September 2011 - Arch-dev-public - lists.archlinux.org

[arch-dev-public] [signoff] coreutils-8.13-1
by Allan McRae 10 Sep '11

10 Sep '11

Upstream update. Signoff both, Allan ================================================================== NEWS * Noteworthy changes in release 8.13 (2011-09-08) [stable] ** Bug fixes chown and chgrp with the -v --from= options, now output the correct owner. I.E. for skipped files, the original ownership is output, not the new one. [bug introduced in sh-utils-2.0g] cp -r could mistakenly change the permissions of an existing destination directory. [bug introduced in coreutils-6.8] cp -u -p would fail to preserve one hard link for each up-to-date copy of a src-hard-linked name in the destination tree. I.e., if s/a and s/b are hard-linked and dst/s/a is up to date, "cp -up s dst" would copy s/b to dst/s/b rather than simply linking dst/s/b to dst/s/a. [This bug appears to have been present in "the beginning".] fts-using tools (rm, du, chmod, chgrp, chown, chcon) no longer use memory proportional to the number of entries in each directory they process. Before, rm -rf 4-million-entry-directory would consume about 1GiB of memory. Now, it uses less than 30MB, no matter how many entries there are. [this bug was inherent in the use of fts: thus, for rm the bug was introduced in coreutils-8.0. The prior implementation of rm did not use as much memory. du, chmod, chgrp and chown started using fts in 6.0. chcon was added in coreutils-6.9.91 with fts support. ] pr -T no longer ignores a specified LAST_PAGE to stop at. [bug introduced in textutils-1.19q] printf '%d' '"' no longer accesses out-of-bounds memory in the diagnostic. [bug introduced in sh-utils-1.16] split --number l/... no longer creates extraneous files in certain cases. [bug introduced in coreutils-8.8] timeout now sends signals to commands that create their own process group. timeout is no longer confused when starting off with a child process. [bugs introduced in coreutils-7.0] unexpand -a now aligns correctly when there are spaces spanning a tabstop, followed by a tab. In that case a space was dropped, causing misalignment. We also now ensure that a space never precedes a tab. [bug introduced in coreutils-5.3.0] ** Changes in behavior chmod, chown and chgrp now output the original attributes in messages, when -v or -c specified. cp -au (where --preserve=links is implicit) may now replace newer files in the destination, to mirror hard links from the source. ** New features date now accepts ISO 8601 date-time strings with "T" as the separator. It has long parsed dates like "2004-02-29 16:21:42" with a space between the date and time strings. Now it also parses "2004-02-29T16:21:42" and fractional-second and time-zone-annotated variants like "2004-02-29T16:21:42.333-07:00" md5sum accepts the new --strict option. With --check, it makes the tool exit non-zero for any invalid input line, rather than just warning. This also affects sha1sum, sha224sum, sha384sum and sha512sum. split accepts a new --filter=CMD option. With it, split filters output through CMD. CMD may use the $FILE environment variable, which is set to the nominal output file name for each invocation of CMD. For example, to split a file into 3 approximately equal parts, which are then compressed: split -n3 --filter='xz > $FILE.xz' big Note the use of single quotes, not double quotes. That creates files named xaa.xz, xab.xz and xac.xz. timeout accepts a new --foreground option, to support commands not started directly from a shell prompt, where the command is interactive or needs to receive signals initiated from the terminal. ** Improvements cp -p now copies trivial NSFv4 ACLs on Solaris 10. Before, it would mistakenly apply a non-trivial ACL to the destination file. cp and ls now support HP-UX 11.11's ACLs, thanks to improved support in gnulib. df now supports disk partitions larger than 4 TiB on MacOS X 10.5 or newer and on AIX 5.2 or newer. join --check-order now prints "join: FILE:LINE_NUMBER: bad_line" for an unsorted input, rather than e.g., "join: file 1 is not in sorted order". shuf outputs small subsets of large permutations much more efficiently. For example `shuf -i1-$((2**32-1)) -n2` no longer exhausts memory. stat -f now recognizes the GPFS, MQUEUE and PSTOREFS file system types. timeout now supports sub-second timeouts. ** Build-related Changes inherited from gnulib address a build failure on HP-UX 11.11 when using /opt/ansic/bin/cc. Numerous portability and build improvements inherited via gnulib.

2 1

[arch-dev-public] Repository status report
by Pierre Schmitz 09 Sep '11

09 Sep '11

Hi all, this is a brief report about the state of some projects affecting the whole repository of packages. packages percentage total 9594 pooled 8150 84.9400% xz 8890 92.6600% gzip 704 7.3300% signed 3186 33.2000% As you see our efforts to compress packages with xz rather than gzip and moving to a package pool structure are almost finished, I am also please with the number of packages that are already signed even though this is in a early stage and not yet official. Please have a look at old packages listed at https://www.archlinux.org/devel/reports/old/ In general I would consider it a good idea to rebuild packages regularly (e.g. once a year) even if here are no upstream changes. This way we keep our PKGBUILDs working and adjust to recent tool chain changes. Here is a short checklist for such rebuilds: * is there a new version available? * remove || return 1 * use package(), check() and build() functions * check install scripts * general cleanup if needed * run namcap on package and pkgbuild * sign the package Greetings, Pierre PS: yes, I know that the numbers bc calculated don't really add up to 100% :-) -- Pierre Schmitz, https://users.archlinux.de/~pierre

1 0

[arch-dev-public] Integrity Check x86_64: core, extra, community, multilib 09-09-2011
by repomaint＠archlinux.org 09 Sep '11

09 Sep '11

Warning : the repository multilib does not exist in /srv/abs/rsync/any =========================================================== = Integrity Check x86_64 of core,extra,community,multilib = =========================================================== Performing integrity checks... ==> parsing pkgbuilds ==> parsing db files ==> checking mismatches ==> checking archs ==> checking dependencies ==> checking makedepends ==> checking hierarchy ==> checking for circular dependencies ==> checking for differences between db files and pkgbuilds Missing PKGBUILDs ------------------- /srv/abs/rsync/any/multilib Missing Dependencies ---------------------- community/listen --> 'pyinotify' community/portaudio_cpp --> 'portaudio=19_20071207' extra/mail-notification --> 'cyrus-sasl-plugins' Missing Makedepends --------------------- community/darcs --> 'haskell-hashed-storage<0.6' extra/alex --> 'ghc=7.0.2' extra/bigloo --> 'jdk' extra/cabal-install --> 'ghc=7.0.2' extra/happy --> 'ghc=7.0.2' extra/kdebase-workspace --> 'kdebindings-pythoni' Repo Hierarchy for Dependencies --------------------------------- extra/archboot depends on community/squashfs-tools (0 extra (make)deps to pull) extra/gnucash depends on community/aqbanking (4 extra (make)deps to pull : gwenhywfar ktoblzcheck docbook2x perl-sgmls) extra/gnucash depends on community/libdbi-drivers (4 extra (make)deps to pull : libdbi sqlite2 docbook2x perl-sgmls) extra/mod_perl depends on community/perl-linux-pid (2 extra (make)deps to pull : docbook2x perl-sgmls) Repo Hierarchy for Makedepends -------------------------------- community/virtualbox depends on multilib/gcc-multilib (6 extra (make)deps to pull : gcc-libs-multilib binutils-multilib gcc-ada-multilib lib32-glibc gcc-multilib lib32-gcc-libs) community/virtualbox depends on multilib/lib32-glibc (6 extra (make)deps to pull : gcc-multilib gcc-libs-multilib binutils-multilib gcc-ada-multilib lib32-glibc lib32-gcc-libs) community/virtualbox-archlinux-additions depends on multilib/gcc-multilib (6 extra (make)deps to pull : gcc-libs-multilib binutils-multilib gcc-ada-multilib lib32-glibc gcc-multilib lib32-gcc-libs) community/virtualbox-archlinux-additions depends on multilib/lib32-glibc (6 extra (make)deps to pull : gcc-multilib gcc-libs-multilib binutils-multilib gcc-ada-multilib lib32-glibc lib32-gcc-libs) community/virtualbox-archlinux-modules depends on multilib/gcc-multilib (6 extra (make)deps to pull : gcc-libs-multilib binutils-multilib gcc-ada-multilib lib32-glibc gcc-multilib lib32-gcc-libs) community/virtualbox-archlinux-modules depends on multilib/lib32-glibc (6 extra (make)deps to pull : gcc-multilib gcc-libs-multilib binutils-multilib gcc-ada-multilib lib32-glibc lib32-gcc-libs) community/virtualbox-sdk depends on multilib/gcc-multilib (6 extra (make)deps to pull : gcc-libs-multilib binutils-multilib gcc-ada-multilib lib32-glibc gcc-multilib lib32-gcc-libs) community/virtualbox-sdk depends on multilib/lib32-glibc (6 extra (make)deps to pull : gcc-multilib gcc-libs-multilib binutils-multilib gcc-ada-multilib lib32-glibc lib32-gcc-libs) core/ca-certificates depends on extra/python2 (168 extra (make)deps to pull) core/crda depends on extra/python-m2crypto (169 extra (make)deps to pull) core/dbus-core depends on extra/libx11 (168 extra (make)deps to pull) core/e2fsprogs depends on extra/bc (0 extra (make)deps to pull) core/glib2 depends on extra/python2 (168 extra (make)deps to pull) core/groff depends on extra/ghostscript (168 extra (make)deps to pull) core/groff depends on extra/netpbm (168 extra (make)deps to pull) core/groff depends on extra/psutils (168 extra (make)deps to pull) core/libsasl depends on extra/libmysqlclient (168 extra (make)deps to pull) core/libsasl depends on extra/postgresql-libs (168 extra (make)deps to pull) core/lilo depends on extra/sharutils (168 extra (make)deps to pull) core/links depends on extra/libpng (0 extra (make)deps to pull) core/links depends on extra/libtiff (168 extra (make)deps to pull) core/links depends on extra/libxt (168 extra (make)deps to pull) core/linux depends on extra/docbook-xsl (168 extra (make)deps to pull) core/linux depends on extra/xmlto (168 extra (make)deps to pull) core/linux-docs depends on extra/docbook-xsl (168 extra (make)deps to pull) core/linux-docs depends on extra/xmlto (168 extra (make)deps to pull) core/linux-headers depends on extra/docbook-xsl (168 extra (make)deps to pull) core/linux-headers depends on extra/xmlto (168 extra (make)deps to pull) core/module-init-tools depends on community/docbook2x (168 extra (make)deps to pull) core/pam depends on extra/docbook-xml (168 extra (make)deps to pull) core/pam depends on extra/docbook-xsl (168 extra (make)deps to pull) core/pam depends on extra/w3m (168 extra (make)deps to pull) core/sqlite3 depends on extra/tcl (0 extra (make)deps to pull) core/sqlite3-doc depends on extra/tcl (0 extra (make)deps to pull) core/sqlite3-tcl depends on extra/tcl (0 extra (make)deps to pull) core/syslinux depends on extra/nasm (168 extra (make)deps to pull) core/udev depends on extra/gobject-introspection (168 extra (make)deps to pull) core/udev depends on extra/gperf (0 extra (make)deps to pull) core/udev depends on extra/libxslt (168 extra (make)deps to pull) core/udev-compat depends on extra/gobject-introspection (168 extra (make)deps to pull) core/udev-compat depends on extra/gperf (0 extra (make)deps to pull) core/udev-compat depends on extra/libxslt (168 extra (make)deps to pull) extra/ardour depends on community/cwiid (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/audacious-plugins depends on community/jack2 (4 extra (make)deps to pull : celt docbook2x perl-sgmls celt-0.7) extra/audacious-plugins depends on community/oss (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/frozen-bubble depends on community/perl-file-slurp (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/frozen-bubble depends on community/perl-locale-maketext-lexicon (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/gnome-speech depends on community/espeak (4 extra (make)deps to pull : portaudio celt-0.7 docbook2x perl-sgmls) extra/gpsd depends on community/chrpath (0 extra (make)deps to pull) extra/grml-zsh-config depends on community/txt2tags (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/jack depends on community/celt-0.7 (0 extra (make)deps to pull) extra/java-commons-daemon depends on community/docbook2x (2 extra (make)deps to pull : perl-sgmls docbook2x) extra/java-jsvc depends on community/docbook2x (2 extra (make)deps to pull : perl-sgmls docbook2x) extra/libiodbc depends on community/chrpath (0 extra (make)deps to pull) extra/libsmbios depends on community/chrpath (0 extra (make)deps to pull) extra/speech-dispatcher depends on community/espeak (4 extra (make)deps to pull : portaudio celt-0.7 docbook2x perl-sgmls) extra/telepathy-salut depends on community/xmldiff (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/vigra depends on community/python-sphinx (4 extra (make)deps to pull : python2-pygments python2-jinja docbook2x perl-sgmls) extra/xfconf depends on community/chrpath (0 extra (make)deps to pull) Packages found in db, but not in tree --------------------------------------- community/openra community/pyinotify Packages found in tree, but not in db --------------------------------------- community/python-pyinotify community/python2-pyinotify Summary --------- Missing PKGBUILDs: 1 Invalid PKGBUILDs: 0 Mismatching PKGBUILD names: 0 Duplicate PKGBUILDs: 0 Invalid archs: 0 Missing (make)dependencies: 9 Repo hierarchy problems: 63 Circular dependencies: 0 In db, but not in tree: 2 In tree, but not in db: 2

1 0

[arch-dev-public] Integrity Check i686: core, extra, community 09-09-2011
by repomaint＠archlinux.org 09 Sep '11

09 Sep '11

================================================ = Integrity Check i686 of core,extra,community = ================================================ Performing integrity checks... ==> parsing pkgbuilds ==> parsing db files ==> checking mismatches ==> checking archs ==> checking dependencies ==> checking makedepends ==> checking hierarchy ==> checking for circular dependencies ==> checking for differences between db files and pkgbuilds Missing Dependencies ---------------------- community/listen --> 'pyinotify' community/portaudio_cpp --> 'portaudio=19_20071207' extra/mail-notification --> 'cyrus-sasl-plugins' Missing Makedepends --------------------- community/darcs --> 'haskell-hashed-storage<0.6' extra/alex --> 'ghc=7.0.2' extra/bigloo --> 'jdk' extra/cabal-install --> 'ghc=7.0.2' extra/happy --> 'ghc=7.0.2' Repo Hierarchy for Dependencies --------------------------------- extra/archboot depends on community/squashfs-tools (0 extra (make)deps to pull) extra/gnucash depends on community/aqbanking (4 extra (make)deps to pull : gwenhywfar ktoblzcheck docbook2x perl-sgmls) extra/gnucash depends on community/libdbi-drivers (4 extra (make)deps to pull : libdbi sqlite2 docbook2x perl-sgmls) extra/mod_perl depends on community/perl-linux-pid (2 extra (make)deps to pull : docbook2x perl-sgmls) Repo Hierarchy for Makedepends -------------------------------- core/ca-certificates depends on extra/python2 (168 extra (make)deps to pull) core/crda depends on extra/python-m2crypto (169 extra (make)deps to pull) core/dbus-core depends on extra/libx11 (168 extra (make)deps to pull) core/e2fsprogs depends on extra/bc (0 extra (make)deps to pull) core/glib2 depends on extra/python2 (168 extra (make)deps to pull) core/groff depends on extra/ghostscript (168 extra (make)deps to pull) core/groff depends on extra/netpbm (168 extra (make)deps to pull) core/groff depends on extra/psutils (168 extra (make)deps to pull) core/libsasl depends on extra/libmysqlclient (168 extra (make)deps to pull) core/libsasl depends on extra/postgresql-libs (168 extra (make)deps to pull) core/lilo depends on extra/sharutils (168 extra (make)deps to pull) core/links depends on extra/libpng (0 extra (make)deps to pull) core/links depends on extra/libtiff (168 extra (make)deps to pull) core/links depends on extra/libxt (168 extra (make)deps to pull) core/linux depends on extra/docbook-xsl (168 extra (make)deps to pull) core/linux depends on extra/xmlto (168 extra (make)deps to pull) core/linux-docs depends on extra/docbook-xsl (168 extra (make)deps to pull) core/linux-docs depends on extra/xmlto (168 extra (make)deps to pull) core/linux-headers depends on extra/docbook-xsl (168 extra (make)deps to pull) core/linux-headers depends on extra/xmlto (168 extra (make)deps to pull) core/module-init-tools depends on community/docbook2x (168 extra (make)deps to pull) core/pam depends on extra/docbook-xml (168 extra (make)deps to pull) core/pam depends on extra/docbook-xsl (168 extra (make)deps to pull) core/pam depends on extra/w3m (168 extra (make)deps to pull) core/sqlite3 depends on extra/tcl (0 extra (make)deps to pull) core/sqlite3-doc depends on extra/tcl (0 extra (make)deps to pull) core/sqlite3-tcl depends on extra/tcl (0 extra (make)deps to pull) core/syslinux depends on extra/nasm (168 extra (make)deps to pull) core/udev depends on extra/gobject-introspection (168 extra (make)deps to pull) core/udev depends on extra/gperf (0 extra (make)deps to pull) core/udev depends on extra/libxslt (168 extra (make)deps to pull) core/udev-compat depends on extra/gobject-introspection (168 extra (make)deps to pull) core/udev-compat depends on extra/gperf (0 extra (make)deps to pull) core/udev-compat depends on extra/libxslt (168 extra (make)deps to pull) extra/ardour depends on community/cwiid (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/audacious-plugins depends on community/jack2 (4 extra (make)deps to pull : celt docbook2x perl-sgmls celt-0.7) extra/audacious-plugins depends on community/oss (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/frozen-bubble depends on community/perl-file-slurp (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/frozen-bubble depends on community/perl-locale-maketext-lexicon (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/gnome-speech depends on community/espeak (4 extra (make)deps to pull : portaudio celt-0.7 docbook2x perl-sgmls) extra/gpsd depends on community/chrpath (0 extra (make)deps to pull) extra/grml-zsh-config depends on community/txt2tags (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/jack depends on community/celt-0.7 (0 extra (make)deps to pull) extra/java-commons-daemon depends on community/docbook2x (2 extra (make)deps to pull : perl-sgmls docbook2x) extra/java-jsvc depends on community/docbook2x (2 extra (make)deps to pull : perl-sgmls docbook2x) extra/libiodbc depends on community/chrpath (0 extra (make)deps to pull) extra/libsmbios depends on community/chrpath (0 extra (make)deps to pull) extra/speech-dispatcher depends on community/espeak (4 extra (make)deps to pull : portaudio celt-0.7 docbook2x perl-sgmls) extra/telepathy-salut depends on community/xmldiff (2 extra (make)deps to pull : docbook2x perl-sgmls) extra/vigra depends on community/python-sphinx (4 extra (make)deps to pull : python2-pygments python2-jinja docbook2x perl-sgmls) extra/xfconf depends on community/chrpath (0 extra (make)deps to pull) Packages found in db, but not in tree --------------------------------------- community/openra community/pyinotify Packages found in tree, but not in db --------------------------------------- community/python-pyinotify community/python2-pyinotify Summary --------- Missing PKGBUILDs: 0 Invalid PKGBUILDs: 0 Mismatching PKGBUILD names: 0 Duplicate PKGBUILDs: 0 Invalid archs: 0 Missing (make)dependencies: 8 Repo hierarchy problems: 55 Circular dependencies: 0 In db, but not in tree: 2 In tree, but not in db: 2

1 0

Re: [arch-dev-public] [arch-general] Adopting start-stop-daemon in archlinux
by Thomas Bächler 08 Sep '11

08 Sep '11

Am 08.09.2011 12:08, schrieb Clemens Fruhwirth: > If you use Debian, you might have come across start-stop-daemon. It's > part of the dpkg package and encapsulates all the knowledge, they > learnt when dealing with starting and stopping daemons. It has plenty > of features ranging from: > > * handling pidfiles more intimately (checking the pid files content, > verifying that the pid given actually is the executable in question) > * changing UID/GID > * chrooting, nice-ing > * retry starting if daemon dies > * creating pid files when the process doesn't do it, etc, etc. > > curl http://clemens.endorphin.org/start-stop-daemon.c | less > if you want to have look for yourself. It's a single C file. > > To me handling pid files correctly is the biggest win. The paradigm > used commonly in arch > > PID=`pidof -o %PPID /usr/bin/executable` > [ -z "$PID" ] && /usr/bin/executable > > is flawed and does not work reliably as shown here > https://bugs.archlinux.org/task/17138 > > I propose to switch to start-stop-daemon and deprecate the method above. > > http://clemens.endorphin.org/sshd-start-stop-daemon.diff is an example > of an rc.d script ported to start-stop-daemon. The paradigm -- to my > personal taste -- is clean and simple. The diffstat is negative > LOC-wise. > > We could either take the aur/start-stop-daemon packaging which > references dpkg.tar.gz or include into another core package. > start-stop-daemon.c is public domain. > -- > Fruhwirth Clemens http://clemens.endorphin.org Forwarding to the dev list, in case someone doesn't notice it here. In principle, I think this is a good idea. I want to hear Tom's opinion though, as this is closely initscripts-related.

3 4

[arch-dev-public] How to disable the DigiNotar root cert on Arch
by Pierre Schmitz 07 Sep '11

07 Sep '11

Hi all, there was another incident with a CA. See http://blog.mozilla.com/security/2011/08/29/fraudulent-google-com-certifica… for more details. If you like to distrust this issuer you'll find a howto for Firefox at http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-cert For other apps that use our ca-certificates package (by Debian) You can easily disable the root cert by issuing the following commands as root: sed -E 's#^(mozilla/DigiNotar_Root_CA.crt)$#!\1#g' -i /etc/ca-certificates.conf update-ca-certificates This information is just for those who are curious. There is most likely no need to panic for those people; especially if you don't live in Iran. And if you do its probably too late as the issuer was compromised two month ago. And I thought the Comodo incident was already pure night mare... The whole CA structure we base our SSL security on is a mess imho. Blindly shipping a bunch of certificates to our users does not seem to be the best idea any more. Unfortunately there is no real alternative atm. Greetings, Pierre -- Pierre Schmitz, https://users.archlinux.de/~pierre

4 7

[arch-dev-public] [signoff] openssh-5.9p1-2
by Gaetan Bisson 07 Sep '11

07 Sep '11

Hi all, The new openssh release has landed in [testing]. For the changes since 5.8, see below. Things have been pretty quiet upstream since they called for testers almost a month ago, so the upgrade should be seamless. Have a happy testing and a happy signing off! -- Gaetan Features: * Introduce sandboxing of the pre-auth privsep child using an optional sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables mandatory restrictions on the syscalls the privsep child can perform. This intention is to prevent a compromised privsep child from being used to attack other hosts (by opening sockets and proxying) or probing local kernel attack surface. Three concrete sandbox implementation are provided (selected at configure time): systrace, seatbelt and rlimit. The systrace sandbox uses systrace(4) in unsupervised "fast-path" mode, where a list of permitted syscalls is supplied. Any syscall not on the list results in SIGKILL being sent to the privsep child. Note that this requires a kernel with the new SYSTR_POLICY_KILL option (only OpenBSD has this mode at present). The seatbelt sandbox uses OS X/Darwin sandbox(7) facilities with a strict (kSBXProfilePureComputation) policy that disables access to filesystem and network resources. The rlimit sandbox is a fallback choice for platforms that don't support a better one; it uses setrlimit() to reset the hard-limit of file descriptors and processes to zero, which should prevent the privsep child from forking or opening new network connections. Sandboxing of the privilege separated child process is currently experimental but should become the default in a future release. Native sandboxes for other platforms are welcome (e.g. Capsicum, Linux pid/net namespaces, etc.) * Add new SHA256-based HMAC transport integrity modes from http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt These modes are hmac-sha2-256, hmac-sha2-256-96, hmac-sha2-512, and hmac-sha2-512-96, and are available by default in ssh(1) and sshd(8) * The pre-authentication sshd(8) privilege separation slave process now logs via a socket shared with the master process, avoiding the need to maintain /dev/log inside the chroot. * ssh(1) now warns when a server refuses X11 forwarding * sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths, separated by whitespace. The undocumented AuthorizedKeysFile2 option is deprecated (though the default for AuthorizedKeysFile includes .ssh/authorized_keys2) * sshd_config(5): similarly deprecate UserKnownHostsFile2 and GlobalKnownHostsFile2 by making UserKnownHostsFile and GlobalKnownHostsFile accept multiple options and default to include known_hosts2 * Retain key comments when loading v.2 keys. These will be visible in "ssh-add -l" and other places. bz#439 * ssh(1) and sshd(8): set IPv6 traffic class from IPQoS (as well as IPv4 ToS/DSCP). bz#1855 * ssh_config(5)'s ControlPath option now expands %L to the host portion of the destination host name. * ssh_config(5) "Host" options now support negated Host matching, e.g. Host *.example.org !c.example.org User mekmitasdigoat Will match "a.example.org", "b.example.org", but not "c.example.org" * ssh_config(5): a new RequestTTY option provides control over when a TTY is requested for a connection, similar to the existing -t/-tt/-T ssh(1) commandline options. * sshd(8): allow GSSAPI authentication to detect when a server-side failure causes authentication failure and don't count such failures against MaxAuthTries; bz#1244 * ssh-keygen(1): Add -A option. For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This is useful for system initialisation scripts. * ssh(1): Allow graceful shutdown of multiplexing: request that a mux server removes its listener socket and refuse future multiplexing requests but don't kill existing connections. This may be requested using "ssh -O stop ..." * ssh-add(1) now accepts keys piped from standard input. E.g. "ssh-add - < /path/to/key" * ssh-keysign(8) now signs hostbased authentication challenges correctly using ECDSA keys; bz#1858 * sftp(1): document that sftp accepts square brackets to delimit addresses (useful for IPv6); bz#1847a * ssh(1): when using session multiplexing, the master process will change its process title to reflect the control path in use and when a ControlPersist-ed master is waiting to close; bz#1883 and bz#1911 * Other minor bugs fixed: 1849 1861 1862 1869 1875 1878 1879 1892 1900 1905 1913 Portable OpenSSH Bugfixes: * Fix a compilation error in the SELinux support code. bz#1851 * This release removes support for ssh-rand-helper. OpenSSH now obtains its random numbers directly from OpenSSL or from a PRNGd/EGD instance specified at configure time. * sshd(8) now resets the SELinux process execution context before executing passwd for password changes; bz#1891 * Since gcc >= 4.x ignores all -Wno-options options, test only the corresponding -W-option when trying to determine whether it is accepted; bz#1901 * Add ECDSA key generation to the Cygwin ssh-{host,user}-config scripts. * Updated .spec and init files for Linux; bz#1920 * Improved SELinux error messages in context change failures and suppress error messages when attempting to change from the "unconfined_t" type; bz#1924 bz#1919 * Fix build errors on platforms without dlopen(); bz#1929

6 8

[arch-dev-public] [signoff] openssl 1.0.0.e-1
by Pierre Schmitz 07 Sep '11

07 Sep '11

Hi, this is a new upstream update including two security related fixes. See http://openssl.org/news/secadv_20110906.txt for details. Please sign off, Pierre -- Pierre Schmitz, https://users.archlinux.de/~pierre

4 4

[arch-dev-public] [signoff] libarchive 2.8.5-1
by Dan McGee 06 Sep '11

06 Sep '11

Upstream maint release, changes below. Please sign off. -Dan Libarchive 2.8.5 is the latest release in the libarchive 2.8 branch. This includes a number of bug fixes since the previous release and is the best version of libarchive, bsdtar, and bsdcpio for general production use. All users of previous versions are encouraged to upgrade. Specific fixes since libarchive 2.8.4: * Now reads ISO images created by NetBSD makefs and other tools. * Relax an lzma compression test to remove false negatives. * Better handling of open failures and interrupted writes. * Corrected compile warnings on various platforms. Any problems with libarchive should be reported to the bug tracker at http://libarchive.googlecode.com/

3 2

[arch-dev-public] [signoff] diffutils-3.2-1
by Allan McRae 05 Sep '11

05 Sep '11

Upstream update: * Noteworthy changes in release 3.2 (2011-09-02) [stable] ** Changes in behavior --ignore-file-name-case now applies at the top level too. For example, "diff dir inIt" might compare "dir/Init" to "inIt". ** New features diff and sdiff have a new option --ignore-trailing-space (-Z). ** Packaging The texinfo documentation no longer specifies "front-cover" or "back-cover" texts, so that it may now be included in Debian's "main" section. Signoff both, Allan

2 2