Current File : //usr/share/doc/perl-Module-Signature/Changes
[Changes for 0.88 - Sat Dec 18 11:34:44 CST 2021]
* Update PAUSE keys to 2022. (@skaji)
[Changes for 0.87 - Sat Jul 4 15:04:41 CST 2020]
* Skip 3-verify.t on Crypt::OpenPGP installations. (@pyramation)
[Changes for 0.86 - Thu Jun 25 21:06:24 CST 2020]
* Update PAUSE and ANDK keys to 2020. (@dweekly)
* Update documentation pertaining to SHA1. (@dweekly)
* Fix compatibility with Crypt::OpenPGP. (@niklasholm)
[Changes for 0.83 - Wed Aug 29 17:33:12 JST 2018]
* Update META.yml.
[Changes for 0.82 - Sun Aug 26 23:00:04 CST 2018]
* Fix CRLF handling on Win32. (@niklasholm)
* Default to SHA256 on new hashes as SHA1 is deprecated. (@niklasholm)
[Changes for 0.79 - Mon May 18 23:02:11 CST 2015]
* Restore "cpansign --skip" functionality.
Contributed by: CLOOS
[Changes for 0.78 - Thu Apr 9 16:58:27 CST 2015]
* Fix verify() use from cpanm and CPAN.pm.
Contributed by: ANDK
[Changes for 0.77 - Wed Apr 8 19:36:50 CST 2015]
* Include the latest public keys of PAUSE, ANDK and AUDREYT.
* Clarify scripts/cpansign copyright to CC0.
Reported by: @pghmcfc
[Changes for 0.76 - Wed Apr 8 18:05:48 CST 2015]
* Fix signature tests by defaulting to verify(skip=>1)
when $ENV{TEST_SIGNATURE} is true.
Reported by: @pghmcfc
[Changes for 0.75 - Tue Apr 7 04:56:09 CST 2015]
Two more issues reported by John Lightsey:
* Update ChangeLog.
* More protection of @INC from relative paths.
Fix various issues reported by John Lightsey:
[Changes for 0.74 - Tue Apr 7 02:39:14 CST 2015]
Fix various issues reported by John Lightsey:
* Fix GPG signature parsing logic.
* MANIFEST.SKIP is no longer consulted unless --skip is given.
* Properly use open() modes to avoid injection attacks.
[Changes for 0.73 - Wed Jun 5 23:44:57 CST 2013]
* Properly redo the previous fix using File::Spec->file_name_is_absolute.
[Changes for 0.72 - Wed Jun 5 23:19:02 CST 2013]
* Only allow loading Digest::* from absolute paths in @INC,
by ensuring they begin with \ or / characters.
Contributed by: Florian Weimer (CVE-2013-2145)
[Changes for 0.71 - Tue Jun 4 18:24:10 CST 2013]
* Constrain the user-specified digest name to /^\w+\d+$/.
* Avoid loading Digest::* from relative paths in @INC.
Contributed by: Florian Weimer (CVE-2013-2145)
[Changes for 0.70 - Thu Nov 29 01:45:54 CST 2012]
* Don't check gpg version if gpg does not exist.
This avoids unnecessary warnings during installation
when gpg executable is not installed.
Contributed by: Kenichi Ishigaki
[Changes for 0.69 - Fri Nov 2 23:04:19 CST 2012]
* Support for gpg under these alternate names:
gpg gpg2 gnupg gnupg2
Contributed by: Michael Schwern
[Changes for 0.68 - Fri, 13 May 2011 11:51:50 +0200]
* Fix breakage introduced by 0.67 (Andreas König).
[Changes for 0.67 - Sun, 17 Apr 2011 16:29:23 +0200]
* Better handling of \r (Andreas König, Zefram) (Closes RT#46339).
[Changes for 0.66 - Fri, 6 Sep 2010 22:51:37 +0200]
* Fix incompatibility with EU::Manifest 1.54 to 1.57
(Paul Howarth) (Closes RT#61124).
[Changes for 0.65 - Fri, 3 Sep 2010 21:38:02 +0200]
* Skip MYMETA (Alexandr Ciornii)
[Changes for 0.64 - Sun, 9 May 2010 00:50:11 +0200]
* Avoid creating gnupg configuration files for the user invoking Makefile.PL
(Closes RT#41978).
* Correctly detect the version of gnupg on cygwin and add tests for it
(Paul Fenwick) (Closes RT#39258).
[Changes for 0.63 - Sun, 28 Mar 2010 04:46:27 +0100]
* Fix diagnostic message from Makefile.PL when the user dosn't have gnupg or
Crypt::OpenPGP (miyagawa).
[Changes for 0.62 - Tue, 23 Mar 2010 22:17:39 +0100]
* Change the default keyserver from the outdated pgp.mit.edu to
pool.sks-keyservers.net.
[Changes for 0.61 - 2009年11月19日 周四 00時56分41秒 CST]
* Added "=encoding utf8" to POD to fix author name display.
No functional changes.
[Changes for 0.60 - 2009年11月16日 周一 22時48分54秒 CST]
* LICENSING CHANGE: This compilation and all individual files in it
are now under the nullary CC0 1.0 Universal terms:
To the extent possible under law, 唐鳳 has waived all copyright and
related or neighboring rights to Module-Signature.
* Updated Module::Install to 0.91, prompted by Florian Ragwitz.
[Changes for 0.55 - 2006-07-29]
* ANDK submitted a patch to fix versioning problem when
the user elects to install Crypt::OpenPGP.
* Major refactoring of the Makefile.PL to ease the installation process.
[Changes for 0.54 - 2006-05-12]
* Fixed a long-standing bug where differing end-of-line conventions
could cause bogus comparisons in signature checks.
* Fixed another long-standing bug where CRLF text files were hashed
into different digests under Unix and Dosish platforms. Now it's
consistently hashed as if it's been normalized to LF.
* Optional dependencies are no longer installed-by-default.
[Changes for 0.53 - 2006-01-31]
* The explicit call to "readline(D)" didn't compile on earlier perls which
demanded either "readline(*D)" or "<D>" -- I elected the latter form.
Reported by: Matthew Persic
* Update my author key to reflect revoked past uids.
[Changes for 0.52 - 2006-01-19]
* POD and source code cleanup; no functional changes.
* Updated my author key to reflect my new name and identity.
* Upgrade to the latest Module::Install to fix Cygwin
installation problems.
Reported by: Lyle Ziegelmiller
[Changes for 0.51 - 2006-01-02]
* Even more flexible CRLF handling for SIGNATURE files,
Contributed by: Andreas Koenig.
[Changes for 0.50 - 2005-08-21]
* Add support for to SHA-256, requested by Mark Shelor in light
of the recent SHA1 attacks. SHA1 is still the default, but
you can now override this by settings MODULE_SIGNATURE_CIPHER
environment variable to SHA256.
[Changes for 0.45 - 2005-08-09]
* Andreas Koenig ported out that "Import GPG keys?" was asked
far too many times during autoinstall.
[Changes for 0.44 - 2004-12-16]
* Add "pmfiles.dat" to legacy manifest_skip routine to accomodate
early Win32 hacks. Reported by Steve Hay via Michael Schwern.
[Changes for 0.43 - 2004-12-16]
* Updated t/0-signature.t to be more friendly with Test::More;
contributed by Michael Schwern.
* Add $Timeout (default 3 seconds) to control the timeout for
probing connections to the key server.
* Take account of the .ts files produced by newer MakeMakers
in the suggested MANIFEST.SKIP list.
[Changes for 0.42 - 2004-11-20]
* Move under SVK version control management; ditch keyword tags.
* Michael Schwern pointed out that during development, the
"signature.t" file would keep failing.
* Documented how to generate SIGNATURE files as part of "make dist",
for Module::Install, ExtUtils::MakeMaker and Module::Build users .
[Changes for 0.41 - 2004-07-04]
* Mark Shelor points out that support for Digest::SHA was broken.
[Changes for 0.40 - 2004-07-01]
* Dave Rolsky points out that GPG version detection always
returns '1'. (bug #6810)
[Changes for 0.39 - 2004-06-17]
* Supports Digest::SHA (now preferred) and Digest::SHA1::PurePerl,
in addition to the original Digest::SHA1 backend.
* We now asks before importing the default keys,
also suggested by Tels.
* Unknown cipher is made fatal, thanks to suggestion by Tels.
* Apply Dave Rolsky's patch to verify that author's pubkey
is available on a keyserver. may need more work.
[Changes for 0.38 - 2004-01-01]
* Update to the newest Module::Install.
* Not using inc/SCRIPT/ anymore.
* Add "#defaults" and "^blibdirs$" to recommended MANIFEST.SKIP
to pacify newer ExtUtil::MakeMaker.
* Starting to think about how to make "disttest" + "dist"
not signing twice.
[Changes for 0.37 - 2003-11-06]
* Move bin/cpansign to script/cpansign.
* Make cpansign exit upon failure.
[Changes for 0.36 - 2003-10-28]
* Use sign(1) to autosign ourselves.
* Soren A pointed out that hkp:// didn't work with GnuPG.
[Changes for 0.25 - 2003-08-28]
* Now ships with my pubkey and PAUSE's.
* Interactive Makefile.PL, suggested by Jarkko.
[Changes for 0.34 - 2003-08-18]
* Don't ask user to install Crypt::OpenPGP if she does not have a
C compiler anyway.
* ExtUtils::Manifest 1.38 does not support good enough skips even
for Makefile.PL, sigh.
[Changes for 0.33 - 2003-08-12]
* William Wentworth-Sheilds points out that META.yml is dynamic,
which makes SIGNATURE incorrect for people without either "diff"
or "gpg". Fixed.
[Changes for 0.32 - 2003-08-11]
* Take Schwern's patch to only set _maniskip for legacy EU::Manifest.
* Remove ::TieOut since we are not using it anymore.
* Reduce noise for untrusted signatures to two lines.
[Changes for 0.31 - 2003-08-10]
* Scott R. Godin pointed out 0.30 had bad signature. whoops.
[Changes for 0.30 - 2003-08-10]
* Add JHI to authors.
* Patch from Michael Schwern: only let GnuPG display anything
if we're handling suspicious keys, not when you have added
the signer into the trustdb.
* New global config variable, $Verbose.
* MODULE_SIGNATURE_VERBOSE, MODULE_SIGNATURE_KEYSERVER and
MODULE_SIGNATURE_KEYSERVERPORT env variables are now respected.
* Only supply _default_skip if our ExtUtils::MakeMaker is too old.
[Changes for 0.29 - 2003-08-08]
* Now fails gracefully all the time, including when incapable of
connecting to the keyserver.
* Also, SHA1 sum is still checked even if the user does not have
GnuPg/Crypt::OpenPGP.
* Hence, Crypt::OpenPGP is no longer a mandatory prerequisite even
for users without gnupg.
* "0E0" is now made into a constant, CANNOT_VERIFY.
* Do not die() when we absolutely can't verify.
* BZAJAC pointed out that we should add .svn to _default_skip.
[Changes for 0.28 - 2003-07-29]
* Remove Digest.pm dependency.
* Don't test for "diff -version" anymore -- not all diffs
have -version, thanks again to Alan Burlison.
[Changes for 0.27 - 2003-07-28]
* More punctuation cleanups in POD.
* Michael Schwern pointed out that successful tests shouldn't be noisy.
[Changes for 0.26 - 2003-07-17]
* New internal function, _verify(), that takes $sigfile as its first
argument, eliminating the "local $Module::Signautre::SIGNATURE" approach.
* sign() now also takes a skip=> parameter (defaults to true)
about whether to respect MANIFEST.SKIP. This needs to be
set to 0 to sign blib/ archives.
* Officially supporting signing and verification of PAR files, using PAR::Dist.
* Let's ignore warnings when performing on exe files
[Changes for 0.24 - 2003-07-08]
* Preliminary PAR support.
[Changes for 0.23 - 2003-07-07]
* Ken Williams noted that M::B now works on 5.005.
[Changes for 0.22 - 2003-05-15]
* Move Signature.pm to lib/Module/Signature.pm.
* Switch to the Module::Install framework.
* Updates TODO to reflect correspondence with andk.
* Matt Southall mentioned that, if somebody has never run gpg before,
we need to initialize it once before running test.
* Warn about potential 'Makefile' exploit as pointed out by Tels.
Document pending.
* Bugfix for incorrect 'MALFORMED' response to signatures made from
older versions of GnuPG, as reported by Tels.
[Changes for 0.18 - 2002-11-04]
* Binary files handling on win32 was broken. (Jos Boumans)
[Changes for 0.17 - 2002-10-30]
* Resolve bug report by Iain Truskett: cpansign -s should not complain
manifest mismatch if SIGNATURE is lacking.
* Also, bail out gracefully when signing fails, instead of crippling the
old SIGNATURE.
* MANIFEST.SKIP doc lifted from Test::Signature.
* Minor POD fixups.
[Changes for 0.16 - 2002-10-28]
* Adds AUTHORS file.
* Added connectivity probing for testing.
* Print a helpful success message after signing.
* Don't cripple old SIGNATURE file.
* Suggestion from Tels: skip the ambiguous 'optional'
probing for Crypt::OpenPGP if gnupg is there.
[Changes for 0.15 - 2002-10-17]
* Fixed compatibility with old MakeMaker versions, thanks to chromatic.
* Fixed "no /dev/tty" bug during smoke testing,
as reported by the excellent CPAN Smokers.
[Changes for 0.12 - 2002-10-12]
* Supports automatic key retrieval, implemented in Crypt::OpenPGP.
[Changes for 1.02 - 2002-10-12]
* Fixed the default cipher from MD5 back to SHA1.
[Changes for 0.10 - 2002-10-12]
* Fixed a problem that prevents earlier versions of GnuPG from fetching
public keys via --keyserver-option=auto-key-retrieve.
[Changes for 0.09 - 2002-10-12]
* Documented the package variables so they become part of APIs.
* Alternative (non-SHA1) ciphers in SIGNATUREs are now recognized.
* Added a new return value, CIPHER_UNKNOWN.
* Mention Test::Signature.
* Ditch Test::More from the sample script.
* Label tests.
[Changes for 0.09 - 2002-10-11]
* We're no longer alpha status; reflect in README.
* Incoporated a suggestion from Tels: undefining the $KeyServer
package variable should disable automatic key-fetching.
* Include the tests from Iain.
* Tels: disable KeyServer fetching if it's undef'ed.
[Changes for 0.07 - 2002-10-11]
* Fixed our own signatures.
[Changes for 0.06 - 2002-10-10]
* Use many-arg system() instead of the one-arg form to prevent security breach.
* Iain Truskett: fixed export bug so SIGNATURE_OK is properly exported.
* Introduced global $KeyServer variable, default at 'pgp.mit.edu'.
* Suggestion from Aurthur Bergman: cpansign without arg should DWIM.
* Set a default keyserver for cpansign -v.
* Use by-name params for functions. sign(override => $bool).
[Changes for 0.05 - 2002-08-14]
* Typo correction and safety checking.
[Changes for 0.04 - 2002-08-14]
* Added boilerplate text before SIGNATURE to explain what's it about.
* Crypt::OpenPGP signature didn't work.
* Add keyword expansion tags.
Mr. DellatioNx196 GaLers xh3LL Backd00r 1.0, Coded By Mr. DellatioNx196 - Bogor BlackHat