{"push_id":925291954,"size":36,"distinct_size":36,"ref":"refs/heads/master","head":"d2b8497d3cec5c454e407b681bbfe0b0b9415c70","before":"d7a2f11bb964da382d6e5c30a15fd11ac74b50d7","commits":[{"sha":"1dd9088a19f67fbadfbb10d8d668ab3eb6fa0df6","author":{"email":"fbe8394d55af4c077cac5399865f6c6522347c3c@suse.com","name":"Franck Bui"},"message":"hashmap: re-add missing header file pthread.h\n\nCommit 11c3a36649e5e removed pthread.h inclusion in\nsrc/basic/hashmap.c but this header file is neeeded when\nENABLE_DEBUG_HASHMAP is defined.","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/1dd9088a19f67fbadfbb10d8d668ab3eb6fa0df6"},{"sha":"10c71477e934bcf0d83ea2ea5fa560d017f00243","author":{"email":"fbe8394d55af4c077cac5399865f6c6522347c3c@suse.com","name":"Franck Bui"},"message":"fstab-gen: don't convert device timeout into seconds when initializing JobTimeoutSec\n\nThere was no need for such conversion and it was actually wrong since\nany device timeout less than a second was converted into 0 which means\nwaits forever.","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/10c71477e934bcf0d83ea2ea5fa560d017f00243"},{"sha":"3889613ec6bc54b9e02955f62b9d5c5b571c3d4b","author":{"email":"a3fde40985401a03951ec31e42775b52b1593ad5@ya.ru","name":"Evgeny Vereshchagin"},"message":"tests: add regression test for `systemctl restart systemd-journald`\n\nSee https://github.com/systemd/systemd/issues/2236","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/3889613ec6bc54b9e02955f62b9d5c5b571c3d4b"},{"sha":"1d3db294fca96fff0a7f8cff4eeeb42460ac21ac","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: print a log message when we ignore an NSEC3 RR with an excessive amount of iterations","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/1d3db294fca96fff0a7f8cff4eeeb42460ac21ac"},{"sha":"28b8191e2f391f043d380d47eb79ed9ff66f14bd","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: never authenticate RRsets with revoked keys","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/28b8191e2f391f043d380d47eb79ed9ff66f14bd"},{"sha":"2a0d751be498be89e18f130ca02b2197f83b6baa","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: refuse revoked DNSKEYs in trust anchor","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/2a0d751be498be89e18f130ca02b2197f83b6baa"},{"sha":"d5bc32d10325d8ce0b8891590252344f75e69596","author":{"email":"a3fde40985401a03951ec31e42775b52b1593ad5@ya.ru","name":"Evgeny Vereshchagin"},"message":"tests: don't change hard limit in test-rlimit-util\n\nFixes:\n$ make valgrind-tests TESTS=test-rlimit-util\n...\nRunning test-rlimit-util\nAssertion 'setrlimit(RLIMIT_NOFILE, &new) >= 0' failed at src/test/test-rlimit-util.c:41, function main(). Aborting.\n\nSee http://valgrind.org/docs/manual/dist.news.old.html\n\nThe setrlimit system call now simply updates the emulated limits as best\nas possible - the hard limit is not allowed to move at all and just\nreturns EPERM if you try and change it.","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/d5bc32d10325d8ce0b8891590252344f75e69596"},{"sha":"beef6a5fc5d53be33568c3e4267c540717b791fc","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: actually make use of message ID when logging about failed DNSSEC validation","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/beef6a5fc5d53be33568c3e4267c540717b791fc"},{"sha":"85aeaccc10b111e8d16d3879b7c30a219ee6e10a","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: fix DNSSEC canonical ordering logic\n\nWhen applying canonical DNSSEC ordering for an RRset only order by the\nwire format of the RRs' RDATA, not by the full wire formatting. The RFC\nisn't particularly clear about this, but this is apparently how it is\ndone. This fixes validation of pentagon.gov's DS RRset.","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/85aeaccc10b111e8d16d3879b7c30a219ee6e10a"},{"sha":"0c8570287400ba57d3705a2f62dd26039121ea6f","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: partially implement RFC5011 Trust Anchor support\n\nWith this patch resolved will properly handle revoked keys, but not\naugment the locally configured trust anchor database with newly learned\nkeys.\n\nSpecifically, resolved now refuses validating RRsets with\nrevoked keys, and it will remove revoked keys from the configured trust\nanchors (only until reboot).\n\nThis patch does not add logic for adding new keys to the set of trust\nanchors. This is a deliberate decision as this only can work with\npersistent disk storage, and would result in a different update logic\nfor stateful and stateless systems.  Since we have to support stateless\nsystems anyway, and don't want to encourage two independent upgrade\npaths we focus on upgrading the trust anchor database via the usual OS\nupgrade logic.\n\nWhenever a trust anchor entry is found revoked and removed from the\ntrust anchor a recognizable log message is written, encouraging the user\nto update the trust anchor or update his operating system.","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/0c8570287400ba57d3705a2f62dd26039121ea6f"},{"sha":"3347e6a299983557d27b7ff950199f2eda6d9bd9","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"update RFCs","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/3347e6a299983557d27b7ff950199f2eda6d9bd9"},{"sha":"51e399bcebefb27d6b147d90de84d07f010fa170","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: block transaction GC'ing while dns_transaction_request_dnssec_keys() is running\n\nIf any of the transactions started by\ndns_transaction_request_dnssec_keys() finishes promptly without\nrequiring asynchronous operation this is reported back to the issuing\ntransaction from the same stackframe. This might ultimately result in\nthis transaction to be freed while we are still in its\n_request_dnssec_keys() stack frame. To avoid memory corruption block the\ntransaction GC while in the call, and manually issue a GC after it\nreturned.","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/51e399bcebefb27d6b147d90de84d07f010fa170"},{"sha":"f2992dc184398c6361273a39d3fde5c605e045e0","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: explicitly avoid cyclic transaction dependencies\n\nWe already try hard not to create cyclic transaction dependencies, where\na transaction requires another one for DNSSEC validation purposes, which\nin turn (possibly indirectly) pulls in the original transaction again,\nthus resulting in a cyclic dependency and ultimately a deadlock since\neach transaction waits for another one forever.\n\nSo far we wanted to avoid such cyclic dependencies by only going \"up the\ntree\" when requesting auxiliary RRs and only going from one RR type to\nanother, but never back. However this turned out to be insufficient.\nConsider a domain that publishes one or more DNSKEY but which has no DS\nfor it. A request for the domain's DNSKEY triggers a request for the\ndomain's DS, which will then fail, but return an NSEC, signed by the\nDNSKEY. To validate that we'd request the DNSKEY again. Thus a DNSKEY\nrequest results in a DS request which results in the original DNSKEY\nrequest again. If the original lookup had been a DS lookup we'd end up\nin the same cyclic dependency, hence we cannot statically break one of\nthem, since both requests are of course fully valid. Hence, do full\ncyclic dependency checking: each time we are about to add a dependency\nto a transaction, check if the transaction is already a dependency of\nthe dependency (recursively down the tree).","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/f2992dc184398c6361273a39d3fde5c605e045e0"},{"sha":"a761c1ca851a9397b5a207ef600e077d0f7f4534","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: introduce a proper bus error for DNSSEC validation errors","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/a761c1ca851a9397b5a207ef600e077d0f7f4534"},{"sha":"b2b796b8ab5565fbe60b544d2579e2bfca31bf6a","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: explicitly handle case when the trust anchor is empty\n\nSince we honour RFC5011 revoked keys it might happen we end up with an\nempty trust anchor, or one where there's no entry for the root left.\nWith this patch the logic is changed what to do in this case.\n\nBefore this patch we'd end up requesting the root DS, which returns with\nNODATA but a signed NSEC we cannot verify, since the trust anchor is\nempty after all. Thus we'd return a DNSSEC result of \"missing-key\", as\nwe lack a verified version of the key.\n\nWith this patch in place, look-ups for the root DS are explicitly\nrecognized, and not passed on to the DNS servers. Instead, if\ndowngrade-ok mode is on an unsigned NODATA response is synthesized, so\nthat the validator code continues under the assumption the root zone was\nunsigned. If downgrade-ok mode is off a new transaction failure is\ngenerated, that makes this case recognizable.","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/b2b796b8ab5565fbe60b544d2579e2bfca31bf6a"},{"sha":"6f8a2c6817e35ca3e76130b31624f7f30e596433","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"update DNSSEC TODO","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/6f8a2c6817e35ca3e76130b31624f7f30e596433"},{"sha":"75e60eea5853620fbb32efb5e7b7982aef374357","author":{"email":"b9c50af7afa7642f6f854434cda9ffe54ece8b85@who-t.net","name":"Peter Hutterer"},"message":"hwdb: add axis ranges and resolution for Dell Lattitude E6220\n\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1293576","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/75e60eea5853620fbb32efb5e7b7982aef374357"},{"sha":"519d39deeeec7121649f28e7287b7790e50d2979","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"man: add basic documentation for resolved.conf's DNSSEC= switch","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/519d39deeeec7121649f28e7287b7790e50d2979"},{"sha":"d3760be01b120df8980c056ecc85a4229d660264","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"resolved: when caching negative responses, honour NSEC/NSEC3 TTLs\n\nWhen storing negative responses, clamp the SOA minimum TTL (as suggested\nby RFC2308) to the TTL of the NSEC/NSEC3 RRs we used to prove\nnon-existance, if it there is any.\n\nThis is necessary since otherwise an attacker might put together a faked\nnegative response for one of our question including a high-ttl SOA RR\nfor any parent zone, and we'd use trust the TTL.","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/d3760be01b120df8980c056ecc85a4229d660264"},{"sha":"d3eae7d8c4fccfe2952ec9e07f8cadab99b485a5","author":{"email":"9bb3d23d041c1d0454e62fec951f9aa4dfa2787f@poettering.net","name":"Lennart Poettering"},"message":"Merge pull request #2268 from whot/hwdb-updates\n\nhwdb: add axis ranges and resolution for Dell Lattitude E6220","distinct":true,"url":"https://api.github.com/repos/l10n-tw/systemd/commits/d3eae7d8c4fccfe2952ec9e07f8cadab99b485a5"}]}