Merge exim4 4.73~rc1-1 (main) from Debian experimental (main)

Binary package hint: exim4

exim4 (4.73~rc1-1) experimental; urgency=low

  * New upstream release candidate.
  * Drop included patches. 80_4.73rc1_*, 40_dkimnotinpaniclog.diff.
  * Update 31_eximmanpage.dpatch.
  * exim4 now uses INSTREAM (added in clamav 0.95) instead of STREAM when
    talking to clamav. exim4-daemon-heavy therefore Breaks: clamav-daemon
    (<< 0.95).
  * Unfuzz EDITME*diff.
  * Dependency changes:
    + Drop exim4-config's conflicts with bash (<< 2.05). This was relevant
      pre-sarge.
    + Drop exim4-daemon-* dependency on exim4-base (>> 4.71-2). This one is
      superfluous because of of the dependency on
      exim4-base (>= ${Upstream-Version}).
    + exim4-config breaks instead of conflicts with pre-DKIM (i.e. << 4.69.1)
      exim4-daemon.
    + exim4-base breaks instead of conflicts with <<${Upstream-Version} daemon
      packages.
   * Add Vcs-Svn and Vcs-Browser fields to debian/control.
   * Build depend on libmysqlclient-dev | libmysqlclient15-dev instead of
     libmysqlclient15-dev. libmysqlclient-dev is not a virtual package
     anymore. Closes: #590218
   * Use db_settitle unconditionally, even etch supports this. Drop unneeded
     lintian override exim4-config: settitle-requires-versioned-depends.

 -- Andreas Metzler <email address hidden> Mon, 27 Dec 2010 19:48:19 +0100

exim4 (4.72-3) unstable; urgency=low

  * [README.Debian*] Correct command for manual paniclog rotation. (Thanks,
    Jörg Sommer) Closes: #602188
  * 67_unnecessaryCopt.diff: Do not use exim's -C option in utility scripts.
    This would not work with ALT_CONFIG_PREFIX.
  * Pull changes related to fixing CVE-2010-4345 from exim 4.73 rc1.
    Closes: #606527
    + 1_cfile_norw_eximuid: Don't allow a configure file which is writeable by
      the Exim user or group.
    + 2_permcheck_configurefile: Check configure file permissions even for
      non-default files if still privileged.
    + 3_remove_ALT_CONFIG_ROOT_ONLY: Remove ALT_CONFIG_ROOT_ONLY build option,
      effectively making it always true.
    + 4_FD_CLOEXEC: Set FD_CLOEXEC on SMTP sockets after forking in the
      daemon, to ensure that rogue child processes cannot use them.
    + 5_TRUSTED_CONFIG_LIST: Add TRUSTED_CONFIG_LIST compile option.
    + 6_nonroot_system_filter_user: If the system filter needs to be run as
      root, let that be explicitly configured. The default is now the Exim
      run-time user.
    + 7_filter_D_option: Add a (compiletime) whitelist of acceptable values
      for the -D option.
    + 8_updatedocumentation: Update documentation to reflect the changes.
  * Build with WHITELIST_D_MACROS=OUTGOING. Post patch 7_filter_D_option exim
    will not regain root privileges (usually necessary for local delivery) if
    the -D option was used. Macro identifiers listed in WHITELIST_D_MACROS are
    exempted from this restriction. mailscanner (4.79.11-2.2) uses -DOUTGOING.
  * Build with TRUSTED_CONFIG_LIST=/etc/exim4/trusted_configs. Post patch
    3_remove_ALT_CONFIG_ROOT_ONLY exim will not re-gain root privileges
    (usually necessary for local delivery) if the -C option was used. This
    makes it impossible to start a fully functional damon with an alternate
    configuration file. /etc/exim4/trusted_configs (can) contain a list of
    filenames (one per line, full path given) to which this restriction does
    not apply.

 -- Andreas Metzler <email address hidden> Sun, 26 Dec 2010 15:13:08 +0100