1931 Commits

Author	SHA1	Message	Date
Adolf Belka	8cdc44bc70	oci-cli: Update to version 3.45.2 ... - Update from version 3.29.4 to 3.45.2 - Update of rootfile - Changelog is too large to include here. Details can be found at https://github.com/oracle/oci-cli/releases Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-15 10:45:29 +00:00
Adolf Belka	849bcfd188	ghostscript: Update to version 10.03.1 ... - Update from version 10.03.0 to 10.03.1 - Update of rootfile - Several CVE fixes in this release - Changelog 10.03.1 Fixes for CVE-2024-33869, CVE-2023-52722, CVE-2024-33870, CVE-2024-33871 and CVE-2024-29510 IMPORTANT: For the 10.04.0 release (fall/autumn 2024) we will be adding protection for device selection from PostScript input. This will mean that, by default, only the device specified on the command line will be permitted. Similar to the file permissions, there will be a "--permit-devices=" allowing a comma separation list of allowed devices. This will also take a single wildcard "*" allowing any device. Any application which relies on allowing PostScript to change devices during a job will have to be aware, and take action to deal with this change. The exception is "nulldevice", switching to that requires no special action. A vulnerability was identified in the way Ghostscript/GhostPDL called tesseract for the OCR devices, which could allow arbitrary code execution. As as result, we strongly urge anyone including the OCR devices in their build to update as soon as possible. As of this release (10.03.1) pdfwrite creates PDF files with XRef streams and ObjStm streams. This can result in considerably smaller PDF output files. See Vector Devices for more details. Ghostscript/pdfwrite now supports passing through PDF "Optional Content". Our efforts in code hygiene and maintainability continue. The usual round of bug fixes, compatibility changes, and incremental improvements. (9.53.0) We have added the capability to build with the Tesseract OCR engine. In such a build, new devices are available (pdfocr8/pdfocr24/pdfocr32) which render the output file to an image, OCR that image, and output the image "wrapped" up as a PDF file, with the OCR generated text information included as "invisible" text (in PDF terms, text rendering mode 3). Mainly due to time constraints, we only support including Tesseract from source included in our release packages, and not linking to Tesseract/Leptonica shared libraries. Whether we add this capability will be largely dependent on community demand for the feature. See Enabling OCR for more details. Incompatible changes (10.03.1) Almost all the "internal" PostScript procedures defined during the interpreter startup are now "executeonly", further reducing the attack surface of the interpreter. The nature of these procedures means there should be no impact for legitimate usage, but it is possible it will impact uses which abuse the previous accessibility (even for legitimate reasons). Such cases may now require "DELAYBIND", See DELAYBIND (10.03.1) The "makeimagedevice" non-standard operator has been removed. It allowed low level access to the graphics library in a way that was, essentially impossible to secure. (10.03.1) The "putdeviceprops", "getdeviceprops", "finddevice", "copydevice", "findprotodevice" non-standard operators have all been removed. They provided functionality that is either accessible through standard operators, or should not be used by user PostScript. (10.03.1) The process of "tidying" the PostScript namespace should have removed only non-standard and undocumented operators. Nevertheless, it is possible that any integrations or utilities that rely on those non-standard and undocumented operators may stop working or may change behaviour. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-15 10:45:20 +00:00
Adolf Belka	ee4c4c787e	fmt: Update to version 11.0.2 ... - Update from version 11.0.1 to 11.0.2 - Update of rootfile - Changelog 11.0.2 - Fixed compatibility with non-POSIX systems (https://github.com/fmtlib/fmt/issues/4054, https://github.com/fmtlib/fmt/issues/4060). - Fixed performance regressions when using `std::back_insert_iterator` with `fmt::format_to` (https://github.com/fmtlib/fmt/issues/4070). - Fixed handling of `std::generator` and move-only iterators (https://github.com/fmtlib/fmt/issues/4053, https://github.com/fmtlib/fmt/pull/4057). Thanks @Arghnews. - Made `formatter<std::string_view>::parse` work with types convertible to `std::string_view` (https://github.com/fmtlib/fmt/issues/4036, https://github.com/fmtlib/fmt/pull/4055). Thanks @Arghnews. - Made `volatile void*` formattable (https://github.com/fmtlib/fmt/issues/4049, https://github.com/fmtlib/fmt/pull/4056). Thanks @Arghnews. - Made `Glib::ustring` not be confused with `std::string` (https://github.com/fmtlib/fmt/issues/4052). - Made `fmt::context` iterator compatible with STL algorithms that rely on iterator category (https://github.com/fmtlib/fmt/issues/4079). Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-15 10:45:13 +00:00
Adolf Belka	61e6011d4e	sdl2: Update to version 2.30.6 ... - Update from version 2.30.1 to 2.30.6 - Update of rootfile - Changelog 2.30.6 Improved detection of Nintendo Switch Pro controller report mode Fixed a rare crash when a controller is disconnected Fixed creating a framebuffer with KMSDRM on some systems 2.30.5 Respect SDL_HINT_RENDER_DRIVER when creating an accelerated window surface Clean up any accelerated renderer in SDL_DestroyWindowSurface() Disable low level USB controller support on Android by default (can be enabled by setting "SDL_ENV.SDL_JOYSTICK_HIDAPI" metadata to "1" in AndroidManifest.xml) Fixed USB permissions dialog on Android 14 Fixed controller mapping matching when one entry has a CRC specified and another doesn't Enable joystick support on FreeBSD when building using CMake Reduced input latency when using an fcitx IME on Linux Fixed graphical corruption on Raspberry Pi Fixed crash when using an unstable sort function in SDL_qsort (you shouldn't do this, but at least it won't crash) 2.30.4 Android rotation will respect user rotation lock preferences Fixed spurious Left-Ctrl key input when the Right Alt key (AltGr) is pressed on Windows Added support for the Saitek Cyborg V.3 Rumble Pad in PS3 mode Added support for the Razer Kitsune in PS5 mode Added Linux bindings for the Qanba Drone 2 Arcade Joystick Leave Nintendo Online controllers in simple report mode so they work with DirectInput games Enable using libusb for GameCube controllers when available 2.30.3 Fixed Win+V handling (pasting from clipboard history) on Windows Fixed Caps Lock and Backspace key mapping for the Colemak keyboard layout on Windows Fixed mouse warp on XWayland Reduced startup time when scanning for game controllers on Linux Fixed building with C89 compilers Fixed building with the GDK SDK on Windows 2.30.2 Fixed performance regression initializing controllers on Linux Added support for the 6-button SEGA Mega Drive Control Pad for Nintendo Online Added support for the MadCatz Saitek Side Panel Control Deck Added support for the Hori Fighting Stick EX2 Added support for the Yawman Arrow flightstick Added a gamepad mapping for the Defender Joystick Cobra R4 Fixed the gamepad mapping for the Sanwa Supply JY-P76USV controller Poll for the initial controller state when using DirectInput Allow using SDL_RWFromFile() with named pipes Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-14 09:11:15 +00:00
Adolf Belka	292817ad93	git: Update to version 2.46.0 ... - Update from version 2.45.2 to 2.46.0 - Update of rootfile - Changelog 2.46.0 UI, Workflows & Features * The "--rfc" option of "git format-patch" learned to take an optional string value to be used in place of "RFC" to tweak the "[PATCH]" on the subject header. * The credential helper protocol, together with the HTTP layer, have been enhanced to support authentication schemes different from username & password pair, like Bearer and NTLM. * Command line completion script (in contrib/) learned to complete "git symbolic-ref" a bit better (you need to enable plumbing commands to be completed with GIT_COMPLETION_SHOW_ALL_COMMANDS). * When the user responds to a prompt given by "git add -p" with an unsupported command, list of available commands were given, which was too much if the user knew what they wanted to type but merely made a typo. Now the user gets a much shorter error message. * The color parsing code learned to handle 12-bit RGB colors, spelled as "#RGB" (in addition to "#RRGGBB" that is already supported). * The operation mode options (like "--get") the "git config" command uses have been deprecated and replaced with subcommands (like "git config get"). * "git tag" learned the "--trailer" option to futz with the trailers in the same way as "git commit" does. * A new global "--no-advice" option can be used to disable all advice messages, which is meant to be used only in scripts. * Updates to symbolic refs can now be made as a part of ref transaction. * The trailer API has been reshuffled a bit. * Terminology to call various ref-like things are getting straightened out. * The command line completion script (in contrib/) has been adjusted to the recent update to "git config" that adopted subcommand based UI. * The knobs to tweak how reftable files are written have been made available as configuration variables. * When "git push" notices that the commit at the tip of the ref on the other side it is about to overwrite does not exist locally, it used to first try fetching it if the local repository is a partial clone. The command has been taught not to do so and immediately fail instead. * The promisor.quiet configuration knob can be set to true to make lazy fetching from promisor remotes silent. * The inter/range-diff output has been moved to the end of the patch when format-patch adds it to a single patch, instead of writing it before the patch text, to be consistent with what is done for a cover letter for a multi-patch series. * A new command has been added to migrate a repository that uses the files backend for its ref storage to use the reftable backend, with limitations. * "git diff --exit-code --ext-diff" learned to take the exit status of the external diff driver into account when deciding the exit status of the overall "git diff" invocation when configured to do so. * "git update-ref --stdin" learned to handle transactional updates of symbolic-refs. * "git format-patch --interdiff" for multi-patch series learned to turn on cover letters automatically (unless told never to enable cover letter with "--no-cover-letter" and such). * The "--heads" option of "ls-remote" and "show-ref" has been been deprecated; "--branches" replaces "--heads". * For over a year, setting add.interactive.useBuiltin configuration variable did nothing but giving a "this does not do anything" warning. The warning has been removed. * The http transport can now be told to send request with authentication material without first getting a 401 response. * A handful of entries are added to the GitFAQ document. * "git var GIT_SHELL_PATH" should report the path to the shell used to spawn external commands, but it didn't do so on Windows, which has been corrected. Performance, Internal Implementation, Development Support etc. * Advertise "git contacts", a tool for newcomers to find people to ask review for their patches, a bit more in our developer documentation. * In addition to building the objects needed, try to link the objects that are used in fuzzer tests, to make sure at least they build without bitrot, in Linux CI runs. * Code to write out reftable has seen some optimization and simplification. * Tests to ensure interoperability between reftable written by jgit and our code have been added and enabled in CI. * The singleton index_state instance "the_index" has been eliminated by always instantiating "the_repository" and replacing references to "the_index" with references to its .index member. * Git-GUI has a new maintainer, Johannes Sixt. * The "test-tool" has been taught to run testsuite tests in parallel, bypassing the need to use the "prove" tool. * The "whitespace check" task that was enabled for GitHub Actions CI has been ported to GitLab CI. * The refs API lost functions that implicitly assumes to work on the primary ref_store by forcing the callers to pass a ref_store as an argument. * Code clean-up to reduce inter-function communication inside builtin/config.c done via the use of global variables. * The pack bitmap code saw some clean-up to prepare for a follow-up topic. * Preliminary code clean-up for "git send-email". * The default "creation-factor" used by "git format-patch" has been raised to make it more aggressively find matching commits. * Before discovering the repository details, We used to assume SHA-1 as the "default" hash function, which has been corrected. Hopefully this will smoke out codepaths that rely on such an unwarranted assumptions. * The project decision making policy has been documented. * The strcmp-offset tests have been rewritten using the unit test framework. * "git add -p" learned to complain when an answer with more than one letter is given to a prompt that expects a single letter answer. * The alias-expanded command lines are logged to the trace output. * A new test was added to ensure git commands that are designed to run outside repositories do work. * A few tests in reftable library have been rewritten using the unit test framework. * A pair of test helpers that essentially are unit tests on hash algorithms have been rewritten using the unit-tests framework. * A test helper that essentially is unit tests on the "decorate" logic has been rewritten using the unit-tests framework. * Many memory leaks in the sparse-checkout code paths have been plugged. * "make check-docs" noticed problems and reported to its output but failed to signal its findings with its exit status, which has been corrected. * Building with "-Werror -Wwrite-strings" is now supported. * To help developers, the build procedure now allows builders to use CFLAGS_APPEND to specify additional CFLAGS. * "oidtree" tests were rewritten to use the unit test framework. * The structure of the document that records longer-term project decisions to deprecate/remove/update various behaviour has been outlined. * The pseudo-merge reachability bitmap to help more efficient storage of the reachability bitmap in a repository with too many refs has been added. * When "git merge" sees that the index cannot be refreshed (e.g. due to another process doing the same in the background), it died but after writing MERGE_HEAD etc. files, which was useless for the purpose to recover from the failure. * The output from "git cat-file --batch-check" and "--batch-command (info)" should not be unbuffered, for which some tests have been added. * A CPP macro USE_THE_REPOSITORY_VARIABLE is introduced to help transition the codebase to rely less on the availability of the singleton the_repository instance. * "git version --build-options" reports the version information of OpenSSL and other libraries (if used) in the build. * Memory ownership rules for the in-core representation of remote.*.url configuration values have been straightened out, which resulted in a few leak fixes and code clarification. * When bundleURI interface fetches multiple bundles, Git failed to take full advantage of all bundles and ended up slurping duplicated objects, which has been corrected. * The code to deal with modified paths that are out-of-cone in a sparsely checked out working tree has been optimized. * An existing test of oidmap API has been rewritten with the unit-test framework. * The "ort" merge backend saw one bugfix for a crash that happens when inner merge gets killed, and assorted code clean-ups. * A new warning message is issued when a command has to expand a sparse index to handle working tree cruft that are outside of the sparse checkout. * The test framework learned to take the test body not as a single string but as a here-document. * "git push '' HEAD:there" used to hit a BUG(); it has been corrected to die with "fatal: bad repository ''". * What happens when http.cookieFile gets the special value "" has been clarified in the documentation. Bug Fixes * "git rebase --signoff" used to forget that it needs to add a sign-off to the resulting commit when told to continue after a conflict stops its operation. * The procedure to build multi-pack-index got confused by the replace-refs mechanism, which has been corrected by disabling the latter. * The "-k" and "--rfc" options of "format-patch" will now error out when used together, as one tells us not to add anything to the title of the commit, and the other one tells us to add "RFC" in addition to "PATCH". * "git stash -S" did not handle binary files correctly, which has been corrected. * A scheduled "git maintenance" job is expected to work on all repositories it knows about, but it stopped at the first one that errored out. Now it keeps going. * zsh can pretend to be a normal shell pretty well except for some glitches that we tickle in some of our scripts. Work them around so that "vimdiff" and our test suite works well enough with it. * Command line completion support for zsh (in contrib/) has been updated to stop exposing internal state to end-user shell interaction. * Tests that try to corrupt in-repository files in chunked format did not work well on macOS due to its broken "mv", which has been worked around. * The maximum size of attribute files is enforced more consistently. * Unbreak CI jobs so that we do not attempt to use Python 2 that has been removed from the platform. * Git 2.43 started using the tree of HEAD as the source of attributes in a bare repository, which has severe performance implications. For now, revert the change, without ripping out a more explicit support for the attr.tree configuration variable. * The "--exit-code" option of "git diff" command learned to work with the "--ext-diff" option. * Windows CI running in GitHub Actions started complaining about the order of arguments given to calloc(); the imported regex code uses the wrong order almost consistently, which has been corrected. * Expose "name conflict" error when a ref creation fails due to D/F conflict in the ref namespace, to improve an error message given by "git fetch". (merge 9339fca23e it/refs-name-conflict later to maint). * The SubmittingPatches document now refers folks to manpages translation project. * The documentation for "git diff --name-only" has been clarified that it is about showing the names in the post-image tree. * The credential helper that talks with osx keychain learned to avoid storing back the authentication material it just got received from the keychain. (merge e1ab45b2da kn/osxkeychain-skip-idempotent-store later to maint). * The chainlint script (invoked during "make test") did nothing when it failed to detect the number of available CPUs. It now falls back to 1 CPU to avoid the problem. * Revert overly aggressive "layered defence" that went into 2.45.1 and friends, which broke "git-lfs", "git-annex", and other use cases, so that we can rebuild necessary counterparts in the open. * "git init" in an already created directory, when the user configuration has includeif.onbranch, started to fail recently, which has been corrected. * Memory leaks in "git mv" has been plugged. * The safe.directory configuration knob has been updated to optionally allow leading path matches. * An overly large ".gitignore" files are now rejected silently. * Upon expiration event, the credential subsystem forgot to clear in-core authentication material other than password (whose support was added recently), which has been corrected. * Fix for an embarrassing typo that prevented Python2 tests from running anywhere. * Varargs functions that are unannotated as printf-like or execl-like have been annotated as such. * "git am" has a safety feature to prevent it from starting a new session when there already is a session going. It reliably triggers when a mbox is given on the command line, but it has to rely on the tty-ness of the standard input. Add an explicit way to opt out of this safety with a command line option. (merge 62c71ace44 jk/am-retry later to maint). * A leak in "git imap-send" that somehow escapes LSan has been plugged. * Setting core.abbrev too early before the repository set-up (typically in "git clone") caused segfault, which as been corrected. * When the user adds to "git rebase -i" instruction to "pick" a merge commit, the error experience is not pleasant. Such an error is now caught earlier in the process that parses the todo list. * We forgot to normalize the result of getcwd() to NFC on macOS where all other paths are normalized, which has been corrected. This still does not address the case where core.precomposeUnicode configuration is not defined globally. * Earlier we stopped using the tree of HEAD as the default source of attributes in a bare repository, but failed to document it. This has been corrected. * "git update-server-info" and "git commit-graph --write" have been updated to use the tempfile API to avoid leaving cruft after failing. * An unused extern declaration for mingw has been removed to prevent it from causing build failure. * A helper function shared between two tests had a copy-paste bug, which has been corrected. * "git fetch-pack -k -k" without passing "--lock-pack" (which we never do ourselves) did not work at all, which has been corrected. * CI job to build minimum fuzzers learned to pass NO_CURL=NoThanks to the build procedure, as its build environment does not offer, or the rest of the build needs, anything cURL. (merge 4e66b5a990 jc/fuzz-sans-curl later to maint). * "git diff --no-ext-diff" when diff.external is configured ignored the "--color-moved" option. (merge 0f4b0d4cf0 rs/diff-color-moved-w-no-ext-diff-fix later to maint). * "git archive --add-virtual-file=<path>:<contents>" never paid attention to the --prefix=<prefix> option but the documentation said it would. The documentation has been corrected. (merge 72c282098d jc/archive-prefix-with-add-virtual-file later to maint). * When GIT_PAGER failed to spawn, depending on the code path taken, we failed immediately (correct) or just spew the payload to the standard output (incorrect). The code now always fail immediately when GIT_PAGER fails. (merge 78f0a5d187 rj/pager-die-upon-exec-failure later to maint). * date parser updates to be more careful about underflowing epoch based timestamp. (merge 9d69789770 db/date-underflow-fix later to maint). * The Bloom filter used for path limited history traversal was broken on systems whose "char" is unsigned; update the implementation and bump the format version to 2. (merge 9c8a9ec787 tb/path-filter-fix later to maint). * Typofix. (merge 231cf7370e as/pathspec-h-typofix later to maint). * Code clean-up. (merge 4b837f821e rs/simplify-submodule-helper-super-prefix-invocation later to maint). * "git describe --dirty --broken" forgot to refresh the index before seeing if there is any chang, ("git describe --dirty" correctly did so), which has been corrected. (merge b8ae42e292 as/describe-broken-refresh-index-fix later to maint). * Test suite has been taught not to unnecessarily rely on DNS failing a bogus external name. (merge 407cdbd271 jk/tests-without-dns later to maint). * GitWeb update to use committer date consistently in rss/atom feeds. (merge cf6ead095b am/gitweb-feed-use-committer-date later to maint). * Custom control structures we invented more recently have been taught to the clang-format file. (merge 1457dff9be rs/clang-format-updates later to maint). * Developer build procedure fix. (merge df32729866 tb/dev-build-pedantic-fix later to maint). * "git push" that pushes only deletion gave an unnecessary and harmless error message when push negotiation is configured, which has been corrected. (merge 4d8ee0317f jc/disable-push-nego-for-deletion later to maint). * Address-looking strings found on the trailer are now placed on the Cc: list after running through sanitize_address by "git send-email". (merge c852531f45 cb/send-email-sanitize-trailer-addresses later to maint). * Tests that use GIT_TEST_SANITIZE_LEAK_LOG feature got their exit status inverted, which has been corrected. (merge 8c1d6691bc rj/test-sanitize-leak-log-fix later to maint). * The http.cookieFile and http.saveCookies configuration variables have a few values that need to be avoided, which are now ignored with warning messages. (merge 4f5822076f jc/http-cookiefile later to maint). * Repacking a repository with multi-pack index started making stupid pack selections in Git 2.45, which has been corrected. (merge 8fb6d11fad ds/midx-write-repack-fix later to maint). * Fix documentation mark-up regression in 2.45. (merge 6474da0aa4 ja/doc-markup-updates-fix later to maint). * Work around asciidoctor's css that renders `monospace` material in the SYNOPSIS section of manual pages as block elements. (merge d44ce6ddd5 js/doc-markup-updates-fix later to maint). * Other code cleanup, docfix, build fix, etc. (merge 493fdae046 ew/object-convert-leakfix later to maint). (merge 00f3661a0a ss/doc-eol-attr-fix later to maint). (merge 428c40da61 ri/doc-show-branch-fix later to maint). (merge 58696bfcaa jc/where-is-bash-for-ci later to maint). (merge 616e94ca24 tb/doc-max-tree-depth-fix later to maint). Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-14 09:08:54 +00:00
Adolf Belka	ca9abd894e	nmap: Update to version 7.95 ... - Update from version 7.94 to 7.95 - Update of rootfile - Changelog 7.95 o [Windows] Upgraded Npcap (our Windows raw packet capturing and transmission driver) from version 1.75 to the latest version 1.79. It includes many performance improvements, bug fixes and feature enhancements described at https://npcap.com/changelog. o Integrated over 4000 IPv4 OS fingerprints submitted since June 2020. Added 336 fingerprints, bringing the new total to 6036. Additions include iOS 15 & 16, macOS Ventura & Monterey, Linux 6.1, OpenBSD 7.1, and lwIP 2.2 o Integrated over 2500 service/version detection fingerprints submitted since June 2020. The signature count went up 1.4% to 12089, including 9 new softmatches. We now detect 1246 protocols, including new additions of grpc, mysqlx, essnet, remotemouse, and tuya. o [NSE] Four new scripts from the DINA community (https://github.com/DINA-community) for querying industrial control systems: + hartip-info reads device information from devices using the Highway Addressable Remote Transducer protocol + iec61850-mms queries devices using Manufacturing Message Specification requests. [Dennis Rösch, Max Helbig] + multicast-profinet-discovery Sends a multicast PROFINET DCP Identify All message and prints the responses. [Stefan Eiwanger, DINA-community] + profinet-cm-lookup queries the DCERPC endpoint mapper exposed via the PNIO-CM service. o Upgraded included libraries: Lua 5.4.6, libpcre2 10.43, zlib 1.3.1, libssh2 1.11.0, liblinear 2.47 o [GH#2639] Upgraded OpenSSL binaries (for the Windows builds and for RPMs) to version 3.0.13. CVEs resolved in this update include only 2 moderate-severity issues which we do not believe affect Nmap: CVE-2023-5363 and CVE-2023-2650 o [Zenmap][Ndiff][GH#2649] Zenmap and Ndiff now use setuptools, not distutils for packaging. o [Ncat][GH#2685] Fixed Ncat UDP server mode to not quit after EOF on stdin. Reported as Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039613 o [GH#2672] Fixed an issue where TCP Connect scan (-sT) on Windows would fail to open any sockets, leading to scans that never finish. [Daniel Miller] o [NSE] ssh-auth-methods will now print the pre-authentication banner text when available. Requires libssh2 1.11.0 or later. [Daniel Miller] o [Zenmap][GH#2739] Fix a crash in Zenmap when changing a host comment. o [NSE][GH#2766] Fix TLS 1.2 signature algorithms for EdDSA. [Daniel Roethlisberger] o [Zenmap][GH#2706] RPM spec files now correctly require the python3 package, not python>=3 o Improvements to OS detection fingerprint matching, including a syntax change for nmap-os-db that allows ranges within the TCP Options string. This leads to more concise and maintainable fingerprints. [Daniel Miller] o Improved the OS detection engine by using a new source port for each retry. Scans from systems such as Windows that do not send RST for unsolicited SYN|ACK responses were previously unable to get a response in subsequent tries. [Daniel Miller] o Several profile-guided optimizations of the port scan engine. [Daniel Miller] o [GH#2731] Fix an out-of-bounds read which led to out-of-memory errors when duplicate addresses were used with --exclude o [GH#2609] Fixed a memory leak in Nsock: compiled pcap filters were not freed. o [GH#2658] Fixed a crash when using service name wildcards with -p, as in -p "http*" o [NSE] Fixed DNS TXT record parsing which caused asn-query to fail in Nmap 7.80 and later. [David Fifield, Mike Pattrick] o [NSE][GH#2727][GH#2728] Fixed packet size testing in KNX scripts [f0rw4rd] Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:15:20 +00:00
Adolf Belka	cbaff8bcb4	ncat: Update to version 7.95 ... - Update from version 7.94 to 7.95 - Update of rootfile - Changelog 7.95 o [Windows] Upgraded Npcap (our Windows raw packet capturing and transmission driver) from version 1.75 to the latest version 1.79. It includes many performance improvements, bug fixes and feature enhancements described at https://npcap.com/changelog. o Integrated over 4000 IPv4 OS fingerprints submitted since June 2020. Added 336 fingerprints, bringing the new total to 6036. Additions include iOS 15 & 16, macOS Ventura & Monterey, Linux 6.1, OpenBSD 7.1, and lwIP 2.2 o Integrated over 2500 service/version detection fingerprints submitted since June 2020. The signature count went up 1.4% to 12089, including 9 new softmatches. We now detect 1246 protocols, including new additions of grpc, mysqlx, essnet, remotemouse, and tuya. o [NSE] Four new scripts from the DINA community (https://github.com/DINA-community) for querying industrial control systems: + hartip-info reads device information from devices using the Highway Addressable Remote Transducer protocol + iec61850-mms queries devices using Manufacturing Message Specification requests. [Dennis Rösch, Max Helbig] + multicast-profinet-discovery Sends a multicast PROFINET DCP Identify All message and prints the responses. [Stefan Eiwanger, DINA-community] + profinet-cm-lookup queries the DCERPC endpoint mapper exposed via the PNIO-CM service. o Upgraded included libraries: Lua 5.4.6, libpcre2 10.43, zlib 1.3.1, libssh2 1.11.0, liblinear 2.47 o [GH#2639] Upgraded OpenSSL binaries (for the Windows builds and for RPMs) to version 3.0.13. CVEs resolved in this update include only 2 moderate-severity issues which we do not believe affect Nmap: CVE-2023-5363 and CVE-2023-2650 o [Zenmap][Ndiff][GH#2649] Zenmap and Ndiff now use setuptools, not distutils for packaging. o [Ncat][GH#2685] Fixed Ncat UDP server mode to not quit after EOF on stdin. Reported as Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039613 o [GH#2672] Fixed an issue where TCP Connect scan (-sT) on Windows would fail to open any sockets, leading to scans that never finish. [Daniel Miller] o [NSE] ssh-auth-methods will now print the pre-authentication banner text when available. Requires libssh2 1.11.0 or later. [Daniel Miller] o [Zenmap][GH#2739] Fix a crash in Zenmap when changing a host comment. o [NSE][GH#2766] Fix TLS 1.2 signature algorithms for EdDSA. [Daniel Roethlisberger] o [Zenmap][GH#2706] RPM spec files now correctly require the python3 package, not python>=3 o Improvements to OS detection fingerprint matching, including a syntax change for nmap-os-db that allows ranges within the TCP Options string. This leads to more concise and maintainable fingerprints. [Daniel Miller] o Improved the OS detection engine by using a new source port for each retry. Scans from systems such as Windows that do not send RST for unsolicited SYN|ACK responses were previously unable to get a response in subsequent tries. [Daniel Miller] o Several profile-guided optimizations of the port scan engine. [Daniel Miller] o [GH#2731] Fix an out-of-bounds read which led to out-of-memory errors when duplicate addresses were used with --exclude o [GH#2609] Fixed a memory leak in Nsock: compiled pcap filters were not freed. o [GH#2658] Fixed a crash when using service name wildcards with -p, as in -p "http*" o [NSE] Fixed DNS TXT record parsing which caused asn-query to fail in Nmap 7.80 and later. [David Fifield, Mike Pattrick] o [NSE][GH#2727][GH#2728] Fixed packet size testing in KNX scripts [f0rw4rd] Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:15:14 +00:00
Adolf Belka	c8490adecf	hplip: Update to version 3.24.4 ... - Update from version 3.23.12 to 3.24.4 - Update of rootfile - Changelog 3.24.4 Added support for the following new Printers: HP OfficeJet 8120 All-in-One series HP OfficeJet Pro 8120 All-in-One series HP OfficeJet 8130 All-in-One series HP OfficeJet Pro 8130 All-in-One series HP OfficeJet Pro 9720 Series HP OfficeJet Pro 9730 Series Added support for following new Distro: Ubuntu 23.10 Debian 12 Fedora 39 Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:14:55 +00:00
Adolf Belka	fdbd6bd32f	frr: Update to version 10.1 ... - Update from version 9.1 to 10.1 - Update of rootfile - CVE Fixes in 9.1.1 - Changelog 10.1 Breaking changes Enable BGP dynamic capability by default for datacenter profile Advertise BGP "Dynamic" capability by default if using a datacenter profile. The dynamic capability gives more flexibility in terms of changing some parameters (e.g. Graceful-Restart, Long-lived Graceful-Restart timers, Addpath, Role, etc.) without resetting the session. Split BGP rpki cache command into separate per SSH/TCP The old command is broken at some level. When configuring a TCP session with the source, the command thinks it's an SSH session with a username. Add deprecation cycle for OSPF router-info X [A.B.C.D] command Features BGP dampening per-neighbor support It is now possible to configure BGP dampening parameters on a per-neighbor basis. In previous releases, BGP dampening could only be configured globally or per-SAFI. BMP send-experimental stats We added an option to send experimental BMP (RFC 7854) stats [65531-65534]. RFC 7854 defines BMP statistics types: Values 65531 through 65534 are Experimental, and value 65535 is Reserved. Implement extended link-bandwidth for BGP By default bandwidth in extended communities is encoded in IEEE floating-point format, and is limited to a maximum of 25 Gbps. Since not every vendor implements this correctly (due to IEEE floating-point), another draft is implemented to encode the bandwidth into IPv6 address-specific extended community. Paths Limit for Multiple Paths in BGP Implemented this draft as an extension for the Addpath capability, that tells the sender to send only an arbitrary number of paths per prefix instead of sending all of the known paths. New command for OSPFv2 ip ospf neighbor-filter NAME [A.B.C.D] Configure an IP prefix list to filter packets received from OSPF neighbors on the OSPF interface. Implement non-broadcast support for point-to-multipoint networks This extends non-broadcast support to point-to-multipoint networks. The AllOSPFRouters (224.0.0.5) is still joined for non-broadcast networks since it is joined for NBMA networks. Other significant changes bgpd Fix route leaking from the default l3vrf Fix match peer when switching between IPv4/IPv6/interface Fix dynamic peer graceful restart race condition Fix colored routes not installed after a switchover Fix crash when deleting the SRv6 locator Fix no set as-path prepend ASNUM... Fix negative commands for Graceful-Restart operations (avoid entering incorrect state) Fix ipv4-mapped ipv6 on non 6pe Fix show run of network route-distinguisher Fix display when using missing-as-worst Fix show bgp neighbors output Fix error handling for MP/GR capabilities as a dynamic capability Fix error handling when receiving BGP Prefix-SID attribute Fix route-target display with a dotted format Fix no bgp as-path access-list Fix no form for neighbor X capability software-version Check against extended community unit size for link bandwidth Make sure we have enough data to handle extended link bandwidth Check if FQDN capability length is in valid ranges Allow using different ASNs per VRF instances Send End-of-RIB not only if Graceful-Restart capability is received Implement backpressure to avoid CPU hog Ignore validating the attribute flags if path-attribute is configured Prevent deletion of BGP peer groups associated with bgp listen range Inherit some peer flags from the peer-group Allow specification of AS 0 for RPKI commands Allow using maximum-prefix for EVPN Increase install/uninstall speed of EVPN VNIs Update default-originate route-map actual map structure Include unsuppress-map as a valid outgoing eBGP policy Allow dynamically disable graceful-restart/long-lived graceful-restart Unset advertised capabilities if the capability is disabled Aggregated summary-only remove suppressed from EVPN isisd Fix crash when deactivating ISIS adjacency on the interface Fix show isis database [detail] json Fix show isis algorithm Fix crash when configuring the circuit type for the interface Fix IP/IPv6 reachability TLVs When the metric-type is configured as "wide", the IS-IS generates incorrect metric values for IPv4 directly connected routes Add link state support for SRv6 adjacencies The hold time of hello packets on a P2P link does not match the sending interval mgmtd Implement YANG RPC/action support ospfd Fix crash in OSPF TE parsing Fix the bug where ip_ospf_dead-interval_minimal_hello-multiplier did not reset the hello timer Fix no write-multiplier command Fix no maximum-paths command Solved crash in RI parsing with OSPF TE Assure OSPF AS External routes are installed after the link flap Send LS Updates in response to LS Request as unicast ospf6d Handle topo change in Graceful-Restart Helper mode for max-age LSAs Prevent heap-buffer-overflow with an unknown type Redistribute metric for AS-external route Fix next-hop computation for inter-area multi-ABR ECMP Fix interface type vs. connected routes updates pathd Retry synchronous label-manager ZAPI connection pimd Fix null register before aging out reg-stop Fix dr-priority range Fix crash unconfiguring rp keepalive timer lib Fix keychain NB crash Do not convert EVPN prefixes into IPv4/IPv6 if not needed ripd Fix clear ip rip command ripngd Fix clear ipv6 ripng command tools Handle seq num for BGP as-path in frr-reload.py vtysh Fix 'show ip[v6] prefix-list ... json' formatting by moving it to vtysh Fix show route-map command when calling via do Show ip ospf network ... even if it's not the same as the interface type zebra Fix mpls label bind command Fix excessive exit commands Fix static SRv6 segment-list SID order Fix JSON output for show route summary json Fix malformed json output for multiple vrfs in command show ip route vrf all json Fix crash if MAC-VLAN link in another netns Fix crash on MAC-VLAN link down/up Deny the routes if ip protocol CLI refers to an undefined route-map Bridge flap handle VLAN membership update Add show fpm status [json] command 9.1.1 Fixed CVEs CVE-2024-31950 CVE-2024-31951 CVE-2024-31949 Bug Fixes bgpd "default-originate" shouldn't withdraw non-default routes Aggr summary-only suppressed export to evpn Allow using optional table id for negative `no set table x` command Arrange peer notification to after zebra announce Check bgp evpn instance presence in soo Convert the bgp_advertise_attr->adv to a fifo Do not show tcp mss if the socket is broken Ensure bgp does not stop monitoring nexthops Ensure community data is freed in some cases. Ensure that the correct aspath is free'd Fix `match peer` when switching between ipv4/ipv6/interface Fix `no set as-path prepend asnum...` Fix bgp_best_selection heap-use-after-free Fix crash when deleting the srv6 locator Fix display when using `missing-as-worst` Fix dynamic peer graceful restart race condition Fix ecommunity_fill_pbr_action heap-buffer-overflow Fix error handling when receiving bgp prefix sid attribute Fix errors handling for mp/gr capabilities as dynamic capability Fix format overflow for graceful-restart debug logs Fix logging message when receiving a software version capability Fix no bgp as-path access-list issue Fix route-map match probability deconfiguration callback Fix srv6 memory leak detection Fix the order of null check and zapi decode Fix vrf leaking with 'no bgp network import-check Free memory for srv6 functions and locator chunks Ignore validating the attribute flags if path-attribute is configured Include unsuppress-map as a valid outgoing policy Lttng tp add evpn route events Make `suppress-fib-pending` clear peering Note when receiving but not understanding a route notification Prevent from one more cve triggering this place Set correct ttl for the dynamic neighbor peers Update default-originate route-map actual map structure Revert "Fix pointer arithmetic in bgp snmp module" doc Add param range for graceful-restart helper supported-grace-time Remove duplicated show route-map isisd Fix _isis_spftree_del heap-use-after-free Fix dislaying lsp id Fix heap-after-free with prefix sid Fix ip/ipv6 reachability tlvs lib Check for not being a blackhole route Fix show route map json output Do not convert evpn prefixes into ipv4/ipv6 if not needed Replace deprecated ares_gethostbyname Replace deprecated ares_process() nhrpd Fix race condition Fix core dump on shutdown ospf6d Ospfv3 route change comparision fixed for asbr-only change Prevent heap-buffer-overflow with unknown type ospfd Add support for "no router-info [<area|as>] command" Can not delete "segment-routing node-msd" when sr if off Correct lsa parser which fulfill the ted Correct opaque lsa extended parser Correct sid check size Fix ospf dead-interval minimal hello-multiplier param range Fix the bug where ip_ospf_dead-interval_minimal_hello-multiplier did not reset hello timer Protect call to get_edge() in ospf_te.c Solved crash in ospf te parsing Solved crash in ri parsing with ospf te Revert "Fix some dicey pointer arith in snmp module" pbrd Fix map seq installed flag in json Fix pbr handling for last rule deletion pimd Fix crash unconfiguring rp keepalive timer Fix crash when configuring ssmpingd Fix dr-priority range Fix null register before aging out reg-stop Fix order of operations for evaluating join Re-evaluated s,g oils upon rp changes and for empty sg upstream oils Fix crash when mixing ssm/any-source joins staticd Fix changing to source auto in bfd monitor tests Check for 0.0.0.0/1 in bgp_default_route Check if ibgp session can drop invalid aigp attribute Extend tests for aspath exclude Update ospf te topotests tools Apply black formatting for tools/frr-reload.py Fix frr-reload interface desc cmd Fix frr-reload multiple no description cmds Fix frr-reload multiple no description cmds Use error log level when failing to execute commands via frr-reload.py topotests Do not check table version Redispatch tests in bfd_topo3 Test wrong bfd source in bfd_topo3 Vpnv4 route leaking with no import-check vtysh Show `ip ospf network ...` even if it's not the same as the interface type zebra Add missing whitespace when printing route entry status Deny the routes if ip protocol cli refers to an undefined rmap Don't deref vxlan-vni array Fix crash if macvlan link in another netns Fix crash on macvlan link down/up Fix evpn svd based remote nh neigh del Fix mpls command Fix route deletion during zebra shutdown The dplane_fpm_nl return path leaks memory Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:14:30 +00:00
Adolf Belka	733e957885	freeradius: Update to version 3.2.5 ... - Update from version 3.2.3 to 3.2.5 - Update of rootfile - Various options removed from ./configure as they are all unrecognised and don't have any effect. Most of them look to have been related to freeradius-1.x - There is no command that gets recognised for disabling or not using static libs - Changelog 3.2.5 Feature Improvements TOTP now supports TOTP-Time-Offset for tokens with times that are out of sync. See mods-available/totp. radclient now supports forcing the Request Authenticator and ID for Access-Request packets. Update dictionary.3gpp. Update advice on shared secrets, including suggesting a secure method for generating useful secrets. Bug Fixes Allow proxying by pool / home server name to work with auth+acct servers. Fix OpenSSL API usage which sometimes caused crash in MS-CHAP Previously it would either always crash immediately, or never crash. Fix packet statistics. Stop double counting some packets, and track packet statistics even if a socket is closed. Reverted patch in TTLS which broke compatibility with some systems. Don't crash in debug mode when multiple intermediate certs are used Patch from Alexander Chernikov. 3.2.4 Feature Improvements Preliminary support for TEAP. Update EAP module pre_proxy checks to make them less restrictive This prevents the "middle box" effect from affecting future traffic. Many fixes and updates for Docker images. Add dpsk module. See mods-available/dpsk. Print out what cause the TLS operations to be made, such as the EAP method name (peap, ttls, etc), or RADIUS/TLS listen / proxy socket. Add auto_escape to sample SQL module config. Add 'if not exists' to mysql create table queries. ref #5032 (#5137). Update dictionary.aruba; add dictionary.tplink, dictionary.alphion. Allow for 'encrypt=1' attributes to be longer than 128 characters. Added "radsecret" program which generates strong secrets. See the top of the "clients.conf" file for more information. radclient now prints packets as hex when using -xxx. Added "-t timeout" to radsniff. It will stop processing packets after <timeout> seconds. Support "interface = ..." on OSX and other *BSD which have IP_BOUND_IF. The detail module now has a "dates_as_integer" configuration item See mods-available/detail for more information. Add lookback/lookforward steps and more configuration to totp. See mods-available/totp. Add "time_since" xlat to calculate elapsed time in seconds, milliseconds and microseconds. Support "Post-Auth-Type Challenge" in the inner tunnel. Patch from Alexander Clouter. PR #5320. Add "proxy_dedup_window". See radiusd.conf. Document KRB5_CLIENT_KTNAME in the "env" section of radiusd.conf. Add "dedup_key" for misbehaving supplicants. See mods-available/eap. Bug Fixes Fix corner case with empty defaults in rlm_files. Fixes #5035. When we have multiple attributes of the same name, always use the canonical attribute. Make FreeRADIUS-Server-EMA* attributes work again for home server exponential moving average statistics. Don't send the global server stats when asked for client stats. They use the same attributes, so the result is confusing. Fix multiple typos in MongoDB query.conf (#5130). Add define for illumos. Fixes #5135. Add client configuration for TLS PSK. Permit originate CoA after proxying to an internal virtual server. Use virtual server "default" when passed "-i" and "-p" on the command line. Fix locking issues with rlm_python3. The detail file reader will catch bad times in the file, and will not update Acct-Delay-Time with extreme values. Fix issue where Message-Authenticator was calculated incorrectly for CoA / Disconnect ACK and NAK packets. Update Python thread and error handling. Fixes #5208. Fix handling of Session-State when proxying. Fixes #5288. Run relevant post-proxy Fail-* section on CoA / Disconnect timeout. Add "limit" section to AWS health check configurtion. Fixes 35300. Use MAX in sqlite queries instead of GREATEST. Fix typo in Mongo queries. Fixes #5301. Fix occasional crash with bad home servers. Fixes #5308. Minor bug fixes to the SQL freetds modules. Fix blocking issue with RADIUS/TLS connection checks. Fix run-time crash on configuration typos of %{substr ...} instead of %{substr:...} Fixes #5321. Fix crash with TLS Status-Server requests. Fixes #5326. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:14:15 +00:00
Adolf Belka	0382036f71	netatalk: Update to version 3.2.5 ... - Update from version 3.1.2 to 3.2.5 - Update of rootfile - Change to meson build - Bundled libevent was removed in 3.1.13 so configure option no longer needed. - The latest netatalk places the prefix value onto all other directories. No way to change this via the meson options. So sysconfdir and localstatedir would end up being under /usr. Patch created to remove the prefix value at the beginning of sysconfdir and localstatedir so that the locations stay the same as for the previous versions. - The default value for pam.d is in /usr/etc/ but option available to change this. - Large number of CVE fixes in some of the updates - 3.2.1, 3.1.18, 3.1.17, 3.1.16, 3.1.15, 3.1.13, 3.1.12, - Changelog 3.2.5 * BREAKING: meson: Allow choosing shared or static libraries to build, GitHub #1321 In practice, only shared libraries are built by default now. Use the `default_library' option to control what is built. * FIX: meson: Control the MySQL CNID backend, and support MariaDB, GitHub #1341 Introduces a new boolean `with-cnid-mysql-backend' option. * FIX: meson: Implement with-init-dir option, GitHub #1346 * FIX: autotools/meson: Install FreeBSD init script into correct location, GitHub #1345 * FIX: meson: Fix syntax error with libiconv path, GitHub #1279 * FIX: meson: Correct description for with-manual option, GitHub #1282 * FIX: meson: Correct prefix lookup for tracker-control, GitHub #1284 * FIX: meson: default OPEN_NOFOLLOW_ERRNO overwrites platform customization, GitHub #1286 * FIX: meson: Don't make dtags depend on rpath, GitHub #1293 * FIX: meson: Remove duplicate dependency check for posix threads, GitHub #1297 * FIX: meson: Better output when cryptographic UAMs aren't built, GitHub #1302 * FIX: meson: Prioritize tests and run single-threaded to avoid race condition, GitHub #1312 * FIX: meson: Better way to handle rpath executable targets, GitHub #1315 * FIX: meson: Refactor libcrypto check and print better status messages, GitHub #1299 * FIX: meson: Look for libmariadb dependency to appease Fedora, GitHub #1348 * FIX: meson: Declare have_atfuncs globally to avoid failure later, GitHub #1357 * FIX: meson: Do a compiler sanity check before header checks, GitHub #1356 * FIX: Avoid using reserved keyword to build the tests on NetBSD, GitHub #1328 3.2.4 * UPD: autotools: Restore ABI versioning of libatalk, and set it to 18.0.0, GitHub #1261 * UPD: meson: Define long-form soversion as 18.0.0, GitHub #1256 Previously, only `18' was defined. * NEW: meson: Introduce pkgconfdir override option, GitHub #1241 The new option is called `with-pkgconfdir-path' and is analogous to the `with-pkgconfdir' Autotools option. Additionally, the hard-coded "netatalk" path suffix has been removed. * NEW: meson: Introduce `debian' init style option that installs both sysv and systemd, GitHub #1239 * FIX: meson: Add have_atfuncs check, and make dtags dependent on rpath flag, GitHub #1236 * FIX: meson: Correct overwrite install logic for config files, GitHub #1253 * FIX: Fix typo in netatalk_conf.c log message 3.2.3 * UPD: Record note of permission to upgrade CNID code to a later GPL, GitHub #1194 * UPD: Remove long-obsoleted cnid2_create script, GitHub #1203 * UPD: docker: Add option to enable ClearText and Guest UAMs, GitHub #1202 * FIX: docs: Standardize reference entry naming for netatalk-config man page, GitHub #1208 * FIX: meson: Generate afppasswd manual html page, GitHub #1210 * UPD: meson: Remove obsolete 64 bit library check, GitHub #1207 * FIX: meson: Enable rpath for binaries only when with-rpath is enabled, GitHub #1214 * FIX: meson: Require kerberos before enabling krb5 UAM, not just GSSAPI, GitHub #1218 * FIX: meson: Restore linking with 64-bit libdb on Solaris, GitHub #1222 * FIX: meson: Fixing linking when building with the `with-ssl-override' option, GitHub #1227 3.2.2 * UPD: meson: Use external SSL dependency to provide cast header, GitHub #1186 This reintroduces OpenSSL/LibreSSL as a dependency for the DHX UAM, while removing all source files with the SSLeay copyright notice. * UPD: meson: Add option to override system WolfSSL with embedded WolfSSL: `with-ssl-override', GitHub #1176 * UPD: Remove obsolete Red Hat Upstart and SuSE SysV init scripts, GitHub #1163 * FIX: meson: Fix errors in PAM support macro, GitHub #1178 * FIX: meson: Fix perl shebang substitution in cnid2_create script, GitHub #1183 * FIX: meson: Fix operation of D-Bus path macros, GitHub #1182 * FIX: meson: Fix errors in shadow password macro, GitHub #1192 * FIX: autotools: gcc 8.5 expects explicit library flags for libgcrypt, GitHub #1188 * NEW: Create a security policy, GitHub #1166 3.2.1 * FIX: CVE-2024-38439,CVE-2024-38440,CVE-2024-38441: Harden user login, GitHub #1158 * BREAKING: meson: Rework option semantics and feature macros, GitHub #1099 - Consistent syntax of the build options to make them user-friendly - Standardises the syntax of the feature macros - Fixes the logic of the largefile support macro - Disables gssapi support if the Kerberos V UAM is not required - All options are now defined either as `with-*' or `with-*-path' - Please see the Release Notes for a full list of changed options * UPD: meson: Enable building with system WolfSSL library, GitHub #1160 - Build system will attempt to detect that all required headers and symbols are supported - Falls back to the bundled WolfSSL library * FIX: meson: Fix -Doption paths on systems where rpath is enabled by default, GitHub #1053 * FIX: meson: Fix library search macro on OmniOS hosts, GitHub #1056 * FIX: meson: Fix rules for installing scripts, GitHub #1070 - Install afpstats only when Perl is detected - Don't install scripts only used by netatalk developers * FIX: meson: set setuid bit to allow user afppasswd changing, GitHub #1071 * FIX: meson: Fix logic of libiconv detection macro, GitHub #1075 * FIX: meson: Address various issues with the meson build system, GitHub #1082 - Enables quota support on all flavours of linux and BSD, plus macOS - Adds the quota provider to the configuration summary - Adds a user option to disable LDAP support - Sets dependencies according to user configuration - Improves the syntax of the ACL macro * FIX: meson: Further refinements to meson build system, GitHub #1086 - Adds user options to disable cracklib and GSSAPI support - Automates Berkeley DB library detection on macOS * FIX: meson: Fix issues with quota support on linux and macOS, GitHub #1092 - Enables quota support on macOS hosts - Restores missing configuration option for linux hosts - Removes obsolete quota configuration data for linux and macOS hosts * FIX: meson: Set executable flags when installing scripts, GitHub #1117 * UPD: autotools and meson: Use pkg-config to find libgcrypt, GitHub #1132 - This removes dependency on the now-obsolete libgcrypt-config * FIX: Use portable linux macro in etc/afpd header, GitHub #1083 * UPD: Debian Trixie expects systemd scripts in /usr/lib, GitHub #1135 * UPD: Add copyright for mac_roman.h, GitHub #1137 * FIX: Cleanup of copyright headers to make them scanner friendly, GitHub #1142 * FIX: Remove unused atalk/talloc.h header, GitHub #1154 * FIX: docker: Don't bail out when password is longer than 8 chars, GitHub #1067 * UPD: docker: Bump to Alpine 3.20 base image, GitHub #1111 * FIX: docker: Rework AFP user's GROUP and GID settings, GitHub #1116 - GID now requires GROUP to be set, and applies to that group rather than that of the user. * UPD: docs: Indicate license for software package, and add SSLeay notice, GitHub #1125 * FIX: docs: Rephrase tarball section of manual, GitHub #1164 3.2.0 * NEW: BREAKING: Introduce the Meson build system, GitHub #707 GNU Autotools is still supported, but will be removed in a future release. See the newly added INSTALL file. * NEW: BREAKING: Bundle WolfSSL for DHX/RandNum UAM encryption, GitHub #358 This is enabled by default, controlled by option "-Dwith-embedded-ssl" Requires the Meson build system. External OpenSSL 1.1 and LibreSSL are still supported. * NEW: BREAKING: LDAP API bump, OpenLDAP v2.3 or later required, GitHub #762 afp.conf option "ldap server" has been replaced with "ldap uri" and has a new syntax. See the manual for details. * UPD: BREAKING: Remove legacy cdb and tdb CNID backends, GitHub #508 * UPD: BREAKING: Remove Andrew File System (AFS) support, GitHub #554 * UPD: BREAKING: Remove bundled talloc, GitHub #479 For Spotlight support, use the talloc library supplied by your OS, or get the source code from the Samba project and build it yourself. * UPD: BREAKING: Remove generated SPARQL code, GitHub #337 This introduces a compile time dependency on a yacc parser and a lexer to build with Spotlight support. * UPD: BREAKING: Rename macOS launchd plist to io.netatalk.*, GitHub #778 Note: Only the Meson build system will clean up the old plist. * UPD: BREAKING: Renamed Gentoo init script to openrc, GitHub #868 OpenRC is cross platform; confirmed working on Alpine Linux. * NEW: FreeBSD init script, borrowed from FreeBSD ports, GitHub #876 Special thanks to the author, Joe Marcus Clarke. * NEW: OpenBSD init script, GitHub #870 * NEW: Introduce an official Dockerfile and entry script, GitHub #713 * NEW: Option to log to file with second (not us) accuracy, GitHub #580 Enable with afp.conf option: "log microseconds = no" * NEW: Option to add delay to FCE event emission, GitHub #849 Set a ms delay with afp.conf option: "fce sendwait" * NEW: afppasswd: Add -w option to set password from the CLI, GitHub #936 * NEW: docs: Distribute a manual appendix with the GNU GPL v2, GitHub #745 * NEW: docs: Distribute the Japanese localization of the manual, GitHub #806 * NEW: docs: Generate a manual appendix with build instructions, GitHub #791 The appendix is generated from the GitHub CI workflow yaml file. * UPD: docs: Document libraries, init scripts in manual, GitHub #808 * UPD: docs: Remove substituted file system paths from manual, GitHub #514 * FIX: afpd: Prevent theoretical crash in FPSetACL, GitHub #364 * FIX: libatalk: Fix parsing of macOS-created AppleDouble files, GitHub #270 * FIX: libatalk: Restore invalid EA metadata cleanup, GitHub #400 * FIX: quota: Use the NetBSD 6 quota API, GitHub #1028 * FIX: quota: Workaround for rquota.h symbol name on Fedora 40, GitHub #1040 * FIX: uams: Allow linking of the PGP UAM, GitHub #548 * FIX: Shore up error handling and type safety, GitHub #952 * UPD: Rewrite the afpstats script in Perl, GitHub #893 And, improve the formatting of the standard output. Requires the Net::DBus Perl extension. This removes the effective dependency on a Python runtime. * UPD: Make Perl and grep optional requirements, GitHub #886 When either is missing, do not install the optional Perl scripts. * NEW: Build system option "disable-init-hooks", GitHub #796 Will skip init script enablement commands that require elevated privileges on the system. * FIX: Make cracklib macro properly detect dictionary, GitHub #940 * FIX: Build with PAM support on FreeBSD 14, GitHub #560 * FIX: Allow libevent2 linking on OpenIndiana, GitHub #512 * FIX: Control all Spotlight dependencies at compile time, GitHub #571 * UPD: Remove redundant AUTHORS file, GitHub #538 3.1.18 * FIX: CVE-2022-22995: Harden create_appledesktop_folder(), GitHub #480 * FIX: Disable dtrace support on aarch64 FreeBSD hosts, Github #498 * FIX: Correct syntax for libwrap check in tcp-wrappers.m4, GitHub #500 * FIX: Correct syntax for libiconv check in iconv.m4, GitHub #491 * FIX: quota is not supported on macOS, GitHub #492 3.1.17 * FIX: CVE-2023-42464: Validate data type in dalloc_value_for_key(), GitHub #486 * FIX: Declare a variable before using it in a loop, which was throwing off the default compiler on RHEL7, GitHub #481 * UPD: Distribute tarballs with xz compression by default, not gzip, GitHub #478 * UPD: Add AUTHOR sections to all man pages with a reference to CONTRIBUTORS, and standardize headers and footers, GitHub #462 3.1.16 * FIX: libatalk: Fix CVE-2022-23121, CVE-2022-23123 regression - Added guard check before access ad_entry(), GitHub#357 - Allow zero length entry, for AppleDouble specification, GitHub#368 - Remove special handling for COMMENT entries, GitHub#236 - The assertion for invalid entires is still enabled, so please report any future "Invalid metadata EA" errors! * FIX: build system: Fix autoconf warnings and modernize bootstrap and configure.ac, GitHub#331 * FIX: build system: Correct syntax in libevent search macro, summary macro and netatalk executable makefile, GitHub#342 * FIX: build system: Fix native libiconv detection on macOS, GitHub#343 * FIX: build system: Use non-interactive PAM session when available, GitHub#361 * FIX: build system: Fix detection of Berkeley DB installed in multiarch location, GitHub#380 * FIX: build system: Fix support for cross-compilation with mysql_config and dtrace, GitHub#384 * FIX: build system: Support building quota against libtirpc, GitHub#385 * FIX: build system: Fix variable substitution in configure summary, GitHub#443 * UPD: build system: Remove ABI checks and the --enable-developer option, GitHub#262 * FIX: initscript: Improvements to Debian SysV init script - Source init-functions, GitHub#386 - Add a Description and Short-Description, GitHub#428 * FIX: docs: Clarify localstate dir configurability in manual, GitHub#401 * UPD: docs: Make BerkeleyDB 5.3.x the recommended version, GitHub#8 * FIX: docs: Update SourceForge URLs to fix CSS styles and download links * FIX: docs: Remove obsoleted bug reporting sections, GitHub#455 * FIX: Sundry typo fixes in user visible strings and docs, GitHub#381, GitHub#382 * UPD: Rename asip-status.pl as asip-status to make naming implementation-agnostic, GitHub#379 * UPD: Remove redundant uid.c|h files in etc/afpd * UPD: Don't build and distribute deprecated cnid2_create tool, GitHub#412 * UPD: Remove deprecated megatron code and man page, GitHub#456 * UPD: Remove deprecated uniconv code and man page, GitHub#457 * UPD: Improvements to the GitHub CI workflow 3.1.15 * FIX: CVE-2022-43634 * FIX: CVE-2022-45188 * NEW: Support for macOS hosts, Intel and Apple silicon, GitHub#281 * FIX: configure.ac: update deprecated autoconf syntax * UPD: configure.ac: Support linking with system shared libraries Introduces the --with-talloc option * FIX: macros: largefile-check macro for largefile (clang 16) * UPD: macros: Update pthread macro to the latest from gnu.org * FIX: initscripts: Modernize Systemd service file. * FIX: libatalk/conf: include sys/file.h for LOCK_EX * FIX: libatalk: Change log level for realpath() error, SF bug#666 * FIX: libatalk: Change log level for real_name error, SF bug#596 * FIX: libatalk: The my_bool type is deprecated as of MySQL 8.0.1, GitHub#129 * UPD: libatalk: allow afpd to read read-protected afp.conf, SF bug#546 * UPD: libatalk: Make the "valid users" option work in the Homes section, SF bug#449 * UPD: libatalk: Check that FPDisconnectOldSession is successful, SF bug#634 * UPD: libatalk: Bring iniparser library codebase in line with current version 4.1 * FIX: afpd: Provide MNTTYPE_NFS on OmniOS to make quota work, GitHub#117 * FIX: afpd: Avoid triggering realpath() lookups with empty path, GitHub#277 * FIX: spotlight: Spotlight searches can cause afpd to segfault, GitHub#56 * UPD: spotlight: add support for tracker3, SF patch#147 * FIX: macusers: Fix output for long usernames * FIX: macusers: account for usernames with non-word characters * FIX: macusers: Support NetBSD * FIX: Fix all function declarations without a prototype * FIX: Fix C99 compliance issues * FIX: Fix gcc10 compiler warnings * UPD: Remove acsiidocs sources and release notes script * FIX: manpages: afp.conf: Parameters are not quoted, SF bug#617 * FIX: manpages: afp.conf: Document $u in home name, GitHub#123 * FIX: manpages: afp.conf: Document the usage of guest user, GitHub#298 * FIX: Document how the mysql cnid backend is configured, GitHub#69 * FIX: Fix user-visible typos in log output and man pages. * FIX: Fix spelling, syntax, and dead URLs in html manual. * NEW: Create README.md * NEW: Set up GitHub workflow and static analysis with Sonarcloud 3.1.14 * FIX: fix build with libressl >= 2.7.0, GitHub#105 * NEW: Added Ignore Directories Feature * UPD: Generate Unicode source code based on Unicode 14.0, GitHub#114 * FIX: Protect against removing AFP metadata xattr * FIX: avoid setting adouble entries on symlinks * FIX: add handling for cases where ad_entry() returns NULL, GitHub#175 * FIX: Fix setting of LD_LIBRARY_FLAGS ($shlibpath_var). * FIX: afpstats: Fedora migrating away from IO::Socket::INET6, GitHub#130 * FIX: afpd: check return values from setXXid() functions, GitHub#115 * FIX: afpd: drop groups in become_user_permanently(), GitHub#126 * FIX: Fix use after free in get_tm_used() * FIX: Fix sign extension problem in bsd_attr_list() * FIX: Fix garbage read in bsd_attr_list * FIX: make afpstats python 3 compatible * UPD: docs: manual: Remove wrong TCP-over-TCP info; minor copy editing * FIX: configure.ac: fix macro ordering for CentOS 6 * FIX: configure.ac: fix typo * FIX: configure.ac: remove some trailing whitespace * FIX: configure.ac: fix deprecated macro invocation * FIX: configure.ac: replace obsolete macro * FIX: libatalk/dsi/Makefile.am: fix deprecation warning * FIX: Store AutoMake helper script in build-aux/ * FIX: configure.ac: define a dir for macros * FIX: configure.ac: AM_CONFIG_HEADER is deprecated * FIX: autotools: Fix another deprecation warning * FIX: libgcrypt typo in configuration error message * UPD: Various CI improvements * FIX: libatalk/conf: re-generation of afp_voluuid.conf * UPD: libatalk/conf: code cleanup and add locking to get_vol_uuid() * UPD: add documentation for the lv_flags_t * FIX: No need to check for attropen on Solaris, GitHub#44 3.1.13 * FIX: CVE-2021-31439 * FIX: CVE-2022-23121 * FIX: CVE-2022-23123 * FIX: CVE-2022-23122 * FIX: CVE-2022-23125 * FIX: CVE-2022-23124 * FIX: CVE-2022-0194 * FIX: afpd: make a variable declaration a definition * UPD: Remove bundled libevent 3.1.12 * FIX: dhx uams: build with LibreSSL, GitHub#91 * FIX: various spelling errors * FIX: CVE-2018-1160 3.1.11 * NEW: Global option "zeroconf name", FR#99 * NEW: show Zeroconf support by "netatalk -V", FR#100 * UPD: gentoo: Switch openrc init script to openrc-run, GitHub#77 * FIX: log message: name of function doese not match, GitHub#78 * UPD: volume capacity reporting to match Samba behavior, GitHub#83 * FIX: debian: sysv init status command exits with proper exit code, GitHub#84 * FIX: dsi_stream_read: len:0, unexpected EOF, GitHub#82 * UPD: dhx uams: OpenSSL 1.1 support, GitHub#87 3.1.10 * FIX: cannot build when ldap is not defined, bug #630 * FIX: SIGHUP can cause core dump when mdns is enabled, bug #72 * FIX: Solaris: stale pid file puts netatalk into maintenance mode, bug #73 * FIX: dsi_stream_read: len:0, unexpected EOF, bug #633 3.1.9 * FIX: afpd: fix "admin group" option * NEW: afpd: new options "force user" and "force group" * FIX: listening on IPv6 wildcard address may fail if IPv6 is disabled, bug #606 * NEW: LibreSSL support, FR #98 * FIX: cannot build when acl is not defined, bug #574 * UPD: configure option "--with-init-style=" for Gentoo. "gentoo" is renamed to "gentoo-openrc". "gentoo-openrc" is same as "openrc". "gentoo-systemd" is same as "systemd". * NEW: configure option "--with-dbus-daemon=PATH" for Spotlight feature * UPD: use "tracker daemon" command instead of "tracker-control" command if Gnome Tracker is the recent version. * NEW: configure options "--enable-rpath" and "--disable-rpath" which can be used to force setting of RPATH (default on Solaris/NetBSD) or disable it. * NEW: configure option "--with-tracker-install-prefix" allows setting an alternate install prefix for tracker when cross-compiling. * UPD: asip-status.pl: IPv6 support * UPD: asip-status.pl: show GSS-UAM SPNEGO blob * FIX: afpd: don't use network IDs without LDAP, bug #621 * FIX: afpd: reading from file may fail, bug #619 * NEW: AFP clients should not be able to copy or manipulate special extended attributes set by NFS and SMB servers on Solaris, issue #36 * FIX: ad: ad cp may crash, bug #622 * UPD: Update Unicode support to version 9.0.0 3.1.8 * FIX: CNID/MySQL: Quote UUID table names. https://sourceforge.net/p/netatalk/bugs/585/ * FIX: Crash in cnid_metad, bug #593 * UPD: Update Unicode support to version 8.0.0 * FIX: larger server side copyfile buffer for improved IO performance, bug #599 * NEW: afpd: new option "ea = samba". Use Samba vfs_streams_xattr compatible xattrs which means adding a 0 byte at the end of xattrs. * FIX: remove #541 workaround patch. There was this problem with only early Fedora 20. * FIX: rpmbuild fails on Fedora x86_64, bug #598 * FIX: Listen on IPv6 wildcard address by default, bug #602 * FIX: FCE protocol version 1 packets, bug #603 * UPD: Update list of BerkeleyDB versions searched at configure time 3.1.7 * UPD: Spotlight: enhance behaviour for long running queries, client will now show "progress wheel" while waiting for first results. * FIX: netatalk: fix a crash on Solaris when registering with mDNS * FIX: netatalk: SIGHUP would kill the process instead of being resent to the other Netatalk processes, bug #579 * FIX: afpd: Solaris locking problem, bug #559 * FIX: Handling of malformed UTF8 strings, bug #524 * FIX: afpd: umask handling, bug #576 * FIX: Spotlight: Limiting searches to subfolders, bug #581 * FIX: afpd: reloading logging config may result in privilege escalation in afpd processes * FIX: afpd: ACL related error messages, now logged with loglevel debug instead of error * FIX: cnid_metad: fix tsockfd_create() return value on error * FIX: CNID/MySQL: volume table name generation, bug #566. 3.1.6 * FIX: Spotlight: fix for long running queries * UPD: afpd: distribute SIGHUP from parent afpd to children and force reload shares * FIX: netatalk: refresh Zeroconf registration when receiving SIGHUP * NEW: configure option "--with-init-style=debian-systemd" for Debian 8 jessie and later. "--with-init-style=debian" is renamed "--with-init-style=debian-sysv". 3.1.5 * FIX: Spotlight: several important fixes 3.1.4 * FIX: afpd: Hangs in Netatalk which causes it to stop responding to connections, bug #572. * NEW: afpd: new option "force xattr with sticky bit = yes|no" (default: no), FR #94 * UPD: afpd: FCE version 2 with new event types and new config options "fce ignore names" and "fce notify script" * UPD: afpd: check for modified included config file, FR #95. * UPD: libatalk: logger: remove flood protection and allocate messages * UPD: Spotlight: use async Tracker SPARQL API * NEW: afpd: new option "case sensitive = yes|no" (default: yes) In spite of being case sensitive as a matter of fact, netatalk 3.1.3 and earlier did not notify kCaseSensitive flag to the client. Now, it is notified correctly by default, FR #62. 3.1.3 * UPD: Spotlight: more SPARQL query optimisations * UPD: Spotlight: new options "sparql results limit", "spotlight attributes" and "spotlight expr" * FIX: afpd: Unarchiving certain ZIP archives fails, bug #569 * UPD: Update Unicode support to version 7.0.0 * FIX: Memory overflow caused by 'basedir regex', bug #567 * NEW: afpd: delete empty resource forks, from FR #92 * FIX: afpd: fix a crash when accessing ._ AppleDouble files created by OS X via SMB, bug #564 * FIX: afpd and dbd: Converting from AppleDouble v2 to ea may corrupt the resource fork. In some circumstances an offset calculation is wrong resulting in corrupt resource forks after the conversion. Bug #568. * FIX: ad: fix for bug #563 broke ad file utilities, bug #570. * NEW: afpd: new advanced option controlling permissions and ACLs, from FR #93 Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-09 10:41:05 +00:00
Adolf Belka	1e639a1dfa	libassuan: Update to version 3.0.1 ... - Update from version 2.5.5 to 3.0.1 - Update of rootfile - Changelog 3.0.1 * Change Unix symbol versioning to help the Debian transitioning process. 3.0.0 * API change: For new code, which uses libassuan with nPTH, please use gpgrt_get_syscall_clamp and assuan_control, instead of the system_hooks API. Use of ASSUAN_SYSTEM_NPTH is deprecated with new API version 3. If it's really needed to keep using old implementation of ASSUAN_SYSTEM_NPTH, you need to change your your application code, to define ASSUAN_REALLY_REQUIRE_V2_NPTH_SYSTEM_HOOKS before including <assuan.h>. For an application which uses version 2 API (NEED_LIBASSUAN_API=2 in its configure.ac), use of ASSUAN_SYSTEM_NPTH is still supported. [T5914] * New function assuan_control. [T6625] * New function assuan_sock_accept. [T5925] * New functions assuan_pipe_wait_server_termination and assuan_pipe_kill_server to support abstraction of process. [T6487] * Windows support for sendfd/recvfd. [T6236] * Implement timeout in assuan_sock_connect_byname. [T3302] * No support for WindowsCE, any more. [T6170] * New socket flags "linger" and "reuseaddr". [rA87f92fe962] * Interface changes relative to the 2.5.0 release: assuan_sock_accept NEW. assuan_pipe_wait_server_termination NEW. assuan_pipe_kill_server NEW. assuan_sock_set_flag EXTENDED. assuan_sock_get_flag EXTENDED. 2.5.7 New configure option --with-libtool-modification. [T6619] Change the naming of the 64 bit Windows DLL from libassuan6-0.dll to libassuan-0.dll to sync this with what we did for libgpg-error. 2.5.6 * Fix logging of confidential data. [rA0fc31770fa] * Fix memory wiping. [T5977] * Fix macOS build problem. [T5440,T5610] * Upgrade autoconf stuff. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-09 10:38:43 +00:00
Adolf Belka	6c0e02c80d	fmt: Update to version 11.0.1 ... - Update from version 10.2.1 to 11.0.1 - Update of rootfile - fmt from version 11.0.0 onwards has made the format function a constant. This was done to enforce that formatter::format is const for compatibility with std::format. - Changelog 11.0.1 Fixed version number in the inline namespace (#4047). Fixed disabling Unicode support via CMake (#4051). Fixed deprecated visit_format_arg (#4043). Fixed handling of a sign and improved the std::complex formater (#4034, #4050). Removed a redundant check in the formatter for std::expected (#4040). 11.0.0 Added fmt/base.h which provides a subset of the API with minimal include dependencies and enough functionality to replace all uses of the printf family of functions. This brings the compile time of code using {fmt} much closer to the equivalent printf code. This gives almost 4x improvement in build speed compared to version 10. Note that the benchmark is purely formatting code and includes. In real projects the difference from printf will be smaller partly because common standard headers will be included in almost any translation unit (TU) anyway. In particular, in every case except printf above ~1s is spent in total on including <type_traits> in all TUs. Optimized includes in other headers such as fmt/format.h which is now roughly equivalent to the old fmt/core.h in terms of build speed. Migrated the documentation at https://fmt.dev/ from Sphinx to MkDocs. Improved C++20 module support (#3990, #3991, #3993, #3994, #3997, #3998, #4004, #4005, #4006, #4013, #4027, #4029). In particular, native CMake support for modules is now used if available. Added an option to replace standard includes with import std enabled via the FMT_IMPORT_STD macro (#3921, #3928). Exported fmt::range_format, fmt::range_format_kind and fmt::compiled_string from the fmt module (#3970, #3999). Improved integration with stdio in fmt::print, enabling direct writes into a C stream buffer in common cases. This may give significant performance improvements ranging from tens of percent to 2x and eliminates dynamic memory allocations on the buffer level. It is currently enabled for built-in and string types with wider availability coming up in future releases. For example, it gives ~24% improvement on a simple benchmark compiled with Apple clang version 15.0.0 (clang-1500.1.0.2.5) and run on macOS 14.2.1 Improved safety of fmt::format_to when writing to an array (#3805). For example (godbolt): auto volkswagen = char[4]; auto result = fmt::format_to(volkswagen, "elephant"); no longer results in a buffer overflow. Instead the output will be truncated and you can get the end iterator and whether truncation occurred from the result object. Enabled Unicode support by default in MSVC, bringing it on par with other compilers and making it unnecessary for users to enable it explicitly. Most of {fmt} is encoding-agnostic but this prevents mojibake in places where encoding matters such as path formatting and terminal output. You can control the Unicode support via the CMake FMT_UNICODE option. Note that some {fmt} packages such as the one in vcpkg have already been compiled with Unicode enabled. Added a formatter for std::expected (#3834). Added a formatter for std::complex (#1467, #3886, #3892, #3900). Added a formatter for std::type_info (#3978). Specialized formatter for std::basic_string types with custom traits and allocators (#3938, #3943). Added formatters for std::chrono::day, std::chrono::month, std::chrono::year and std::chrono::year_month_day (#3758, #3772, #3906, #3913). Fixed handling of precision in %S (#3794, #3814). Thanks @js324. Added support for the - specifier (glibc strftime extension) to day of the month (%d) and week of the year (%W, %U, %V) specifiers (#3976). Fixed the scope of the - extension in chrono formatting so that it doesn't apply to subsequent specifiers (#3811, #3812). Improved handling of time_point::min() (#3282). Added support for character range formatting (#3857, #3863). Added string and debug_string range formatters (#3973, #4024). Enabled ADL for begin and end in fmt::join (#3813, #3824). Made contiguous iterator optimizations apply to std::basic_string iterators (#3798). Added support for ranges with mutable begin and end (#3752, #3800, #3955). Added support for move-only iterators to fmt::join (#3802, #3946). Moved range and iterator overloads of fmt::join to fmt/ranges.h, next to other overloads. Fixed handling of types with begin returning void such as Eigen matrices (#3839, #3964). Added an fmt::formattable concept (#3974). Added support for __float128 (#3494). Fixed rounding issues when formatting long double with fixed precision (#3539). Made fmt::isnan not trigger floating-point exception for NaN values (#3948, #3951). Removed dependency on <memory> for std::allocator_traits when possible (#3804). Enabled compile-time checks in formatting functions that take text colors and styles. Deprecated wide stream overloads of fmt::print that take text styles. Made format string compilation work with clang 12 and later despite only partial non-type template parameter support (#4000, #4001). Made fmt::iterator_buffer's move constructor noexcept (#3808). Started enforcing that formatter::format is const for compatibility with std::format (#3447). Added fmt::basic_format_arg::visit and deprecated fmt::visit_format_arg. Made fmt::basic_string_view not constructible from nullptr for consistency with std::string_view in C++23 (#3846). Fixed fmt::group_digits for negative integers (#3891, #3901). Fixed handling of negative ids in fmt::basic_format_args::get (#3945). Improved named argument validation (#3817). Disabled copy construction/assignment for fmt::format_arg_store and fixed moved construction (#3833). Worked around a locale issue in RHEL/devtoolset (#3858, #3859). Added RTTI detection for MSVC (#3821, #3963). Migrated the documentation from Sphinx to MkDocs. Improved documentation and README. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Adolf Belka	ff6a50b9e4	tshark: Update to version 4.2.6 ... - Update from version 4.2.5 to 4.2.6 - Update of rootfile - Changelog 4.2.6 Bug Fixes A regression in the TCP Stream Graph "Time Sequence (tcptrace)" receive window line behavior introduced in 4.2.5 and 4.0.15 has been fixed. Issue 19846[3] The following vulnerability has been fixed: • wnpa-sec-2024-10[4] SPRT dissector crash. Issue 19559[5]. The following bugs have been fixed: • RADIUS dissector’s dictionary loading broken in many ways. Issue 6466[6]. • 3.4 → 3.6.5 ASCII display is broken on CentOS 7. Issue 18096[7]. • Funnel/Lua: Closing child window disconnects buttons of parent. Issue 18386[8]. • Lua detection fails with Alpine Linux: missing: LUA_LIBRARIES. Issue 19841[9]. • vnd.3gpp.5gnas payloads of type SMS not decoded inside HTTP2 5GC. Issue 19845[10]. • TCP Stream Graphs green sliding window line not displayed correctly. Issue 19846[11]. • Wireshark window doesn’t fully fit on screen on small resolutions and can’t be resized properly on Russian language. Issue 19861[12]. • Wireshark started from command line doesn’t set gui.fileopen_remembered_dir correctly on Windows. Issue 19891[13]. • Wireshark expects wrong length for DHCP Relay Agent Information Source Port Suboption. Issue 19909[14]. • SIP P-Access-Network-Info header not correctly decoded. Issue 19917[15]. Updated Protocol Support DHCP, E.212, MySQL, NAS-5GS, PKT CCC, ProtoBuf, RADIUS, RLC-LTE, RTP, SIP, SPRT, Thrift, and Wi-SUN New and Updated Capture File Support log3gpp Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Adolf Belka	7674c7533e	c-ares: Update to version 1.32.1 ... - Update from version 1.17.1 to 1.32.1 - Update of rootfile - There have been 22 version updates that are now being applied. 4 of these releases had security issues being addressed and there have been 5 CVE's and fixes - Changelog 1.32.1 Bugfixes: Channel lock needs to be recursive to ensure calls into c-ares functions can be made from callbacks otherwise deadlocks will occur. This regression was introduced in 1.32.0 1.32.0 Features: Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying ARES_FLAG_DNS0x20. Disabled by default. PR #800 Rework query timeout logic to automatically adjust timeouts based on network conditions. The timeout specified now is only used as a hint until there is enough history to calculate a more valid timeout. PR #794 Changes: DNS RR TXT strings should not be automatically concatenated as there are use cases outside of RFC 7208. In order to maintain ABI compliance, the ability to retrieve TXT strings concatenated is retained as well as a new API to retrieve the individual strings. This restores behavior from c-ares 1.20.0. PR #801 Clean up header inclusion logic to make hacking on code easier. PR #797 GCC/Clang: Enable even more strict warnings to catch more coding flaws. 253bdee MSVC: Enable /W4 warning level. PR #792 Bugfixes: Tests: Fix thread race condition in test cases for EventThread. PR #803 Windows: Fix building with UNICODE. PR #802 Thread Saftey: ares_timeout() was missing lock. 74a64e4 Fix building with DJGPP (32bit protected mode DOS). PR #789 1.31.0 Changes: Enable Query Cache by default. PR #786 Bugfixes: Enhance Windows DNS configuration change detection to also detect manual DNS configuration changes. PR #785 Various legacy MacOS Build fixes. Issue #782 Ndots value of zero in resolv.conf was not being honored. 852a60a Watt-32 build support had been broken for some time. PR #781 Distribute ares_dns_rec_type_tostr manpage. PR #778 1.30.0 Features: Basic support for SIG RR record (RFC 2931 / RFC 2535) PR #773 Changes: Validation that DNS strings can only consist of printable ascii characters otherwise will trigger a parse failure. 75de16c and 40fb125 Windows: use GetTickCount64() for a monotonic timer that does not wrap. 1dff8f6 Bugfixes: QueryCache: Fix issue where purging on server changes wasn’t working. a6c8fe6 Windows: Fix Y2K38 issue by creating our own ares_timeval_t datatype. PR #772 Fix packaging issue affecting MacOS due to a missing header. 55afad6 MacOS: Fix UBSAN warnings that are likely meaningless due to alignment issues in new MacOS config reader. Android: arm 32bit build failure due to missing symbol. d1722e6 1.29.0 Features: When using ARES_OPT_EVENT_THREAD, automatically reload system configuration when network conditions change. PR #759 Apple: reimplement DNS configuration reading to more accurately pull DNS settings. PR #750 Add observability into DNS server health via a server state callback, invoked whenever a query finishes. PR #744 Add server failover retry behavior, where failed servers are retried with small probability after a minimum delay. PR #731 Changes: Mark ares_channel_t * as const in more places in the public API. PR #758 Bugfixes: Due to a logic flaw dns name compression writing was not properly implemented which would result in the name prefix not being written for a partial match. This could cause issues in various record types such as MX records when using the deprecated API. Regression introduced in 1.28.0. Issue #757 Revert OpenBSD SOCK_DNS flag, it doesn’t do what the docs say it does and causes c-ares to become non-functional. PR #754 ares_getnameinfo(): loosen validation on salen parameter. Issue #752 cmake: Android requires C99. PR #748 ares_queue_wait_empty() does not honor timeout_ms >= 0. Issue #742 1.28.1 This release contains a fix for a single significant regression introduced in c-ares 1.28.0. ares_search() and ares_getaddrinfo() resolution fails if no search domains are specified. Issue #737 1.28.0 Features: Emit warnings when deprecated c-ares functions are used. This can be disabled by passing a compiler definition of CARES_NO_DEPRECATED. PR #732 Add function ares_search_dnsrec() to search for records using the new DNS record data structures. PR #719 Rework internals to pass around ares_dns_record_t instead of binary data, this introduces new public functions of ares_query_dnsrec() and ares_send_dnsrec(). PR #730 Changes: tests: when performing simulated queries, reduce timeouts to make tests run faster Replace configuration file parsers with memory-safe parser. PR #725 Remove acountry completely, the manpage might still get installed otherwise. Issue #718 Bugfixes: CMake: don’t overwrite global required libraries/definitions/includes which could cause build errors for projects chain building c-ares. Issue #729 On some platforms, netinet6/in6.h is not included by netinet/in.h and needs to be included separately. PR #728 Fix a potential memory leak in ares_init(). Issue #724 Some platforms don’t have the isascii() function. Implement as a macro. PR #721 CMake: Fix Chain building if CMAKE runtime paths not set NDots configuration should allow a value of zero. PR #735 1.27.0 Security: Moderate. CVE-2024-25629. Reading malformatted /etc/resolv.conf, /etc/nsswitch.conf or the HOSTALIASES file could result in a crash. GHSA-mg26-v6qh-x48q Features: New function ares_queue_active_queries() to retrieve number of in-flight queries. PR #712 New function ares_queue_wait_empty() to wait for the number of in-flight queries to reach zero. PR #710 New ARES_FLAG_NO_DEFLT_SVR for ares_init_options() to return a failure if no DNS servers can be found rather than attempting to use 127.0.0.1. This also introduces a new ares status code of ARES_ENOSERVER. PR #713 Changes: EDNS Packet size should be 1232 as per DNS Flag Day. PR #705 Bugfixes: Windows DNS suffix search list memory leak. PR #711 Fix warning due to ignoring return code of write(). PR #709 CMake: don’t override target output locations if not top-level. Issue #708 Fix building c-ares without thread support. PR #700 1.26.0 Features: Event Thread support. Integrators are no longer required to monitor the file descriptors registered by c-ares for events and call ares_process() when enabling the event thread feature via ARES_OPT_EVENT_THREAD passed to ares_init_options(). PR #696 Added flags to are_dns_parse() to force RAW packet parsing. PR #693 Changes: Mark ares_fds() as deprecated. PR #691 Bugfixes: adig: Differentiate between internal and server errors. e10b16a Autotools allow make to override CFLAGS/CPPFLAGS/CXXFLAGS. PR #695 Autotools: fix building for 32bit windows due to stdcall symbol mangling. PR #689 RR Name should not be sanity checked against the Question. PR #685 1.25.0 Changes: AutoTools: rewrite build system to be lighter weight and fix issues in some semi-modern systems. It is likely this has broken building on some less common and legacy OSs, please report issues. PR #674 Rewrite ares_strsplit() as a wrapper for ares__buf_split() for memory safety reasons. 88c444d The ahost utility now uses ares_getaddrinfo() and returns both IPv4 and IPv6 addresses by default. PR #669 OpenBSD: Add SOCK_DNS flag when creating socket. PR #659 Bugfixes: Tests: Live reverse lookups for Google’s public DNS servers no longer return results, replace with CloudFlare pubic DNS servers. 1231aa7 MacOS legacy SDKs require sys/socket.h before net/if.h PR #673 Connection failures should increment the server failure count first or a retry might be enqueued to the same server. 05181a6 On systems that don’t implement the ability to enumerate network interfaces the stubs used the wrong prototype. eebfe0c Fix minor warnings and documentation typos. PR #666 Fix support for older GoogleTest versions. d186f11 getrandom() may require sys/random.h on some systems. Issue #665 Fix building tests with symbol hiding enabled. Issue #664 1.24.0 Features: Add support for IPv6 link-local DNS servers. Nameserver formats can now accept the %iface suffix, and a new ares_get_servers_csv() function was added to return servers that can contain the link-local interface name. Changes: Unbundle GoogleTest for test cases. Package maintainers will now need to require GoogleTest (GMock) as a build dependency if building tests. New GoogleTest versions require C++14 or later. Replace nameserver parsing code to use new memory-safe functions. Replace the sortlist parser with new memory-safe functions. Various warning fixes and dead code removal. Bugfixes: Old Linux versions require POSIX_C_SOURCE or _GNU_SOURCE to compile with thread safety support. A non-responsive DNS server that caused timeouts wouldn’t increment the failure count, this would lead to other servers not being tried. Regression introduced in 1.22.0. Some projects that depend on c-ares expect invalid parameter option values passed into ares_init_options() to simply be ignored. This behavior has been restored. On linux getrandom() can fail if the kernel doesn’t support the syscall, fall back to another random source. ares_cancel() when performing ares_gethostbyname() or ares_getaddrinfo() with AF_UNSPEC, if called after one address class was returned but before the other address class, it would return ARES_SUCCESS rather than ARES_ECANCELLED. 1.23.0 Features: Introduce optional (but on by default) thread-safety for the c-ares library. This has no API nor ABI implications. resolv.conf in modern systems uses attempts and timeouts options instead of the old retrans and retry options. Query caching support based on TTL of responses. Can be enabled via ares_init_options() with ARES_OPT_QUERY_CACHE. Bugfixes: ares_init_options() for ARES_OPT_UDP_PORT and ARES_OPT_TCP_PORT accept the port in host byte order, but it was reading it as network byte order. Regression introduced in 1.20.0. ares_init_options() for ARES_FLAG_NOSEARCH was not being honored for ares_getaddrinfo() or ares_gethostbyname(). Regression introduced in 1.16.0. Autotools MacOS and iOS version check was failing Environment variables passed to c-ares are meant to be an override for system configuration. Regression introduced in 1.22.0. Spelling fixes as detected by codespell. The timeout returned by ares_timeout() was truncated to milliseconds but validated to microseconds which could cause a user to attempt to process timeouts prior to the timeout actually expiring. CMake was not honoring CXXFLAGS passed in via the environment which could cause compile and link errors with distribution hardening flags during packaging. Fix Windows UWP and Cygwin compilation. ares_set_servers_*() for legacy reasons needs to accept an empty server list and zero out all servers. This results in an inoperable channel and thus is only used in simulation testing, but we don’t want to break users. Regression introduced in 1.21.0. 1.22.1 Bugfixes: Fix /etc/hosts processing performance with all entries using same IPaddress. Large hosts files using the same IP address for all entries could use exponential time. Fix typos in manpages Fix OpenWatcom building 1.22.0 Features: ares_reinit() is now implemented to re-read any system configuration and immediately apply to an existing ares channel The adig command line program has been rewritten and its format now more closely matches that of BIND’s dig utility The new DNS message parser and writer functions have now been made public RFC9460 HTTPS and SVCB records are now supported RFC6698 TLSA records are now supported The server list is now internally dynamic and can be changed without impacting existing queries Hosts file processing is now cached until the file is detected to be changed to speed up repetitive lookups of large hosts files Changes: Internally all DNS messages are now written using the new DNS writing functions EDNS is now enabled by default Internal cleanups in function prototypes Bugfixes: Randomize retry penalties to prevent thundering herd issues when dns servers throttle requests Fix Windows build error for missing if_indextoname() 1.21.0 Changes: Provide better man page cross-links. Introduce ares_status_t as an enum rather than using #define list and integer data type for internal functions. Introduce ares_bool_t datatype rather than using an integer with 0/1 so it is clear based on the function prototype what it returns. Increase compiler warning levels by default. Use size_t and other more proper datatypes internally (rather than int). Many developers have used different code styles over the years, standardize on one and use clang-format to enforce the style. CMake can now control symbol visibility Replace multiple DNS hand-made parsers with new memory-safe DNS message parser. Bugfixes: Tools: STAYOPEN flag could make tools not terminate. Socket callbacks were passed SOCK_STREAM instead of SOCK_DGRAM on udp. 1.20.1 Bugfixes: Resolve use-after-free issue when TCP connection is terminated before a response is returned Reduce number of queries for a load test case to prevent overloading some build systems Fix fuzz test build target 1.20.0 Changes: Update from 1989 MIT license text to modern MIT license text Remove acountry from built tools as nerd.dk is gone Add new ARES_OPT_UDP_MAX_QUERIES configuration option to limit the number of queries that can be made from a single ephemeral port Default per-query timeout has been reduced to 2s with a 3x retry count Modernization: start implementing some common data structures that are easy to use and hard to misuse. This will make code refactoring easier and remove some varied implementations in use. This change also makes ares_timeout() more efficient Use SPDX identifiers and a REUSE CI job to verify rand: add support for getrandom() Bug fixes: TCP back to back queries were broken Ensure queries for ares_getaddrinfo() are not requeued during destruction ares_getaddrinfo() should not retry other address classes if one address class has already been returned Avoid production ill-formed result when qualifying a name with the root domain Fix missing prefix for CMake generated libcares.pc DNS server ports will now be read from system configuration instead of defaulting to port 53 Remove some unreachable code Replace usages of sprintf with snprintf Fix Watcom instructions and update Windows URLs 1.19.1 Security: CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service CVE-2023-31147 Moderate. Insufficient randomness in generation of DNS query IDs CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton() CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during cross compilation Bug fixes: Fix uninitialized memory warning in test Turn off IPV6_V6ONLY on Windows to allow IPv4-mapped IPv6 addresses ares_getaddrinfo() should allow a port of 0 Fix memory leak in ares_send() on error Fix comment style in ares_data.h Remove unneeded ifdef for Windows Fix typo in ares_init_options.3 Re-add support for Watcom compiler Sync ax_pthread.m4 with upstream Windows: Invalid stack variable used out of scope for HOSTS path Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support 1.19.0 Security: Low. Stack overflow in ares_set_sortlist() which is used during c-ares initialization and typically provided by an administrator and not an end user. Changes: Windows: Drop support for XP and derivatives which greatly cleans up initialization code. Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for specifying a custom hosts file location. Add vcpkg installation instructions Bug fixes: Fix cross-compilation from Windows to Linux due to CPACK logic. Fix memory leak in reading /etc/hosts when using localhost fallback. Fix chain building c-ares when libresolv is already included by another project File lookup should not immediately abort as there may be other tries due to search criteria. Asterisks should be allowed in host validation as CNAMEs may reference wildcard domains AutoTools build system referenced bad STDC_HEADERS macro Even if one address class returns a failure for ares_getaddrinfo() we should still return the results we have CMake Windows: DLLs did not include resource file to include versions CMake: Guard target creation in exported config Fix ares_getaddrinfo() numerical address resolution with AF_UNSPEC Apple: fix libresolv configured query times. Fix tools and help information Various documentation fixes and cleanups Add include guards to ares_data.h c-ares could try to exceed maximum number of iovec entries supported by system CMake package config generation allow for absolute install paths Intel compiler fixes ares_strsplit bugs The RFC6761 6.3 states localhost subdomains must be offline too. 1.18.1 Bug fixes: ares_getaddrinfo() would return ai_addrlen of 16 for ipv6 adddresses rather than the sizeof(struct sockaddr_in6) 1.18.0 Changes: Add support for URI(Uniform Resource Identifier) records via ares_parse_uri_reply() Provide ares_nameser.h as a public interface as needed by NodeJS Update URLs from c-ares.haxx.se to c-ares.org During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so that the search process will continue to the next domain in the search. Turn ares_gethostbyname() into a wrapper for ares_getaddrinfo() as they followed very similar code paths and ares_gethostbyaddr() has some more desirable features such as priority sorting and parallel queries for AF_UNSPEC. ares_getaddrinfo() now contains a name element in the address info structure as the last element. This is not an API or ABI break due to the structure always being internally allocated and it being the last element. ares_parse_a_reply() and ares_parse_aaaa_reply() were nearly identical, those now use the same helper functions for parsing rather than having their own code. RFC6761 Section 6.3 says “localhost” lookups need to be special cased to return loopback addresses, and not forward queries to recursive dns servers. On Windows this now returns all loopback addresses, on other systems it returns 127.0.0.1 or ::1 always, and will never forward a request for “localhost” to outside DNS servers. Haiku: port Bug fixes: add build to .gitignore z/OS minor update, add missing semicolon in ares_init.c Fix building when latest ax_code_coverage.m4 is imported Work around autotools ‘error: too many loops’ and other newer autotools import related bugs. MinGW cross builds need advapi32 link as lower case Cygwin build fix due to containing both socket.h and winsock2.h ares_expand_name should allow underscores (_) as SRV records legitimately use them Allow ‘/’ as a valid character for a returned name for CNAME in-addr.arpa delegation ares_getaddrinfo() was not honoring HOSTALIASES ares_getaddrinfo() had some test cases disabled due to a bug in the test framework itself which has now been resolved 1.17.2 Security: NodeJS passes NULL for addr and 0 for addrlen to ares_parse_ptr_reply() on systems where malloc(0) returns NULL. This would cause a crash. When building c-ares with CMake, the RANDOM_FILE would not be set and therefore downgrade to the less secure random number generator If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause a crash Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing follow-up Perform validation on hostnames to prevent possible XSS due to applications not performing valiation themselves Changes: Use non-blocking /dev/urandom for random data to prevent early startup performance issues z/OS port ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases Bug fixes: Fuzz testing files were not distributed with official archives Building tests should not force building of static libraries except on Windows Windows builds of the tools would fail if built as static due to a missing CARES_STATICLIB definition Relative headers must use double quotes to prevent pulling in a system library Fix OpenBSD building by implementing portability updates for including arpa/nameser.h Fix building out-of-tree for autotools Make install on MacOS/iOS with CMake was missing the bundle destination so libraries weren’t actually installed Fix retrieving DNS server configuration on MacOS and iOS if the configuration did not include search domains ares_parse_a_reply and ares_parse_aaa_reply were erroneously using strdup() instead of ares_strdup() Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Michael Tremer	bf8abf549e	samba: Fix rootfiles ... The CGI script, the misc-progs helper and the menu entry were removed. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-10 14:28:48 +00:00
Adolf Belka	b5befbc045	samba: Update to version 4.20.2 ... - Update from version 4.20.1 to 4.20.2 - Update of rootfile for both x86_64 and aarch64 - After doing a grep into the config directories I realised that the xxxMACHINExxx phrase is only added into rootfiles in the main common or package directories and not in the x86_64 and aarch64 - In the past I have submitted the samba rootfile with x86_64 replaced by xxxMACHINExxx. It seems to have worked, so the replacement probably occurs even in the architecture specific directories but it doesn't need to be used there as the directory is clearly only for that one architecture. - Changelog 4.20.2 * BUG 15662: vfs_widelinks with DFS shares breaks case insensitivity. * BUG 13213: Samba build is not reproducible. * BUG 15569: ldb qsort might r/w out of bounds with an intransitive compare function. * BUG 15625: Many qsort() comparison functions are non-transitive, which can lead to out-of-bounds access in some circumstances. * BUG 15638: Need to change gitlab-ci.yml tags in all branches to avoid CI bill. * BUG 15654: We have added new options --vendor-name and --vendor-patch- revision arguments to ./configure to allow distributions and packagers to put their name in the Samba version string so that when debugging Samba the source of the binary is obvious. * BUG 15665: CTDB RADOS mutex helper misses namespace support. * BUG 13019: Dynamic DNS updates with the internal DNS are not working. * BUG 14981: netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0. * BUG 15412: Anonymous smb3 signing/encryption should be allowed (similar to Windows Server 2022). * BUG 15573: Panic in dreplsrv_op_pull_source_apply_changes_trigger. * BUG 15620: s4:nbt_server: does not provide unexpected handling, so winbindd can't use nmb requests instead cldap. * BUG 15642: winbindd, net ads join and other things don't work on an ipv6 only host. * BUG 15659: Segmentation fault when deleting files in vfs_recycle. * BUG 15664: Panic in vfs_offload_token_db_fetch_fsp(). * BUG 15666: "client use kerberos" and --use-kerberos is ignored for the machine account. * BUG 15435: Regression DFS not working with widelinks = true. * BUG 15633: samba-gpupdate - Invalid NtVer in netlogon_samlogon_response. * BUG 15653: idmap_ad creates an incorrect local krb5.conf in case of trusted domain lookups. * BUG 15660: The images don't build after the git security release and CentOS 8 Stream is EOL. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-08 15:31:13 +00:00
Adolf Belka	374ba6dafc	tshark: Update to version 4.2.5 ... - Update from version 4.0.8 to 4.2.5 - Update of rootfile - Version 4.2.5 requires asciidoctor to be built for tshark to build. Despite lots of investigation and testing out various commands, tshark will not build if asciidoctor is not present, even if the docs are not going to be used. It is only required for the build - To build asciidoctor ruby has to be installed. It is only required for the build of asciidoctor - tshark has previously had its own version of speexdsp built in. It is only used to provide some "arbitrary resampling code" during the build and does not end up in the running tshark system. Version 4.2.5 has removed the internal speexdsp code but it is still a required dependency for building, so speexdsp also need to be installed but only for the build stage. - The associated patches with this one provide the build installation of ruby, asciidoctor and speexdsp. With these installed tshark was able to be built. - version 4.0.8 and 4.2.5 of tshark were tested out on a vm system with the command "tshark -c 100 > tshark" and this wrote 100 packets from the vm red0 interface to a text file. Both the old and new versions provided the same sort of result. To a first level of testing this shows that the 4.2.5 version is functioning as the previous version was. - This version had an sobump so find-dependencies was run. All files linked to the three libraries in tshark are all also in tshark. No other package is linked to. - Changelog There are 13 releases between 4.0.8 and 4.2.5 so the changelist is too large to include here. Details can be found in the release notes for each version at https://www.wireshark.org/docs/relnotes/ 21 CVE vulnerabilities have been fixed that were identified in 7 of the 13 versions. Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:17:00 +00:00
Adolf Belka	3161e5e857	taglib: Update to version 2.0.1 ... - Update from version 1.12 to 2.0.1 - Update of rootfile - sobump so ran find-dependencies. None found except taglib itself. - build of taglib now requires utfcpp. Patch for build of this is part of this patch set. - Changelog 2.0.1 (Apr 9, 2024) * Fix aborting when _GLIBCXX_ASSERTIONS are enabled. * Fall back to utf8cpp header detection in the case that its CMake configuration is removed. * Improve compatibility with the SWIG interface compiler. * Build system fixes for testing without bindings, Emscripten and Illumos. * C bindings: Fix setting UTF-8 encoded property values. * Windows: Fix opening long paths. 2.0 (Jan 24, 2024) * New major version, binary incompatible, but mostly source-compatible with the latest 1.x release if no deprecated features are used. Simple applications should build without changes, more complex applications (e.g. extending classes of TagLib) will have to be adapted. * Requires a C++17 compiler and uses features of C++17. * Major code cleanup, fixed warnings issued by compilers and static analyzers. * Made methods virtual which should have been virtual but could not be changed to keep binary compatibility, remove related workarounds. * Removed deprecated functions: - APE::Item::Item(const String &, const String &) - APE::Item::toStringList(): Use values() - APE::Item::value(): Use binaryData() - ASF::Properties::setLength() - ByteVector::checksum() - ByteVector::isNull(): Use isEmpty() - ByteVector::null - FLAC::File::setID3v2FrameFactory() - FLAC::File::streamInfoData() - FLAC::File::streamLength() - FLAC::Properties::Properties(File *, ReadStyle) - FLAC::Properties::sampleWidth(): Use bitsPerSample() - File::isReadable(): Use system functions - File::isWritable(): Use system functions - FileName::str() - FileRef::create(): Use constructor - MP4::Tag::itemListMap(): Use itemMap() - MPC::File::remove(): Use strip() - MPC::Properties::Properties(const ByteVector &, long, ReadStyle) - MPEG::File::save(int, ...): Use overload - MPEG::File::setID3v2FrameFactory(): Use constructor - MPEG::ID3v2::Frame::Header::Header(const ByteVector &, bool) - MPEG::ID3v2::Frame::Header::frameAlterPreservation(): Use fileAlterPreservation() - MPEG::ID3v2::Frame::Header::setData(const ByteVector &, bool) - MPEG::ID3v2::Frame::Header::size(unsigned int): Use size() - MPEG::ID3v2::Frame::Header::unsycronisation(): use unsynchronisation() - MPEG::ID3v2::Frame::checkEncoding(const StringList &, String::Type): Use checkTextEncoding(const StringList &, String::Type) - MPEG::ID3v2::Frame::headerSize(): Use Header::size() - MPEG::ID3v2::Frame::headerSize(unsigned int): Use Header::size(unsigned int) - MPEG::ID3v2::FrameFactory::createFrame(const ByteVector &, bool) - MPEG::ID3v2::FrameFactory::createFrame(const ByteVector &, unsigned int): Use createFrame(const ByteVector &, const Header *) - MPEG::ID3v2::RelativeVolumeFrame::channelType() - MPEG::ID3v2::RelativeVolumeFrame::peakVolume(): Use peakVolume(ChannelType) - MPEG::ID3v2::RelativeVolumeFrame::setChannelType() - MPEG::ID3v2::RelativeVolumeFrame::setPeakVolume(const PeakVolume &): Use setPeakVolume(const PeakVolume &, ChannelType) - MPEG::ID3v2::RelativeVolumeFrame::setVolumeAdjustment(float): Use setVolumeAdjustment(float, ChannelType) - MPEG::ID3v2::RelativeVolumeFrame::setVolumeAdjustmentIndex(short): Use setVolumeAdjustmentIndex(short, ChannelType) - MPEG::ID3v2::RelativeVolumeFrame::volumeAdjustment(): Use volumeAdjustment(ChannelType) - MPEG::ID3v2::RelativeVolumeFrame::volumeAdjustmentIndex(): Use volumeAdjustmentIndex(ChannelType) - MPEG::ID3v2::Tag::footer() - MPEG::ID3v2::Tag::render(int): Use render(Version) - MPEG::XingHeader::xingHeaderOffset() - Ogg::Page::getCopyWithNewPageSequenceNumber() - Ogg::XiphComment::removeField(): Use removeFields() - PropertyMap::unsupportedData(): Returns now const reference, use addUnsupportedData() to add keys - RIFF::AIFF::Properties::Properties(const ByteVector &, ReadStyle) - RIFF::AIFF::Properties::Properties(const ByteVector &, int, ReadStyle) - RIFF::AIFF::Properties::sampleWidth(): Use bitsPerSample() - RIFF::WAV::File::save(TagTypes, bool, int): Use save(TagTypes, StripTags, Version) - RIFF::WAV::File::tag(): Returns now a TagUnion, use ID3v2Tag() to get an ID3v2::Tag - String::isNull(): Use isEmpty() - String::null - TrueAudio::File::setID3v2FrameFactory(): Use constructor - WavPack::Properties::Properties(const ByteVector &, long, ReadStyle) * Made methods const: Frame::Header::size(), Frame::headerSize(), MP4::Atom::findall(), MP4::Atoms::find(), MP4::Atoms::path(). * Made classes non-virtual: APE::Footer, APE::Item, ASF::Attribute, ASF::Picture, MP4::CoverArt, MP4::Item, ID3v2::ExtendedHeader, ID3v2::Footer, ID3v2::Header, MPEG::Header, MPEG::XingHeader, Ogg::Page, Ogg::PageHeader. * Removed type definitions in TagLib namespace: wchar, uchar, ushort, uint, ulong, ulonglong, wstring: Use the standard types. * Removed include file taglib_config.h and its defines TAGLIB_WITH_ASF, TAGLIB_WITH_MP4: They were always 1 since version 1.8. * Behavioral changes: - The basic tag methods (e.g. genre()) separate multiple values with " / " instead of " ". - The stream operator for String uses UTF-8 instead of ISO-8859-1 encoding. - MP4 property ORIGINALDATE is mapped to "----:com.apple.iTunes:ORIGINALDATE" instead of "----:com.apple.iTunes:originaldate". - MP4 property ENCODEDBY is mapped to "©enc" instead of "©too", which is now mapped to ENCODING. * Unified interface for complex properties like pictures. * Simplified the unified properties interface by providing its methods on FileRef. * C bindings: Support for properties (taglib_property_...) and complex properties like cover art (taglib_complex_property_...), memory I/O streams. * Support for Direct Stream Digital (DSD) stream files (DSF) and interchange file format (DSDIFF, DFF), ADTS (AAC) files. * The runtime version can be queried. * Additional utility functions ByteVector::fromUShort(), ByteVector::fromULongLong(), ByteVector::toULongLong(), ByteVector::toULongLong(), List::sort(). * Fixed List::setAutoDelete() affecting implicitly shared copies. * Build system: Direct support for CMake, find_package(TagLib) exports target TagLib::tag. * Build system: Fixed PackageConfig to support both relative and absolute paths. * Build system: utf8cpp is no longer included, it can be provided via a system package or a Git submodule. * ASF: Support additional properties ARTISTWEBPAGE, ENCODING, ENCODINGTIME, FILEWEBPAGE, INITIALKEY, ORIGINALALBUM, ORIGINALARTIST, ORIGINALFILENAME, ORIGINALLYRICIST. * ID3v2: Fixed extensibility of FrameFactory, use it also for WAV and AIFF files. * MP4: Support additional properties OWNER, RELEASEDATE. * MP4: Introduced ItemFactory allowing clients to support new atom types. * MP4: Detect duration from mvhd atom if not present in mdhd atom. * MP4: Fixed type of hdvd atom to be integer instead of boolean. * MP4: Tolerate trailing garbage in M4A files. * MPC: Fixed content check in presence of an ID3v2 tag. * MPEG: Do not scan full file for ID3v2 tag when ReadStyle Fast is used. * RIFF: Support properties ALBUM, ARRANGER, ARTIST, ARTISTWEBPAGE, BPM, COMMENT, COMPOSER, COPYRIGHT, DATE, DISCSUBTITLE, ENCODEDBY, ENCODING, ENCODINGTIME, GENRE, ISRC, LABEL, LANGUAGE, LYRICIST, MEDIA, PERFORMER, RELEASECOUNTRY, REMIXER, TITLE, TRACKNUMBER. * WAV: Fixed crash with files having the "id3 " chunk as the only valid chunk. * Windows: Fixed support for files larger than 2GB. 1.13.1 (Jul 1, 2023) * Fixed parsing of TXXX frames without description. * Detect MP4 atoms with invalid length or type. * Do not miss ID3v2 frames when an extended header is present. * Use property "DISCSUBTITLE" for ID3v2 "TSST" frame. * Build system improvements: Use absolute path for macOS dylib install name, support --define-prefix when using pkg-config, fixed minimum required CppUnit version. * Code clean up using clang-tidy. 1.13 (Oct 27, 2022) * Added interface StreamTypeResolver to support streams which cannot be fopen()'ed, e.g. network files. * Added MP4::File::strip() to remove meta atom from MP4 file. * Added Map::value() to look up without creating entry. * Use property "WORK" instead of "CONTENTGROUP" for ID3v2 "TIT1" frame, use property "WORK" for ASF "WM/ContentGroupDescription", use property "COMPILATION" for ID3v2 "TCMP" frame. * Build system improvements: option WITH_ZLIB, BUILD_TESTING instead of BUILD_TESTS, GNUInstallDirs, FeatureSummary, tests with BUILD_SHARED_LIBS, cross compilation with Buildroot, systems without HAVE_GCC_ATOMIC, Clang. * Fixed heap-buffer-overflows when handling ASF, APE, FLAC, ID3v2, MP4, MPC tags. * Fixed detection of invalid file by extension when correct type can be detected by contents. * Fixed unnecessary creation of map entries in APE and FLAC tags if looked up tag does not exist. * Fixed parsing of MP4 non-full meta atoms. * Fixed potential ID3v1 false positive in the presence of an APE tag. * Fixed ID3v2 version handling for frames embedded in CHAP or CTOC frames. * Fixed parsing of multiple strings with a single BOM in ID3v2.4.0. * Fixed several smaller issues reported by clang-tidy. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:14:10 +00:00
Adolf Belka	c4239ab570	hplip: Update to version 3.23.12 ... - Update from version 3.23.5 to 3.23.12 - Update of rootfile - Changelog 3.23.12 Added support for the following new Printers: HP OfficeJet Pro 9130b series HP OfficeJet Pro 9120b series HP OfficeJet Pro 9110b series HP Color LaserJet Enterprise Flow MFP X58045z HP Color LaserJet Enterprise Flow MFP X58045zs HP Color LaserJet Enterprise MFP X58045dn  HP Color LaserJet Enterprise MFP X58045 HP LaserJet Pro P1106 plus HP LaserJet Pro P1108 plus 3.23.8 Added support for following new Distro's: OpenSuse 15.5 Fedora 38 Ubuntu 23.04 Added support for the following new Printers: HP Color LaserJet Pro MFP 4301dwe HP Color LaserJet Pro MFP 4301fdne HP Color LaserJet Pro MFP 4301fdwe HP Color LaserJet Pro MFP 4301cdwe HP Color LaserJet Pro MFP 4301cfdne HP Color LaserJet Pro MFP 4301cfdwe HP Color LaserJet Pro MFP 4302dwe HP Color LaserJet Pro MFP 4302fdne HP Color LaserJet Pro MFP 4302fdwe HP Color LaserJet Pro MFP 4302cdwe HP Color LaserJet Pro MFP 4302fdn HP Color LaserJet Pro MFP 4302fdw HP Color LaserJet Pro MFP 4303dw HP Color LaserJet Pro MFP 4303fdn HP Color LaserJet Pro MFP 4303fdw HP Color LaserJet Pro MFP 4303cdw HP Color LaserJet Pro MFP 4303cfdn HP Color LaserJet Pro MFP 4303cfdw HP Color LaserJet Pro 4201dne HP Color LaserJet Pro 4201dwe HP Color LaserJet Pro 4201cdne HP Color LaserJet Pro 4201cdwe HP Color LaserJet Pro 4202dne HP Color LaserJet Pro 4202dwe HP Color LaserJet Pro 4202dn HP Color LaserJet Pro 4202dw HP Color LaserJet Pro 4203dn HP Color LaserJet Pro 4203dw HP Color LaserJet Pro 4203cdn HP Color LaserJet Pro 4203cdw HP DeskJet 2800 All-in-One Printer series HP DeskJet 2800e All-in-One Printer series HP DeskJet Ink Advantage 2800 All-in-One Printer series HP DeskJet 4200 All-in-One Printer series HP DeskJet 4200e All-in-One Printer series HP DeskJet Ink Advantage 4200 All-in-One Printer series HP DeskJet Ink Advantage Ultra 4900 All-in-One Printer series Known issues: 1. USB print feature is not working properly with FW version 6.17.X.X for HP Color LaserJet Pro MFP 4303 devices 2. An I/O error is observed when attempting to add a HP Color LaserJet Pro MFP 4303series device via wireless option. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:07:58 +00:00
Adolf Belka	c79f4a9a47	libid3tag: Update to version 0.16.3 ... - Update from version 0.15.1b to 0.16.3 - Update of rootfile - A new fork has been made of the libid3tag. This is now being managed by Tenacity. The latest version has a library change so that any package using the old version will work with the new one. - Changelog 0.16.3 This release fixes backwards compatibility issues with libid3tag 0.15.1b. #8 - Define a separate library soversion, which is set to 0 to preserve ABI compatibility. Note: no functionality was changed in this release. This and the previous release are identical in terms of functionality. Compatibility With the changes listed above, libid3tag is both source compatible and binary (ABI) compatible with programs linked against libid3tag 0.15.1b. We will continue to guarantee this compatibility for as long as we can. Existing libid3tag 0.15.1b packages can be easily switched to this version without breakage. Reporting Issues or Contributing Patches Our version of libid3tag contains all kinds of integrated packages plus our own tweaks. However, if you have a patch or two that haven't been integrated into our fork yet, please feel free to open a pull request. Just like Tenacity, we aim to have libid3tag packaged and working on as many platforms as we can without patches. 0.16.2 Fix null pointer dereference in id3_ucs4_length (CVE-2017-11550) 0.16.1 Fix exported CMake config file Fix pkgconfig file name to match Linux distro packages (id3tag instead of libid3tag). 0.16.0 Add CMake build system Remove autotools build system Install pkgconfig and CMake config files Apply patches from Debian, Fedora, Arch, and Gentoo Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:07:19 +00:00
Arne Fitzenreiter	46d0ccd3b3	samba: update riscv64 rootfile ... Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-06-24 13:18:09 +02:00
Arne Fitzenreiter	9f1c036293	samba: update aarch64 rootfile ... Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-06-14 14:26:55 +02:00
Adolf Belka	98278fef4c	nut: Update to version 2.8.2 ... - Update from version 2.8.1 to 2.8.2 - Update of rootfile - Changelog 2.8.2 - Fix fallout of development in NUT v2.8.0 and/or v2.8.1: * dstate machinery: a segmentation fault (null pointer dereference) was possible with `INSTCMD` processing of commands without parameters nor `TRACKING` identifier. [#2155] * USB bus number detection for libusb-1.0 builds was overly zealous and wrongly considered zero values as an error. [#2198] * `upsmon` recognition of `CAL` state could linger after the calibration activity was completed by the hardware, which led to mis-processing of shutdown triggers. Also, notification was added to report "finished calibration". [issue #2168, PR #2169] * `upsmon` recognition of `OFF` state as a trigger for FSD (forced shut down) criticality considered also the input line state, which may be an independently evolving circumstance. [issue #2278, PR #2279] * `upsmon` support for `POLLFAIL_LOG_THROTTLE_MAX` did not neuter the applied setting when live-reloading configuration, so commenting it away in `upsmon.conf` did not have the effect of resetting the logging frequency to default. It also did not reset the counters to certainly follow the new configuration for existing faults. [issue #2207, PR #2209] * `upsmon` support for `POLLFAIL_LOG_THROTTLE_MAX` had an off-by-one error (e.g. reporting "Data stale" or "Driver not connected" every 30 sec with `POLLFAIL_LOG_THROTTLE_MAX 5` and `POLLFREQ 5` settings). [#2207] * Drivers running with non-default user account (e.g. with `user=root` in their configuration) failed to apply group ownership and permissions to their Unix socket file for interaction with the local data server. [#2185, #2096] * Dispatcher script `scripts/python/app/NUT-Monitor` referenced `py3qt3` instead of the correct `py3qt5`. It also tries to check both `py2gtk2` and `py3qt5` implementations verbosely, even if one is not installed. [#2199, #2201] * Set the `DesktopFileName` in `scripts/python/app/NUT-Monitor-py3qt5`, this binds the application with the desktop file and allow the Open Desktop compatible implementation to display the proper icon and application name. [#2205] * Original recipe for `apc_modbus` strictly required USB support even if building NUT without it. [#2262] * Builds requested with a specific C/C++ language standard revision via `CFLAGS` and `CXXFLAGS` should again be honoured. [PR #2306] * Allow requesting detailed debug builds (with disabled optimizations for binaries to best match the source code) for supported compilers using `configure` script option `--with-debuginfo`. Note that default autoconf behavior usually embeds moderate optimizations and debug information on its own. [PR #2310] * A fix applied among clean-ups between NUT v2.7.4 and v2.8.0 releases backfired for `usbhid-ups` subdriver `belkin-hid` which in practice relied on the broken older behavior; more details in its entry below. [PR #2371] - nut-usbinfo.pl, nut-scanner and libnutscan: * Library API version for `libnutscan` was bumped from 2.2.0 to 2.5.0 during evolution of this NUT release. * USB VendorID:ProductID support list files generated by the script for different OS frameworks now include a comment with other possibly compatible driver names, where the respective file format allows for comments. * Added the concept of `alt_driver_names` in `nutscan_device_t` structure for ability to suggest a comment with other possibly compatible driver names in configuration snippets generated by `nut-scanner`; practical support implemented for USB connected drivers. * Added the concept of commented-away suggested option values `comment_tag` and a method to `nutscan_add_commented_option_to_device()`, instead of hacks in prepared config data which broke some use-cases. [#2221] * Command-line option `-U` for USB scan can now be specified several times to increase the detail level about hardware link to the device (this was previously always suggested, but may be not reliable if USB enumeration gets changed over time). [#2221] * Added generation of FreeBSD/pfSense quirks for USB devices supported by NUT (may get installed to `$datadir` e.g. `/usr/local/share/nut` and need to be pasted into your `/boot/loader.conf.local`). [#2159] * nut-scanner now avoids creating ambiguous `nutdevN` device section names when called separately to scan different media buses (one at a time). Now the "bus" name would be embedded (e.g. non-colliding `nutdev-usb1` and `nutdev-snmp1`). [#2247] * nut-scanner can now discover NUT simulated devices (`.dev` and `.seq` files) located in your sysconfig directory, and prepare configuration sections with the simulation driver (currently `dummy-ups`). [#2246] * nut-scanner now reports `dummy-ups` as driver when scanning NUT "bus" with Old or Avahi method. [#2236, #2245] - upsd: Fixed conditions for "no listening interface available" diagnosis to check how many listeners we succeeded with, not whether the first one succeeded or not. If not all requested (non-localhost) listeners were available, default to fail the daemon start-up attempt; support for an `ALLOW_NOT_ALL_LISTENERS` setting was added to control this behavior. [#723] - NUT CI improvements: * Added publishing recipes for PyNUT client bindings for NUT, so it ends up in the link:https://pypi.org/project/PyNUTClient[PyPI repository]. [#2158] * Added support for new `ccache` namespace concept, where possible. [#2256] * Fixed an issue for builds configured `--without-usb`. [#2263] * Added a fallback for `libgd` discovery (for CGI etc. builds). [#2287] * Made `aspell` TeX module detection more reliable. [#2206] * Fixed recipes for completely out-of-tree builds to pass with documentation generation and checking on all tested "make" implementations. [#2318] * Various other recipe and documentation clean-up efforts. [#2284, #2269, #2261] - main driver core codebase: * Help users of drivers that can be built to support optionally USB and other media (like `nutdrv_qx` built for serial-only support), and built in fact without USB support but used for USB devices, with some more information to make troubleshooting easier. [issue #2259, PR #2260] * Driver programs with debug tracing support via `-D` CLI option and/or the `NUT_DEBUG_LEVEL` environment variable now check those earlier in their life-time, so that initialization routine can be debugged. [#2259] * Multiple USB-capable drivers got options to customize `usb_config_index` `usb_hid_rep_index`, `usb_hid_desc_index`, `usb_hid_ep_in` and `usb_hid_ep_out` hardware connection settings via `ups.conf` options. This is treated as experimental, not all code paths may be actually using such values from `struct usb_communication_subdriver_t` rather than hard-coded defaults. Discovery of correct values is up to the user at the moment (using `lsusb`, internet search, luck...) [#2149] - nut-driver-enumerator (NDE) service/script: * The optional daemon mode (primarily useful for systems which monitor a large and dynamic population of power devices) was enhanced with a `--daemon-after` variant which parses the configuration once before daemonization and this has a chance to fail while not forked off, as well as to allow only completing the service unit initialization when everything is actually ready to work (so further dependencies can start at the proper time). [#682] * Also applied other optimizations to the script implementation. [#682] - powerpanel text driver now handles status responses in any format and should support most devices. [#2156] - tripplite_usb driver now allows any device to match if a particular Unit ID was not specified in `ups.conf`. [PR #2297, issues #2282 and #2258] - snmp-ups driver: * added support for Eaton EMP002 sensor for ATS16 NM2 sub-driver. [#2286] * mapping table updates for apc-mib sub-driver. [#2264] - usbhid-ups driver: * `arduino-hid` subdriver was enhanced from "initial bare bones" experimental set of mapped data points to support some 20 more mappings to make it more useful as an UPS driver, not just a controller developer sandbox. [#2188] * `cps-hid` subdriver now supports devices branded as Cyber Energy and built by cooperation with Cyber Power Systems. [#2312] * `belkin-hid` subdriver now supports Liebert PSI5 devices which have a different numeric reading scale than earlier handled models. [issue #2271, PR #2272, PR #2369] Generally the wrong-scale processing was addressed, including a regression in NUT v2.8.0 which led to zero values in voltage data points which NUT v2.7.4 reported well [#2371] * The `onlinedischarge` configuration flag name was too ambiguous and got deprecated (will be supported but no longer promoted by documentation), introducing `onlinedischarge_onbattery` as the meaningful alias. [#2213] * Logged notifications about `OL+DISCHRG` state should now be throttled (see the driver manual page for more details) [#2214, #2215]: - If `battery.charge` is available, make the message when entering the state and then only if the charge differs from that when we posted the earlier message (e.g. really discharging) and is under `onlinedischarge_log_throttle_hovercharge` value (defaults to 100%); - Also can throttle to a time frequency configurable by a new option `onlinedischarge_log_throttle_sec`, by default 30 sec if `battery.charge` is not reported by the device (should be frequent by default, in case the UPS-reported state combination does reflect a bad power condition). - nutdrv_qx driver: * Fixed handling of `battery_voltage_reports_one_pack` configuration flag introduced in NUT v2.8.1. [originally by PR #1279; fixed by PR #2324, issue #2325] - Various code and documentation fixes for NSS crypto support. [#2274, #2268] - Laid foundations for the SmartNUT effort (aiming to integrate drivers with some other backends than the networked NUT data server process). - Eaton contributed recipes and scripts used to create the IPP for Unix bundle (aka Eaton IPSS Unix or UPP), a freely available value-added packaging of NUT distributed as the UPS software companion for OSes where their more complex UPS monitoring/management tools had not been ported. This allows for delivery of NUT packages with an interactive installer and some system integration scripts (events, notifications, status, shutdown daemon...), and was contributed to the NUT upstream project by Eaton -- provided "as is" at the moment, and may later serve as foundation or inspiration for new NUT features. [#2288] - nutconf (C++ library and tool to read and manage NUT configuration files) was started in the open by Eaton employees and used in the IPP installer, but the code lingered in a side branch. It was now brushed up to our common best practices and added to the main codebase. As of this import, there are known deficiencies in Windows platform support, as well as some un-awareness about configuration key words which appeared in NUT since 2013. [#2290] - The `tools/gitlog2changelog.py.in` script was revised, in particular to convert section titles (with contributor names coming from Git metadata) into plain ASCII character set, for `dblatex` versions which do not allow diacritics and other kinds of non-trivial characters in sections. This can cause successful builds of `ChangeLog.pdf` file on more platforms, but at expense of a semi-cosmetic difference in those names. [PR #2360, PR #2366] Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-06-04 15:07:20 +02:00
Adolf Belka	a03adc928e	postfix: Update to version 3.9.0 ... - Update from version 3.8.4 to 3.9.0 - Update of rootfile - With version 3.9.0 the option smtpd_forbid_bare_newline default value is now yes. With previous versions the default value was no but to prevent the possibility of an smtp smuggling attack the option should be yes. Previous version therefore actively set the value to yes and added it to the main.cf file when being installed. With version 3.9.0 the default value is now yes so the option no longer needs to be added into main.cf, so smtp smuggling attack is protected by default now. - Removed the section from the install.sh file that added the option into main.cf with version 3.8.4. From 3.9.0 onwards the default value is yes so no longer needs to be actively added into main.cf - Changelog is too large to paste here. It can be read in the file RELEASE_NOTES in the source tarball. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-06-04 15:06:34 +02:00
Adolf Belka	ed562f8dde	samba: Update to version 4.20.1 ... - This v2 version increments the PAK_VER number - Update from version 4.19.5 to 4.20.1 - Update of rootfile - Changelog 4.20.1 * BUG 15630: dns update debug message is too noisy. * BUG 15635: Do not fail PAC validation for RFC8009 checksums types. * BUG 15605: Improve performance of lookup_groupmem() in idmap_ad. * BUG 15636: Smbcacls incorrectly propagates inheritance with Inherit-Only flag. * BUG 15611: http library doesn't support 'chunked transfer encoding'. * BUG 15600: Provide a systemd service file for the background queue daemon. 4.20.0 The changelog is too large to show here. Details can be found at https://www.samba.org/samba/history/samba-4.20.0.html I did not identify any changes related to how samba is configured in IPFire 4.19.6 * BUG 15527: fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(). * BUG 15588: samba-gpupdate: Correctly implement site support. * BUG 15527: fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(). * BUG 15588: samba-gpupdate: Correctly implement site support. * BUG 15599: libgpo: Segfault in python bindings. * BUG 15580: Packet marshalling push support missing for CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and CTDB_CONTROL_TCP_CLIENT_PASSED. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-06-04 15:05:17 +02:00
Arne Fitzenreiter	c2955d0127	mympd: update to 15.0.1 ... Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-05-19 10:02:10 +02:00
Adolf Belka	d3ea3e932f	bacula: Update to version 13.0.4 ... - Update from version 11.0.6 to 13.0.4 - Update of rootfile - Version 13.x has now been released for 12 months so updating the File Daemon to 13.x should be good. - Version 11.x was released 40 months ago. - Changelog The changes are all related to the Director and the Storage Daemon. The changelog states that older file daemons "should" be compatible with 13.x DIR & SD. This change ensures IPfire "is" compatible with the 13.x DIR & SD. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-05-07 05:51:18 +00:00
Arne Fitzenreiter	1ce6219703	lynis: update rootfile ... Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-04-28 21:04:02 +00:00
Adolf Belka	ea7dd6822c	icinga: Removal of icinga addon ... - As discussed in the Dev conf call on 2024-Jan-08 - The 1.x version of Icinga has been EOL since 2018 - The 2.x version would require a complete new configuration approach as the settings and options are completely different to 1.x and so would be a start from scratch. - removal of icinga from make.sh file - removal of lfs file - removal of rootfile - removal of configuration file - removal of backup includes file Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Acked-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-04-19 06:07:02 +00:00
Adolf Belka	4ed125ae66	sslh: Removal of sslh addon ... - As discussed in the Dev conf call on 2024-Apr-08 - sslh has not been functioning since last update ion Sep 2021. Configuration syntax was radically changed somewhere in the update from 1.7a(2013) to 1.22c in Sep 2021 - removal of sslh from make file - removal of lfs file - removal of rootfile - removal of paks files - removal of initscript Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-04-19 06:06:37 +00:00
Arne Fitzenreiter	77bae935e6	cpufrequtils: remove cpufrequtils ... the only file in the package is now the initskript to configre powersave mode using cpupower which is shipped with the kernel. Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-03-20 17:49:27 +01:00
Michael Tremer	5552f51de0	wsdd: Remove dropped initscript ... Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-03-19 11:14:42 +00:00
Adolf Belka	1887a63d26	sdl2: Update to version 2.30.1 ... - Update from version 2.28.5 to 2.30.1 - Update of rootfile - Changelog 2.30.1 Fixed a regression causing SDL_WaitEvent() to return spurious failures Fixed X11 cursors on the latest release of GNOME Wayland windows automatically have OpenGL enabled again Fixed memory corruption when converting signed 16-bit audio to float Fixed audio artifacts when converting signed 8-bit audio to float Fixed the clip rectangle not being updated when the viewport changes in the SDL renderer Convert mouse wheel coordinates to the rendering view in the SDL renderer Fixed a crash handling controllers on macOS Fixed a crash setting a window fullscreen with Emscripten Fixed the keyboard automatically popping up when resuming an application on Android 2.30.0 In addition to lots of bug fixes, here are the major changes in this release: General: Added support for 2 bits-per-pixel indexed surface formats Added the function SDL_GameControllerGetSteamHandle() to get the Steam API handle for a controller, if available Added the event SDL_CONTROLLERSTEAMHANDLEUPDATED which is sent when the Steam API handle for a controller changes. This could also change the name, VID, and PID of the controller. Added the environment variable SDL_LOGGING to control default log output macOS: Added the hint SDL_HINT_JOYSTICK_IOKIT to control whether the IOKit controller driver should be used Added the hint SDL_HINT_JOYSTICK_MFI to control whether the GCController controller driver should be used Added the hint SDL_HINT_RENDER_METAL_PREFER_LOW_POWER_DEVICE to choose whether high or low power GPU should be used for rendering, in the case where there are multiple GPUs available Xbox: Added the function SDL_GDKGetDefaultUser() Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-03-14 14:10:49 +00:00
Adolf Belka	c3152d5eda	opus: Update to version 1.5.1 ... - Update from version 1.4 to 1.5.1 - Update of rootfile - Changelog 1.5.1 Opus 1.5.1 fixes the meson build that was broken in 1.5. 1.5 Opus 1.5 is the first release to make extended use of ML in the encoder and decoder. You can read all the details in the release demo page. In summary, major changes since 1.4 include: Significant improvement to packet loss robustness using Deep Redundancy (DRED) Improved packet loss concealment through Deep PLC Low-bitrate speech quality enhancement down to 6 kb/s wideband Improved x86 (AVX2) and Arm (Neon) optimizations Support for 4th and 5th order ambisonics In addition to the improvements above, this release includes many minor bug fixes. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-03-14 14:09:02 +00:00
Michael Tremer	860515b21c	Remove excess newlines in rootfiles ... Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-03-12 10:15:49 +00:00
Adolf Belka	bb6d3ed8cf	libplist: Update to version 2.4.0 ... - Update from version 2.3.0 to 2.4.0 - Update of rootfile - Changelog 2.4.0 - Changes: * Add a PLIST_OPT_NONE value to plist_write_options_t * autoconf: Allow disabling build of test suite * Update doxygen config and document undocumented macros * Add an explicit PLIST_FORMAT_NONE value * Add a libplist_version() function to the interface * docs: Use README.md to generate mainpage with doxygen - Bugfixes: * Several compiler-related fixes and code improvements * Plug memory leak in plist_write_to_stream() * Prevent adding NULL items to array/dictionary nodes * Fix parallel running of test suite * Fix cython bindings * Fix OOB read in plist_from_memory() Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-03-12 10:12:58 +00:00
Adolf Belka	d3b0d3a99c	ghostscript: Update to version 10.03.0 ... - Update from version 10.02.1 to 10.03.0 - Update of rootfile - Changelog 10.03.0 Highlights in this release include: A vulnerability was identified in the way Ghostscript/GhostPDL called tesseract for the OCR devices, which could allow arbitrary code execution. As as result, we strongly urge anyone including the OCR devices in their build to update as soon as possible. As of this release (10.03.0) pdfwrite creates PDF files with XRef streams and ObjStm streams. This can result in considerably smaller PDF output files. See Vector Devices for more details. Ghostscript/pdfwrite now supports passing through PDF "Optional Content". Our efforts in code hygiene and maintainability continue. The usual round of bug fixes, compatibility changes, and incremental improvements. (9.53.0) We have added the capability to build with the Tesseract OCR engine. In such a build, new devices are available (pdfocr8/pdfocr24/pdfocr32) which render the output file to an image, OCR that image, and output the image "wrapped" up as a PDF file, with the OCR generated text information included as "invisible" text (in PDF terms, text rendering mode 3). Mainly due to time constraints, we only support including Tesseract from source included in our release packages, and not linking to Tesseract/Leptonica shared libraries. Whether we add this capability will be largely dependent on community demand for the feature. See Enabling OCR for more details. Incompatible changes (10.03.0) Almost all the "internal" PostScript procedures defined during the interpreter startup are now "executeonly", further reducing the attack surface of the interpreter. The nature of these procedures means there should be no impact for legitimate usage, but it is possible it will impact uses which abuse the previous accessibility (even for legitimate reasons). Such cases may now require "DELAYBIND", See DELAYBIND (10.03.0) The "makeimagedevice" non-standard operator has been removed. It allowed low level access to the graphics library in a way that was, essentially impossible to secure. (10.03.0) The "putdeviceprops", "getdeviceprops", "finddevice", "copydevice", "findprotodevice" non-standard operators have all been removed. They provided functionality that is either accessible through standard operators, or should not be used by user PostScript. (10.03.0) The process of "tidying" the PostScript namespace should have removed only non-standard and undocumented operators. Nevertheless, it is possible that any integrations or utilities that rely on those non-standard and undocumented operators may stop working or may change behaviour. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-03-12 10:12:22 +00:00
Robin Roevens	bff53f09ff	zabbix_agentd: Add OpenVPN certificates items ... - Adds Zabbix Agent userparameters `ipfire.ovpn.clientcert` and `ipfire.ovpn.cacert` for the agent to get details about openvpn client, server and ca certificates. - Moves all `ipfire.ovpn.*` userparameters to a separate config file `userparameter_ovpn.conf` to enable users to selectively disable openvpn items when not needed - Includes `ipfire_certificate_detail.sh` script in sudoers for Zabbix Agent as it needs root permission to read openvpn certificate details. - Adapts lfs install script to install new script and configfile - Adds new script and configfile to rootfiles Reviewed-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-02-29 10:26:11 +00:00
Adolf Belka	1087370d52	git: Update to version 2.44.0 ... - Update from version 2.43.0 to 2.44.0 - Update of rootfile - Changelog is too large to include here. See the files 2.43.1.txt, 2.43.2.txt, 2.43.3.txt & 2.44.0.txt in the source tarball in directory Documentation/RelNotes Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-02-29 10:21:40 +00:00
Michael Tremer	bed265cc5a	Merge remote-tracking branch 'ms/wsdd' into next	2024-02-28 16:44:06 +00:00
Arne Fitzenreiter	e3a8147c67	libmpdclient: update to 2.22 ... Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-02-25 02:03:24 +01:00
Arne Fitzenreiter	3de42257d0	mpd: move scripts and config from mpfire to mpd ... this allows to use mpd without mpfire installed. Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-02-24 16:39:59 +01:00
Arne Fitzenreiter	a4f29a5347	transmission: add menuentry to transmission webgui ... Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-02-11 13:33:39 +01:00
Arne Fitzenreiter	761e73230f	mympd: update to 14.0.1 ... Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-02-11 11:27:48 +01:00
Arne Fitzenreiter	394405b1dd	vdr: add menu entry for vdr website ... we had discussed this on december telco but it is not so easy because our menusystem only shows entry's existing cgi's. so i add a cgi redirect to http://$ENV{SERVER_ADDR}:3000 this add the entry under pakfire and also to service page. Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-02-10 12:00:18 +00:00
Matthias Fischer	bb25f15cf9	clamav: Update to 1.3.0 ... For details see: https://blog.clamav.net/2023/11/clamav-130-122-105-released.html Excerpts from changelog: "Major changes Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled using one of the following options: a. The clamscan command line option: --scan-onenote=no, b. The clamd.conf config option: ScanOneNote no, c. The libclamav scan option options.parse &= ~CL_SCAN_PARSE_ONENOTE;, d. A signature change to the daily.cfg dynamic configuration (DCONF). Other improvements Fixed issue when building ClamAV on the Haiku (BeOS-like) operating system. Patch courtesy of Luca D'Amico ClamD: When starting, ClamD will now check if the directory specified by TemporaryDirectory in clamd.conf exists. If it doesn't, ClamD will print an error message and will exit with exit code 1. Patch courtesy of Andrew Kiggins. CMake: If configured to build static libraries, CMake will now also install the libclamav_rust, libclammspack, libclamunrar_iface, and libclamunrar static libraries required by libclamav. Note: These libraries are all linked into the clamscan, clamd, sigtool, and freshclam programs, which is why they did not need to be installed to function. However, these libraries would be required if you wish to build some other program that uses the libclamav static library. Added file type recognition for compiled Python (`.pyc`) files. The file type appears as a string parameter for these callback functions: - clcb_pre_cache - clcb_pre_scan - clcb_file_inspection When scanning a `.pyc` file, the `type` parameter will now show "CL_TYPE_PYTHON_COMPILED" instead of "CL_TYPE_BINARY_DATA". Improved support for decrypting PDFs with empty passwords. Assorted minor improvements and typo fixes. Bug fixes Fixed a warning when scanning some HTML files. Fixed an issue decrypting some PDF's with an empty password. ClamOnAcc: Fixed an infinite loop when a watched directory does not exist. ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan. Patch courtesy of gsuehiro. Fixed a possible crash when processing VBA files on HP-UX/IA 64bit. Patch courtesy of Albert Chin-A-Young. ClamConf: Fixed an issue printing `MaxScanSize` introduced with the change to allow a `MaxScanSize` greater than 4 GB. Fix courtesy of teoberi. Fixed an issue building a ClamAV RPM in some configurations. The issue was caused by faulty CMake logic that intended to create an empty database directory during the installation." Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Reviewed-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-02-10 11:52:39 +00:00
Adolf Belka	816af4dfb7	elfutils: Move from addon to core program. Required by suricata-7.0.2 for execution ... - Updated lfs file to core program type - Moved rootfile from packages to common - Older suricata versions required elfutils only for building but suricata-7.0.2 fails to start if elfutils is not present due to libelf.so.1 being missing. - The requirement for elfutils is not mentioned at all in the changelog. Fixes: Bug#13516 Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-02-07 10:55:34 +00:00
Arne Fitzenreiter	437bfd6780	vdr_streamdev: update to 0.6.3 ... Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-02-05 11:07:03 +01:00
Arne Fitzenreiter	6179f056da	vdr_epgsearch: update to 2.4.2 ... Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-02-05 11:06:29 +01:00