New Ports of the Week #30 (July 27)

There are 12 new ports for the week of July 21 to July 27:

textproc: sphinx mail: enigmail-seamonkey devel: py-buildbot graphics: cfdg www: p5-Apache-Reload graphics: cal3d net: enet devel: hudson www: firefox3 www: webkit www: midori net: ladvd

Some ports had updates that users should be aware of.

Ports are listed in the order they were committed to the tree:

• textproc/sphinx
  • Sphinx is a full-text search engine. Generally, it's a standalone search engine, meant to provide fast, size-efficient and relevant fulltext search functions to other applications. Sphinx was specially designed to integrate well with SQL databases and scripting languages. Currently built-in data sources support fetching data either via direct connection to MySQL, or from a XML pipe.
• mail/enigmail-seamonkey
  • Enigmail is an extension to the mail client of Mozilla/Netscape and Mozilla Thunderbird which allows users to access the authentication and encryption features provided by GnuPG. This port is similar to enigmail, but is built for seamonkey. Importing a new port, instead of adding quirks to the existing port, was a much simplier solution this time.
• devel/py-buildbot
  • Buildbot is a system to automate the compile/test cycle required by most software projects to validate code changes. The overall goal is to reduce tree breakage and provide a platform to run tests or code-quality checks that are too annoying or pedantic for any human to waste their time with. Developers get immediate (and potentially public) feedback about their changes, encouraging them to be more careful about testing before checkin.
• graphics/cfdg
  • Chris Coyne created a small language for design grammars called CFDG. These grammars are sets of non-deterministic rules to produce images. The images are surprisingly beautiful, often from very simple grammars. cfdg is a command-line tool to produce images in PNG format from these grammars.
• www/p5-Apache-Reload
  • Apache::Reload is a Perl module that allows for dynamically re-loading Perl modules into a persistent mod_perl environment without restarting the server.
• graphics/cal3d
  • Cal3D is a skeletal based character animation library. It is platform-independent and not bound to a specific graphic API. Originally designed to be used in a 3d client for the Worldforge project, it evolved into a stand-alone product that can be used in many different projects.
• net/enet
  • ENet's purpose is to provide a relatively thin, simple and robust network communication layer on top of UDP (User Datagram Protocol). The primary feature it provides is optionally reliable, in-order delivery of packets. ENet is NOT intended to be a general purpose high level networking library that handles authentication, lobbying, server discovery, compression, encryption and other high level, often application level or dependent tasks.
• devel/hudson
  • Initial import of Hudson, a continuous integration (CI) server. Hudson can run standalone (has own tiny web server) or in a Java-capable web server or application server.
• www/firefox3
  • Import Firefox 3.0.1, intended as a replacement for mozilla-firefox, when we decide it's stable enough.
• www/webkit
  • Webkit is an open source web rendering engine. WebKit's HTML and JavaScript code began as a branch of the KHTML and KJS libraries fro m KDE. All our previous patches have been integrated upstream. Mark it BROKEN on sparc64 until bug #19775 is fixe d. Not linked to the build yet, a little bit of testing is still needed with latest libc/libm change.
• www/midori
  • Midori is a lightweight web browser using Webkit for its rendering engine.
• net/ladvd
  • LADVD uses CDP / LLDP frames to inform switches about connected hosts, which simplifies ethernet switch man agement. It does this by creating the required payloads and descriptors on startup and then switching to a non-privileged user for the remaining runtime.

Port update notes:

• databases/openldap:
  Update to OpenLDAP 2.3.43. bug fix release.
• mail/dovecot:
  Three fixes for Dovecot 1.0..
  • Maildir: Group of the created shared directory wasn't set.
  • Logging: Make sure we don't recurse infinitely when running out of memory.
  • rfc822_parse_phrase(): Don't read outside data boundaries if input is empty.
• lang/ruby:
  Security fixes for:
  • CVE-2008-1891: Directory traversal vulnerability in WEBrick
  • CVE-2008-2662: Multiple integer overflows in the rb_str_buf_append function allow context-dependent attackers to execute arbitrary code or cause a denial of serv ice via unknown vectors that trigger memory corruption
  • CVE-2008-2663: Multiple integer overflows in the rb_ary_store function allow context-dependent attackers to execute arbitrary code or cause a denial of service v ia unknown vectors
  • CVE-2008-2664: The rb_str_format function allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca
  • CVE-2008-2725: Integer overflow in the rb_ary_splice function allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the "R EALLOC_N" variant
  • CVE-2008-2726: Integer overflow in the rb_ary_splice function allows context-dependent attackers to trigger memory corruption, aka the "beg + rlen" issue
  More info at http://secunia.com/advisories/29794/.
• x11/xloadimage:
  Fix an egregious LP64 error. From Debian bug #394366, submitted by Stephen McCamant.
• emulators/bochs:
  Allow Bochs to build on big endian systems.
• telephony/asterisk:
  SECURITY update fixing several problems in IAX, both remotely exploitable without authentication.
  • AST-2008-010: Asterisk IAX 'POKE' resource exhaustion (DoS)
  • AST-2008-011: Traffic amplification in IAX2, 40->1040 bytes
• www/phpmyadmin:
  SECURITY update to 2.11.7.1; fixes XSRF/CSRF by manipulating the db, convcharset and collation_connection parameters.
• databases/sqlite3:
  Update to sqlite-3.5.9, including patches from Marc Espie (espie@) and Kurt Miller (kurt@). Fixes apps such as p5-DBD-SQLite by adding weak pthread functions.
• mail/mozilla-thunderbird:
  Update to mozilla-thunderbird-2.0.0.16. Security fixes for:
  • MFSA 2008-34: Remote code execution by overflowing CSS reference counter
  • MFSA 2008-33: Crash and remote code execution in block reflow
  • MFSA 2008-31: Peer-trusted certs can use alt names to spoof
  • MFSA 2008-29: Faulty .properties file results in uninitialized memory being used
  • MFSA 2008-26: Buffer length checks in MIME processing
  • MFSA 2008-25: Arbitrary code execution in mozIJSSubScriptLoader.loadSubScript()
  • MFSA 2008-24: Chrome script loading from fastload file
  • MFSA 2008-21: Crashes with evidence of memory corruption (rv:1.8.1.15)
  See here for more details.
• net/nsd:
  Update to NSD 3.1.1; bug fix release.
• multimedia/avidemux:
  Bugfix update to avidemux-2.4.3.
• x11/gnome/themes-extras:
  Add patch from GNOME bugzilla #528322 to fix an issue with the Darklooks theme.
• lang/squeak/funsqueak:
  Extra squeak image for demonstrations.
• net/samba:
  Update to Samba 3.0.31; A bug fix release.
• www/drupal5/workflow:
  Workflow module for drupal, allows state transitions for nodes.