			       =================
				BOGOFILTER NEWS
			       =================

	!!!!!!!! READ THE RELEASE.NOTES !!!!!!!!

	This file is in Unicode charset, with UTF-8 encoding.

	Sections headed '[Incompat <version>]' and '[Major <version>]'
	are particularly important.  They describe changes that are
	incompatible with earlier releases or are significantly
	different.

	!!!!!!!! READ THE RELEASE.NOTES !!!!!!!!

-------------------------------------------------------------------------------

1.2.4	2013-07-01 (released)

	2013-06-28
	* Fix three crashes in command line and environment variable parsers
	  that caused NULL pointer dereferences with long option variants
	  of bogofilter --syslog-tag, or bogoutil --timestamp-date, or when
	  bogotune -M<file> cannot derive the bogofilter directory.
	  Reported by Alexandre Rebert, found with Mayhem tool.

	* Add getopt_long_chk(), a getopt_long variant that checks if the
	  overlapping short and long options agree on whether their argument
	  is not required, mandatory, or optional.  If they disagree, the
	  program aborts.

	* Fix a crash in command line parser that causes a NULL pointer
	  dereference when --db-cachesize is used without argument.
	  Found with getopt_long_chk().

	2013-01-20
	* Change lexer API/ABI a bit so as to work with flex 2.5.36 generated
	  lexers (for instance, on Fedora 18 "Spherical Cow") that flip the
	  type of yyleng from int to size_t. We use a signed long internally.

	2012-12-30
	* The bogofilter project was updated to the new SourceForge.net
	  platform. This has caused the URLs to change. Use one of these
	  commands for a read-only checkout:
	  svn checkout svn://svn.code.sf.net/p/bogofilter/code/trunk bogofilter
	  svn checkout http://svn.code.sf.net/p/bogofilter/code/trunk bogofilter

	  And developers would use, replacing joe by their sf.net login:
	  svn checkout --username=joe svn+ssh://m-a@svn.code.sf.net/p/bogofilter/code/trunk bogofilter

	2012-12-03
	* Add bogofilter-SA-2012-01 (CVE-2012-5468).
	* Fix XML form of Bulgarian FAQ so that it validates;
	  and validate XHTML at build time.
	* Mark Berkeley DB 5.2.42 and 5.3.21 supported.

1.2.3	2012-12-02 (released)

	2012-10-24
	* Update configure.ac to avoid autoconf 2.68 warnings, by 
	  (a) quoting the first AC_RUN_IFELSE argument, an
	      AC_LANG_PROGRAM(), with [ ], and
	  (b) providing an explicit "true" assumption for Berkeley DB
	      capabilities to avoid cross-compilation warnings.

	2012-10-22
	* Security bugfix for CVE-2012-5468 (bogofilter-SA-2012-01):
	  Fix a heap corruption in base64 decoder on invalid input.
	  Analysis and patch by Julius Plenz <plenz@cis.fu-berlin.de>.

	2011-01-02
	* Added bogofilter-faq-bg.html, a Bulgarian translation of the FAQ.
	  (thanks to Albert Ward)

	2010-10-29
	* Mark "Berkeley DB 5.1.19: (August 27, 2010)" supported.


1.2.2	2010-07-08 (released)

	2010-07-05
	* Use a better PRNG for random sleeps. That is arc4random() where
	  available, and drand48() elsewhere.

	* Assorted fixes for issues found with clang analyzer:
	  + Fix a potential NULL deference
	  + Fix a potential division by zero
	  + Remove dead assignments and increments

	* Update Doxyfile and source contrib/bogogrep.c for docs, too.

	2010-07-03

	* Security bugfix, CVE-2010-2494:
	  Fix a heap corruption in base64 decoder on invalid input.
	  Analysis and patch by Julius Plenz <plenz@cis.fu-berlin.de>.
	  Please see doc/bogofilter-SA-2010-01 for details.

	2010-04-07

	* Updated sendmail milter contrib/bogofilter-milter.pl to v1.??????
	  (thanks to Jonathan Kamens)

	2010-04-01

	* Bump supported/minimum SQLite3 versions and warning threshold.
	  See doc/README.sqlite for details.

	* Mark BerkeleyDB 4.8.26 and 5.0.21 supported.

	  Note that Berkeley DB 5.0's SQLite3 compatibility API is NOT
	  supported, it causes shifts in scores and write failures under
	  contention.  Bogofilter can use Berkeley DB 5.0's native interface, 
	  and using that is more efficient than the added SQL shim layer.

	2010-03-06

	* Make t.maint more robust; ignore .ENCODING token. To fix test
	  failures on, for instance, FreeBSD with unicode enabled.

	2010-02-15

	* Fix several compiler warnings "array subscript has type 'char'", by
	  casting the arguments to unsigned char.
	     A security audit was conducted and showed that all affected
	  functions either received the relevant input from the user running
	  bogofilter, or the input had already been pre-validated by the token
	  lexer.

	2010-02-14

	* Split error messages for ENOENT and EINVAL into new function.
	* Avoid divison by zero in robx computation by checking if there are at
	  least one ham message and one spam message registered.

	2009-08-13

	* contrib/spamitarium.pl updated to version 0.4.0
	  (thanks to Tom Anderson)

	2009-08-05

	* Updated and integrated Ted Phelps's "Patch to prevent .ENCODING from
	  being discarded by bogoutil -m" (SourceForge Patch #1743984).
	  Thanks to Ted for debugging the issue and providing the patch (which
	  was for bogofilter v1.1.5).

	2009-09-15
	* Promoted to "stable"

1.2.1	2009-08-01 (released)

	2009-08-01

	* Update configure to use "host" rather than "target", to match the
	  newer autotools cross-build semantics. Untested.
	  Developers changing the build system and users who build from SVN
	  will now need automake 1.9 and autoconf 2.60.

	2009-07-31

	* Fix Christian Frommeyer's MIME decoding bug, Ubuntu/Launchpad Bug
	  #320829. As a side effect, also fixes misattribution of MIME bodies
	  as MIME headers with mime: tag.  Original bug report:
	  https://bugs.launchpad.net/ubuntu/+source/bogofilter/+bug/320829

	  Before this fix, bogofilter did not properly MIME-decode the first
	  line in a body. This was especially bad with Christian's samples
	  where the whole body was only one long base64 line.

	2009-05-28

	* Removed two scripts that are auto-built.

	* Added test case for Stephen Davies' Q-P EOL problem (see below).

	2009-05-25

	* Fixed EOL problem in quoted_printable text. Problem reported by
	  Stephen Davies and identified by Pavel Kankovsky.

	2009-03-28
	* Promoted to "stable"

1.2.0	2009-02-21 (released) 2009-03-28 (declared stable)

	2009-02-20
	* Flex-2.5.35 has fix for memory allocation problem in 2.5.4,
          2.5.31, and 2.5.33, making bogofilter's flex patch obsolete.

	2009-02-12

	* Bogofilter now uses listsort in place of qsort.

	2009-01-31

	* Added token-count=n, token-count-min=n, and token-count-max=n options.

	* Minor code cleanups.

	2009-01-21

	* spamitarium.pl updated to version 0.3.0
	  (thanks to Tom Anderson)

	2009-01-11

	* For compatibility with Sun's Sun Studio 12 compiler, provide
          a name for the anonymous union in typedef word_t.
	  Patch provided by Jack Bailey.

	2008-10-20

	* update bf_compact documentation by removing explicit Berkeley DB
	  references, as it has been fixed to work with other database drivers
	  in March 2008.

	2008-10-15

	* bf_compact, bf_copy and bf_tar now support transformed program names
	  (fixes Debian Bug#501947).

	* Update sqlite3 adaptor to take advantage of sqlite3_prepare_v2()
	  API function that appeared in SQLite 3.3.9. The new _v2 interface
	  allows for more specific error messages when executing SQL
	  statements.  Also enable extended result codes for more precise error
	  reporting.

	2008-07-21

	* Update doc/integrating-with-postfix: the script now suggests sendmail
	  -G -i (where -G will be ignored by Postfix before 2.3) to tell
	  Postfix it's a gateway submission, not an original injection; the
	  filter pipe(8) magic for master.cf now suggests flags=Rq (was
	  flags=R), as per Postfix's FILTER_README.

	2008-07-09

	* Drop support for systems that reverse setvbuf arguments. The last
	  systems to do that are reported to be shipped in 1987 by the autoconf
	  manual, so ditch them.

1.1.7	2008-05-04 (released) 2008-05-18 (declared stable)

	2008-04-30

	* Updated sendmail milter contrib/bogofilter-milter.pl to v1.45
	  (thanks to Jonathan Kamens)

	2008-04-28

	* Added maildir training info to English and French FAQs.
	  (thanks to Karl Schmidt and to Mouss)

	2008-04-26

	* Fix uninitialized variable in lexer.c when unicode is disabled.
	  Patch provided by Roman Trunov.

	2008-04-20

	* In process_arg functions use the val parameter rather than optarg.
	  Patch provided by Roman Trunov.

	2008-04-18

	* Function process_arg now has the same prototype for
	  bogofilter, bogolexer, bogoutil, and bogotune.  The proper
	  version is called by function read_config_file for all
	  programs.  Problem reported by Roman Trunov.

	2008-04-17

	* Update Doxyfile for doxygen v1.5.5

	2008-04-16

	* Fixed syntax errors in t.valgrind test

	2008-03-21

	* bf_compact now supports compacting databases that use QDBM, Tokyo
	  Cabinet or SQLite3 and is covered by the test suite.

	2008-03-19

	* bf_compact now verifies databases before dumping them, to avoid
	  getting into an unterminated loop and wasting all diskspace.

	* Bogoupgrade now verifies databases before dumping them, to avoid
	  getting into an unterminated loop and burning all memory or disk
	  space when the database is corrupt.
	  This should fix Debian Bug#226643 and Debian Bug#226646.

	* Bogoupgrade now uses Pod::Usage to print usage/help, prints error
	  messages that are a bit more concise and validates arguments a bit
	  stricter.

	2008-02-08

	* Bump required sqlite version to 3.5.4, earlier versions could
	  sometimes corrupt the database. Update install-staticdblibs.sh.
	  Bogofilter will complain when used with older versions.

	2008-01-05

	* bf_compact problem fixed.  Reported by Thomas Novin.

1.1.6	2007-11-25 (released)

	* Transaction support added for TokyoCabinet datastore.
	  (thanks to Pierre Habouzit)

	* Bump required sqlite version to 3.4.2 and fix related compiler
	  warnings. Bogofilter will complain when used with older versions.

	2007-11-22

	* Support for TokyoCabinet datastore added.
	  (thanks to Pierre Habouzit)

	2007-08-14

	* doc/README.db was updated to BerkeleyDB 4.6
	* doc/README.db: section 3.5 was added, with information on how to 
	  resolve "Logging region out of memory; you may need to increase its 
	  size", section 4.2 now documents set_lg_regionmax.

	2007-07-23

	* The upstream repository was migrated to SVN.
	  In order to check the code out, use this command (one line):
	  (OBSOLETE) svn co https://bogofilter.svn.sourceforge.net/svnroot/bogofilter/trunk/bogofilter/ bogofilter
	  (see entry for 2012-12-30 for updated URL)

	2007-07-22

	* The install-staticdblibs.sh script was relicensed under GNU GPL v3,
	  adjusted to download Berkeley DB 4.2 from oracle.com, adds patch #5,
	  and updated to build SQLite 3.4.1. In order to for a rebuild of the
	  updated library, do: rm -rf /opt/db-4.2-lean /opt/sqlite-3-lean
	  and re-run the script.

	* The recommended minimum sqlite3 version is now 3.4.0, bogofilter will
	  warn if used with older versions. Bugs that could cause database
	  corruption in rare circumstances have been fixed in sqlite3.
	  See doc/README.sqlite for details.

	* Updated sendmail milter contrib/bogofilter-milter.pl to v1.27
	  (thanks to Jonathan Kamens)

	2007-02-25

	* Add '--spam-header-place={header}' to specify header line
	  before which the X-Bogosity line is placed.

	2007-02-14

	* Support --db-verify for sqlite3.

	* Fix defect where the database verification method would not be called
	  for traditional Berkeley DB databases. Reported by Eric Wood.

	2007-01-28

	* Fix test suite for situations where there are blanks in the test or
	  working directories' names.

	* Repair passthrough defect on systems whose standard system library
	  makes a distinction between text and binary mode in stdio stuff.

1.1.5	2007-01-14 (released) 2007-01-25 (declared stable)

	* Fixed Makefile dependency problem.
	  (reported by Andras Salamon)
	  This took several iterations to get right.

	2007-01-11

	* Fixed block-on-subnets problem.
	  (thanks to Jack Bailey)

	2007-01-10
	* Added block-on-subnets regression test.

1.1.4	2007-01-01 (released)

	* Update copyright notices.

	2006-12-08

	* Add GSL dependency to bogofilter target to support parallel
	  makes.
	  (reported by Martin von Gagern)

	2006-12-05

	* Fixed problem in flex-2.5.4 patch.
	  (reported by Boris 'pi' Piwinger)

1.1.3	2006-12-03 (released) 2006-12-20 (declared stable)

	* Fixed typo in configure.ac.
	  (reported by Boris 'pi' Piwinger and Torsten Veller)

1.1.2	2006-12-02 (released)

	2006-12-01

	* Revise install-staticlibs.sh's links for retrieving database
	  tarball and patches.
	* Revise make rules for generating statically linked RPM.

	2006-11-29

	* Provide separate flex patches for 2.5.4 and 2.5.3x

	2006-11-26

	* Updated file comment for lexer_v3.l and removed unneeded
	  rules T1, T12, SHORT_TOKEN, and TOKEN_12.
	* Miscellaneous minor cleanups of lexer_v3.l classes and rules.
	* Patch flex skeleton code problem which can cause a seg-fault.
	  (reported by Michael Gerdau)

	2006-11-21

	* Fix processing of "--unicode=no" option.

	2006-11-18

	* Fix prefixes for ip address and url tokens.  Restore colon
          that was dropped in token.c edit for bogofilter-1.1.0.

	2006-11-04

	* Fixed problem parsing message ids, which can cause a
	  seg-fault on an x86_64.
	  (reported by Torsten Veller)

	2006-10-03

	* Added '--ham-true' option for bogofilter (to match docs)

	2006-08-26

	* FAQ's updated to point to current sylpheed-claws wiki
	  (thanks to Paul Mangan)

1.1.1	2006-08-23 (released) 2006-09-01 (declared stable)

	2006-08-22

	* Added bogofilter-faq-it.html, an Italian translation of the
          FAQ  (thanks to Marco Bozzolan).

	2006-08-10

	* Fixed minor header/body multi-word token defect.

1.1.0	2006-08-09 (released)

	* Revised FAQ's mailbox conversion example.

	2006-07-26

	* 1.0.3 Promoted to "Stable" status

	2006-07-24

	* Forward port GNU make compatibility fix for doc/Makefile* from
	  1.0 branch.

	2006-07-08

	* Add large file support for 32-bit systems.
	  (_FILE_OFFSET_BITS/_LARGE_FILE).
	* Fix lexer_v3.l format string mismatch that broke debugging code on
	  64-bit systems.

	2006-07-04

	* Add multi-word token support to bogoutil & bogotune.

	2006-07-03

	* Clean up token prefixing.
	* Clean up queue-id processing.
	* Add max-multi-token-len checks.
	* Revised function names.  get_token() uses parse_new_token(),
          add_token_to_array(), build_token_from_array(), and
          build_prefixed_token(). 

	2006-07-02

	* Add min-token-len check (with exemption for 2 character
          money amounts which bogofilter has long accepted).
	* Add "short token" pattern to lexer

	2006-07-01

	* Refactor get_token.  Function get_single_token is the original
          get_token function.  Function get_multi_token calls
          get_single_token when another token must be parsed, else it
          constructs multi-part tokens using w_token_array (an array
          of word_t structs).

	2006-06-20

	* Add options for min/max token length, multi-token count, and
          max multi-token length.

	* Modify get_token() to return multi-word tokens.

1.0.3	2006-07-10 (released) 2006-07-26 (declared stable)

	* Released 1.0.3 to provide the bogotune bugfixes to a wider
	  audience.

	2006-07-09

	* Work around GNU make 3.81 incompatibility in doc/Makefile*
	  (it does not work properly with "}\" at the line ends, but
	   wants "} \" instead).

	2006-06-02

	* "make rpm" changes:
	  - document use with gpg-agent (see Makefile.am)
	  - build static RPMs (these won't fail) before shared RPMs

	2006-05-29

	* #include cleanups in common.h, system.h and C files.

	2006-04-28

	* Updated copyright dates.

	2006-04-13

	* Included additional config file options in bogofilter's
	  --help message.

	2006-03-27

	* Corrected option parsing in bogotune to support -n ham1 ham2
	  -s spam1 spam2 as suggested by bogotune -h; broken since 0.93.2.

	2006-03-26

	* Corrected problem with bogotune's -D option (thanks to Jason Smith).

	* Corrected man page description of bogotune's -n and -s options.

	2006-03-17

	* Fixed bf_compact's test for transactional environment.

	2006-03-12

	* 1.0.2 Promoted to "Stable" status

1.0.2	2006-03-03 (released)

	2006-02-19

	* Added vm-bogofilter.el for using bogofilter with VM, an
          Emacs mail tool (thanks to Björn Knutsson).
	* Added FAQ question "How do I use bogofilter with VM (an
          Emacs mail tool)?" (thanks to Pimpon).

	2006-02-14

	* SleepyCat has been acquired by Oracle, who are now providing
	  Berkeley DB. Since most of the references are to actual
	  strings in the programs or addresses that remain unchanged,
	  this will only gradually show in the bogofilter sources and
	  documentation.

	2006-02-06

	* Flush output after writing spam header line and/or message body.
	* When database is near to maximum allowed size, allow reading
	  it and disallow writing to it.

	2006-01-30

	* Fix formatting of Rtable output when in the message header,
	  this keeps verbose passthrough modes RFC-822/2822 compliant.

	2006-01-29

	* The configure script, when checking Berkeley DB capabilities,
	  now checks for logging and transactional subsystems rather
	  than the locking subsystem that was abandoned before 1.0.0.
	  This appears a suitable workaround for configure lockups on
	  OpenBSD 3.7 macppc with db 4.2 or 4.3.

	2006-01-28

	* Only print Berkeley DB file size message once per run.

	2006-01-21

	* 1.0.1 Promoted to "Stable" status

	2006-01-02

	* Fixed --input-file and --output-file command line options.

	2006-01-01

	* Added CVE-2005 identifiers for defects described in
          doc/bogofilter-SA-2005-01

1.0.1	2006-01-01 (released)

	* New names for binary rpms:

	  bogofilter-db42 - requires shared library for DB-4.2.52
	  bogofilter-db42-static - statically linked with DB-4.2.52
	  bogofilter-sqlite3 - requires shared library for SQLite3-3.2.8
	  bogofilter-sqlite3-static - statically linked with SQLite3-3.2.8

	2005-12-30

	* The configure help texts have been revised, the IEEE checks
	  for trio have been simplified (they are no longer nested) and
	  configure.ac has been updated to quiet autoconf -Wobsolete
	  warnings. The README file now reflects the new requirements.

	2005-12-29

	* For maintainers: Add install-staticdblibs.sh, a script to
	  fetch and build static & lean BerkeleyDB 4.2.52.4 and SQLite
	  3.2.8 libraries. Modify some parts of the RPM building so that
	  the binary RPMs are built without external dependencies beyond
	  glibc 2.2. This may render "make rpm" unusable on non-Linux
	  platforms, but you should still be able to "rpmbuild -tb" from
	  the source .tar.gz file.

	2005-12-27

	* Add '-O' option to direct bogoutil output to a file.
	* Fix building of binary rpms with SQLite support.
	* Include SQLite binary rpm as standard part of "make rpm"

	2005-12-26

	* Split NEWS file into files NEWS and NEWS.0 for new (version
	  1.0 and after) and old (version 0.x.y) info

	2005-12-25

	* Capitalize variables in bogofilter.spec.in to please RH9's
          RPM 4.2 implementation.

	2005-12-18
	
	* Fix bad return code in db_loop() in datastore_sqlite.c
	  (reported by Sami Farin).

	2005-12-17
	
	* XML documentation cleanups (thanks to Nicholas Kaiser).

	2005-12-06

	* bogofilter.cf.example was updated to reflect the proper default of
	  db_log_autoremove=yes. It previously claimed the default were "off".

1.0.0	2005-11-30 (released)

	Release history prior to 1.0.0 is in file NEWS.0

$Id: NEWS 6993 2013-06-28 21:54:23Z m-a $

 vim:tw=79 com=bf\:* ts=8 sts=8 sw=8 ai:

 LocalWords:  bogofilter bogolexer bogoutil Spamicity spamicity
 LocalWords:  procmail maildrop
