Version bump for security bug #359019

Package-Manager: portage-2.1.9.34/cvs/Linux i686

4 files changed, 397 insertions, 2 deletions

diff --git a/www-plugins/adobe-flash/ChangeLog b/www-plugins/adobe-flash/ChangeLog
index baea4906a422..8f67508d4d67 100644
--- a/www-plugins/adobe-flash/ChangeLog
+++ b/www-plugins/adobe-flash/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for www-plugins/adobe-flash
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/www-plugins/adobe-flash/ChangeLog,v 1.67 2011/03/02 15:59:55 signals Exp $
+# $Header: /var/cvsroot/gentoo-x86/www-plugins/adobe-flash/ChangeLog,v 1.68 2011/03/22 16:32:51 lack Exp $
+
+*adobe-flash-10.2.153.1_p201011173 (22 Mar 2011)
+*adobe-flash-10.2.153.1 (22 Mar 2011)
+
+  22 Mar 2011; Jim Ramsay <lack@gentoo.org> +adobe-flash-10.2.153.1.ebuild,
+  +adobe-flash-10.2.153.1_p201011173.ebuild:
+  Version bump for security bug #359019
 
   02 Mar 2011; Kevin McCarthy <signals@gentoo.org>
   adobe-flash-9.0.289.0.ebuild:
diff --git a/www-plugins/adobe-flash/Manifest b/www-plugins/adobe-flash/Manifest
index b0bcd2c98e73..d6fc6bbb5ce0 100644
--- a/www-plugins/adobe-flash/Manifest
+++ b/www-plugins/adobe-flash/Manifest
@@ -3,12 +3,15 @@ AUX memcpy-to-memmove.sh 1418 RMD160 322005bfe0717630b945eb71ae4aa808a1d14d5e SH
 AUX mms.cfg 4420 RMD160 b73a91462e1db48fb40983e896cb06b3deb2a51e SHA1 3e56ecb32b938f46eea17a924fa0b006c66a3e6e SHA256 0dd2a9f9aab559243c4d282b5c143ed8876b8d6f8be519bfa8ca6e8fc0c55d9a
 DIST flash-plugin-10.1.102.64-release.i386.rpm 4902583 RMD160 5646d4dadf7b77145bac33c789aa3e66bd3bf67c SHA1 2387409833b5bfae70f59cf33e7b6e1ad15a76dd SHA256 45e6f7feadde7113ccf9360488f4f7e2bb15ae66c2f596c92a3677a09cd0a532
 DIST flash-plugin-10.2.152.27-release.i386.rpm 4961334 RMD160 4fd7007ce17b0eeb37fad487c59dc9f9f02854be SHA1 3feeb3e941361b63ff9da0e08bfc202dfbc82da2 SHA256 dac2f8a19558db70f928e0c681cbbabbc27970aa58faccbe7f8b99096b62a915
+DIST flash-plugin-10.2.153.1-release.i386.rpm 4961820 RMD160 f71f3e3afb09eab067cb253f8d40b6e6aaeb0ec3 SHA1 fb3228371ddfc00c31d6121974e23da2e02b4b22 SHA256 9899252732cc94b3bc0ae7e145c6c5e94255e123bd8d5298f9ec40cb10f63568
 DIST flashplayer10_2_p3_64bit_linux_111710.tar.gz 4310219 RMD160 a57e8c4555545ca348f4b33e8c042c3f66e905f4 SHA1 a53ee83c02421f900fe25fd3738efd77932e542c SHA256 ef05f679f8977144621560587ffdf9bc81812e9941dea422e977070c9cd05ff0
 DIST install_flash_player_9.tar.gz 3065784 RMD160 a36518cecaa5ed20743aebb61224567e9cf9291f SHA1 e4c6c77061c0899743284a758480fee95cfb8601 SHA256 a19c1765c44e515c435a5ad3c2d3b9444926bfc771710b204f4bfdcf4868cf51
 EBUILD adobe-flash-10.1.102.64.ebuild 5420 RMD160 e0bbbe87ca4235bc18b04c859579d68de5ab6c6e SHA1 dd4b522423baf8fee8831c87077a14db1d325ca9 SHA256 cf7b0fc677882be410a7a71f25f0f25aa904c7ebcd99141a7ca145890018f85b
 EBUILD adobe-flash-10.2.152.27.ebuild 5525 RMD160 c0a31ea0a1f593f3e0d005c943c77674ac0ddc9b SHA1 07814a538c2ea6b53af0032f767b817706766e5c SHA256 ad1569f02cef387b49501443df745815c7cdcdf40502d8139c20ae28ba54cead
 EBUILD adobe-flash-10.2.152.27_p201011173-r1.ebuild 6664 RMD160 b720447aa8d06c2f0e360ced84e29d05e80e4c63 SHA1 c85a0f0b42d9aa1537fc2be028f8ef6331d5c2cf SHA256 13c58e9e9daa07ae2095fb169d5412e5b6724ca243c93d96ddeb57644b57a08e
 EBUILD adobe-flash-10.2.152.27_p201011173-r2.ebuild 7104 RMD160 70b4a78f1736ab55d1c7871b2f168e17c9565994 SHA1 af441792a7ffe93abb604430f47a61da4b05fb9e SHA256 6147b2966b52ab222077514cc7ac7ade0049bbb8b0a6dce3639710d9ef28f1a7
+EBUILD adobe-flash-10.2.153.1.ebuild 5516 RMD160 04e0f9128e447b06bb6a6d96a8c47d01a0893d04 SHA1 dfcfa5881202d31a83b5f54003f72143ca48e2fb SHA256 b9888b329454afda6d85e5ca84eaf454dd12111b86bc675c6094b66138032539
+EBUILD adobe-flash-10.2.153.1_p201011173.ebuild 7100 RMD160 746d74f634412e43c93dfa78dcee4848abf6fdcf SHA1 71ed7336b574bf629d5e4bfa8591a39079193e47 SHA256 5935b04a2a5e0982f636dc91ab3c4eaf03595541bac8c0e52a1efa99f657e5c3
 EBUILD adobe-flash-9.0.289.0.ebuild 1784 RMD160 4ab05470e71f2d6eb9bbbea082e0b315439a1a43 SHA1 ed5c641d06bb52b99f670c921ad00d249b46c87a SHA256 945cfbb1141497499aafed9b371df02d05d35c0fe5dccd9316e0e05de83a2b87
-MISC ChangeLog 30588 RMD160 b5a65b865f47010fa0c469c91e80307c340deec3 SHA1 eec7e5e9b6ab5fc44431722a8b52109ff45a02a7 SHA256 886fbf9c23fd114573b47960fb9344954b26bef50a6ae2cfd70001e69559d5c9
+MISC ChangeLog 30835 RMD160 e4eef50e9345ce2ef0d1427c254c2eef93d529cd SHA1 1b9a1c4f84fe3844edd46a16691e4313282bd77b SHA256 882fdabbf25527aac33ff9121223ad4dade3c1822f02890c5dd65595921b72ce
 MISC metadata.xml 871 RMD160 b50fc8e6c15c6927d2b9bde901a07f7d2d9d60f2 SHA1 428c6f860230298dedfc43e20a02ad27a9f4ff8e SHA256 3bfd601bdacea3455708800d5f7946db559ae91719b2c65f6379d4b15e54ed13
diff --git a/www-plugins/adobe-flash/adobe-flash-10.2.153.1.ebuild b/www-plugins/adobe-flash/adobe-flash-10.2.153.1.ebuild
new file mode 100644
index 000000000000..9aa749e4f397
--- /dev/null
+++ b/www-plugins/adobe-flash/adobe-flash-10.2.153.1.ebuild
@@ -0,0 +1,169 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/www-plugins/adobe-flash/adobe-flash-10.2.153.1.ebuild,v 1.1 2011/03/22 16:32:51 lack Exp $
+
+EAPI=1
+inherit nsplugins rpm multilib toolchain-funcs
+
+MY_32B_URI="http://fpdownload.macromedia.com/get/flashplayer/current/flash-plugin-${PV}-release.i386.rpm"
+
+DESCRIPTION="Adobe Flash Player"
+SRC_URI="${MY_32B_URI}"
+HOMEPAGE="http://www.adobe.com/"
+IUSE="nspluginwrapper vdpau"
+SLOT="0"
+
+KEYWORDS="-* ~amd64 ~x86"
+LICENSE="AdobeFlash-10.1"
+RESTRICT="strip mirror"
+
+S="${WORKDIR}"
+
+NATIVE_DEPS="x11-libs/gtk+:2
+	media-libs/fontconfig
+	dev-libs/nss
+	net-misc/curl
+	vdpau? ( x11-libs/libvdpau )
+	>=sys-libs/glibc-2.4"
+
+EMUL_DEPS="vdpau? ( >=app-emulation/emul-linux-x86-xlibs-20110129 )
+	>=app-emulation/emul-linux-x86-gtklibs-20100409-r1
+	app-emulation/emul-linux-x86-soundlibs"
+
+DEPEND="amd64? ( nspluginwrapper? ( www-plugins/nspluginwrapper ) )"
+RDEPEND="x86? ( $NATIVE_DEPS )
+	amd64? ( $EMUL_DEPS )
+	|| ( media-fonts/liberation-fonts media-fonts/corefonts )
+	${DEPEND}"
+
+# Where should this all go? (Bug #328639)
+INSTALL_BASE="opt/Adobe/flash-player"
+
+# Ignore QA warnings in these binary closed-source libraries, since we can't fix
+# them:
+QA_EXECSTACK="${INSTALL_BASE}32/libflashplayer.so
+	${INSTALL_BASE}/libflashplayer.so"
+
+QA_DT_HASH="${INSTALL_BASE}32/libflashplayer.so
+	${INSTALL_BASE}/libflashplayer.so"
+
+pkg_setup() {
+	if use x86; then
+		export native_install=1
+	elif use amd64; then
+		# As of 10.1, no more native 64b version *grumble grumble*
+		unset native_install
+		unset need_lahf_wrapper
+		export amd64_32bit=1
+	fi
+}
+
+src_compile() {
+	if [[ $need_lahf_wrapper ]]; then
+		# This experimental wrapper, from Maks Verver via bug #268336 should
+		# emulate the missing lahf instruction affected platforms.
+		$(tc-getCC) -fPIC -shared -nostdlib -lc -oflashplugin-lahf-fix.so \
+			"${FILESDIR}/flashplugin-lahf-fix.c" \
+			|| die "Compile of flashplugin-lahf-fix.so failed"
+	fi
+}
+
+src_install() {
+	if [[ $native_install ]]; then
+		# 32b RPM has things hidden in funny places
+		use x86 && pushd "${S}/usr/lib/flash-plugin"
+
+		exeinto /${INSTALL_BASE}
+		doexe libflashplayer.so
+		inst_plugin /${INSTALL_BASE}/libflashplayer.so
+
+		use x86 && popd
+
+		# 64b tarball has no readme file.
+		use x86 && dodoc "${S}/usr/share/doc/flash-plugin-${PV}/readme.txt"
+	fi
+
+	if [[ $need_lahf_wrapper ]]; then
+		# This experimental wrapper, from Maks Verver via bug #268336 should
+		# emulate the missing lahf instruction affected platforms.
+		exeinto /${INSTALL_BASE}
+		doexe flashplugin-lahf-fix.so
+		inst_plugin /${INSTALL_BASE}/flashplugin-lahf-fix.so
+	fi
+
+	if [[ $amd64_32bit ]]; then
+		local oldabi="${ABI}"
+		ABI="x86"
+
+		# 32b plugin
+		pushd "${S}/usr/lib/flash-plugin"
+			exeinto /${INSTALL_BASE}32
+			doexe libflashplayer.so
+			inst_plugin /${INSTALL_BASE}32/libflashplayer.so
+			dodoc "${S}/usr/share/doc/flash-plugin-${PV}/readme.txt"
+		popd
+
+		ABI="${oldabi}"
+	fi
+
+	# The magic config file!
+	insinto "/etc/adobe"
+	doins "${FILESDIR}/mms.cfg"
+}
+
+pkg_postinst() {
+	if use amd64; then
+		elog "Adobe has released 10.1 in only a 32-bit version and upgrading"
+		elog "is required to close a major security vulnerability:"
+		elog "  http://bugs.gentoo.org/322855"
+		elog
+		if has_version 'www-plugins/nspluginwrapper'; then
+			if [[ $native_install ]]; then
+				# Note: This code branch is dead (no native 64-bit flash player
+				# available yet for 10.1), but I'm keeping it around in the hope
+				# that some day it will be back...
+				#  - Jim Ramsay <lack@gentoo.org>
+
+				# TODO: Perhaps parse the output of 'nspluginwrapper -l'
+				#       However, the 64b flash plugin makes
+				#       'nspluginwrapper -l' segfault.
+				local FLASH_WRAPPER="${ROOT}/usr/lib64/nsbrowser/plugins/npwrapper.libflashplayer.so"
+				if [[ -f ${FLASH_WRAPPER} ]]; then
+					einfo "Removing duplicate 32-bit plugin wrapper: Native 64-bit plugin installed"
+					nspluginwrapper -r "${FLASH_WRAPPER}"
+				fi
+				if [[ $need_lahf_wrapper ]]; then
+					ewarn "Your processor does not support the 'lahf' instruction which is used"
+					ewarn "by Adobe's 64-bit flash binary.  We have installed a wrapper which"
+					ewarn "should allow this plugin to run.  If you encounter problems, please"
+					ewarn "adjust your USE flags to install only the 32-bit version and reinstall:"
+					ewarn "  ${CATEGORY}/$PN[+32bit -64bit]"
+					elog
+				fi
+			else
+				einfo "nspluginwrapper detected: Installing plugin wrapper"
+				local oldabi="${ABI}"
+				ABI="x86"
+				local FLASH_SOURCE="${ROOT}/${INSTALL_BASE}32/libflashplayer.so"
+				nspluginwrapper -i "${FLASH_SOURCE}"
+				ABI="${oldabi}"
+				ewarn "Using adobe-flash-10.1 in a 64-bit browser is unstable:"
+				ewarn "  http://bugs.gentoo.org/324365"
+				ewarn "The recommended configuration is to use the 32-bit plugin"
+				ewarn "in a 32-bit browser such as www-client/firefox-bin"
+				elog
+			fi
+		elif [[ ! $native_install ]]; then
+			elog "To use the 32-bit flash player in a native 64-bit firefox,"
+			elog "you must install www-plugins/nspluginwrapper, though this"
+			elog "configuration is not recommended:"
+			elog "  http://bugs.gentoo.org/324365"
+			elog
+		fi
+	fi
+
+	ewarn "Flash player is closed-source, with a long history of security"
+	ewarn "issues.  Please consider only running flash applets you know to"
+	ewarn "be safe.  The 'flashblock' extension may help for mozilla users:"
+	ewarn "  https://addons.mozilla.org/en-US/firefox/addon/433"
+}
diff --git a/www-plugins/adobe-flash/adobe-flash-10.2.153.1_p201011173.ebuild b/www-plugins/adobe-flash/adobe-flash-10.2.153.1_p201011173.ebuild
new file mode 100644
index 000000000000..ec77066b41c8
--- /dev/null
+++ b/www-plugins/adobe-flash/adobe-flash-10.2.153.1_p201011173.ebuild
@@ -0,0 +1,216 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/www-plugins/adobe-flash/adobe-flash-10.2.153.1_p201011173.ebuild,v 1.1 2011/03/22 16:32:51 lack Exp $
+
+EAPI=3
+inherit rpm nsplugins multilib toolchain-funcs versionator
+
+# Note: There is no "square" for 32-bit!  Just use the current 32-bit release:
+PV_REL=$(get_version_component_range 1-4)
+MY_32B_URI="http://fpdownload.macromedia.com/get/flashplayer/current/flash-plugin-${PV_REL}-release.i386.rpm"
+
+# Specal version parsing for date-based 'square' releases
+# For proper date ordering in the ebuild we are using CCYYMMDD,  whereas Adobe
+# uses MMDDYY in their filename.  Plus we tack on the release number, too.
+EBUILD_DATE=$(get_version_component_range $(get_version_component_count))
+DATE_SUFFIX=${EBUILD_DATE: -5:4}${EBUILD_DATE:3:2}
+REL_SUFFIX=${EBUILD_DATE: -1}
+MY_64B_URI="http://download.macromedia.com/pub/labs/flashplayer10/flashplayer10_2_p${REL_SUFFIX}_64bit_linux_${DATE_SUFFIX}.tar.gz"
+
+DESCRIPTION="Adobe Flash Player"
+SRC_URI="x86? ( ${MY_32B_URI} )
+amd64? (
+	multilib? (
+		32bit? ( ${MY_32B_URI} )
+		64bit? ( ${MY_64B_URI} )
+	)
+	!multilib? ( ${MY_64B_URI} )
+)"
+#HOMEPAGE="http://www.adobe.com/"
+HOMEPAGE="http://labs.adobe.com/technologies/flashplayer10/"
+IUSE="multilib nspluginwrapper +32bit +64bit vdpau bindist"
+SLOT="0"
+
+KEYWORDS="-* ~amd64 ~x86"
+LICENSE="AdobeFlash-10.1"
+RESTRICT="strip mirror"
+
+S="${WORKDIR}"
+
+NATIVE_DEPS="x11-libs/gtk+:2
+	media-libs/fontconfig
+	dev-libs/nss
+	net-misc/curl
+	32bit? ( vdpau? ( x11-libs/libvdpau ) )
+	>=sys-libs/glibc-2.4"
+
+EMUL_DEPS="vdpau? ( >=app-emulation/emul-linux-x86-xlibs-20110129 )
+	>=app-emulation/emul-linux-x86-gtklibs-20100409-r1
+	app-emulation/emul-linux-x86-soundlibs"
+
+DEPEND="amd64? ( multilib? ( 32bit? ( nspluginwrapper? (
+	www-plugins/nspluginwrapper ) ) ) )"
+RDEPEND="x86? ( $NATIVE_DEPS )
+	amd64? (
+		multilib? (
+			64bit? ( $NATIVE_DEPS )
+			32bit? ( $EMUL_DEPS )
+		)
+		!multilib? ( $NATIVE_DEPS )
+	)
+	|| ( media-fonts/liberation-fonts media-fonts/corefonts )
+	${DEPEND}"
+
+# Where should this all go? (Bug #328639)
+INSTALL_BASE="opt/Adobe/flash-player"
+
+# Ignore QA warnings in these binary closed-source libraries, since we can't fix
+# them:
+QA_EXECSTACK="${INSTALL_BASE}32/libflashplayer.so
+	${INSTALL_BASE}/libflashplayer.so"
+
+QA_DT_HASH="${INSTALL_BASE}32/libflashplayer.so
+	${INSTALL_BASE}/libflashplayer.so"
+
+pkg_setup() {
+	einfo "Date is $EBUILD_DATE suffix is $DATE_SUFFIX"
+	if use x86; then
+		export native_install=1
+	elif use amd64; then
+		# amd64 users may unselect the native 64bit binary, if they choose
+		if ! use multilib || use 64bit; then
+			export native_install=1
+		else
+			unset native_install
+		fi
+
+		if use multilib && use 32bit; then
+			export amd64_32bit=1
+		else
+			unset amd64_32bit
+		fi
+
+		if use multilib && ! use 32bit && ! use 64bit; then
+			eerror "You must select at least one architecture USE flag (32bit or 64bit)"
+			die "No library version selected [-32bit -64bit]"
+		fi
+
+		unset need_lahf_wrapper
+		if [[ $native_install ]]; then
+			# 64bit flash requires the 'lahf' instruction (bug #268336)
+			# Also, check if *any* of the processors are affected (bug #286159)
+			if grep '^flags' /proc/cpuinfo | grep -qv 'lahf_lm'; then
+				export need_lahf_wrapper=1
+			fi
+
+			if use vdpau; then
+				ewarn "You have tried to enable VDPAU acceleration, but this is only"
+				ewarn "available for the 32-bit flash plugin at this time."
+				ewarn "Continuing with an unaccelerated 64-bit plugin."
+				if [[ $amd64_32bit ]]; then
+					ewarn "The 32-bit plugin will be accelerated."
+				fi
+			fi
+		fi
+	fi
+}
+
+src_compile() {
+	if [[ $need_lahf_wrapper ]]; then
+		# This experimental wrapper, from Maks Verver via bug #268336 should
+		# emulate the missing lahf instruction affected platforms.
+		$(tc-getCC) -fPIC -shared -nostdlib -lc -oflashplugin-lahf-fix.so \
+			"${FILESDIR}/flashplugin-lahf-fix.c" \
+			|| die "Compile of flashplugin-lahf-fix.so failed"
+	fi
+	if use amd64 && ! use bindist && [[ $native_install ]]; then
+		# Bug #354073: Patch binary to use memmove instead of memcpy from
+		# Redhat's bug https://bugzilla.redhat.com/show_bug.cgi?id=638477#c94
+		cp libflashplayer.so libflashplayer.so.orig
+		bash "${FILESDIR}/memcpy-to-memmove.sh" libflashplayer.so \
+			|| die "memcpy-to-memmove.sh failed"
+	fi
+	# TODO: Apparently changing memcpy to memmove helps the 32-bit plugin too...
+}
+
+src_install() {
+	if [[ $native_install ]]; then
+		# 32b RPM has things hidden in funny places
+		use x86 && pushd "${S}/usr/lib/flash-plugin"
+
+		exeinto /${INSTALL_BASE}
+		doexe libflashplayer.so
+		inst_plugin /${INSTALL_BASE}/libflashplayer.so
+
+		use x86 && popd
+
+		# 64b tarball has no readme file.
+		use x86 && dodoc "${S}/usr/share/doc/flash-plugin-${PV_REL}/readme.txt"
+	fi
+
+	if [[ $need_lahf_wrapper ]]; then
+		# This experimental wrapper, from Maks Verver via bug #268336 should
+		# emulate the missing lahf instruction affected platforms.
+		exeinto /${INSTALL_BASE}
+		doexe flashplugin-lahf-fix.so
+		inst_plugin /${INSTALL_BASE}/flashplugin-lahf-fix.so
+	fi
+
+	if [[ $amd64_32bit ]]; then
+		local oldabi="${ABI}"
+		ABI="x86"
+
+		# 32b plugin
+		pushd "${S}/usr/lib/flash-plugin"
+			exeinto /${INSTALL_BASE}32
+			doexe libflashplayer.so
+			inst_plugin /${INSTALL_BASE}32/libflashplayer.so
+		popd
+
+		ABI="${oldabi}"
+	fi
+
+	# The magic config file!
+	insinto "/etc/adobe"
+	doins "${FILESDIR}/mms.cfg"
+}
+
+pkg_postinst() {
+	if use amd64; then
+		if [[ $need_lahf_wrapper ]]; then
+			ewarn "Your processor does not support the 'lahf' instruction which is used"
+			ewarn "by Adobe's 64-bit flash binary.  We have installed a wrapper which"
+			ewarn "should allow this plugin to run.  If you encounter problems, please"
+			ewarn "adjust your USE flags to install only the 32-bit version and reinstall:"
+			ewarn "  ${CATEGORY}/$PN[+32bit -64bit]"
+			elog
+		fi
+		if has_version 'www-plugins/nspluginwrapper'; then
+			if [[ $native_install ]]; then
+				# TODO: Perhaps parse the output of 'nspluginwrapper -l'
+				#       However, the 64b flash plugin makes
+				#       'nspluginwrapper -l' segfault.
+				local FLASH_WRAPPER="${ROOT}/usr/lib64/nsbrowser/plugins/npwrapper.libflashplayer.so"
+				if [[ -f ${FLASH_WRAPPER} ]]; then
+					einfo "Removing duplicate 32-bit plugin wrapper: Native 64-bit plugin installed"
+					nspluginwrapper -r "${FLASH_WRAPPER}"
+				fi
+			else
+				einfo "nspluginwrapper detected: Installing plugin wrapper"
+				local oldabi="${ABI}"
+				ABI="x86"
+				local FLASH_SOURCE="${ROOT}/${INSTALL_BASE}32/libflashplayer.so"
+				nspluginwrapper -i "${FLASH_SOURCE}"
+				ABI="${oldabi}"
+			fi
+		elif [[ ! $native_install ]]; then
+			elog "To use the 32-bit flash player in a native 64-bit browser,"
+			elog "you must install www-plugins/nspluginwrapper"
+		fi
+	fi
+
+	ewarn "Flash player is closed-source, with a long history of security"
+	ewarn "issues.  Please consider only running flash applets you know to"
+	ewarn "be safe.  The 'flashblock' extension may help for mozilla users:"
+	ewarn "  https://addons.mozilla.org/en-US/firefox/addon/433"
+}