GNATS 4.1.0, March 2005
==========================

This is GNATS 4.1.0, a release that incorporates multiple bug fixes
and enhancements that have been committed to CVS since the release of
GNATS 4.0.  Notable enhancements include:

- Upgrade to autoconf 2.59 generated configure scripts.
- New PR numbers are reported to the client upon new submissions
- Rewrite of install-sid.  Now, rather than editing send-pr, which can
  be installed on a read-only partition, install-sid creates or edits
  user or site configuration files ~/.send-pr.conf or
  /etc/gnats/send-pr.conf.
- Removal of libiberty, old manpages, and old build framework cruft
- Performance enhancements to indexing code
- Various cleanups and bugfixes.  See the ChangeLog files for details.


GNATS 4.0.1, November 2004
==========================

This is the GNATS 4.0.1 release, a patch release to address a
potential security vulnerability with string formatting in
gnats/misc.c that was described in:

  http://lists.gnu.org/archive/html/bug-gnats/2004-06/msg00028.html
  http://www.zone-h.org/advisories/read/id=4889
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0623
  http://www.debian.org/security/2004/dsa-590

Additional string formatting fixes were applied to avoid buffer
overflows in constructing formatted date strings.


GNATS 4.0, August 2003
======================

This is the GNATS 4.0 release.  GNATS 4 has major changes since GNATS
3, see the beta 1 news below for an overview of the changes. This
release includes several bug-fixes and documentation improvements
since the beta 2 release.


GNATS 4.0 beta 2, November 2002
===============================

This is the second beta release of GNATS 4.0.  We have a new
maintainer, Andrew Gray, and development has picked up pace a bit.
This release contains a great many bug-fixes and a limited selection
of new or expanded functionality.

This list indicates the most important changes made since beta 1.

- Myriads of bug-fixes have been made since beta 1.  See the ChangeLog
  for details.
- A new field `Notify-List' has been added to the standard dbconfig.
  This replaces the old GNATS 3 X-Gnats-Notify functionality.  E-mail
  addresses entered in this field are used to CC people on PR changes
  that generate Audit-Trail entries.  As part of this, the -c / --cc
  option to send-pr was removed.
- The fields Cases, Quarter, Keywords and Date-Required have been
  removed from the default dbconfig.
- gnatsd.access has been renamed to gnatsd.user_access.
- Password matching and the gnats-pwconv utility have been fixed, they
  were both broken in beta 1.
- Slightly redesigned access model.  See "Controlling access to
  databases" appendix in the manual.
- It is now possible to require certain fields to be nonempty upon
  initial PR submission by using the `require' keyword in the
  `initial-entry' section of the dbconfig file.  Along with the
  previously undocumented "on-change require" field definition keyword
  this makes it possible to specify that certain fields can never be
  empty.
- The manual includes a new appendix titled `dbconfig recipes',
  containing dbconfig customizations that are hopefully useful in
  themselves, but which should also serve to illustrate the great
  power of dbconfig.
- The manual is now fully compliant with GNATS 4.


GNATS 4.0 beta 1, December 2001
===============================

This is the first beta release of GNATS 4.0.  Two alpha releases were
made in 1999, but a lot of work has been done since then, both
implementation- and design-wise.

GNATS 4 amounts to a full rewrite compared with GNATS 3, and the major
changes and additions to functionality divide into four main areas:

- Remote network access to the GNATS server.
- Vastly improved customizability, allowing sites to customize
  virtually all aspects of GNATS behaviour.
- Much more powerful database queries.
- Documentation has been thoroughly revised.
- Password encryption.

Remote access

The GNATS network daemon gnatsd now allows direct PR submission,
allowing remote tools such as send-pr to speak directly to the GNATS
server over the network instead of assembling the PR and submitting it
by e-mail.  gnatsd can now also verify the contents of new PRs before
they are submitted, and remote tools are now also able to get such
data as field default values directly from gnatsd.

All the tools supplied with GNATS, such as send-pr, query-pr and
edit-pr now honor the GNATSDB environment variable.  When accessing a
GNATS database on the local system, this variable should simply
contain the name of the database to access, but in order to access a
remote GNATS server, the syntax

host:port:name

for the value of GNATSDB is now supported.  In addition, all the tools
now support a --database option with the same syntax as the GNATSDB
environment variable.


Customizability

The most important new customization feature, frequently requested by
GNATS 3 users, is the ability to add custom fields.  GNATS 4 contains
a small number of `built-in' fields, such as PR number and Category
that are required to be present in all setups, but apart from that,
what fields are defined and what characteristics they have is
completely customizable.

The old GNATS `config' file is gone, replaced by a much more powerful
file named `dbconfig', containing the following main sections:

- Overall database configuration, mainly containing the settings from
  the old `config' file, such as beginning and end of business hours,
  enable/disable submitter acknowledgment etc.
- Field configuration, containing field names, datatypes, on-change
  actions etc.
- Query definitions, allowing definition of named queries.
- Audit Trail format.
- Mail formats, allowing for easy customization of acknowledgment and
  notification e-mail messages etc.
- Index file format.
- Description of which fields are required to be present on initial PR
  submission.


Powerful database queries

GNATS 3 had severely limited query functionality, and this version
contains an entirely rewritten query engine with full support for
complex cross-field regular expression searches.  For legacy
applications, the query-pr tool also supports the version 3 query
syntax.


Documentation

The GNATS manual has been almost completely rewritten, thoroughly
documenting the new features present in GNATS 4.  It also contains
more in-depth technical information, such as the full gnatsd command
set, than earlier editions.


Password encryption

GNATS 4.0 supports encrypted passwords in the gnatsd.access file.
Traditional UNIX DES crypt() encryption, as well as the more secure
MD5 is supported.  Sites upgrading from GNATS 3 need to use the
gnats-pwconv tool in the distribution in order to translate their
gnatsd.access file to GNATS 4 format, even if they want to continue to
use plaintext passwords.  gnats-pwconv supports conversion to crypt()
and MD5 as well.  The distribution also contains the gnats-passwd tool
for password file management.


Other changes

Miscellaneous other changes to features and functionality include:
- The Emacs interface has been completely rewritten.
- The --gnats-release-based option to configure has been removed.
  This option was used to make GNATS include special fields such as
  Release-Note, required by some sites.  Since fields are now
  configurable in the dbconfig file, this build-time option is no
  longer necessary.
- The `site' functionality, with the mkdist tool, is gone.  In GNATS
  3, client tools such as send-pr could be packaged and distributed to
  submitter sites with the proper configuration files included.  This
  was never very well or thoroughly implemented, but something similar
  may appear in later versions of GNATS.  This should not be critical,
  since tools such as send-pr now get most of the data they need, such
  as list of categories etc., directly from gnatsd over the network.
- In addition to supporting much more advanced queries, query-pr now
  supports the specification of a C-style format string on the command
  line with the --format option.
- pr-mail, pr-addr, npr-addr and sub-type have been removed and their
  functionality has instead been added to query-pr.
- The file-pr command has been replaced by edit-pr --submit
- There is a new tool, mkdb, which is used to initialize a new database.
- There is a new tool, `diff-prs' which lists the fields that have
  changed between two PRs.
- GNATS_ROOT is no longer.  The GNATSDB environment variable is now
  used to determine which database to use (or the -d or --database
  option to the client tools).
- Databases must now be specified by name, so the --directory option
  in all the client tools has been replaced by a --database option.
- Category directories are now created on-the-fly by default,
  obviating the need for the mkcat tool.  This can be switched off in
  the `dbconfig' file, so mkcat is still present in the distribution.
- Most programs in the distribution now come with man pages.
- A new access level, `listdb' has been added.  This is like `none',
  except that it allows access to the LSDB command which is needed by
  third-party tools such as Gnatsweb, which need to get a list of
  available databases before presenting a login screen.
- The gnatsd command set has been significantly simplified.  There are
  fewer but more powerful commands now.
- gnatsd now takes care of Audit-Trail entries and sending e-mails for
  edits, making implementation of clients easier.
- gnatsd.conf has been renamed to gnatsd.host_access.
- Support for binary index files.  This is the default in GNATS 4 and
  removes the problems with separator quoting that was a huge problem
  in GNATS 3, causing frequent index file corruption.
- gnatsd now has a --maximum-access-level option, allowing a site to
  limit all access to a certain level.
- Parsing of time zones in e-mail headers is far more robust, no
  longer depending on the recognition of a myriad different time zone
  abbreviations.