bug#28597: 26.0.60; [Security] Configure should use --without-pop by default

[Paul Eggert <eggert@cs.ucla.edu>]

[-- Attachment #1: Type: text/plain, Size: 284 bytes --]

On 10/03/2017 01:09 AM, Robert Pluim wrote:
> I think configure should output
> *something*  to warn people about the change in behaviour.

That's easy and harmless enough, so I installed the attached into 
emacs-26, after installing the patch I previously mentioned in this thread.


[-- Attachment #2: 0001-Warn-if-without-pop-is-now-the-default.patch --]
[-- Type: text/x-patch, Size: 3396 bytes --]

From bbc889f07fa1cc516480d5958ece89997c87cdeb Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 3 Oct 2017 15:42:10 -0700
Subject: [PATCH] Warn if --without-pop is now the default

* configure.ac (with_pop): Set to no-by-default if defaulting to "no".
Warn about the change if defaulting to "no".  Update URLs.
---
 configure.ac | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/configure.ac b/configure.ac
index 3feac73bed..d92b95cb54 100644
--- a/configure.ac
+++ b/configure.ac
@@ -259,7 +259,7 @@ AC_DEFUN
   [],
   [case $host in
      *-mingw*) with_pop=yes;;
-     *) with_pop=no;;
+     *) with_pop=no-by-default;;
    esac])
 if test "$with_pop" = yes; then
    AC_DEFINE(MAIL_USE_POP)
@@ -1320,7 +1320,7 @@ AC_DEFUN
 dnl LD_SWITCH_SYSTEM_TEMACS.  That is:
 dnl * inappropriate, as LDFLAGS is a user option but this is essential.
 dnl   Eg "make LDFLAGS=... all" could run into problems,
-dnl   http://bugs.debian.org/684788
+dnl   https://bugs.debian.org/684788
 dnl * unnecessary, since temacs is the only thing that actually needs it.
 dnl   Indeed this is where it was originally, prior to:
 dnl   https://lists.gnu.org/archive/html/emacs-pretest-bug/2004-03/msg00170.html
@@ -1399,10 +1399,6 @@ AC_DEFUN
    # The resulting binary has a complete symbol table, and is better
    # for debugging and other observability tools (debuggers, pstack, etc).
    #
-   # If you encounter a problem using dldump(), please consider sending
-   # a message to the OpenSolaris tools-linking mailing list:
-   #      http://mail.opensolaris.org/mailman/listinfo/tools-linking
-   #
    # It is likely that dldump() works with older Solaris too, but this has
    # not been tested, so for now this change is for Solaris 10 or newer.
    UNEXEC_OBJ=unexsol.o
@@ -2651,7 +2647,7 @@ AC_DEFUN
        closing open displays.  This is no problem if you just use
        one display, but if you use more than one and close one of them
        Emacs may crash.
-       See http://bugzilla.gnome.org/show_bug.cgi?id=85715]])
+       See https://bugzilla.gnome.org/show_bug.cgi?id=85715]])
   fi
 
 fi
@@ -4464,7 +4460,6 @@ AC_DEFUN
 
 case $opsys in
   dnl SIGIO exists, but the feature doesn't work in the way Emacs needs.
-  dnl See eg <http://article.gmane.org/gmane.os.openbsd.ports/46831>.
   hpux* | nacl | openbsd | sol2* | unixware )
     emacs_broken_SIGIO=yes
     ;;
@@ -5575,6 +5570,12 @@ m4_define
     AC_MSG_WARN([This configuration installs a 'movemail' program
 that retrieves POP3 email via only insecure channels.
 To omit insecure POP3, you can use '$0 --without-pop'.])
+  elif test "$with_pop" = no-by-default; then
+    AC_MSG_WARN([This configuration installs a 'movemail' program
+that does not retrieve POP3 email.  By default, Emacs 25 and earlier
+installed a 'movemail' program that retrieved POP3 email via only
+insecure channels, a practice that is no longer recommended but that
+you can continue to support by using '$0 --with-pop'.])
   fi
 
   case $opsys in
@@ -5586,7 +5587,7 @@ m4_define
       case `(movemail --version) 2>/dev/null` in
 	*Mailutils*) ;;
 	*) emacs_fix_movemail="install GNU Mailutils
-<http://mailutils.org> and $emacs_fix_movemail";;
+<https://mailutils.org> and $emacs_fix_movemail";;
       esac
       AC_MSG_NOTICE([You might want to $emacs_fix_movemail.]);;
   esac
-- 
2.13.6