NewsCache 1.3.20

Upgrading: with Options ssl or starttls, NewsCache now verifies the server's
TLS certificate and drops the connection if it is invalid, expired or for
another name, or if STARTTLS is refused. Check the log after upgrading. For a
server with a private CA set TLSCAFile; Options noverify accepts any
certificate, without protection against a man-in-the-middle.

Bug fixes

• TLS to upstream servers (Options ssl and starttls) now verifies the
  server's certificate: it must chain to a trusted CA, be valid and match the
  host name in the Server line. Before, any certificate was accepted, so
  anyone in the middle could impersonate the server.
• STARTTLS no longer falls back to plain text. If the server refused
  STARTTLS, NewsCache continued without TLS and sent User/Password in plain
  text, which anyone in the middle could force; now the connection is
  dropped. A failed TLS handshake after STARTTLS also ends the connection.
• A NewsCache built without GnuTLS ignored Options ssl and starttls and
  talked to such a server in plain text, login included. It now refuses to
  connect to it and logs why.
• TLS uses the system's trust store (it was a fixed Debian path, missing on
  Fedora and macOS), sends the host name as SNI, has a handshake timeout and
  logs why a handshake or verification failed.
• newscache -p left the server options ssl, starttls and dontgenmsgid out of
  its output, although they were parsed and used.

Other changes

• New server settings: TLSCAFile (CA certificates for servers with a
  private CA) and Options noverify (accept any certificate, logged as a
  warning). The man page now documents ssl and starttls, and the sample
  config no longer lists not-ssl and not-starttls, which never existed.
• Bug reports and the home page point to
  https://github.com/go-while/NewsCache instead of the dead members.aon.at,
  linuxhacker.at and TU Wien sites and mailing lists: in the error messages
  that ask for a report, the man pages, README, INSTALL (whose socket++
  instructions were obsolete), the texinfo manual, doc/ and debian/.
• NVClasses: NVlist.{h,cc} is now NVListBase.{h,cc} (class NVListBase).
  NVlist.h and NVList.h clashed on case-insensitive file systems, so
  checkouts on Windows and macOS were broken. The spool format is unchanged.
• src/Config.{h,cc} is now src/NewsCacheConfig.{h,cc} (the class is still
  Config). On case-insensitive file systems, #include "config.h" in src/
  found src/Config.h instead of the header that configure generates.
• NewsCache builds on macOS: configure checks for crypt.h (macOS and the
  BSDs declare crypt() in unistd.h), and wildmat.c no longer uses a K&R
  function definition, which C23 compilers such as Xcode's clang reject.
• CI: build and make check on macOS, and a check on Windows and macOS that
  the tree checks out cleanly on a case-insensitive file system.
• The sample newscache.conf-dist and FEDORA.md use news.blueworldhosting.com
  (port 563, TLS) instead of the long-gone TU Wien servers, and README.md
  lists public news servers.
• FEDORA.md: all steps tested on Fedora 43, 44 and 45.
• Removed stamp-h.in (an automake leftover) and the TODO file from 2013;
  its still-open items are in REVIEW.md.

Build

tar xzf NewsCache-1.3.20.tar.gz && cd NewsCache-1.3.20
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make && make check && sudo make install

Tested on Ubuntu 24.04 (g++ 13.3) and Fedora 43, 44 and 45 (g++ 15.3/16.2, Fedora's rpm flags); CI also builds and tests on macOS. See README.md and FEDORA.md.

SHA-256: 113f1bffee6dfc2d6a12b56689c35007fa57bf3b9f75379abb1b2f293dfdc8ac