2.88 2026-04-03

  Bug Fixes:
  - Fix razorhome option assignment and readlink safety in
    Config.pm. (PR #36)
  - Prevent argument mutation and data loss in SIS parsing
    functions. (PR #42)
  - Fix bugs in preprocessing and engine modules. (PR #41)
  - Replace two-arg open with three-arg form in Agent.pm. (PR #40)
  - Correct dependency declarations in Makefile.PL and cpanfile.
    (PR #39)
  - Eliminate uninitialized value warnings in Ephemeral.pm. (PR #37)
  - Security hardening: remove unsafe eval, fix file locking, harden
    error handling. (PR #27)

  Improvements:
  - Modernize Perl idioms: three-arg open, lexical filehandles,
    use parent. (PR #24)
  - Add use strict and use warnings to all modules. (PR #25)
  - Remove unused imports, modernize Exporter, simplify Digest::SHA
    fallback. (PR #28)
  - Use consistent literal version numbers across all modules.
    (PR #29)
  - Add META provides and upgrade repository metadata to CPAN META
    spec v2. (PR #30)
  - Update repository URLs from toddr to cpan-authors. (PR #38)

  Tests:
  - Add 109 tests for previously untested core modules. (PR #26)
  - Add 44 tests for preprocessing and engine modules. (PR #41)
  - Add t/config.t for Config.pm. (PR #36)

  Documentation:
  - Add POD documentation to Agent.pm, Config.pm, and Core.pm.
    (PR #35)
  - Add SECURITY.md with vulnerability reporting guidelines. (PR #31)
  - Add CONTRIBUTING.md with contributor guidelines. (PR #32)
  - Add CLAUDE.md with build artifact and release policy rules.
    (PR #43)

2.87 2026-03-22

  Bug Fixes:
  - Fix "Wide character in print" warnings by encoding UTF-8 output
    in Logger. (GH #8, PR #17)
  - Enable autoflush on stdout/stderr logger to prevent encoding
    layer buffering. (GH #20, PR #21)
  - Resolve Windows CI test failures in t/basic.t. (GH #22, PR #23)
  - Fix builds with parallel make at manifypods-razor. (PR #10)

  Improvements:
  - Allow logfile config to use 'stdout' and 'stderr' keywords for
    direct output. (GH #14, PR #15)
  - Use Digest::SHA instead of Digest::SHA1, removing the non-core
    Digest::SHA1 dependency. (PR #11)

  Maintenance:
  - Replace Travis CI with GitHub Actions and set MIN_PERL_VERSION
    to 5.010. (PR #19)
  - Rewrite Changes file from POD to plain text format. (PR #18)
  - Stop tracking META files in git.

2.86 Jun 03 2019

- Switch to IO::Socket::IP to enable IPv6 support.
- Switch to modern XSLoader.
- Modernize CI configuration and track perl 5.30.

2.85 Jul 21 2008

- Relicense under Artistic License 2.0. See LICENSE for details.

2.84 May 10 2007

- Update discovery hostname.

2.83 May 08 2007

- Remove all uses of $' from code. This removes a global regex
  engine slowdown. [issues.apache.org #5312]
- Comment out or replace shell commands with Perl equivalents.
  This removes the prerequisites of uname(1) and GNU mkdir(1).

2.82 May 26 2006

- Always disconnect from discovery server after performing
  discovery. This fixes a long standing bug wherein razor-report
  and razor-check would attempt to report to or check against the
  discovery servers.

2.81 Mar 16 2006

- Update service policy.

2.80 Feb 27 2006

- Untaint filenames loaded from the config file. [Bug #1395719]

2.79 Feb 16 2006

- Change C++ comments to C comments. [Patch #1431589]

2.78 Oct 01 2005

- When registering with a username and password, accept existing credentials
  if they authenticate successfully.
- When autoregistering, attempt to write a test identity before attempting
  to register credentials.
- Always remove the existing identity symlink before overwriting, as -e $fn
  can return false for a symlink that still exists.
- Added several error checks to the register process.
- Disconnect from the register server before returning when errors occur.
- Ensure that checks and reports are sent to the appropriate servers.
  [Bug #1267559]

2.77 Aug 17 2005

- Fixed corrupted distribution.

2.76 Aug 15 2005

- When no reporter identity is found, attempt to register automatically.
- When -home is specified on the command line, default global_razorhome to
  the provided value. [Gentoo #101070]

2.75 Jul 06 2005

- Removed two debugging statements accidentally checked into 2.74.
- Applied syslog patch from Debian bug #295727 to reintroduce support for
  'sys-syslog' and 'syslog' log targets. [Feature #1229433]
- Modified Makefile.PL to honor DESTDIR when installing section 5 man
  pages. [Bug #1227167]
- Fixed failure for razor-agents to exit with error when unknown
  parameters were specified. [Bug #1229450]
- Fixed bug for when razor-agents was invoked without -f but reading
  from STDIN, causing the shell to be unusable until the forked
  background process was killed off. [Bug #1229887]

2.74 Jun 28 2005

- Fixed handling of configuration options; under certain circumstances,
  neither the defaults nor the configuration file would set necessary
  variables such as listfile_discovery.
- Fixed handling of -home option; when provided, it will be accepted
  without further checks.
- Fixed installation of man(5) pages by non-root users to local man
  directories. [Patch #1227162]
- Reverted a patch that was intended to add support for overriding
  razorhome under certain circumstances. The patch introduced new
  issues with external program integration (eg. Amavis).
  [Bug #1074391]
- Corrected a spelling error in a debug message.
- Added several defined checks to avoid unnecessary warnings when
  manipulating server lists.
- Corrected the preprocessing fix shipped with 2.70 and updated the
  test suite to match. [Bug #1001417]
- Updated preproc implementation (deHTMLxs) to match other clients.

2.72 Jun 16 2005

- razor-client no longer creates symlinks to itself upon installation;
  four new scripts have been added to the distribution to replace this
  functionality (razor-admin, razor-check, razor-report, razor-revoke).

2.71 Jun 15 2005

- A fix to Makefile.PL script to correctly invoke razor-client
  after installation. Thanks to Liam Quinn for the patch.

2.70 Jun 10 2005

- Fixed preprocessing of unusual HTML messages. This resolves the
  segfault issue in razor-agents. [Bug #1001417]
- Fixed handling of certain malformed headers.
- Explicitly specify the record separator as \n when reading files, to
  ensure that someone else hasn't set it to undef. [Patch #537813]
- razorzone is no longer supported and has been removed from the
  documentation.
- Allow the config file to set razorhome. [Bug #1074391]
- Razor Agents no longer go into an infinite loop when discovery
  fails. [Bug #1016039]
- Properly creates razor-* symlinks after installation. [Bug #874468]
- Default to PERLPREFIX instead of PREFIX when installing man5 pages.
  [Bug #1001320]
- Removed a call to $sha1->reset() which was breaking SHA1 calculation.
  [Bug #1004858]
- use_engines is no longer supported and has been removed from
  the documentation. [Bug #1120311]
- Shuffle the discovery, catalogue, and nomination server lists
  after loading them from disk; this prevents razor-agents from
  always starting with the same catalogue server.
- Replace the complex DNS lookup logic for discovery servers with
  a single DNS round robin. [Bug #604679]
- Remove the ICMP ping logic for finding the "fastest" catalogue
  server; the configuration option for this logic is now ignored.
  [Support #739464]
- Removed stale engine code for various signature types that are no
  longer used.

2.67 Dec 03 2004

- This is a patch release that fixes a bug in the Whiplash
  signature scheme. The bug was in the new code added to support
  canonicalization of domains. It caused the signature algorithm
  to generate no signatures on valid content.

2.66 Dec 02 2004

- Introduced support for country domain canonicalization in the
  Whiplash signature scheme. This means domains like foo.co.uk
  would be extracted correctly by Whiplash. This change affords a
  considerable improvement in accuracy.
- Modified the revocation logic to do signature-only
  communications with the server. All versions of razor-agents
  prior to this sent the entire message on razor-revoke, and even
  though the backend would drop the messages after computing
  signatures, this entailed a privacy risk. From this version on
  razor-agents will never send the contents of a revoked message
  to the backend servers.
- Fixed a bug in se (supported engines) computation, which was
  broken when the se mask was larger than 8 bits. This would
  sometimes disable the use of engine 4 (ehash). This fix would
  also afford an increase in accuracy due to ehash being used
  everytime.
- Fixed a bug in report by message. Version 2.61 would drop MIME
  headers on certain spam messages which would cause the backend
  to ignore these messages as malformed.

2.61 Jul 06 2004

- Introduced the Whiplash signature scheme. Whiplash signatures
  are based on canonical domain names present in URLs embedded in
  spam messages. A Whiplash signature is also a function of the
  length of the spam message. It's important to note that not all
  whiplashes are used as classifiers. The Whiplash engine is
  augmented by sophisticated logic on the Razor2 backend to select
  the Whiplashes that are used to filter spam.
- Fixed a bug in MIME parser whereby some broken MIME mails were
  invisible to the system. [Bug #788723]
- We override the use_engines parameter in the config file
  because this version supports different engines but leaves the
  config file untouched. [Bug #984374]
- Engine 1 support completely removed. Engine 1 was a signature
  scheme compatible with the old razor v1 signatures, which is no
  longer supported on the backend. [Bug #975490]

2.40 Dec 07 2003

- Applied patch from Michael (lemkemch) to make Razor Agents work on VMS.
  (SF patch #797003).
- Applied another Makefile.PL patch from Michael Schwern to correctly
  install manpages in part 5 of the manual set in various versions of perl.
- Applied patch from Mark Martinec and Vivek Khera of Amavid to untaint
  various file targets obtained from user input. This is the same patch
  pointed to by the SpamAssassin FAQ.
- Support for HTTP 1.1 tunneling [SF patch #821324] by Jon Schewe.
- Applied Anne Bennett's patch to Logger.pm to introduce a new log
  target, "syslog-sys", that talks to Syslog over a Unix socket rather
  than a TCP socket.
- Applied Anne Bennett's patch to deHTML.xs to get rid of the type
  mismatch warning.
- Removed computation of signatures that are no longer supported by the
  backend -- engines 1, 2 and 3. Digest::Nilsimsa no longer required by
  Razor Agents.

2.36 Aug 05 2003

- Removed some experimental code.

2.35 Aug 05 2003

- Applied a patch to Makefile.PL by Michael Schwern. This patch makes
  Makefile.PL compatible with new MakeMaker and behave better in general.
- C++ style comments in deHTML code replaced with C comments so the code
  compiles with C compilers other than GCC.
- Applied patch [SF patch #766292] by Suren A. Chilingaryan to detect and
  skip body parts that only contain MIME headers.

2.34 May 16 2003

- Fixed a bug where razor-check would terminate prematurely on messages for
  which it could not compute a signature. Thanks to Bela Lubkin for tracking
  this and several other bugs down! [vipul]
- We don't do server sorting by distance anymore. Most servers are closeby,
  so we use the order the discovery server gives us. [vipul]
- Introduced SOCKS support. Net::SOCKS is required in order to use SOCKS.
  Specify socks_server in the config file. [vipul]
- Fixed a bug in String::split_mime(); the MIME boundary was being spuriously
  set in certain cases. [SF bug #707850 by Jams H Thompson]. [vipul]
- Razor agents use getpwuid() instead of getlogin() to determine the user's
  home directory. [SF bug #650410 by Jochen Erwied]. [vipul]
- A bug in the selection of zone prefixes in bootstrap discovery was fixed.
  [SF bug #604679 by Bill Sobel] [vipul]
- Razorhome is gleaned from the config file passed to razor-agents, if all
  else fails. "razor-report -conf=/etc/razor/razor.conf spam" will use
  /etc/razor as its home if no other home is found (eg in $HOME/.razor).
  To force a particular Razorhome value, use the -home=path option. [vipul]
- Rewrote many error messages to be descriptive and helpful. [vipul]
- auth=ai provides client name and version. [vipul]
- discover() will force bootstrap discovery when all discovery servers are
  unavailable. This fixes a bug where razor-agents would try to connect
  to the old Razor2 discovery server found in servers.discovery.lst. [vipul]
- reportit() in background mode will return faster. [vipul]
- checkit(), reportit(), parse_mbox(), etc take an ARRAY hash as an argument
  when provided against the 'aref' key. [vipul]

2.22 Nov 21 2002

- Turned off verbose logging in ehash that was left on by mistake. [vipul]
- Some user contributed additions to the FAQ.

2.21 Nov 19 2002

- Ephemeral Hash reverts to the entire content when both sections are
  composed of whitespace. This makes a certain type of false positives go
  away. [vipul]
- Razor2::Client::Core skips whitespace only message parts. [vipul]
- DebugLevel 15 prints out the content after preprocessing, just before the
  signatures are computed. [vipul]

2.20 Oct 15 2002 (First Stable Version)

- If log file isn't writable for whatever reason, we write logs to
  /dev/null. [vipul]
- We look for stray \r's in the split_mime function. Thanks to
  Jim <jim@ironchicken.org> for pointing this out. [vipul]
- Added a significantly faster XS version of deHTML code. [vipul]
- Made ::Agent taint friendly. [vipul]
- Added support for passing an already open filehandle to ::Agent::checkit()
  and ::Agent::parse_mbox(). [vipul]
- Made logic_method 4 the default. [vipul]
- Added Razor2::Syslog to the package. [vipul]

2.14 Jul 24 2002

- General release of 2.126. [chad]

2.126 Jul 24 2002

- Improved logic again for detecting spam. [chad, vipul]
- Run-time warnings are disabled unless in debug mode. [chad]

2.125 Jul 18 2002

- Improved logic for detecting spam, now we only
  look at visible and/or significant mime parts. [chad, vipul]
- Mime parts cleaned to only whitespace are now ignored on
  the client side; they are not checked against server. [chad]
- Fixed bug in report (err 202). [chad]
- Quieted more warnings. [chad]

2.123 Jul 17 2002

- Fixed bug in revoke/report. [chad]
- Whitelist now looks at all 'Received:' headers for matching. [chad]
- Added debuglevel, whitelist cmd-line options. [chad]
- Quieted more warnings. [chad]

2.122 Jul 15 2002

- Renamed razor-register razor-admin. To register, you must
  'razor-admin -register'. [chad]
- Cleaned up how we store mail parts. Each mail object now
  has a part object that stores info relevant to that part. [chad]
- Fixed parse_mbox (reading mbox and rfc822 mails). [chad]
- Backup any existing identity files before writing over them
  (with new identity). [chad]
- Added lock file support, so only one process writes to
  servers.*.lst at a time. [chad]
- Added rediscover_wait_dns. [chad]
- Fixed a bug when we rediscover, we save info to list correctly but
  when using it we skip the first server. [chad]
- Fixed whitelist so rule 'from xx' only matches 'From: .*xx' not
  'From .*xx' (Note the ':'). [chad]
- Made exit codes cleaner: 0 or 1 => no error, 2 or greater => error.
  [chad]
- Fixed error msg/exit code after disconnect. [chad]
- Added -w to razor binaries. [chad]
- If authen fails because of unknown user (213), attempt re-register.
  [chad]
- Quieted a bunch of warnings. [chad]

2.12 Jun 28 2002

- Man pages install correctly. [chad]
- Updated 'razor-register -create' so it creates home, conf,
  and forces discovery creating all .lst files. [chad]
- Added -discover switch to force discovery. [chad]
- Every time server bumps srl, force discovery. [chad]
- Fixed bug in preprocessor for engine 1, might
  have caused false positives. [chad]
- Whitelist fixed. [chad]
- Default logging is much more quiet,
  debuglevel changed from 5 to 3. [chad]
- Debug mode (-d) default debuglevel changed from 5 to 9. [chad]
- Fixed lots of logging foo. [chad]

2.10 Jun 22 2002

- Significantly improved runtime by not loading all packages
  until they are needed. These include: Time::HiRes Net::Ping
  Net::DNS. [chad]
- Non-mbox support added, thanks to Aaron Hopkins <aaron@die.net>.
  Now you can do: razor-check mail1 mbox mail2 ...
- -M mbox option has been removed, Razor Agents will figure out
  if file is mbox or not. [chad]
- Fixed a couple bugs relating to incorrect logs. [chad]
- Fixed a bug relating to first-time caching of a new server. [chad]
- Added ep4 to default server cache. [chad]

2.09 Jun 20 2002

- Added a BUGS file to distribution. [chad]
- Added an overview manpage, razor-agents(1), updated the rest. [chad]
- Overhauled how razorhome, config files, identity files,
  and -create work. Support the case where there is not and never will
  be a razor home dir. New options: -home=razorhome (all Razor Agents),
  -ident=identity (report, revoke, and register).
- Should not check/report if length of cleaned body part is 0. [chad]
- razor-register -sys switch removed. [chad]
- Fixed various bugs relating to engine 1 and razor 1 compatibility.
  [chad]
- Fixed bugs relating to sending/receiving queries to/from server.
  [chad]

2.08 Jun 16 2002

- Removed the debug statements from Razor2::Signature::Ephemeral.
  [vipul]

2.07 Jun 15 2002

- Added deNewline.pm to the tarball. It was missing from 2.06. [vipul]

2.06 Jun 15 2002

- Added a deNewline preprocessor that removes trailing \n's. Reflected
  the change in the server code as well. The reason for this is that
  MUAs (like mutt) strip trailing \n's so there's no way to get to
  the original message. This change necessitates upgrade from old 2.x
  agents. [vipul]
- Fixed a bug in Config.pm to use EUID instead of UID to discover
  user's Razor config directory. Thanks to Theo Van Dinter
  <felicity@kluge.net> for the patch. [vipul]
- Fixed a bug in sort in Razor2::String. [vipul]

2.05 Jun 15 2002

- Fixed port bug with bootstrap_discovery (initial register fails).
  [chad]

2.04 Jun 13 2002

- Added 'use_engines' to razor-agent.conf(5). [chad]
- Fixed a bug in reading port from server:port. Thanks to Theo Van
  Dinter <felicity@kluge.net>. [chad]
- Client behaves properly by sending a=q when done with server. [chad]
- Client now turns off VR2 by default. [chad]
- Logs to stdout if -d (debugging) cmd-line option is used. [chad]
- Register string now Razor-Agents v2.xx. [chad]

2.03 Jun 13 2002

- Fixed a bug in deHTML that was causing razor-check to hang on certain
  type of content.
- Fixed a bug in regexes in the MIME decoding function.
