Log message:
Remove obsolete PKG_DESTDIR_SUPPORT

Log message:
Update mod_auth_mellon after lasso upgrade. Approved by wiz@

NEWS since last version imported in pkgsrc

Version 0.10.0
---------------------------------------------------------------------------

* Make sure that we fail in the unlikely case where OpenSSL is not able
  to provide us with a secure session id.

* Increase the number of key-value pairs in the session to 2048.

* Add MellonMergeEnvVars-option to store multi-valued attributes in
  a single environment variable, separated with ';'.

* Bugfixes:

  * Fix the [MAP] option for MellonCond.

  * Fix cookie deletion for the session cookie. (Logout is not dependent
    on the cookie being deleted, so this only fixes the cookie showing
    up after the session is deleted.)

Version 0.9.1
---------------------------------------------------------------------------

* Bugfixes:

  * Fix session offset calculation that prevented us from having
    active sessions at once.

  * Run mod_auth_mellon request handler before most other handlers,
    so that other handlers cannot block it by accident.

Version 0.9.0
---------------------------------------------------------------------------

* Set the AssertionConsumerServiceURL attribute in authentication
  requests.

* Bugfixes:

  * Fix use of uninitialized data during logout.

  * Fix session entry overflow leading to segmentation faults.

  * Fix looking up sessions by NameID, which is used during logout.

Version 0.8.1
---------------------------------------------------------------------------

This is a security release with fixes backported from version 0.9.1.

It turned out that session overflow bugs fixes in version 0.9.0 and
0.9.1 can lead to information disclosure, where data from one session
is leaked to another session. Depending on how this data is used by the
web application, this may lead to data from one session being disclosed
to an user in a different session. (CVE-2014-8566)

In addition to the information disclosure, this release contains some
fixes for logout processing, where logout requests would crash the
Apache web server. (CVE-2014-8567)

Version 0.8.0
---------------------------------------------------------------------------

* Add support for receiving HTTP-Artifact identifiers as POST data.

* Simplify caching headers.

* Map login errors into more appropriate HTTP error codes than
  400 Bad Request.

* Add MellonNoSuccessErrorPage option to redirect to a error page on login
  failure.

* Turn session storage into a dynamic pool of memory, which means that
  attribute values (and other items) can have arbitrary sizes as long as
  they fit in the session as a whole.

* Various bugfixes:

  * Fix for compatibility with recent versions of CURL.

  * Fix broken option MellonDoNotVerifyLogoutSignature.

  * Fix deadlock that could occur during logout processing.

  * Fix some compile warnings.

  * Fix some NULL derefernce bugs that may lead to segmentation faults.

  * Fix a minor memory leak during IdP metadata loading.

Version 0.7.0
---------------------------------------------------------------------------

* Add MellonSPentityId to control entityId in autogenerated metadata

* Fix compatibility with Apache 2.4.

* Handle empty RelayState the same as missing RelayState.

* Add MellonSetEvnNoPrefix directive to set environment variables
  without "MELLON_"-prefix.

Log message:
Recursive PKGREVISION bump for OpenSSL API version bump.

Log message:
Recursive PKGREVISION bump for libgcrypt-1.6.0 shlib major bump.

Log message:
Upgrade ap2-auth-mellon to 0.6.1 plus a patch from upstream

Changes since 0.4.0, from NEWS file:

* Add MellonSPentityId to control entityId in autogenerated metadata

Version 0.6.1
---------------------------------------------------------------------------

* Fix the POST replay functionality when multiple users logging in
  at once.

* Add a fallback for the case where the POST replay data has expired
  before the user logs in.

Version 0.6.0
---------------------------------------------------------------------------

Backwards-incompatible changes:

* The POST replay functionality has been disabled by default, and the
  automatic creation of the MellonPostDirectory target directory has been
  removed. If you want to use the POST replay functionality, take a
  look at the README file for instructions for how to enable this.

* Start discovery service when accessing the login endpoint. We used
  to bypass the discovery service in this case, and just pick the first
  IdP. This has been changed to send a request to the discovery service
  instead, if one is configured.

* The MellonLockFile default path has been changed to:
    /var/run/mod_auth_mellon.lock
  This only affects platforms where a lock file is required and
  where Apache doesn't have write access to that directory during
  startup. (Apache can normally create files in that directory
  during startup.)

Other changes:

* Fix support for SOAP logout.

* Local logout when IdP does not support SAML 2.0 Single Logout.

* MellonDoNotVerifyLogoutSignature option to disable logout signature
  validation.

* Support for relative file paths in configuration.

* The debian build-directory has been removed from the repository.

* Various cleanups and bugfixes:

  * Fix cookie parsing header parsing for some HTTP libraries.

  * Fix inheritance of MellonAuthnContextClassRef option.

  * Use ap_set_content_type() instead of accessing request->content_type.

  * README indentation cleanups.

  * Support for even older versions of GLib.

  * Fixes for error handling during session initialization.

  * Directly link with GLib rather than relying on the Lasso library
    linking to it for us.

  * Some code cleanups.

Version 0.5.0
---------------------------------------------------------------------------

* Honour MellonProbeDiscoveryIdP order when sending probes.

* MellonAuthnContextClassRef configuration directive, to limit
  authentication to specific authentication methods.

* Support for the HTTP-POST binding when sending authentication
  requests to the IdP.

* MellonSubjectConfirmationDataAddressCheck option to disable received
  address checking.

* Various cleanups and bugfixes:

  * Support for older versions of GLib and APR.

  * Send the correct SP entityID to the discovery service.

  * Do not set response headers twice.

  * Several cleanups in the code that starts authentication.

Log message:
PKGREVISION bumps for the security/openssl 1.0.1d update.

Log message:
Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.

Log message:
recursive bump from libffi shlib major bump
(additionaly, reset PKGREVISION of qt4-* sub packages from base qt4 update)

Log message:
Recursive PKGREVISION bump for libxml2 buildlink addition.

Log message:
Recursive bump for pcre-8.30* (shlib major change)