19:09 Matthias Andree (mandree) 

mail/mailman: 2.1.38 security fixing CSRF vuln

While here, fix pkg-message to mention -exim4 and -postfix
derived ports that override the default MTA.

Security:	0d6efbe3-52d9-11ec-9472-e3667ed6088e
Security:	CVE-2021-44227
MFH:		2021Q4

    87f0f37

18:04 mandree 

mail/mailman: rcfile and pkg-message tweaks

Limit the install message about pkg install -I to installs (not upgrades).

Convert the required_dirs of the rcfile into a coded prereq check,
so that we can print the proper error message, and point the user to
the right place.

Bump PORTREVISION.

 

22:41 mandree 

mail/mailman: fix some permission issues, realign template policy

- tighten up permissions on install dirs even more, patching
  bin/check_perms to not complain - fewer directories or files belong
  in mailman's hand or need group write permissions.

- revert 2.1.30's "make templates samples" because the upstream has
  always instead provided a templates/site dir here and warned users that
  default templates will be overwritten on updates or reinstallation
 
https://wiki.list.org/DOC/4.48%20How%20can%20I%20change%20the%20HTML%20or%20.txt%20templates%20used%20by%20my%20mailing%20lists%3F
  changed templates will be written to different directories, the site,
  domain-specific or list-specific directory

- adjust pkg-plist such that a no-script install, a regular install
  with post-install script run, and check_perms agree on permissions,
  however with tighter write permissions than the default install,
  as a security-in-depth safety precaution. [1]

- revise files/pkg-install.in accordingly

- boil down files/pkg-message.in texts a little bit

- bump PORTREVISION

PR:		245853
Reported by:	manu@ (IRC) [1]

 

20:46 mandree 

mail/mailman: update to 2.1.30 - bug fix (incl. data loss)

* upstream changelog:
https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L6

Note that upstream means 2.1.30 to be the final 2.x release,
because it relies on Python 2.x which is EOL upstream.

! MAJOR DATA LOSS FIX, rename all templates/* files to .sample,
! and list them as a @sample in pkg-plist, because they can be edited
! through the web server, and an upgrade should not stomp over edited files.

* rearrange makefile a bit (portlint, portfmt)
* update and upload new htdig patch
* expose NLS port option to pkg-install script to avoid failure
* patch upstream bin/check_perms script to not complain about tightened-
  up messages/ and mailmanprefix (${PREFIX}/mailman) permissions that we
  set to 0755 instead of 02775. Mailman should not need to write outside
  designated directories or create new top-level directories in its install.
* fix a typo in the German (mailman.po) translation
* tweak pkg-install to:
  - leave ${PREFIX}/mailman permissions alone and not set them to 02775
  - fix up non-moved .sample files if pkg-install is run with -I
  - create a copy of mm_cfg.py from mm_cfg.py.dist if missing (-I)
  - create a newsyslog.conf.d/mailman.conf if missing, from
    examples/mailman.newsyslog.sample if installed (-I)
  - not attempt to fix messages/ (translations) permissions if the NLS
    port option is disabled
* tweak pkg-plist so that the proper permissions and groups are set
  by default already
* clean up pkg-message, thanks to bapt@ for pointing out that a missing
  type: means "install or upgrade".

MFH:		2020Q2 (@samples is an important fix against data loss on update)

 

02:39 mandree 

mail/mailman: repair incomplete UCL conversion of pkg-message.in

There are parts of the install message that are also relevant on
updates, but were missed. Add them, and bump PORTREVISION.

Failure-inducing commit:

------------------------------------------------------------------------
r508882 | mat | 2019-08-14 00:29:42 +0200 (Wed, 14 Aug 2019) | 2 lines

onvert to UCL & cleanup pkg-message (categories l-m)

------------------------------------------------------------------------

 

22:29 mat 

onvert to UCL & cleanup pkg-message (categories l-m)

 

17:34 mandree 

Actually expand newsyslog locations in pkg-message.

Followup to
Differential Revision:	https://reviews.freebsd.org/D17088

 

14:18 woodsb02 

mail/mailman: Use .conf suffix for /usr/local/etc/newsyslog.conf.d/

- Rename the files installed to /usr/local/etc/newsyslog.conf.d/ to end
  with a '.conf' suffix.
- Add pkg-install script to automatically move any copies of the old
  newsyslog file to the new location if the new file is unmodified from the
default,
  or print a warning if it the new file has been modified.
- Add a note to UPDATING and pkg-message to warn users of this, in case
  they are using provisioning/configuration management tools which need
  to be modified. Note the UPDATING entry was committed in r485721.

Recent changes to /etc/newsyslog.conf (r340318) will only include files
from the /usr/local/etc/newsyslog.conf.d/ directory which end with
'.conf' and do not beginning with a '.' character.

Reviewed by:	mat
Approved by:	mandree (maintainer)
Differential Revision:	https://reviews.freebsd.org/D17088

 

23:20 mandree 

Remove dead link from pkg-message.

PR:		225925
Submitted by:	Yasuhito FUTATSUKI

 

19:50 mandree 

Avoid patch-LP1551075 when HTDIG is enabled. [1]

This patch is part of the HTDIG integration patch already. [1]

Also correct namazurc file path in pkg-message, bumping PORTREVISION.

PR:		207876 [1]
Submitted by:	David Sieborger [1]

 

20:08 mandree 

Update to new upstream release 2.1.20.

Fixes one security bug [1], a few other bugs, and adds a feature so that
list admins can edit list addresses.

Uses newer Mailman-and-HTDig integration patches. [2]

Security:	CVE-2015-2775 [1]
Security:	a5f160fa-deee-11e4-99f8-080027ef73ec [1]
PR:		199286 [2]
Submitted by:	David Sieborger [2]

 

07:26 mandree 

Update to new upstream release 2.1.19.

Changes:
https://mail.python.org/pipermail/mailman-announce/2015-March/000205.html

 

01:19 mandree 

The rcfile now runs bin/check_perms so users have a visual clue in case
  they installed the package without running scripts (pkg install -I).
Clean up inconsistent image (=icon) installation. Reported by Alex Stangl.
Makefile: Shuffle things around to please portlint.
Makefile: Clean up muting: only mute RM, comments, MKDIR.
Makefile: Move postfix checks into pkg-install.
pkg-deinstall: drop workaround for traditional pkg_delete.
pkg-deinstall: less verbose mail list reporting.
pkg-deinstall: cleanups for last_mailman_version handling.
pkg-install: defeat "Re-run..." line from check_perms to avoid confusing users.
pkg-plist: cleanups and modernization. Sets directory permissions.
  NOTE: pkg 1.4.1 is unable to extract these on package installs,
  "make install" however should be fine.

 

20:05 mandree 

Add OPENSMTPD's user ID [1]. Add warnings about GIDs [2].

The FreeBSD pkg-message and post-install documentation now clearly warn
that the binary package is only meant for use with Sendmail, and
hints that poudriere can be used to build a Mailman package with
different options.

PR:		192230 [1]
Submitted by:	feld [1], Tom Limoncelli [2]

 

22:58 mandree 

Note that I could not fully test all integrations yet.  If integrations are
failing, please add detailed information how you set up your MTA, and
Mailman, what user/group IDs are, how list aliases are managed, and
thereabouts.

- Update to 2.1.15. [2] Changes: click View the full Changelog on
  https://launchpad.net/mailman/2.1/2.1.15
- Fix without-NLS install: Install at least English template. [1]
- Drop EXIM3 option, we don't have an Exim 3 port any more.
- Drop INTEGRATION option, which would at best be confusing.
- Reformat COMMENT to fit into common limits.
- Fix typo in COURIER_DESC.
- When Postfix integration is chosen, add BUILD and RUN_DEPENDS on
  Postfix because we need the postconf program.
- Use htdig patches for Mailman version 2.1.12 and remove BROKEN tag,
  in an experimental attempt to revive htdig support.
- Fix a few minor glitches in FreeBSD-post-install-notes.
- Drop files/patch-Mailman__Cgi__confirm.py, integrated in upstream tarball.
- Add launchpad.net to MASTER_SITES.
- Update files/postfix-verp.diff.
- Install a dummy one-line text file into PYTHON_SITELIBDIR so that
  Python's upgrade-site-packages would reinstall Mailman. [1]
- Add "status" support for rc.d script. [3]
- Change pre-fetch: to pre-everything::
- Revise formatting of pre-everything text to make clear it displays
  default values, not current values. To avoid ports/170280.

PR:		ports/135503 [1]
PR:		ports/170280 [2]
PR:		ports/170285 [2]
PR:		ports/176180 [1]
PR:		ports/181298 [3]
Submitted by:	Lowell Gilbert [1]
Submitted by:	Stefan Lasiewski [2]
Submitted by:	Oliver Fromme [3]

 

14:35 wxs 

Fix MAILMANDIR macro substitution.

Noticed by:     tota@
Pointyhat to:   me :(

13:34 wxs 

Add option for NAMAZU2, off by default so no PORTREVISION bump.

PR:             portts/156296
Submitted by:   TAKATSU Tomonari <tota@FreeBSD.org>

23:36 jmelo 

- Fix message in pkg-message.

Reported by:            Chris St Denis <chris@smartt.com> by email

18:49 jmelo 

- Add OPTIONS to choose MTA integration.
- Remove "make options", it's not necessary.
- Fix/update FreeBSD-post-install-notes doc.
- Fix both pkg-install and pkg-deinstall to add/delete mailman user in
/var/cron/allow
- Use pkg-message as SUB_FILES.

Approved by:    mnag (mentor)