Path: ...!3.eu.feeder.erje.net!feeder.erje.net!usenet.goja.nl.eu.org!news.freedyn.de!paganini.bofh.team!news.killfile.org!news.eyrie.org!.POSTED!not-for-mail
From: Russ Allbery <rra@isc.org>
Newsgroups: news.software.nntp
Subject: [ANNOUNCE] INN 2.7.0 available
Date: Sat, 16 Jul 2022 11:39:58 -0700
Organization: Internet Systems Consortium, Inc.
Message-ID: <877d4c9a0x.fsf@hope.eyrie.org>
Mime-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Injection-Info: hope.eyrie.org;
	logging-data="12660"; mail-complaints-to="news@eyrie.org"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
To: inn-announce@isc.org
Cancel-Lock: sha1:tTn0mOUsisN3zbo8wANF5r/GP1A=
Bytes: 16122
Lines: 300

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Internet Systems Consortium is pleased to announce that a new major
release of INN is available at:

   https://ftp.isc.org/isc/inn/inn-2.7.0.tar.gz

The SHA-256 checksum of this release is:

   75c17e02aac939149187766a448e706118e13b22fecd8802a987e1f8ce866066

A PGP signature is available in the same directory.  Due to the extensive
changes between INN 2.6 and INN 2.7, no patch is available.

INN 2.7.0 is almost entirely compatible with INN 2.6, and most INN 2.6
users will be able to upgrade with a simple "make update".  A few checks
explained in the upgrade changes below should also be made.

All of the applicable bug fixes from the INN 2.6 series are also included
in INN 2.7.0.

Further 2.7.x releases will be made for bug fixes.  New features will go
into the 2.8.x series, which is already under development.  Please note
that the STABLE development branch is now INN 2.7.x, and there will be no
further INN 2.6.x releases after INN 2.6.5.

Many thanks to Julien =C3=89LIE for preparing this release and for all of h=
is
work on INN over the past seven years of this development cycle.

The following changes require your full attention because a manual
intervention may be needed:

 * The *require_ssl* parameter in readers.conf has been renamed to
   *require_encryption* as it applies to any kind of encryption layers,
   including TLS and SASL security layers. Since innupgrade only takes
   care of the change in the file named readers.conf, you will have to
   manually rename that parameter in configuration files for nnrpd with
   an alternate name.

 * The innreport.conf file in *pathetc* has been split into a general
   configuration file (innreport.conf itself) and a display configuration
   file (innreport-display.conf in *pathlib*). If you made local changes
   in sections other than the *default* section in innreport.conf, and
   wish to keep them, then you need renaming the new
   innreport-display.conf file to another name in *pathlib*, setting this
   local file name in the new *display_conf_file* option in
   innreport.conf, and re-applying your local changes to that local
   display configuration file.

   As a matter of fact, the default display configuration file would
   otherwise be overwritten each time INN is updated. Bug fixes or
   enhancements are made from time to time to the display configuration
   of innreport, and previously couldn't be automatically be merged in
   innreport.conf on update. This new separate configuration file to
   parameter the display will now permit an automatic update (if of
   course you use the default display configuration file).

 * A new inn-secrets.conf configuration file has been added in *pathetc*.
   The intent is that, from now on, new secrets used by INN are added to
   that file, and that all secrets currently stored in several other
   configuration files eventually move to that file. Make sure it is
   properly created during the upgrade, and not world-readable. It
   currently only stores the secrets used for the new Cancel-Lock
   functionality.

 * The -C flag given to innd to disable the execution of cancels has been
   deprecated and is no longer taken into account (an error message will
   be present in your logs if innd is started with it). Instead, a new
   parameter has been added in inn.conf to tune the types of cancels innd
   should process. If *docancels* is set to "require-auth", which is the
   default if INN has Cancel-Lock support, only articles originally
   protected by the Cancel-Lock authentication mechanism can be withdrawn
   by a valid authenticated cancel article or a valid authenticated
   supersede request. Withdrawals of articles not originally protected by
   Cancel-Lock will not be executed. See inn.conf(5) for more details
   about the different values of the new *docancels* parameter, and make
   sure to parameter it according to your needs.

 * The *refusecybercancels* and *verifycancels* parameters have been
   removed from inn.conf. The first was performing an inefficient and
   inexact check (that should be done, if wanted, in the special "ME"
   entry in newsfeeds, or even better, ask your peers not to feed you
   articles with "cyberspam" in the Path header field body); the second
   check performed on the newsgroups present in cancel articles was not
   useful in innd (this check is relevant to posting agents).

   The related lines in inn.conf will be commented by innupgrade during
   the upgrade.

 * The XBATCH command is no longer enabled by default in innd. You'll
   have to explicitly enable that capability by setting the new *xbatch*
   parameter to true in incoming.conf for the peers sending you such
   compressed batches.

 * The *nolist* and *noresendid* parameters in incoming.conf have been
   respectively renamed to *list* and *resendid* (and the meaning of
   their related boolean values is now the opposite). Besides, the unused
   *comment* and *email* parameters in incoming.conf have been removed.
   innupgrade will take care of the changes (inverting the boolean
   values, and commenting the lines with removed parameters).

 * filechan is no longer shipped with INN; it was just a simple version
   of buffchan. All calls to "filechan" will be changed to "buffchan -u"
   (for its unbuffered mode) in newsfeeds by innupgrade. If you have
   local scripts running filechan, you will have to manually take care of
   the change.

 * send-nntp is no longer shipped with INN. If you have local scripts
   running it, you will have to manually adjust them to use nntpsend
   which basically does the same thing, better. Or, even greater, use
   innfeed if that is possible.

 * Wrappers around old Perl and Python authentication and access hooks,
   pre-dating INN 2.4.0 and identifiable by the *nnrpperlauth* and
   *nnrppythonauth* parameters in inn.conf, are no longer shipped as
   samples in INN releases. If not already done, you should either
   replace old hooks with new modern hooks or use the possibilities that
   readers.conf and regular authenticator and resolver programs offer.

 * The libauth.h header file and the libstorage library have been renamed
   to libinnauth.h and libinnstorage to homogenize their name with
   existing libinnhist library. External programs building or linking
   against them need a manual change.

Changes in 2.7.0:

 * Upgrading to a major release is a good time to ensure that your
   configuration files, that are usually kept untouched during normal
   updates, are up-to-date: notably control.ctl (with your local changes
   in a separate control.ctl.local file), new better default values in
   inn.conf and innfeed.conf, improvements in innreport.conf (along with
   innreport-display.conf) and innreport.css, fixes in innwatch.ctl,
   updated moderators and nocem.ctl files.

   You may also want to check that the PGP keys used to verify the
   signature of control articles and NoCeM notices are still up-to-date
   and working. The keys of a few hierarchies and NoCeM issuers have
   recently changed.

 * Bo Lindbergh has implemented a new overview storage method based on
   SQLite, known for its long-term stability and compatibility. Robust
   and faster at reading ranges of overview data, but somewhat slower at
   writing, this new SQLite-based method is a perfect choice to store
   overview data.

   To select it as your overview method, set the *ovmethod* parameter in
   inn.conf to "ovsqlite". Details about ovsqlite, the ovsqlite.conf
   configuration file and how to switch to that new modern overview
   storage method can be found in the ovsqlite(5) and makehistory(8) man
   pages.

 * Julien Elie has implemented Cancel-Lock support in innd and nnrpd,
   based on RFC 8315 and libcanlock. A new inn-secrets.conf configuration
   file has been added in *pathetc* wherein you can set the secrets to
   use for Cancel-Lock. See the inn-secrets.conf(5) man page for more
   details.

   A new -F flag is recognized by innconfval to indicate the type of file
   to parse (by default, "inn.conf"); just run "innconfval -F
   inn-secrets.conf" to get the values of that new configuration file.
   Another new flag, -f, permits specifying another file name to parse
   than the standard one.

   The *addcanlockuser* parameter has been added in readers.conf to
   deactivate the generation of user-specific hashes when several
   different posters have the same identity in an access group. This
   parameter also permits setting whether the hash, when generated, is
   based on the username or the (static) IP of the connection.

 * Added a new tool, gencancel, to help the news administrator generate
   authenticated cancel control messages, with the expected admin
   Cancel-Key hashes. See the gencancel(1) man page for more details.

 * A new *docancels* parameter has been added in inn.conf to define which
   types of cancels innd should process. The -C flag given to innd is
   deprecated in favour of that new parameter (you'll see in your logs
   the message "innd -C flag has been deprecated and has no effect; use
   docancels in inn.conf" in case you're passing that flag to innd).

========== REMAINDER OF ARTICLE TRUNCATED ==========