This is required to make 'export -f' work, which is enabled by default on
other OS I checked.  While here sort the list of enabled options so that
it's easier to compare against the list of available options, as there are
still a number that we do not enable, and remove the bogus comment.

Bump PKGREVISION.

needed for latest cmake.

…t cmake

Upstream decided to delete the distfile and let people download the
on-demand-created tarball instead. At least that seems to be generated
deterministically.

Fixes to auto-pkgsrc-setup and auto-update-pkgsrc
Other minor enhancements and fixes

Upstream change log: https://github.com/outpaddling/auto-admin/releases

This fixes a shift-reduce conflict in the parser that causes e.g.
"static const int" to be rejected as a syntax error.

This patch should have been handled by upstream, but there doesn't seem
to be an upstream.

Feature Changes:
- After the network manager was introduced to named to handle incoming traffic,
  it was discovered that recursive performance had degraded compared to
  previous BIND 9 versions. This has now been fixed by processing internal
  tasks inside network manager worker threads, preventing resource contention
  among two sets of threads.

- Zone dumping tasks are now run on separate asynchronous thread pools. This
  change prevents zone dumping from blocking network I/O.

- inline-signing was incorrectly described as being inherited from the
  options/view levels and was incorrectly accepted at those levels without
  effect. This has been fixed; named.conf files with inline-signing at those
  levels no longer load.


Full changelog:
https://bind9.readthedocs.io/en/v9_16/notes.html#notes-for-bind-9-16-17

No changes since 21.1.4.

… again

Needs more work to build on netbsd HEAD.

This is a maintenance release.

Release notes:
https://bind.isc.org/doc/arm/9.11/Bv9ARM.ch09.html#relnotes-9.11.33

Changes & fixes:
-Added messages: PrintPwdAndQuit, PrintFocusPathAndQuit, PrintSelectionAndQuit.
-Mapped :q to a new built-in mode quit containing different options to quit.
-Fixed handling of relative paths.
-FocusNext will start from the first node after the last node.
-FocusPrevious will start from the last node after the first node.

-{root} argument (current tree root) can be used in verb patterns - Fix #395
-working_dir verb attribute - Fix #396
-client-server mode fixed, no longer feature-gated (but still only available on
unix like systems)
-broot tries to keep same selection on option changes
-:tree_up and :tree_down internals, mapped to ctrl-up and ctrl-down - Fix #399
-better handling of auto color mode: two separate behaviors: for app running
and for export when leaving - Fix #397
-remove the deprecated --no-style launch argument (use --color no instead)
-deprecate the --out argument (redirecting the output is the recommanded
solution)
-fix a few minor bugs

See https://bugreports.qt.io/browse/QTBUG-71564 . This replaces -march=core-avx2
with -mavx2 for the respective bits of the code, to avoid interaction
with global -march=naitive in not freshest GCC. Otherwise, the build would
fail in that setup.

0.21.1 [2021-06-14]
-macOS: Fix a regression in the previous release that broke rendering of
strikeout (#3717)
-macOS: Fix a crash when rendering ligatures larger than 128 characters (#3724)
-Fix a regression in the previous release that could cause a crash when changing
layouts and mousing (#3713)

0.21.0 [2021-06-12]
-Allow reloading the kitty.conf config file by pressing ctrl+shift+f5. (#1292)
-Allow clicking URLs to open them without needing to also hold ctrl+shift
-Allow remapping all mouse button press/release events to perform arbitrary
actions. See details.
-Support infinite length ligatures (#3504)
-Backward incompatibility: The options to control which modifiers keys to press
for various mouse actions have been removed, if you used these options, you will
need to replace them with configuration using the new mouse actions framework as
they will be ignored. The options were: terminal_select_modifiers,
rectangle_select_modifiers and open_url_modifiers.
-Add a configurable mouse action (ctrl+alt+triplepress to select from the
clicked point to the end of the line. (#3585)
-Add the ability to un-scroll the screen to the kitty @ scroll-window remote
control command (#3604)
-A new option, tab_bar_margin_height to add margins around the top and bottom
edges of the tab bar (#3247)
-Unicode input kitten: Fix a regression in 0.20.0 that broke keyboard handling
when the NumLock or CapsLock modifiers were engaged. (#3587)
-Fix a regression in 0.20.0 that sent incorrect bytes for the F1-F4 keys in rmkx
mode (#3586)
-macOS: When the Apple Color Emoji font lacks an emoji glyph search for it in
other installed fonts (#3591)
-macOS: Fix rendering getting stuck on some machines after sleep/screensaver
(#2016)
-macOS: Add a new Shell menu to the global menubar with some commonly used
actions (#3653)
-macOS: Fix the baseline for text not matching other CoreText based applications
for some fonts (#2022)
-Add a few more special commandline arguments for the launch command. Now all
KITTY_PIPE_DATA is also available via command line argument substitution (#3593)
-Fix dynamically changing the background color in a window causing rendering
artifacts in the tab bar (#3595)
-Fix passing STDIN to launched background processes causing them to not inherit
environment variables (#3603)
-Fix deleting windows that are not the last window via remote control leaving no
window focused (#3619)
-Add an option kitty @ get-text --add-cursor to also get the current cursor
position and state as ANSI escape codes (#3625)
-Add an option kitty @ get-text --add-wrap-markers to add line wrap markers to
the output (#3633)
-Improve rendering of curly underlines on HiDPI screens (#3637)
-ssh kitten: Mimic behavior of ssh command line client more closely by executing
any command specified on the command line via the users' shell just as ssh does
(#3638)
-Fix trailing parentheses in URLs not being detected (#3688)
-Tab bar: Use a lower contrast color for tab separators (#3666)
-Fix a regression that caused using the title command in session files to stop
working (#3676)
-macOS: Fix a rare crash on exit (#3686)
-Fix ligatures not working with the Iosevka font (requires Iosevka >= 7.0.4)
(TritonDataCenter#297)
-Remote control: Allow matching tabs by index number in currently active OS
Window (#3708)
-ssh kitten: Fix non-standard properties in terminfo such as the ones used for
true color not being copied (TritonDataCenter#312)

The rust toolchain emits unusable R_AARCH64_ADR_PREL_PG_HI21 relocations
with rust's default -pie setting, so BUILDLINK_TRANSFORM it to -fPIC.

* Prevent an AttributeError that occurs when a server returns HTTP 3xx
  but doesn't include a Location header as well. (TritonDataCenter#267)
* Prevent a TypeError crash that may occur when including a username and
  password in the feed URL. (TritonDataCenter#276)
* Prevent a UnicodeDecodeError crash that may occur when the title
  element's type attribute exists but is empty. (TritonDataCenter#277)
* Prevent a UnicodeEncodeError crash that may occur if the URL contains
  Unicode characters in the path. (TritonDataCenter#273)
* Fix an issue with the HTTP request status on Python >= 3.9.

Updating during the freeze for the bugfixes.

These are leftover from the NetBSD base system where having lots
of specific warning flags makes sense because the system is compiled
with -Werror, but here they just cause portability problems.

Reported as breaking the bootstrap on HP-UX by Lehel Bernadt on
pkgsrc-users@.

this is easier than dealing with prefixed ruby commands

Candidate fix for PR pkg/56261

use the "ARM" CPU yield code (actually portable C) on everything where
there's not inline ASM.

while here, comment patches, convert line endings to unix.

Relax dependency to ruby-unicode-display_width and it fixes runtime problem
of www/ruby-jekyll.  (Noted by wiz@ via private e-mail.)

Bump PKGREVISION.

Dependency added directly to the package in lieu of a mk/atomic128.mk,
due to freeze.

This is a bugfix release.

- Fixed a bug that caused the NSEC salt to be changed for KASP zones on every
  startup.

- Signed, insecure delegation responses prepared by named either lacked the
  necessary NSEC records or contained duplicate NSEC records when both wildcard
  expansion and CNAME chaining were required to prepare the response. This has
  been fixed.

- Queries where the wildcard match contained the letter W failed to return the
  correct response as the W was mapped to \000.

- Checking of key-directory and dnssec-policy was broken. The checks failed to
  account for key-directory inheritance.

Full release notes:
https://bind9.readthedocs.io/en/v9_16/notes.html#notes-for-bind-9-16-18

The problem was:

~/usr/include/g++/bits/c++0x_warning.h:32:2: error: #error
This file requires compiler and library support for the ISO C++ 2011 standard.
This support must be enabled with the -std=c++11 or -std=gnu++11 compiler options.
 #error This file requires compiler and library support \
  ^~~~~

PKG_REVISION bumped as it simply would have not built in the
prescence for tiff 4.3, so there is no functional change for versions
that did build.

+ ImageMagick-7.1.0.0, gdbm-1.20, libffcall-2.4, maim-5.7.4,
  pandoc-2.14.0.2, pcre-8.45, tor-0.4.6.5.

from Iku Iwasa

0.6.6 - Changed the YouTube API client to capture more videos.
0.6.5 - Videos which are UNPLAYABLE won't just fail anymore.
0.6.4 - the YouTube handler uses the new(ish) youtube API now.
0.6.3 - YouTube has changed the get_video_info URL. Should fix TritonDataCenter#3.
0.6.2 - not taged upstream.

Fixes configuring in print/scribus-qt5.

Brief description of changes:
-add comment_collapsing feature (default binds to tab) to toggle collapsing of
a comment
-disable rendering non-ascii characters by default to avoid some weird behaviors
on terminal. To enable rendering all unicode characters, set allow_unicode
option to true.

…ariant

used in a different compilation unit, so this builds with newer gcc
versions.

Security release.

v2.3.15 2021-06-21  Aki Tuomi <[email protected]>

* CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
  JWT tokens. This may be used to supply attacker controlled keys to
  validate tokens, if attacker has local access.
* CVE-2021-33515: On-path attacker could have injected plaintext commands
  before STARTTLS negotiation that would be executed after STARTTLS
  finished with the client.
* Disconnection log messages are now more standardized across services.
  They also always now start with "Disconnected" prefix.
* Dovecot now depends on libsystemd for systemd integration.
* Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
* config: Some settings are now marked as "hidden". It's discouraged to
  change these settings. They will no longer be visible in doveconf
  output, except if they have been changed or if doveconf -s parameter
  is used. See https://doc.dovecot.org/settings/advanced/ for details.
* imap-compress: Compression level is now algorithm specific.
  See https://doc.dovecot.org/settings/plugin/compress-plugin/
* indexer-worker: Convert "Indexed" info logs to an event named
  "indexer_worker_indexing_finished". See
  https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
+ Add TSLv1.3 support to min_protocols.
+ Allow configuring ssl_cipher_suites. (for TLSv1.3+)
+ acl: Add acl_ignore_namespace setting which allows to entirely ignore
  ACLs for the listed namespaces.
+ imap: Support official RFC8970 preview/snippet syntax. Old methods of
  retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
  with explicit algorithm selection") have been deprecated.
+ imapc: Support INDEXPVT for imapc storage to enable private
  message flags for cluster wide shared mailboxes.
+ lib-storage: Add new events: mail_opened, mail_expunge_requested,
  mail_expunged, mail_cache_lookup_finished. See
  https://doc.dovecot.org/admin_manual/list_of_events/#mail
+ zlib, imap-compression, fs-compress: Support compression levels that
  the algorithm supports. Before, we would allow hardcoded value between
  1 to 9 and would default to 6. Now we allow using per-algorithm value
  range and default to whatever default the algorithm specifies.
- *-login: Commands pipelined together with and just after the authenticate
  command cause these commands to be executed twice. This applies to all
  protocols that involve user login, which currently comprises of imap,
  pop3, submisision and managesieve.
- *-login: Processes are supposed to disconnect the oldest non-logged in
  connection when process_limit was reached. This didn't actually happen
  with the default "high-security mode" (with service_count=1) where each
  connection is handled by a separate process.
- *-login: When login process reaches client/process limits, oldest
  client connections are disconnected. If one of these was still doing
  anvil lookup, this caused a crash. This could happen only if the login
  process limits were very low or if the server was overloaded.
- Fixed building with link time optimizations (-flto).
- auth: Userdb iteration with passwd driver does not always return all
  users with some nss drivers.
- dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
  disabled. If a user has a shared mailbox which is another user's INBOX,
  dsync didn't include the mailbox in syncing unless explicit naming is
  enabled with "mail_shared_explicit_inbox" set to "yes".
- dsync: Shared namespaces were not synced with "-n" flag.
- dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
  If a user has a shared mailbox that is another user's INBOX, dsync
  failed to export the mailbox if mail attributes are disabled.
- fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
  requests to assert-crash: Panic: file http-client-request.c: line 1232
  (http_client_request_send_more): assertion failed: (req->payload_input != NULL)
- fts-tika: 5xx errors returned by Tika server as indexing failures.
  However, Tika can return 5xx for some attachments every time.
  So the 5xx error should be retried once, but treated as success if it
  happens on the retry as well. v2.3 regression.
- fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
  resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
  assertion failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))
- imap: SETMETADATA could not be used to unset metadata values.
  Instead NIL was handled as a "NIL" string. v2.3.14 regression.
- imap: IMAP BINARY FETCH crashes at least on empty base64 body:
  Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
  assertion failed: (block_count == 0 || block_idx+1 == block_count)
- imap: If IMAP client using the NOTIFY command was disconnected while
  sending FETCH notifications to the client, imap could crash with
  Panic: Trying to close mailbox INBOX with open transactions.
- imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
  when IMAP commands are >8 kB long.
- imapc: If remote server sent BYE but didn't immediately disconnect, it
  could cause infinite busy-loop.
- lib-index: Corrupted cache record size in dovecot.index.cache file
  could have caused a crash (segfault) when accessing it.
- lib-oauth2: JWT token time validation now works correctly with
  32-bit systems.
- lib-ssl-iostream: Checking hostnames against an SSL certificate was
  case-sensitive.
- lib-storage: Corrupted mime.parts in dovecot.index.cache may have
  resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
  assertion failed: (text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0))
- lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
  preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
  session could have accessed all of the emails' metadata to read their
  POP3 UIDL (opening dbox files).
- listescape: When using the listescape plugin and a shared namespace
  the plugin didn't work properly anymore resulting in errors like:
  "Invalid mailbox name: Name must not have '/' character."
- lmtp: Connection crashes if connection gets disconnected due to
  multiple bad commands and the last bad command is BDAT.
- lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
  forwarded by LMTP proxy without checking that the backend has support.
  This caused a command parameter error from the backend if it was
  running an older Dovecot release. This could only occur in more complex
  setups where the message was proxied twice; when the proxy generated
  the XRCPTFORWARD parameter itself the problem did not occur, so this
  only happened when it was forwarded.
- lmtp: The LMTP proxy crashes with a panic when the remote server
  replies with an error while the mail is still being forwarded through
  a DATA/BDAT command.
- lmtp: Username may have been missing from lmtp log line prefixes when
  it was performing autoexpunging.
- master: Dovecot would incorrectly fail with haproxy 2.0.14 service
  checks.
- master: Systemd service: Dovecot announces readiness for accepting
  connections earlier than it should. The following environment variables
  are now imported automatically and can be omitted from
  import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
- master: service { process_min_avail } was launching processes too
  slowly when master was forking a lot of processes.
- util: Make the health-check.sh example script POSIX shell compatible.

	mail/dovecot2
	mail/dovecot2-gssapi
	mail/dovecot2-ldap
	mail/dovecot2-mysql
	mail/dovecot2-pgsql
	mail/dovecot2-sqlite
VS: ----------------------------------------------------------------------

Security release.

v0.5.15 2021-06-21  Aki Tuomi <[email protected]>

* CVE-2020-28200: Sieve interpreter is not protected against abusive
  scripts that claim excessive resource usage. Fixed by limiting the
  user CPU time per single script execution and cumulatively over
  several script runs within a configurable timeout period. Sufficiently
  large CPU time usage is summed in the Sieve script binary and execution
  is blocked when the sum exceeds the limit within that time. The block
  is lifted when the script is updated after the resource usage times out.
* Disconnection log messages are now more standardized across services.
  They also always now start with "Disconnected" prefix.
- managesieve: Commands pipelined together with and just after the
  authenticate command cause these commands to be executed twice.

qemu-system-alpha where FEN traps were never generated.  Fixes
a whole slew of FP-related problems on NetBSD/alpha running in
Qemu (including a broken jot(1)).

Bump package version to qemu-6.0.0nb2.

it works just fine without it, and consolekit introduces a mozjs
dependency that breaks the package on e.g. arm

- Disable kqueue when EVFILT_USER is detected as missing by CMake.
- Use Linux procfs when F_GETPATH is missing.
- Define ppoll to pollts.

This version updates Tor to 0.4.5.9, including important security
fixes.

Warning:

Tor Browser will stop supporting version 2 onion services later
this year. Please see the previously published deprecation timeline.
Migrate your services and update your bookmarks to version 3 onion
services as soon as possible.

…oken