[SECURITY UPDATE] net/mattermost-server

2019-02-25 Thread Pavel Korovin
Dear all,

Please find the latest net/mattermost-server update attached.   


   



   
According to the CHANGELOG, 


   
"Mattermost v5.8.0 contains low to high level security fixes.
Upgrading is highly recommended".
https://docs.mattermost.com/administration/changelog.html   


   



   
Important port changes:

1. I think renaming mattermost bin to mattermost-server and placing it into
/usr/local/sbin should be reverted.
mattermost binary runs the server, but it also runs CLI interface to manage
the server. In the docs it's just "mattermost", not "mattermost-server".
I think getting closer to the source won't be a problem for anyone.

2. Fixed config/log paths, so mattermost cli works without necessity
of descending into /usr/share/mattermost and specifying -c flag.

3. Mattermost config should be /etc/mattermost/config.json. If mattermost
starts and cannot find config.json, it writes default.json and starts with
defaults from it.

4. Enforce security on /etc/mattermost and /var/log/mattermost dirs
(chmod o=), it can have sensitive information.

Finally, I'd propose renaming net/mattermost-server to net/mattermost
to get rid of unnecessary ambiguity in naming. This change can be seen
as questionable, so I don't include it though it's as easy as adding
PKGNAME = mattermost-${V}.

-- 
With best regards,
Pavel Korovin
Index: Makefile
===
RCS file: /cvs/ports/net/mattermost-server/Makefile,v
retrieving revision 1.9
diff -u -p -r1.9 Makefile
--- Makefile14 Feb 2019 06:26:03 -  1.9
+++ Makefile25 Feb 2019 16:48:57 -
@@ -2,7 +2,7 @@
 
 COMMENT =  open source Slack-alternative
 
-V =5.7.1
+V =5.8.0
 GH_ACCOUNT =   mattermost
 GH_PROJECT =   mattermost-server
 GH_TAGNAME =   v${V}
@@ -30,19 +30,20 @@ MODGO_LDFLAGS = -X github.com/mattermost
 NO_TEST =  Yes
 
 pre-configure:
-   ${SUBST_CMD} ${WRKDIST}/config/default.json
+   ${SUBST_CMD} ${WRKDIST}/config/default.json 
${WRKDIST}/utils/fileutils/fileutils.go \
+   ${WRKDIST}/cmd/mattermost/commands/logs.go
 
 do-build:
cd ${WRKSRC}/cmd/mattermost && \
${MODGO_BUILD_CMD}
 
 do-install:
-   ${INSTALL_PROGRAM} ${MODGO_WORKSPACE}/bin/mattermost 
${PREFIX}/sbin/mattermost-server
-   ${INSTALL_DATA_DIR} ${PREFIX}/share/mattermost
-   ${INSTALL_DATA_DIR} ${PREFIX}/share/examples/mattermost
-   cp ${WRKSRC}/config/default.json ${PREFIX}/share/examples/mattermost
+   ${INSTALL_PROGRAM} ${MODGO_WORKSPACE}/bin/mattermost ${PREFIX}/bin/
+   ${INSTALL_DATA_DIR} ${PREFIX}/share/mattermost/
+   ${INSTALL_DATA_DIR} ${PREFIX}/share/examples/mattermost/
+   cp ${WRKSRC}/config/default.json ${PREFIX}/share/examples/mattermost/
 .for _d in client fonts i18n templates
-   cp -Rp ${WRKDIR}/mattermost/${_d} ${PREFIX}/share/mattermost
+   cp -Rp ${WRKDIR}/mattermost/${_d} ${PREFIX}/share/mattermost/
 .endfor
 
 .include 
Index: distinfo
===
RCS file: /cvs/ports/net/mattermost-server/distinfo,v
retrieving revision 1.8
diff -u -p -r1.8 distinfo
--- distinfo14 Feb 2019 06:26:03 -  1.8
+++ distinfo25 Feb 2019 16:48:57 -
@@ -1,4 +1,4 @@
-SHA256 (mattermost-5.7.1-linux-amd64.tar.gz) = 
CfQGjhLkNUMydhcsGiWwy3TjVGh3h+eBy6emxUZ7q2c=
-SHA256 (mattermost-server-5.7.1.tar.gz) = 
y0mtZL11S8xpSPEf91PREkk8TFSGKvZ4+AI+6GEQwZ4=
-SIZE (mattermost-5.7.1-linux-amd64.tar.gz) = 102660133
-SIZE (mattermost-server-5.7.1.tar.gz) = 10293290
+SHA256 (mattermost-5.8.0-linux-amd64.tar.gz) = 
+VxDjIEXH2kpwPJDjDWLfhzL00NUays+daX50UsCQs0=
+SHA256 (mattermost-server-5.8.0.tar.gz) = 
J9489c3WFNclUeTgU7/pA0Xw4AS/ccYDbFRzasG0i10=
+SIZE (mattermost-5.8.0-linux-amd64.tar.gz) = 98792460
+SIZE (mattermost-server-5.8.0.tar.gz) = 16551687
Index: 

Re: [SECURITY UPDATE] net/mattermost-server

2019-02-13 Thread Klemens Nanni
OK kn



[SECURITY UPDATE] net/mattermost-server

2019-02-13 Thread Pavel Korovin
Please find the update for the latest net/mattermost-server attached.

According to the CHANGELOG,
"Mattermost v5.7.1 contains a high level security fix. Upgrading is
highly recommended."
https://docs.mattermost.com/administration/changelog.html

OK to commit?

-- 
With best regards,
Pavel Korovin
Index: Makefile
===
RCS file: /cvs/ports/net/mattermost-server/Makefile,v
retrieving revision 1.8
diff -u -p -r1.8 Makefile
--- Makefile28 Jan 2019 11:45:48 -  1.8
+++ Makefile13 Feb 2019 21:28:01 -
@@ -2,7 +2,7 @@
 
 COMMENT =  open source Slack-alternative
 
-V =5.7.0
+V =5.7.1
 GH_ACCOUNT =   mattermost
 GH_PROJECT =   mattermost-server
 GH_TAGNAME =   v${V}
Index: distinfo
===
RCS file: /cvs/ports/net/mattermost-server/distinfo,v
retrieving revision 1.7
diff -u -p -r1.7 distinfo
--- distinfo28 Jan 2019 11:45:48 -  1.7
+++ distinfo13 Feb 2019 21:28:01 -
@@ -1,4 +1,4 @@
-SHA256 (mattermost-5.7.0-linux-amd64.tar.gz) = 
EiDiX1AeQdub7mrxTdElg8H5VlilWGLaQqEmjRYLEMQ=
-SHA256 (mattermost-server-5.7.0.tar.gz) = 
cPrhU5GrW5Au6gT8QWk6+m3bVNu9ohTaZk+E877mhss=
-SIZE (mattermost-5.7.0-linux-amd64.tar.gz) = 102104566
-SIZE (mattermost-server-5.7.0.tar.gz) = 10292956
+SHA256 (mattermost-5.7.1-linux-amd64.tar.gz) = 
CfQGjhLkNUMydhcsGiWwy3TjVGh3h+eBy6emxUZ7q2c=
+SHA256 (mattermost-server-5.7.1.tar.gz) = 
y0mtZL11S8xpSPEf91PREkk8TFSGKvZ4+AI+6GEQwZ4=
+SIZE (mattermost-5.7.1-linux-amd64.tar.gz) = 102660133
+SIZE (mattermost-server-5.7.1.tar.gz) = 10293290