security/doas6.4

*/*: Refresh checksums for on the fly archives on codeberg.org

See https://codeberg.org/Codeberg/Community/issues/2861

Approved by:	blanket

security/doas: Update 6.3p13 => 6.4

Changelog:
- Fix some typos in the documentation.
- Cause doasedit to better handle shell variables and find the best
  text editor for altering files.

Improve port:
- Move BINMODE=4755 to plist: "@(,,4755) bin/doas" - BINMODE is applied
  universally (to all programs and scripts). This means helper scripts
  like doasedit, which are meant to be run as a regular user, were also
  installed as setuid. This is a potential security issue.
- Move plist to file.
- Add "@sample" for "etc/doas.conf.sample".

PR:		293628
Sponsored by:	UNIS Labs
MFH:		2026Q2
Co-authored-by:	Vladimir Druzenko <vvd@FreeBSD.org>

security/doas: update to 6.3p13 and switch to new upsteam

The upstream repository has migrated from GitHub to CodeBerg. There
has also been a new update which fixes editing files with a leading
slash (/) character and enables building on illumos/OmniOS.

PR:		289344
Reported by:	Jesse Smith <jsmith@resonatingmedia.com> (maintainer)

security/{open,}doas: add CONFLICTS to each other

They install files with the same names.

PR:		279598
Reported by:	fluffy (via email)
Fixes:		2820df617d13 (new port: portable version of OpenBSD's doas)

security/doas: update to 6.3p12

6.3p11:
* Cleaned up error checking for temporary files, removed redundant check.
* Fixed status check for copy and editor launch.

6.3p12:
* Make sure doasedit can work when target file to edit has a leading slash
character. ie A full path name is used.
* Update doas.1 manual page to indicate problems with piping input
on Linux when processes are launched by doas.

Upstream release announcement:
https://github.com/slicer69/doas/releases/tag/6.3p11
https://github.com/slicer69/doas/releases/tag/6.3p12

PR:	278897
MFH:	2024Q2

security/doas: update to 6.3p10

This is a minor upgrade which includes two fixes for the doasedit utility,
allowing it to work with files containing special characters and including
more error checking.

Upstream release announcement:
https://github.com/slicer69/doas/releases/tag/6.3p10

PR:	278683
MFH:	2024Q2

MAN?PREFIX: eleminate its usage  and move man to share/man

security/doas: Update to 6.3p9

ChangeLog: https://github.com/slicer69/doas/releases/tag/6.3p9

PR:		266413
Reported by:	jsmith@resonatingmedia.com (maintainer)

security/doas: update to 6.3p7

PR:		266387
Reported by:	jsmith@resonatingmedia.com (maintainer)

Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)

Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)

security/doas: Add CPE information

Approved by:	portmgr (blanket)

security/doas: Update to 6.3p6

ChangeLog: https://github.com/slicer69/doas/releases/tag/6.3p6

PR:		258483

security/doas: port update to 6.3p5

ChangeLog: https://github.com/slicer69/doas/releases

PR:		256447
Approved by:	dbaio, garga (mentors, implicit)

One more small cleanup, forgotten yesterday. Reported by:	lwhsu

Remove # $FreeBSD$ from Makefiles.

- Update to 6.3p4

PR:		253010
Submitted by:	jsmith@resonatingmedia.com (maintainer)

security/doas: update to 6.3p2

Changes:	https://github.com/slicer69/doas/releases/tag/6.3p1
Changes:	https://github.com/slicer69/doas/releases/tag/6.3p2
PR:		248524
Submitted by:	jsmith@resonatingmedia.com (maintainer)

security/doas: Add upstream doas.conf.sample

PR:	247496
Submitted by:	ed.arrakis@gmail.com
Approved by:	jsmith@resonatingmedia.com (maintainer)

security/doas: update to 6.3.

PR:		247467
Submitted by:	maintainer (jsmith resonatingmedia com)

security/doas: Manual page cleanup

PR:		245238
Submitted by:	jsmith@resonatingmedia.com (maintainer)
MFH:		2020Q2

security/doas: upgrade 6.2 -> 6.2p4

PR:		242931
Submitted by:	jsmith@resonatingmedia.com (maintainer)
Relnotes:	https://github.com/slicer69/doas/releases/tag/6.2p4

security/doas: Update to 6.2

PR:		240305
Submitted by:	jsmith@resonatingmedia.com (maintainer)

security/doas: Update to 6.1

* Update the pkg-message to give users that install/upgrade the port some
  info about the changed behavior regarding the environment variables. [1]

* Make the configuration of target user's sanitized $PATH that is set at
  compile time more flexible by enabling users to configure it via
  _GLOBAL_PATH. [2]

* Also pet portlint/portclippy by placing USES to the top of the USES block
  and remove the superfluous occurence of GH_PROJECT while I'm here.

Changelog:

* Most environment variables are no longer copied to the target user's
  environment. This avoids corrupting files through use of $HOME, for
  example.

  When environment variables are required, keepenv can be set in the
  doas.conf file.

* The target user's sanitized $PATH can be set at compile time to avoid
  passing malicious executables to the target user's path.

https://github.com/slicer69/doas/releases/tag/6.1

PR:		239629
Submitted by:	jsmith@resonatingmedia.com (maintainer)
Approved by:	jsmith@resonatingmedia.com (maintainer) [1] [2]
MFH:		2019Q3

security/doas: Convert pkg-message to UCL

security/doas: Port update to 6.0p3

PR:		236465
Submitted by:	jsmith@resonatingmedia.com (maintainer)

Update to 6.0p2.

PR:		222936
Submitted by:	maintainer

security/doas: Update to 6.0p1

This update brings the security/doas port up to date with upstream.
This gives us the added benefit of restricted path searching.  Which
means if the admin puts a relative path in the doas.conf file, doas
will limit the number of places where the executable can be found.
This prevents users from putting malicious executables with the same
name in their custom path.

PR:		222092
Submitted by:	jsmith@resonatingmedia.com (maintainer)
MFH:		2017Q3

security/doas: Update to version 6.0p.

- Pull tarball from a GitHub release rather than a commit.
- Update license information.  There is code under BSD2CLAUSE and code
  under ISCL.

PR:		217176
Submitted by:	jsmith@resonatingmedia.com (maintainer)
Approved by:	mat, swills (mentor, implicit)
Differential Revision:	https://reviews.freebsd.org/D9664

- Update to 5.9p7

PR:		214414
Submitted by:	jsmith@resonatingmedia.com(maintainer)

Update to version 5.9p6

PR:		212975
Submitted by:	maintainer

security/doas: Update to 5.9p5

This update enforces the correct uid and gid when -u switch is used.

PR:		211622
Reported by:	telnetuserid@sdf.org
Submitted by:	jsmith@resonatingmedia.com (maintainer)
Approved by:	koobs, adamw (mentors)
Relnotes:	https://github.com/slicer69/doas/releases/tag/v5.9-5
Differential Revision:	https://reviews.freebsd.org/D7630

Update to 5.9p4, which fixes a bug where command output is not displayed properly when the user authenticates with "nopass" specified in the doas.conf configuration file.

PR:		210851
Submitted by:	jsmith@resonatingmedia.com (maintainer)

security/doas: 5.9p1 -> 5.9p2

- fixed a bug where, when the user authenticates successfully as root,
  only the user's effective user id (euid) becomes zero (0).
  This leads to file permission errors when performing upgrades or
  other file-oriented operations.
- introduced gmake as a dependency as it is needed to process upstream's
  makefile.

PR:		210596
Submitted by:	jsmith@resonatingmedia.com (maintainer)

Fix filename in distinfo.

PR:		210553
Submitted by:	t@tobik.me

Change PORTREVISION to something sensible as upstream did not change.

Reported by:	mat

Missed the fact that ${ETCDIR} includes the port's name.

Submitted by:	@mordin_ on Twitter.

Update to commit 720db72 to fix a security issue.

Reported by:	Bryan Steele (@canadianbryan on Twitter)

New port: security/doas

The doas program allows users to run commands as another user (usually
root). The doas program was written by the OpenBSD team to provide a
lightweight, simplified (and more secure) alternative to the sudo command.

Original upstream (OpenBSD) source:
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/doas/

FreeBSD version: https://github.com/slicer69/doas

NOTE: I added the two patch files to workaround issues mentioned in the PR
about hardcoding of /usr/local.

PR:		210473
Submitted by:	jsmith@resonatingmedia.com
Modified by:	jrm@ftfl.ca (see PR) and me (roberto)