net-misc/tor-1.0.22 stable request - works fine on x86 w/ gcc-4.1+glibc-2.4 for some time - no bugs-in-zilla
I think you refer to 0.1.22, not 1.0.22. 0.1.22 has a security problem, I'll fill a new security issue right away.
tor-0.1.1.24 has a serious bug in it which is the primary reason for the release of version tor-0.1.1.26. (The summary of this bug, net-misc/tor-0.1.22, is way old, but I don't have permission to change it). Please bump Tor to tor-0.1.1.26 as the latest stable version in portage. Also, please consider using the *-alpha branch of Tor for the "masked" versions of this package.
There's no 0.1.22 in the tree. 05 Sep 2006; Gustavo Felisberto <humpback@gentoo.org>; -files/torrc.sample-0.1.0.14.patch, -tor-0.1.0.14-r1.ebuild, -tor-0.1.0.16.ebuild, -tor-0.1.0.17.ebuild, -tor-0.1.1.20.ebuild, -tor-0.1.1.22.ebuild: Removed older version that had sec issues.
Thanks for removing the very old versions. However, every version prior to 0.1.1.26 has "a serious privacy bug for people who use the HttpProxyAuthenticator config option: Tor would send your proxy auth directly to the directory server when you're tunnelling directory requests through Tor. Specifically, this happens when publishing or accessing hidden services, or when you have set FascistFirewall or ReachableAddresses and you're accessing a directory server that's not reachable directly.". Both tor-0.1.1.23 (latest unmasked) and tor-0.1.1.24 (latest masked) have this bug, which is why I highly recommend making tor-0.1.1.26 the default (latest unmasked) version in portage. I recommend -tor-0.1.0.18.ebuild -tor-0.1.1.23.ebuild -tor-0.1.1.24.ebuild and +tor-0.1.1.26.ebuild, rename the patch file, rename the build and change the patch file line, and done. I realize 0.1.1.26 is "new" and perhaps shouldn't be considered stable, but only very safe things from Tor's alpha branch are backported into the stable tree and it's quite safe to make 0.1.1.26 the latest version - especially because every prior version makes users who use the HttpProxyAuthenticator config option think they are getting privacy when they in reality are not.
