Re: ports/security/nessus

2014-09-30 Thread Peter Ezetta
On Sep 30, 2014, at 9:40 AM, Nigel Taylor mailto:njtay...@asterisk.demon.co.uk>> wrote: On 09/30/14 15:47, Stuart Henderson wrote: OK to remove this from ports? It went closed-source in 2005 and I don't see much benefit in keeping a 9-year-old vulnerability scanner in ports. If anyone is upset b

net/pidgin coredumps after ssl patch

2014-09-30 Thread ks-lists
Hi. I've been using finch from ports (net/pidgin subpkg) for a few months. Today I restarted it and it core dumps. The maintainer suggested I email ports list for help. I installed from 5.5 amd64 package. Nothing has changed lately. A Pidgin developer told me building against OpenSSL instead of NS

[update] bogofilter 1.2.4

2014-09-30 Thread Landry Breuil
Hi, here's an update to bogofilter 1.2.4 - the version we have in-tree is nearly 7 years old, and even if the motto "if it ain't broken dont fix it" is strong among some, there's been at least two CVEs since then: http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01 http://bogofilter.s

Re: Stop building rubinius (rbx-*) ports

2014-09-30 Thread Jeremy Evans
On Tue, Sep 30, 2014 at 12:06 PM, vtamara wrote: > First thank you for your work with ruby on OpenBSD, I'm doing some > projects on RoR with it. > > I have not tested much rubinius --just I see that some of my projects > compile with rbx on travis-ci. > > However I notice: > * Recent rbx supports

Re: Stop building rubinius (rbx-*) ports

2014-09-30 Thread vtamara
First thank you for your work with ruby on OpenBSD, I'm doing some projects on RoR with it. I have not tested much rubinius --just I see that some of my projects compile with rbx on travis-ci. However I notice: * Recent rbx supports mri 2.1 (http://rubini.us/doc/en/guides/migrating-from-mri

MAINTAINER UPDATE: www/opengroupware

2014-09-30 Thread Sebastian Reitenbach
Hi, opengroupware needs some compatibility patches from upstream to cope with newer versions of www/sope. While touching it, a few minor bug fixes and enhancements included. OK? SebastianIndex: Makefile === RCS file: /cvs/ports/www/

MAINTAINER UPDATE: www/sope www/sogo to 2.2.9

2014-09-30 Thread Sebastian Reitenbach
Hi, long overdue an update. The update to 2.2.6 was too short to make it into the release for 5.6. Meanwhile we're at 2.2.9. Attached patches update to that newer version, I have running since a few days without issues so far. With the change of 2.2.8 -> 2.2.9, the documentation is not provided

Re: SSL_CTX_use_certificate_chain fallout

2014-09-30 Thread Joel Sing
On Wed, 1 Oct 2014, Reyk Floeter wrote: > Am 30.09.2014 um 15:39 schrieb Christian Weisgerber : > > Joel Sing: > ===> www/apache-httpd-openbsd > ===> www/apache-httpd > >> > >> Is this the only ports fallout? > > > > Yes. > > So what about patching these two apache ports instead of LibreS

Re: ports/security/nessus

2014-09-30 Thread Nigel Taylor
On 09/30/14 15:47, Stuart Henderson wrote: > OK to remove this from ports? It went closed-source in 2005 and I don't > see much benefit in keeping a 9-year-old vulnerability scanner in ports. > > If anyone is upset by this, feel free to submit an OpenVAS port instead :) > > OpenVAS is in OpenBSD

Re: ports/security/nessus

2014-09-30 Thread David Coppa
On Tue, Sep 30, 2014 at 4:47 PM, Stuart Henderson wrote: > OK to remove this from ports? It went closed-source in 2005 and I don't > see much benefit in keeping a 9-year-old vulnerability scanner in ports. > > If anyone is upset by this, feel free to submit an OpenVAS port instead :) > nuke it -

Re: ports/security/nessus

2014-09-30 Thread Stuart Henderson
On 2014/09/30 15:47, Stuart Henderson wrote: > OK to remove this from ports? It went closed-source in 2005 and I don't > see much benefit in keeping a 9-year-old vulnerability scanner in ports. > > If anyone is upset by this, feel free to submit an OpenVAS port instead :) > ...as a bonus this ge

ports/security/nessus

2014-09-30 Thread Stuart Henderson
OK to remove this from ports? It went closed-source in 2005 and I don't see much benefit in keeping a 9-year-old vulnerability scanner in ports. If anyone is upset by this, feel free to submit an OpenVAS port instead :)

Re: [new] devel/lwjgl - required for Minecraft

2014-09-30 Thread Aaron Bieber
On Tue, Sep 30, 2014 at 11:00:48AM +0100, Stuart Henderson wrote: > - src/native/linux/opengl/extgl_glx.c dlopen should just use > dlopen("libGL.so", ...) rather than forcing a specific version, > otherwise this needs manual changes every time the version is > bumped in X Could have sworn I added

Re: SSL_CTX_use_certificate_chain fallout

2014-09-30 Thread Reyk Floeter
Am 30.09.2014 um 15:39 schrieb Christian Weisgerber : > Joel Sing: > ===> www/apache-httpd-openbsd ===> www/apache-httpd >> >> Is this the only ports fallout? > > Yes. > So what about patching these two apache ports instead of LibreSSL? It is a valid addition to the library and Li

Re: SSL_CTX_use_certificate_chain fallout

2014-09-30 Thread Christian Weisgerber
Joel Sing: > > > ===> www/apache-httpd-openbsd > > > ===> www/apache-httpd > > Is this the only ports fallout? Yes. -- Christian "naddy" Weisgerber na...@mips.inka.de

Re: xmlto failing with what looks like junk data

2014-09-30 Thread Tobias Ulmer
On Thu, Sep 25, 2014 at 09:23:24AM -0400, trondd wrote: > Just an update (and apologies for previous top posting and message history) > but we've only ever seen this error and crash while running xmlto. I would > think (maybe wrongly) that a stack-protector issue would show up in other > programs,

Re: SSL_CTX_use_certificate_chain fallout

2014-09-30 Thread Joel Sing
On Tue, 30 Sep 2014, Stuart Henderson wrote: > On 2014/09/30 11:20, Stuart Henderson wrote: > > On 2014/09/29 14:06, Christian Weisgerber wrote: > > > Apache doesn't like the addition of SSL_CTX_use_certificate_chain(). > > > > > > ===> www/apache-httpd-openbsd > > > > > > ../../modules/ssl/ssl_uti

Re: SSL_CTX_use_certificate_chain fallout

2014-09-30 Thread Joel Sing
On Tue, 30 Sep 2014, Stuart Henderson wrote: > On 2014/09/29 14:06, Christian Weisgerber wrote: > > Apache doesn't like the addition of SSL_CTX_use_certificate_chain(). > > > > ===> www/apache-httpd-openbsd > > > > ../../modules/ssl/ssl_util_ssl.h:119: error: conflicting types for > > 'SSL_CTX_use_

Re: SSL_CTX_use_certificate_chain fallout

2014-09-30 Thread Stuart Henderson
On 2014/09/30 11:20, Stuart Henderson wrote: > On 2014/09/29 14:06, Christian Weisgerber wrote: > > Apache doesn't like the addition of SSL_CTX_use_certificate_chain(). > > > > ===> www/apache-httpd-openbsd > > > > ../../modules/ssl/ssl_util_ssl.h:119: error: conflicting types for > > 'SSL_CTX_u

Re: SSL_CTX_use_certificate_chain fallout

2014-09-30 Thread Stuart Henderson
On 2014/09/29 14:06, Christian Weisgerber wrote: > Apache doesn't like the addition of SSL_CTX_use_certificate_chain(). > > ===> www/apache-httpd-openbsd > > ../../modules/ssl/ssl_util_ssl.h:119: error: conflicting types for > 'SSL_CTX_use_certificate_chain' > /usr/include/openssl/ssl.h:1533: er

Re: [new] devel/lwjgl - required for Minecraft

2014-09-30 Thread Stuart Henderson
- src/native/linux/opengl/extgl_glx.c dlopen should just use dlopen("libGL.so", ...) rather than forcing a specific version, otherwise this needs manual changes every time the version is bumped in X - ARCH is an internal variable and shouldn't be overridden, it should be OK to just use another nam