/mandos/trunk : changes

» Changes to crl.pem from revision 1316

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 1316 to 1297

expand all

Rev	Summary	Authors	Date
1316	Merge from release branch Merge from release branch	Teddy Hogeborn	29 days ago
1315	mandos-keygen: Show warning about old OpenSSH versions mandos-keygen: Show warning about old OpenSSH versions When generating a config file snippet on the Mandos client system using mandos-keygen, and the default ssh-keyscan checker is used, and if the OpenSSH version is 9.8 or later, the "checker" command generated for the config file on the Mandos server will include the "-q" option for ssh-keyscan. This option did not exist on ssh-keyscan from OpenSSH older than version 9.8. Therefore, if the Mandos server is running an older version of OpenSSH, where ssh-keyscan does not support the "-q" option, this option must be removed from the generated "checker" setting. Since we cannot know if this is the case when running mandos-keygen on the Mandos client system, we print this information as a comment above the generated "checker" setting. * mandos-keygen: Show warning if the new "-q" options was used with ssh-keyscan in the generated "checker" setting.	Teddy Hogeborn	29 days ago
1314	mandos-monitor: avoid deprecation warnings from urwid mandos-monitor: avoid deprecation warnings from urwid The urwid.FlowWidget class is deprecated. Replace it with inheriting from urwid.Widget, and setting the appropriate class attribute. * mandos-monitor: Replace any mentions of urwid.FlowWidget with urwid.Widget. (MandosClientWidget): Inherit from "urwid.Widget" instead of "urwid.FlowWidget". Also, move MandosClientPropertyCache to first in inheritance list so that its __init__ method can absorb the "proxy_object" and "properties" keyword arguments. (MandosClientWidget._sizing): New class attribute; set to "frozenset(["flow"])". (Thanks to an anonymous contributor for reporting this.)	Teddy Hogeborn	1 month ago
1313	mandos-monitor: Avoid debug messages from urwid mandos-monitor: Avoid debug messages from urwid Avoid debug messages from urwid. Any logging output before the screen has been set up will mangle the screen. * mandos-monitor: When setting up logging, set urwid to only show log messages of level INFO or above. (Thanks to an anonymous contributor for reporting this.)	Teddy Hogeborn	1 month ago
1312	Debian package: Avoid suggesting a C compiler unnecessarily Debian package: Avoid suggesting a C compiler unnecessarily The list of suggested packages, meant to enable the "mandos" program to find the correct value of SO_BINDTODEVICE by using a C compiler, are not necessary when Python 3.3 or later is used, since it has the SO_BINDTODEVICE constant defined in the "socket" module. Also, Python 2.6 or older has the same constant in the old "IN" module. Therefore, we should suggest these Python versions as alternatives to a C compiler, so that a C compiler is not installed unnecessarily. debian/control (Package: mandos/Suggests): Add "python3 (>= 3.3)" and "python (<= 2.6)" as alternatives to "libc6-dev \| libc-dev" and "c-compiler".	Teddy Hogeborn	1 month ago
1311	mandos: Make configured network socket non-inheritable mandos: Make configured network socket non-inheritable If we are passed a pre-created created network socket as a file descriptor, we should make it non-inheritable to checkers and other subprocesses.	Teddy Hogeborn	1 month ago
1310	mandos: Avoid closing configured server network socket mandos: Avoid closing configured server network socket If we are passed a pre-created created network socket as a file descriptor, we must avoid later closing it (when stdin, stdout and stderr are dup2()ed over with /dev/null) by making sure that the network file descriptor is not 0, 1, or 2, by creating a new file descriptor if necessary. However, when we create a new file descriptor we must check that the new file descriptor is not 0, 1, or 2 either, and try again until we get a suitable file descriptor.	Teddy Hogeborn	1 month ago
1309	mandos-keygen: Avoid comment lines from ssh-keyscan mandos-keygen: Avoid comment lines from ssh-keyscan In ssh-keyscan from OpenSSH 9.8, comment lines containing the hostname and SSH protocol banner are emitted by to standard output. Avoid this by passing the "-q" (quiet) option to ssh-keyscan. mandos-keygen: When scanning localhost for keys, try to run "ssh-keyscan" both with and without the "-q" option. If the "-q" option worked, use the option also in the generated checker command. Reported-By: bb <bb@tsufeki.eu> Thanks: bb <bb@tsufeki.eu> for analysis	Teddy Hogeborn	1 month ago
1308	initramfs-unpack: Support initramfs images compressed with z... initramfs-unpack: Support initramfs images compressed with zstd initramfs-unpack: Also support initramfs images compressed with the new compression method zstd.	Teddy Hogeborn	1 month ago
1307	Make binary directory configurable Make binary directory configurable Reportedly, Arch Linux uses /bin for all binaries, not /sbin. Therefore, make binary directory configurable. From: Erich Eckner <mandos@eckner.net> Signed-off-by: Teddy Hogeborn <teddy@recompile.se>	Teddy Hogeborn	1 month ago
1306	Detect GPGME version correctly Detect GPGME version correctly It seems that newer versions of dpkg-query can print an empty version. Change the code to also parse this output. Reported-By: Pablo Abelenda <pabelenda@igalia.com>	Teddy Hogeborn	1 month ago
1305	Only use D-Bus when necessary Only use D-Bus when necessary If both "use_dbus" and "zeroconf" are false, by either setting them to False in mandos.conf or by using the --no-dbus and --no-zeroconf options (and a port number or socket is specified), then we do not need to connect to D-Bus at all. From: Mike Klein <mike@kleinnet.com> Signed-off-by: Teddy Hogeborn <teddy@recompile.se>	Teddy Hogeborn	3 months ago
1304	Override lintian experimental tag "executable-in-usr-lib" Override lintian experimental tag "executable-in-usr-lib" Lintian reports executable files in /usr/lib, since binaries which are executed internally are supposed to be stored in /usr/libexec. But the executables we store in /usr/lib are all files to be copied into the initial RAM disk image, and are never executed from their storage location in /usr/lib. Except one; the Dracut module-setup.sh file. But that file seems to be required to be executable; the module-setup.sh file of every other Dracut module is also an executable file. * debian/mandos-client.lintian-overrides: Override experimental tag "executable-in-usr-lib" about files which are not actually executed from this location, and only exist to be copied to the initial RAM disk image. Also the Dracut module-setup.sh file, which merely follows the pattern of all other Dracut module-setup.sh files from other Dracut modules.	Teddy Hogeborn	3 months ago
1303	Fix lintian warning "build-depends-on-obsolete-package" Fix lintian warning "build-depends-on-obsolete-package" Apparently, pkg-config is deprecated in favor of pkgconf: <https://bugs.debian.org/1020799>, <http://pkgconf-migration.debian.net/> Therefore, prefer pkgconf in the build dependencies. * debian/control (Source: mandos/Build-Depends): Change "pkg-config" to "pkgconf \| pkg-config".	Teddy Hogeborn	3 months ago
1302	Merge from release branch Merge from release branch	Teddy Hogeborn	3 months ago
1301	Ignore some more files Ignore some more files * .bzrignore: Ignore "cl", which is used to temporarily save the commit message. Ignore the .mypy_cache directories. Ignore *.c.local files which are used by the tools to sort #include directives and associated comments.	Teddy Hogeborn	3 months ago
1300	Hide warnings if --no-warn-execstack is not supported Hide warnings if --no-warn-execstack is not supported * Makefile: When testing if "-Xlinker --no-warn-execstack" can be used by the C compiler, hide any error output.	Teddy Hogeborn	3 months ago
1299	Only use linker option --no-warn-execstack if supported Only use linker option --no-warn-execstack if supported The --no-warn-execstack is new in ld(1) version 2.39; only use the option if the linker supports it. * Makefile: Only add "-Xlinker --no-warn-execstack" to LDFLAGS for various programs if we can successfully run a compiler with that linker flag.	Teddy Hogeborn	3 months ago
1298	Eliminate compiler warnings Eliminate compiler warnings Many programs use nested functions, which now result in a linker warning about executable stack. Hide this warning. Also, rewrite a loop in the plymouth plugin to avoid warning about signed overflow. This change also makes the plugin pick the alphabetically first process entry instead of the last, in case many plymouth processes are found (which should be unlikely). * Makefile (plugin-runner, dracut-module/password-agent, plugins.d/password-prompt, plugins.d/mandos-client, plugins.d/plymouth): New target; set LDFLAGS to add "-Xlinker --no-warn-execstack". * plugins.d/plymouth.c (get_pid): When no pid files are found, and we are looking through the process list, go though it from the start instead of from the end, i.e. in normal alphabetical order and not in reverse order.	Teddy Hogeborn	3 months ago
1297	Acknowledge NMUs in debian/changelog Acknowledge NMUs in debian/changelog * debian/changelog (1.8.16-1.1, 1.8.16-1.2): New entries.	Teddy Hogeborn	3 months ago

Older »