security/shibboleth-sp 3.5.2

Upgrade shibboleth-sp 2.6 and its tool chain

Missed two occurences of ${PORTSDIR}/.

With hat:	portmgr
Sponsored by:	Absolight

Remove ${PORTSDIR}/ from dependencies, categories r, s, t, and u.

With hat:	portmgr
Sponsored by:	Absolight

Update xerces-c3 and shibboleth to latest versions

The update in xerces fixes a buffer overflow security problem that exposes the
possibility of a denial of service attack, and could conceivably result in
remote code execution.

Users of Shibboleth or any other service usingi the xerces-c3 xml library are
recommended to upgrade promptly.

URL:	http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt
Security:	CVE-2016-0729

- Convert to @sample - Cleanup plist

Remove UNIQUENAME and LATEST_LINK.

UNIQUENAME was never unique, it was only used by USE_LDCONFIG and now,
we won't have conflicts there.

Use PKGBASE instead of LATEST_LINK in PKGLATESTFILE, the *only* consumer
is pkg-devel, and it works just fine without LATEST_LINK as pkg-devel
has the correct PKGNAME anyway.

Now that UNIQUENAME is gone, OPTIONSFILE is too. (it's been called
OPTIONS_FILE now.)

Reviewed by:	antoine, bapt
Exp-run by:	antoine
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D3336

The new shibboleth will refuse to accept -u when it was already su:ed to that user. Trust shibboleth to change user.

Shibboleth SP software crashes on well-formed but invalid XML.

The Service Provider software contains a code path with an uncaught
exception that can be triggered by an unauthenticated attacker by
supplying well-formed but schema-invalid XML in the form of SAML
metadata or SAML protocol messages. The result is a crash and so
causes a denial of service.

You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or later.
The easiest way to do so is to update the whole chain including
shibboleth-2.5.5 an opensaml2.5.5.

URL:    	http://shibboleth.net/community/advisories/secadv_20150721.txt
Security:	CVE-2015-2684

Update Shibboleth and opensaml to latest version.

Remove $FreeBSD$ from patches files everywhere.

With hat:	portmgr
Sponsored by:	Absolight

into the fire... last commit didnt't really help, it has to be part of SUB_LIST as well

Spelling error, WWWGROUP is really WWWGRP PR:	191118

revert r354688 and fix the error instead, it should be @owner, not @user...

remove @user @group since it does not work with old pkg_tools [https://wiki.freebsd.org/ports/StageDir] recommends using them, but I see no point in using both Reported by: Peter Olsson

Update Shibboleth to 2.5.3, a bug fix release.

Change the cache directory back to the built-in default, /var/cache, and
force mode 755 on that directory. (see r258664 in head why this is a good thing).

Add odbc support as suggested in ports/189410.

Add NO_STAGE all over the place in preparation for the staging support (cat: security)

- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)

Move /var/cache/shibboleth to /var/db/shibboleth, since /var/cache has mode 750 and cannot be read by the www user. According to hier(7):    db/   misc. automatically generated system-specific database files so /var/db seems like the best choice

- Don't remove directories not created by this port

Reported by:	pkg (DEVELOPER_MODE)

Security update for apache-xml-security-c. Dependant ports, especially shibboleth2-sp, opensaml2, xmltooling and log4shib should all be updated.

Security: CVE-2013-2156

Add build dependency on boost for shibboleth and opensaml. PR:	ports/179431

Don't remove /var/*/shibboleth with rm -rf, so we don't "pull out the carpet from underneath" a running shibd. Hence allow updating while the old shibd is still running.

Update Shibboleth-sp and its tool chain to 2.5.1.

Note that from 2.5, shibd is run as the user shibd.  The port tries to fix the
key file ownership but if you have changed the file name of the key from the
default sp-key.pem, make sure you chown your key file(s) to user shibd.

Also, take maintainership of the entire tool chain (approved by all previous
maintainers).

Incorporates the ideas suggested by Craig Leres [177668], making sure that the
ssl key is not added to the package.

PR:	177668, 178694

Convert security to new options framework

- remove www/apache20 and devel/apr0 - s/USE_APACHE= 20+/USE_APACHE= 22+/ - unify s/YES/yes/ - cleanup APACHE_VERSION <= 22 usage - add entry to MOVED

with hat apache@

- Fix permissions on /var/run/shibboleth

In the rc.d scripts, change assignments to rcvar to use the literal name_enable wherever possible, and ${name}_enable when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.

- Update to 2.4.3 - Update home page while here - Take maintainership while here

PR:		ports/159195
Approved by:	linimon

- Update to latest versions

PR:		ports/157822
Submited by:	Palle Girgensohn <girgen@FreeBSD.org>
Approved by:	maintainer timeout

- Don't overwrite/remove config files on package installation/uninstall - Obey shibboleth_sp_flags, shibboleth_sp_program and shibboleth_sp_pidfile

PR:		ports/155876
Submitted by:	Craig Leres <leres at ee.lbl.gov>
Approved by:	maintainer timeout

Sync to new bsd.autotools.mk

Punt autoconf267->autoconf268

Round one migration of ports from automake{19,110} to automake111

Autotools update.   Read ports/UPDATING 20100915 for details.

Approved by:	portmgr (for Mk/bsd.port.mk part)
Tested by:	Multiple -exp runs

Begin the process of deprecating sysutils/rc_subr by s#. %%RC_SUBR%%#. /etc/rc.subr#

2010-01-08 x11-toolkits/gtkada-gps: has been broken for 3 months 2010-01-08 x11-fm/velocity: has been broken for 7 months 2010-01-08 x11-drivers/xf86-video-nsc: has been broken for 5 months 2010-01-08 www/rubygem-merb: has been broken for 5 months 2010-01-08 security/shibboleth-sp: has been broken for 3 months

- Update to 2.3.1.

PR:		ports/136034
Submitted by:	Steve Wills <steve@mouf.net>
Approved by:	janos.mohacsi@bsd.hu (maintainer timeout)

- WITH_APACHE22 is deprecated

With Hat: apache@

This port has been broken for 3+ months, thus

- Mark DEPRECATED and schedule for expiration in one month

With hat:	portmgr

Mark BROKEN on i386-6 as well.

Mark as only for i386-6.

Based on:

PR:		ports/115474
Submitted by:	maintainer

Shibboleth is standards-based, open source middleware software which provides Web Single SignOn (SSO) across or within organizational boundaries. It allows sites to make informed authorization decisions for individual access of protected online resources in a privacy-preserving manner.

This software is a C++ implementation of the Service Provider
component of the Shibboleth can be used in Apache Web servers.  The
service provider manages secured resources. User access to resources
is based on assertions received by the service provider (SP) from
an identity provider.

WWW:	http://shibboleth.internet2.edu/

PR:		ports/114663
Submitted by:	Janos Mohacsi <janos.mohacsi@bsd.hu>