NEWS -- list of user-visible changes		-*- outline -*-

* Thy 0.9.2 [Re-connect] -- 2004-06-15

	"The fragments of connection died
	 Some things just won't fade with time
	 Hide behind a transparent eye
	 You can't see me but I can you..."

The major reason for this release is a discovery of a possible Denial
Of Service attack against Thy, one which can easily crash a Thy
process. However, this was just a NULL-dereference, which can not be
used to execute arbitrary code. And is fixed in this release.

Also, epoll support was disabled in this release.

* Thy 0.9.1 [Hurt] -- 2004-06-05

	"Beneath the stains of time
	 The feelings disappear
	 You are someone else
	 I am still right here"

When Thy starts a helper process (such as the Authoriser or the
Worker), she will close and reopen the connection to syslog with a
different ID.

There is also a new option to limit how many bytes Thy will use for
mapping files into memory. When the limit is reached, no mmapping
will occur. This is only useful when using a Worker, since otherwise
files are not mapped to memory at all.

SRP authentication was implemented in this version.

One of the major new features in this release is the ability to
compile multiple event systems into Thy. In the past, Thy had to be
recompiled if one wanted to use epoll or kqueue instead of
select. Now, every possible event system is compiled in, and one can
select the appropriate one at run time. Thy will also try to select
the most appropriate one if none was explicitly specified.

Some smaller bugs were also fixed, as usual.

* Thy 0.9.0 [A Pirate I Was Meant To Be] -- 2004-04-25

	"A pirate I was meant to be, trim the sails and roam the sea!"

This release features a way to make Thy interact better with web
cache software: the ability to set the max-age of resources and
expiry times.

The Linux version of the networking code was updated to be able to
serve files larger than 2Gb when Thy is compiled with Large File
Support (which is the default).

* Thy 0.8.10 [Damned In Any Language] -- 2004-03-21

	"And the Great Dragon was cast out, that old serpent
	 called the devil and Satan which deceiveth the whole
	 world, he was cast out into the Earth and his angels
	 were cast out with him."

To reduce initial confusion, Thy will not try to change its UID to a
hardcoded default, but will run as the user starting her (she will
still warn when running as root). This fixes a problem where the
default UID did not have an associated user.

Improved portability by making sure the latest Thy compiles in most
of the BSDs too, not only on GNU/Linux.

When there were no configuration files specified on the command-line
and the default SYSCONFDIR/thy/thy.conf file exists, it will be
parsed upon startup.

This is Thy 0.9.0 release candidate four, most probably the last one.

* Thy 0.8.9 [Thirteen Autumns And a Widow] -- 2004-02-27

	"I must avert mine eyes to hymns
	 For His gaze brings dogmas to my skin
	 He knows that I dreamt of carnal rites
	 With Him undead for three long nights"

Fixed a bug in the TLS certificate selection code that could lead to a
crash. Also improved the same code to select the certificate based on
the `Host' HTTP header if no hostname was supplied during handshake
(note that this is only possible when upgrading from plain HTTP to
TLS).

Another important bug squashed, was one that resulted in all files
being kept mapped into memory.

This is Thy 0.9.0 release candidate three.

* Thy 0.8.8 [Portrait Of The Dead Countess] -- 2004-02-13

For fighting DoS better, it is now possible to limit the maximum
number of subsequent requests served in one keep-alive
connection. Also, the timeout for kept-alive requests can be set
separately from the normal timeout.

Another important news item is that one does not need to enable CGI
support anymore in order to be able to use handlers. The need to
enable CGI was both underdocumented and confusing.

There were also various bugs fixed all over the place.

This is Thy 0.9.0 release candidate two.

* Thy 0.8.7 [Serpent Tongue] -- 2004-01-24

	"At dusting ledgers of the seraphim
	 That Lilith swept across the broken land
	 In a whirl of lust to pleasure him"

The most visible - and incompatible - change in this release is the
updated authorisation protocol. This means that one will need at least
thy-auth 0.3.0 if one wants authorisation.

Apart from this, only minor bugfixes were applied, such as a fix for
over-eager caching of failed stat() calls, and a fix for fabs_open()
so we get read permissions on stricter systems, like the Hurd.

That was the code. The documentation, however, was updated quite a
bit, to explain the syntax - roughly - of the configuration files and
the available options.

This is Thy 0.9.0 release candidate one.

* Thy 0.8.6 [The Black Goddess Rises] -- 2003-12-24

	"You're in my dreams
	 The Darkness in my heart
	 The rapture in their screams
	 Black Goddess Rise..."

Changed Thy's behaviour when she serves a directory with an index that
is a CGI, and a request that points to a non-existent file. To make it
clear, lets suppose we have /test/, with a single file in it,
index.cgi. Now, if the client requests /test/foobar, Thy will now
report a HTTP 404 error. Older versions called index.cgi with /foobar
set as PATH_INFO. The old behaviour can be turned on with the new
`lazycgi' option (see the documentation for more information about
this).

Another major new feature is the support for aliases.

However, there is still more: configuration files. In a day or two of
insanity, support for configuration files were implemented. There can
be any number of them, so one can structure their files as they see
fit. However, this feature is not well documented yet.

Of course, there were a lot of bugfixes. For example, RFC 2817 support
introduced a silly requirement: if compiled with GnuTLS, one needed a
certificate to run Thy, even when TLS was explicitly turned off.

* Thy 0.8.5 [Scorched Earth Erotica] -- 2003-12-04

	"Welcome arms wide and crucified...
	 The slaughter"

Fixed RFC 2817 (Upgrading to TLS within HTTP/1.1) support to not
require input after the upgrade request, but serve the content
immediately after the handshake. Also added a simple client to test
this functionality with.

Made the command-line parser more strict. Most of the values will be
sanity checked before use.

* Thy 0.8.4 [Dusk And Her Embrace] -- 2003-11-29

	"Through twilight, darkness and moonrise
	 My scarlet tears will run
	 As stolen blood and whispered love
	 Of fantasises undone"

The most visible change in this release is that one is now allowed to
map most options to canonicalised filenames too, not only absolute
URLs. This way, one can change, eg, the MIME type of a file that might
well appear in multiple virtual hosts.

Another new feature is the support for RFC 2817 (Upgrading to TLS
within HTTP/1.1), which allows one to upgrade to TLS/1.0 within a
HTTP/1.1 session without needing to reconnect to a special port.

When compiled with GnuTLS 0.9.97 or later, Thy now supports client
certificate verification, and mod_ssl compatible extra CGI environment
variables.

* Thy 0.8.3 [Ebony Dressed For Sunset] -- 2003-10-29

This is mostly a bugfix release, containing some quite important
fixes.  A set of segmentation faults (one, in the configuration mapper
code, and one in the LRU cache implementation) were eliminated.
Dynamic compression was fixed, the footer was sent to the client with
a wrong byte order. Also fixed operation with dynamic compression, but
without TLS support compiled in.

Fixed a bug which caused Thy to not recognise there is a pending
connection, when there is (happened when a connection was accepted on
a FD that was lower than the FD of the highest listening socket).

Also, errordoc.php was made more robust, and the behaviour of Thy,
when encountering a file that is readable to her, but not `other', was
reverted to the old way of serving it (starting with Thy 0.8.1, Thy
only served files which were readable by `other').

Thy was also ported to MacOS X (and probably Darwin too).

Special thanks to Martin Schaaf and Xavier Noria for their help.

* Thy 0.8.2 [To Eve The Art Of Witchcraft] -- 2003-09-19

	"Make me as a flower that grows
	 forever in your throne
	 that I might pollinate the world
	 with darkness as your own
	 Embrace me in spellbinding eyes
	 the fire of life that never dies
	 tear deeper through my paper wounds
	 and never leave inside"

While working on adding support for HTTP 100 Continue (which is a new
feature in this release), copy & pasting code from the TRACE handling
code revealed that indeed, it wasn't in a compilable state since early
October, 2002. This has been cured quickly after adding HTTP 100
support.

Another new feature is the ability to discard POST body requests -
which is now the default, instead of the old method of closing the
connection before receiving the body of the request.

There were quite a few internal changes, but most users will most
probably not notice them.

* Thy 0.8.1 [Death Magick For Adepts] -- 2003-09-08

	"For words alone are at loss to trace
	 The face of today's inhuman wraith"

In an effort to minimise the time Thy spends doing disc I/O, two
frameworks were implemented: the first one is called the Worker, a
separate process, much like the Authoriser, which reads stuff into
core, so Thy does not have to. Unlike the Authoriser, this is
completely optional. The other framework is an LRU caching
mechanism. Almost every file operation, such as filename
canonicalisation, stat(), and URL to filename mapping is cached. Cache
entries are cleaned out either when they grow too old, or when the
cache gets full and they were at the end.

There were also some less interesting improvements, such as always
including QUERY_STRING in the CGI environment, even if it is empty;
logging of PATH_INFO and QUERY_STRING, alongside the requested URL;
support for limiting the maximum number of CGI children; and some
others.

Also, this release can be compiled with the native AIX C compiler,
xlC too.

* Thy 0.8.0 [Thank God For The Suffering] -- 2003-08-19

After a short vacation, I hereby present the first release on the new
development branch. This time, only two features were implemented -
not all that much. However, one of these is quite powerful...

This new feature is called "configuration mapping". This makes one
able to set options for URLs matching a given regexp. So one can
enable WebDAV for a directory, and so on. The other feature is the
ability to pass arbitrary options down to the Authoriser process.

* Thy 0.7.1 [Double Espresso] -- 2003-09-04

It is about time to have another cup of coffee, so allow me to present
Double Espresso!

Being a release on the stable branch, Double Espresso contains mostly
bugfixes and a small set of new features which proved to be stable and
non-intrusive.

This time, let us start with the new features (where features are
meant in a very broad sense, of course)!

As requested by some people, the documentation received some
attention: the Thy Authorisation Protocol was documented in
thy-auth(7), and examples for the "Address Format" were added to both
the manual page and the info docs.

Other new features include support for passing arguments to the
Authoriser, the logging of PATH_INFO and QUERY_STRING (this two might
be classified as bugfixes by some - I consider them new features
though).

Some of the more important bugfixes are the disabling of Certificate
Authority (by default only - it can be re-enabled with --ssl ca=file),
the inclusion of the QUERY_STRING variable in the CGI environment no
matter what (even if it is empty). Furthermore nor STDIN, nor STDERR
will be closed when they are not used, instead, they will be reopened
to /dev/null.

* Thy 0.7.0 [Espresso] -- 2003-07-30

Ladies and Gentlemen, it is Espresso time.

After three months of development, a new stable release of Thy is now
unleashed. Users who were using the development branch until now will
not notice anything important. Users of the former stable branch, the
Thy 0.5 series, however, are strongly encouraged to upgrade.

In short, Thy 0.7 is way more stable and standards conforming than any
of the previous releases. She is more robust, and more forgiving for
errors - yet screaming loudly if a problem cannot be worked around.

But now, on to the gory details, I present a summary of changes
between the former stable branch, and this new one!

Let us start with the easier things: as usual, there have been lots of
testing (this time, with a semi-automated test system), and as a
result, many bugs were found and eliminated. For reference, Thy 0.5
fails on about 20 of the 100 tests, Thy 0.7 passes them all. This also
resulted in stricter conformance to HTTP/1.1, mostly in corner-cases.

For those of us, who use CGIs as error documents, it is now possible to
specify one script for all error cases, with only one command.

I've been asked to support early chrooting, and disabling of the
automatically generated directory indexes - this is now possible
too. Adding custom environment variables for CGIs was also
implemented.

Now on to the more interesting parts!

One of the first improvements during the life of the development
branch, was to merge CGI handling back into the main process. That is,
CGIs are served by the same process that serves static content. This
eliminates an unnecessary fork, reduces system load, and code
complexity. It is also easier to maintain.

The next huge improvement is the support for listen on different IP
addresses and different ports. Thy 0.5 was able to accept requests on
any number of IPs, but only on the same port, and either http, or
https requests. Thy 0.7 removes this restriction, and the same server
can listen on any number of addresses, all on different ports,
accepting both http and https requests - it is all handled well.

Thy gained support for the `chunked' transfer encoding, as defined by
HTTP/1.1, which helps a lot with dynamic content. While there, Thy was
also made more cache friendly, by adding support for headers like
ETag, If-Range, If-Match, If-None-Match and Vary.

Since most of the webservers support the so-called `ScriptAlias'
feature, a similar solution was implemented in Thy too. With this, it
is possible to mark every executable file in a directory as CGI
programs.

As yet another special case for the CGI and handler framework, Thy 0.7
makes it possible to handle unknown request methods (such as PROPFIND,
as used by WebDAV) with external programs. As a test case, a WebDAV
server was set up with HTTP::DAVServer, and was tested with checking
out the Thy sources from a WebDAV-enabled Arch repository.

Of course, there are not only good news, but bad too. Authorisation
support was redesigned, and moved out into an external project,
Thy-Auth, which, in the future, will make adding new Authorisers (for
example, one that reads .htaccess files) easier.

Last but not least, Thy 0.7 has a new build system, modelled after
that of Linux 2.5/2.6.

* Thy 0.6.340 [Pandemonium] -- 2003-07-25

This is Thy 0.7 release candidate five.

This release serves as a final clean-up stage before Thy 0.7.0,
containing a few important fixes. First of all, keep-alive is working
again, Thy does not delay kept-alive requests anymore. Then, the
`Authorization' HTTP header is not passed down to CGIs anymore - they
have no business knowing the username and the password. The parsing of
the `Accept-Encoding' header was also improved.

On the other hand, support for serving documents in different
languages (ie, supporting the `Accept-Language' header) is gone,
sorry.

However, most of these are not visible for the average user (well,
except the keep-alive bugfix), but the new build system is. It was
modelled after the Linux 2.5 kbuild system - watch the output of
`make'!

* Thy 0.6.321 [Goodbye] -- 2003-07-14

This is Thy 0.7 release candidate four.

Since the final 0.7 release is very near now (I promise!), this
release is mainly focused on bugfixes. Some small, but long standing
and annoying bugs were fixed - most of them wouldn't even come up for
most users.

Among the fixes are a workaround for BSDs, where the source address
was always 0.0.0.0 (it turned out that getnameinfo() works a bit
differently there than on Linux), various fixes around the interaction
with the spawned Authoriser process, a workaround for pre-20030701
FreeBSD-current's setproctitle(), which segfaulted when it received a
NULL argument, and the ability to disable the header limit was also
restored.

A more important fix was done in the POST buffering code - when the
POST buffer was sent in many small chunks, Thy allocated way too much
memory, resulting in the shutdown of the server process.

On the features front (yes, I still couldn't keep myself from adding
some easier stuff) we have ETag, If-Range, If-Match and If-None-Match
support. See RFC2616 for their description.

On the comfortability front, we have --errordoc all=<foo>, a way to
specify the same document for all error messages (comes handy if you
want to handle everything with a CGI).

* Thy 0.6.285 [Hidden Houses] -- 2003-07-04

This is Thy 0.7 release candidate three, hopefully the last one.

Most of the changes in this release are fixes for defects in some
corner cases, and a few new features which were frequently requested
to appear in Thy 0.7.

The bugfixes include a fix for chunked transfer-encoding - Thy was not
RFC compliant in this respect, a trailing CRLF was missing from the
chunk headers; A severe FD leak in the CGI code was also fixed along
with a hard to reproduce hang. When HTTP 401 is handled by a CGI, the
WWW-Authenticate header now gets properly added to the response
header. When serving pre-compressed documents, Thy will now check if
it is recent enough, and serve the uncompressed document if that
version is newer.

As a real corner case, when there is a directory, say, /foo, which has
a directory index which is a CGI, Thy now correctly does a redirect to
/foo/ first.

On the feature front, we have fully non-blocking chunk serving and
on-the-fly compression - in the past, the chunk and deflate header and
footer were pushed out in blocking mode. The authorisation support was
rewritten from scratch, it is now handled by an external program,
allowing much more flexibility.

And for popular request, there is now support to turn off directory
indexing from the command-line, and Thy can chroot herself into the
webroot.

* Thy 0.6.242 [Stand Up] -- 2003-06-24

This is Thy 0.7 release candidate two, also known as "one more bug to
squash".

Apart from including most of the fixes also present in the recently
released Thy 0.5.3 (fixed the directory index of single-char
directories; a possible, yet unlikely memory corruption was fixed in
daemon_handle_io(); suboption parsing on some platforms was fixed;
etc), this version also contains many bugfixes that were not
backported: case-insensitive CGI header parsing, a possible
infinite-loop in the "CGI headers ended prematurely" case, and
buffering for POST requests. This latter one is especially important,
since it not only makes POST work in HTTPS sessions, but also makes it
impossible to the CGI to read parts of the upcoming, pipelined HTTP
request.

Of course, I wouldn't be myself, if I could have kept my promise to
not add new features. These new features are the addition of
SCRIPT_FILENAME to the CGI environment, in order to make PHP work for
everyone, and the elimination of empty variables from the CGI
environment. The ones that weren't backported to Thy 0.5 are the
support for the `Vary' HTTP response header, and a feature similar to
ScriptAlias in other HTTP daemons: support for marking directories in
which every executable file will be treated as a CGI program.

* Thy 0.6.193 [Stay] -- 2003-06-10

This is - hopefully - Thy 0.7.0 release candidate one. I do not plan
to add any new features before the next stable release, this one
brings quite enough!

For my own benefit, to know that Thy is still functioning, a hourly
statistics code was put into Thy. It simply reports the accepted
connections, the total amount of bytes transferred and the number of
active connections.

On the RFC conformance front the "Chunked" transfer-encoding was
implemented for HTTP/1.1, which helps a lot for dynamic content.

On the scalability front, an epoll (a Linux 2.6 feature) based network
queue was added alongside the existing poll(), select() and
kqueue() based implementations.

For those people who want to pass arbitrary environment variables to
their CGI programs, a new command-line option was added to do just
that.

Apart from that, there were the usual bugfixes and cleanups.

* Thy 0.6.175 [Black and Blue again] -- 2003-06-03

This release is about two things: minor, internal enhancements, such
as support for a kqueue() based event system, revitalised Tru64 and
HP-UX B.11.11 ports, and internal cleanups. And - as usual - brand new
and exciting features.

The most notable new feature is the ability to let external programs
handle unknown request methods, such as PROPFIND. This, along with the
support for adding arbitrary fields to the response header, makes Thy
able to act as a WebDAV server (tested with HTTP::DAVServer and Arch).

* Thy 0.6.134 [Bottle Living] -- 2003-05-22

This releases closes the hole noticed by Yann Vernier and fixed on the
stable branch in Thy 0.5.1: the CGI child now only inherits the file
descriptors it is supposed to. It also fixes an integer-overflow that
could lead to dead-locks or segfaults.

Apart from that, the usual bugfixes were applied, together with
cleanups and optimisations, improving performance, stability and
robustness.

* Thy 0.6.78 [Painkiller] -- 2003-05-02

Unlike previous development branches, Thy 0.6 took off
quickly. Probably because there were some stuff pending for a long
time, waiting for 0.5 to stabilise.

This release adds support for listening on multiple ports, http mixed
with https. CGI support got rewritten one final time: it got merged
into the main process, and is served in a non-blocking way, like
everything else. This allows Thy to support TLS with CGI keep-alive.

On the stability and portability front, a double-free() bug in the TLS
code was fixed (though it only surfaced on Alpha, not on x86, for some
reason), and the AIX port of Thy got revitalised.

* Thy 0.5.3 [Wabbit] -- 2003-06-20

This silly Wabbit Welease is mostly a bugfix version, containing a fix
for CGI mis-detection, a segmentation fault in the CGI environment
creating code and a possible, yet unlikely memory corruption in
daemon_handle_io(). Suboption parsing on some platforms (notably
FreeBSD 5) was also fixed.

In the spirit of portability, changes were made to make Thy compile
and work well on Tru64 and Solaris again, and she was ported to HP-UX
B.11.11 too. As part of this effort, Thy now uses sysconf() (instead
of using a compile-time option) to determine the maximum number of
file descriptors she can keep open, and she does not use the system's
realpath() implementation - that turned out to behave very differently
on many platforms. Thy uses the implementation lifted from the GNU C
library instead.

Since there are lots of broken clients out there, which should still
be supported, Thy now accepts lower-case HTTP requests, and handles
clients which terminate all lines with a single line feed, instead of
CRLF.

While the above is all and good, it is not everything. On the CGI
front, Thy now sets the SCRIPT_FILENAME variable, when running a CGI
via a handler (like she does with PHP), empty variables don't find
their way into the CGI programs' environment, and the connection will
not be kept alive if the CGI did not send a Content-Length header.

* Thy 0.5.2 [Roger] -- 2003-05-19

Roger fixes an integer overflow which randomly raised its ugly head
when Thy was asked to serve CGIs too.

Apart from that, mostly bugfixes were applied from the development
branch, to allow Thy to build without GNUTLS and warning-less on
NetBSD.

This release was also tested on NetBSD quite much - due to me
struggling to get a pkgsrc of it working.

* Thy 0.5.1 [Hare Risin' Havoc] -- 2003-05-14

This is mostly a security bug-fix release, closing the hole noticed by
Yann Vernier: the CGI child now only inherits the file descriptors it
is supposed to.

Apart from this, a set of memory leaks were plugged, and Thy was
re-ported to AIX.

As the single new feature, Thy can handle CGIs, which are directory
indexes themselves, as expected.

* Thy 0.5.0 [Bunnyyyy!!1!] -- 2003-04-20

This release marks the beginning of the new stable branch, one that is
more featureful, and stable than the one before.

Over Thy 0.3, the former stable branch, this brings us the usual
bugfixes and much-enhanced CGI support, IPv6, TLS, Multi-language and
compression (both transparent serving of precompressed files and
on-the-fly compression).

And now, ladies and gentlemen.... Happy easter to everyone!

* Thy 0.4.312 [Eye of the Beholder] -- 2003-04-14

This is basically Thy 0.5.0-pre1, the tree is in bugfix-only state.
See http://mantis.bonehunter.rulez.org/ for a list of pending issues.

In this relase, on-the-fly compression was reimplemented, since the
old implementation failed on larger documents.

Both the CGI and TLS support code received lots of bugfixes and
enhancements (like keep-alive and timeout for CGI, non-blocking TLS
handshake, multiple certs and TLS dnsname extensions, and more)

There have been many bugfixes all over the place, as usual.

* Thy 0.4.268 [The Unforgiven] -- 2003-04-05

This is a major brown-paper-bug release. First of all, there was a
security-hole in follow_ifowner(): if the path did not contain any
symlinks, and the owners matched, this function returned successfully,
instead of reporting an error (if there are no symlinks, there is
nothing to follow after all). This problem was fixed.

The other major bug was that non-TLS mode did not work at all, due to
Thy waiting for a TLS handshake on every connection.

In order to get away without being killed, on-the-fly compression was
implemented too, to gain forgiveness.

* Thy 0.4.258 [One] -- 2003-04-03

During the past days, TLS support was extensively debugged, and fixed
up to a level that it can be declared stable. As a side-effect,
keep-alive support with TLS was restored.

Another TLS-related feature is the support for OpenPGP certificates. I
do not know any client that supports this, but whatever.

Among the usual bugfixes is one noteworthy: Thy accepts LFLF as a
header-body separator and LF as line ending. In previous versions, Thy
strictly adhered to the RFC and only accepted CRLFCRLF and CRLF,
respectively.

* Thy 0.4.242 [The God That Failed] -- 2003-03-31

The most visible feature of this release is IPv6 support and the
ability to listen on any number of addresses, be them IPv6 or IPv4.

Among the bugfixes are a fix for a runaway fork problem, which haunted
Thy since the early days of CGI support, and many TLS-related fixes.

Please note that TLS is still experimental.

* Thy 0.4.211 [Away] -- 2003-03-25

Behold! For Thy has TLS support, though far from stable, but most of
the code is in place.

Behind the scenes, many internal cleanups were made.

* Thy 0.4.165 [Lagoon] -- 2003-03-20

Thanks to Yann Vernier, Thy's CGI support is way more robust. The
hangs and disconnects are now past. Some minor bugs still remain,
though.

The PID file is now removed earlier in exit-cases, like when Thy
cannot bind to the specified port.

Also, a typo, which prevented many of the HTTP POST using applications
to work, was corrected.

* Thy 0.4.141 [Witchdrums] -- 2003-03-15

This was a rather quiet month for Thy development. As such, this is
mostly a bug-fix release, correcting a rather serious double-free bug
when utilising precompression, and a rare one in the directory index
caching code.

However, there are new features too, like an extensible MIME-type
database. In the past, the only way to change the MIME-type table was
to modify etc/mime.type and recompile Thy. With this release, there is
an option for this.

For non-glibc users, long options are now supported wherever
getopt_long is available (tested on FreeBSD and NetBSD).

* Thy 0.4.116 [Angels Fall First] -- 2003-02-19

After nearly two months of minor enhancements, true development is
about to begin: Support for multi-language content is in place and
works, though, it is probably not yet compatible with other similar
implementations.

Another new feature being implemented is content compression. So far,
only precompressed documents are supported, with run-time encoding on
its way.

As usual, there were also massive documentation updates (all the
--options properties are documented in due length) and internal
cleanups, paving the way for future features.

* Thy 0.4.88 [I Can See Now] -- 2003-02-11

Various fixes all over the plate: one for FreeBSD, one for argument
hiding, another for stripping the trailing slash from the specified
webroot.

Probably the most visible change is that If-Modified-Since works
again. A too aggressive check was weakened to fix the problem.

There is also a .spec file and an init script for RedHat systems.

New features include optional case-insensitive extension matching (so
.TXT will be correctly identified as text/plain), and following of all
symlinks, not just those whose target matches the owner (again, this
is optional, and off by default).

* Thy 0.4.67 [Black Sun] -- 2003-01-26

This is a release of code cleanup and porting fixes. Since the last
release, Thy was tested on all the currently working ports, resulting
in a set of fixes and cleanups.

* Thy 0.4.40 [Dead to the World] -- 2003-01-19

Command-line arguments are now hidden, users of `ps' has no business
knowing our webroot.

There were also a set of smaller bugfixes and cleanups, mostly as a
side-effect of the ICC support in the build system. Also, Thy was
ported to HP-UX.

This is the first release that is able to run on a completely non-GNU
(save GNU Make) platform.

* Thy 0.4.25 [Forever Yours] -- 2003-01-12

In this release, the most visible change is the improved
fairness. Instead of allowing fast clients to drown the others, we
serve documents in smaller chunks (as opposed to simply sendfile()-ing
out as much data as possible).

As an added bonus, Thy now runs on AIX, utilising its send_file()
call. Before this release, the port was not complete, because our
internal asprintf() emulation did not work on this platform. Well, it
did not work anywhere else but on GNU/Linux and BSDs.

Furthermore, the need for Perl to build Thy is now gone too.

* Thy 0.4.9 [One More Night To Live] -- 2002-12-31

First in the series of the new development release. Contains mostly
code-cleanups and one little fix to make some CGI scripts which rely
on SCRIPT_NAME (like viewcvs) work as expected.

Happy new year to everyone!

* Thy 0.3.4 [Once Upon a Troubadour] -- 2003-03-21

Thanks to Yann Vernier, Thy's CGI support is way more robust. The
hangs and disconnects are now past. As a consequence, a typo, which
prevented many of the HTTP POST-using applications to work, was also
corrected.

The PID file is now removed earlier in exit-cases, like when Thy
cannot bind to the specified port.

* Thy 0.3.3 [East of Eden] -- 2003-02-27

This is the first release on this branch that does not contain mostly
everything that the development branch does. Since real development is
going on there, only bugfixes were backported. Well... That is not
entirely true, but anyway, there are no spectacular new features this
time.

There is support for long options on FreeBSD and NetBSD, documentation
cleanups, and a fix for a very rare segfault in the directory-index
caching code.

* Thy 0.3.2 [Don't Fade Away] -- 2003-02-11

This is the third, and probably most tested release in this branch so
far. As with the previous version, it does not differ much from the
development version - almost everything got backported.

And what does this bring us? Lots of fixes, mostly compile-time stuff
and portability, but there are real bugfixes too: for example, Thy
will not segfault anymore when no arguments are specified, nor will she
report a HTTP 404 error when the webroot is specified with a trailing
slash.

The most visible change probably is the reimplementation of
If-Modified-Since handling: Thy does not need to set her timezone to
GMT anymore, we use a less sensitive approach instead.

There are also two new options, one to make the extension comparsion
case-insensitive, when trying to determine the mime-type (nocasemime),
and another to follow symlinks, even if the owners do not match
(followall).

For RedHat users, a thy.spec file is shipped with the release tarball.

* Thy 0.3.1 [The Carnival is Over] -- 2003-01-20

As was my habit before, this release is not only a bugfix release, but
it has a selected set of enhancements backported from the development
branch. Well, truth be told, everything is backported.

This means that Thy received lots of fixes, among others, one that
makes viewcvs work correctly. There were some internal cleanups and
reorganisations too.

However, the most visible feature is the improved fairness: fast
clients will not drown others anymore.

For users of arcane platforms, such as AIX, Solaris, HP-UX or even
Cygwin, there is also good news: Thy was ported to these platforms,
using the native sendfile() look-a-like calls where possible.

* Thy 0.3.0 [Snoopy] -- 2002-12-24

You might wonder where the codename comes from, it is a giant step
away from the Pink Floyd titles after all. This time, it is part of a
message from Martin Michlmayr: "Verena, have fun with Snoopy and I
hope we shall meet again". Of course, only Martin and Verena will
understand what this actually means, but it has something to do with
Christmas, so here we go!

Merry Christmas to everybody out there!

It has been a long time since the last stable release, and although
many of the improvements were backported to Thy 0.1, the most
interesting ones were not.

We already had directory indexing, and a port to FreeBSD. Thy 0.3
brings us many new ports: AIX, Solaris, NetBSD and OpenBSD. CGI
support, which was completely removed from the last Thy 0.1 release is
back again, working pretty stable (it needs some more work though).

So go now, it is not too late to give a new present to your favourite
server: install Thy, the most beautiful HTTP daemon of all times!

* Thy 0.2.153 [Interstellar Overdrive] -- 2002-12-16

Ported to AIX, Solaris, NetBSD and OpenBSD. NPH and index-mode CGI
support, and various minor fixes all over the place.

* Thy 0.2.133 [Obscured by Clouds] -- 2002-10-31

The main improvement in this release is directory index caching, which
speeds up index generation by an order of magnitude.

* Thy 0.2.126 [One Of The Few] -- 2002-10-22

Fixed a dead-lock on relative URL requests, implemented support for
dynamic directory indexes (index.cgi & friends), Pidfile handling
fixes.

Dynamic content support was made a bit Apache-compatible by changing
the working directory to the webroot on startup, and always passing a
REDIRECT_STATUS variable to external programs.

The non-glibc ports got a great deal of attention too: a simplistic
getopt()-based argp implementation found its way in, so from now on,
every port supports command-line options. Also, the dietlibc port is
now considered fully functional, as all the known bugs are worked
around. Thy was also ported to uClibc.

Somewhen after 0.2 was forked off, a nasty memory leak creeped in,
this is fixed in this release too.

This release should be considered as a release candidate for the
upcoming 0.3 release.

* Thy 0.2.86 [Brain Damage] -- 2002-10-17

Implemented support for non-static error documents.

* Thy 0.2.70 [One of My Turns] -- 2002-10-15

Implemented HEAD and Keep-Alive support for CGI scripts. Support for
external handlers were added too.

Also fixed the sendfile() check in configure.ac, so Thy should compile
on FreeBSD without hacks.

* Thy 0.2.46 [Yet Another Movie] -- 2002-10-08

Completely redesigned CGI support, which - unlike in Thy 0.1 - works,
although it has some known bugs.

During this short period of time, many-many internal cleanups were
made to ease maintenance.

* Thy 0.1.356 [Breathe] -- 2002-10-31

Unlike previous releases, this one contains some major updates, which
do not affect much code, and proved rock solid in the Thy 0.2 branch:
** Directory index caching
** Simplistic argp suite for non-glibc systems
** Various portability enhancements

Also, CGI support which was disabled by default, and was way to buggy
to be usable, was removed in this release.

* Thy 0.1.346 [Remember A Day] -- 2002-10-20

This is mainly a bugfix release. Backports from the Thy 0.2 branch:
** Fixed an off-by-two bug in line2cgienv()
** Better FreeBSD support
** Pidfile handling fixes
** Fixed a dead-lock on relative URLs
** Various minor updates

* Thy 0.1.337 [One Slip] -- 2002-10-06

Fixed two segmentation faults, introduced during the cleanup made
during 0.1.334. Hopefully these were the last, and the Thy 0.1 branch
can be considered stable.

* Thy 0.1.334 [If] -- 2002-10-04

Fixed an off-by-one bug in the header flushing code (it prepended a
NULL character before the response body).

Added support for "0-X" range-pairs, although it is quite weird.

Modified logging, so now it logs the actual bytes sent, not the whole
length of the response.

* Thy 0.1.327 [Round and Round] -- 2002-10-03

Command-line syntax changed drastically: --http* is no more, long live
--errordoc!

The last trace of blocking I/O was eliminated, along with some related
minor buglets.

Because of some confusion it caused, the default from now on will be
to start with virtual hosting disabled.

And as part of the usual cleanups and bugfixes, Thy was ported to
FreeBSD and dietlibc systems. However, support for them is still
somewhat experimental and incomplete.

* Thy 0.1.300 [Wish You Were Here] -- 2002-09-22

A severe security bug was fixed in this version, thanks to Guglielmo
Bondioni for reporting it. The problem was that because of an inverted
check, requests like "/../../etc/passwd" were determined to be
correct.

* Thy 0.1.292 [Piper At The Gates of Dawn] -- 2002-09-09

The directory indexer was polished a bit, and Thy was modified to try
her best to notice and clean up dead connections as early as possible.

* Thy 0.1.281 [Sorrow] -- 2002-08-31

Based on an idea of Tamas Szerb, Authorisation support was redesigned
in this release. This second design seems to be far more flexible, and
less error prone.

Also, some smaller optimisations and bugfixes were applied, as usual.

* Thy 0.1.256 [Any Colour You Like] -- 2002-08-25

In this release, all the known memory leaks were fixed, and the source
was cleaned up in many places. Thy is now more robust, while the code
is cleaner.

* Thy 0.1.238 [Coming Back To Life] -- 2002-08-20

Quick brown-paper-bag release. Fixed the URL resolver to properly
terminate the resolved string, which - in turn - fixes the bug which
caused Thy to either return "400 Bad Request" or "404 Not Found" on
almost every URL it was asked to serve.

* Thy 0.1.234 [Empty Spaces] -- 2002-08-19

Initial release. Supports name based virtual hosting,
If-Modified-Since and If-Unmodified-Since, Keep-Alive, Pipelining,
Ranges, Userdirs, Basic Authorisation, and a set of minor things.

It also contains experimental CGI support, but that is disabled by
default.
