CVS log for pkgsrc/mail/procmail/distinfo

Up to [cvs.NetBSD.org] / pkgsrc / mail / procmail

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

mail/procmail: long due update to v3.24

Fixed all bugs collected by Debian and others
during the past 21 years.  See the git commit history
for detailed descriptions.

mail: Replace RMD160 checksums with BLAKE2s checksums

All checksums have been double-checked against existing RMD160 and
SHA512 hashes

The following distfiles were unfetchable (possibly fetched
conditionally?):

./mail/qmail/distinfo netqmail-1.05-TAI-leapsecs.patch

mail: Remove SHA1 hashes for distfiles

Teach procmail to cross-compile on NetBSD.

No revbump because this was not cross-compilable before.

Pullup ticket #5653 - requested by bsiegert
mail/procmail: security patch

Revisions pulled up:
- mail/procmail/Makefile                                        1.50
- mail/procmail/distinfo                                        1.17
- mail/procmail/patches/patch-bd                                1.4

-------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   snj
   Date:           Sun Nov 26 20:39:41 UTC 2017

   Modified Files:
           pkgsrc/mail/procmail: Makefile distinfo
           pkgsrc/mail/procmail/patches: patch-bd

   Log Message:
   procmail: Fix CVE-2017-16844

   Patch from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug‡6511

   Bump PKGREVISION


   To generate a diff of this commit:
   cvs rdiff -u -r1.49 -r1.50 pkgsrc/mail/procmail/Makefile
   cvs rdiff -u -r1.16 -r1.17 pkgsrc/mail/procmail/distinfo
   cvs rdiff -u -r1.3 -r1.4 pkgsrc/mail/procmail/patches/patch-bd

procmail: Fix CVE-2017-16844

Patch from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511

Bump PKGREVISION

Add SHA512 digests for distfiles for mail category

Problems found locating distfiles:
	Package mutt: missing distfile patch-1.5.24.rr.compressed.gz
	Package p5-Email-Valid: missing distfile Email-Valid-1.198.tar.gz
	Package pine: missing distfile fancy.patch.gz
	Package postgrey: missing distfile targrey-0.31-postgrey-1.34.patch
	Package qmail: missing distfile badrcptto.patch
	Package qmail: missing distfile outgoingip.patch
	Package qmail: missing distfile qmail-1.03-realrcptto-2006.12.10.patch
	Package qmail: missing distfile qmail-smtpd-viruscan-1.3.patch
	Package thunderbird24: missing distfile enigmail-1.7.2.tar.gz
	Package thunderbird31: missing distfile enigmail-1.7.2.tar.gz

Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden).  All existing
SHA1 digests retained for now as an audit trail.

Fix CVE-2014-3618.
https://bugzilla.redhat.com/show_bug.cgi?id=1121299

While here:
Convert to user-destdir by using pkgsrc setuid framework.
Add comments to some patches.

Bump PKGREVISION.

Fix the SunOS do-install target to be DESTDIR compatible.
Fix the patch files to contain proper RCS keywords.

Basic destdir support. From Steven Drake.

Changet getline() to get_line()

Support PKGMANDIR.

Fix errno.

Add RMD160 digests.

Pass the size to be reallocated to realloc(), not the address of the
size(!).  Fixes "Out of memory as I tried to allocate N bytes" messages
that I've been seeing.

Make this use ${CHMOD} rather than 'chmod', which may be in different
locations (and thus not even in the PATH), depending on the platform.
This partly adresses PR pkg/19804.

Update to 3.22.
            Changes to procmail:
               - Regression bugs from 3.20:
                  - Broke compilation with K&R compilers
                  - procmail -p -m was overridding PATH
                  - maildir delivery included garbage in filenames
                  - Mismatched HOST in last rcfile didn't discard the message
                  - COMSAT wasn't turned off by an rcfile on the command line
               - Catch overly long command line variable assignments
               - If a command expansion is truncated, set PROCMAIL_OVERFLOW
                 and don't trim trailing (really middle) newlines
               - If the comsat host can't be resolved, set COMSAT to "no"
            Some fixes to the man pages
            More paranoia: start to use strlcpy()
            Generate safe temp and maildir filenames when the hostname
               contains / or : by mapping them to \ooo

I've also seen corrupted From lines (missing F) when I upgraded to 3.21.
Someone reported in the Esd-l mailing list (see
http://www.spconnect.com/pipermail/esd-l/
for archives) that 3.22 solved the problem for him.

Update to 3.21. Changes:
   - Incorrect prototype broke compilation on Tru64 UNIX
   - INCLUDERC was broken by trying to be fancy and not fully
     succeeding when support for multiple -a options was added
Also set USE_BUILDLINK_ONLY.

Update to 3.20. Changes since last version (3.15.1):
Changes to procmail:
   - SECURITY: don't do unsafe things from signal handlers:
      - ignore TRAP when terminating because of a signal
      - resolve the host and protocol of COMSAT when it is set
      - save the absolute path form of $LASTFOLDER for the comsat
        message when it is set
      - only use the log buffer if it's safe
   - Support LMTP for delivery mode (not enabled by default)
   - Preliminary support for using mmap() for `large' messages
     (this doesn't work yet)
   - SWITCHRC=zero-length-file didn't always abort the current
     rcfile
   - A race to create the mailspool would bounce one of the
     messages due to an internal error
   - LC_ in KEEPENV would preserve only the first LC_foo variable
   - Strip runtime linker variables (LD_*) from environment on
     all platforms
   - Drop duplicate and malformed environment entries
   - Multiple -a options will now set $2, $3, etc
   - Command line assignments to INCLUDERC and SWITCHRC no longer
     have any effect
   - Worked around AIX 4.3.3 xlc compiler (incorrect file-scope
     variable initialization)
   - When delivering to a maildir, don't force the message to end
     with an empty line
   - Be more paranoid about leaking information between recipients
   - Unset LOCKFILE if we can't actually lock it
   - Set MAILDIR to '.' if the chdir fails
   - LASTFOLDER was sometimes set by '?' conditions
   - Buffer the log more efficiently
   - Use the `standard' format for maildir filenames and retry
     on name collision
   - Rename by linking to prevent lossage
Changes to lockfile:
   - Include the system mailbox lockfile path in the -v output
   - Resist attempts to use a setuid lockfile command
   - Fix infinite loop on -l, -r, or -s flag with no value.
Documented formail's treatment of >From_ lines as continuations
   of the From_ line and warned of problems caused by non-RFC822
   field names like 'Old-From '
Clarified procmail's treatment of $@ and $#
Fixed a man page formatting problem
Use long, not off_t, with fseek()/ftell()
Increase our paranoia: start to use strlcat()
The default MAILDIR is now configurable separately from the
   default rcfile location
Include an RPM spec file in the examples directory for automated
   builds
Include and use mkinstalldirs
Called nice() when shouldn't have (this time for sure!)

Update to 3.15.1, from Martti Kuparinen via pkg/13257.
Some of the more interesting changes:
- A race to create the mailspool would bounce one of the
  messages due to an internal error
- LC_ in KEEPENV would preserve only the first LC_foo variable
- Strip runtime linker variables (LD_*) from environment on
  all platforms
- Drop duplicate and malformed environment entries
- Fixed a man page formatting problem

Move to sha1 digests, and add distfile sizes.

+ move the distfile digest/checksum value from files/md5 to distinfo
+ move the patch digest/checksum values from files/patch-sum to distinfo