** New operation mode: proxy

** Command line option precedence

Command line options take precedence over configuration file
statements.

** elif statement

A familiar `elif' statement is supported, e.g.:

if condition-1
  action-list-1
elif condition-2
  action-list-2
elif condition-3
  action-list-3
else
  action-list-4
fi
  
** New CONTROL statement esmtp-auth-delayed.

When set to `yes', this statement instructs Anubis to postpone ESMTP
authentication until MAIL command is issued by the client.  This
allows to change authentication credentials in the SMTP section (see
below).

** SMTP section

The new section "SMTP" is invoked each time an SMTP command
is received. This section may alter the command's argument, using the
"modify command", e.g.:

BEGIN SMTP
regex :extended
modify command [ehlo] "foo.bar.net"
if command ["mail from:"] "<(.*)>(.*)"
  modify command ["mail from:"] "<root@bar.net>\2"
fi
END

It is also allowed to use esmtp-* keywords in this section, provided
that `esmtp-auth-delayed yes' is set in the CONTROL section. Changes
in the ESMTP authentication credentials take effect if they occur
either before receiving MAIL command from the client, or when handling
this command, e.g.:

BEGIN SMTP
if command ["mail from:"] "<smith(\+.*)?@@example.net>"
  esmtp-auth-id smith
  esmtp-password guessme
else
  esmtp-auth no
fi
END

** New keywords: log-facility and log-tag

** Guile output

By default Scheme's standard error and output ports are redirected to
syslog, using priorities `err' and `warning' correspondingly.

** MySQL options file

When using MySQL for Anubis user database, the database parameters and
access credentials are read from the file /etc/my.cnf, section
"anubis".  Additionally, two URL parameters are provided:
"options-file", which sets the name of the options file, and
"options-group", which sets the name of the group.

* Fix threshold calculation in the cleaner module.
* Refuse to start if another copy is already running.

* New command line option --init (-i)

* New format flags: down=N, child=S, sibling=S

* New guile primitives:

- (grecs-node-ident-locus node [full])

Returns the location of the node's identifier.  See below for the meaning
of [full].

- (grecs-node-value-locus node [full])

Returns the location of the node's value.

* Full vs. simplified locations.

There are two flavors of source locations: simplified and full ones.  A
simplified location consists of a file name and line number.  When returned
from a Guile primitive, they are packed in a cons.  A simplified location
shows an approximate location of the object in the configuration file.

A full location provides the exact location of the object.  It consists of
a pair of triplets, which mark the beginning and end of the object.  Each
triplet consists of a file name, line number and column number.  When 
returned from a Guile primitive, each triplet is represented as a list of 
three elements and both triplets are packed in a cons, the start location 
being its car, and the end location being its cdr.

The three functions that return node locations, grecs-node-locus,
grecs-node-ident-locus and grecs-node-value-locus, return simplified
locations by default.  If #t is supplied as the optional second
argument, these functions return full locations.

* Fix CVE-2015-1197
* Fix CVE-2016-2037
* Fix CVE-2019-14866

* New configuration variable DEFAULT_PIDFILE_NAME

Use it to alter the default pidfile location, e.g.:

   ./configure DEFAULT_PIDFILE_NAME=/var/dico/dicod.pid

* Fix compilation on 32-bit systems

* The path statement can refer to a regular file.

Prior versions of direvent required the argument to the "path"
statement to refer to an existing directory.  This requirement is now
lifted.  The pathname can refer to any type of file (not only a
directory).  Moreover, the file is not required to exist.  If it does
not exist, direvent will set up an auxiliary watcher (called a
"sentinel"), that will wake up upon creation of the file with that
pathname and will set up the configured watcher once it is created.

The process is reversed when the file referred to by the "path"
statement is deleted.  In that case, the configured watcher is
deactivated and a sentinel is set up which will bring it back when the
destination file or directory is created.

This mode of operation ensures that the configured watcher will always
be operational.

* Fix watcher removal on BSD-like systems.

* Configuration changes

** multiple environ statements

Multiple environ statements can be used within a single watcher block.
Such statements accumulate.

* Exponential backoff with jitter

If AWS responds with a RequestLimitExceeded code, eclat retries the
request using exponential backoff with jitter algorithm. The algorithm
is controlled by two values: max-retry-interval and total-retry-timeout.
When the RequestLimitExceeded error is returned, eclat will sleep for
2 seconds and then retry the request. For each subsequent
RequestLimitExceeded error, it will calculate the timeout using the
following formula:

   t = rand(0, min(M, 2 ** N)) + 1

where N is the attempt number, M is the value of max-retry-interval
parameter, 'rand(a,b)' selects the integer random number X such that
0 <= X <= b, and '**' denotes the power operator. The attempts to resend
the request will continue until either a response other than
RequestLimitExceeded is received (be it a response to the query or
another error response), or the total time spent in the retry loop
becomes equal to or greater than total-retry-timeout, whichever occurs
first.

* VPC Support

The following new commands provide full support for manipulating
the EC2 VPC objects:

 lsvpc	        describe-vpcs
 lsvpcattr      describe-vpc-attribute
 mkvpc          create-vpc
 setvpcattr     modify-vpc-attribute
 rmvpc          delete-vpc

* Route table support

The following new commands provide full support for manipulating
the EC2 Route Table objects:

 assocrtab      AssociateRouteTable
 mkrtab         CreateRouteTable
 rmrtab         DeleteRouteTable
 lsrtab         DescribeRouteTables
 disasrtab      DisassociateRouteTable

* Route support

The route subcommand allows you to add, delete and modify routes in
route tables.

** Create route:

 eclat route rtb-12345678 add CIDR gw ID

** Delete route:

 eclat route rtb-12345678 del CIDR

** ReplaceRoute

 eclat route rtb-12345678 repl CIDR gw ID
 
* Subnet support

The following new commands provide full support for manipulating
the EC2 Subnet objects:

 mksubnet       create-subnet 
 rmsubnet       delete-subnet
 lssubnet       describe-subnets
 setsubnetattr  modify-subnet-attribute

* Internet Gateway support
 
The following new commands provide full support for manipulating
the EC2 Internet Gateway objects:

 lsigw          describe-internet-gateways
 mkigw          create-internet-gateway
 rmigw          delete-internet-gateway
 atigw          attach-internet-gateway
 deigw          detach-internet-gateway

Initial release.

* Implement heartbeat event

* Add auxiliary program: ifactive

* Fix file descriptor leak

* The program is installed in /usr/bin

Prior versions went to /usr/sbin, you will need to remove them
manually.

* Print /etc/issue before the prompt
* Sleep after incorrect password is input
* New options: -i (--issue), -s (--sleep), -c (--clear)
* Add a manpage
* Improve error checking and reporting

* The --callout-socket option

New option --callout-socket=URL instructs mailfromd to use URL to pass
callout requests to the callout server listening on URL. It is
equivalent to the callout-url configuration statement, which it
overrides.

This option is used by mtasim to avoid clobbering the existing callout
sockets when starting new mailfromd instance.

* NS lookup NFL functions

This release implements the following new MFL functions:

number primitive_hasns (string DOM)
  Returns 1 if the domain DOM has at least one NS record and 0
  otherwise. Throws an error if DNS lookup fails.

require 'dns'
number hasns (string DOM)
  Same as above, but returns 0 on DNS lookup failures.

string getns (string DOM ; number RESOLVE, number SORT)

  Returns a whitespace-separated list of all the NS records for
  the domain DOM. If optional parameter RESOLVE is 1, the returned list
  contains IP addresses. Optional SORT controls whether the entries are
  sorted.

* Bugfixes
** Callout functions return true on checking the null return address (<>)
** Arguments in transaction between mailfromd and calloutd are quoted
** Avoid false failures in testsuite due to libadns warnings
** configure --with-dbm=T accepts any T supported by mailutils
** The 'dbdel' built-in silently ignores non-existing keys

* dotmail: fix mailbox opening in append-only mode

* Fix mda testsuite

The tests don't depend on the selected default mailbox format.

* New options to configure:

    --disable-build-mda     do not build mda
    --disable-build-lmtpd   do not build lmtpd
    --disable-build-putmail do not build putmail

* Remove deprecated functions

Following is a complete list of deprecated functions.  For the record,
each function name is followed by a short instruction on how to
replace eventual use of this function in old code.

    . mu_body_get_stream
    . mu_message_get_stream
    . mu_mailer_get_stream
    . mu_header_get_stream
       These functions should not be used at all.
       They will reappear within a couple of releases as synonyms
       for the corresponding _get_streamref functions, after which
       the latter will be gradually removed. Thus, at the end of
       the transition perion _get_streamref's will be replaced by
       _get_stream.
    
    . mu_sieve_compile_buffer
       Replaced by mu_sieve_compile_text.
       Old code:
         rc = mu_sieve_compile_buffer (mach, buf, bufsize, fname, line);
       New code:
         struct mu_locus_point loc = MU_LOCUS_POINT_INITIALIZER;
         mu_locus_point_set_file (&loc, fname);
         loc.mu_line = line;
         rc = mu_sieve_compile_text (mach, buf, bufsize, &loc);
         mu_locus_point_deinit (&loc);
    
    . mu_address_to_string
       Use mu_address_get_printable instead.
    
    . mu_address_format_string
       Use mu_stream_format_address instead. E.g. to print to a string:
    
         char buf[100];
         stream_t str;
         mu_fixed_memory_stream_create (&str, buf, sizeof(buf), MU_STREAM_WRITE);
         rc = mu_stream_format_address (str, addr);
    
    . mu_registrar_get_list
       Should not be used.  Use mu_registrar_get_iterator if you need to
       iterate over the list.
    
    . mu_mailbox_save_attributes
       Replaced by mu_mailbox_sync.
    
    . mu_msgset_print
       Use mu_stream_msgset_format.
       Old code:
         rc = mu_msgset_print (mu_stream_t str, mu_msgset_t mset);
       New code:
         rc = mu_stream_msgset_format (str, mu_msgset_fmt_imap, mset);

* Remove deprecated ioctls

The following ioctl codes have been removed: MU_IOCTL_LOGSTREAM_GET_LOCUS,
and MU_IOCTL_LOGSTREAM_SET_LOCUS.

* mail: fix composing MIME messages

- Make sure message body has inline disposition (fixes bug #54992).
- When building the "filename" parameter of the Content-Disposition
  header, and the "name" parameter of the Content-Type header, strip
  directory components off the original file name (fixes bug #57431).

* Fix build on FreeBSD

* Fix detection of Kerberos libraries

* Fix build with Python 3.8 (bug #57318)

* Minor fixes in mysqlstat-setup
* Provide default values for NULL columns

* Add README, improve meta-data

First actual release.

* Add missing symbol

pam_innetgr lacked pam_sm_setcred

* New option --no-init

The --no-init option instructs pies not to switch to init mode if its
PID is 1.  Use this option if you run pies as a process manager in a
docker container.

* New component modes: startup and shutdown

Startup components are run right after pies startup. Any other
components start running only after last startup component has terminated.

Shutdown components are executed at program shutdown, after
all other components have been terminated.

Any number of startup or shutdwon components can be defined in the
configuration file. Such multiple components are run simultaneously,
unless required otherwise by their "prerequisites" and "dependents"
statements. 

* New component flag: shell

The 'shell' flag instructs pies to run the component via "/bin/sh -c
$command". Use it if the command should undergo variable expansion,
contains redirections, pipes, etc. E.g.

  component X {
    flags shell;
    command "if [ -n \"$X\" ]; then foo; else bar; fi"
  }

* Improved cyclic dependency diagnostics

* New 'env' statement

The 'env' statement has been re-implemented as a compound statement.
It can contain the following sub-statements:

** clear
Clears the environment

** keep NAME
Keeps the variable NAME when clearing the environment. Implies
"clear". NAME can be a globbing pattern, in which case all
variables matching the pattern are retained.

** set "NAME=VALUE"
Sets the environment variable for the component. VALUE is subject
to variable expansion.

** eval "VALUE"
Perform variable expansion on VALUE and discard the result (similar
to the shell ":" command). Useful for side effects, e.g.:

  eval ${HOME:=/home/t}

** unset NAME
Unsets the variable. NAME can be a globbing pattern, in which case all
variables matching the pattern are unset.

Example:

 env {
   clear;
   keep PATH;
   keep MANPATH;
   keep "LC_*";
   set "MANPATH=$MANPATH${MANPATH:+:}/usr/local/man";
 }

* Legacy 'env' statement.

Support for the old one-line syntax of "env" is retained for
backward compatibility.

Previous versions applied unnecessary word splitting if given a
single argument. This is now fixed, so that e.g. the following
statement is processed correctly and defines a single variable
X to have the value "foo bar":

  env "X=foo bar"

* New environment variable available for commands started from return-code

Programs started via "exec" statement in the "return-code" block
obtain the PID of the master pies process in environment variable
PIES_MASTER_PID.

* Improved testsuite

* Configuration file raddb/config

The syslog statement takes an optional 4th argument specifying syslog
tag to use, e.g.:

    channel default {
	    syslog local1.info radiusd;
    };

* New attributes

** GNU-Server-Address

Holds IP address of the RADIUS server that recieved the
request. Notice, that the value of this attribute is "0.0.0.0" if
there are no `listen' statement in your `raddb/config'.
    
** GNU-Server-Port

Holds UDP port number of the RADIUS server that recieved the request.

* Automake function AM_GNU_RADIUS is provided, for checking if
GNU Radius is installed from configure.ac scripts.

* Guile support requires Gule version 1.8 or later.

* Bugfixes
** Pass NAS-IP-Address to mlc_stop_query	
	

* Include updated wordsplit version (v1.0-7-g6ccb9ad)
* Allow for multiple EOLs and comments after the preface statement.
* Bugfix in the testcase 20.

* Support SNMPv3
* Default SNMP version is 2c
* Use newer Grecs
* Drop unneeded dependencies
* Variable assignments in expressions
* Detection of SNMP counter overflows
* Comma operator
* Support for indexed MIBs

This feature allows you to use symbolic names instead of the fixed MIBs
for MIBs that are part of SNMP subtrees.  For example, to get number of
packets sent over eth0 into variable "out", you would do the following:

    table iftable IF-MIB::ifDescr;
    variable out "IF-MIB::ifOutUcastPkts.$iftable[eth1]";

The first statement converts the subtree into a "table" named "iftable".
The second statement references an entry in this table that has
the value "eth1".  For example, if the SNMP tree has the following MIB

    IF-MIB::ifDescr.10: eth0

then the expression "$iftable[eth]" yields "10"

* Assertion syntax changed.

The assertion statement takes a single argument, which must be a
string consisting of the following three parts:

   <oid: string> [!]<opcode>[/i] <value: string>

The <opcode> part can be either an arithmetical operator (=, <, <=, >,
>=), or any of the following string operators:

    eq          string equality
    ne          string inequality
    prefix      oid value must begin with <value>
    suffix      oid value must end with <value>
    glob        <value> is a glob(7) pattern that oid value must match
    
Each of these can be suffixed with "/i" to request case-insensitive comparison.

A "!" in front of opcode reverts its meaning.   

The <value> part must not include the type prefix.

* new module: ldap

* mailutils: Requires 2.99.98 or later

* Fix the use of --checkpoint without explicit --checkpoint-action

* Fix extraction with the -U option

See http://lists.gnu.org/archive/html/bug-tar/2019-01/msg00015.html,
for details

* Fix iconv usage on BSD-based systems

* Fix possible NULL dereference (savannah bug #55369)

* Improve the testsuite

Rewrite as a stand-alone snmpd agent.

* Automatic VCS detection.

* Don't descend into internal VCS directories during the scan.

* Minor change

* Restore backward compatibility with Varnish versions prior to 6.2.

* Builds with Varnish 6.3.1

* Support for Varnish 6.3.1

* Support for Varnish 6.3.1

* Support for Varnish 6.0.2

* Variable expansion syntax

This release uses wordsplit v1.0-9-g7eaa3c4.  Normal shell like
expansion is allowed.  This means that curly braces around variable
names are optional and that the following forms are now allowed:

${VARIABLE:-WORD}
     "Use Default Values".  If VARIABLE is unset or null, the
     expansion of WORD is substituted.  Otherwise, the value of
     VARIABLE is substituted.

${VARIABLE:=WORD}
     "Assign Default Values".  If VARIABLE is unset or null, the
     expansion of WORD is assigned to variable.  The value of
     VARIABLE is then substituted.

     The assigned value remains in effet during expansion of the
     current string.

${VARIABLE:?WORD}
    "Display Error if Null or Unset".  If VARIABLE is null or
    unset, the expansion of WORD (or a message to that effect if
    WORD is not present) is output to the current logging channel.
    Otherwise, the value of VARIABLE is substituted.

${VARIABLE:+WORD}
    "Use Alternate Value".  If VARIABLE is null or unset, nothing
     is substituted, otherwise the expansion of WORD is
     substituted.

* Handling of undefined variables

Attempt to expand undefined variable causes fatal error.  Use one of
the advanced forms described above to handle such cases gracefully.

* Variable names

Several variable names have changed.  Names that contained dash,
now use underscore instead.  These are:

  Old name             Use this instead
  -------------------  -------------------
  stat:check-failures  stat:check_failures
  dest-dir             dest_dir
  source-dir           source_dir
  user:real-name       user:real_name

* $- is gone

Trailing newlines are automatically removed from all variable
expansions.  Consequently, the $- marker (delete to the end of line)
has been removed.

* Requires Mailutils 3.4

* Bugfixes and organizational changes

* The "periodic" subcommand

The new subcommand "periodic" is responsible for maintaining the job database.
It finishes up pending glacier jobs, dowloading the results (both inventory
listings and requested files) and removes expired jobs. It should be run as a
cronjob.

* When run on an EC2 instance, credentials can be obtained from the EC2 metadata

* Directory validity is controlled using the LastInventoryDate field

Implements restart mode.

The restart mode is a special feature of sentinel mode, controlled by
the new options --restart-on-exit and --restart-on-signal. In this
mode genrc will restart the subsidiary program if it exits with a
predefined status code or terminates on a predefined signal. Use this
feature to ensure the service provided by the program controlled by
genrc won't get terminated because of hitting a bug or encountering an
unforeseen external condition.

For example:

  genrc --command=COMMAND \
        --sentinel \
	--restart-on-exit='!0' --restart-on-signal='!TERM,QUIT' start

This will ensure that the COMMAND will be restarted immediately after
it terminates, unless it exits with the status 0 or terminates on
SIGTERM or SIGQUIT.

	- The following environment variables are set when running
	postrenew commands defined in the [core] section:
	ACMEMAN_CERTIFICATE_COUNT, ACMEMAN_CERTIFICATE_FILE,
	ACMEMAN_DOMAIN_NAME, ACMEMAN_ALT_NAMES.
	- The following environment variables are set when running
	postrenew commands defined in [domain] sections:
	ACMEMAN_CERTIFICATE_FILE, ACMEMAN_DOMAIN_NAME,
	ACMEMAN_ALT_NAMES.  See the manpage for a detailed discussion.
	- Challenge files are removed before exiting.
	- By default, a special domain source is used, which invokes
	"apache" and, if unable to do so, outputs on standard error
	a detailed description of the problem with a suggestion on
	how to fix it.

	- Make sure constructor never croaks if on_error is set to 'return'
	  Improve diagnostics.

* Adopt the testsuite for systems with directory separator other than '/'.

Initial release.

* Display unterminated lines from the command

All data the executed program outputs to the standart output and error
are captured and reproduced on the corresponding system streams.
The previous release would suppress lines not terminated with a newline
character.  This is fixed.

* Display additional diagnostics if the program fails to run

Implement safe upgrade mode.  In safe mode, slackupgrade first
downloads all needed packages from the remote repository and then
proceeds to upgrade.  Downloaded packages are removed after
installation.  This is the default mode, if there is sufficient disk
space.

Initial release.

* Use red-black trees to index the IP list.

* Fix compatibility with Varnish versions 6.1.x and 6.2.x.