KRB5 1.16 releases.
Major changes in 1.16 (2017-12-05)
==================================
Administrator experience:
* The KDC can match PKINIT client certificates against the
"pkinit_cert_match" string attribute on the client principal entry,
using the same syntax as the existing "pkinit_cert_match" profile
option.
* The ktutil addent command supports the "-k 0" option to ignore the
key version, and the "-s" option to use a non-default salt string.
* kpropd supports a --pid-file option to write a pid file at startup,
when it is run in standalone mode.
* The "encrypted_challenge_indicator" realm option can be used to
attach an authentication indicator to tickets obtained using FAST
encrypted challenge pre-authentication.
* Localization support can be disabled at build time with the
--disable-nls configure option.
Developer experience:
* The kdcpolicy pluggable interface allows modules control whether
tickets are issued by the KDC.
* The kadm5_auth pluggable interface allows modules to control whether
kadmind grants access to a kadmin request.
* The certauth pluggable interface allows modules to control which
PKINIT client certificates can authenticate to which client
principals.
* KDB modules can use the client and KDC interface IP addresses to
determine whether to allow an AS request.
* GSS applications can query the bit strength of a krb5 GSS context
using the GSS_C_SEC_CONTEXT_SASL_SSF OID with
gss_inquire_sec_context_by_oid().
* GSS applications can query the impersonator name of a krb5 GSS
credential using the GSS_KRB5_GET_CRED_IMPERSONATOR OID with
gss_inquire_cred_by_oid().
* kdcpreauth modules can query the KDC for the canonicalized requested
client principal name, or match a principal name against the
requested client principal name with canonicalization.
Protocol evolution:
* The client library will continue to try pre-authentication
mechanisms after most failure conditions.
* The KDC will issue trivially renewable tickets (where the renewable
lifetime is equal to or less than the ticket lifetime) if requested
by the client, to be friendlier to scripts.
* The client library will use a random nonce for TGS requests instead
of the current system time.
* For the RC4 string-to-key or PAC operations, UTF-16 is supported
(previously only UCS-2 was supported).
* When matching PKINIT client certificates, UPN SANs will be matched
correctly as UPNs, with canonicalization.
User experience:
* Dates after the year 2038 are accepted (provided that the platform
time facilities support them), through the year 2106.
* Automatic credential cache selection based on the client realm will
take into account the fallback realm and the service hostname.
* Referral and alternate cross-realm TGTs will not be cached, avoiding
some scenarios where they can be added to the credential cache
multiple times.
* A German translation has been added.
Update to u-boot-master model, moved MAINTAINER to uboot@. This brings the
version from 2016.05 (super old) to 2017.09 under the unified FreeBSD u-boot
model.
All of the patches previously here have been made redundant, either by
upstream or by using our U-Boot repository with FreeBSD patches applied.
Reviewed by: imp, manu
Approved by: imp, jmcneill (maintainer)
Differential Revision: https://reviews.freebsd.org/D13352
Changelog:
tbuilder:
- Add flavors support, add 'all' alias to build all flavors
upgrade-ports:
- Use deinstall instead of reinstall, make backup package so things
can be restored when install fails
- Improve usage help description
- Add flavors support
Changes: https://github.com/freebsd/poudriere/wiki/release_notes_323
- bulk: Fix MOVED origin not causing a package rebuild. This
could result in a reverse dependency continuing to rebuild
due to a "new dependency" now with FLAVORS support.
- jail -c -m null: Fix this to work rather than error about
having an existing directory already.
- jail -c -m src: Respect existing _/usr/src/.cpignore_
- jail -c -m null -S: Respect the `-S path` rather than assume the jail has
a _/usr/src_.
- jail -c -m null: Assert that the jail is populated already.
- HTML: Throw explicit error if unknown ports type is encountered. [1]
PR: 224065 [1]
It offers controls to play, pause, stop the music, as well as
navigate back and forth the current playlist.
musicpd volume can be set with the mouse wheel.
WWW: https://github.com/yogsothoth/wmmp
PR: 216904
Submitted by: nicolasherry@gmail.com
