13:56 vsevolod 

Update to 1.3.0.b7

Changes:
- Save repo type in the annotation.
- Fix packages fetching for reinstallation
- Convert pkg repo from threads to processes (no more pthread dependency)
- Add progress indicators to repo create
- Implement new repo style:
	* Add metafile
	* Use data from that metafile
	* Use advanced manifest digests format
	* Implement legacy repos creation
- Fix symlinks checksums (reported by misha @ #pkgng)
- Fix pkg backup -r messages
- Now pkg is able to delete multiple versions of the same package (e.g. when
some packages are
 merged into one another)
- Fix repo schema upgrade
- Do not try to re-fetch broken packages infinitely
- Fix couple minor bugs and crashes

With hat:	pkg@

 

08:47 vsevolod 

Update to 1.3.0 beta6.

Changes:
- fixed pkg-delete bug
- fixed issues with progress displaying

With hat:	pkg@

 

13:18 vsevolod 

Update to 1.3.0 beta5

Changes:
- repositories system has been reworked to support opaque repository operations
- progress bar has been reworked and simplified
- pkg backups generated by the distributed script are now plain sql files
- fixed some visual issues while installing packages

With hat:	pkg@

 

15:10 vsevolod 

Update to 1.3.0.b4.

With hat:	pkg@

 

16:01 bapt 

Update to 1.3.0 beta3
Changes:
- Now unicity is made on the typle (origin, name) to allow sub packages but
cannot be made to only name to break installation from prior sanitization of the
names
- Fix pkg stat
- Fix speed regression
- 411.pkg-backup does not hide errors anymore
- Improve documentation
- debug now print stacktrace on freebsd 10+
- globalize common variables
- new option to allow profiling sql queries
- fix flatsize calculation
- improve ui (better output)
- add a new shiny progress bar and start using it everywhere
- create a pkg_checksum api
- fix pkg rquery -I
- rework package digest
- allow to use ldns instead of the FreeBSD dns api if needed
- change the upgrade package path: first rename a file then extract the new file
then unlink the renamed one
- add a version script to avoid exposing external third party library symbols
- fix pkg upgrade (it was changing the automatic flags when it shouldn't)

 

10:11 bapt 

Update to pkg 1.3.0 beta2
Changes:
- more fixes in pkg audit
- move audit functions into the library
- pkg lock -l now list the locked packages
- database lock behaviour is now configurable
- symlinks now has a checksum to ensure they are valid
- more fixes on the solver
- add long version of the options

 

13:29 bapt 

Update to 1.3.0 beta1
Changes:
- pkg audit now accepts vuln.xml with multiple package names
- Prefer SONAME instead of filename for library provides
- Do not require dependencies that are self provided
- pkg upgrade can now have a name in argument to only upgrade a given package
and its dependencies
- Lots of bug fixes

 

13:21 bapt 

Update to 1.3.0 alpha10
Changes:
- Document pkg search -U
- Reduce memory usage when loading a package
- Validate package loading against a ucl schema
- Sandbox signature checking with capsicum
- Update man pages
- Be pedantically correct about units and scale factors
- Now uses sqlite full text search extension
- Allow case insensitive search
- Fix pkg add -f
- Lots of fixes in the solver

 

15:23 bapt 

Update to 1.3.0 alpha9
Changes:
- Fix important regression due to bad usage of libucl
- Validate keywords against a schema
- repos can now present metadata

 

14:48 bapt 

Update to 1.3.0 alpha8
Changes:
- Detect invalid packages that list directories in plist
- new pkg_emit_query_(yesno|select) to allow the library to ask question to the
user
- Reinstall packages on upgrade if remote abi changed (this catches up
automatically major upgrade of freebsd)
- Ability the specify the file to read the ABI from
- add --relocate to pkg add and register (this is totally unsafe to use a a
normal user, it is intended to be used in the ports tree)
- clean/improvements in the repo handling functions
- validate the directory is actually a port directory when running pkg version
against the ports tree
- new pkg audit -f <file> to run pkg audit against a local file
- pkg -j and pkg -c are now able to restart themself
- pkg version against the ports tree now works even if current working directory
has been deleted out from underneath us.
- Improved pkg upgrade/install/delete output
- Improve cache handling
- Make pkg update more verbose
- new RUN_SCRIPTS options (default on) to be able to switch of the running
pre/post operation scripts

 

16:56 bapt 

Update to 1.3.0.a7:
Changes:
- pkg create uses a readonly lock
- pkg create returns non 0 is package creation failed
- rework the cache so that is avoid collision with multirepo and avoid warning
the users harmless checksum retry
- do not cache anymore files when using file:// scheme
- Preserve automatic flags of local packages.
- Use installed provides if possible.
- Fix local and remote logic for provides and conflicts.
- Optimize SAT solving slightly.
- Make duplicate-related warning fatal in developer mode
- Continue turning the public api into pkg_objects

 

10:23 bapt 

Update to 1.3.0.a6:
Changes:
- pkg delete is not recursive by default
- pkg delete ui now explain why a package will be removed
- pkg which now handle PATH when looking for a file
- shared libraries are now directly resolved in the solver (no need anymore for
explicit package dependency)

 

17:17 bapt 

Release 1.3.0.a5
Changes:
- Added ability to install packages with missing dependencies
- Do not enter in a sandbox if the database is open
- Do not count the lock owner as lock blocker.
- Lots of rework and fixes to improve the solver when trying to upgrade very old
package database.

 

13:26 bapt 

Update to 1.3.0 alpha4
Changes:
- Reimport old pkg add (aliasing it to install was too optimistic at the moment)
- Fix pkg install ./file with package lacking the manifestdigest information)
- Fix a bug resulting in "pkg-static: sqlite: no such savepoint: upgrade"

 

18:05 bapt 

Update to 1.3.0.a3
- Fix a typo in pkg.conf(5)
- pkg add is an alias on pkg install -l

 

15:45 bapt 

Update to 1.3.0.a2

Changes:
- libpkg: Simplify code but turning annotations into a pkg_object
- libpkg: Simplify dumping the configuration of plugins in pkg -vv
- libpkg: Update libucl to latest version
- libpkg: Fix options emission in the Manifest
- libpkg: fix some multirepository bugs
- pkg: fix pkg delete -f
- pkg: fix pkg register
- pkg: fix pkg upgrade
- pkg: fix pkg shell
- pkg: 'update' now warns user if no repos are enabled

 

17:12 bapt 

Update to 1.3.0.a1:
- New solver that can support external solvers using the CUDF format and the
internal SAT solver
- pkg-ssh(8) is now sandboxed with capsicum if it is available
- pkg-ssh(8) now uses poll(2)
- Remove StringList usage to improve portability
- Rework the build system to use autotools to help portability
- Now fetching is done to a temporary location and cleaned up if it fails
- Remove PACKAGESITE
- pkg-audit: remove support for portaudit compact database (only VulnXML will be
used)
- Improved UI experience based on jmmv write up
(http://julipedia.meroh.net/search/label/cli-design)
- Hide the average speed from the progress bar (confusing for users)
- Reworking the database locking mechanism into a finer grain and more clever
system
- Dynamic conflict handling if a conflict on files is detected at the sanity
check level, try to solve the problem again with the new conflict information
- Fix %t (timestamp) modifier in pkg_printf(3)
- Full output now has a new field "date installed"
- New pkg -o A=B to overwrite configuration from command line without the need
of defining environment variables
- pkg-install now can handle local files
- pkg-add is now an alias on pkg-install
- Simplify API by using more and more libucl objects (hidden behind an opaque
'pkg_object')

Special thanks to Vsevolod Stakhov (vsevolod@)

 

23:41 bdrewery 

- Update to 1.2.7

Changes:
  - Only fallback to YAML if UCL parsing fails
  - pkg2ng: Hide warnings about @mtree, @stopdaemon, @comment
    @display and @conflicts
  - Fix escaping issues with COMMENT
  - pkg add: Fix -A to properly mark package as automatic
  - pkg2ng: Fix over NFS
  - pkg2ng: Show message while analyzing shared libraries

 

21:12 bdrewery 

- Update pkg and pkg-devel to 1.2.6

  This update includes a security update for possible arbitrary code
  execution from package manifest parsing. All users are advised to
  upgrade ASAP. The base pkg(7) was never affected by this. [1]

Changes:
  * Fix libyaml head-based buffer overflow [1]
  * Fix pkg info -E support for ports, which namely affected
    net/openldap* usage. [2]
  * Fix packages registering themselves as dependencies [3]
  * Bash autocompletion fixes [4]
  * autoremove: Don't try to remove locked packages
  * Support 'pkg bootstrap -f', which will force a reinstall of pkg
    on FreeBSD 10.0+
  * Fix %t timestamp formatter with %{...%} modifiers [5]
  * pkg info: Show date installed
  * Add $daily_status_security_pkgaudit_quiet to control 410.pkg-audit.in
    output verbosity level
  * Add an error when trying to update repository and none are defined [6]
  * Fix typos in manpages [7]

Security:	CVE-2013-6393 [1]
Reported by:	secteam (delphij) [1]
PR:		ports/184797 [2]
Reported by:	Pavel Timofeev <timp87@gmail.com> [2], many
Submitted by:	smh@ [3]
Submitted by:	brd@ [4]
Submitted by:	Jamie Landeg Jones [5]
Submitted by:	Rodrigo Osorio [6]
Submitted by:	Michael Gehring, wblock [7]
With hat:	portmgr
MFH:		2014Q1

 

14:19 bapt 

Update to 1.2.5:
- Manpage improvements
- fix $auditfile in pkg audit periodic script
- Fix repo-*.sqlite being corrupted when pkg update is interrupted by the user
- pkg add now tells the version of the package missing
- Strop decoding/encoding all fields, only scripts and description are now
encoded/decoded

 

08:00 bapt 

Update to 1.2.4
Changes:
- Fix segfault in pkg audit -F [1]
- Fix multiple segfault when using eventpipe [2]
- Fix REPOS_DIR being appended instead of overwritten when modified from
pkg.conf

Reported by:	many [1]
Reported by:	kmoore [2]

 

15:44 bapt 

Update to pkg 1.2.3
Changes:
- Workaround a bug in bsd.*.mk on FreeBSD 8.x
- Fix a pkg repo segfault
- Document aliases in pkg.conf(5)
- Be more verbose when refusing a repository configuration file
- Sync libucl with upstream (bug fixes)
- Fix a fd leak in pkg repo
- Fix memory leaks due bad usage of libarchive

 

15:35 bapt 

Update to 1.2.2
Changelog:
- Fix pkg which returns bogus non-zero exit status on success
- Better check libucl returns
- Fix bad build system resulting in broken binaries on arm and ia64
- Update pkg.conf documentation
- Add manpage for pkg config
- OOTB support for dragonfly
- Lots of fixes in libucl
- Fix pkg register complaining about shared libraries not found
- Do not resume a jailed or chrooted pkg(8) upgrade
- Document the plist format (in pkg-create(8))
- Pet mandoc -Tlint
- Add manpage for pkg_repos(3)
- Fix dependencies losing portepoch information
- pkg-[r]query: Add %q to display architecture
- Fix pkg add allowing to install package with missing dependencies
- Fix description being stored escaped

Special thanks to mat@ (for bug busting) and cognet@ (tracking down 2 issues
on arm and as a side effect fixing on ia64

 

18:26 bapt 

Release pkg 1.2.1
Changes:
- Fix pkg rquery always printing index like lines
- Fix pkg -vv suggestion so it print something actually usable
- Fix shlib's -P and -R options were swapped round.
- Replace broken pkg_repos_count() by pkg_repos_total_count() and
pkg_repos_activated_count()
- Fix parsing of options (in manifest)
- pkg add http:// now fetch to a temporary location and cleanup after itself
- Fix generation of the manifest digest
- Properly calculate how many packages where removed
- Fix support for dependencies with the same name (grrrr Fix you port if they
have package name collision !!!!)
- Fix pkg info -R in case multiple dependencies has the same name

 

14:33 bapt 

Release final pkg 1.2 version:
- changes since 1.2.0 rc1:
  * Couple of style fixes
  * Fix loading yaml keywords
  * Fix building on Dragonfly
  * Autodetect if libelf should be used bundled
  * Fix a bug if pkg audit -F got interrupted
  * Allow 'enabled' entry from repo configuration to be a string and raise a
warning about it

 

18:04 bapt 

- Update to 1.2.0.rc1
- Changes:
 * Fix loading of fingerprints
 * Fix ssh transport by refactoring
 * Skip self upgrade with -F is passed
 * Fix pkg info -[q]O
 * Fix pkg info -q (with no other options)
 * Make fingerprints signature checking actually working

 

15:45 bapt 

Update to pkg 1.2.0 beta2
- Update bundled libucl code (which fixes bugs)
- Fix double escaped \n for script and messages
- Fix rquery with -e not properly working [1]
- rquery can now take a -I argument to output index like lines (needed for
bsdconfig)
- Fix local database creation (initial)
- With build with older bsd.prog.mk
- Improved documentation for pkg query

Reported by:	mat [1]

 

16:24 bapt 

Update to pkg 1.2.0 b1

Changes:
- Bug fixes in zsh completion
- Lots of bug fixes discovered by Coverity Scan
- New debug level traces
- Auto upgrade of pkg(8) now restart the upgrade process automatically
- Dependencies on library is now automatic via pkg register and pkg
  create
- YAML is replaced by UCL format:

  Both formats are really simular. pkg(8) will falls back on parsing YAML
  when the UCL parser fail. And will emit a warning to the
  user showing a syntax that is compatible with both YAML and UCL.
  More informations on UCL: https://github.com/vstakhov/libucl

- Do not generate catalogs in pkg 1.0 format anymore.
- Working ssh protocol supported for repositories
- New PKG_SSH_ARGS to allow passing custom arguments to ssh command
  used for the ssh:// protocol
- Allow using '?' operator in pkg query expressions
- New git like aliases to allow creating custom commands
- REPO_DIR is now a list instead of a simple string
- packagesite in pkg.conf is deprecated in favour using dedicated
  repository configuration files
- New 'fingerprint' kind of signature:

    if a repository is declared using the fingerprint type of
    signature, a fingerprint directory should also be provided.
    Inside that fingerprint directory should be 2 directories:
    trusted and revoked.  Those directories will contains files (in
    yaml/ucl format) containing the fingerprint of the trusted
    certificated and the revoked ones:

    --- begins --
    function: sha256
    fingerprint: an_hex_representation_of_the_fingerprint
    --- ends ---

    All unknown attribute will be silently ignored to allow extending
    in the future.

    It also support multiple signatures inside the catalog. the
    catalog should provide the signature in the following form:
    name.sig
    name.cert

- pkg add is now able to read the packages from a pipe or a non-regular
  file '-' is an alias for stdin, this also works from pipes, fifos,
  unix domain sockets etc.
- Support for pkg+foo url scheme where foo can be (http, https, ftp).
- pkg info now default on glob matching
- Print a pkg name only once - even if multiple vulns were found -
  when using -q
- Accept empty/comment only configuration files
- vuxml is now the default source for pkg audir
- expat is now bundled (for vuxml)
- pkg info -q is now equivalent of pkg info -qa
- in case pkg info is querying a file or is a single direct match
  query then default on -f
- pkg repo can now take new arguments:
  pkg repo [path] [rsa_key|'signing_command: <command>']

  This allow calling external command to perform the signing and
  pass the checksum to be signed in the command stdin.
- options can now have a description
- new pkg config subcommand to allow direct query of options
- ABI is now checked again using globs:
  a 'noarch' package should just specify: ARCH: 'freebsd:*'
  a package working on both i386 and amd64: ARCH: 'freebsd:9:x86:*'
- Broken incremental pkg repo support was removed.
- Lots of spelling/grammar fixes
- Properly support srv priority/weigh when ordering mirrors
- Use port specified in the SRV entries to connect to a given mirror
- New pkg bootstrap subcommand that is the counter part of the
  pkg(7) bootstrap subcommand
- Allow ARCH to be printed by pkg info
- Allow to hook plugins, before closing the local db if it was
  opened in RW mode
- Improved build system

 

11:29 bdrewery 

- Update to 1.1.4

Changes:
 * Fix crash when opening repository in some cases
 * Fix build with -Werror
 * Fix 'pkg install [-f] pkg' not finding results
 * Fix 'pkg upgrade -f' always wanting to upgrade pkg first
 * Fix 'pkg install -R' always wanting to install pkg first
 * Fix backwards compatibility for 1.0-built packages for
   tracking shlibs. This may cause some packages to be
   reinstalled after the repository is updated.
 * Fix pkg (upgrade|fetch|install) -r <repo> crash
 * Fix crash when specifying invalid repo with -r

 

22:26 bdrewery 

- Update to 1.1.3

Changes:

 - Fix repository signing verification with new format during update
 - Disable terminal title setting
 - Fix %a/%k returning true/false instead of 0/1
 - Various memory/fd leaks have been fixed
 - Fixed pkg self-upgrade detection
 - ZSH completion fixes
 - Several crashes fixed

With hat:	portmgr

 

10:08 bapt 

Update to 1.1.2
Changes:
- Fix install|upgrade -f not executing post-install scripts [1]
- Fix bad size calculation on i386 for pkg delete (always say 4G will be freed)
- Fix pkg query '%sh' now properly converting to human number on i386
- Fix zsh completion missing ']' [2]
- Fix pkg stats in case no remote repositories are configured [3]

Reported by:	ohauer [1], Kimmo Paasiala via github issue #520 [2], rene [3]

 

13:02 bapt 

Update to 1.1.1:
Changes:
- Fix an pkg crashing on i386
- Fix a regression on the output of pkg version

 

05:55 bapt 

Update to 1.1 final
Changes:
- Fix packing of +UPGRADE scripts
- Fix pkg update always thinking the repo is up to date if the remote server
sends no mtime header
- Various updates on the manpage
- New pkg-repository(5) man page

 

09:31 bapt 

Update to 1.1.0 rc1
Changes:
 - Fix pkg install -R [1]
 - pkg install -R does not downgrade anymore except if -f is passed.
 - Fix package validation [2]
 - Do not try to search on repositories if no repositories are configured
 - Fix pkg query '%M' printing '(null)' [3]

Reported by:	Nikolai Lifanov <lifanov@mail.lifanov.com> [1],
		Waitman Gobble (github issue #514), and many others [2],
		flo [3]

 

07:18 bapt 

Update to 1.1.0.b4
Changes:
  - A package can now be marked to only be upgraded from a given repository via
annotations
  - install and upgrade will now show from which repository packages are taken
(if at least 2 repositories are setup)
  - old/unused 'informations' field has been removed in favor of using
annotations
  - important cleanup using pkg_printf(3)
  - add seat belt so pkg-devel can only be removed with -f
  - signing key is only asked once now in pkg repo
  - only look withing the note version of elf files
  - fix pkg delete -a
  - pkg repo has been changed to produce repo.txz in 1.0 only format
  - catalog is now only take from digest in 1.1
  - fix pkg update to that is is really incremental.
  - fix pkg convert (thus fix pkg2ng)
  - Add a DISABLE_MTREE option, which just disables processing +MTREE data
  - Rename ENV to PKG_ENV to not conflict with sh(1)'s ENV
  - Refactor 'pkg [-v|-vv|-vvv]' handling

 

14:42 bapt 

Update to 1.1.0.b3:
- Fix the solver endlessly proposing to reinstall some packages [1]
- Fix a typo in repository configuration parser
- Explain why a package is being reinstalled

Reported and tested by:	Nikolai Lifanov <lifanov@mail.lifanov.com> [1]

 

12:02 bapt 

Update to 1.1.0.b2
- Fix pkg audit -F [1]
- Fix the new solver trying to downgrade some packages when it shouldn't
- Properly show how much space is going to be free/required when deinstalling
[2]

Reported by:	Nikolai Lifanov <lifanov@mail.lifanov.com> [1], gerald [2]

 

15:17 bapt 

The pkg developement team is proud to announce the new 1.1.0 beta1 release of
pkg.

Here is the list of new features that happened in pkg 1.1:
- new simpler and more reliable solver
- shared libraries are now always tracked
- ssh:// is supported as a protocol to distribute packages (needs pkg 1.1+ on
  the server hosting the packages)
- multirepository is no longer considered experimental and works by default.
- incremental update of the catalog (only if the repository was created by pkg
  1.1+)
- simplification of the public API
- stabilisation of the public API (we will now try to keep it stable and if
  change are needed there will be deprecation time before removal of some old
  functions)

(Only the first 15 lines of the commit message are shown above )