xref: /netbsd/external/gpl2/xcvs/dist/NEWS (revision 6550d01e)
1Changes since 1.12.12:
2**********************
3
4SECURITY FIXES
5
6* CVS now uses version 1.2.3 of the ZLib compression libraries in order to
7  avoid two recently announced security vulnerabilities in them.  Both may be
8  used for denial of service attacks and one may reportedly allow execution of
9  arbitrary code, though this is not confirmed.  Please see the CERT
10  vulnerabilities advisories #238678 <http://www.kb.cert.org/vuls/id/238678> &
11  #680620 <http://www.kb.cert.org/vuls/id/680620> for more.
12
13NEW FEATURES
14
15* Thanks to Conrad Pino <conrad@pino.com>, a hang in the Windows client, which
16  had pretty much rendered the client useless, has been fixed.
17
18* A minor problem preventing build of the Kerberos4 client has been fixed.
19
20* The path to the config file may be set as an argument to the CVS server
21  commands.
22
23* Sections of directives specific to one or more repositories and not others
24  may now be specified in the config file.
25
26* %{sV} format strings are now available to the verifymsg trigger, similar to
27  the %{stVv} available to loginfo.
28
29* `cvs watch add' on an empty directory no longer clears watchers, and
30  specifying a directory for `cvs watch add' now (correctly) sets default
31  attributes.
32
33* Missing CVSROOT/history files will now cause CVS to attempt to create one.
34  To suppress history logging, set LogHistory equal to the empty string in
35  CVSROOT/config.
36
37* There are several new options available in CVSROOT/config.  These are
38  TmpDir, HistoryLogPath, HistorySearchPath, MinCompressionLevel, &
39  MaxCompressionLevel.  Please see the manual for more.
40
41* CVS on Solaris 10 was refusing to parse command options.  This has been
42  fixed.
43
44* The Windows client now creates locks compatible with older versions of CVS by
45  default.  This should only be relevant if your client is accessing a local
46  repository concurrently with another, older client.  If you would like to
47  disable compatibility mode (because it is slightly faster), edit the
48  LOCK_COMPATIBILITY flag in windows-NT/config.h and recompile.
49
50* Misc efficiency and portability improvements.
51
52BUG FIXES
53
54* Thanks to Serguei E. Leontiev <lse@CryptoPro.ru>, CVS with Kerberos 5 GSSAPI
55  should automatically link on FreeBSD 5.x. (bug #14639).
56
57* Thanks to Rahul Bhargava <rahul@wandisco.com>, heavily loaded systems
58  suffering from a disk crash or power failure will not lose data they claimed
59  to have committed.
60
61* CVS server now handles conflict markers in Entry requests as documented.
62
63* CVS now remembers that binary file merge conflicts occurred until the
64  timestamp of the updated binary file changes.
65
66* CVS client now saves some bandwidth by not sending the contents of files
67  with conflicts to the server when it isn't needed.
68
69* CVS now does correct locking during import.
70
71* A problem where the server could block indefinitely waiting for an EOF from
72  the client when compression was enabled has been fixed.
73
74* `cvs diff' no longer splits its arguments on spaces.
75
76* Thanks to an old report and patch from Stewart Brodie <stewart@eh.org>, a
77  potential crash in response to a corrupt RCS file has been fixed.
78
79* CVS now locks the history and val-tags files before writing to them.
80  Especially with large repositories, users should no longer see new warnings
81  about corrupt history records when using the `cvs history' command.  Existing
82  corrupt history records will still need to be removed manually.  val-tags
83  corruption should have had less obvious effects, but removing the
84  CVSROOT/val-tags file and allowing a 1.11.21 or later version of CVS to
85  regenerate it may eliminate a few odd behaviors and possibly cause a slight
86  speed up of read transactions in large repositories over time.
87
88BUILD ISSUES
89
90* The RPM spec file works again with the most modern versions of `rpm'.  It
91  also finds the correct version of install-sh when building the CVS with
92  GSSAPI.
93
94DEVELOPER ISSUES
95
96* We've standardized on Automake 1.9.6 to get some at new features that make
97  our jobs easier.  See the HACKING file for more on using the autotools with
98  CVS.
99
100Changes from 1.12.11 to 1.12.12:
101********************************
102
103SERVER SECURITY FIXES
104
105* Thanks to a report from Alen Zukich <alen.zukich@klocwork.com>, several minor
106  security issues have been addressed.  One was a buffer overflow that is
107  potentially serious but which may not be exploitable, assigned CAN-2005-0753
108  by the Common Vulnerabilities and Exposures Project
109  <http://www.cve.mitre.org>.  Other fixes resulting from Alen's report include
110  repair of an arbitrary free with no known exploit and several plugged memory
111  leaks and potentially freed NULL pointers which may have been exploitable for
112  a denial of service attack.
113
114* Thanks to a report from Craig Monson <craig@malachiarts.com>, minor
115  potential vulnerabilities in the contributed Perl scripts have been fixed.
116  The confirmed vulnerability could allow the execution of arbitrary code on
117  the CVS server, but only if a user already had commit access and if one of
118  the contrib scripts was installed improperly, a condition which should have
119  been quickly visible to any administrator.  The complete description of the
120  problem is here: <https://ccvs.cvshome.org/issues/show_bug.cgi?id=224>.  If
121  you were making use of any of the contributed trigger scripts on a CVS
122  server, you should probably still replace them with the new versions, to be
123  on the safe side.
124
125  Unfortunately, our fix is incomplete.  Taint-checking has been enabled in all
126  the contributed Perl scripts intended to be run as trigger scripts, but no
127  attempt has been made to ensure that they still run in taint mode.  You will
128  most likely have to tweak the scripts in some way to make them run.  Please
129  send any patches you find necessary back to <bug-cvs@nongnu.org> so that we
130  may again ship fully enabled scripts in the future.
131
132  You should also make sure that any home-grown Perl scripts that you might
133  have installed as CVS triggers also have taint-checking enabled.  This can be
134  done by adding `-T' on the scripts' #! lines.  Please try running
135  `perldoc perlsec' if you would like more information on general Perl security
136  and taint-checking.
137
138NEW FEATURES
139
140* Thanks to a report from Ian Abbott <abbotti@mev.co.uk>, a problem that caused
141  CVS to stop with broken assertions in certain time zones when daylight
142  savings is in effect has been fixed.
143
144* A problem where a proxy server could fail to notice that its primary closed
145  the connection has been fixed.
146
147* Failures to open the CVS_CLIENT_LOG, CVS_SERVER_LOG, and CVS_SECONDARY_LOG
148  are no longer fatal.
149
150* CVS's client and server IO buffers now rely on a GNULIB modules for memory
151  management rather than taking on the task themseleves.  This should be faster
152  on any system but may increase memory usage noticably on systems without the
153  POSIX mmap() function.  Benchmark reports to <bug-cvs@gnulib.org> would be
154  welcome.
155
156* Some more GNULIB functions have been imported and/or updated for portability
157  reasons.  This change should not be visible to most users, though CVS may now
158  compile on a few more platforms.
159
160* CVS creates a unique session id that gets written to the RCS files during
161  import and commit. When committing several files at once, they all get the
162  same 'commitid'. The commitid becomes visible with log and status commands,
163  and is derived and compatible with the cvsnt project.
164
165* CVS once again compiles correctly configured with various combinations of
166  --disable-client, --disable-server, and --disable-proxy.
167
168* CVS now accepts the <tag>:<date> format, which has long been acceptable as an
169  argument to -j options, in most places where <tag> used to be acceptable.  An
170  empty tag in this format (e.g. ":<date>"), which used to be rejected, is now
171  interpreted as specifying a date on the trunk.
172
173* CVS now uses ZLib 1.2.2.  This fixes the minor vulnerability described here:
174  <http://www.kb.cert.org/vuls/id/238678>, as well as some other minor bugs we
175  are not aware of bug reports for in conjunction with CVS.
176
177* `cvs -n release' now does what it should (see changes to the info-cleanup-0
178  test in sanity.sh for more).
179
180* The configure script now prefers `ssh' to `rsh' when determining a default
181  executable to use when connecting via the :ext: method.
182
183* A problem in the compression buffer that was causing some incompatibility
184  with some 3rd party CVS clients when compression was enabled has been fixed.
185
186* Some files missing from the distribution have been added or readded.  The
187  missing files were mostly development support files, with a few docs and
188  .cvsignore files thrown in.
189
190* The incomplete Brazillian Portugese translation of the CVS manual is now
191  included in the distribution.
192
193BUG FIXES
194
195* Misc bug and documentation fixes.
196
197* CVS now detects write errors on standard output.  Before, e.g.,
198  `cvs update -p FILE > /dev/full' would fail to report the write error.
199
200* Thanks to a report and a patch from Georg Scwharz <georg.scwarz@freenet.de>
201  CVS now builds without error on IRIX 5.3
202
203DEVELOPER ISSUES
204
205* We've standardized on Automake 1.9.5 to get some at new features that make
206  our jobs easier.  See the HACKING file for more on using the autotools with
207  CVS.
208
209Changes from 1.12.10 to 1.12.11:
210********************************
211
212NEW FEATURES
213
214* Thanks to Conrad Pino <conrad@pino.com>, the Windows build works once again.
215
216* CVSROOT methods and option names are now case insensitive
217
218* CVSROOT methods :ext: and :fork: now support the CVS_SERVER option.
219
220* CVSROOT method :ext: now supports the CVS_RSH and Redirect options.
221
222* Date handling has been improved slightly.
223
224* Miscellaneous bug fixes.
225
226* Miscellaneous documentation fixes.
227
228BUG FIXES
229
230* An intermittant assertion failure in checkout has been fixed.
231
232* Thanks to a report from Chris Bohn <cbohn@rrinc.com>, all the source files
233  needed to build on Windows are now included in the source distribution.
234
235Changes from 1.12.9 to 1.12.10:
236*******************************
237
238NEW FEATURES
239
240* The date formats which CVS accepts are now documented more fully in the
241  manual.
242
243* CVS commands which accept dates now understand some more time zones,
244  including those which are some hours plus some fraction of an hour off of
245  universal coordinated time.
246
247* `cvs ls filename' no longer causes an assertion failure.
248
249* The maximum length of the discovered comment leader used in a Log keyword
250  substitution is now limited to 20 characters by default.  If a longer leader
251  is discovered, then the keyword is not expanded.  This default behavior may
252  be altered using the new MaxCommentLeaderLength & UseArchiveCommentLeader
253  config options.
254
255* Commit messages once again include the full relative path to the file being
256  committed.
257
258* Thanks to funding from Juniper Networks <http://juniper.net>, "write proxy"
259  functionality has been added to the CVS server.  Write proxy functionality
260  allows any of multiple, read-only "secondary" servers to relay write requests
261  from clients to a single primary CVS server, allowing for a massive
262  redistribution of server load which is transparent to all known CVS clients.
263
264* Thanks to funding from Juniper Networks <http://juniper.net>, some code has
265  been added which second-guesses the system file cache for a performance
266  boost.
267
268* The loginfo scripting hook now runs after the administrative files in CVSROOT
269  are rebuilt, rather than before.
270
271* Misc error message improvements.
272
273* Thanks to funding from Juniper Networks <http://juniper.net>, new scripting
274  hooks have been added to the CVS server.  These are the postadmin, posttag,
275  and postwatch hooks.  See the manual for more info.
276
277* Thanks to funding from Juniper Networks <http://juniper.net>, all the
278  existing scripting hooks may now optionally be passed a command name
279  argument.
280
281* Thanks to funding from Juniper Networks <http://juniper.net>, new tags are
282  cached in the val-tags file at the time of tag creation.
283
284* Thanks to a patch from Brian Murphy <brian@murphy.dk>, CVS now supports PAM
285  session management.
286
287* Thanks to a report from Brian Murphy <brian@murphy.dk>, the demo PAM
288  configuration files mentioned in the manual are actually being distributed.
289
290* Thanks again to Bart Robinson <lomew@pobox.com>, `cvs log' & `cvs ls' now
291  actually output local times when the server is version 1.12.9 or greater and
292  the client is version  1.12.10 or greater.
293
294* The CVS server now sends paths to files relative to the repository.  CVS
295  clients have been able to handle this since at least the 10 year old
296  CVS 1.9.2 release, so no attempt at verifying compatibility of clients has
297  been made.  This saves a small amount of bandwidth and may enable some future
298  functionality.
299
300* The CVS client will send relative Directory requests if the server claims to
301  support it.  This saves a very small amount of bandwidth but may enable some
302  future functionality.
303
304* "cvs import" now has a new option, `-X', which causes new files to be
305  imported in a way that they appear only on the vendor branch, and do not
306  automatically appear on the main trunk.
307
308  This option may be made the default on a repository-wide basis
309  using the new ImportNewFilesToVendorBranchOnly=yes option in
310  CVSROOT/config.
311
312* contrib/cvs_acls.in has been revised. Users of the old version will
313  want to upgrade to use the new format. See the documentation in
314  contrib/cvs_acls.html for more information.
315
316* Thanks to Dan Peterson <dbpete@aol.com>, the contrib/validate_repo script now
317  accepts and logs corrupted revision numbers in RCS archives.
318
319BUG FIXES
320
321* Thanks to a report from Gottfried Ganssauge <gotti@cvshome.org>, CVS no
322  longer exits when it encounters links pointing to paths containing more
323  than 128 characters.
324
325* Thanks to a report from Dan Peterson <dbpete@aol.com>, error messages from
326  GSSAPI servers are no longer truncated.
327
328* Thanks to a report from Dan Peterson <dbpete@aol.com>, attempts to resurrect
329  a file on the trunk that was added on a branch no longer causes an assertion
330  failure.
331
332* Thanks to a report from Dan Peterson <dbpete@aol.com>, imports to branches
333  like "1.1." no longer create corrupt RCS archives.
334
335* Thanks to a report from Chris Bohn <cbohn@rrinc.com>, links from J.C. Hamlin
336  <jchamlin@ibsys.com>, and code posted by Jonathan Gilligan, we think we have
337  finally corrected the Windows "red-file" (daylight savings time) bug once and
338  for all.
339
340* Thanks to a patch from Jeroen Ruigrok/asmodai <asmodai@wxs.nl>, the
341  log_accum.pl script should no longer elicit warnings from Perl 5.8.5.
342
343* The r* commands (rlog, rls, etc.) can once again handle requests to run
344  against the entire repository (e.g. `cvs rlog .').  Thanks go to Dan Peterson
345  <dbpete@aol.com> for the report.
346
347* A problem where the attempted access of files via tags beginning with spaces
348  could cause the CVS server to hang has been fixed.  This was a particular
349  problem with WinCVS clients because users would sometimes accidentally
350  include spaces in tags pasted into a dialog box.  This fix also altered some
351  of the error messages generated by the use of invalid tags.  Thanks go to Dan
352  Peterson <dbpete@aol.com> for the report.
353
354* Thanks to James E Wilson <wilson@specifixinc.com> for a bug fix to
355  modules processing "gcc-core -a !gcc/f gcc" will no longer exclude
356  gcc/fortran by mistake.
357
358* Thanks to Conrad Pino <conrad@pino.com>, the Windows build works once again.
359
360* Misc updates to the manual.
361
362DEVELOPER ISSUES
363
364* We've standardized on Automake 1.9.3 to get some at new features that make
365  our jobs easier.  See the note below on the Autoconf upgrade for more
366  details.
367
368* We've standardized on Autoconf version 2.59 to get presumed bug fixes and
369  features, but nothing specific.  Mostly, once we decide to upgrade one of the
370  autotools we just figure it'll save time later to grab the most current
371  versions of the others too.  See the HACKING file for more on using the
372  autotools with CVS.
373
374Changes from 1.12.8 to 1.12.9:
375******************************
376
377SERVER SECURITY FIXES
378
379* Thanks to Stefan Esser & Sebastian Krahmer, several potential security
380  problems have been fixed.  The ones which were considered dangerous enough
381  to catalogue were assigned issue numbers CAN-2004-0416, CAN-2004-0417, &
382  CAN-2004-0418 by the Common Vulnerabilities and Exposures Project.  Please
383  see <http://www.cve.mitre.org> for more information.
384
385* A potential buffer overflow vulnerability in the server has been fixed.
386  This addresses the Common Vulnerabilities and Exposures Project's issue
387  #CAN-2004-0414.  Please see <http://www.cve.mitre.org> for more information.
388
389NEW FEATURES
390
391* `cvs log' & `cvs ls' now output local times when both the server and client
392  are 1.12.9 or greater.  (Thanks to Bart Robinson <lomew@pobox.com>.)
393
394DEVELOPER NOTES
395
396* The windows-NT/config.h.in file is now generated dynamically from the
397  root config.h.in file and a few inputs in the windows-NT directory in hopes
398  of keeping it more in sync with the root config.h.in file.
399
400Changes from 1.12.7 to 1.12.8:
401******************************
402
403SERVER SECURITY FIXES
404
405* A potential buffer overflow vulnerability in the server has been fixed.
406  Prior to this patch, a malicious client could potentially use carefully
407  crafted server requests to run arbitrary programs on the CVS server machine.
408  This addresses the Common Vulnerabilities and Exposures Project's issue
409  #CAN-2004-0396.  Please see <http://www.cve.mitre.org> for more information.
410
411NEW FEATURES
412
413* Some redundant output generated by the `cvs commit' command has been removed.
414
415* Most output from the `cvs commit' command is suppressed when the -Q global
416  option is specified.
417
418* Repository directory browsing via `cvs rls' & `cvs ls' commands.  Expect
419  changes in the long format output soon.  The "entries" format output should
420  remain fairly stable for automated parsers.
421
422* Glob matches, as specified in ignore lists and wrapper options, now conform
423  to the POSIX.2 specification for fnmatch on all platforms.
424
425* The Windows MS Visual C++ project files, including the nmake build files,
426  are now generated with MSVC++ 6.0, but should still work with MSVC++ 5.0.
427
428BUG FIXES
429
430* The cvs.1 man page is now generated automatically from a section of the CVS
431  Manual.
432
433* Thanks to a report from Mark Andrews at the Internet Systems Consortium, the
434  :ext: connection method no longer relies on a transparent transport that uses
435  an argument processor that can handle arbitrary ordering of options and other
436  arguments when using a username other than the caller's.
437
438* Thanks to Ken Raeburn at MIT, directory deletion, whether via `cvs release'
439  or empty directory pruning, now works on network shares under Windows XP.
440
441Changes from 1.12.6 to 1.12.7:
442******************************
443
444SERVER SECURITY ISSUES
445
446* Piped checkouts of paths above $CVSROOT no longer work.  Previously, clients
447  could have requested the contents of RCS archive files anywhere on a CVS
448  server.  This addresses CVE issue CAN-2004-0405.  Please see
449  <http://www.cve.mitre.org> for more information.
450
451CLIENT SECURITY ISSUES
452
453* Clients now check paths from the server to verify that they are within one of
454  the sandboxes the user requested be updated.  Previously, a trojan server
455  could have written or overwritten files anywhere the user had access,
456  presenting a serious security risk.  This addresses CVE issue CAN-2004-1080.
457  Please see <http://www.cve.mitre.org> for more information.
458
459GENERAL USER ISSUES
460
461* Imported the most recent version of regex from GNULIB, which actually means
462  some systems will use now their native regex functions instead of compiling
463  CVS's.  Users should notice no changes in CVS responses to regular
464  expressions.  If you do, please report them to <bug-cvs@gnu.org>.
465
466* CVS now accepts the location of HTTP tunnel web proxies as part of the
467  CVSROOT string.  Actually using a proxy remains untested.  Please report
468  problems and successes to <bug-cvs@gnu.org>.
469
470* Configure no longer checks the $TMPDIR, $TMP, & $TEMP variables to set the
471  default temporary directory.
472
473* CVS on Cygwin correctly handles X:\ style paths.
474
475* Import now uses backslash rather than slash on Windows when checking for
476  "CVS" directories to ignore in import commands.
477
478* Relative paths containing up-references (`..') should now work in
479  client/server mode (client fix).
480
481* A race condition between the ordering of messages from CVS and messages from
482  called scripts in client/server mode has been removed (server fix).
483
484* The check_cvs and cvscheck scripts in the contrib directory have been renamed
485  validate_repo and sandbox_status, respectively, in the interests of clarity.
486
487* The Windows MS Visual C++ 6.0 project files have been brought up to date.
488  The nmake build files were regenerated from these files with MSVC++ 5.0.
489
490* A memory allocation bug on Windows that could cause at least executions of
491  `cvs status' to fail has been fixed (client fix).
492
493* Resurrected files now get their modes and timestamps set correctly and a
494  longstanding bug involving resurrection of an uncommitted removal has been
495  fixed (server fix).
496
497* Some resurrection (cvs add) status messages have changed slightly.
498
499* `cvs release' now works with Kerberos or GSSAPI encryption enabled (server
500  fix).
501
502* File resurrection from a previously existing revision no longer just reports
503  that it works (server fix).
504
505* Misc error & status message corrections.
506
507* Diffing of locally added files against arbitrary revisions in an RCS archive
508  is now allowed when a file of the same name exists or used to exist on some
509  branch (server fix).
510
511* Some user messages have been updated for consistency and spelling.
512
513DEVELOPER ISSUES
514
515* The message source differentiation in the test suite between client and
516  server executables has been repaired.
517
518Changes from 1.12.5 to 1.12.6:
519******************************
520
521GENERAL USER ISSUES
522
523* CVSROOT/*info scripts may not work as expected with executables compiled
524  using VC++ under Windows since all quoting is currently done according to
525  Bourne Shell rules, which probably don't look like command.com rules.
526  Patches gratefully accepted.
527
528* Imports will now always ignore directories and files named `CVS' to avoid
529  violating assumptions made by other parts of CVS.
530
531* Directories specified to `checkout -d' are no longer required to exist.  This
532  consolidates some behavior between `-d' options specified in the modules file
533  and `checkout -d' as well as removing some prior differences between local
534  and client/server mode operation.
535
536* A problem with `cvs release' of subdirs that could corrupt CVS/Entries files
537  has been fixed (client/server).
538
539* The CVS server's protocol check for unused data from the client is no longer
540  called automatically at program exit in order to avoid potential recursive
541  calls to error when the first close is due to memory allocation or similar
542  problems that cause calls to error() to fail.  The check is still made when
543  the server program exits normally.
544
545* The CVSROOT/*info files want a new command format and the old style strings
546  have been deprecated.  Please see the manual for more information on the new
547  format.
548
549* The spec file has been updated to work with more recent versions of RPM.
550
551* Some more GNULIB functions have been imported and/or updated for portability
552  reasons.
553
554* Several memory leaks have been plugged.
555
556* A seg fault which always occurred after waiting on another process's lock
557  in order to establish a promotable lock is now avoided.
558
559* An unlikely potential segfault when using the :fork: connection method has
560  been fixed.
561
562* The CVS server has had the protocol check for unused data from the client
563  partially restored.
564
565* A fix has been included that should avoid a very rare race condition that
566  could cause a CVS server to exit with a "broken pipe" message.
567
568* Infinite alias loops in the modules file are now checked for and avoided.
569
570* Clients on case insensitive systems now preserve the case of directories in
571  CVS/Entries, in addition to files, for use in communications with the CVS
572  server.
573
574* Misc status message fixes for consistency.
575
576* Some previously untested behavior is now being tested.
577
578* Server no longer claims to support the "Case" request.
579
580* Case insensitive clients once again preserve the case of filenames in
581  CVS/Entries for communication with the server, as specified in the CVS
582  client/server protocol spec.  Note that all CVS _servers_ still lack support
583  for case insensitive clients - servers are relying on the client to preserve
584  the case of checked out files.
585
586* Thanks to Ville Skyttä the man page has a few less spelling errors and is
587  slightly more accurate.
588
589* Thanks to Ville Skyttä some unused variables were removed from the log_accum
590  Perl script in contrib.
591
592* Thanks to Alexey Mahotkin, a bug that prevented CVS from being compiled with
593  Kerberos 4 authentication enabled has been fixed.
594
595* A minor bug that caused CVS to fail to report an inifinte alias loop in the
596  modules file when portions of the alias definition contained trailing slashes
597  has been fixed.
598
599* A bug in the gzip code that could cause heap corruption and segfaults in CVS
600  servers talking to clients less than 1.8 and some modern third-party CVS
601  clients has been fixed.
602
603* mktemp.sh is now included with the source distribution so that the rcs2log
604  and cvsbug executables may be run on systems which do not contain an
605  implementation of mktemp.
606
607* Misc documentation fixes.
608
609DEVELOPER ISSUES
610
611* xmalloc, xstrdup, & some other memory allocating functions are now available
612  vi GNULIB versions imported into lib.
613
614* The asnprintf() & vasnprintf() functions are now available due to a GNULIB
615  implementation.
616
617* Misc cosmetic, readability, and commenting fixes.
618
619Changes between 1.12.4 and 1.12.5:
620**********************************
621
622SERVER SECURITY ISSUES
623
624* pserver can no longer be configured to run as root via the
625  $CVSROOT/CVSROOT/passwd file, so if your passwd file is compromised, it no
626  longer leads directly to a root hack.  Attempts to root will also be logged
627  via the syslog.
628
629GENERAL USER ISSUES
630
631* The Windows build files were updated to allow building of the current version
632  under Windows.
633
634Changes between 1.12.3 and 1.12.4:
635**********************************
636
637GENERAL USER ISSUES
638
639* The CVS server no longer locks more than a directory at a time for write, so
640  large commits & tags should now have a much harder time blocking other
641  operations.
642
643* Add support for large files. Use --disable-largefile to omit support
644  for large files.
645
646Changes between 1.12.2 and 1.12.3:
647**********************************
648
649SERVER SECURITY ISSUES
650
651* Malformed module requests could cause the CVS server to attempt to create
652  directories and possibly files at the root of the filesystem holding the CVS
653  repository.  Filesystem permissions usually prevent the creation of these
654  misplaced directories, but nevertheless, the CVS server now rejects the
655  malformed requests.
656
657GENERAL USER ISSUES
658
659* Support for case insensitive clients has been removed.  This is not as
660  drastic as it sounds, as all of the current tests still pass without
661  modification when run from a case insensitive client to a case sensitive
662  server.  In the end this should provide a major stability improvement.
663
664* A minor problem that prevented the correct version of a system ZLIB from
665  being detected on some platforms has been fixed.
666
667* Attempts to use the global `-l' option, removed from both client and server
668  as of version 1.12.1, will now elicit a warning rather than a fatal error
669  from the server.
670
671* The configure script now tests whether it is building CVS on a case
672  insensitive file system.  If it is, CVS assumes that all file systems on this
673  platform will be case insensitive.  This is useful for getting the case
674  insensitivity flag set correctly when compiling on Mac OS X and under Cygwin
675  on Windows.  Autodetection can be overridden using the
676  --disable-case-sensitivity and --enable-case-sensitivity arguments to
677  configure.
678
679DEVELOPER ISSUES
680
681* A new set of tests to test issues specific to case insensitive clients and
682  servers has also been added.
683
684* Support has been added to the test suite to support testing over a :ext: link
685  to another machine, subject to some stringent requirements.  This support can
686  be used, for instance, to test the operation of a case insensitive client
687  against a case sensitive server.  Please see the comments in TEST and the
688  src/sanity.sh test script itself for more.
689
690* We've standardized on Automake 1.7.9 to get a bug fix.  See the note below
691  on the Autoconf upgrade for more details.
692
693* We've standardized on Autoconf version 2.58 to avoid a bug and get at a few
694  new macros.  Again, this should only really affect developers, though it is
695  possible that CVS will now compile on a few new platforms.  Please see the
696  section of the INSTALL file about using the autotools if you are compiling
697  CVS yourself.
698
699Changes between 1.12.1 and 1.12.2:
700
701* Misc cleanup, reorganization, and other minor fixes.
702
703* A behavior change in `cvs up -jrev1 -jrev2' for modified files with a base
704  revision of rev2 (ie, checked-out version matches rev2 and file has been
705  modified).  The operation is no longer ignored and instead is passed to
706  diff3.  This will potentially re-apply the diffs between the two revisions to
707  a modified local file.  Status messages like from a standard merge have also
708  been added when the file would not or does not change due to this merge
709  request ("[file] already contains the changes between [revisions]...").
710
711* A build problem that caused warnings and slower builds on systems without a
712working getline() function (e.g. Mac OS X 10.1) has been fixed.
713
714* A build problem that prevented the CVS executable from being built on systems
715with the gettext library installed has been fixed.
716
717* A bug which could stop `cvs admin -mTAG:message' from recursing has been
718  fixed.
719
720* Misc documentation cleanup and fixes.
721
722* Some of the contrib scripts, some of the documentation, and sanity.sh were
723  modified to use and recommend more portable commands rather than using and
724  recommending commands which were not compatible with the POSIX 1003.1-2001
725  specification.
726
727* CVS now knows how to report, as well as record, `P' record types.
728
729* When running the `cvs history' command, clients will now send the
730  long-accepted `-e' option, for all records, rather than explicitly requesting
731  `P' record types, a request which servers prior to 1.11.7 will reject with a
732  fatal error message.
733
734* A problem with locating files requested by case insensitive clients which was
735  accidentally introduced in 1.11.6 as part of a fix for a data loss problem
736  involving `cvs add's from case insensitive clients has been fixed.  The
737  relevant error message was `cvs [<command> aborted]: filE,v is ambiguous;
738  could mean FILE,v or file,v'.
739
740* A problem in the CVS getpass library that could cause passwords to echo on
741  some systems has been fixed.
742
743* A segfault that could occur in very rare cases where the stat of a file
744  failed during a diff has been fixed.
745
746* Any user with write privleges to the CVSROOT/checkoutlist file could pass
747arbitrary format strings directly through to a printf function.  This was
748probably bad and has been fixed.  White space at the beginning of error strings
749in checkoutlist is now ignored properly.
750
751* A chmod 0600 that CVS performed on temp files it created designed to work
752around a bug in versions of GLIBC eariler than 2.0.7 has been removed since it
753still left a race condition open to exploitation and provided a false sense of
754security.  If you are linking CVS against a version of GLIBC prior to 2.0.7,
755you should consider upgrading GLIBC.
756
757* The CVSROOT/editinfo file is no longer referenced by CVS.  This funcitonality
758has been deprecated for over six years and removing it will presumably not
759cause anyone any problems.
760
761* In client/server mode, most messages from CVS now contain the actual
762command name rather than the generic "server".
763
764* A long-standing bug that prevented most client/server updates from being
765logged in the history file has been fixed.
766
767* Updates done via a patch ("P" status) are now logged in the history file
768by default and the corresponding "P" history record type is now documented.
769If you're setting the LogHistory option in your CVSROOT/config file, you may
770want to add "P" to the list of record types.
771
772* CVS now will always compile its own getpass() function (originally from
773GNULIB) in favor of any system one that may exist.  This avoids some problems
774with long passwords on some systems and updates us to POSIX.2 compliance, since
775getpass() was removed from the POSIX.2 specification.
776
777* Support for pre-ANSI compilers has been removed.  Our minimum support level
778now assumes at least a freestanding C89 compilers.  See the HACKING file for
779more information.  If you *really* need K&R support, our Makefile.am files
780should only need minor tweaking to get them to run the ansi2knr script from the
781Automake project.  If you get this working, please send a patch to
782<bug-cvs@gnu.org>.
783
784* Experimental support for Pluggable Authentication Modules (PAM) has been
785added, though it is not compiled by default.  If you like this feature (or
786don't), please send us feedback.  See the Cederqvist, `./configure --help',
787and the INSTALL file for more.
788
789* Command line keyword expansion modes no longer override binary keyword
790expansion modes.
791
792* New LocalKeyword and KeywordExpand options to CVSROOT/config which
793FreeBSD, OpenBSD, and NetBSD users may find familiar as the "tag" and
794"tagexpand" options used for many years. The CVSHeader keyword has
795also been added to the mixture.
796
797* A bug that allowed a write lock to be created in a directory despite
798there being existing read locks when using LockDir in CVSROOT/config has
799been fixed.
800
801* A bug with short patches (`rdiff -s') which caused rdiff to sometimes report
802differences that did not exist has been fixed.
803
804* Some minor corrections were made to the diff code to keep diff & rdiff from
805printing diff headers with empty change texts when two files have different
806revision numbers but the same content.
807
808* The global '-l' option, which suppressed history logging, has been removed
809from both client and server.
810
811Changes from 1.11.5 to 1.12.1:
812
813* The new --with-external-zlib option can be passed to configure to compile
814CVS against an external installed zlib.
815
816* A warning message is now issued if an administrative file contains
817more than one DEFAULT entry.
818
819* An error running a verifymsg script (such as referencing an unset user
820variable or the script not existing) now causes the verification to
821fail.
822
823* Errors in administrative files commands (like unset user variables)
824are no longer reported unless the command is actually executed.
825
826* When a file is initially checked out, its last access time is now set
827to the current time rather than being set to the time the file was last
828checked in like the modification time is.
829
830* The Checkin.prog and Update.prog functionality has been removed.  This
831fuctionality previously allowed executables to be specified in the modules file
832to be run at update and checkin time, but users could edit these files on a per
833workspace basis, creating a security hole.
834
835* CVSROOTs which contain a symlink to a real repository should work.
836
837* contrib/rcs2log and src/cvsbug now use the BSD mktemp program to create
838their temp files and directories on systems which provide it.
839
840* Added a UserAdminOptions configuration option to CVSROOT/config to
841control which `cvs admin' commands are not restricted to the `cvsadmin'
842group.
843
844* If the rcsinfo specified template changes after a user has checked
845out a tree, the template in the users' tree will be updated rather
846than remaining static from the time of the original checkout.
847
848* Added a CVSREADONLYFS environment variable and `-R' cvs global
849option to turn on read-only repository mode for local repositories.
850This allows users to checkout from a CDROM repository or other
851read-only filesystem.
852
853* There is a new CVS_LOCAL_BRANCH_NUM environment variable, which
854may be used to give control over the branch number to be used next.
855Useful for having local changes in a CVSup mirrored repository.
856
857* Miscellaneous documentation corrections.
858
859* Corrected the path in a failed write error message.
860
861* Autoconf and Automake are no longer run automatically unless you run
862configure with --enable-maintainer-mode.  Accordingly, noautomake.sh is
863no longer needed and has been removed.
864
865* We've standardized on Automake version 1.7.5 and Autoconf version 2.57 to get
866at a few new macros.  Again, this should only really affect developers.  See
867the section of the INSTALL file about using the autotools if you are compiling
868CVS yourself.
869
870Changes from 1.11.4 to 1.11.5:
871
872* Fixed a security hole in the CVS server by which users with read only access
873could gain write access.  This issue does not affect client builds.  The
874Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
875name CAN-2003-0015 to this issue.  See
876<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0015> for more
877information.
878
879* Fixed some bugs where revision numbers starting with 0 (like 0.3)
880weren't correctly handled.  (CVS doesn't normally use such revision
881numbers, but users may be able to force it to do so and old RCS files
882might.)
883
884Changes from 1.11.3 to 1.11.4:
885
886* Some minor changes to allow the code to compile on Windows platforms.
887
888Changes from 1.11.2 to 1.11.3:
889
890* The tag/rtag code has been fixed to once again lock just a single
891directory at a time.
892
893* There was a bug where certain error conditions could cause the server
894to go into an infinite loop.  There was also a bug that caused a
895compressed connection from an older client to hang on shutdown.  These
896bugs have been fixed.
897
898* Fixed a bug that caused the server to reject most watch commands.
899
900* When waiting for another user's lock, the message timestamps are now
901in UTC rather than the server's local time.
902
903* The options.h file is no longer used.  This fixes a bug that occurred when
9041.11.2 was compiled on Windows platforms.
905
906* We've standardized on Automake version 1.6.3 and Autoconf version 2.53.
907They are cleaner, less bug prone, and will hopfully allow me to start updating
908sanity.sh to use Autotest and Autoshell.  Again, this should only really affect
909developers.  See the section of the INSTALL file about using the autotools if
910you are compiling CVS yourself.
911
912* Fixed a bug in the log/rlog code when a revision range crosses a
913branch point.
914
915* Fixed a bug where filenames starting with - would be misinterpreted as
916options when using client/server mode.
917
918Changes from 1.11.1p1 to 1.11.2:
919
920* There is a new feature, enabled by RereadLogAfterVerify in CVSROOT/config,
921which tells CVS to reread the log message after running the verifymsg
922script.  This allows the verifymsg script to reformat or otherwise
923modify the log message.
924
925* The interpretation of revision ranges using :: in "log" and "rlog"
926has changed: a::b now excludes the log message from revision a but
927includes the log message from revision b.  Also, revision ranges that
928cross branch points should now work.
929
930* zlib has been updated to version 1.4.  There is a security advisory
931out in regards to 1.3.  This should fix that problem.
932
933* The "log" and "rlog" commands now have a -S option to suppress the
934header information when no revisions are selected.
935
936* A serious error that allowed read-only users to tag files has been
937corrected.
938
939* The "annotate" command will no longer annotate binary files unless
940you specify the new -F option.
941
942* The "tag" and "rtag" commands will no longer move or delete branch
943tags unless you use the new -B option.  (This prevents accidental
944changes to branch tags that are hard to undo.)
945
946* We've standardized on the 1.5 Automake release for the moment.  Again, this
947should only really affect developers.  See the section of the INSTALL file
948about using the autotools if you are compiling CVS yourself.
949
950Changes from 1.11.1 to 1.11.1p1:
951
952* Read only access was broken - now fixed.
953
954Changes from 1.11 to 1.11.1:
955
956* There was a locking bug in the tag/rtag code that could lose changes
957made to a file while the tag operation was in progress.  This has been
958fixed, but all of the directories being tagged are now locked for the
959entire duration of the tag operation rather than only one directory at a
960time.
961
962* The "cvs diff" command now accepts the -y/--side=by-side and -T/
963--initial-tab options.  (To use these options with a remote repository,
964both the client and the server must support them.)
965
966* The expansion of the loginfo format string has changed slightly.
967Previously, the expansion was surrounded by single quotes ('); if a file
968name contained a single quote character, the string would not be parsed
969as a single entity by the Unix shell (and it would not be possible to
970parse it unambiguously).  Now the expansion is surrounded by double
971quotes (") and any embedded dollar signs ($), backticks (`), backslashes
972(\), and double quotes are preceded by a backslash.  This is parsed as a
973single entity by the shell reguardless of content.  This change should
974not be noticable unless you're not using a Unix shell or you have
975embedded the format string inside a double quoted string.
976
977* There was a bug in the diff code which sometimes caused conflicts to
978be flagged which shouldn't have been.  This has been fixed.
979
980* New "cvs rlog" and "cvs rannotate" commands have been added to get log
981messages and annotations without having to have a checked-out copy.
982
983* Exclusive revision ranges have been added to "cvs log" using ::
984(similar to "cvs admin -o").
985
986* The VMS client now accepts wildcards if you're running VMS 7.x.
987
988* ZLIB has been updated to version 1.1.3, the most current version.  This
989includes mostly some optimizations and minor bug fixes.
990
991* The ~/.cvspass file has a slightly modified format.  CVSROOTs are now
992stored in a new canonical form - hostnames are now case insensitive and
993port numbers are always stored in the new format.  Until a new login for
994a particular CVSROOT is performed with the new version of CVS, new and
995old versions of CVS should interoperate invisibly.  After that point, an
996extra login using the old version of CVS may be necessary to continue to
997allow the new and old versions of CVS to interoperate using the same
998~/.cvspass file and CVSROOT. The exception to this rule occurs when the
999CVSROOTs used with the different versions use case insensitively
1000different hostnames, for example, "empress", and "empress.2-wit.com".
1001
1002* A password and a port number may now be specified in CVSROOT for
1003pserver connections.  The new format is:
1004
1005    :pserver:[[user][:password]@]host[:[port]]/path
1006
1007Note that passwords specified in a checkout command will be saved in the
1008clear in the CVS/Root file in each created directory, so this is not
1009recommended, except perhaps when accessing anonymous repositories or the
1010like.
1011
1012* The distribution has been converted to use Automake.  This shouldn't
1013affect most users except to ease some portability concerns, but if you
1014are building from the repository and encounter problems with the
1015makefiles, you might try running ./noautomake.sh after a fresh update
1016-AC.
1017
1018Changes from 1.10 to 1.11:
1019
1020* The "cvs update" command has a new -C option to get clean copies from
1021the repository, abandoning any local changes.
1022
1023* The new "cvs version" command gives a short version message.  If
1024the repository is remote, both the client and server versions are
1025reported.
1026
1027* "cvs admin -t" now works correctly in client/server mode.
1028
1029* The "cvs history" command output format has changed -- the date
1030now includes the year and is given is ISO 8601 format (yyyy-mm-dd).
1031Also, the new LogHistory option in CVSROOT/config can be used to
1032control what information gets recorded in the log file and code has
1033been added to record file removals.
1034
1035* The buggy PreservePermissions code has been disabled.
1036
1037* Anonymous read-only access can now be done without requiring a
1038password.  On the server side, simply give that user (presumably
1039`anonymous') an empty password in the CVSROOT/passwd file, and then
1040any received password will authenticate successfully.
1041
1042* There is a new access method :fork: which is similar to :local:
1043except that it is implemented via the CVS remote protocol, and thus
1044has a somewhat different set of quirks and bugs.
1045
1046* The -d command line option no longer updates the CVS/Root file.  For
1047one thing, the CVS 1.9/1.10 behavior never had updated CVS/Root in
1048subdirectories, and for another, it didn't seem that popular in
1049general.  So this change restores the CVS 1.8 behavior (which is also
1050the CVS 1.9/1.10 behavior if the environment variable
1051CVS_IGNORE_REMOTE_ROOT is set; with this change,
1052CVS_IGNORE_REMOTE_ROOT no longer has any effect).
1053
1054* It is now possible for a single CVS command to recurse into several
1055CVS roots.  This includes roots which are located on several servers,
1056or which are both remote and local.  CVS will make connections to as
1057many servers as necessary.
1058
1059* It is now possible to put the CVS lock files in a directory
1060set by the new LockDir option in CVSROOT/config.  The default
1061continues to be to put the lock files in the repository itself.
1062
1063Changes from 1.9 to 1.10:
1064
1065* A bug was discovered in the -t/-f wrapper support that can cause
1066serious data loss.  Because of this (and also the fact that it doesn't
1067work at all in client/server mode), the -t/-f wrapper code has been
1068disabled until it can be fixed.
1069
1070* There is a new feature, enabled by TopLevelAdmin in CVSROOT/config,
1071which tells CVS to modify the behavior of the "checkout" command.  The
1072command now creates a CVS directory at the top level of the new
1073working directory, in addition to CVS directories created within
1074checked-out directories.  See the Cederqvist for details.
1075
1076* There is an optional set of features, enabled by PreservePermissions
1077in CVSROOT/config, which allow CVS to store unix-specific file
1078information such as permissions, file ownership, and links.  See the
1079Cederqvist for details.
1080
1081* One can now authenticate and encrypt using the GSSAPI network
1082security interface.  For details see the Cederqvist's description of
1083specifying :gserver: in CVSROOT, and the -a global option.
1084
1085* All access to RCS files is now implemented internally rather than by
1086calling RCS programs.  The main user-visible consequence of this is
1087that there is no need to worry about making sure that CVS finds the
1088correct version of RCS.  The -b global option and the RCSBIN setting
1089in CVSROOT/config are still accepted but don't do anything.  The
1090$RCSBIN internal variable in administrative files is no longer
1091accepted.
1092
1093* There is a new syntax, "cvs admin -orev1::rev2", which collapses the
1094revisions between rev1 and rev2 without deleting rev1 or rev2
1095themselves.
1096
1097* There is a new administrative file CVSROOT/config which allows one
1098to specify miscellaneous aspects of CVS configuration.  Currently
1099supported here:
1100
1101  - SystemAuth, allows you to prevent pserver from checking for system
1102  usernames/passwords.
1103
1104For more information see the "config" section of cvs.texinfo.
1105
1106* When setting up the pserver server, one now must specify the
1107allowable CVSROOT directories in inetd.conf.  See the Password
1108authentication server section of cvs.texinfo for details.  Note that
1109this implies that everyone who is running a pserver server must edit
1110inetd.conf when upgrading their CVS.
1111
1112* The client no longer needs an external patch program (assuming both
1113the client and the server have been updated to the new version).
1114
1115* "cvs admin [options]" will now recurse.  In previous versions of
1116CVS, it was an error and one needed to specify "cvs admin [options] ."
1117to recurse.  This change brings admin in line with the other CVS
1118commands.
1119
1120* New "logout" command to remove the password for a remote cvs
1121repository from the cvspass file.
1122
1123* Read-only repository access is implemented for the
1124password-authenticated server (other access methods are just governed
1125by Unix file permissions, since they require login access to the
1126repository machine anyway).  See the "Repository" section of
1127cvs.texinfo for details, including a discussion of security issues.
1128Note that the requirement that read-only users be able to create locks
1129and write the history file still applies.
1130
1131* There is a new administrative file verifymsg which is like editinfo
1132but merely validates the message, rather than also getting it from the
1133user.  It therefore works with client/server CVS or if one uses the -m
1134or -F options to commit.  See the verifymsg section of cvs.texinfo for
1135details.
1136
1137* The %s format formerly accepted in loginfo has been extended to
1138formats such as %{sVv}, so that loginfo scripts have access to the
1139version numbers being changed.  See the Loginfo section of cvs.texinfo
1140for details.
1141
1142* The postscript documentation (doc/cvs.ps) shipped with CVS is now
1143formatted for US letter size instead of A4.  This is not because we
1144consider this size "better" than A4, but because we believe that the
1145US letter version will print better on A4 paper than the other way
1146around.
1147
1148* The "cvs export" command is now logged in the history file and there
1149is a "cvs history -x E" command to select history file entries
1150produced by export.
1151
1152* CVS no longer uses the CVS_PASSWORD environment variable.  Storing
1153passwords in cleartext in an environment variable is a security risk,
1154especially since (on BSD variants) any user on the system can display
1155any process's environment using 'ps'.  Users should use the 'cvs
1156login' command instead.
1157
1158
1159Changes from 1.8 to 1.9:
1160
1161* Windows NT client should now work on Windows 95 as well.
1162
1163* New option "--help-synonyms" prints a list of all recognized command
1164synonyms.
1165
1166* The "log" command is now implemented internally rather than via the
1167RCS "rlog" program.  The main user-visible consequence is that
1168symbolic branch names now work (for example "cvs log -rbranch1").
1169Also, the date formats accepted by -d have changed.  They previously
1170had been a bewildering variety of poorly-documented date formats.  Now
1171they are the same as the date formats accepted by the -D options to
1172the other CVS commands, which is also a (different) bewildering
1173variety of poorly-documented date formats, but at least we are
1174consistently bewildering :-).
1175
1176* Encryption is now supported over a Kerberos client/server
1177connection.  The new "-x" global option requests it.  You must
1178configure with the --enable-encryption option in order to enable
1179encryption.
1180
1181* The format of the CVS commit message has changed slightly when
1182committing changes on a branch.  The tag on which the commit is
1183ocurring is now reported correctly in all cases.
1184
1185* New flag -k in wrappers allows you to specify the keyword expansion
1186mode for added files based on their name.  For example, you can
1187specify that files whose name matches *.exe are binary by default.
1188See the Wrappers section of cvs.texinfo for more details.
1189
1190* Remote CVS with the "-z" option now uses the zlib library (included
1191with CVS) to compress all communication between the client and the
1192server, rather than invoking gzip on each file separately.  This means
1193that compression is better and there is no need for an external gzip
1194program (except to interoperate with older version of CVS).
1195
1196* The "cvs rlog" command is deprecated and running it will print a
1197warning; use the synonymous "cvs log" command instead.  It is
1198confusing for rlog to mean the same as log because some other CVS
1199commands are in pairs consisting of a plain command which operates on
1200a working directory and an "r" command which does not (diff/rdiff;
1201tag/rtag).
1202
1203* "cvs diff" has a bunch of new options, mostly long options.  Most of
1204these work only if rcsdiff and diff support them, and are named the
1205same as the corresponding options to diff.
1206
1207* The -q and -Q command options to "cvs diff" were removed (use the
1208global options instead).  This brings "cvs diff" into line with the
1209rest of the CVS commands.
1210
1211* The "annotate" command can now be used to annotate a revision other
1212than the head revision on the trunk (see the -r, -D, and -f options in
1213the annotate node of cvs.texinfo for details).
1214
1215* The "tag" command has a new option "-c" which checks that all files
1216  are not locally modified before tagging.
1217
1218* The -d command line option now overrides the cvsroot setting stored
1219in the CVS/Root file in each working directory, and specifying -d will
1220cause CVS/Root to be updated.
1221
1222* Local (non-client/server) CVS now runs on Windows NT.  See
1223windows-NT/README for details.
1224
1225* The CVSROOT variable specification has changed to support more
1226access methods.  In addition to "pserver," "server" (internal rsh
1227client), "ext" (external rsh client), "kserver" (kerberos), and
1228"local" (local filesystem access) can now be specified.  For more
1229details on each method, see cvs.texinfo (there is an index entry for
1230:local: and each of the other access methods).
1231
1232* The "login" command no longer prompts the user for username and
1233hostname, since one will have to provide that information via the `-d'
1234flag or by setting CVSROOT.
1235
1236Changes from 1.7 to 1.8:
1237
1238* New "cvs annotate" command to display the last modification for each
1239line of a file, with the revision number, user checking in the
1240modification, and date of the modification.  For more information see
1241the `annotate' node in cvs.texinfo.
1242
1243* The cvsinit shell script has been replaced by a cvs init command.
1244The cvs init command creates some example administrative files which
1245are similar to the files found in the examples directory (and copied
1246by cvsinit) in previous releases.
1247
1248* Added the patterns *.olb *.exe _$* *$ to default ignore list.
1249
1250* There is now a $USER internal variable for *info files.
1251
1252* There is no longer a separate `mkmodules' program; the functionality
1253is now built into `cvs'.  If upgrading an old repository, it is OK to
1254leave in the lines in the modules file which run mkmodules (the
1255mkmodules actions will get done twice, but that is harmless); you will
1256probably want to remove them once you are no longer using the old CVS.
1257
1258* One can now specify user variables in *info files via the
1259${=varname} syntax; there is a -s global option to set them.  See the
1260Variables node in cvs.texinfo for details.
1261
1262Changes from 1.6 to 1.7:
1263
1264* The default ignore list has changed slightly: *.obj has been added
1265and CVS* has been changed to CVS CVS.adm.
1266
1267* CVS now supports password authentication when accessing remote
1268repositories; this is useful for sites that can't use rsh (because of
1269a firewall, for example), and also don't have kerberos.  See node
1270"Password authenticated" (in "Remote repositories", in
1271doc/cvs.texinfo) for more details.  Note: This feature requires both
1272the client and server to be upgraded.
1273
1274* Using the -kb option to specify binary files now works--most cases
1275did not work before.  See the "Binary files" section of
1276doc/cvs.texinfo for details.
1277
1278* New developer communication features.  See the "Watches" section of
1279doc/cvs.texinfo for details.
1280
1281* RCS keyword "Name" supported for "cvs update -r <tag>" and "cvs
1282checkout -r <tag>".
1283
1284* If there is a group whose name matches a compiled in value which
1285defaults to "cvsadmin", only members of that group can use "cvs
1286admin".  This replaces the CVS_NOADMIN option.
1287
1288* CVS now sets the modes of files in the repository based on the
1289CVSUMASK environment variable or a compiled in value defaulting to
1290002.  This way other developers will be able to access the files in
1291the repository regardless of the umask of the developer creating them.
1292
1293* The command names in .cvsrc now match the official name of the
1294command, not the one (possibly an alias) by which it was invoked.  If
1295you had previously relied on "cvs di" and "cvs diff" using different
1296options, instead use a shell function or alias (for example "alias
1297cvsdi='cvs diff -u'").  You also can specify global CVS options (like
1298"-z") using the command name "cvs".
1299
1300Changes from 1.5 to 1.6:
1301
1302* Del updated the man page to include all of the new features
1303of CVS 1.6.
1304
1305* "cvs tag" now supports a "-r | -D" option for tagging an already
1306tagged revision / specific revision of a file.
1307
1308* There is a "taginfo" file in CVSROOT that supports filtering and
1309recording of tag operations.
1310
1311* Long options support added, including --help and --version options.
1312
1313* "cvs release" no longer cares whether or not the directory being
1314released has an entry in the `modules' file.
1315
1316* The modules file now takes a -e option which is used instead of -o
1317for "cvs export".  If your modules file has a -o option which you want
1318to be used for "cvs export", change it to specify -e as well as -o.
1319
1320* "cvs export" now takes a -k option to set RCS keyword expansion.
1321This way you can export binary files.  If you want the old behavior,
1322you need to specify -kv.
1323
1324* "cvs update", "cvs rdiff", "cvs checkout", "cvs import", "cvs
1325release", "cvs rtag", and "cvs tag" used to take -q and -Q options
1326after the command name (e.g. "cvs update -q").  This was confusing
1327because other commands, such as "cvs ci", did not.  So the options
1328after the command name have been removed and you must now specify, for
1329example, "cvs -q update", which has been supported since CVS 1.3.
1330
1331* New "wrappers" feature.  This allows you to set a hook which
1332transforms files on their way in and out of cvs (apparently on the
1333NeXT there is some particular usefulness in tarring things up in the
1334repository).  It also allows you to declare files as merge-by-copy
1335which means that instead of trying to merge the file, CVS will merely
1336copy the new version.  There is a CVSROOT/cvswrappers file and an
1337optionsl ~/.cvswrappers file to support this feature.
1338
1339* You can set CVSROOT to user@host:dir, not just host:dir, if your
1340username on the server host is different than on the client host.
1341
1342* VISUAL is accepted as well as EDITOR.
1343
1344* $CVSROOT is expanded in *info files.
1345
1346Changes from 1.4A2 to 1.5:
1347
1348* Remote implementation.  This is very helpful when collaborating on a
1349project with someone across a wide-area network.  This release can
1350also be used locally, like other CVS versions, if you have no need for
1351remote access.
1352
1353Here are some of the features of the remote implementation:
1354- It uses reliable transport protocols (TCP/IP) for remote repository
1355  access, not NFS.  NFS is unusable over long distances (and sometimes
1356  over short distances)
1357- It transfers only those files that have changed in the repository or
1358  the working directory.  To save transmission time, it will transfer
1359  patches when appropriate, and can compress data for transmission.
1360- The server never holds CVS locks while waiting for a reply from the client;
1361  this makes the system robust when used over flaky networks.
1362
1363The remote features are documented in doc/cvsclient.texi in the CVS
1364distribution, but the main doc file, cvs.texinfo, has not yet been
1365updated to include the remote features.
1366
1367* Death support.  See src/README-rm-add for more information on this.
1368
1369* Many speedups, especially from jtc@cygnus.com.
1370
1371* CVS 1.2 compatibility code has been removed as a speedup.  If you
1372have working directories checked out by CVS 1.2, CVS 1.3 or 1.4A2 will
1373try to convert them, but CVS 1.5 and later will not (if the working
1374directory is up to date and contains no extraneous files, you can just
1375remove it, and then check out a new working directory).  Likewise if
1376your repository contains a CVSROOT.adm directory instead of a CVSROOT
1377directory, you need to rename it.
1378
1379Fri Oct 21 20:58:54 1994  Brian Berliner  <berliner@sun.com>
1380
1381	* Changes between CVS 1.3 and CVS 1.4 Alpha-2
1382
1383	* A new program, "cvsbug", is provided to let you send bug reports
1384	directly to the CVS maintainers.  Please use it instead of sending
1385	mail to the info-cvs mailing list.  If your build fails, you may
1386	have to invoke "cvsbug" directly from the "src" directory as
1387	"src/cvsbug.sh".
1388
1389	* A new User's Guide and Tutorial, written by Per Cederqvist
1390	<ceder@signum.se> of Signum Support.  See the "doc" directory.  A
1391	PostScript version is included as "doc/cvs.ps".
1392
1393	* The Frequesntly Asked Questions file, FAQ, has been added to the
1394	release.  Unfortunately, its contents are likely out-of-date.
1395
1396	* The "cvsinit" shell script is now installed in the $prefix/bin
1397	directory like the other programs.  You can now create new
1398	CVS repositories with great ease.
1399
1400	* Index: lines are now printed on output from 'diff' and 'rdiff',
1401	in order to facilitate application of patches to multiple subdirs.
1402
1403	* Support for a ~/.cvsrc file, which allows you to specify options
1404	that are always supposed to be given to a specific command.  This
1405	feature shows the non-orthogonality of the option set, since while
1406	there may be an option to turn something on, the option to turn
1407	that same thing off may not exist.
1408
1409	* You can now list subdirectories that you wish to ignore in a
1410	modules listing, such as:
1411
1412		gcc  -a gnu/gcc, !gnu/gcc/testsuites
1413
1414	which will check out everything underneath gnu/gcc, except
1415	everything underneath gnu/gcc/testsuites.
1416
1417	* It is now much harder to accidentally overwrite an existing tag
1418	name, since attempting to move a tag name will result in a error,
1419	unless the -F (force) flag is given to the tag subcommands.
1420
1421	* Better error checking on matching of the repository used to
1422	check code out from against the repository the current cvs
1423	commnands would use. (Thanks to Mark Baushke <mdb@cisco.com>)
1424
1425	* Better support for sites with multiple CVSROOT repositories has
1426	been contributed.  The file "CVS/Root" in your working directory
1427	is created to hold the full path to the CVS repository and a
1428	simple check is made against your current CVSROOT setting.
1429
1430	* You can now specify an RCS keyword substitution value when you
1431	import files into the repository.
1432
1433	* Uses a much newer version of Autoconf, and conforms to the GNU
1434	coding standards much more closely.  No, it still doesn't have
1435	long option names.
1436
1437	* Code cleanup.  Many passes through gcc -Wall helped to identify
1438	a number of questionable constructs.  Most arbitrary length limits
1439	were removed.
1440
1441	* Profiling to determine bottlenecks helped to identify the best
1442	places to spend time speeding up the code, which was then done.  A
1443	number of performance enhancements in filename matching have sped
1444	up checkouts.
1445
1446	* Many more contributions have been added to the "contrib"
1447	directory.  See the README file in that directory for more
1448	information.
1449
1450	* "cvs commit" will try harder to not change the file's
1451	modification time after the commit.  If the file does not change
1452	as a result of the commit operation, CVS will preserve the
1453	original modification time, thus speeding up future make-type
1454	builds.
1455
1456	* "cvs commit" now includes any removed files in the (optional)
1457	pre-commit checking program that may be invoked.  Previously, only
1458	added and modified files were included.
1459
1460	* It is now possible to commit a file directly onto the trunk at a
1461	specific revision level by doing "cvs commit -r3.0 file.c", where
1462	"3.0" specifies the revision you wish to create.  The file must be
1463	up-to-date with the current head of the trunk for this to succeed.
1464
1465	* "cvs commit" will now function with a pre-commit program that
1466	has arguments specified in the "commitinfo" file.
1467
1468	* The "mkmodules" program will now look within the
1469	$CVSROOT/CVSROOT/checkoutlist" file for any additional files that
1470	should be automatically checked out within CVSROOT; mkmodules also
1471	tries harder to preserve any execute bits the files may have
1472	originally had.
1473
1474	* "cvs diff" is much more accurate about its exit status now.  It
1475	now returns the maximum exit status of any invoked diff.
1476
1477	* The "-I !" option is now supported for the import and update
1478	commands correctly.  It will properly clear the ignore list now.
1479
1480	* Some problems with "cvs import" handling of .cvsignore have been
1481	fixed; as well, some rampant recursion problems with import have
1482	also been fixed.
1483
1484	* "cvs rdiff" (aka "cvs patch") now tries to set the modify time
1485	of any temporary files it uses to match those specified for the
1486	particular revision.  This allows a more accurate patch image to
1487	be created.
1488
1489	* "cvs status" has improved revision descriptions.  "Working
1490	revision" is used for the revision of the working file that you
1491	edit directly; "Repository revision" is the revision of the file
1492	with the $CVSROOT source repository.  Also, the output is clearer
1493	with regard to sticky and branch revisions.
1494
1495	* CVS no longer dumps core when given a mixture of directories and
1496	files in sub-directories (as in "cvs ci file1 dir1/file2").
1497	Instead, arguments are now clumped into their respective directory
1498	and operated on in chunks, together.
1499
1500	* If the CVSEDITOR environment variable is set, that editor is
1501	used for log messages instead of the EDITOR environment variable.
1502	This makes it easy to substitute intelligent programs to make more
1503	elaborate log messages.  Contributed by Mark D Baushke
1504	(mdb@cisco.com).
1505
1506	* Command argument changes:
1507	cvs:			The "-f" option has been added to ignore
1508				the ~/.cvsrc file.
1509	commit:			Renamed the "-f logfile" option to the
1510				"-F logfile" option.  Added the "-f"
1511				option to force a commit of the specified
1512				files (this disables recursion).
1513	history:		Added "-t timezone" option to force any
1514				date-specific output into the specified
1515				timezone.
1516	import:			Added "-d" option to use the file's
1517				modification time as the time of the
1518				import. Added "-k sub" option to set the
1519				default RCS keyword substitution mode for
1520				newly-created files.
1521	remove:			Added "-f" option to force the file's
1522				automatic removal if it still exists in
1523				the working directory (use with caution).
1524	rtag:			Added "-F" option to move the tag if it
1525				already exists -- new default is to NOT
1526				move tags automatically.
1527	tag:			Added "-F" option to move the tag if it
1528				already exists -- new default is to NOT
1529				move tags automatically.
1530
1531Tue Apr  7 15:55:25 1992  Brian Berliner  (berliner at sun.com)
1532
1533	* Changes between CVS 1.3 Beta-3 and official CVS 1.3!
1534
1535	* A new shell script is provided, "./cvsinit", which can be run at
1536	install time to help setup your $CVSROOT area.  This can greatly
1537	ease your entry into CVS usage.
1538
1539	* The INSTALL file has been updated to include the machines on
1540	which CVS has compiled successfully.  I think CVS 1.3 is finally
1541	portable.  Thanks to all the Beta testers!
1542
1543	* Support for the "editinfo" file was contributed.  This file
1544	(located in $CVSROOT/CVSROOT) can be used to specify a special
1545	"editor" to run on a per-directory basis within the repository,
1546	instead of the usual user's editor.  As such, it can verify that
1547	the log message entered by the user is of the appropriate form
1548	(contains a bugid and test validation, for example).
1549
1550	* The manual pages cvs(1) and cvs(5) have been updated.
1551
1552	* The "mkmodules" command now informs you when your modules file
1553	has duplicate entries.
1554
1555	* The "add" command now preserves any per-directory sticky tag when
1556	you add a new directory to your checked-out sources.
1557
1558	* The "admin" command is now a fully recursive interface to the
1559	"rcs" program which operates on your checked-out sources.  It no
1560	longer requires you to specify the full path to the RCS file.
1561
1562	* The per-file sticky tags can now be effectively removed with
1563	"cvs update -A file", even if you had checked out the whole
1564	directory with a per-directory sticky tag.  This allows a great
1565	deal of flexibility in managing the revisions that your checked-out
1566	sources are based upon (both per-directory and per-file sticky
1567	tags).
1568
1569	* The "cvs -n commit" command now works, to show which files are
1570	out-of-date and will cause the real commit to fail, or which files
1571	will fail any pre-commit checks.  Also, the "cvs -n import ..."
1572	command will now show you what it would've done without actually
1573	doing it.
1574
1575	* Doing "cvs commit modules" to checkin the modules file will no
1576	properly run the "mkmodules" program (assuming you have setup your
1577	$CVSROOT/CVSROOT/modules file to do so).
1578
1579	* The -t option in the modules file (which specifies a program to
1580	run when you do a "cvs rtag" operation on a module) now gets the
1581	symbolic tag as the second argument when invoked.
1582
1583	* When the source repository is locked by another user, that user's
1584	login name will be displayed as the holder of the lock.
1585
1586	* Doing "cvs checkout module/file.c" now works even if
1587	module/file.c is in the Attic (has been removed from main-line
1588	development).
1589
1590	* Doing "cvs commit */Makefile" now works as one would expect.
1591	Rather than trying to commit everything recursively, it will now
1592	commit just the files specified.
1593
1594	* The "cvs remove" command is now fully recursive.  To schedule a
1595	file for removal, all you have to do is "rm file" and "cvs rm".
1596	With no arguments, "cvs rm" will schedule all files that have been
1597	physically removed for removal from the source repository at the
1598	next "cvs commit".
1599
1600	* The "cvs tag" command now prints "T file" for each file that was
1601	tagged by this invocation and "D file" for each file that had the
1602	tag removed (as with "cvs tag -d").
1603
1604	* The -a option has been added to "cvs rtag" to force it to clean
1605	up any old, matching tags for files that have been removed (in the
1606	Attic) that may not have been touched by this tag operation.  This
1607	can help keep a consistent view with your tag, even if you re-use
1608	it frequently.
1609
1610Sat Feb 29 16:02:05 1992  Brian Berliner  (berliner at sun.com)
1611
1612	* Changes between CVS 1.3 Beta-2 and CVS 1.3 Beta-3
1613
1614	* Many portability fixes, thanks to all the Beta testers!  With any
1615	luck, this Beta release will compile correctly on most anything.
1616	Hey, what are we without our dreams.
1617
1618	* CVS finally has support for doing isolated development on a
1619	branch off the current (or previous!) revisions.  This is also
1620	extremely nice for generating patches for previously released
1621	software while development is progressing on the next release.
1622	Here's an example of creating a branch to fix a patch with the 2.0
1623	version of the "foo" module, even though we are already well into
1624	the 3.0 release.  Do:
1625
1626		% cvs rtag -b -rFOO_2_0 FOO_2_0_Patch foo
1627		% cvs checkout -rFOO_2_0_Patch foo
1628		% cd foo
1629		[[ hack away ]]
1630		% cvs commit
1631
1632	A physical branch will be created in the RCS file only when you
1633	actually commit the change.  As such, forking development at some
1634	random point in time is extremely light-weight -- requiring just a
1635	symbolic tag in each file until a commit is done.  To fork
1636	development at the currently checked out sources, do:
1637
1638		% cvs tag -b Personal_Hack
1639		% cvs update -rPersonal_Hack
1640		[[ hack away ]]
1641		% cvs commit
1642
1643	Now, if you decide you want the changes made in the Personal_Hack
1644	branch to be merged in with other changes made in the main-line
1645	development, you could do:
1646
1647		% cvs commit		     # to make Personal_Hack complete
1648		% cvs update -A		     # to update sources to main-line
1649		% cvs update -jPersonal_Hack # to merge Personal_Hack
1650
1651	to update your checked-out sources, or:
1652
1653		% cvs checkout -jPersonal_Hack module
1654
1655	to checkout a fresh copy.
1656
1657	To support this notion of forked development, CVS reserves
1658	all even-numbered branches for its own use.  In addition, CVS
1659	reserves the ".0" and ".1" branches.  So, if you intend to do your
1660	own branches by hand with RCS, you should use odd-numbered branches
1661	starting with ".3", as in "1.1.3", "1.1.5", 1.2.9", ....
1662
1663	* The "cvs commit" command now supports a fully functional -r
1664	option, allowing you to commit your changes to a specific numeric
1665	revision or symbolic tag with full consistency checks.  Numeric
1666	tags are useful for bringing your sources all up to some revision
1667	level:
1668
1669		% cvs commit -r2.0
1670
1671	For symbolic tags, you can only commit to a tag that references a
1672	branch in the RCS file.  One created by "cvs rtag -b" or from
1673	"cvs tag -b" is appropriate (see below).
1674
1675	* Roland Pesch <pesch@cygnus.com> and K. Richard Pixley
1676	<rich@cygnus.com> were kind enough to contribute two new manual
1677	pages for CVS: cvs(1) and cvs(5).  Most of the new CVS 1.3 features
1678	are now documented, with the exception of the new branch support
1679	added to commit/rtag/tag/checkout/update.
1680
1681	* The -j options of checkout/update have been added.  The "cvs join"
1682	command has been removed.
1683
1684	With one -j option, CVS will merge the changes made between the
1685	resulting revision and the revision that it is based on (e.g., if
1686	the tag refers to a branch, CVS will merge all changes made in
1687	that branch into your working file).
1688
1689	With two -j options, CVS will merge in the changes between the two
1690	respective revisions.  This can be used to "remove" a certain delta
1691	from your working file.  E.g., If the file foo.c is based on
1692	revision 1.6 and I want to remove the changes made between 1.3 and
1693	1.5, I might do:
1694
1695		% cvs update -j1.5 -j1.3 foo.c		# note the order...
1696
1697	In addition, each -j option can contain on optional date
1698	specification which, when used with branches, can limit the chosen
1699	revision to one within a specific date.  An optional date is
1700	specified by adding a colon (:) to the tag, as in:
1701
1702		-jSymbolic_Tag:Date_Specifier
1703
1704	An example might be what "cvs import" tells you to do when you have
1705	just imported sources that have conflicts with local changes:
1706
1707		% cvs checkout -jTAG:yesterday -jTAG module
1708
1709	which tells CVS to merge in the changes made to the branch
1710	specified by TAG in the last 24 hours.  If this is not what is
1711	intended, substitute "yesterday" for whatever format of date that
1712	is appropriate, like:
1713
1714		% cvs checkout -jTAG:'1 week ago' -jTAG module
1715
1716	* "cvs diff" now supports the special tags "BASE" and "HEAD".  So,
1717	the command:
1718
1719		% cvs diff -u -rBASE -rHEAD
1720
1721	will effectively show the changes made by others (in unidiff
1722	format) that will be merged into your working sources with your
1723	next "cvs update" command.  "-rBASE" resolves to the revision that
1724	your working file is based on.  "-rHEAD" resolves to the current
1725	head of the branch or trunk that you are working on.
1726
1727	* The -P option of "cvs checkout" now means to Prune empty
1728	directories, as with "update".  The default is to not remove empty
1729	directories.  However, if you do "checkout" with any -r options, -P
1730	will be implied.  I.e., checking out with a tag will cause empty
1731	directories to be pruned automatically.
1732
1733	* The new file INSTALL describes how to install CVS, including
1734	detailed descriptions of interfaces to "configure".
1735
1736	* The example loginfo file in examples/loginfo has been updated to
1737	use the perl script included in contrib/log.pl.  The nice thing
1738	about this log program is that it records the revision numbers of
1739	your change in the log message.
1740
1741	Example files for commitinfo and rcsinfo are now included in the
1742	examples directory.
1743
1744	* All "#if defined(__STDC__) && __STDC__ == 1" lines have been
1745	changed to be "#if __STDC__" to fix some problems with the former.
1746
1747	* The lib/regex.[ch] files have been updated to the 1.3 release of
1748	the GNU regex package.
1749
1750	* The ndbm emulation routines included with CVS 1.3 Beta-2 in the
1751	src/ndbm.[ch] files has been moved into the src/myndbm.[ch] files
1752	to avoid any conflict with the system <ndbm.h> header file.  If
1753	you had a previous CVS 1.3 Beta release, you will want to "cvs
1754	remove ndbm.[ch]" form your copy of CVS as well.
1755
1756	* "cvs add" and "cvs remove" are a bit more verbose, telling you
1757	what to do to add/remove your file permanently.
1758
1759	* We no longer mess with /dev/tty in "commit" and "add".
1760
1761	* More things are quiet with the -Q option set.
1762
1763	* New src/config.h option:  If CVS_BADROOT is set, CVS will not
1764	allow people really logged in as "root" to commit changes.
1765
1766	* "cvs diff" exits with a status of 0 if there were no diffs, 1 if
1767	there were diffs, and 2 if there were errors.
1768
1769	* "cvs -n diff" is now supported so that you can still run diffs
1770	even while in the middle of committing files.
1771
1772	* Handling of the CVS/Entries file is now much more robust.
1773
1774	* The default file ignore list now includes "*.so".
1775
1776	* "cvs import" did not expand '@' in the log message correctly.  It
1777	does now.  Also, import now uses the ignore file facility
1778	correctly.
1779
1780	Import will now tell you whether there were conflicts that need to
1781	be resolved, and how to resolve them.
1782
1783	* "cvs log" has been changed so that you can "log" things that are
1784	not a part of the current release (in the Attic).
1785
1786	* If you don't change the editor message on commit, CVS now prompts
1787	you with the choice:
1788
1789		!)reuse this message unchanged for remaining dirs
1790
1791	which allows you to tell CVS that you have no intention of changing
1792	the log message for the remainder of the commit.
1793
1794	* It is no longer necessary to have CVSROOT set if you are using
1795	the -H option to get Usage information on the commands.
1796
1797	* Command argument changes:
1798	checkout:		-P handling changed as described above.
1799				New -j option (up to 2 can be specified)
1800				for doing rcsmerge kind of things on
1801				checkout.
1802	commit:			-r option now supports committing to a
1803				numeric or symbolic tags, with some
1804				restrictions.  Full consistency checks will
1805				be done.
1806				Added "-f logfile" option, which tells
1807				commit to glean the log message from the
1808				specified file, rather than invoking the
1809				editor.
1810	rtag:			Added -b option to create a branch tag,
1811				useful for creating a patch for a previous
1812				release, or for forking development.
1813	tag:			Added -b option to create a branch tag,
1814				useful for creating a patch for a previous
1815				release, or for forking development.
1816	update:			New -j option (up to 2 can be specified)
1817				for doing rcsmerge kind of things on
1818				update.
1819
1820Thu Jan  9 10:51:35 MST 1992 Jeff Polk (polk at BSDI.COM)
1821
1822	* Changes between CVS 1.3 Beta-1 and CVS 1.3 Beta-2
1823
1824	* Thanks to K. Richard Pixley at Cygnus we now have function
1825	prototypes in all the files
1826
1827	* Some small changes to configure for portability.  There have
1828	been other portability problems submitted that have not been fixed
1829	(Brian will be working on those).  Additionally all __STDC__
1830	tests have been modified to check __STDC__ against the constant 1
1831	(this is what the Second edition of K&R says must be true).
1832
1833	* Lots of additional error checking for forked processes (run_exec)
1834	(thanks again to K. Richard Pixley)
1835
1836	* Lots of miscellaneous bug fixes - including but certainly not
1837	limited to:
1838		various commit core dumps
1839		various update core dumps
1840		bogus results from status with numeric sticky tags
1841		commitprog used freed memory
1842		Entries file corruption caused by No_Difference
1843		commit to revision broken (now works if branch exists)
1844		ignore file processing broken for * and !
1845		ignore processing didn't handle memory reasonably
1846		miscellaneous bugs in the recursion processor
1847		file descriptor leak in ParseInfo
1848		CVSROOT.adm->CVSROOT rename bug
1849		lots of lint fixes
1850
1851	* Reformatted all the code in src (with GNU indent) and then
1852	went back and fixed prototypes, etc since indent gets confused.  The
1853	rationale is that it is better to do it sooner than later and now
1854	everything is consistent and will hopefully stay that way.
1855	The basic options to indent were: "-bad -bbb -bap -cdb -d0 -bl -bli0
1856	-nce -pcs -cs -cli4 -di1 -nbc -psl -lp -i4 -ip4 -c41"  and then
1857	miscellaneous formatting fixes were applied.  Note also that the
1858	"-nfc1" or "-nfca" may be appropriate in files where comments have
1859	been carefully formatted (e.g, modules.c).
1860
1861Sat Dec 14 20:35:22 1991  Brian Berliner  (berliner at sun.com)
1862
1863	* Changes between CVS 1.2 and CVS 1.3 Beta are described here.
1864
1865	* Lots of portability work.  CVS now uses the GNU "configure"
1866	script to dynamically determine the features provided by your
1867	system.  It probably is not foolproof, but it is better than
1868	nothing.  Please let me know of any portability problems.  Some
1869	file names were changed to fit within 14-characters.
1870
1871	* CVS has a new RCS parser that is much more flexible and
1872	extensible.  It should read all known RCS ",v" format files.
1873
1874	* Most of the commands now are fully recursive, rather than just
1875	operating on the current directory alone.  This includes "commit",
1876	which makes it real easy to do an "atomic" commit of all the
1877	changes made to a CVS hierarchy of sources.  Most of the commands
1878	also correctly handle file names that are in directories other than
1879	".", including absolute path names.  Commands now accept the "-R"
1880	option to force recursion on (though it is always the default now)
1881	and the "-l" option to force recursion off, doing just "." and not
1882	any sub-directories.
1883
1884	* CVS supports many of the features provided with the RCS 5.x
1885	distribution - including the new "-k" keyword expansion options.  I
1886	recommend using RCS 5.x (5.6 is the current official RCS version)
1887	and GNU diff 1.15 (or later) distributions with CVS.
1888
1889	* Checking out files with symbolic tags/dates is now "sticky", in
1890	that CVS remembers the tag/date used for each file (and directory)
1891	and will use that tag/date automatically on the next "update" call.
1892	This stickyness also holds for files checked out with the the new
1893	RCS 5.x "-k" options.
1894
1895	* The "cvs diff" command now recognizes all of the rcsdiff 5.x
1896	options.  Unidiff format is available by installing the GNU
1897	diff 1.15 distribution.
1898
1899	* The old "CVS.adm" directories created on checkout are now called
1900	"CVS" directories, to look more like "RCS" and "SCCS".  Old CVS.adm
1901	directories are automagically converted to CVS directories.  The
1902	old "CVSROOT.adm" directory within the source repository is
1903	automagically changed into a "CVSROOT" directory as well.
1904
1905	* Symbolic links in the source repository are fully supported ONLY
1906	if you use RCS 5.6 or later and (of course) your system supports
1907	symlinks.
1908
1909	* A history database has been contributed which maintains the
1910	history of certain CVS operations, as well as providing a wide array
1911	of querying options.
1912
1913	* The "cvs" program has a "-n" option which can be used with the
1914	"update" command to show what would be updated without actually
1915	doing the update, like:  "cvs -n update".  All usage statements
1916	have been cleaned up and made more verbose.
1917
1918	* The module database parsing has been rewritten.  The new format
1919	is compatible with the old format, but with much more
1920	functionality.  It allows modules to be created that grab pieces or
1921	whole directories from various different parts of your source
1922	repository.  Module-relative specifications are also correctly
1923	recognized now, like "cvs checkout module/file.c".
1924
1925	* A configurable template can be specified such that on a "commit",
1926	certain directories can supply a template that the user must fill
1927	before completing the commit operation.
1928
1929	* A configurable pre-commit checking program can be specified which
1930	will run to verify that a "commit" can happen.  This feature can be
1931	used to restrict certain users from changing certain pieces of the
1932	source repository, or denying commits to the entire source
1933	repository.
1934
1935	* The new "cvs export" command is much like "checkout", but
1936	establishes defaults suitable for exporting code to others (expands
1937	out keywords, forces the use of a symbolic tag, and does not create
1938	"CVS" directories within the checked out sources.
1939
1940	* The new "cvs import" command replaces the deprecated "checkin"
1941	shell script and is used to import sources into CVS control.  It is
1942	also much faster for the first-time import.  Some algorithmic
1943	improvements have also been made to reduce the number of
1944	conflicting files on next-time imports.
1945
1946	* The new "cvs admin" command is basically an interface to the
1947	"rcs" program.  (Not yet implemented very well).
1948
1949	* Signal handling (on systems with BSD or POSIX signals) is much
1950	improved.  Interrupting CVS now works with a single interrupt!
1951
1952	* CVS now invokes RCS commands by direct fork/exec rather than
1953	calling system(3).  This improves performance by removing a call to
1954	the shell to parse the arguments.
1955
1956	* Support for the .cvsignore file has been contributed.  CVS will
1957	now show "unknown" files as "? filename" as the result of an "update"
1958	command.  The .cvsignore file can be used to add files to the
1959	current list of ignored files so that they won't show up as unknown.
1960
1961	* Command argument changes:
1962	cvs:		Added -l to turn off history logging.
1963			Added -n to show what would be done without actually
1964			doing anything.
1965			Added -q/-Q for quiet and really quiet settings.
1966			Added -t to show debugging trace.
1967	add:		Added -k to allow RCS 5.x -k options to be specified.
1968	admin:		New command; an interface to rcs(1).
1969	checkout:	Added -A to reset sticky tags/date/options.
1970			Added -N to not shorten module paths.
1971			Added -R option to force recursion.
1972			Changed -p (prune empty directories) to -P option.
1973			Changed -f option; forcing tags match is now default.
1974			Added -p option to checkout module to standard output.
1975			Added -s option to cat the modules db with status.
1976			Added -d option to checkout in the specified directory.
1977			Added -k option to use RCS 5.x -k support.
1978	commit:		Removed -a option; use -l instead.
1979			Removed -f option.
1980			Added -l option to disable recursion.
1981			Added -R option to force recursion.
1982			If no files specified, commit is recursive.
1983	diff:		Now recognizes all RCS 5.x rcsdiff options.
1984			Added -l option to disable recursion.
1985			Added -R option to force recursion.
1986	history:	New command; displays info about CVS usage.
1987	import:		Replaces "checkin" shell script; imports sources
1988			under CVS control.  Ignores files on the ignore
1989			list (see -I option or .cvsignore description above).
1990	export:		New command; like "checkout", but w/special options
1991			turned on by default to facilitate exporting sources.
1992	join:		Added -B option to join from base of the branch;
1993			join now defaults to only joining with the top two
1994			revisions on the branch.
1995			Added -k option for RCS 5.x -k support.
1996	log:		Supports all RCS 5.x options.
1997			Added -l option to disable recursion.
1998			Added -R option to force recursion.
1999	patch:		Changed -f option; forcing tags match is now default.
2000			Added -c option to force context-style diffs.
2001			Added -u option to support unidiff-style diffs.
2002			Added -V option to support RCS specific-version
2003			keyword expansion formats.
2004			Added -R option to force recursion.
2005	remove:		No option changes.  It's a bit more verbose.
2006	rtag:		Equivalent to the old "cvs tag" command.
2007			No option changes.  It's a lot faster for re-tag.
2008	status:		New output formats with more information.
2009			Added -l option to disable recursion.
2010			Added -R option to force recursion.
2011			Added -v option to show symbolic tags for files.
2012	tag:		Functionality changed to tag checked out files
2013			rather than modules; use "rtag" command to get the
2014			old "cvs tag" behaviour.
2015	update:		Added -A to reset sticky tags/date/options.
2016			Changed -p (prune empty directories) to -P option.
2017			Changed -f option; forcing tags match is now default.
2018			Added -p option to checkout module to standard output.
2019			Added -I option to add files to the ignore list.
2020			Added -R option to force recursion.
2021
2022	Major Contributors:
2023
2024	* Jeff Polk <polk@bsdi.com> rewrote most of the grody code of CVS
2025	1.2.  He made just about everything dynamic (by using malloc),
2026	added a generic hashed list manager, re-wrote the modules database
2027	parsing in a compatible - but extended way, generalized directory
2028	hierarchy recursion for virtually all the commands (including
2029	commit!), generalized the loginfo file to be used for pre-commit
2030	checks and commit templates, wrote a new and flexible RCS parser,
2031	fixed an uncountable number of bugs, and helped in the design of
2032	future CVS features.  If there's anything gross left in CVS, it's
2033	probably my fault!
2034
2035	* David G. Grubbs <dgg@odi.com> contributed the CVS "history" and
2036	"release" commands.  As well as the ever-so-useful "-n" option of
2037	CVS which tells CVS to show what it would do, without actually
2038	doing it.  He also contributed support for the .cvsignore file.
2039
2040	* Paul Sander, HaL Computer Systems, Inc. <paul@hal.com> wrote and
2041	contributed the code in lib/sighandle.c.  I added support for
2042	POSIX, BSD, and non-POSIX/non-BSD systems.
2043
2044	* Free Software Foundation contributed the "configure" script and
2045	other compatibility support in the "lib" directory, which will help
2046	make CVS much more portable.
2047
2048	* Many others have contributed bug reports and enhancement requests.
2049	Some have even submitted actual code which I have not had time yet
2050	to integrate into CVS.  Maybe for the next release.
2051
2052	* Thanks to you all!
2053
2054Wed Feb  6 10:10:58 1991  Brian Berliner  (berliner at sun.com)
2055
2056	* Changes from CVS 1.0 Patchlevel 1 to CVS 1.0 Patchlevel 2; also
2057	known as "Changes from CVS 1.1 to CVS 1.2".
2058
2059	* Major new support with this release is the ability to use the
2060	recently-posted RCS 5.5 distribution with CVS 1.2.  See below for
2061	other assorted bug-fixes that have been thrown in.
2062
2063	* ChangeLog (new): Added Emacs-style change-log file to CVS 1.2
2064	release.  Chronological description of changes between release.
2065
2066	* README: Small fixes to installation instructions.  My email
2067	address is now "berliner@sun.com".
2068
2069	* src/Makefile: Removed "rcstime.h".  Removed "depend" rule.
2070
2071	* src/partime.c:  Updated to RCS 5.5 version with hooks for CVS.
2072	* src/maketime.c: Updated to RCS 5.5 version with hooks for CVS.
2073	* src/rcstime.h:  Removed from the CVS 1.2 distribution.
2074	Thanks to Paul Eggert <eggert@twinsun.com> for these changes.
2075
2076	* src/checkin.csh: Support for RCS 5.5 parsing.
2077	Thanks to Paul Eggert <eggert@twinsun.com> for this change.
2078
2079	* src/collect_sets.c (Collect_Sets): Be quieter if "-f" option is
2080	specified.  When checking out files on-top-of other files that CVS
2081	doesn't know about, run a diff in the hopes that they are really
2082	the same file before aborting.
2083
2084	* src/commit.c (branch_number): Fix for RCS 5.5 parsing.
2085	Thanks to Paul Eggert <eggert@twinsun.com> for this change.
2086
2087	* src/commit.c (do_editor): Bug fix - fprintf missing argument
2088	which sometimes caused core dumps.
2089
2090	* src/modules.c (process_module): Properly NULL-terminate
2091	update_dir[] in all cases.
2092
2093	* src/no_difference.c (No_Difference): The wrong RCS revision was
2094	being registered in certain (strange) cases.
2095
2096	* src/patch.c (get_rcsdate): New algorithm.  No need to call
2097	maketime() any longer.
2098	Thanks to Paul Eggert <eggert@twinsun.com> for this change.
2099
2100	* src/patchlevel.h: Increased patch level to "2".
2101
2102	* src/subr.c (isdir, islink): Changed to compare stat mode bits
2103	correctly.
2104
2105	* src/tag.c (tag_file): Added support for following symbolic links
2106	that are in the master source repository when tagging.  Made tag
2107	somewhat quieter in certain cases.
2108
2109	* src/update.c (update_process_lists): Unlink the user's file if it
2110	was put on the Wlist, meaning that the user's file is not modified
2111	and its RCS file has been removed by someone else.
2112
2113	* src/update.c (update): Support for "cvs update dir" to correctly
2114	just update the argument directory "dir".
2115
2116	* src/cvs.h: Fixes for RCS 5.5 parsing.
2117	* src/version_number.c (Version_Number): Fixes for parsing RCS 5.5
2118	and older RCS-format files.
2119	Thanks to Paul Eggert <eggert@twinsun.com> for these changes.
2120
2121	* src/version_number.c (Version_Number): Bug fixes for "-f" option.
2122	Bug fixes for parsing with certain branch numbers.  RCS
2123	revision/symbol parsing is much more solid now.
2124
2125Wed Feb 14 10:01:33 1990  Brian Berliner  (berliner at sun.com)
2126
2127	* Changes from CVS 1.0 Patchlevel 0 to CVS 1.0 Patchlevel 1; also
2128	known as "Changes from CVS 1.0 to CVS 1.1".
2129
2130	* src/patch.c (get_rcsdate): Portability fix.  Replaced call to
2131	timelocal() with call to maketime().
2132
2133Mon Nov 19 23:15:11 1990  Brian Berliner  (berliner at prisma.com)
2134
2135	* Sent CVS 1.0 release to comp.sources.unix moderator and FSF.
2136
2137	* Special thanks to Dick Grune <dick@cs.vu.nl> for his work on the
2138	1986 version of CVS and making it available to the world.  Dick's
2139	version is available on uunet.uu.net in the
2140	comp.sources.unix/volume6/cvs directory.
2141