Romanian, German, French, Norwegian/Bookmal, Polish,
Serbian, Swedish
- New translation: Georgian, Korean
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 1.3.2 to 1.3.3
- Update of rootfile not required
- Changelog
1.3.3 - Released 1-Jun-2023
- Fixed HTTP chunk length parsing.
- Improved Dutch and Swedish translations.
- Fixed directory symlink deletion handling.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 1.2.0 to 1.2.3
- Update of rootfile
- Changelog
The meson changelog is defined only at the 1.2 level. So what changes are related in
going from 1.2.0 to 1.2.3 can not be determined.
The changes have to be reviewed from the 1.2 branch of commits
https://github.com/mesonbuild/meson/commits/1.2
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 1.10 to 1.11
- Update of rootfile not required
- Previous versions of this package used to be on bitbucket but that link no longer exists.
The new git repo https://github.com/geekman/mdns-repeater was started by someone else as
a fork but the original developer then moved to it. However all the history was not moved
to the new repo so that repo starts now with version 1.11. It is being worked on as the
last commit was Aug 2023 however version 1.11 was released in 2016. There are 11 commits
between version 1.11 and present time.
- Changelog
1.11
Blacklist feature added (16 blacklisted subnets allowed).
Socket limit increased to 16 sockets, moved to #define.
The first is most interesting. Say you have two networks bound together
with site-to-site tunnels, repeating mDNS over the tunnel... And there
are Chromecasts, or Apple TV's at both ends. Even if you had firewall
rules to block traffic, the devices would still show up (albeit be
defective) on the opposite network.
The new blacklist flag allows you to filter such devices out by specifying
their subnet (or individual addresses, although having such "private"
devices on their own subnet might be a good idea).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 181 to 196
- Update of rootfile not required
- Fix python call patch removed as correct python call now in the source tarball
- Changelog file is no longer used. Review of changes has to be done via the git repo.
https://git.kernel.org/pub/scm/utils/cpu/mce/mcelog.git/log/
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 5.4.4 to 5.4.6
- Update of rootfile
- Updated version number in shared library patch
- Changelog
5.4.6
read overflow in 'l_strcmp'. Reported by Xmilia Hermit on 09 Jun 2023. existed
since 5.0 (at least). fixed in github.
Call hook may be called twice when count hook yields. Reported by G.k Ray on
20 Jul 2023. existed since 5.4.0 (at least). fixed in github.
Wrong line number for function calls. Reported by Thadeu de Paula on 20 Aug 2023.
existed since 5.2. fixed in github.
5.4.5
Changing the signature of 'lua_resetthread' broke ABI. Reported by Andrew Gierth
on 29 Apr 2023. fixed in 5.4.6. fixed in github
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 5.4.0 to 5.4.5
- Update of rootfile
- Changelog
5.4.5 (2023-11-01)
* liblzma:
- Use __attribute__((__no_sanitize_address__)) to avoid address
sanitization with CRC64 CLMUL. It uses 16-byte-aligned reads
which can extend past the bounds of the input buffer and
inherently trigger address sanitization errors. This isn't
a bug.
- Fixed an assertion failure that could be triggered by a large
unpadded_size argument. It was verified that there was no
other bug than the assertion failure.
- Fixed a bug that prevented building with Windows Vista
threading when __attribute__((__constructor__)) is not
supported.
* xz now properly handles special files such as "con" or "nul" on
Windows. Before this fix, the following wrote "foo" to the
console and deleted the input file "con_xz":
echo foo | xz > con_xz
xz --suffix=_xz --decompress con_xz
* Build systems:
- Allow builds with Windows win95 threading and small mode when
__attribute__((__constructor__)) is supported.
- Added a new line to liblzma.pc for MSYS2 (Windows):
Cflags.private: -DLZMA_API_STATIC
When compiling code that will link against static liblzma,
the LZMA_API_STATIC macro needs to be defined on Windows.
- CMake specific changes:
* Fixed a bug that allowed CLOCK_MONOTONIC to be used even
if the check for it failed.
* Fixed a bug where configuring CMake multiple times
resulted in HAVE_CLOCK_GETTIME and HAVE_CLOCK_MONOTONIC
not being set.
* Fixed the build with MinGW-w64-based Clang/LLVM 17.
llvm-windres now has more accurate GNU windres emulation
so the GNU windres workaround from 5.4.1 is needed with
llvm-windres version 17 too.
* The import library on Windows is now properly named
"liblzma.dll.a" instead of "libliblzma.dll.a"
* Fixed a bug causing the Ninja Generator to fail on
UNIX-like systems. This bug was introduced in 5.4.0.
* Added a new option to disable CLMUL CRC64.
* A module-definition (.def) file is now created when
building liblzma.dll with MinGW-w64.
* The pkg-config liblzma.pc file is now installed on all
builds except when using MSVC on Windows.
* Added large file support by default for platforms that
need it to handle files larger than 2 GiB. This includes
MinGW-w64, even 64-bit builds.
* Small fixes and improvements to the tests.
* Updated translations: Chinese (simplified) and Esperanto.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 015 to 017
- Update of rootfile
- Changelog
017
lsusb: fix up [unknown] vendor and product strings.
lsusb: fix build warning for dump_billboard_alt_mode_capability_desc()
lsusb: add fallback names for 'lsusb -v' output
names: simplify get_vendor_product_with_fallback() a bit
Honor system libdir and includedir
016
usbutils: lsusb-t: print entries for devices with no interfaces
Fix a typo in usb-spec.h
lsusb.py.in: Display (device) power/wakeup via -w option.
Fix an incorrect length value in hid descriptor.
Fix misalignments in hid device descripptor.
Use bigger buffer to place speed value string
lsusb -h returns an error
lsusb -h fixups
lsusb -t: sort in bus order, not reverse order
lsusb -t: print ports and busses and devices with same width
lsusb -t: assign_interface_to_parent() fixups
lsusb.8.in: fix up missing '-' in text
README.md: add source location
lsusb.py: fix up wakeup logic for devices that do not support it
lsusb.py.in: add another default path for usb.ids
names.c: if a string can not be found in the usb.ids file, return [unknown]
lsusb-t: if a driver is not bound to an interface, report "[none]"
Generate usbutils.pc pkgconfig file
usbreset: Allow idProduct and idVendor to be 0
usb-devices: make shellcheck happy
lsusb: Add function that sorts the output by device ID.
lsusb: Additional sorting by bus number.
lsusb: This is a more compact implementation of the device list sort implemented
within this pull request. The output remains the same as the one demonstrated in
the previous commit.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 1.9.14p2 to 1.9.15p2
- Update of rootfile
- Changelog
1.9.15p2
* Fixed a bug on BSD systems where sudo would not restore the
terminal settings on exit if the terminal had parity enabled.
GitHub issue #326.
1.9.15p1
* Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based
sudoers from being able to read the ldap.conf file.
GitHub issue #325.
1.9.15
* Fixed an undefined symbol problem on older versions of macOS
when "intercept" or "log_subcmds" are enabled in sudoers.
GitHub issue #276.
* Fixed "make check" failure related to getpwent(3) wrapping
on NetBSD.
* Fixed the warning message for "sudo -l command" when the command
is not permitted. There was a missing space between "list" and
the actual command due to changes in sudo 1.9.14.
* Fixed a bug where output could go to the wrong terminal if
"use_pty" is enabled (the default) and the standard input, output
or error is redirected to a different terminal. Bug #1056.
* The visudo utility will no longer create an empty file when the
specified sudoers file does not exist and the user exits the
editor without making any changes. GitHub issue #294.
* The AIX and Solaris sudo packages on www.sudo.ws now support
"log_subcmds" and "intercept" with both 32-bit and 64-bit
binaries. Previously, they only worked when running binaries
with the same word size as the sudo binary. GitHub issue #289.
* The sudoers source is now logged in the JSON event log. This
makes it possible to tell which rule resulted in a match.
* Running "sudo -ll command" now produces verbose output that
includes matching rule as well as the path to the sudoers file
the matching rule came from. For LDAP sudoers, the name of the
matching sudoRole is printed instead.
* The embedded copy of zlib has been updated to version 1.3.
* The sudoers plugin has been modified to make it more resilient
to ROWHAMMER attacks on authentication and policy matching.
This addresses CVE-2023-42465.
* The sudoers plugin now constructs the user time stamp file path
name using the user-ID instead of the user name. This avoids a
potential problem with user names that contain a path separator
('/') being interpreted as part of the path name. A similar
issue in sudo-rs has been assigned CVE-2023-42456.
* A path separator ('/') in a user, group or host name is now
replaced with an underbar character ('_') when expanding escapes
in @include and @includedir directives as well as the "iolog_file"
and "iolog_dir" sudoers Default settings.
* The "intercept_verify" sudoers option is now only applied when
the "intercept" option is set in sudoers. Previously, it was
also applied when "log_subcmds" was enabled. Sudo 1.9.14
contained an incorrect fix for this. Bug #1058.
* Changes to terminal settings are now performed atomically, where
possible. If the command is being run in a pseudo-terminal and
the user's terminal is already in raw mode, sudo will not change
the user's terminal settings. This prevents concurrent sudo
processes from restoring the terminal settings to the wrong values.
GitHub issue #312.
* Reverted a change from sudo 1.9.4 that resulted in PAM session
modules being called with the environment of the command to be
run instead of the environment of the invoking user.
GitHub issue #318.
* New Indonesian translation from translationproject.org.
* The sudo_logsrvd server will now raise its open file descriptor
limit to the maximum allowed value when it starts up. Each
connection can require up to nine open file descriptors so the
default soft limit may be too low.
* Better log message when rejecting a command if the "intercept"
option is enabled and the "intercept_allow_setid" option is
disabled. Previously, "command not allowed" would be logged and
the user had no way of knowing what the actual problem was.
* Sudo will now log the invoking user's environment as "submitenv"
in the JSON logs. The command's environment ("runenv") is no
longer logged for commands rejected by the sudoers file or an
approval plugin.
1.9.14p3
* Fixed a crash with Python 3.12 when the sudo Python plugin is
unloaded. This only affects "make check" for the Python plugin.
* Adapted the sudo Python plugin test output to match Python 3.12.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 6.3 to 6.6
- Update of rootfile not required
- Changelog
6.6 (2023-10-31)
* Improvements
* Implemented --kill-on-exit option that instructs the tracer to set
PTRACE_O_EXITKILL option to all tracee processes and not to detach them
on cleanup so they will not be left running after the tracer exit.
* Implemented automatic activation of --kill-on-exit option when
--seccomp-bpf is enabled and -p/--attach option is not used.
* Implemented decoding of map_shadow_stack syscall.
* Implemented decoding of FSCONFIG_CMD_CREATE_EXCL fsconfig command.
* Implemented decoding of IFLA_BRPORT_BACKUP_NHID netlink attribute.
* Implemented decoding of SECCOMP_IOCTL_NOTIF_SET_FLAGS ioctl.
* Implemented decoding of UFFDIO_CONTINUE, UFFDIO_POISON, and
UFFDIO_WRITEPROTECT ioctls.
* Updated lists of ARCH_*, BPF_*, DEVCONF_*, IORING_*, KEXEC_*, MAP_*, NT_*,
PTRACE_*, QFMT_*, SEGV_*, UFFD_*, V4L2_*, and XDP_* constants.
* Updated lists of ioctl commands from Linux 6.6.
6.5 (2023-09-01)
* Improvements
* Implemented decoding of cachestat and fchmodat2 syscalls.
* Implemented decoding of SO_PASSPIDFD and SO_PEERPIDFD socket options.
* Implemented decoding of SCM_PIDFD control messages.
* Implemented decoding of BPF_ENABLE_STATS, BPF_ITER_CREATE, BPF_LINK_DETACH,
and BPF_PROG_BIND_MAP bpf syscall commands.
* Updated decoding of BPF_OBJ_PIN and BPF_OBJ_GET bpf syscall commands.
* Updated lists of AT_*, BPF_*, IORING_*, KVM_*, MOVE_MOUNT_*, NFT_*, NT_*,
PR_*, and V4L2_* constants.
* Updated lists of ioctl commands from Linux 6.5.
6.4 (2023-06-26)
* Improvements
* Implemented decoding of IFLA_BRPORT_NEIGH_VLAN_SUPPRESS netlink attribute.
* Implemented decoding of IP_PROTOCOL type control messages and socket option.
* Updated lists of BPF_*, IP_*, KVM_*, MDBA_*, PACKET_*, PR_*, PTRACE_*,
UFFD_*, and V4L2_PIX_FMT_* constants.
* Updated lists of ioctl commands from Linux 6.4.
* Bug fixes
* Turn --seccomp-bpf off when --syscall-limit option is specified.
* Fixed --trace-fds filtering support of syscalls taking file descriptor
arguments that do not normally have a path associated with them.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 4.13 to 4.14.2
- Update of rootfile not required
- Supress installation of groups patch updated for changed layout of source tarball
- Changelog
4.14.2:
libshadow:
Fix build with musl libc.
Avoid NULL dereference.
Update utmp at an initial login
useradd(8):
Set proper SELinux labels for def_usrtemplate
Manual:
Document --prefix in chage(1), chpasswd(8), and passwd(1)
4.14.1:
Build system:
Merge libshadow and libmisc into a single libshadow. This fixes
problems in the linker, which were reported at least in Gentoo.
4.14.0
This release includes some steps toward preparing for the Y2038 (e.g. removing
lastlog conditionally), a great deal of removal of obsolete function checks (like
rmdir), and overhaul of some string manipulation functions, of which there is
more to come. And a great deal more. The abbreviated git log follows:
Serge Hallyn: configure.ac: check for strlcpy
Michael Vetter: Remove intree website
Serge Hallyn: 4.14.0-rc4 pre-release
Serge Hallyn: Releases: add etc/shadow-maint to distfiles
Serge Hallyn: 4.14.0-rc3
Iker Pedrosa: libmisc: include freezero
Iker Pedrosa: libmisc: add freezero source code
Iker Pedrosa: libmisc: add readpassphrase source code
Iker Pedrosa: configure: add with-libbsd option
Iker Pedrosa: man: include shadow-man.xsl in tarball
Iker Pedrosa: man: include its.rules in tarball
Iker Pedrosa: autogen: enable lastlog build
Christian Göttsche: Add wrapper for write(2)
Serge Hallyn: tag 4.14.0-rc2
Michael Vetter: Add new files to libmisc_la_SOURCES
Serge Hallyn: Add a make dist CI test
Serge Hallyn: 4.14.0-rc1
Serge Hallyn: remove xmalloc.c from POTFILES.in
Iker Pedrosa: logoutd: add missing <utmp.h> include
Iker Pedrosa: CI: compile old utmp interface in Fedora
Iker Pedrosa: src: add SELINUX library
Iker Pedrosa: libmisc: conditionally compile utmp.c and logind.c
Iker Pedrosa: lib: replace USER_NAME_MAX_LENGTH macro
Iker Pedrosa: libmisc: call active_sessions_count()
Iker Pedrosa: libmisc: implement active_sessions_count()
Iker Pedrosa: utmp: update update_utmp()
Iker Pedrosa: utmp: move update_utmp
Iker Pedrosa: utmp: move failtmp()
Iker Pedrosa: libmisc: implement get_session_host()
Iker Pedrosa: configure: new option enable-logind
xiongshenglan: shadow userdel: add the adaptation to the busybox ps in 01-kill_user_procs.sh
Michael Vetter: chsh: warn if root sets a shell not listed in /etc/shells
Michael Vetter: doc: mention ci workflow file to learn about deps
Serge Hallyn: man/po/Makefile: add a comment to shadow-man-pages.pot
Vegard Nossum: newgrp: fix potential string injection
Todd Zullinger: lastlog: fix alignment of Latest header
Iker Pedrosa: configure: fix lastlog check
Alan D. Salewski: subuid.5: reference newusers(8) rather than newusers(1)
Iker Pedrosa: CI: build lastlog in Fedora
Iker Pedrosa: man: conditionally build lastlog documentation
Iker Pedrosa: usermod: conditionally build lastlog functionality
Iker Pedrosa: useradd: conditionally build lastlog functionality
Iker Pedrosa: login: conditionally build lastlog functionality
Iker Pedrosa: lastlog: stop building by default
Iker Pedrosa: CI: update debian repos
Bernd Kuhls: Fix yescrypt support
Jeffrey Bencteux: chgpasswd: fix segfault in command-line options
Alejandro Colomar: gpasswd(1): Fix password leak
Alejandro Colomar: src/useradd.c: create_mail(): Cosmetic
Alejandro Colomar: src/useradd.c: create_home(): Cosmetic
Alejandro Colomar: src/useradd.c: create_home(): Cosmetic
Alejandro Colomar: src/useradd.c: create_home(): Cosmetic
Alejandro Colomar: src/useradd.c: close_group_files(): Cosmetic
Alejandro Colomar: src/useradd.c: check_uid_range(): Cosmetic
Jaroslav Jindrak: build: link passwd, chpasswd and chage against libdl
Jaroslav Jindrak: configure: check whether fgetpwent_r is available before marking xprefix_getpwnam_r as reentrant
Jaroslav Jindrak: passwd: fall back to non-PAM code when prefix is used
Jaroslav Jindrak: chpasswd: fall back to non-PAM code when prefix is used
Jaroslav Jindrak: chpasswd: add --prefix/-P options
Jaroslav Jindrak: chage: add --prefix/-P options
Jaroslav Jindrak: passwd: Respect --prefix/-P options
Michael Vetter: prefix: add prefix support
Iker Pedrosa: strtoday: remove unnecessary cast
Alejandro Colomar: Use temporary variable
Alejandro Colomar: realloc(NULL, ...) is equivalent to malloc(...)
Alejandro Colomar: Simplify allocation APIs
Christian Göttsche: Drop alloca(3)
Christian Göttsche: usermod: fix off-by-one issues
Alejandro Colomar: libmisc/csrand.c: Update comments
Alejandro Colomar: lib/nss.c: Fix use of invalid p
Alejandro Colomar: lib/nss.c: Fix use of uninitialized p
Alejandro Colomar: Centralize error handling
Alejandro Colomar: Second verse, it gets worse; it gets no better than this
Alejandro Colomar: ROFL: Rolling on the floor looping
Alejandro Colomar: This ain't no loop
Iker Pedrosa: newusers: Improve error message
Martin Kletzander: ch(g)passwd: Check selinux permissions upon startup
Skyler Ferrante: Check if crypt_method null before dereferencing
Alejandro Colomar: xgetXXbyYY: Simplify elifs
Alejandro Colomar: xgetXXbyYY: Centralize error handling
Alejandro Colomar: xgetXXbyYY: tfix
Samanta Navarro: xgetXXbyYY: Avoid duplicated error handling block
Samanta Navarro: xgetXXbyYY: Handle DUP_FUNCTION failure
Serge Hallyn: sub_[ug]id_{add,remove}: fix return values
Martin Kletzander: usermod: Small optimization using memmove for password unlock
Alejandro Colomar: Reorder logic to improve comprehensibility
Alejandro Colomar: newusers: Fail early
Alejandro Colomar: newusers: Add missing error handling
Samanta Navarro: libmisc: Use safer chroot/chdir sequence
Samanta Navarro: su: Prevent stack overflow in check_perms
Samanta Navarro: subsystem: Prevent endless loop
Serge Hallyn: def_load: avoid NULL deref
Serge Hallyn: def_load: split the econf from non-econf definition
Tobias Stoeckmann: Plug econf memory leaks
Samanta Navarro: chsh: Verify that login shell path is absolute
Samanta Navarro: process_prefix_flag: Drop privileges
bubu: Update French translations
Samanta Navarro: get_pid.c: Use tighter validation checks
Markus Hiereth: replace inadequate German translation of login error message
Markus Hiereth: Update German translations
Samanta Navarro: Remove some static char arrays
Samanta Navarro: commonio: Use do_lock_file again
Serge Hallyn: Fix broken docbook translations
ed neville: open with O_CREAT when lock path does not exist
Samanta Navarro: commonio_open: Remove fcntl call
Samanta Navarro: commonio_lock_nowait: Remove deprecated code
Samanta Navarro: login_prompt: Simplify login_prompt API
Samanta Navarro: login_prompt: Use _exit in signal handler
Samanta Navarro: login_prompt: Do not parse environment variables
Samanta Navarro: libmisc/yesno.c: Fix regression
Alejandro Colomar: libmisc, man: Drop old check and advice for complex character sets in passwords
Christian Göttsche: semanage: disconnect to free libsemanage internals
Christian Göttsche: commonio: free removed database entries
ed neville: run_parts for groupadd and groupdel
lilinjie: fix typos
Alejandro Colomar: libmisc/yesno.c: Use getline(3) and rpmatch(3)
Samanta Navarro: newgrp/useradd: always set SIGCHLD to default
Serge Hallyn: Update AUTHORS to add Marek Michałkiewicz
Samanta Navarro: Read whole line in yes_or_no
Christian Göttsche: useradd/usermod: add --selinux-range argument
Alejandro Colomar: CI: Make build logs more readable
Iker Pedrosa: ci: remove explicit fedora dependencies
Iker Pedrosa: README: add reference to contribution guidelines
Iker Pedrosa: doc: add contributions introduction
Iker Pedrosa: doc: add license
Iker Pedrosa: doc: add releases
Iker Pedrosa: doc: add Continuous Integration
Iker Pedrosa: doc: add tests
Iker Pedrosa: doc: add coding style
Iker Pedrosa: doc: add build & install
Serge Hallyn: trivial: vipw.8: fix grammar
Christian Göttsche: sssd: skip flushing if executable does not exist
Christian Göttsche: Overhaul valid_field()
Martin Kletzander: semanage: Do not set default SELinux range
Michael Vetter: Fix typo in groupadd usage
Christian Göttsche: ci: update Differential ShellCheck
tomspiderlabs: Added control character check
Mike Gilbert: usermod: respect --prefix for --gid option
Alejandro Colomar: Fix su(1) silent truncation
Alejandro Colomar: Simplify is_my_tty()
Alejandro Colomar: Fix is_my_tty() buffer overrun
Alejandro Colomar: Add STRLEN(): a constexpr strlen(3) for string literals
Alejandro Colomar: Fix crash with large timestamps
Paul Eggert: Prefer strcpy(3) to strlcpy(3) when either works
Paul Eggert: Fix change_field() buffer underrun
Paul Eggert: Omit unneeded test in change_field()
Paul Eggert: Simplify change_field() by using strcpy
skyler-ferrante: Fix null dereference in basename
Iker Pedrosa: CI: script for local container build
Iker Pedrosa: CI: build project in containers
Iker Pedrosa: container: add fedora
Iker Pedrosa: container: add debian
Iker Pedrosa: container: add alpine
Iker Pedrosa: SECURITY.md: add Iker Pedrosa
Christian Göttsche: selinux: use type safe function pointer assignment
Christian Göttsche: Use strict prototype in definition
Vinícius dos Santos Oliveira: Add .editorconfig
Serge Hallyn: run_some: fix shellcheck warning
Serge Hallyn: fail on any run_some test failure
Serge Hallyn: ignore first test in run_some
Serge Hallyn: swap first two tests - does the first one still fail?
Serge Hallyn: tests: remove some github runner PATH tweaking
Alejandro Colomar: tests: Support git-worktree(1)
Serge Hallyn: tests: newuidmap and newgidmap: update expected fail message
Serge Hallyn: libsubid: include alloc.h
Serge Hallyn: run_some: log stderr
Vinícius dos Santos Oliveira: Validate fds created by the user
Serge Hallyn: get_pidfd_from_fd: return -1 on error, not 0
Serge Hallyn: g-h-a workflow: workaround
Serge Hallyn: Fix regression in some translation strings
Iker Pedrosa: lib: bit_ceil_wrapul(): stop recursion
Iker Pedrosa: lib: define ULONG_WIDTH if non-existent
maqi: Update translation
Serge Hallyn: newuidmap and newgidmap: support passing pid as fd
Alejandro Colomar: Fix use-after-free of pointer after realloc(3)
Alejandro Colomar: Use safer allocation macros
Alejandro Colomar: libmisc: Add safer allocation macros
Alejandro Colomar: Use xreallocarray() instead of its pattern
Alejandro Colomar: Use reallocarrayf() instead of its pattern
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 2.28.3 to 2.28.5
- Update of rootfile
- Changelog
2.28.5
This is a stable bugfix release, with the following changes:
Added support for the HP HyperX Clutch Gladiate controller
Fixed a crash if a controller is disconnected while SDL is opening it
Fixed a crash on Linux if XInput2 isn't available at runtime
2.28.4
This is a stable bugfix release, with the following changes:
Enable clipping for zero sized rectangles in the SDL renderer
Notify X11 clipboard managers when the clipboard changes
Fixed sensor timestamps for third-party PS5 controllers
Added detection for Logitech and Simagic racing wheels
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 8.1.1 to 8.1.2
- Update of rootfile not required
- Changelog is only provided at the 8.1 level and not lower. There is no further info on
what changes occurred in the changelog. For more details the git repo commits need to
be reviewed - https://gitlab.com/qemu-project/qemu/-/commits/master
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 8.1.1 to 8.1.2
- Update of rootfile not required
- Changelog is only provided at the 8.1 level and not lower. There is no further info on
what changes occurred in the changelog. For more details the git repo commits need to
be reviewed - https://gitlab.com/qemu-project/qemu/-/commits/master
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from 2.8.0 to 2.8.1
- Update of rootfile
- Disable creating docs i9n configure statement
- Changelog is too large to include here (~500 lines). For more details read the NEWS.adoc
file in thye source tarball.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update pci.ids from version 2023.08.12 to 2023.09.22
- Update usb.ids from version 2023.08.24 to 2023.11.08
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 0.189 to 0.190
- Update of rootfile
- Changelog
0.190
CONTRIBUTING: Switch from real name policy to known identity policy.
Updated ChangeLog policy (no more separate ChangeLog files).
There is a SECURITY bug policy now.
The default branch is now 'main'.
libelf: Add RELR support.
libdw: Recognize .debug_[ct]u_index sections
readelf: Support readelf -Ds, --use-dynamic --symbol.
Support .gdb_index version 9
scrlines: New tool that compiles a list of source files associated
with a specified dwarf/elf file.
debuginfod: Schema change (reindexing required, sorry!) for a 60%
compression in filename representation, which was a large
part of the sqlite index; also, more deliberate sqlite
-wal management during scanning using the
--scan-checkpoint option.
backends: Various LoongArch updates.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 3.8.2 to 3.8.3
- Update of rootfile not required
- Changelog
3.8.3
Bugfix (defect introduced Postfix 2.5, date 20080104): the Postfix SMTP server
was waiting for a client command instead of replying immediately, after a
client certificate verification error in TLS wrappermode. Reported by
Andreas Kinzler.
Usability: the Postfix SMTP server (finally) attempts to log the SASL username
after authentication failure. In Postfix logging, this appends
", sasl_username=xxx" after the reason for SASL authentication failure. The
logging replaces an unavailable reason with "(reason unavailable)", and
replaces an unavailable sasl_username with "(unavailable)". Based on code by
Jozsef Kadlecsik.
Compatibility bugfix (defect introduced: Postfix 2.11, date 20130405): in
forward_path, the expression ${recipient_delimiter} would expand to an empty
string when a recipient address had no recipient delimiter. The compatibility
fix is to use a configured recipient delimiter value instead. Reported by
Tod A. Sandman.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 8.1.1 to 8.2.2
- Update of rootfile
- Changelog
8.2.2
- Fix regression from 8.1.0 in shaping fonts with duplicate feature tags.
- Fix regression from 8.2.0 in parsing CSS-style feature strings.
- Variable fonts instanciation now handles more tables.
- Various CMake build improvements.
- various fixes to build without errors with gcc 4.9.2.
8.2.1
- Unicode 15.1 support.
8.2.0
- Various build and fuzzing fixes
- Improvements to COLRv1 painting.
- New API:
+hb_paint_color_glyph_func_t
+hb_paint_funcs_set_color_glyph_func
+hb_paint_color_glyph
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 2.42.0 to 2.42.1
- Update of rootfile not required
- Changelog
* Tests that are known to pass with LSan are now marked as such.
* Flaky "git p4" tests, as well as "git svn" tests, are now skipped
in the (rather expensive) sanitizer CI job.
* Tests with LSan from time to time seem to emit harmless message
that makes our tests unnecessarily flaky; we work it around by
filtering the uninteresting output.
* GitHub CI workflow has learned to trigger Coverity check.
* Overly long label names used in the sequencer machinery are now
chopped to fit under filesystem limitation.
* Scalar updates.
* Tweak GitHub Actions CI so that pushing the same commit to multiple
branch tips at the same time will not waste building and testing
the same thing twice.
* The commit-graph verification code that detects mixture of zero and
non-zero generation numbers has been updated.
* "git diff -w --exit-code" with various options did not work
correctly, which is being addressed.
* transfer.unpackLimit ought to be used as a fallback, but overrode
fetch.unpackLimit and receive.unpackLimit instead.
* The use of API between two calls to require_clean_work_tree() from
the sequencer code has been cleaned up for consistency.
* "git diff --no-such-option" and other corner cases around the exit
status of the "diff" command has been corrected.
* "git for-each-ref --sort='contents:size'" sorts the refs according
to size numerically, giving a ref that points at a blob twelve-byte
(12) long before showing a blob hundred-byte (100) long.
* Various fixes to the behavior of "rebase -i" when the command got
interrupted by conflicting changes.
* References from description of the `--patch` option in various
manual pages have been simplified and improved.
* "git grep -e A --no-or -e B" is accepted, even though the negation
of "or" did not mean anything, which has been tightened.
* The completion script (in contrib/) has been taught to treat the
"-t" option to "git checkout" and "git switch" just like the
"--track" option, to complete remote-tracking branches.
* "git diff --no-index -R <(one) <(two)" did not work correctly,
which has been corrected.
* Update "git maintenance" timers' implementation based on systemd
timers to work with WSL.
* "git diff --cached" codepath did not fill the necessary stat
information for a file when fsmonitor knows it is clean and ended
up behaving as if it is not clean, which has been corrected.
* Clarify how "alias.foo = : git cmd ; aliased-command-string" should
be spelled with necessary whitespaces around punctuation marks to
work.
* HTTP Header redaction code has been adjusted for a newer version of
cURL library that shows its traces differently from earlier
versions.
* An error message given by "git send-email" when given a malformed
address did not give correct information, which has been corrected.
* UBSan options were not propagated through the test framework to git
run via the httpd, unlike ASan options, which has been corrected.
Also contains various documentation updates, code clean-ups and minor fixups.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 10.01.2 to 10.02.1
- Update of rootfile
- Changelog - these are highlights. For more details the git commits have to be used.
10.02.1
release fixes CVE-2023-43115.
CVE-2023-43115 affects all Ghostscript/GhostPDL versions prior to 10.02.0.
CVE-2023-43115 is a remote code execution risk, so we recommend upgrading to
version 10.02.0 as a matter of urgency
10.02.0
release fixes CVE-2023-43115.
CVE-2023-43115 affects all Ghostscript/GhostPDL versions prior to 10.02.0.
CVE-2023-43115 is a remote code execution risk, so we recommend upgrading to
version 10.02.0 as a matter of urgency
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 5.2.2 to 5.3.0
- Update of rootfile
- Changelog
5.3.0
1. Infrastructure changes: Removed the use of libsigsegv. The
value-add was never very much and it caused problems in some
environments.
2. In keeping with new features in BWK awk, gawk now has built-in
CSV file parsing. The behavior is intended to be identical to
that of the "One True AWK" when --csv is applied. See the
manual for details.
3. Also in keeping with BWK awk, gawk now supports a new \u escape
sequence. This should be followed by 1-8 hexadecimal digits. The
given code point is converted to its corresponding multibyte encoding
for storage inside gawk. See the manual.
4. If PROCINFO["BUFFERPIPE"] exists, then pipe output is buffered.
You can also use PROCINFO["command", "BUFFERPIPE"]. See the manual
for details.
5. Because of the additional `do_csv' variable in the API, which breaks
binary compatibility, the API major version was updated to 4 and
the minor version was reset to zero. The API remains source code
compatible; that is, existing extensions should only require recompilation.
6. The manual now requires Texinfo 7.1 and its texinfo.tex for formatting.
As a result, we no longer need to pre-process it, removing the need
for gawktexi.in and leaving just gawk.texi.
7. And of course, there have been several minor code cleanups and bug fixes.
See the ChangeLog for details.
5.2.x
1. The readdir extension has been updated with additonal code and
features, see the manual or its man page. As a result, the
readdir_test.c extension has been removed.
2. We have a new translation: Ukranian.
3. Several subtle issues related to null regexp matches around
multibyte characters have been fixed.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 10.0.2 to 10.0.4
- Update of rootfile not required
- Two patches removed as the fixes have been included in the source tarball
- Changelog
10.0.4
privsep: allow __NR_mmap2 call by @olegartys in #253
privsep: allow __NR_clock_gettime32 syscall by @olegartys in #254
compat/arc4random.c: use memset instead of explicit_bzero by
@ffontaine in #252
privsep: avoid SIGPIPE errors when scripts write to stderr/stdout after
dhcpcd is daemonised
10.0.3
Do not crash on dhcpcd test run by @pemensik in #231
Add automated CI builds for Ubuntu, OpenBSD, FreeBSD and NetBSD by
@tobhe in #229
dhcpcd: Fix off-by-one overflow when read() writes full BUFSIZ by
@tobhe in #236
privsep: fix strlcpy overflow in psp_ifname by @tobhe in #239
ci: execute tests after successful build by @tobhe in #243
compat: update arc4random() to newer chacha20 based version from OpenBSD by
@tobhe in #227
Support libcrypto for hmac and sha256 by @tobhe in #223
Use a local variable instead of the optind by @gotthardp in #86
Send correct amount of used buffer for prefix exclude option by
@ctomahogh in #250
compat: use OpenSSL RAND_priv_bytes() for entropy by @tobhe in #248
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
