/mandos/trunk : changes

» Changes from revision 1316

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 1312 to 1293

expand all

Rev	Summary	Authors	Date
1312	Debian package: Avoid suggesting a C compiler unnecessarily Debian package: Avoid suggesting a C compiler unnecessarily The list of suggested packages, meant to enable the "mandos" program to find the correct value of SO_BINDTODEVICE by using a C compiler, are not necessary when Python 3.3 or later is used, since it has the SO_BINDTODEVICE constant defined in the "socket" module. Also, Python 2.6 or older has the same constant in the old "IN" module. Therefore, we should suggest these Python versions as alternatives to a C compiler, so that a C compiler is not installed unnecessarily. debian/control (Package: mandos/Suggests): Add "python3 (>= 3.3)" and "python (<= 2.6)" as alternatives to "libc6-dev \| libc-dev" and "c-compiler".	Teddy Hogeborn	1 month ago
1311	mandos: Make configured network socket non-inheritable mandos: Make configured network socket non-inheritable If we are passed a pre-created created network socket as a file descriptor, we should make it non-inheritable to checkers and other subprocesses.	Teddy Hogeborn	1 month ago
1310	mandos: Avoid closing configured server network socket mandos: Avoid closing configured server network socket If we are passed a pre-created created network socket as a file descriptor, we must avoid later closing it (when stdin, stdout and stderr are dup2()ed over with /dev/null) by making sure that the network file descriptor is not 0, 1, or 2, by creating a new file descriptor if necessary. However, when we create a new file descriptor we must check that the new file descriptor is not 0, 1, or 2 either, and try again until we get a suitable file descriptor.	Teddy Hogeborn	1 month ago
1309	mandos-keygen: Avoid comment lines from ssh-keyscan mandos-keygen: Avoid comment lines from ssh-keyscan In ssh-keyscan from OpenSSH 9.8, comment lines containing the hostname and SSH protocol banner are emitted by to standard output. Avoid this by passing the "-q" (quiet) option to ssh-keyscan. mandos-keygen: When scanning localhost for keys, try to run "ssh-keyscan" both with and without the "-q" option. If the "-q" option worked, use the option also in the generated checker command. Reported-By: bb <bb@tsufeki.eu> Thanks: bb <bb@tsufeki.eu> for analysis	Teddy Hogeborn	1 month ago
1308	initramfs-unpack: Support initramfs images compressed with z... initramfs-unpack: Support initramfs images compressed with zstd initramfs-unpack: Also support initramfs images compressed with the new compression method zstd.	Teddy Hogeborn	1 month ago
1307	Make binary directory configurable Make binary directory configurable Reportedly, Arch Linux uses /bin for all binaries, not /sbin. Therefore, make binary directory configurable. From: Erich Eckner <mandos@eckner.net> Signed-off-by: Teddy Hogeborn <teddy@recompile.se>	Teddy Hogeborn	1 month ago
1306	Detect GPGME version correctly Detect GPGME version correctly It seems that newer versions of dpkg-query can print an empty version. Change the code to also parse this output. Reported-By: Pablo Abelenda <pabelenda@igalia.com>	Teddy Hogeborn	1 month ago
1305	Only use D-Bus when necessary Only use D-Bus when necessary If both "use_dbus" and "zeroconf" are false, by either setting them to False in mandos.conf or by using the --no-dbus and --no-zeroconf options (and a port number or socket is specified), then we do not need to connect to D-Bus at all. From: Mike Klein <mike@kleinnet.com> Signed-off-by: Teddy Hogeborn <teddy@recompile.se>	Teddy Hogeborn	3 months ago
1304	Override lintian experimental tag "executable-in-usr-lib" Override lintian experimental tag "executable-in-usr-lib" Lintian reports executable files in /usr/lib, since binaries which are executed internally are supposed to be stored in /usr/libexec. But the executables we store in /usr/lib are all files to be copied into the initial RAM disk image, and are never executed from their storage location in /usr/lib. Except one; the Dracut module-setup.sh file. But that file seems to be required to be executable; the module-setup.sh file of every other Dracut module is also an executable file. * debian/mandos-client.lintian-overrides: Override experimental tag "executable-in-usr-lib" about files which are not actually executed from this location, and only exist to be copied to the initial RAM disk image. Also the Dracut module-setup.sh file, which merely follows the pattern of all other Dracut module-setup.sh files from other Dracut modules.	Teddy Hogeborn	3 months ago
1303	Fix lintian warning "build-depends-on-obsolete-package" Fix lintian warning "build-depends-on-obsolete-package" Apparently, pkg-config is deprecated in favor of pkgconf: <https://bugs.debian.org/1020799>, <http://pkgconf-migration.debian.net/> Therefore, prefer pkgconf in the build dependencies. * debian/control (Source: mandos/Build-Depends): Change "pkg-config" to "pkgconf \| pkg-config".	Teddy Hogeborn	3 months ago
1302	Merge from release branch Merge from release branch	Teddy Hogeborn	3 months ago
1301	Ignore some more files Ignore some more files * .bzrignore: Ignore "cl", which is used to temporarily save the commit message. Ignore the .mypy_cache directories. Ignore *.c.local files which are used by the tools to sort #include directives and associated comments.	Teddy Hogeborn	3 months ago
1300	Hide warnings if --no-warn-execstack is not supported Hide warnings if --no-warn-execstack is not supported * Makefile: When testing if "-Xlinker --no-warn-execstack" can be used by the C compiler, hide any error output.	Teddy Hogeborn	3 months ago
1299	Only use linker option --no-warn-execstack if supported Only use linker option --no-warn-execstack if supported The --no-warn-execstack is new in ld(1) version 2.39; only use the option if the linker supports it. * Makefile: Only add "-Xlinker --no-warn-execstack" to LDFLAGS for various programs if we can successfully run a compiler with that linker flag.	Teddy Hogeborn	3 months ago
1298	Eliminate compiler warnings Eliminate compiler warnings Many programs use nested functions, which now result in a linker warning about executable stack. Hide this warning. Also, rewrite a loop in the plymouth plugin to avoid warning about signed overflow. This change also makes the plugin pick the alphabetically first process entry instead of the last, in case many plymouth processes are found (which should be unlikely). * Makefile (plugin-runner, dracut-module/password-agent, plugins.d/password-prompt, plugins.d/mandos-client, plugins.d/plymouth): New target; set LDFLAGS to add "-Xlinker --no-warn-execstack". * plugins.d/plymouth.c (get_pid): When no pid files are found, and we are looking through the process list, go though it from the start instead of from the end, i.e. in normal alphabetical order and not in reverse order.	Teddy Hogeborn	3 months ago
1297	Acknowledge NMUs in debian/changelog Acknowledge NMUs in debian/changelog * debian/changelog (1.8.16-1.1, 1.8.16-1.2): New entries.	Teddy Hogeborn	3 months ago
1296	Update Debian Policy version to 4.7.0; no other changes nece... Update Debian Policy version to 4.7.0; no other changes necessary. * debian/control (Standards-Version): Change to "4.7.0".	Teddy Hogeborn	3 months ago
1295	Change to new lintian override syntax Change to new lintian override syntax Lintian has changed its output for warnings, and as a result, its syntax for overriding those warnings has also changed. (See Debian bug #1007002 for further information.) Therefore, change the syntax in the lintian override files. * debian/mandos-client.lintian-overrides: Change to new lintian "pointed hints" syntax. * debian/mandos.lintian-overrides: - '' -	Teddy Hogeborn	3 months ago
1294	Make all required directories when installing Make all required directories when installing When installing into a normal system, one can assume that target directories, such as /usr/bin, already exists. But when installing into a subdirectory for the purpose of creating a package, one cannot assume that all directories already exist. Therefore, when installing, we must not check if any directories exist, and must instead always create any directories we want to install into. * Makefile (confdir/mandos.conf, confdir/clients.conf, install-html): Use the "-D" option to "install" instead of creating the directory separately. (install-server): Move creation of $(CONFDIR) down to before it is needed. Don't check if the $(TMPFILES) or $(SYSUSERS) directories exist; instead create them by using the "-D" option to "install". Create the $(PREFIX)/sbin directory. Always use "--target-directory" if possible; i.e. if the file name is the same. Create the $(DBUSPOLICYDIR) and $(DESTDIR)/etc/init.d directories by using the "-D" option to "install". Don't check if the $(SYSTEMD) directory exists; instead create it by using the "-D" option to "install". Create the $(DESTDIR)/etc/default and $(MANDIR)/man8 directories by using the "-D" option to "install". Create the $(MANDIR)/man5 directories explicitly. (install-client-nokey): Remove unnecessary creation of the $(CONFDIR) directory. Don't check if the $(SYSUSERS) directory exists; instead create it by using the "-D" option to "install". Move the "--directory" argument to be the first argument, for clarity. Create the $(PREFIX)/sbin directory. Use the "-D" argument to "install" when installing $(INITRAMFSTOOLS)/hooks/mandos, $(INITRAMFSTOOLS)/conf.d/mandos-conf, $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos, $(INITRAMFSTOOLS)/scripts/init-premount/mandos, $(INITRAMFSTOOLS)/scripts/local-premount/mandos, $(DRACUTMODULE)/ask-password-mandos.path, and $(DRACUTMODULE)/dracut-module/ask-password-mandos.service. Create the $(MANDIR)/man8 directory. Reported-By: Erich Eckner <erich@eckner.net> Thanks: Erich Eckner <erich@eckner.net> for analysis	Teddy Hogeborn	3 months ago
1293	Fix minor deprecated syntax issue in debian/control Fix minor deprecated syntax issue in debian/control The << syntax should be preferred to the deprecated < notation. * debian/control (Source: mandos/Build-Depends): Change from having "systemd (< 256~rc2-1)" to "systemd (<< 256~rc2-1)".	Teddy Hogeborn	3 months ago

Older »