ports-mgmt/pkg-devel 2.8.99.4

Update to pkg 1.3.0 beta2 Changes: - more fixes in pkg audit - move audit functions into the library - pkg lock -l now list the locked packages - database lock behaviour is now configurable - symlinks now has a checksum to ensure they are valid - more fixes on the solver - add long version of the options

Update to 1.3.0 beta1 Changes: - pkg audit now accepts vuln.xml with multiple package names - Prefer SONAME instead of filename for library provides - Do not require dependencies that are self provided - pkg upgrade can now have a name in argument to only upgrade a given package and its dependencies - Lots of bug fixes

Update to 1.3.0 alpha10 Changes: - Document pkg search -U - Reduce memory usage when loading a package - Validate package loading against a ucl schema - Sandbox signature checking with capsicum - Update man pages - Be pedantically correct about units and scale factors - Now uses sqlite full text search extension - Allow case insensitive search - Fix pkg add -f - Lots of fixes in the solver

When linking a library libA with a library libB using libtool, if libB.la exists, libtool will add all libraries libB.la refers to (dependency_libs field) to the linker command line and store them in the dependency_libs field of libA.la.  So everything that subsequently links with libA will also link to these extra libraries.  This causes too much overlinking.

This commit modifies Mk/Uses/libtool.mk so it empties the dependency_libs
field in .la libraries during staging.  However, because .la libraries have
very limited use when dependency_libs is empty it makes sense to completely
remove them during staging.

So with this commit USES=libtool is modified to remove .la libraries and a
new form (USES=libtool:keepla) is introduced in case they need to be kept
(dependency_libs is still emptied).

PORTREVISION is bumped on all ports with USES=libtool that install .la
libraries.  Most ports are also changed to add :keepla because .la
libraries have to be kept around as long as there are dependent ports with
.la libraries that refer to them in their dependency_libs field.  In most
cases :keepla can be removed again as soon as all dependent ports that
install .la libraries have some form of USES=libtool added to their
Makefile.

PR:		ports/188759
Exp-run:	bdrewery
Approved by:	portmgr (bdrewery)

Update to 1.3.0 alpha9 Changes: - Fix important regression due to bad usage of libucl - Validate keywords against a schema - repos can now present metadata

New patch to avoid tons of cores to be created in case of bad failures

This time bump portrevision

Add a patch to fix build on FreeBSD 8.x and 9.1 No bump has there is no changes for version where it built

Update to 1.3.0 alpha8 Changes: - Detect invalid packages that list directories in plist - new pkg_emit_query_(yesno|select) to allow the library to ask question to the user - Reinstall packages on upgrade if remote abi changed (this catches up automatically major upgrade of freebsd) - Ability the specify the file to read the ABI from - add --relocate to pkg add and register (this is totally unsaf

Add the ability to specifiy the file where the ABI string will be determined from Enfore USES=libtool (the default libtool to not really respect CC and thus breaks cross building)

Update to 1.3.0.a7: Changes: - pkg create uses a readonly lock - pkg create returns non 0 is package creation failed - rework the cache so that is avoid collision with multirepo and avoid warning the users harmless checksum retry - do not cache anymore files when using file:// scheme - Preserve automatic flags of local packages. - Use installed provides if possible. - Fix local and remote logic fo

Update to 1.3.0.a6: Changes: - pkg delete is not recursive by default - pkg delete ui now explain why a package will be removed - pkg which now handle PATH when looking for a file - shared libraries are now directly resolved in the solver (no need anymore for explicit package dependency)

Release 1.3.0.a5 Changes: - Added ability to install packages with missing dependencies - Do not enter in a sandbox if the database is open - Do not count the lock owner as lock blocker. - Lots of rework and fixes to improve the solver when trying to upgrade very old package database.

Add orphaned file to plist.

Approved by:	bapt (just do it)

Update to 1.3.0 alpha4 Changes: - Reimport old pkg add (aliasing it to install was too optimistic at the moment) - Fix pkg install ./file with package lacking the manifestdigest information) - Fix a bug resulting in "pkg-static: sqlite: no such savepoint: upgrade"

Update to 1.3.0.a3 - Fix a typo in pkg.conf(5) - pkg add is an alias on pkg install -l

Update to 1.3.0.a2

Changes:
- libpkg: Simplify code but turning annotations into a pkg_object
- libpkg: Simplify dumping the configuration of plugins in pkg -vv
- libpkg: Update libucl to latest version
- libpkg: Fix options emission in the Manifest
- libpkg: fix some multirepository bugs
- pkg: fix pkg delete -f
- pkg: fix pkg register
- pkg: fix pkg upgrade
- pkg: fix pkg shell
- pkg: 'update' now warns user if no repos are enabled

Update to 1.3.0.a1: - New solver that can support external solvers using the CUDF format and the internal SAT solver - pkg-ssh(8) is now sandboxed with capsicum if it is available - pkg-ssh(8) now uses poll(2) - Remove StringList usage to improve portability - Rework the build system to use autotools to help portability - Now fetching is done to a temporary location and cleaned up if it fails - Re

Special thanks to Vsevolod Stakhov (vsevolod@)

- Update to 1.2.7

Changes:
  - Only fallback to YAML if UCL parsing fails
  - pkg2ng: Hide warnings about @mtree, @stopdaemon, @comment
    @display and @conflicts
  - Fix escaping issues with COMMENT
  - pkg add: Fix -A to properly mark package as automatic
  - pkg2ng: Fix over NFS
  - pkg2ng: Show message while analyzing shared libraries

Update comment and description for pkg(8)

it is not new generation anymore and it is the current package tool
While here remove "for FreeBSD" as it also works on other OSes

Reported by:	peter

- Update pkg and pkg-devel to 1.2.6

This update includes a security update for possible arbitrary code
  execution from package manifest parsing. All users are advised to
  upgrade ASAP. The base pkg(7) was never affected by this. [1]

Changes:
  * Fix libyaml head-based buffer overflow [1]
  * Fix pkg info -E support for ports, which namely affected
    net/openldap* usage. [2]
  * Fix packages registering themselves as dependencies [3]
  * Bash autocompletion fixes [4]
  * autoremove: Don't try to remove locked packages
  * Support 'pkg bootstrap -f', which will force a reinstall of pkg
    on FreeBSD 10.0+
  * Fix %t timestamp formatter with %{...%} modifiers [5]
  * pkg info: Show date installed
  * Add $daily_status_security_pkgaudit_quiet to control 410.pkg-audit.in
    output verbosity level
  * Add an error when trying to update repository and none are defined [6]
  * Fix typos in manpages [7]

Security:	CVE-2013-6393 [1]
Reported by:	secteam (delphij) [1]
PR:		ports/184797 [2]
Reported by:	Pavel Timofeev <timp87@gmail.com> [2], many
Submitted by:	smh@ [3]
Submitted by:	brd@ [4]
Submitted by:	Jamie Landeg Jones [5]
Submitted by:	Rodrigo Osorio [6]
Submitted by:	Michael Gehring, wblock [7]
With hat:	portmgr
MFH:		2014Q1

Update to 1.2.5: - Manpage improvements - fix $auditfile in pkg audit periodic script - Fix repo-*.sqlite being corrupted when pkg update is interrupted by the user - pkg add now tells the version of the package missing - Strop decoding/encoding all fields, only scripts and description are now encoded/decoded

Fix sefault while cleaning up It only happens if one has list or key/value list in pkg.conf a workaround to update is to comment it out the time to upgrade

Reported by:	many
Pointyhat to:	bapt (again)

Update to 1.2.4 Changes: - Fix segfault in pkg audit -F [1] - Fix multiple segfault when using eventpipe [2] - Fix REPOS_DIR being appended instead of overwritten when modified from pkg.conf

Reported by:	many [1]
Reported by:	kmoore [2]

Update to pkg 1.2.3 Changes: - Workaround a bug in bsd.*.mk on FreeBSD 8.x - Fix a pkg repo segfault - Document aliases in pkg.conf(5) - Be more verbose when refusing a repository configuration file - Sync libucl with upstream (bug fixes) - Fix a fd leak in pkg repo - Fix memory leaks due bad usage of libarchive

- Fix build on 8.x

With hat:	portmgr

Update to 1.2.2 Changelog: - Fix pkg which returns bogus non-zero exit status on success - Better check libucl returns - Fix bad build system resulting in broken binaries on arm and ia64 - Update pkg.conf documentation - Add manpage for pkg config - OOTB support for dragonfly - Lots of fixes in libucl - Fix pkg register complaining about shared libraries not found - Do not resume a jailed or chroo

Special thanks to mat@ (for bug busting) and cognet@ (tracking down 2 issues
on arm and as a side effect fixing on ia64

ports-mgmt/pkg*: Prepare for alternative PORTSDIR support

With the PKG_PORTSDIR make argument set, Release 1.2.2 will properly build
pkg when PORTSDIR doesn't equal the default /usr/ports, as is the standard
case with DragonFly.

Additionally, pkg(8) and pkg-static(8) man pages are conditionally edited
to remove references to the -j option when libjail isn't found on the
system.  This extra-patch should never be used on FreeBSD.

Release pkg 1.2.1 Changes: - Fix pkg rquery always printing index like lines - Fix pkg -vv suggestion so it print something actually usable - Fix shlib's -P and -R options were swapped round. - Replace broken pkg_repos_count() by pkg_repos_total_count() and pkg_repos_activated_count() - Fix parsing of options (in manifest) - pkg add http:// now fetch to a temporary location and cleanup after itsel

First errata: - Fix pkg rquery always printing index like lines [1] - Fix pkg -vv suggestion so it print something actually usable [2]

Reported by:	gjb [1]
Reported by:	ohauer [2]

Release final pkg 1.2 version: - changes since 1.2.0 rc1:   * Couple of style fixes   * Fix loading yaml keywords   * Fix building on Dragonfly   * Autodetect if libelf should be used bundled   * Fix a bug if pkg audit -F got interrupted   * Allow 'enabled' entry from repo configuration to be a string and raise a warning about it

Move WITH_DEBUG check below b.p.m so it works with WITH_DEBUG_PORTS

Approved by:	portmgr (bapt, maintainer)

in case WITH_PKGNG=devel, create pkg-devel latest link as pkg and name the package pkg to allow bulks using the devel version of pkg

- Update to 1.2.0.rc1 - Changes:  * Fix loading of fingerprints  * Fix ssh transport by refactoring  * Skip self upgrade with -F is passed  * Fix pkg info -[q]O  * Fix pkg info -q (with no other options)  * Make fingerprints signature checking actually working

- Fix leftover

With hat:	portmgr

- Support DEBUG

PR:		ports/183277
With hat:	portmgr

Update to pkg 1.2.0 beta2 - Update bundled libucl code (which fixes bugs) - Fix double escaped \n for script and messages - Fix rquery with -e not properly working [1] - rquery can now take a -I argument to output index like lines (needed for bsdconfig) - Fix local database creation (initial) - With build with older bsd.prog.mk - Improved documentation for pkg query

Reported by:	mat [1]

Fix build with older bsd.prog.mk

Update to pkg 1.2.0 b1

Changes:
- Bug fixes in zsh completion
- Lots of bug fixes discovered by Coverity Scan
- New debug level traces
- Auto upgrade of pkg(8) now restart the upgrade process automatically
- Dependencies on library is now automatic via pkg register and pkg
  create
- YAML is replaced by UCL format:

  Both formats are really simular. pkg(8) will falls back on parsing YAML
  when the UCL parser fail. And will emit a warning to the
  user showing a syntax that is compatible with both YAML and UCL.
  More informations on UCL: https://github.com/vstakhov/libucl

- Do not generate catalogs in pkg 1.0 format anymore.
- Working ssh protocol supported for repositories
- New PKG_SSH_ARGS to allow passing custom arguments to ssh command
  used for the ssh:// protocol
- Allow using '?' operator in pkg query expressions
- New git like aliases to allow creating custom commands
- REPO_DIR is now a list instead of a simple string
- packagesite in pkg.conf is deprecated in favour using dedicated
  repository configuration files
- New 'fingerprint' kind of signature:

    if a repository is declared using the fingerprint type of
    signature, a fingerprint directory should also be provided.
    Inside that fingerprint directory should be 2 directories:
    trusted and revoked.  Those directories will contains files (in
    yaml/ucl format) containing the fingerprint of the trusted
    certificated and the revoked ones:

    --- begins --
    function: sha256
    fingerprint: an_hex_representation_of_the_fingerprint
    --- ends ---

    All unknown attribute will be silently ignored to allow extending
    in the future.

    It also support multiple signatures inside the catalog. the
    catalog should provide the signature in the following form:
    name.sig
    name.cert

- pkg add is now able to read the packages from a pipe or a non-regular
  file '-' is an alias for stdin, this also works from pipes, fifos,
  unix domain sockets etc.
- Support for pkg+foo url scheme where foo can be (http, https, ftp).
- pkg info now default on glob matching
- Print a pkg name only once - even if multiple vulns were found -
  when using -q
- Accept empty/comment only configuration files
- vuxml is now the default source for pkg audir
- expat is now bundled (for vuxml)
- pkg info -q is now equivalent of pkg info -qa
- in case pkg info is querying a file or is a single direct match
  query then default on -f
- pkg repo can now take new arguments:
  pkg repo [path] [rsa_key|'signing_command: <command>']

  This allow calling external command to perform the signing and
  pass the checksum to be signed in the command stdin.
- options can now have a description
- new pkg config subcommand to allow direct query of options
- ABI is now checked again using globs:
  a 'noarch' package should just specify: ARCH: 'freebsd:*'
  a package working on both i386 and amd64: ARCH: 'freebsd:9:x86:*'
- Broken incremental pkg repo support was removed.
- Lots of spelling/grammar fixes
- Properly support srv priority/weigh when ordering mirrors
- Use port specified in the SRV entries to connect to a given mirror
- New pkg bootstrap subcommand that is the counter part of the
  pkg(7) bootstrap subcommand
- Allow ARCH to be printed by pkg info
- Allow to hook plugins, before closing the local db if it was
  opened in RW mode
- Improved build system

- Force pkg to not use base libbsdyml, which was available in head|stable/10   for some months. libbsdyml is being removed for 10-R. The bundled libyaml   will be used instead.

Discussed with:	bapt
With hat:	portmgr

- Sync with pkg update   Fix pkg register -i (staged pass mode) not properly respecting @owner/@group

With hat:	portmgr

- Fix spelling of "Upgrades" since it keeps being reported

With hat:	portmgr

- Sync with ports-mgmt/pkg

Changes:
  - Fix @exec/post-install script execution with pkg register -i
  - Fix MTREE not properly being extracted with pkg register -i
  - Fix staging of meta ports that have no files, such as
    mail/squirrelmail-plugins

With hat:	portmgr

Pickup patches from ports-mgmt/pkg so that pkg-devel is also stage ready

Add NO_STAGE all over the place in preparation for the staging support (cat: ports-mgmt)

- Allow this port to build a package so users can switch without   needing ports

Reviewed by:	bapt
With hat:	portmgr

- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)

- Update to 1.1.4

Changes:
 * Fix crash when opening repository in some cases
 * Fix build with -Werror
 * Fix 'pkg install [-f] pkg' not finding results
 * Fix 'pkg upgrade -f' always wanting to upgrade pkg first
 * Fix 'pkg install -R' always wanting to install pkg first
 * Fix backwards compatibility for 1.0-built packages for
   tracking shlibs. This may cause some packages to be
   reinstalled after the repository is updated.
 * Fix pkg (upgrade|fetch|install) -r <repo> crash
 * Fix crash when specifying invalid repo with -r

- Fix build with -Werror

Make portlint happier

- Update to 1.1.3

Changes:

 - Fix repository signing verification with new format during update
 - Disable terminal title setting
 - Fix %a/%k returning true/false instead of 0/1
 - Various memory/fd leaks have been fixed
 - Fixed pkg self-upgrade detection
 - ZSH completion fixes
 - Several crashes fixed

With hat:	portmgr