/mandos/release : changes

» Changes from revision 237.7.860

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

From Revision 237.7.860 to 237.7.841

expand all

Rev	Summary	Authors	Date
237.7.860	Debian package: Avoid suggesting a C compiler unnecessarily Debian package: Avoid suggesting a C compiler unnecessarily The list of suggested packages, meant to enable the "mandos" program to find the correct value of SO_BINDTODEVICE by using a C compiler, are not necessary when Python 3.3 or later is used, since it has the SO_BINDTODEVICE constant defined in the "socket" module. Also, Python 2.6 or older has the same constant in the old "IN" module. Therefore, we should suggest these Python versions as alternatives to a C compiler, so that a C compiler is not installed unnecessarily. debian/control (Package: mandos/Suggests): Add "python3 (>= 3.3)" and "python (<= 2.6)" as alternatives to "libc6-dev \| libc-dev" and "c-compiler".	Teddy Hogeborn	9 days ago
237.7.859	mandos: Make configured network socket non-inheritable mandos: Make configured network socket non-inheritable If we are passed a pre-created created network socket as a file descriptor, we should make it non-inheritable to checkers and other subprocesses.	Teddy Hogeborn	9 days ago
237.7.858	mandos: Avoid closing configured server network socket mandos: Avoid closing configured server network socket If we are passed a pre-created created network socket as a file descriptor, we must avoid later closing it (when stdin, stdout and stderr are dup2()ed over with /dev/null) by making sure that the network file descriptor is not 0, 1, or 2, by creating a new file descriptor if necessary. However, when we create a new file descriptor we must check that the new file descriptor is not 0, 1, or 2 either, and try again until we get a suitable file descriptor.	Teddy Hogeborn	9 days ago
237.7.857	mandos-keygen: Avoid comment lines from ssh-keyscan mandos-keygen: Avoid comment lines from ssh-keyscan In ssh-keyscan from OpenSSH 9.8, comment lines containing the hostname and SSH protocol banner are emitted by to standard output. Avoid this by passing the "-q" (quiet) option to ssh-keyscan. mandos-keygen: When scanning localhost for keys, try to run "ssh-keyscan" both with and without the "-q" option. If the "-q" option worked, use the option also in the generated checker command. Reported-By: bb <bb@tsufeki.eu> Thanks: bb <bb@tsufeki.eu> for analysis	Teddy Hogeborn	11 days ago
237.7.856	initramfs-unpack: Support initramfs images compressed with z... initramfs-unpack: Support initramfs images compressed with zstd initramfs-unpack: Also support initramfs images compressed with the new compression method zstd.	Teddy Hogeborn	23 days ago
237.7.855	Make binary directory configurable Make binary directory configurable Reportedly, Arch Linux uses /bin for all binaries, not /sbin. Therefore, make binary directory configurable. From: Erich Eckner <mandos@eckner.net> Signed-off-by: Teddy Hogeborn <teddy@recompile.se>	Teddy Hogeborn	23 days ago
237.7.854	Detect GPGME version correctly Detect GPGME version correctly It seems that newer versions of dpkg-query can print an empty version. Change the code to also parse this output. Reported-By: Pablo Abelenda <pabelenda@igalia.com>	Teddy Hogeborn	23 days ago
237.7.853	Only use D-Bus when necessary Only use D-Bus when necessary If both "use_dbus" and "zeroconf" are false, by either setting them to False in mandos.conf or by using the --no-dbus and --no-zeroconf options (and a port number or socket is specified), then we do not need to connect to D-Bus at all. From: Mike Klein <mike@kleinnet.com> Signed-off-by: Teddy Hogeborn <teddy@recompile.se>	Teddy Hogeborn	2 months ago
237.7.852	Override lintian experimental tag "executable-in-usr-lib" Override lintian experimental tag "executable-in-usr-lib" Lintian reports executable files in /usr/lib, since binaries which are executed internally are supposed to be stored in /usr/libexec. But the executables we store in /usr/lib are all files to be copied into the initial RAM disk image, and are never executed from their storage location in /usr/lib. Except one; the Dracut module-setup.sh file. But that file seems to be required to be executable; the module-setup.sh file of every other Dracut module is also an executable file. * debian/mandos-client.lintian-overrides: Override experimental tag "executable-in-usr-lib" about files which are not actually executed from this location, and only exist to be copied to the initial RAM disk image. Also the Dracut module-setup.sh file, which merely follows the pattern of all other Dracut module-setup.sh files from other Dracut modules.	Teddy Hogeborn	2 months ago
237.7.851	Fix lintian warning "build-depends-on-obsolete-package" Fix lintian warning "build-depends-on-obsolete-package" Apparently, pkg-config is deprecated in favor of pkgconf: <https://bugs.debian.org/1020799>, <http://pkgconf-migration.debian.net/> Therefore, prefer pkgconf in the build dependencies. * debian/control (Source: mandos/Build-Depends): Change "pkg-config" to "pkgconf \| pkg-config".	Teddy Hogeborn	2 months ago
237.7.850	Merge from release branch Merge from release branch	Teddy Hogeborn	2 months ago
237.7.849	Ignore some more files Ignore some more files * .bzrignore: Ignore "cl", which is used to temporarily save the commit message. Ignore the .mypy_cache directories. Ignore *.c.local files which are used by the tools to sort #include directives and associated comments.	Teddy Hogeborn	2 months ago
237.7.848	Hide warnings if --no-warn-execstack is not supported Hide warnings if --no-warn-execstack is not supported * Makefile: When testing if "-Xlinker --no-warn-execstack" can be used by the C compiler, hide any error output.	Teddy Hogeborn	2 months ago
237.7.847	Only use linker option --no-warn-execstack if supported Only use linker option --no-warn-execstack if supported The --no-warn-execstack is new in ld(1) version 2.39; only use the option if the linker supports it. * Makefile: Only add "-Xlinker --no-warn-execstack" to LDFLAGS for various programs if we can successfully run a compiler with that linker flag.	Teddy Hogeborn	2 months ago
237.7.846	Eliminate compiler warnings Eliminate compiler warnings Many programs use nested functions, which now result in a linker warning about executable stack. Hide this warning. Also, rewrite a loop in the plymouth plugin to avoid warning about signed overflow. This change also makes the plugin pick the alphabetically first process entry instead of the last, in case many plymouth processes are found (which should be unlikely). * Makefile (plugin-runner, dracut-module/password-agent, plugins.d/password-prompt, plugins.d/mandos-client, plugins.d/plymouth): New target; set LDFLAGS to add "-Xlinker --no-warn-execstack". * plugins.d/plymouth.c (get_pid): When no pid files are found, and we are looking through the process list, go though it from the start instead of from the end, i.e. in normal alphabetical order and not in reverse order.	Teddy Hogeborn	2 months ago
237.7.845	Acknowledge NMUs in debian/changelog Acknowledge NMUs in debian/changelog * debian/changelog (1.8.16-1.1, 1.8.16-1.2): New entries.	Teddy Hogeborn	2 months ago
237.7.844	Update Debian Policy version to 4.7.0; no other changes nece... Update Debian Policy version to 4.7.0; no other changes necessary. * debian/control (Standards-Version): Change to "4.7.0".	Teddy Hogeborn	2 months ago
237.7.843	Change to new lintian override syntax Change to new lintian override syntax Lintian has changed its output for warnings, and as a result, its syntax for overriding those warnings has also changed. (See Debian bug #1007002 for further information.) Therefore, change the syntax in the lintian override files. * debian/mandos-client.lintian-overrides: Change to new lintian "pointed hints" syntax. * debian/mandos.lintian-overrides: - '' -	Teddy Hogeborn	2 months ago
237.7.842	Make all required directories when installing Make all required directories when installing When installing into a normal system, one can assume that target directories, such as /usr/bin, already exists. But when installing into a subdirectory for the purpose of creating a package, one cannot assume that all directories already exist. Therefore, when installing, we must not check if any directories exist, and must instead always create any directories we want to install into. * Makefile (confdir/mandos.conf, confdir/clients.conf, install-html): Use the "-D" option to "install" instead of creating the directory separately. (install-server): Move creation of $(CONFDIR) down to before it is needed. Don't check if the $(TMPFILES) or $(SYSUSERS) directories exist; instead create them by using the "-D" option to "install". Create the $(PREFIX)/sbin directory. Always use "--target-directory" if possible; i.e. if the file name is the same. Create the $(DBUSPOLICYDIR) and $(DESTDIR)/etc/init.d directories by using the "-D" option to "install". Don't check if the $(SYSTEMD) directory exists; instead create it by using the "-D" option to "install". Create the $(DESTDIR)/etc/default and $(MANDIR)/man8 directories by using the "-D" option to "install". Create the $(MANDIR)/man5 directories explicitly. (install-client-nokey): Remove unnecessary creation of the $(CONFDIR) directory. Don't check if the $(SYSUSERS) directory exists; instead create it by using the "-D" option to "install". Move the "--directory" argument to be the first argument, for clarity. Create the $(PREFIX)/sbin directory. Use the "-D" argument to "install" when installing $(INITRAMFSTOOLS)/hooks/mandos, $(INITRAMFSTOOLS)/conf.d/mandos-conf, $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos, $(INITRAMFSTOOLS)/scripts/init-premount/mandos, $(INITRAMFSTOOLS)/scripts/local-premount/mandos, $(DRACUTMODULE)/ask-password-mandos.path, and $(DRACUTMODULE)/dracut-module/ask-password-mandos.service. Create the $(MANDIR)/man8 directory. Reported-By: Erich Eckner <erich@eckner.net> Thanks: Erich Eckner <erich@eckner.net> for analysis	Teddy Hogeborn	2 months ago
237.7.841	Fix minor deprecated syntax issue in debian/control Fix minor deprecated syntax issue in debian/control The << syntax should be preferred to the deprecated < notation. * debian/control (Source: mandos/Build-Depends): Change from having "systemd (< 256~rc2-1)" to "systemd (<< 256~rc2-1)".	Teddy Hogeborn	2 months ago

Older »