sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

[SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (a314f2579dfd06d92041211c7e76286235052bb6)

From: Vlad Glagolev <scm AT sourcemage.org>
To: sm-commit AT lists.ibiblio.org
Subject: [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (a314f2579dfd06d92041211c7e76286235052bb6)
Date: Wed, 23 Dec 2015 15:44:53 +0000

GIT changes to stable-0.62 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

crypto/ca-certificates/DETAILS | 4
crypto/ca-certificates/HISTORY | 3
crypto/cyrus-sasl/BUILD | 8
crypto/cyrus-sasl/CONFIGURE | 20 +
crypto/cyrus-sasl/DEPENDS | 11 -
crypto/cyrus-sasl/DETAILS | 28 +-
crypto/cyrus-sasl/FINAL | 2
crypto/cyrus-sasl/HISTORY | 18 +
crypto/cyrus-sasl/PRE_BUILD | 6
crypto/cyrus-sasl/cve-2013-4122.patch | 116
+++++++++++
crypto/cyrus-sasl/db5.patch | 24 --
crypto/cyrus-sasl/imap-logout.patch | 48 ++++
crypto/cyrus-sasl/imap-loop.patch | 89 ++++++++
crypto/cyrus-sasl/init.d/saslauthd | 2
crypto/cyrus-sasl/init.d/saslauthd.conf | 3
crypto/cyrus-sasl/ldapdb-buffer.patch | 10
crypto/cyrus-sasl/size_t.patch | 12 +
crypto/nss/DETAILS | 4
crypto/nss/HISTORY | 3
crypto/nss/PREPARE | 4
crypto/nss/PRE_BUILD | 4
crypto/nss/PRE_SUB_DEPENDS | 1
crypto/nss/SUB_DEPENDS | 3
crypto/openssh/DETAILS | 4
crypto/openssh/HISTORY | 6
crypto/openssl/DETAILS | 8
crypto/openssl/HISTORY | 16 +
gnome2-libs/librsvg2/DEPENDS | 2
gnome2-libs/librsvg2/HISTORY | 3
http/firefox/DEPENDS | 2
http/firefox/DETAILS | 6
http/firefox/HISTORY | 7
kernels/linux/HISTORY | 13 +
kernels/linux/info/kernels/4.1 | 5
kernels/linux/info/patches/maintenance_patches_4/patch-4.0.5 | 5
kernels/linux/info/patches/maintenance_patches_4/patch-4.1 | 5
kernels/linux/info/patches/maintenance_patches_4/patch-4.1.1 | 5
kernels/linux/latest.defaults | 4
libs/glibc/DEPENDS | 1
libs/glibc/HISTORY | 3
libs/tzdata/DETAILS | 2
libs/tzdata/HISTORY | 3
net/monit/DETAILS | 5
net/monit/HISTORY | 10
net/monit/PRE_BUILD | 4
net/monit/timeout.patch | 20 -
printer/cups/DETAILS | 6
printer/cups/HISTORY | 4
python-pypi/pillow/BUILD | 3
python-pypi/pillow/HISTORY | 3
security/wireshark/DETAILS | 6
security/wireshark/HISTORY | 3
utils/ntp/DETAILS | 6
utils/ntp/HISTORY | 4
54 files changed, 487 insertions(+), 110 deletions(-)

New commits:
commit a314f2579dfd06d92041211c7e76286235052bb6
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

openssl: => 1.0.2e (1.0), 0.9.8zh (0.9)

commit c622a4131ddc4ca537895a28ad6407fd6671ac77
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

openssl: => 1.0.2d

(cherry picked from commit 4e9eb651a600435fa118a1a4a7beaba1dc368546)

commit 22f820eb8a9cee8dc02bc751408118a124d4a0c5
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

crypto/openssl: version 1.0.1p, security update

(cherry picked from commit a379d960e6953c6864930f65692b7d87715a9f3b)

commit e906202f951b21dd94dde276a94c31d3baa0f3ba
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

openssl 1.0.1o

(cherry picked from commit 4160377d095d6c0fef3218db0e85b97bde649cf6)

commit 3a7485fb233b1f3733e57fcd0de03af18e6839a9
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

cyrus-sasl: extended init script by adding custom arguments variable

(cherry picked from commit 8849febc10574ca42d2c30f0945f07352586d9cf)

commit a7ce162ff38704a39842cd35bfe41307475b0bcf
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

cyrus-sasl: => 2.1.26 [security]

(cherry picked from commit bad4e383a9d3ac851559bf58aa141413da045d32)

commit c2f25f6ad7086c73f2b6df41bb92a6d2660c87a9
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

firefox 39.0, SECURITY_PATCH=86

(cherry picked from commit 29311abeaa45c0a46bf8d9de7f85417885d6c493)

commit fb593a0297967f313de817d3d1611cfceac07134
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

nss 3.19.2

(cherry picked from commit dc5a14b798faab12a3eab23c9f4e80d3955ff72e)

commit d17a4b6dc383e871c3763ea95b56dfe6c339b39e
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

openssh 6.9p1, SECURITY_PATCH=8

(cherry picked from commit f6ea530cc389098e68bd7d168c94c0b6fd075ce2)

commit bc5afb5a6b18f97708b4983618390f7263af9bf4
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

openssh 6.8p1

(cherry picked from commit 76433f3095b9f8c6597a92e4c48065f47ce47b48)

commit fc5747209136ca2fcae394daeac1be5ffb5fbfcd
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

linux 4.1.1

(cherry picked from commit c412e5699c6cc76c297e8481063d860f59ec285a)

commit 4c46d661b0ad4eee9dddec5c915c1b6ca2b321d0
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

monit: => 5.13

(cherry picked from commit 051de82ce4f3f997269978c5d5429038bb5da125)

commit 272f6e8992946b0addc30656e5a95488c59a723b
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

monit: => 5.12.2

(cherry picked from commit 0522f9168365ccaba659fc5e70dee713da1f1358)

commit 34b8553160e4391e56906a962fa710c33cb1b780
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

monit: => 5.12

(cherry picked from commit e89a5e2e8c549a4b3cf5784f0e3a8d5f943d5285)

commit e41d0ba0fe8bd82455361faea1da68f6e9aef2e1
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

linux 4.1.0

(cherry picked from commit 6559e9cbcdc6cb4591822c47fe2262806d28b769)

commit fa548f4131bfeceb38f411639d15bef31a2e8a0a
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

librsvg2 - not depend atk, expat

(cherry picked from commit fe4c618df11c5ede5944d845d88784286ab3aee2)

commit 42951e770085d9ae7c9e47750c59b3f6148d9ffa
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

wireshark 1.12.6, SECURITY_PATCH=54

(cherry picked from commit 5024edfec992fecb5ea836058fe16a890fe2b84b)

Conflicts:
security/wireshark/HISTORY

commit a5af27de099d6768d0d32fdbbbbdaa9161fb424b
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

ca-certificates: => 20150426

(cherry picked from commit 8067be12cd16d779e0f5ee9b165931f0115d3eac)

commit f9f1905f62b03b9842376cd2963d57c19a7e806f
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

openssl 0.9.8zg, 1.0.1n, SECURITY_PATCH++

(cherry picked from commit d9cf696d032031f9969f4a67ec383e45f95eec33)

commit 69d30c3b16638b0cdaf5dae33b88b101169ef4a8
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

cups-2.0.3 SECURITY FIX

(cherry picked from commit 55448bc01680ffe03c30ab276746c0cd2d554649)

commit 86a867a5de2e71f21cc582a57e350d9178ff86db
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

linux 4.0.5

(cherry picked from commit d050a581707ca79b0cc827c70f65fdba9b98ce2c)

Conflicts:
kernels/linux/HISTORY

commit b51f4600b0b9552d9b0b165694728ed302e78f2d
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

glibc: added missing required dependency -- binutils

(cherry picked from commit 0d08ef02837d832d0744aba293d78ae1eae46398)

commit a29a3d66ce6b374d19cb2d4c6c46485459be5e28
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

tzdata: => 2015d

(cherry picked from commit a25eb0ce6ec909f90b00482bd910b6a3a4719707)

commit bbec53b22c91764e6058f4b2d791f1fc632e3051
Author: Pavel Vinogradov <public AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

http/firefox: version 38.0.5

(cherry picked from commit 197c3e39188e43c5c5d8c78e16a26d814e083490)

commit a307207aeefbf2cc4a8b4fd6e2945bc4b22ba282
Author: Ismael Luceno <ismael AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

ntp 4.2.8p2, SECURITY_PATCH++

(cherry picked from commit 7ffae34fd252d263ee08bf324d597cd63133d3b9)

commit 75dc93c612571d8e80bb944fbadb752031d1cd17
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

pillow: fixed build with system zlib

(cherry picked from commit 87da0cb80f0fd5154cb3aec86e5e3ea6b18454ab)

diff --git a/crypto/ca-certificates/DETAILS b/crypto/ca-certificates/DETAILS
index 64fb887..e0f84ff 100755
--- a/crypto/ca-certificates/DETAILS
+++ b/crypto/ca-certificates/DETAILS
@@ -1,7 +1,7 @@
SPELL=ca-certificates
- VERSION=20141019
+ VERSION=20150426
SECURITY_PATCH=1
-
SOURCE_HASH=sha512:8ffa2693c9cdf7153cc39d46224a806887422285ca5b5ad31a59eb59c3796b024f93180933b5d9b714c484e292c99ef1eeae99a275b448859f93a67adbb17d41
+
SOURCE_HASH=sha512:dc8827c683fce01dba10d9e52f7bb49c1386f68b0a641a658c071efc5ea185ae7646110d4a56b21a3b53ff74f48c26e7d595464f2a4e6588c98746e21891543a
SOURCE=${SPELL}_${VERSION}_all.deb
SOURCE_URL[0]=http://ftp.de.debian.org/debian/pool/main/c/$SPELL/$SOURCE
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL"
diff --git a/crypto/ca-certificates/HISTORY b/crypto/ca-certificates/HISTORY
index 130b9aa..d89f1b6 100644
--- a/crypto/ca-certificates/HISTORY
+++ b/crypto/ca-certificates/HISTORY
@@ -1,3 +1,6 @@
+2015-06-17 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: version 20150426
+
2014-10-31 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 20141019

diff --git a/crypto/cyrus-sasl/BUILD b/crypto/cyrus-sasl/BUILD
index 49df187..dedf6d4 100755
--- a/crypto/cyrus-sasl/BUILD
+++ b/crypto/cyrus-sasl/BUILD
@@ -10,17 +10,17 @@ OPTS="$OPTS \
$CS_PLAIN \
$CS_LOGIN \
$CS_CRAM \
+ $CS_SCRAM \
$CS_DIGEST \
$CS_OTP \
$CS_SRP \
+ $CS_PASSDSS \
$CS_ANON \
$CS_NTLM \
$CS_APOP \
- --disable-sample \
-"
+ --enable-static \
+ --disable-sample" &&

-sedit 's|extern sasl_global_callbacks_t global_callbacks;||g'
lib/saslint.h &&
-sedit 's|^$sasl_global_callbacks_t\s\+global_callbacks;$|static \1|g'
lib/server.c &&
make_single &&
default_build &&

diff --git a/crypto/cyrus-sasl/CONFIGURE b/crypto/cyrus-sasl/CONFIGURE
index bc24be8c..9148322 100755
--- a/crypto/cyrus-sasl/CONFIGURE
+++ b/crypto/cyrus-sasl/CONFIGURE
@@ -1,15 +1,15 @@
message "Cyrus-SASL supports lots of authentication mechanisms, devided into
3 main categories:" &&
-message "plaintext (LOGIN, PLAIN), shared secret (DIGEST-MD5, CRAM-MD5) and
Kerberos (KERBEROS_V4, GSSAPI)" &&
+message "password verification (LOGIN, PLAIN), shared secret (DIGEST-MD5,
CRAM-MD5) and Kerberos (KERBEROS_V4, GSSAPI)" &&
message "To avoid getting lost in configuring SASL, please choose *only* the
mechanisms" &&
message "you are actually planning to use." &&
-config_query CS_PLAINTEXT "Enable plaintext mechanisms?" n &&
-config_query CS_SHARED "Enable shared secret mechanisms?" n &&
+config_query CS_PLAINTEXT "Enable password verification (plaintext)
mechanisms?" y &&
+config_query CS_SHARED "Enable shared secret mechanisms?" y &&
config_query CS_KERBEROS "Enable kerberos mechanisms?" n &&

# Some lonely options, doesn't fit with anything else
-config_query_option CS_ANON "Enable ANONYMOUS authentication? (you really
don't want this)" n "--enable-anon" "--disable-anon" &&
+config_query_option CS_ANON "Enable ANONYMOUS authentication? (you really
don't want this)" y "--enable-anon" "--disable-anon" &&
config_query_option CS_NTLM "Enable NTLM authentication? (unsupported)" n
"--enable-ntlm" "--disable-ntlm" &&
-config_query_option CS_APOP "Enable APOP authentication?" n
"--enable-checkapop" "--disable-checkapop" &&
+config_query_option CS_APOP "Enable APOP authentication?" y
"--enable-checkapop" "--disable-checkapop" &&

if [ "$CS_PLAINTEXT" == "n" ] && [ "$CS_SHARED" == "n" ] && [ "$CS_KERBEROS"
== "n" ]; then
message "You didn't select any authentication mechanism!" &&
@@ -37,14 +37,16 @@ persistent_add CS_MECH &&

if [ "$CS_PLAINTEXT" == "y" ]; then
message "Plaintext by itself is not secure for obvious reasons," &&
- message " but it can be usefull in combination with something like TLS" &&
+ message "but it can be useful in combination with something like TLS" &&
config_query_option CS_PLAIN "Enable PLAIN authentication?" y
"--enable-plain" "--disable-plain" &&
config_query_option CS_LOGIN "Enable LOGIN authentication? (unsupported)"
n "--enable-login" "--disable-login"
elif [ "$CS_SHARED" == "y" ]; then
- config_query_option CS_CRAM "Enable CRAM-MD5 authentication?" n
"--enable-cram" "--disable-cram" &&
- config_query_option CS_DIGEST "Enable DIGEST-MD5 authentication?" n
"--enable-digest" "--disable-digest" &&
+ config_query_option CS_CRAM "Enable CRAM-MD5 authentication?" y
"--enable-cram" "--disable-cram" &&
+ config_query_option CS_SCRAM "Enable SCRAM authentication?" y
"--enable-scram" "--disable-scram" &&
+ config_query_option CS_DIGEST "Enable DIGEST-MD5 authentication?" y
"--enable-digest" "--disable-digest" &&
config_query_option CS_OTP "Enable One-Time-Password authentication?" y
"--enable-otp" "--disable-otp" &&
- config_query_option CS_SRP "Enable SRP authentication?" y "--enable-srp"
"--disable-srp"
+ config_query_option CS_SRP "Enable SRP authentication?" n "--enable-srp"
"--disable-srp" &&
+ config_query_option CS_PASSDSS "Enable PASSDSS authentication
(${PROBLEM_COLOR}experimental${QUERY_COLOR})?" n "--enable-passdss"
"--disable-passdss"
elif [ "$CS_KERBEROS" == "y" ]; then
true
# deferred until DEPENDS to let sorcery manage options
diff --git a/crypto/cyrus-sasl/DEPENDS b/crypto/cyrus-sasl/DEPENDS
index 66f2dec..454b982 100755
--- a/crypto/cyrus-sasl/DEPENDS
+++ b/crypto/cyrus-sasl/DEPENDS
@@ -2,13 +2,17 @@ depends automake &&
depends autoconf &&
depends e2fsprogs &&
depends groff &&
-depends libmcrypt &&

optional_depends SSL \
"--with-openssl=$INSTALL_ROOT/usr" \
'--without-openssl' \
'for OpenSSL' &&

+optional_depends JDK \
+ "--enable-java --with-javabase=$INSTALL_ROOT/usr/lib/j2sdk"
\
+ "--disable-java" \
+ "to compile Java support" &&
+
if [[ "$CS_KERBEROS" == 'y' ]]; then
optional_depends krb5 \
"--enable-gssapi=$INSTALL_ROOT/usr" \
@@ -35,6 +39,11 @@ if [[ "$CS_MECH" =~ 'auxprop' ]]; then
gdbm) depends gdbm '--with-dblib=gdbm' ;;
esac &&

+ optional_depends openldap \
+ "--with-ldap=$INSTALL_ROOT/usr --enable-ldapdb" \
+ "--without-ldap --disable-ldapdb" \
+ "auxprop LDAP backend" &&
+
optional_depends sqlite \
"--enable-sql --with-sqlite3=$INSTALL_ROOT/usr"\
'--without-sqlite3' \
diff --git a/crypto/cyrus-sasl/DETAILS b/crypto/cyrus-sasl/DETAILS
index d1d1c7a..1faee6b 100755
--- a/crypto/cyrus-sasl/DETAILS
+++ b/crypto/cyrus-sasl/DETAILS
@@ -1,16 +1,14 @@
SPELL=cyrus-sasl
- VERSION=2.1.25
- SECURITY_PATCH=1
+ VERSION=2.1.26
+ SECURITY_PATCH=2
SOURCE=$SPELL-$VERSION.tar.gz
- SOURCE2=$SOURCE.sig
+ SOURCE_URL[0]=ftp://ftp.cyrusimap.org/$SPELL/$SOURCE
+ SOURCE_URL[1]=ftp://ftp.cyrusimap.org/$SPELL/OLD-VERSIONS/$SOURCE
+
SOURCE_HASH=sha512:78819cb9bb38bea4537d6770d309deeeef09ff44a67526177609d3e1257ff4334d2b5e5131d5a1e4dea7430d8db1918ea9d171f0dee38b5e8337f4b72ed068f0
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
- SOURCE_URL[0]=ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/$SOURCE
-
SOURCE_URL[1]=ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/OLD-VERSIONS/sasl/$SOURCE
- SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
- SOURCE_GPG=6581B5F1.gpg:$SOURCE2:UPSTREAM_KEY
- SOURCE2_IGNORE=signature
+ DOCS="doc/*.txt doc/*.html doc/TODO"
LICENSE[0]=BSD
- WEB_SITE=http://cyrusimap.web.cmu.edu/
+ WEB_SITE=https://cyrusimap.org/
ENTERED=20020717
SHORT="Cyrus SASL (RFC 2222) Library"
cat << EOF
@@ -19,11 +17,13 @@ side to provide authentication. See RFC 2222 for more
information.
The following mechanisms are included in this distribution:
* ANONYMOUS
* CRAM-MD5
+* DIGEST-MD5
+* EXTERNAL
+* GSSAPI (MIT Kerberos 5, Heimdal Kerberos 5 or CyberSafe)
* KERBEROS_V4
+* LOGIN
+* NTLM (requires OpenSSL libcrypto)
+* OTP (requires OpenSSL libcrypto)
* PLAIN
-* CRAM-MD5 (deprecated)
-* GSSAPI (MIT Kerberos 5 or Heimdal Kerberos 5)
-* DIGEST-MD5
-* LOGIN (unsupported)
-* SRP (unsupported, may not work)
+* SRP (work in progress; requires OpenSSL libcrypto)
EOF
diff --git a/crypto/cyrus-sasl/FINAL b/crypto/cyrus-sasl/FINAL
index abc0084..3158b2c 100755
--- a/crypto/cyrus-sasl/FINAL
+++ b/crypto/cyrus-sasl/FINAL
@@ -1,3 +1,3 @@
-if [ -f $INSTALL_ROOT/etc/sysconfig/saslauthd ] && echo $OPTS | grep -q --
'--with-pam'; then
+if [ -f $INSTALL_ROOT/etc/sysconfig/saslauthd ] && is_depends_enabled $SPELL
linux-pam; then
sedit "s:shadow:pam:" $INSTALL_ROOT/etc/sysconfig/saslauthd
fi
diff --git a/crypto/cyrus-sasl/HISTORY b/crypto/cyrus-sasl/HISTORY
index 88c3fcc..18f458e 100644
--- a/crypto/cyrus-sasl/HISTORY
+++ b/crypto/cyrus-sasl/HISTORY
@@ -1,3 +1,21 @@
+2015-07-06 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 2.1.26; gpg -> hash; SECURITY_PATCH++;
+ updated long desc; updated source urls
+ * BUILD: dropped dirty hacks; enable static libs
+ * DEPENDS: dropped senseless libmcrypt dependency; added Java support;
+ add auxprop LDAP support
+ * CONFIGURE: fixed defaults as per upstream definition; added SCRAM
and
+ PASSDSS authentication support; corrected a typo; rephrased
+ description -- plaintext -> password verification as per official
docs
+ * FINAL: more accurate dependency check
+ * PRE_BUILD: apply patches
+ * size_t.patch, imap-loop.patch: backported patches from Gentoo
+ (#458790, #510320)
+ * imap-logout.patch, ldapdb-buffer.patch: backported patches from
Debian
+ * cve-2013-4122.patch: added, to fix CVE-2013-4122
+ * db5.patch: dropped, fixed by upstream
+ * init.d/saslauthd{,.conf}: added SASLAUTHD_ARGS
+
2014-10-24 Vlad Glagolev <stealth AT sourcemage.org>
* DEPENDS: use SSL provider

diff --git a/crypto/cyrus-sasl/PRE_BUILD b/crypto/cyrus-sasl/PRE_BUILD
index fc26314..2112b7e 100755
--- a/crypto/cyrus-sasl/PRE_BUILD
+++ b/crypto/cyrus-sasl/PRE_BUILD
@@ -1,5 +1,9 @@
default_pre_build &&
cd "$SOURCE_DIRECTORY" &&

+patch -p1 < $SPELL_DIRECTORY/cve-2013-4122.patch &&
+patch -p1 < $SPELL_DIRECTORY/imap-logout.patch &&
+patch -p1 < $SPELL_DIRECTORY/ldapdb-buffer.patch &&
+patch -p0 < $SPELL_DIRECTORY/imap-loop.patch &&
+patch -p0 < $SPELL_DIRECTORY/size_t.patch &&
patch -p0 < $SPELL_DIRECTORY/sqlite.patch
-patch -p1 < "$SPELL_DIRECTORY/db5.patch"
diff --git a/crypto/cyrus-sasl/cve-2013-4122.patch
b/crypto/cyrus-sasl/cve-2013-4122.patch
new file mode 100644
index 0000000..09c9ce8
--- /dev/null
+++ b/crypto/cyrus-sasl/cve-2013-4122.patch
@@ -0,0 +1,116 @@
+From dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d Mon Sep 17 00:00:00 2001
+From: mancha <mancha1 AT hush.com>
+Date: Thu, 11 Jul 2013 09:08:07 +0000
+Subject: Handle NULL returns from glibc 2.17+ crypt()
+
+Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL
+(w/ NULL return) if the salt violates specifications. Additionally,
+on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords
+passed to crypt() fail with EPERM (w/ NULL return).
+
+When using glibc's crypt(), check return value to avoid a possible
+NULL pointer dereference.
+
+Patch by mancha1 AT hush.com.
+---
+diff --git a/pwcheck/pwcheck_getpwnam.c b/pwcheck/pwcheck_getpwnam.c
+index 4b34222..400289c 100644
+--- a/pwcheck/pwcheck_getpwnam.c
++++ b/pwcheck/pwcheck_getpwnam.c
+@@ -32,6 +32,7 @@ char *userid;
+ char *password;
+ {
+ char* r;
++ char* crpt_passwd;
+ struct passwd *pwd;
+
+ pwd = getpwnam(userid);
+@@ -41,7 +42,7 @@ char *password;
+ else if (pwd->pw_passwd[0] == '*') {
+ r = "Account disabled";
+ }
+- else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) {
++ else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) ||
strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) {
+ r = "Incorrect password";
+ }
+ else {
+diff --git a/pwcheck/pwcheck_getspnam.c b/pwcheck/pwcheck_getspnam.c
+index 2b11286..6d607bb 100644
+--- a/pwcheck/pwcheck_getspnam.c
++++ b/pwcheck/pwcheck_getspnam.c
+@@ -32,13 +32,15 @@ char *userid;
+ char *password;
+ {
+ struct spwd *pwd;
++ char *crpt_passwd;
+
+ pwd = getspnam(userid);
+ if (!pwd) {
+ return "Userid not found";
+ }
+
+- if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) {
++ crpt_passwd = crypt(password, pwd->sp_pwdp);
++ if (!crpt_passwd || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) !=
0) {
+ return "Incorrect password";
+ }
+ else {
+diff --git a/saslauthd/auth_getpwent.c b/saslauthd/auth_getpwent.c
+index fc8029d..d4ebe54 100644
+--- a/saslauthd/auth_getpwent.c
++++ b/saslauthd/auth_getpwent.c
+@@ -77,6 +77,7 @@ auth_getpwent (
+ {
+ /* VARIABLES */
+ struct passwd *pw; /* pointer to passwd file
entry */
++ char *crpt_passwd; /* encrypted password */
+ int errnum;
+ /* END VARIABLES */
+
+@@ -105,7 +106,8 @@ auth_getpwent (
+ }
+ }
+
+- if (strcmp(pw->pw_passwd, (const char *)crypt(password,
pw->pw_passwd))) {
++ crpt_passwd = crypt(password, pw->pw_passwd);
++ if (!crpt_passwd || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) {
+ if (flags & VERBOSE) {
+ syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password",
login);
+ }
+diff --git a/saslauthd/auth_shadow.c b/saslauthd/auth_shadow.c
+index 677131b..1988afd 100644
+--- a/saslauthd/auth_shadow.c
++++ b/saslauthd/auth_shadow.c
+@@ -210,8 +210,8 @@ auth_shadow (
+ RETURN("NO Insufficient permission to access NIS authentication
database (saslauthd)");
+ }
+
+- cpw = strdup((const char *)crypt(password, sp->sp_pwdp));
+- if (strcmp(sp->sp_pwdp, cpw)) {
++ cpw = crypt(password, sp->sp_pwdp);
++ if (!cpw || strcmp(sp->sp_pwdp, (const char *)cpw)) {
+ if (flags & VERBOSE) {
+ /*
+ * This _should_ reveal the SHADOW_PW_LOCKED prefix to an
+@@ -221,10 +221,8 @@ auth_shadow (
+ syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'",
+ sp->sp_pwdp, cpw);
+ }
+- free(cpw);
+ RETURN("NO Incorrect password");
+ }
+- free(cpw);
+
+ /*
+ * The following fields will be set to -1 if:
+@@ -286,7 +284,7 @@ auth_shadow (
+ RETURN("NO Invalid username");
+ }
+
+- if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) {
++ if (!(cpw = crypt(password, upw->upw_passwd)) ||
(strcmp(upw->upw_passwd, (const char *)cpw) != 0)) {
+ if (flags & VERBOSE) {
+ syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s",
+ password, upw->upw_passwd);
+--
+cgit v0.9.0.2
diff --git a/crypto/cyrus-sasl/db5.patch b/crypto/cyrus-sasl/db5.patch
deleted file mode 100644
index 5228240..0000000
--- a/crypto/cyrus-sasl/db5.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-Author: Ondřej Surý <ondrej AT debian.org>
-Description: Support newer Berkeley DB versions
---- a/sasldb/db_berkeley.c
-+++ b/sasldb/db_berkeley.c
-@@ -101,7 +101,7 @@ static int berkeleydb_open(const sasl_ut
- ret = db_create(mbdb, NULL, 0);
- if (ret == 0 && *mbdb != NULL)
- {
--#if DB_VERSION_MAJOR == 4 && DB_VERSION_MINOR >= 1
-+#if (DB_VERSION_MAJOR > 4) || ((DB_VERSION_MAJOR == 4) && (DB_VERSION_MINOR
>= 1))
- ret = (*mbdb)->open(*mbdb, NULL, path, NULL, DB_HASH, flags, 0660);
- #else
- ret = (*mbdb)->open(*mbdb, path, NULL, DB_HASH, flags, 0660);
---- a/utils/dbconverter-2.c
-+++ b/utils/dbconverter-2.c
-@@ -214,7 +214,7 @@ static int berkeleydb_open(const char *p
- ret = db_create(mbdb, NULL, 0);
- if (ret == 0 && *mbdb != NULL)
- {
--#if DB_VERSION_MAJOR == 4 && DB_VERSION_MINOR >= 1
-+#if (DB_VERSION_MAJOR > 4) || ((DB_VERSION_MAJOR == 4) && (DB_VERSION_MINOR
>= 1))
- ret = (*mbdb)->open(*mbdb, NULL, path, NULL, DB_HASH, DB_CREATE,
0664);
- #else
- ret = (*mbdb)->open(*mbdb, path, NULL, DB_HASH, DB_CREATE, 0664);
diff --git a/crypto/cyrus-sasl/imap-logout.patch
b/crypto/cyrus-sasl/imap-logout.patch
new file mode 100644
index 0000000..d8b4b6e
--- /dev/null
+++ b/crypto/cyrus-sasl/imap-logout.patch
@@ -0,0 +1,48 @@
+--- cyrus-sasl2.orig/saslauthd/auth_rimap.c
++++ cyrus-sasl2/saslauthd/auth_rimap.c
+@@ -90,6 +90,7 @@ static struct addrinfo *ai = NULL; /* re
+ service we connect to. */
+ #define TAG "saslauthd" /* IMAP command tag */
+ #define LOGIN_CMD (TAG " LOGIN ") /* IMAP login command (with tag) */
++#define LOGOUT_CMD (TAG " LOGOUT ") /* IMAP logout command (with tag)*/
+ #define NETWORK_IO_TIMEOUT 30 /* network I/O timeout (seconds) */
+ #define RESP_LEN 1000 /* size of read response buffer */
+
+@@ -307,10 +308,12 @@ auth_rimap (
+ int s=-1; /* socket to remote auth host
*/
+ struct addrinfo *r; /* remote socket address info
*/
+ struct iovec iov[5]; /* for sending LOGIN command */
++ struct iovec iov2[2]; /* for sending LOGOUT command */
+ char *qlogin; /* pointer to "quoted" login */
+ char *qpass; /* pointer to "quoted" password */
+ char *c; /* scratch pointer */
+ int rc; /* return code scratch area */
++ int rcl; /* return code scratch area */
+ char rbuf[RESP_LEN]; /* response read buffer */
+ char hbuf[NI_MAXHOST], pbuf[NI_MAXSERV];
+ int saved_errno;
+@@ -505,6 +508,24 @@ auth_rimap (
+ }
+ }
+ }
++
++ /* close remote imap */
++ iov2[0].iov_base = LOGOUT_CMD;
++ iov2[0].iov_len = sizeof(LOGOUT_CMD) - 1;
++ iov2[1].iov_base = "\r\n";
++ iov2[1].iov_len = sizeof("\r\n") - 1;
++
++ if (flags & VERBOSE) {
++ syslog(LOG_DEBUG, "auth_rimap: sending %s%s %s",
++ LOGOUT_CMD, qlogin, qpass);
++ }
++ alarm(NETWORK_IO_TIMEOUT);
++ rcl = retry_writev(s, iov2, 2);
++ alarm(0);
++ if (rcl == -1) {
++ syslog(LOG_WARNING, "auth_rimap: writev logout: %m");
++ }
++
+ (void) close(s); /* we're done with the remote */
+ if (rc == -1) {
+ syslog(LOG_WARNING, "auth_rimap: read (response): %m");
diff --git a/crypto/cyrus-sasl/imap-loop.patch
b/crypto/cyrus-sasl/imap-loop.patch
new file mode 100644
index 0000000..4da6189
--- /dev/null
+++ b/crypto/cyrus-sasl/imap-loop.patch
@@ -0,0 +1,89 @@
+--- saslauthd/auth_rimap.c 2012-10-12 14:05:48.000000000 +0000
++++ saslauthd/auth_rimap.c 2014-05-15 05:23:02.000000000 +0000
+@@ -371,7 +371,7 @@
+ if ( rc>0 ) {
+ /* check if there is more to read */
+ fd_set perm;
+- int fds, ret;
++ int fds, ret, loopc;
+ struct timeval timeout;
+
+ FD_ZERO(&perm);
+@@ -380,6 +380,7 @@
+
+ timeout.tv_sec = 1;
+ timeout.tv_usec = 0;
++ loopc = 0;
+ while( select (fds, &perm, NULL, NULL, &timeout ) >0 ) {
+ if ( FD_ISSET(s, &perm) ) {
+ ret = read(s, rbuf+rc, sizeof(rbuf)-rc);
+@@ -387,6 +388,14 @@
+ rc = ret;
+ break;
+ } else {
++ if (ret == 0) {
++ loopc += 1;
++ } else {
++ loopc = 0;
++ }
++ if (loopc > sizeof(rbuf)) { // arbitrary chosen value
++ break;
++ }
+ rc += ret;
+ }
+ }
+@@ -484,7 +493,7 @@
+ if ( rc>0 ) {
+ /* check if there is more to read */
+ fd_set perm;
+- int fds, ret;
++ int fds, ret, loopc;
+ struct timeval timeout;
+
+ FD_ZERO(&perm);
+@@ -493,6 +502,7 @@
+
+ timeout.tv_sec = 1;
+ timeout.tv_usec = 0;
++ loopc = 0;
+ while( select (fds, &perm, NULL, NULL, &timeout ) >0 ) {
+ if ( FD_ISSET(s, &perm) ) {
+ ret = read(s, rbuf+rc, sizeof(rbuf)-rc);
+@@ -500,6 +510,14 @@
+ rc = ret;
+ break;
+ } else {
++ if (ret == 0) {
++ loopc += 1;
++ } else {
++ loopc = 0;
++ }
++ if (loopc > sizeof(rbuf)) { // arbitrary chosen value
++ break;
++ }
+ rc += ret;
+ }
+ }
+--- lib/checkpw.c 2012-01-27 23:31:36.000000000 +0000
++++ lib/checkpw.c 2014-05-15 05:19:35.000000000 +0000
+@@ -587,16 +587,14 @@
+ /* Timeout. */
+ errno = ETIMEDOUT;
+ return -1;
+- case +1:
+- if (FD_ISSET(fd, &rfds)) {
+- /* Success, file descriptor is readable. */
+- return 0;
+- }
+- return -1;
+ case -1:
+ if (errno == EINTR || errno == EAGAIN)
+ continue;
+ default:
++ if (FD_ISSET(fd, &rfds)) {
++ /* Success, file descriptor is readable. */
++ return 0;
++ }
+ /* Error catch-all. */
+ return -1;
+ }
diff --git a/crypto/cyrus-sasl/init.d/saslauthd
b/crypto/cyrus-sasl/init.d/saslauthd
index 45edab0..0f9248d 100644
--- a/crypto/cyrus-sasl/init.d/saslauthd
+++ b/crypto/cyrus-sasl/init.d/saslauthd
@@ -3,7 +3,7 @@
. /etc/sysconfig/saslauthd

PROGRAM=/usr/sbin/saslauthd
-ARGS="-a $AUTH"
+ARGS="-a $AUTH $SASLAUTHD_ARGS"
RUNLEVEL=3
NEEDS="+remote_fs"

diff --git a/crypto/cyrus-sasl/init.d/saslauthd.conf
b/crypto/cyrus-sasl/init.d/saslauthd.conf
index f4f0b04..a890e28 100644
--- a/crypto/cyrus-sasl/init.d/saslauthd.conf
+++ b/crypto/cyrus-sasl/init.d/saslauthd.conf
@@ -1,2 +1,5 @@
# authentication mechanism to use
AUTH=shadow
+
+# for arguments and description see saslauthd(8)
+SASLAUTHD_ARGS=""
diff --git a/crypto/cyrus-sasl/ldapdb-buffer.patch
b/crypto/cyrus-sasl/ldapdb-buffer.patch
new file mode 100644
index 0000000..af38218
--- /dev/null
+++ b/crypto/cyrus-sasl/ldapdb-buffer.patch
@@ -0,0 +1,10 @@
+--- cyrus-sasl2.orig/plugins/ldapdb.c
++++ cyrus-sasl2/plugins/ldapdb.c
+@@ -406,6 +406,7 @@ ldapdb_canon_server(void *glob_context,
+ if ( len > out_max )
+ len = out_max;
+ memcpy(out, bvals[0]->bv_val, len);
++ out[len] = '\0';
+ *out_ulen = len;
+ ber_bvecfree(bvals);
+ }
diff --git a/crypto/cyrus-sasl/size_t.patch b/crypto/cyrus-sasl/size_t.patch
new file mode 100644
index 0000000..7f50ce6
--- /dev/null
+++ b/crypto/cyrus-sasl/size_t.patch
@@ -0,0 +1,12 @@
+--- include/sasl.h.orig 2012-10-12 17:05:48.000000000 +0300
++++ include/sasl.h 2013-02-23 16:56:44.648786268 +0200
+@@ -121,6 +121,9 @@
+ #ifndef SASL_H
+ #define SASL_H 1
+
++/* stddef.h to get size_t defined */
++#include <stddef.h>
++
+ /* Keep in sync with win32/common.mak */
+ #define SASL_VERSION_MAJOR 2
+ #define SASL_VERSION_MINOR 1
diff --git a/crypto/nss/DETAILS b/crypto/nss/DETAILS
index b4fcea7..f874fa6 100755
--- a/crypto/nss/DETAILS
+++ b/crypto/nss/DETAILS
@@ -23,6 +23,10 @@ case $NSS_BRANCH in
VERSION=3.18.1

SOURCE_HASH=sha512:00c2893b5aa74038661f7353ebc8200746de1757cec61072717a89ec10292040a1dd954aaf688fbcf68261031ec30e85e6fe9ab46283e202e8b62b06e05fa616
;;
+ 3.19)
+ VERSION=3.19.2
+
SOURCE_HASH=sha512:d3c45010f8dace58f9da9efe0f9792f8b8a69384e100663f33c949685cdd1ce70e5131f279bc82336622841c41dbc0a4d70a7cc6839a1782dbe8b3c3fd8bc59d
+ ;;
esac
SOURCE=$SPELL-$VERSION.tar.gz

SOURCE_URL[0]=http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_${VERSION//./_}_RTM/src/$SOURCE
diff --git a/crypto/nss/HISTORY b/crypto/nss/HISTORY
index 23cdb20..e411c39 100644
--- a/crypto/nss/HISTORY
+++ b/crypto/nss/HISTORY
@@ -1,3 +1,6 @@
+2015-07-03 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS, PREPARE, PRE_BUILD, PRE_SUB_DEPENDS, SUB_DEPENDS: version
3.19.2
+
2015-05-12 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 3.18.1

diff --git a/crypto/nss/PREPARE b/crypto/nss/PREPARE
index d2de368..0c79af8 100755
--- a/crypto/nss/PREPARE
+++ b/crypto/nss/PREPARE
@@ -1,5 +1,5 @@
-config_query_list NSS_BRANCH "Which branch of $SPELL do you want to build?"
DEFAULT 3.14 3.15 3.16 3.17 3.18 &&
+config_query_list NSS_BRANCH "Which branch of $SPELL do you want to build?"
DEFAULT 3.14 3.15 3.16 3.17 3.18 3.19 &&

if [[ -z "$NSS_BRANCH" ]] || [[ "$NSS_BRANCH" == "DEFAULT" ]]; then
- NSS_BRANCH=3.18
+ NSS_BRANCH=3.19
fi
diff --git a/crypto/nss/PRE_BUILD b/crypto/nss/PRE_BUILD
index 088795d..ea1f31b 100755
--- a/crypto/nss/PRE_BUILD
+++ b/crypto/nss/PRE_BUILD
@@ -1,7 +1,9 @@
default_pre_build &&
cd "$SOURCE_DIRECTORY" &&

-if [[ $NSS_BRANCH == "3.18" ]]; then
+if [[ $NSS_BRANCH == "3.19" ]]; then
+ patch -p1 < "$SPELL_DIRECTORY/nss-3.17.2-standalone-2.patch"
+elif [[ $NSS_BRANCH == "3.18" ]]; then
patch -p1 < "$SPELL_DIRECTORY/nss-3.17.2-standalone-2.patch"
elif [[ $NSS_BRANCH == "3.17" ]]; then
patch -p1 < "$SPELL_DIRECTORY/nss-3.17.2-standalone-2.patch"
diff --git a/crypto/nss/PRE_SUB_DEPENDS b/crypto/nss/PRE_SUB_DEPENDS
index 322b8f6..f7338f7 100755
--- a/crypto/nss/PRE_SUB_DEPENDS
+++ b/crypto/nss/PRE_SUB_DEPENDS
@@ -4,6 +4,7 @@ case $THIS_SUB_DEPENDS in
3.16.x) if [ $NSS_BRANCH == "3.16" ]; then return 0; fi;;
3.17.x) if [ $NSS_BRANCH == "3.17" ]; then return 0; fi;;
3.18.x) if [ $NSS_BRANCH == "3.18" ]; then return 0; fi;;
+ 3.19.x) if [ $NSS_BRANCH == "3.19" ]; then return 0; fi;;
PEM) if [ $NSS_PEM == "y" ]; then return 0; fi;;
esac
return 1
diff --git a/crypto/nss/SUB_DEPENDS b/crypto/nss/SUB_DEPENDS
index c68dd33..0af8933 100755
--- a/crypto/nss/SUB_DEPENDS
+++ b/crypto/nss/SUB_DEPENDS
@@ -14,6 +14,9 @@ case $THIS_SUB_DEPENDS in
3.18.x) message "${MESSAGE_COLOR}3.18.x release needed, forcing
it.${DEFAULT_COLOR}" &&
NSS_BRANCH="3.18"
;;
+ 3.19.x) message "${MESSAGE_COLOR}3.19.x release needed, forcing
it.${DEFAULT_COLOR}" &&
+ NSS_BRANCH="3.19"
+ ;;
PEM) message "${MESSAGE_COLOR}nss with PEM support needed, forcing
it.${DEFAULT_COLOR}" &&
NSS_PEM="y"
;;
diff --git a/crypto/openssh/DETAILS b/crypto/openssh/DETAILS
index 253255d..e685384 100755
--- a/crypto/openssh/DETAILS
+++ b/crypto/openssh/DETAILS
@@ -1,6 +1,6 @@
SPELL=openssh
- VERSION=6.7p1
- SECURITY_PATCH=7
+ VERSION=6.9p1
+ SECURITY_PATCH=8
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE2=$SOURCE.asc
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
diff --git a/crypto/openssh/HISTORY b/crypto/openssh/HISTORY
index d3704eb..e1f999c 100644
--- a/crypto/openssh/HISTORY
+++ b/crypto/openssh/HISTORY
@@ -1,3 +1,9 @@
+2015-07-01 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 6.9p1, SECURITY_PATCH=8
+
+2015-03-18 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 6.8p1
+
2014-12-12 Treeve Jelbert <treeve AT sourcemage.org>
* DEPENDS: remove obsolete tcp_wrappers

diff --git a/crypto/openssl/DETAILS b/crypto/openssl/DETAILS
index 278833f..61ff05b 100755
--- a/crypto/openssl/DETAILS
+++ b/crypto/openssl/DETAILS
@@ -6,12 +6,12 @@ fi

case $OPENSSL_BRANCH in
0.9)
- VERSION=0.9.8zf
- SECURITY_PATCH=25
+ VERSION=0.9.8zh
+ SECURITY_PATCH=27
;;
1.0)
- VERSION=1.0.1m
- SECURITY_PATCH=27
+ VERSION=1.0.2e
+ SECURITY_PATCH=30
;;
esac

diff --git a/crypto/openssl/HISTORY b/crypto/openssl/HISTORY
index b652fed..f37c6c2 100644
--- a/crypto/openssl/HISTORY
+++ b/crypto/openssl/HISTORY
@@ -1,3 +1,19 @@
+2015-12-23 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 1.0.2e (1.0), 0.9.8zh (0.9)
+
+2015-08-16 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: version 1.0.2d
+
+2015-07-09 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * DETAILS: version 1.0.1p, this fixes CVE-2015-1793
+
+2015-06-12 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 1.0.1o
+
+2015-06-11 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 0.9.8zg, 1.0.1n, SECURITY_PATCH++
+ https://www.openssl.org/news/secadv_20150611.txt
+
2015-03-19 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 0.9.8zf, 1.0.1m, SECURITY_PATCH++
https://www.openssl.org/news/secadv_20150319.txt
diff --git a/gnome2-libs/librsvg2/DEPENDS b/gnome2-libs/librsvg2/DEPENDS
index 9e68ab1..0c61c15 100755
--- a/gnome2-libs/librsvg2/DEPENDS
+++ b/gnome2-libs/librsvg2/DEPENDS
@@ -1,6 +1,4 @@
-depends atk &&
depends -sub PNG cairo &&
-depends expat &&
depends fontconfig &&
depends freetype2 &&
depends glib2 &&
diff --git a/gnome2-libs/librsvg2/HISTORY b/gnome2-libs/librsvg2/HISTORY
index 0495ac6..e96a9b8 100644
--- a/gnome2-libs/librsvg2/HISTORY
+++ b/gnome2-libs/librsvg2/HISTORY
@@ -1,3 +1,6 @@
+2015-06-21 Treeve Jelbert <treeve AT sourcemage.org>
+ * DEPENDS: delete atk, expat
+
2015-04-23 Vlad Glagolev <stealth AT sourcemage.org>
* DEPENDS: added a warning about vala dependency making
gobject-introspection non-optional
diff --git a/http/firefox/DEPENDS b/http/firefox/DEPENDS
index f532998..a96634f 100755
--- a/http/firefox/DEPENDS
+++ b/http/firefox/DEPENDS
@@ -23,7 +23,7 @@ depends -sub APNG libpng '--enable-system-png'
&&
depends librsvg2 '--enable-svg' &&

depends nspr '--with-system-nspr' &&
-depends -sub "3.18.x" nss '--with-system-nss' &&
+depends -sub "3.19.x" nss '--with-system-nss' &&

depends -sub "TSAFE SECURE_DELETE ENABLE_UNLOCK_NOTIFY" sqlite
'--enable-system-sqlite' &&

diff --git a/http/firefox/DETAILS b/http/firefox/DETAILS
index 797f63d..c818317 100755
--- a/http/firefox/DETAILS
+++ b/http/firefox/DETAILS
@@ -1,10 +1,10 @@
SPELL=firefox
- VERSION=38.0.1
+ VERSION=39.0
SOURCE=$SPELL-$VERSION.source.tar.bz2
-
SOURCE_HASH=sha512:e016093c008f118cf5f586d2bd6248b1b9d647d8faf2fbc3edaa827b665b4653cb0a92f5ba079e80d8ea4d65c819e3f76345561f5581081606d23f18623b3b61
+
SOURCE_HASH=sha512:963dbf48c077659edd49868e2e11600ba232a7cbf35e4acb20f10b878f2d2278e3d33c9eaa9272a07b7b6e2e565e4b40ebc269a128935ee4e044857c828dbc50

SOURCE_URL[0]=http://releases.mozilla.org/pub/mozilla.org/${SPELL}/releases/${VERSION}/source/${SOURCE}

SOURCE_URL[1]=ftp://ftp.mozilla.org/pub/$SPELL/releases/$VERSION/source/$SOURCE
- SECURITY_PATCH=85
+ SECURITY_PATCH=86
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
WEB_SITE=https://www.mozilla.org/en-US/firefox/fx/
GATHER_DOCS=off
diff --git a/http/firefox/HISTORY b/http/firefox/HISTORY
index f5681c3..8da0ab6 100644
--- a/http/firefox/HISTORY
+++ b/http/firefox/HISTORY
@@ -1,3 +1,10 @@
+2015-07-03 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 39.0, SECURITY_PATCH=86
+ * DEPENDS: nss 3.19.x is needed
+
+2015-06-02 Pavel Vinogradov <public AT sourcemage.org>
+ * DETAILS: updated spell to 38.0.5
+
2015-05-15 Pavel Vinogradov <public AT sourcemage.org>
* DETAILS: version 38.0.1, removed obsolete mirror

diff --git a/kernels/linux/HISTORY b/kernels/linux/HISTORY
index 5773c95..bd1d96e 100644
--- a/kernels/linux/HISTORY
+++ b/kernels/linux/HISTORY
@@ -1,3 +1,16 @@
+2015-06-30 Ladislav Hagara <hgr AT vabo.cz>
+ * latest.defaults: LATEST_maintenance_patches_4=4.1.1
+ * info/patches/maintenance_patches_4/patch-4.1.1: added
+
+2015-06-22 Ladislav Hagara <hgr AT vabo.cz>
+ * latest.defaults: LATEST_4=4.1,
LATEST_maintenance_patches_4=patch-4.1
+ * info/kernels/4.1: added
+ * info/patches/maintenance_patches_4/patch-4.1: added
+
+2015-06-07 Ladislav Hagara <hgr AT vabo.cz>
+ * latest.defaults: LATEST_maintenance_patches_4=4.0.5
+ * info/patches/maintenance_patches_4/patch-4.0.5: added
+
2015-05-18 Vlad Glagolev <stealth AT sourcemage.org>
* info/patches/maintenance_patches_3/patch-3.10.79: added
* info/patches/maintenance_patches_3/patch-3.14.43: added
diff --git a/kernels/linux/info/kernels/4.1 b/kernels/linux/info/kernels/4.1
new file mode 100755
index 0000000..40e139a
--- /dev/null
+++ b/kernels/linux/info/kernels/4.1
@@ -0,0 +1,5 @@
+version="4.1"
+source="linux-${version}.tar.xz"
+source_url="${KERNEL_URL}/pub/linux/kernel/v4.x/${source}"
+source2="linux-${version}.tar.sign"
+source2_url="${KERNEL_URL}/pub/linux/kernel/v4.x/${source2}"
diff --git a/kernels/linux/info/patches/maintenance_patches_4/patch-4.0.5
b/kernels/linux/info/patches/maintenance_patches_4/patch-4.0.5
new file mode 100755
index 0000000..b0ab060
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_4/patch-4.0.5
@@ -0,0 +1,5 @@
+appliedkernels="4.0"
+patchversion="${appliedkernels}.5"
+source="patch-${patchversion}.xz"
+source_url="${KERNEL_URL}/pub/linux/kernel/v4.x/${source}"
+sha1sum="98325daa6003be17f6d9bf446275880d98571a5d"
diff --git a/kernels/linux/info/patches/maintenance_patches_4/patch-4.1
b/kernels/linux/info/patches/maintenance_patches_4/patch-4.1
new file mode 100755
index 0000000..a04ffd5
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_4/patch-4.1
@@ -0,0 +1,5 @@
+patchversion="4.1.0"
+source=""
+source_url=""
+appliedkernels="4.1"
+md5sum=""
diff --git a/kernels/linux/info/patches/maintenance_patches_4/patch-4.1.1
b/kernels/linux/info/patches/maintenance_patches_4/patch-4.1.1
new file mode 100755
index 0000000..2f2fecc
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_4/patch-4.1.1
@@ -0,0 +1,5 @@
+appliedkernels="4.1"
+patchversion="${appliedkernels}.1"
+source="patch-${patchversion}.xz"
+source_url="${KERNEL_URL}/pub/linux/kernel/v4.x/${source}"
+sha1sum="2b8d258b0d5ccab320ec21b58e15d5f19051875b"
diff --git a/kernels/linux/latest.defaults b/kernels/linux/latest.defaults
index 3615f50..2cd838d 100644
--- a/kernels/linux/latest.defaults
+++ b/kernels/linux/latest.defaults
@@ -1,10 +1,10 @@
-LATEST_4=4.0
+LATEST_4=4.1
LATEST_3=3.19
LATEST_2_6=2.6.39
LATEST_PRE_2_6=patch-2.6.39
LATEST_maintenance_patches=patch-2.6.39.4
LATEST_maintenance_patches_3=patch-3.19.3
-LATEST_maintenance_patches_4=patch-4.0.4
+LATEST_maintenance_patches_4=patch-4.1.1
LATEST_git_patches=patch-2.6.25-rc6-git7
LATEST_2_4=2.4.37.9
LATEST_PRE_2_4=patch-2.4.33-pre1
diff --git a/libs/glibc/DEPENDS b/libs/glibc/DEPENDS
index 451f928..982661c 100755
--- a/libs/glibc/DEPENDS
+++ b/libs/glibc/DEPENDS
@@ -1,3 +1,4 @@
+depends binutils &&
depends autoconf &&
depends gcc &&
depends gettext &&
diff --git a/libs/glibc/HISTORY b/libs/glibc/HISTORY
index 9353c50..d9dc31f 100644
--- a/libs/glibc/HISTORY
+++ b/libs/glibc/HISTORY
@@ -1,3 +1,6 @@
+2015-06-04 Vlad Glagolev <stealth AT sourcemage.org>
+ * DEPENDS: added missing required dependency -- binutils
+
2015-05-24 Remko van der Vossen <wich AT sourcemage.org>
* DETAILS, PREPARE, PRE_BUILD: support kernel headers 4.x

diff --git a/libs/tzdata/DETAILS b/libs/tzdata/DETAILS
index 7584466..467b4c0 100755
--- a/libs/tzdata/DETAILS
+++ b/libs/tzdata/DETAILS
@@ -1,5 +1,5 @@
SPELL=tzdata
- VERSION=2015a
+ VERSION=2015d
SOURCE="${SPELL}${VERSION}.tar.gz"
SOURCE2=$SOURCE.asc
SOURCE_URL[0]=ftp://ftp.iana.org/tz/releases/${SOURCE}
diff --git a/libs/tzdata/HISTORY b/libs/tzdata/HISTORY
index f11ac9e..b5c2bb1 100644
--- a/libs/tzdata/HISTORY
+++ b/libs/tzdata/HISTORY
@@ -1,3 +1,6 @@
+2015-06-02 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: version 2015d
+
2015-03-09 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 2015a
* hard_linked_files: updated, generated with:
diff --git a/net/monit/DETAILS b/net/monit/DETAILS
index b1b87e5..cf58dba 100755
--- a/net/monit/DETAILS
+++ b/net/monit/DETAILS
@@ -1,9 +1,8 @@
SPELL=monit
- VERSION=5.11
- PATCHLEVEL=2
+ VERSION=5.13
SOURCE="${SPELL}-${VERSION}.tar.gz"
SOURCE_URL[0]="http://mmonit.com/${SPELL}/dist/${SOURCE}";
-
SOURCE_HASH=sha512:d3bffd0fa5326d7783259af5f14beaed510d06644ec865e933e63aab2c35d47e2f859a9e490b0193ae62c9174a065c216cfa0ae3708d5a06a2d92e9c384f4151
+
SOURCE_HASH=sha512:257fc9d5ece7b39973107adef51b437941c944909efa03949f53067a0811ab8929ea57e98cbf06a22dd6d69aaa0aadd65a22788165819ede8316dcd1894ad546
SOURCE_DIRECTORY="${BUILD_DIRECTORY}/${SPELL}-${VERSION}"
WEB_SITE="http://mmonit.com/monit/";
LICENSE[0]=GPL
diff --git a/net/monit/HISTORY b/net/monit/HISTORY
index 7d1ea46..a04bed4 100644
--- a/net/monit/HISTORY
+++ b/net/monit/HISTORY
@@ -1,3 +1,13 @@
+2015-05-07 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 5.13
+
+2015-03-29 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 5.12.2
+
+2015-02-25 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 5.12
+ * timeout.patch: removed, fixed by upstream
+
2015-01-22 Vlad Glagolev <stealth AT sourcemage.org>
* CONFIGURE: corrected typo

diff --git a/net/monit/PRE_BUILD b/net/monit/PRE_BUILD
index 265cc03..525d495 100755
--- a/net/monit/PRE_BUILD
+++ b/net/monit/PRE_BUILD
@@ -2,6 +2,4 @@ default_pre_build &&
cd "$SOURCE_DIRECTORY" &&

# use strict pid directory
-sedit "s:piddir=.*:piddir=$INSTALL_ROOT/var/run:g" configure &&
-
-patch -p0 < "$SPELL_DIRECTORY/timeout.patch"
+sedit "s:piddir=.*:piddir=$INSTALL_ROOT/var/run:g" configure
diff --git a/net/monit/timeout.patch b/net/monit/timeout.patch
deleted file mode 100644
index b21db81..0000000
--- a/net/monit/timeout.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- src/net.c.orig 2014-12-22 21:41:37.000000000 +0300
-+++ src/net.c 2015-01-07 01:23:01.461108587 +0300
-@@ -515,7 +515,7 @@
- gettimeofday(&t_in, NULL);
- /* The read from connection-less raw socket via
recvfrom() provides messages regardless of origin, the source IP address is
set in sout, we have to check the IP and skip responses belonging to other
ICMP conversations */
- if (sout.sin_addr.s_addr != sa->sin_addr.s_addr ||
icmpin->icmp_type != ICMP_ECHOREPLY || id_in != id_out || seq_in >=
(uint16_t)count) {
-- if ((read_timeout = timeout - ((t_in.tv_sec
- t_out.tv_sec) + (t_in.tv_usec - t_out.tv_usec) / 1000.)) > 0)
-+ if ((read_timeout = timeout - ((t_in.tv_sec
- t_out.tv_sec) * 1000 + (t_in.tv_usec - t_out.tv_usec) / 1000.)) > 0)
- goto readnext; // Try to read next
packet, but don't exceed the timeout while waiting for our response so we
won't loop forever if the socket is flooded with other ICMP packets
- } else {
- data = (unsigned char *)icmpin->icmp_data;
-@@ -525,7 +525,7 @@
- break; // Wait for one response only
- }
- } else
-- LogError("Ping response for %s %d/%d timed out --
no response within %d seconds\n", hostname, i + 1, count, timeout);
-+ LogError("Ping response for %s %d/%d timed out --
no response within %d seconds\n", hostname, i + 1, count, timeout / 1000);
- }
- error1:
- do {
diff --git a/printer/cups/DETAILS b/printer/cups/DETAILS
index a005ece..417bf02 100755
--- a/printer/cups/DETAILS
+++ b/printer/cups/DETAILS
@@ -3,9 +3,9 @@
# VERSION=1.4.3
# SOURCE_HASH=sha512:
#else
- VERSION=2.0.2
-
SOURCE_HASH=sha512:6b0ae58983f66ea295aabe7367880931aabbb4390085d31bcdd8d42830c958c23b34bfa8b761bd681e233d9727a7841524076dd9760f5b093a6001676d74bc2e
- SECURITY_PATCH=8
+ VERSION=2.0.3
+
SOURCE_HASH=sha512:fcc2be8d12cec624423a07706486afd226c9cb29b2ba694d63b8250c16a7d0f39aa51e6c831ca7c978ba5009e98b1daedad4b119a4f3287a88e21e48f0d07e18
+ SECURITY_PATCH=9
#fi
SOURCE=$SPELL-$VERSION-source.tar.bz2
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
diff --git a/printer/cups/HISTORY b/printer/cups/HISTORY
index b1663c2..94b0e53 100644
--- a/printer/cups/HISTORY
+++ b/printer/cups/HISTORY
@@ -1,3 +1,7 @@
+2015-06-10 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: version 2.0.3
+ SECURITY_PATCH++, fixes CVE-2015-1158/CVE-2015-1159
+
2015-02-22 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 2.0.2
SECURITY_PATCH++
diff --git a/python-pypi/pillow/BUILD b/python-pypi/pillow/BUILD
index a46e6c4..2c5ec4c 100755
--- a/python-pypi/pillow/BUILD
+++ b/python-pypi/pillow/BUILD
@@ -1,3 +1,6 @@
+# fix build against system zlib
+LDFLAGS="-L$INSTALL_ROOT/lib $LDFLAGS" &&
+
local PYTHON="$(get_spell_provider_file $SPELL PYTHON
'/usr/bin/python[0-9\.]*$')" &&

$PYTHON setup.py build_py build_scripts &&
diff --git a/python-pypi/pillow/HISTORY b/python-pypi/pillow/HISTORY
index d61982d..8e0600b 100644
--- a/python-pypi/pillow/HISTORY
+++ b/python-pypi/pillow/HISTORY
@@ -1,3 +1,6 @@
+2015-05-31 Vlad Glagolev <stealth AT sourcemage.org>
+ * BUILD: fixed build with system zlib
+
2015-04-14 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 2.8.1; use SPELLX
* DEPENDS: rewritten -- added missing required dependency (unzip);
fixed
diff --git a/security/wireshark/DETAILS b/security/wireshark/DETAILS
index 87592dd..6214b61 100755
--- a/security/wireshark/DETAILS
+++ b/security/wireshark/DETAILS
@@ -1,11 +1,11 @@
SPELL=wireshark
- VERSION=1.12.5
- SECURITY_PATCH=53
+ VERSION=1.12.6
+ SECURITY_PATCH=54
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
SOURCE_URL[0]=$SOURCEFORGE_URL/$SPELL/$SOURCE
SOURCE_URL[1]=http://www.wireshark.org/download/src/$SOURCE
-
SOURCE_HASH=sha512:857f0299290d5ca1a34ec4296bf6ef1da82fb59af1aae2c095599e16c4a95a653987d60611d58874dd8cb3271838b0a4ec476a17c52e781cb56607ac39197136
+
SOURCE_HASH=sha512:a8fb576e359d6534fc2df3372f23c1f338aed393749786cde21d8593f50ccec154d05c9298f7ddfcaa3a0dcee921975c6a40070a8d0b84f6fbb7f8df16b2b17b
WEB_SITE=http://www.wireshark.org/
ENTERED=20020116
LICENSE[0]=GPL
diff --git a/security/wireshark/HISTORY b/security/wireshark/HISTORY
index d7b9e0a..bb3855b 100644
--- a/security/wireshark/HISTORY
+++ b/security/wireshark/HISTORY
@@ -1,3 +1,6 @@
+2015-06-18 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 1.12.6, SECURITY_PATCH=54
+
2015-05-13 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 1.12.5, SECURITY_PATCH=53

diff --git a/utils/ntp/DETAILS b/utils/ntp/DETAILS
index 308e7ba..5bd2510 100755
--- a/utils/ntp/DETAILS
+++ b/utils/ntp/DETAILS
@@ -1,10 +1,10 @@
SPELL=ntp
- VERSION=4.2.8p1
- SECURITY_PATCH=2
+ VERSION=4.2.8p2
+ SECURITY_PATCH=3
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION

SOURCE_URL[0]=http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/$SOURCE
-
SOURCE_HASH="sha512:4075260dc8817c5b1ed04ec8a60316f938b2c188d95419eb1c3808a5b2854c91d40c62f36b8d3be30ea40cc92415e1b7326a9362a4c61c53c33abcca781b3f4f"
+
SOURCE_HASH=sha512:7b39e4d8a362afd37dc57a742841fadcd4634bb1d21d59d72d484b759a867d82b90d8c77e6e104c73ec8690489b80b0f9e2e86e4dfcfa34a49621cee3dee16d0
WEB_SITE=http://www.ntp.org/
ENTERED=20011004
LICENSE[0]=PD
diff --git a/utils/ntp/HISTORY b/utils/ntp/HISTORY
index 5f89502..ff54e0d 100644
--- a/utils/ntp/HISTORY
+++ b/utils/ntp/HISTORY
@@ -1,3 +1,7 @@
+2015-06-01 Ismael Luceno <ismael AT sourcemage.org>
+ * DETAILS: updated spell to 4.2.8p2
+ SECURITY_PATCH++
+
2015-03-21 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* DETAILS: remove dead SOURCE_URL

[SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (a314f2579dfd06d92041211c7e76286235052bb6), Vlad Glagolev, 12/23/2015