security/openssh-portable 10.6.p1,1

Mark OVERWRITE_BASE as IGNORE.

Keep it as an option as otherwise the user won't be notified that
their configuration is wrong and it will just install to PREFIX
instead, which would be surprising.

- Fix HPN patches for 6.7p1 - Add back HPN and NONECIPHER for the default options and bump PORTREVISION   due to this.

- Unbreak KERB_GSSAPI option by using Debian's patch.

I am serving the patch exactly as-is from their site. Obtained from:
  http://sources.debian.net/data/main/o/openssh/1:6.7p1-3/debian/patches/gssapi.patch

Unmark X509 option as BROKEN after fixed in r374821

- Update X509 patch to 8.2 which now supports OpenSSH 6.7p1   No PORTREVISION bump since it was BROKEN before with X509.

- Update to 6.7p1.

Several patches do not currently apply. Use security/openssh-portable66 for:
  HPN, NONECIPHER, KERB_GSSAPI, X509.

- Add a TCP_WRAPPER patch to re-enable support after it was removed upstream.

Add USES=alias to several ports

Alias is a new USES tool that allows DragonFly to masquerade as FreeBSD
by setting CFLAGS+= -D__FreeBSD__.  For some ports, this fixes the build
without the need for additional patches.

Approved by:	portmgr (bapt, blanket)

Note my intentions with OVERWRITE_BASE

- Mark OVERWRITE_BASE and security/openssh-portable-base as DEPRECATED.   These will be removed on January 1 2015.

Really ports should not be touching the base system at all.

  This option is a big foot-shoot problem:

  1. Recent versions of FreeBSD such as 9.3, 10.0, 10.1+, now remove all ssh
     files from /usr if you 'make delete-old' with WITHOUT_SSH. This results in
     removing the overwrite base files.
  2. Uninstalling the package leaves the system with no ssh.
  3. Running installworld without WITHOUT_SSH results in overwriting the
     package, or giving false-positive 'pkg check -s' errors.
  4. The port fails to pass QA checks because it removes system files.

Support multiple ListenAddress ports

Reported by:	rustamabd@gmail.com

net/openldap24-*: - Convert to USES=libtool and bump dependent ports - Avoid USE_AUTOTOOLS - Don't use PTHREAD_LIBS - Use MAKE_CMD

databases/glom:
- Drop :keepla
- Add INSTALL_TARGET=install-strip

databases/libgda4* databases/libgda5*:
- Convert to USES=libtool and bump dependent ports
- USES=tar:xz
- Use INSTALL_TARGET=install-strip
- Use @sample

databases/libgdamm:
- Drop :keepla
- USES=tar:bzip2
- Use INSTALL_TARGET=install-strip

databases/libgdamm5:
- Add INSTALL_TARGET=install-strip
- Drop --enable-static (inherited from old repocopy)

devel/anjuta x11-toolkits/py-gnome-extras:
- Drop :keepla

dns/powerdns dns/powerdns-devel:
- Convert to USES=libtool
- Add INSTALL_TARGET=install-strip
- Disable static modules
- Stop creating library symlinks with .0 suffix, not needed for dynamically
  opened modules

mail/dovecot2:
- Add USES=libtool

mail/dovecot2-pigeonhole:
- Drop CONFIGURE_TARGET (incorrect for Dragonfly)
- Add USES=libtool and INSTALL_TARGET=install-strip

math/gnumeric:
- USES=libtool tar:xz

Approved by:	portmgr (implicit, bump unstaged ports)

- Update to "6.6.1" [1] - Switch to using @sample keyword, fixing orphans.

Upstream note on "6.6.1" [1]:

  OpenSSH 6.5 and 6.6 sometimes encode a value used in the curve25519
  key exchange incorrectly, causing connection failures about 0.2% of
  the time when this method is used against a peer that implements
  the method properly.

  Fix the problem and disable the curve25519 KEX when speaking to
  OpenSSH 6.5 or 6.6. This version will identify itself as 6.6.1
  to enable the compatability code.

[1] https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032494.html

Fix minor plist issues from check-plist

- Update GSS API Key Exchange patch with working version.

PR:		ports/183006
Submitted by:	Garrett Wollman (via email)
Tested by:	Garrett Wollman

- Update to 6.6 - Capsicum patch no longer needed - Update X509 patch to 7.9

Changelog: http://www.openssh.org/txt/release-6.6

- Fix build with HEIMBAL_BASE

PR:		ports/186830
Reported by:	Robert Simmons <rsimmons0@gmail.com>

- Fix RC script

Pointyhat to:	bdrewery
Reported by:	Kenta S. <kentas@hush.com>

- Update to 6.5   ChangeLog: http://www.openssh.org/txt/release-6.5

- Update X509 patch to 7.8
- Update LIB_DEPENDS to new format
- Revert r328706 and re-enable privilege separation sandboxing by default
  as the issue causing crashes has been fixed upstream
- capsicum(4) is now enabled upstream. A local patch is added to fix an issue
  with it [1]
- KERB_GSSAPI is marked BROKEN. It does not build.
  This patch lacks an upstream and I have no way to test it. It needs
  a non-trivial amount of refactoring for 6.5 as the key handling API
  has changed quite a bit.

Submitted by:	pjd@ [1]

- License is all of BSD2,BSD3,MIT,public domain,BSD-Style,BEER-WARE,   "any purpose with notice intact",ISC-Style. The framework does not   support such a case easily.   See http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD

- Fix packaging when not using HPN patches

PR:		ports/183895
Reported by:	mat

- Update to 6.4p1

This release fixes a security bug:

 * sshd(8): fix a memory corruption problem triggered during rekeying
   when an AES-GCM cipher is selected. Full details of the vulnerability
   are available at: http://www.openssh.com/txt/gcmrekey.adv

Security:	http://www.openssh.com/txt/gcmrekey.adv

- Update to 6.3p1   Changelog: http://www.openssh.org/txt/release-6.3 - Use options helpers where possible - Use upstream patch mirror for x509 and HPN - Update HPN patch to v14 and use upstream version - Add option NONECIPHER to allow disabling NONE in HPN patch - Update x509 patch from 7.4.1 to 7.6 - Add support for LDNS and enable by it and VerifyHostKeyDNS/SSHFP by default.   See http://lists.

- Now that :DEFAULT can be used in PATCH_SITES (fixed in 329679),   depend on the upstream mirror for the x509 patch and my mirror   as a fallback

Remove useless -c flag

Perl has not been needed as a direct dependency since 6.0

- Fix KERB_GSSAPI incorrectly using a predictable cache file.   This was due to a mistake in r319062 when porting the patch from 5.8 to 6.2

There is no active upstream for this patch. For reference here are the
  changes made in the patch:

  --- -	2013-10-03 11:07:21.262913573 -0500
  +++ /tmp/zdiff.XXXXXXXXXX.STScEeSI	2013-10-03 11:07:21.000000000 -0500
  @@ -183,7 +183,7 @@
	  if (ret < 0 || (size_t)ret >= sizeof(ccname))
		  return ENOMEM;

  -+#ifdef USE_CCAPI
  ++#ifndef USE_CCAPI
	  old_umask = umask(0177);
	  tmpfd = mkstemp(ccname + strlen("FILE:"));
	  oerrno = errno;

PR:		ports/180419
Reported by:	Garrett Wollman <wollman@khavrinen.csail.mit.edu>

Mark IGNORE if KERB_GSSAPI incorrectly selected

Cleanup patch-readconf.c to only have 1 diff

Update descriptions to match current conventions

- Copy base r251088 over (which removes a patch) and disable default sandbox   privilege separation as it causes crashes when using AES crypto devices.   This now uses 'yes' for UsePrivilegeSeparation instead of 'sandbox' by   default

Reminded by:	Garrett Wollman

Fix sshd.8 referring to LOCALBASE with OVERWRITE_BASE

Don't extract mtree with OVERWRITE_BASE

Convert to stagedir

- Add NO_STAGE until validated to be safe for upcoming staging support

- Convert to new perl5 framework

Approved by:	bdrewery@ (maintainer)

Add an openssh-portable-base slave port to install with OVERWRITE_BASE

Add LICENSE

- In rc script, be consistent in reload and check for and generate keys   if needed, as well as checking for port collision with base sshd.

Reported by:	delphij

- Update and re-add KERB_GSSAPI gsskex patch.   I did very minor porting of the upstream patch to make   it apply.   Note that this currently does not build with base heimdal, but   does build with port MIT or port HEIMDAL. - Bump PORTREVISION in case someone built the update, expecting   this option to work and now have a broken ssh.

PR:		ports/178885
Reported by:	Garrett Wollman <wollman@csail.mit.edu>

- Fix sshd crash when not using HPN   This was due to not including the canohost.h header for our   base customization to respect class login restrictions. I had   missed this as I was only tested with the default (HPN enabled)   which already was including this header.

Reported by:	runelind in ##freenode
Tested by:	runelind, myself
Reported by:	Krzysztof Stryjek

Mark BROKEN as I have received 2 separate reports of crashing.

- Update to 6.2p2

- The LPK patch has been updated but is obsolete, deprecated and
  untested. It has been replaced by AuthorizedKeysCommand
- The upstream HPN's last update was for 6.1 and is mostly
  abandoned. The patch has had bugs since 5.9. I have reworked
  it and split into into HPN and AES_THREADED options. The
  debugging/logging part of the patch is incomplete. I may
  change the patch to more closely match our base version
  eventually.
- The KERB_GSSAPI option has been removed as the patch has not
  been updated by upstream since 5.7
- sshd VersionAddendum is currently not working as intended;
  it will be fixed later to allow removing the port/pkg version.
- Update our patchset to match latest base version
- Bring in ssh-agent -x support from base
- I incrementally updated the port from 5.8 up to 6.2p2 along
  with patches. You can find all of the versions at
  https://github.com/bdrewery/openssh

Changes:
    http://www.openssh.com/txt/release-5.9
    http://www.openssh.org/txt/release-6.0
    http://www.openssh.org/txt/release-6.1
    http://www.openssh.org/txt/release-6.2
    http://www.openssh.org/txt/release-6.2p2

- Bring in r199804 and r206397 from base to avoid killing sshd in   high-pressure swapping environments

- Remove copyright as it was a base customization that was removed in   base r213250

- Remove CHROOT option and patch. ChrootDirectory was added in 5.0   to achieve the same thing.

Fix xauth and ssh-askpass still being expected in /usr/X11R6

This was fixed in base in 2007 in r169966

- Add support for base and port Heimdal for Kerberos

PR:		ports/167554
Requested by:	Volodymyr Kostyrko <c.kworr@gmail.com>

- Remove compatibiliy for FreeBSD <4.x   * /var/empty has been in hier(7) since 4.x   * User sshd has been in base since 4.x   * Simplify a patch for realhostname_sa(3) usage - Remove SUID_SSH - It was removed from ssh in 2002 - Fix 'make test' - Add some hints into the patches on where they came from - Mirror all patches - Move LPK patch out of files/ - Remove the need for 2 patches   * Removal o

PR:		ports/174570 [1]
Submitted by:	oleg <proler@gmail.com> [1]
Obtained from:	https://bugzilla.mindrot.org/show_bug.cgi?id=2016 (upstream) [1]
Feature safe:	yes

- Fix runtime crash on CURRENT due to import of NetBSD strnvis() [1]   which differs in prototype from OpenBSD strnvis() [2]

[1] http://lists.freebsd.org/pipermail/freebsd-stable/2013-January/071703.html
[2] http://gnats.netbsd.org/44977

Submitted by:	dim

- Fix all cases of 'No newline at end of file' in ports tree

Approved by: portmgr (bapt)