CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

shells/ksh1.0.10

ksh93u+m is the renewed development of ksh93 based on AT&T ksh93u+m (stable)

Maintainer
cy@FreeBSD.org
Packages
ksh 1.0.10
Upstream
up to date
CPE
ksh_project:ksh
WWW
http://www.kornshell.com/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (22)

Dima Panov (fluffy) · 1.0.10
shells/ksh: mark as PIE_UNSAFE (+)

Reported by:	bulk -t

Approved by:	portmgr (blanket)

Sponsored by:	Future Crew, LLC
06cbfc93c7
Cy Schubert (cy) · 1.0.10
shells/ksh: Update to 1.0.10

Full changelog at:
https://github.com/ksh93/ksh/compare/v1.0.9...v1.0.10

Main changes between 93u+m/1.0.9 and 93u+m/1.0.10:
- Fixed a serious and longstanding bug in the arithmetic subsystem that was
   triggered on non-Intel processors (such as ARM): any division of an
   integer by a negative integer threw a spurious "divide by zero" error.
- Fixed a regression where a broken pipe signal (SIGPIPE), when occurring in
   a pipe construct within a subshell, caused incorrect signal handling in the
   parent/main shell, in some cases causing a script to abort.
- Fixed a bug where printf %T, after having printed the time in UTC once
   with the TZ variable set to "UTC", would always print the time in UTC from
   then on, even if the TZ variable was changed to another time zone.
- The history expansion character ('!' by default) is now not processed when
   immediately following '${'. This makes it possible to use expansion syntax
   like ${!varname} and ${!prefix@} on the interactive command line with the
   histexpand option on; these no longer trigger an "event not found" error.
- The shell is now capable of handling more than 32767 simultaneous
   background jobs, subject to system limitations.

Reported by:	Martijn Dekker <martijn@inlv.org> (Upstream)
784d45c32d
Cy Schubert (cy) · 1.0.9
shells/ksh: Update to 1.0.9
6d3749e0b0
Baptiste Daroussin (bapt) · 1.0.8_1
MAN?PREFIX: eleminate its usage  and move man to share/man
e4610fcb8b
Cy Schubert (cy) · 1.0.8
shells/ksh: Update to 1.0.8
11e7e0df88
Cy Schubert (cy) · 1.0.7
shells/ksh: Update to 1.0.7

From the announcement email:

Full changelog at:
https://github.com/ksh93/ksh/compare/v1.0.6...v1.0.7

Main changes between 1.0.6 and 1.0.7:
- Fixed a hang in command substitutions (introduced in 93u+m/1.0.0)
   that was triggered when redirecting standard output within a
   command substitution, in combination with other factors. E.g.,
   the following no longer hangs:
         { v=$(redirect 2>&1 1>&9); } 9>&1
- Fixed a crash on trying to append an indexed array value to an
   unset name reference, e.g.: nameref unsetref; unsetref+=(foo
   bar). This now produces a "removing nameref attribute" warning
   before performing the assignment.
- Fixed: assignments like name=(...) to arrays did not preserve the
   array and variable types; similarly, assigning an empty set () to
   a compound indexed array caused the -C attribute to be lost.
- Fixed incorrect rejection of the tab key while reading input
   using the 'read' built-in command.
- Fixed a bug in printf %T: when using dates and times in the past,
   time zones for the present were incorrectly used, ignoring
   historical changes.
b51504dc11
Po-Chuan Hsieh (sunpoet) · 1.0.6
shells/ksh: Remove blank line

Approved by:	portmgr (blanket)
f10176d67c
Cy Schubert (cy) · 1.0.6
shells/ksh: Update to 1.0.6

From the announcement:

This is an urgent bugfix release that fixes a serious regression in
pathname expansion, see: https://github.com/ksh93/ksh/issues/660
The previous 1.0.5 release is withdrawn and should not be used.

Main changes between 1.0.5 and 1.0.6:

- Fixed a serious regression in pathname expansion where quoted wildcard
   characters were incorrectly expanded if a pattern contains both a brace
   expansion and a variable expansion.
- Fixed a bug where the command to launch a full-screen editor (^X^E in
   emacs and 'v' in vi) could cause the wrong command line to be edited
   if two shell sessions share a .sh_history file.

1.0.5 had a large amount of bugfixes compared to 93u+m/1.0.4. In summary:

- Fixed various bugs causing crashes.
- Fixed many bugs in the emacs and vi line editors, in command completion,
   and in file name completion.
- Fixed various bugs in the handling of quotes, backslash escapes and braces
   when processing shell glob patterns (e.g. in pathname expansion and
'case').
- ksh now throws a panic and exits if a read error (such as an I/O error)
   occurs while trying to read the next command(s) from a running script.
- Fixed many bugs in 'printf' and 'print -f' built-in commands, including:
   . Multiple bugs causing incorrect output for relative date
specifications,
     e.g., printf %T\\n 'exactly 20 months ago' now outputs a correct
result.
   . More printf bugs with mix and match of % and %x$.
   . A data corruption bug when using %B with 'printf -v varname'.
   . A bug causing double evaluation of arithmetic expressions.
- Fixed a bug where 'unset -f commandname', executed in a subshell, hides
   any built-in command by the same name for the duration of that subshell.
- Fixed ${var/#/string} and ${var/%/string} (with anchored empty pattern)
   to work as on mksh, bash and zsh; these are no longer ineffective.
- Fixed incorrect result of array slicing ${array[@]:offset:length} where
   'length' is a nested expansion involving an array.
- Command names can now end in ':' as they can on other shells.
- Fixed a spurious syntax error in compound assignments upon encountering a
   pair of repeated opening parentheses '(('.
- Fixed spurious syntax error in ${parameter:offset:length}: the arithmetic
   expressions 'offset' and 'length' may now contain the operators ( ) & |.
- Fixed a parsing bug in the declaration of .sh.math.* arithmetic functions.
- Fixed nameref self-reference loop detection for more than two namerefs.
- Several improvements to the POSIX compatibility mode.
- Many more minor and/or esoteric bugfixes.
f3cb8cd9be
Cy Schubert (cy) · 1.0.5_2
shells/ksh*: Fix ksh 1.0.5 Regression (issue #660) version 2

From the upstream patch description:

Patch version two. In mac_copy(), don't internally backslash-escape
a backslash in a glob pattern bracket expression. This also fixes
the #549 regression reintroduced by the previous patch, at least for
standard glob patterns. For this, we need to use the bracketexpr flag
(introduced as a copyto() local variable in 6c73c8c) in mac_copy(),
so we move it to the Mac_t struct, making it globally accessible.
Initialisation is automatic.
6f567e62fa
Cy Schubert (cy) · 1.0.5_1
shells/ksh: Fix ksh 1.0.5 Regression (issue #660)

From issue #660:

Globs are not expanded with the following:

% echo "/"{bin,sbin}"/*"
/bin/* /sbin/*

% v=/; echo "$v"bin"/*"
/bin/*

But globbing is unexpectedly performed if both parameter substitution
and brace expansion are present:

	% v=/; echo "$v"{bin,sbin}"/*"
	[output omitted for the sake of brevity]

Obtained from:	https://github.com/ksh93/ksh/issues/660
MFH:		2023Q3
a2ba1fd2c5
Cy Schubert (cy) · 1.0.5
shells/ksh: Update 1.0.4 --> 1.0.5

The release email outlined the following changes:

This release has a large amount of bugfixes compared to 93u+m/1.0.4. In
summary:

- Fixed various bugs causing crashes.
- Fixed many bugs in the emacs and vi line editors, in command completion,
   and in file name completion.
- Fixed various bugs in the handling of quotes, backslash escapes and braces
   when processing shell glob patterns (e.g. in pathname expansion and
'case').
- ksh now throws a panic and exits if a read error (such as an I/O error)
   occurs while trying to read the next command(s) from a running script.
- Fixed many bugs in 'printf' and 'print -f' built-in commands, including:
   . Multiple bugs causing incorrect output for relative date
specifications,
     e.g., printf %T\\n 'exactly 20 months ago' now outputs a correct
result.
   . More printf bugs with mix and match of % and %x$.
   . A data corruption bug when using %B with 'printf -v varname'.
   . A bug causing double evaluation of arithmetic expressions.
- Fixed a bug where 'unset -f commandname', executed in a subshell, hides
   any built-in command by the same name for the duration of that subshell.
- Fixed ${var/#/string} and ${var/%/string} (with anchored empty pattern)
   to work as on mksh, bash and zsh; these are no longer ineffective.
- Fixed incorrect result of array slicing ${array[@]:offset:length} where
   'length' is a nested expansion involving an array.
- Command names can now end in ':' as they can on other shells.
- Fixed a spurious syntax error in compound assignments upon encountering a
   pair of repeated opening parentheses '(('.
- Fixed spurious syntax error in ${parameter:offset:length}: the arithmetic
   expressions 'offset' and 'length' may now contain the operators ( ) & |.
- Fixed a parsing bug in the declaration of .sh.math.* arithmetic functions.
- Fixed nameref self-reference loop detection for more than two namerefs.
- Several improvements to the POSIX compatibility mode.
- Many more minor and/or esoteric bugfixes.
141cb5d09e
Cy Schubert (cy) · 1.0.4
shells/ksh*: Remove BROKEN for missing sbrk()

As of Jan 26, 2021, ksh (ksh93/ksh) no longer needs sbrk(). Remove
BROKEN for architectures that don't have sbrk(2). See upstream issue
https://github.com/ksh93/ksh/issues/154.
79bdbf328c
Cy Schubert (cy) · 1.0.4
shells/ksh*: Update descriptions

Update ksh ports descriptions to more accurately reflect what they are.

Reported by:	 "Joseph Holsten" <joseph@josephholsten.com>
fd44857c89
Cy Schubert (cy) · 1.0.4
shells/ksh: Remove the now expired ksh2020 from CONFLICTS.
b50fe1ebe5
Cy Schubert (cy) · 1.0.4
shells/ksh*: Permanently fix LLVM15 build

Fix aso atomics broken by LLVM:

/wrkdirs/usr/ports/shells/ksh/work/ksh-1.0.4/src/lib/libast/aso/aso.c
/wrkdirs/usr/ports/shells/ksh/work/ksh-1.0.4/src/lib/libast/aso/aso.c:839:10: error: incompatible integer to pointer conversion passing 'uint64_t' (aka 'unsigned long') to parameter of type 'void *' [-Wint-conversion]
                return _aso_casptr((void**)p, o, n);
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
./FEATURE/aso:19:66: note: expanded from macro '_aso_casptr'
                                                                      ^~~~~~~~~~~
/wrkdirs/usr/ports/shells/ksh/work/ksh-1.0.4/src/lib/libast/aso/aso.c:839:10: error: incompatible integer to pointer conversion passing 'uint64_t' (aka 'unsigned long') to parameter of type 'void *' [-Wint-conversion]
                return _aso_casptr((void**)p, o, n);
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
./FEATURE/aso:19:78: note: expanded from macro '_aso_casptr'
                                                                                  ^~~~~~~~~~~
2 errors generated.
mamake [lib/libast]: *** exit code 1 making aso.o
mamake: *** exit code 1 making lib/libast
mamake: *** exit code 1 making all
package: creating flat view
package: make failed at Fri Feb 10 06:00:01 UTC 2023 in /wrkdirs/usr/ports/shells/ksh/work/ksh-1.0.4/arch/freebsd14.amd64-64
*** Error code 1
38557f2f45
Cy Schubert (cy) · 1.0.4
shells/ksh: Fix build with LLVM15
40c294fd4f
Cy Schubert (cy) · 1.0.4
shells/ksh: Update 1.0.3 --> 1.0.4
b5281aedd8
Stefan Eßer (se) · 1.0.3
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.0.3
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Cy Schubert (cy) · 1.0.3
shells/ksh: Add missing option

Fixes:		6e9237ba47f0c0df54a58ca8a1bf79b44d580208
39ac815eec
Cy Schubert (cy) · 1.0.3
shells/ksh*: Allow the ksh ports to coexist

Add an option to allow the ksh ports to avoid conflicting with each
other and to coexist. This allows people who wish to punish themselves
by tracking developent to still be able to fall back should upstream
cause regressions.

This also allows legacy ksh93 to coexist with the recently added
ksh93/ksh, which is not entirely compatible with legacy ksh. Applications
which require a legacy ksh compatible package should use the ksh93 port
installed using one of its options. This allows new and old to exist on
the same system.
6e9237ba47
Cy Schubert (cy) · 1.0.3
shells/ksh93: Introduce new ksh port

Now that ksh development has resumed under a new account on github,
this introduces the fourth stable release (1.0.3) of ksh93/ksh to ports
039bde8216