• https://sourceware.org/pub/bzip2/ (Download)

• (2020-01-13) Updated to version: bzip2-1.0.8
• (2010-09-21) Updated to version: bzip2-1.0.6
• (2008-03-19) Updated to version: bzip2-1.0.5
• (2007-01-26) Updated to version: bzip2-1.0.4
• (2006-07-21) Package added to openports.se, version bzip2-1.0.3 (created)

Log message:
Update to 1.0.8:
* relaxes the fix for CVE-2019-12900
* cleanup of bzdiff and bzgrep scripts so they don't use bash extensions
There's also a homepage again.
ok kmos@ cwen@

Log message:
update to bzip 1.0.7
ok kn, probably ok sthen

Log message:
MFC bzip2 security fix:
fix out of bounds access in BZ2_decompress(), CVE-2019-12900
set HOMEPAGE while there
based on a diff from Henry Jensen

Log message:
fix out of bounds access in BZ2_decompress(), CVE-2019-12900
set HOMEPAGE while there
based on a diff from Henry Jensen

Log message:
mirror and drop HOMEPAGE; domain expired

Log message:
missed in previous

Log message:
Fix for CVE-2016-3189; proposed patch from RH

Log message:
Fix for CVE-2016-3189; proposed patch from RH

Log message:
remove various instances of NO_SHARED_LIBS and PROPERTIES:Mno_shared,
fold PFRAG.shared into PLIST

Log message:
add an easily-greppable marker for ports known to use pledge().
it's not so important while they're only in patches in the ports tree,
but for any which get upstreamed it saves a ~100GB grep to find them.

Log message:
If bzip2 is used to compress or decompress a single file to stdout,
or if it's used in a pipeline, then it can further pledge to only use
stdio-related system calls while doing the actual de/compression.
Since ports uses 'bzip2 -dc [file] | tar xf -', it can benefit from
this added protection during file extraction.

Log message:
use standard "local" error handling (sprintf+exit/message_fatal) rather than
err() to avoid the need to pull in err.h, idea from deraadt

Log message:
err.h for bzip2 as well, pointed out by jca@

Log message:
bzip2 now also needs rpath

Log message:
tame -> pledge

Log message:
bzip2 only needs stdio and some file operations, so it can be tame()'d early
in main().

Log message:
USE_GROFF=Yes

Log message:
MFC:
- - -
date: 2010/09/20 18:21:10;  author: naddy;  state: Exp;  lines: +2 -2
SECURITY update to 1.0.6, which fixes an integer overflow, CVE-2010-0405.
ok jasper@
- - -

Log message:
MFC:
- - -
date: 2010/09/20 18:21:10;  author: naddy;  state: Exp;  lines: +2 -2
SECURITY update to 1.0.6, which fixes an integer overflow, CVE-2010-0405.
ok jasper@
- - -

Log message:
SECURITY update to 1.0.6, which fixes an integer overflow, CVE-2010-0405.
ok jasper@

Log message:
SECURITY:
Update to 1.0.5, which includes integer overflow checks.
Fixes CERT-FI 20469.
from William Yodlowsky

Log message:
SECURITY:
Update to 1.0.5, which includes integer overflow checks.
Fixes CERT-FI 20469.

Log message:
tweak FAKE_FLAGS semantics to saner defaults.

Log message:
zap all quotes in COMMENT/PERMIT_*

Log message:
base64 distinfo with SHA256

Log message:
MFC:
SECURITY update to 1.0.4:
* Fix file permissions race problem (CVE-2005-0953).
* Avoid possible segfault in BZ2_bzclose.
* Sanitise file names more carefully in bzgrep.  Fixes CVE-2005-0758
to the extent that applies to bzgrep.
* Use 'mktemp' rather than 'tempfile' in bzdiff.
* Tighten up a couple of assertions in blocksort.c following automated
analysis.

Log message:
MFC:
SECURITY update to 1.0.4:
* Fix file permissions race problem (CVE-2005-0953).
* Avoid possible segfault in BZ2_bzclose.
* Sanitise file names more carefully in bzgrep.  Fixes CVE-2005-0758
to the extent that applies to bzgrep.
* Use 'mktemp' rather than 'tempfile' in bzdiff.
* Tighten up a couple of assertions in blocksort.c following automated
analysis.

Log message:
SECURITY update to 1.0.4:
* Fix file permissions race problem (CVE-2005-0953).
* Avoid possible segfault in BZ2_bzclose.
* Sanitise file names more carefully in bzgrep.  Fixes CVE-2005-0758
to the extent that applies to bzgrep.
* Use 'mktemp' rather than 'tempfile' in bzdiff.
* Tighten up a couple of assertions in blocksort.c following automated
analysis.

Log message:
pass shared library version in REGRESS_FLAGS, otherwise regress target
rebuilds it without version number.
ok sturm@

Log message:
use SHARED_LIBS
USE_LIBTOOL where appropriate (and bump PKGNAME)
tweak a few FAKE_FLAGS to be more uniform.

Log message:
after querying brad@ he decided to drop maintainership for these.

Log message:
Maintenance update to 1.0.3.
- minor bug fixes only
- no more .info manual
ok brad@

Log message:
@endfake marker

Log message:
SIZE

Log message:
Mark all system libs in WANTLIB, result of running newlib-depends-check

Log message:
switch to new style PLISTS, using @lib, ditching DYNLIBDIR.
Replace two INSTALL scripts with @sample.
Reorder plists to match auto-generation, add comments for files that
don't get installed.

Log message:
manpages markers.
use SHARED_ONLY to discard PFRAG.shared.

Log message:
switch to using dir/ and @info.
a few more tweaks done by the automatic update mode of make update-plist.

Log message:
remove another sparc64/2.95 workaround.

Log message:
remove WWW lines

Log message:
allow optimization on sparc64 again.  tested by naddy, sturm, & myself.

Log message:
# BSD

Log message:
sayonara NEED_VERSION.

Log message:
MFC:
correct wrong symlinks for man pages.
--
Spotted by: form@
Patch from: mpech@

Log message:
correct wrong symlinks for man pages.
--
Spotted by: form@
Patch from: mpech@