head 1.6; access; symbols pkgsrc-2026Q3:1.4.0.2 pkgsrc-2026Q3-base:1.4 pkgsrc-2026Q2:1.2.0.4 pkgsrc-2026Q2-base:1.2 pkgsrc-2026Q1:1.2.0.2 pkgsrc-2026Q1-base:1.2; locks; strict; comment @# @; 1.6 date 2026.11.11.11.54.21; author wiz; state Exp; branches; next 1.5; commitid ibfBdhxkigxin23H; 1.5 date 2026.10.05.02.43.47; author jnemeth; state Exp; branches; next 1.4; commitid uzZWYHgKhkqOweYG; 1.4 date 2026.07.26.02.43.18; author mef; state Exp; branches; next 1.3; commitid IKBONegrB4xkO6PG; 1.3 date 2026.07.16.19.03.59; author wiz; state Exp; branches; next 1.2; commitid FQnRlmCjzrRuxUNG; 1.2 date 2026.03.18.18.15.21; author nia; state Exp; branches; next 1.1; commitid MTlBdeHy63Xv9uyG; 1.1 date 2026.03.09.03.16.43; author jnemeth; state Exp; branches; next ; commitid V50zudbW699ctfxG; desc @@ 1.6 log @*: recursive bump for icu 79 @ text @# $NetBSD: Makefile,v 1.5 2026/10/05 02:43:47 jnemeth Exp $ DISTNAME= cyrus-imapd-3.12.4 PKGREVISION= 1 CATEGORIES= mail MASTER_SITES= ${MASTER_SITE_GITHUB:=cyrusimap/} GITHUB_TAG= ${PKGNAME_NOREV} MAINTAINER= pkgsrc-users@@NetBSD.org HOMEPAGE= https://www.cyrusimap.org/ COMMENT= Cyrus IMAP server LICENSE= original-bsd # like license MAKE_JOBS_SAFE= no USE_TOOLS+= perl:run makedepend pkg-config gmake bison bash:run USE_TOOLS+= autoconf automake autoreconf flex USE_LANGUAGES+= c c++ USE_PKGLOCALEDIR= yes GNU_CONFIGURE= yes PERL5_CONFIGURE= no USE_LIBTOOL= yes BUILD_TARGET= all BUILD_DEFS+= VARBASE CHECK_PORTABILITY_SKIP= configure.lineno .include "../../mk/bsd.prefs.mk" # CYRUS_USER username of the Cyrus administrator # CYRUS_GROUP group of the Cyrus administrator # CYRUS_USER?= cyrus CYRUS_GROUP?= mail DEPENDS+= p5-Term-ReadLine-Gnu-[0-9]*:../../devel/p5-Term-ReadLine-Gnu BUILD_DEFS+= CYRUS_USER CYRUS_GROUP FILES_SUBST+= CYRUS_USER=${CYRUS_USER} FILES_SUBST+= CYRUS_GROUP=${CYRUS_GROUP} CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR} CONFIGURE_ARGS+= --with-cyrus-user=${CYRUS_USER} CONFIGURE_ARGS+= --with-pidfile=${VARBASE}/run/cyrus-master.pid CONFIGURE_ARGS+= --with-openssl=${SSLBASE:Q} CONFIGURE_ARGS+= --with-sasl=${BUILDLINK_PREFIX.cyrus-sasl} CONFIGURE_ARGS+= --with-perl=${PERL5:Q} CONFIGURE_ARGS+= --with-libwrap=${BUILDLINK_PREFIX.tcp_wrappers} CONFIGURE_ENV+= ac_cv_lib_wrap_request_init=yes CONFIGURE_ARGS+= --enable-idled CONFIGURE_ARGS+= --enable-murder CONFIGURE_ARGS+= --enable-nntp CONFIGURE_ARGS+= --enable-replication CONFIGURE_ARGS+= andrew_cv_runpath_switch=${COMPILER_RPATH_FLAG} LDFLAGS.FreeBSD+= -lm LDFLAGS.OpenBSD+= -lm .include "options.mk" MAKE_ENV+= PERL=${PERL5:Q} HTMLDIR= ${PREFIX}/share/doc/cyrus-imapd EGDIR= ${PREFIX}/share/examples/cyrus-imapd CONF_FILES= ${EGDIR}/imapd.conf ${PKG_SYSCONFDIR}/imapd.conf CONF_FILES+= ${EGDIR}/normal.conf ${PKG_SYSCONFDIR}/cyrus.conf RCD_SCRIPTS= cyrus FILES_SUBST+= IMAPDCONF=${PKG_SYSCONFDIR}/imapd.conf REPLACE_BASH+= imap/cyr_cd.sh REPLACE_PERL+= imap/promdatagen REPLACE_PERL+= perl/annotator/Daemon.pm REPLACE_PERL+= perl/sieve/scripts/sieveshell.pl REPLACE_PERL+= snmp/snmpgen REPLACE_PERL+= tools/config2header REPLACE_PERL+= tools/masssievec REPLACE_PERL+= tools/mkimap REPLACE_PERL+= tools/mknewsgroups REPLACE_PERL+= tools/rehash REPLACE_PERL+= tools/config2rst REPLACE_PERL+= tools/perl2rst REPLACE_SH+= perl/imap/cyradm.sh # Override default Perl install location SUBST_CLASSES+= perldir SUBST_STAGE.perldir= post-configure SUBST_FILES.perldir= perl/annotator/Makefile SUBST_FILES.perldir+= perl/imap/Makefile SUBST_FILES.perldir+= perl/sieve/managesieve/Makefile SUBST_SED.perldir+= -e 's|\(^INSTALLDIRS =\) .*|\1 vendor|' PERL5_PACKLIST= \ auto/Cyrus/Annotator/Daemon/.packlist \ auto/Cyrus/IMAP/.packlist \ auto/Cyrus/SIEVE/managesieve/.packlist post-patch: set -e; cd ${WRKSRC} && autoreconf -fi set -e; cd ${WRKSRC}/docsrc/imap/reference/manpages/systemcommands && mv httpd.rst cyrus-httpd.rst .include "../../lang/perl5/module.mk" BUILDLINK_API_DEPENDS.cyrus-sasl+= cyrus-sasl>=2.1.17 .include "../../security/cyrus-sasl/buildlink3.mk" .include "../../security/openssl/buildlink3.mk" .include "../../security/tcp_wrappers/buildlink3.mk" # Only imap/mupdate needs to be build with pthreads support, so selectively # enable it via patches for just that one program. # .include "../../mk/pthread.buildlink3.mk" # XXX cyrus imapd no longer comes with prebuilt man pages # # Change references of some manpages from foo.8 to cyrus-foo.8 to avoid # # manpage conflicts with other packages. Also change references to # # "/etc/{cyrus,imapd}.conf" into "${PKG_SYSCONFDIR}/{cyrus,imapd}.conf". # # # post-patch: # cd ${WRKSRC}/man; \ # set -- deliver 8 fetchnews 8 idled 8 imapd 8 lmtpd 8 master 8 \ # nntpd 8 notifyd 8 pop3d 8 quota 8; \ # while [ $$# -gt 0 ]; do \ # man=$$1.$$2; \ # for file in Makefile.in *.[0-9]; do \ # sed -e "s|\(\$$(srcdir)/\)\($$man\)|\1cyrus-\2|g" \ # -e "s|\(\\\fB\)\($$1($$2)\\\fR\)|\1cyrus-\2|g" \ # $$file > $$file.fixed; \ # mv -f $$file.fixed $$file; \ # done; \ # if [ -f $$man ]; then \ # mv $$man cyrus-$$man; \ # fi; \ # shift 2; \ # done # find ${WRKSRC} -type f -print | \ # xargs -n 1 ${GREP} -l -e /etc/imapd\.conf -e /etc/cyrus\.conf | \ # while read file; do \ # sed -e "s|/etc/\(cyrus\.conf\)|${PKG_SYSCONFDIR}/\1|g" \ # -e "s|/etc/\(imapd\.conf\)|${PKG_SYSCONFDIR}/\1|g" \ # $${file} > $${file}.fixed; \ # mv -f $${file}.fixed $${file}; \ # done post-install: ${INSTALL_SCRIPT} ${WRKSRC}/tools/masssievec ${DESTDIR}${PREFIX}/sbin ${INSTALL_SCRIPT} ${WRKSRC}/tools/mkimap ${DESTDIR}${PREFIX}/sbin ${INSTALL_SCRIPT} ${WRKSRC}/tools/mknewsgroups ${DESTDIR}${PREFIX}/sbin ${INSTALL_SCRIPT} ${WRKSRC}/tools/translatesieve ${DESTDIR}${PREFIX}/sbin ${INSTALL_SCRIPT} ${WRKSRC}/tools/rehash ${DESTDIR}${PREFIX}/sbin ${INSTALL_DATA_DIR} ${DESTDIR}${EGDIR} ${INSTALL_DATA} ${FILESDIR}/imapd.conf ${DESTDIR}${EGDIR} cd ${WRKSRC}/doc/examples/cyrus_conf; for file in *.conf; do \ ${INSTALL_DATA} $${file} ${DESTDIR}${EGDIR}; \ done ${INSTALL_DATA_DIR} ${DESTDIR}${HTMLDIR} cd ${WRKSRC}/doc/legacy; for file in *.html; do \ ${INSTALL_DATA} $${file} ${DESTDIR}${HTMLDIR}; \ done .include "../../time/libical/buildlink3.mk" .include "../../textproc/jansson/buildlink3.mk" .include "../../textproc/icu/buildlink3.mk" .include "../../devel/zlib/buildlink3.mk" CONFIGURE_ARGS+= --with-zlib=${BUILDLINK_PREFIX.zlib} .include "../../databases/sqlite3/buildlink3.mk" CONFIGURE_ARGS+= --with-sqlite=${BUILDLINK_PREFIX.sqlite3} .include "../../mk/bsd.pkg.mk" @ 1.5 log @cyrus-imapd312: Update to Cyrus IMAPd 3.12.4. ____________________________________________________________________________________________ Cyrus IMAP 3.12.4 Release Notes Changes since 3.12.3 Security fixes * CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox. Reported by: Michael Lynch (mtlynch.io). * CVE-2026-61908: JMAP email-header blob ID out-of-bounds index An authenticated user could attempt to download a specially crafted JMAP blob ID of the form H-, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory. Reported by: Ahmed Said. * CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT. Reported by: Ahmed Said. * CVE-2026-61910 Mailbox/set let sharee change special-use role on shared mailboxes An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update. Reported by: Michael Lynch (mtlynch.io). * CVE-2026-61911 Sieve mailbox existence oracle An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery. Reported by: Michael Lynch (mtlynch.io). * CVE-2026-61915: VPATCH BYPARAM double-free An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties. Reported by: Michael Lynch (mtlynch.io). Build changes * Fixed: Issue #6142: build failure in lmtp_sieve on Alpine Linux Bug fixes * Fixed: Issue #6064: escape JMAP logHeaders values before logging * Fixed: Issue #6165: JMAP EmailSubmission/set now reports bad rcptTo values as invalidRecipients rather than invalidProperties * Fixed: Issue #6334: JMAP CalendarEvent/set crash when participants.sendTo malformed ____________________________________________________________________________________________ Cyrus IMAP 3.12.3 Release Notes Changes since 3.12.2 Security fixes * CVE-2026-47084 LOCALDELETE bypassed ACL checks An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions. Reported by: Michael Lynch (mtlynch.io) * CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions. Reported by: Matthew Horsfall * CVE-2026-47087 URLAUTH does not honor revoked authorizer access A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked. Reported by: Matthew Horsfall * CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed. Reported by Matthew Horsfall. * CVE-2026-47089 LISTRIGHTS not limited to users with admin access An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.) Reported by: Matthew Horsfall * CVE-2026-47085 URLAUTH token forgery via missing mboxkey If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing HMAC-SHA1 with a predictable key, allowing them read access to the mailbox. URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. We are unaware of any clients using URLAUTH. Reported by: Matthew Horsfall * CVE-2026-47083 ESEARCH cross-user content oracle Using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching search, creating a content oracle without allowing arbitrary reads of the target's content. Reported by: Michael Lynch (mtlynch.io) * CVE-2026-47088 Heap exposure in nested MIME comment parsing An authenticated IMAP user could specially craft an email containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message end in memory and read into the heap, returning the read content to the user. Reported by: Michael Lynch (mtlynch.io). * CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox. Reported by: Michael Lynch (mtlynch.io) Build changes * Fixed: Issue #5262: fix cunit+valgrind libtool invocation * Fixed: Issue #5646: update cunit valgrind suppressions Bug fixes * Fixed: Issue #5908: auditlog rename of UUID mailboxes * Fixed: Issue #5922: prohibit APPEND/COPY/MOVE into non-IMAP mailboxes * Fixed: Issue #5437: don't leak cached TLS sessions * Fixed: Issue #5436: fix leaks in imap SELECT and SETQUOTA * Fixed: Issue #6022: various memory leaks ____________________________________________________________________________________________ Cyrus IMAP 3.12.2 Release Notes Changes since 3.12.1 Security fixes * Fixed Issue #5495: MBTYPE_INTERMEDIATE mailboxes could be renamed by users without the expected ACL_DELETEMBOX permission. Build changes * Fixed Issue #5500: cassandane failures on Ubuntu 24 LTS * Fixed Issue #5512: distcheck now runs the unit tests * Added: configure --with-zoneinfo-dir option to set zoneinfo_dir at compile time * Fixed Issue #5733: compiler warning when optimizations enabled * Fixed Issue #5727: cross-version cassandane support was broken * Fixed Issue #5750: cross-version cassandane can now conditionalise tests on both versions Bug fixes * Fixed: lmtpd(8) now uses the session id that it logged * Fixed Issue #4787: VANISHED not working with cyrus proxy * Fixed Issue #5602: LIST (SUBSCRIBED) not working with cyrus proxy * Fixed Issue #3562: imapd(8) crash when searching for flags (thanks Sven Wegener) * Fixed Issue #5816: Xapian indexing broken on platforms without posix_fadvise() (thanks Angelo Gruendler) * Fixed Issue #5789: mupdate(8) crash on DEACTIVATE (thanks Zisis Vakras) @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.4 2026/07/26 02:43:18 mef Exp $ d4 1 @ 1.4 log @(mail/cyrus-imapd312) Fix patching issue on some environment, See Following https://mail-index.netbsd.org/pkgsrc-users/2026/07/25/msg043234.html @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.3 2026/07/16 19:03:59 wiz Exp $ d3 1 a3 2 DISTNAME= cyrus-imapd-3.12.1 PKGREVISION= 1 @ 1.3 log @*: recursive bump for perl5 5.44.0 @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.2 2026/03/18 18:15:21 nia Exp $ d102 1 a102 1 post-extract: @ 1.2 log @cyrus-imapd312: Fixes for various platforms. @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.1 2026/03/09 03:16:43 jnemeth Exp $ d4 1 @ 1.1 log @mail/cyrus-imapd312: import cyrus-imapd-3.12.1 IMAP (Internet Message Access Protocol) is an Internet standards-track protocol for accessing messages (mail, bboards, news, etc). The Cyrus IMAP server differs from other IMAP server implementations in that it is generally intended to be run on "sealed" servers, where normal users are not permitted to log in. The mailbox database is stored in parts of the filesystem that are private to the Cyrus IMAP system. All user access to mail is through the IMAP, POP3, or KPOP protocols. @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.84 2024/05/29 16:33:19 adam Exp $ d16 1 a16 1 USE_TOOLS+= autoconf automake autoreconf d58 3 d86 2 @