mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-10 02:55:55 +02:00
8cdc44bc70e7700a9627e8aadfc8622067d8a7d7
12149 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Adolf Belka
|
8cdc44bc70 |
oci-cli: Update to version 3.45.2
- Update from version 3.29.4 to 3.45.2 - Update of rootfile - Changelog is too large to include here. Details can be found at https://github.com/oracle/oci-cli/releases Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
849bcfd188 |
ghostscript: Update to version 10.03.1
- Update from version 10.03.0 to 10.03.1
- Update of rootfile
- Several CVE fixes in this release
- Changelog
10.03.1
Fixes for CVE-2024-33869, CVE-2023-52722, CVE-2024-33870, CVE-2024-33871 and
CVE-2024-29510
IMPORTANT: For the 10.04.0 release (fall/autumn 2024) we will be adding
protection for device selection from PostScript input. This will mean that,
by default, only the device specified on the command line will be permitted.
Similar to the file permissions, there will be a "--permit-devices="
allowing a comma separation list of allowed devices. This will also take a
single wildcard "*" allowing any device.
Any application which relies on allowing PostScript to change devices during
a job will have to be aware, and take action to deal with this change.
The exception is "nulldevice", switching to that requires no special action.
A vulnerability was identified in the way Ghostscript/GhostPDL called
tesseract for the OCR devices, which could allow arbitrary code execution.
As as result, we strongly urge anyone including the OCR devices in their
build to update as soon as possible.
As of this release (10.03.1) pdfwrite creates PDF files with XRef streams
and ObjStm streams. This can result in considerably smaller PDF output
files. See Vector Devices for more details.
Ghostscript/pdfwrite now supports passing through PDF "Optional Content".
Our efforts in code hygiene and maintainability continue.
The usual round of bug fixes, compatibility changes, and incremental
improvements.
(9.53.0) We have added the capability to build with the Tesseract OCR
engine. In such a build, new devices are available
(pdfocr8/pdfocr24/pdfocr32) which render the output file to an image, OCR
that image, and output the image "wrapped" up as a PDF file, with the OCR
generated text information included as "invisible" text (in PDF terms, text
rendering mode 3).
Mainly due to time constraints, we only support including Tesseract from
source included in our release packages, and not linking to
Tesseract/Leptonica shared libraries. Whether we add this capability will
be largely dependent on community demand for the feature.
See Enabling OCR for more details.
Incompatible changes
(10.03.1) Almost all the "internal" PostScript procedures defined during the
interpreter startup are now "executeonly", further reducing the attack
surface of the interpreter.
The nature of these procedures means there should be no impact for
legitimate usage, but it is possible it will impact uses which abuse the
previous accessibility (even for legitimate reasons). Such cases may now
require "DELAYBIND", See DELAYBIND
(10.03.1) The "makeimagedevice" non-standard operator has been removed. It
allowed low level access to the graphics library in a way that was,
essentially impossible to secure.
(10.03.1) The "putdeviceprops", "getdeviceprops", "finddevice",
"copydevice", "findprotodevice" non-standard operators have all been
removed. They provided functionality that is either accessible through
standard operators, or should not be used by user PostScript.
(10.03.1) The process of "tidying" the PostScript namespace should have
removed only non-standard and undocumented operators. Nevertheless, it is
possible that any integrations or utilities that rely on those non-standard
and undocumented operators may stop working or may change behaviour.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Adolf Belka
|
ee4c4c787e |
fmt: Update to version 11.0.2
- Update from version 11.0.1 to 11.0.2
- Update of rootfile
- Changelog
11.0.2
- Fixed compatibility with non-POSIX systems
(https://github.com/fmtlib/fmt/issues/4054,
https://github.com/fmtlib/fmt/issues/4060).
- Fixed performance regressions when using `std::back_insert_iterator` with
`fmt::format_to` (https://github.com/fmtlib/fmt/issues/4070).
- Fixed handling of `std::generator` and move-only iterators
(https://github.com/fmtlib/fmt/issues/4053,
https://github.com/fmtlib/fmt/pull/4057). Thanks @Arghnews.
- Made `formatter<std::string_view>::parse` work with types convertible to
`std::string_view` (https://github.com/fmtlib/fmt/issues/4036,
https://github.com/fmtlib/fmt/pull/4055). Thanks @Arghnews.
- Made `volatile void*` formattable
(https://github.com/fmtlib/fmt/issues/4049,
https://github.com/fmtlib/fmt/pull/4056). Thanks @Arghnews.
- Made `Glib::ustring` not be confused with `std::string`
(https://github.com/fmtlib/fmt/issues/4052).
- Made `fmt::context` iterator compatible with STL algorithms that rely on
iterator category (https://github.com/fmtlib/fmt/issues/4079).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
Michael Tremer
|
71d9948c3b |
core188: Ship SQLite
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
b14dab3033 |
core188: Ship intel-microcode
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
9f3c37ab0c |
ovpnmain.cgi: Unify the error message box
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
61e6011d4e |
sdl2: Update to version 2.30.6
- Update from version 2.30.1 to 2.30.6
- Update of rootfile
- Changelog
2.30.6
Improved detection of Nintendo Switch Pro controller report mode
Fixed a rare crash when a controller is disconnected
Fixed creating a framebuffer with KMSDRM on some systems
2.30.5
Respect SDL_HINT_RENDER_DRIVER when creating an accelerated window surface
Clean up any accelerated renderer in SDL_DestroyWindowSurface()
Disable low level USB controller support on Android by default (can be
enabled by setting "SDL_ENV.SDL_JOYSTICK_HIDAPI" metadata to "1" in
AndroidManifest.xml)
Fixed USB permissions dialog on Android 14
Fixed controller mapping matching when one entry has a CRC specified and
another doesn't
Enable joystick support on FreeBSD when building using CMake
Reduced input latency when using an fcitx IME on Linux
Fixed graphical corruption on Raspberry Pi
Fixed crash when using an unstable sort function in SDL_qsort (you shouldn't
do this, but at least it won't crash)
2.30.4
Android rotation will respect user rotation lock preferences
Fixed spurious Left-Ctrl key input when the Right Alt key (AltGr) is pressed
on Windows
Added support for the Saitek Cyborg V.3 Rumble Pad in PS3 mode
Added support for the Razer Kitsune in PS5 mode
Added Linux bindings for the Qanba Drone 2 Arcade Joystick
Leave Nintendo Online controllers in simple report mode so they work with
DirectInput games
Enable using libusb for GameCube controllers when available
2.30.3
Fixed Win+V handling (pasting from clipboard history) on Windows
Fixed Caps Lock and Backspace key mapping for the Colemak keyboard layout on
Windows
Fixed mouse warp on XWayland
Reduced startup time when scanning for game controllers on Linux
Fixed building with C89 compilers
Fixed building with the GDK SDK on Windows
2.30.2
Fixed performance regression initializing controllers on Linux
Added support for the 6-button SEGA Mega Drive Control Pad for Nintendo Online
Added support for the MadCatz Saitek Side Panel Control Deck
Added support for the Hori Fighting Stick EX2
Added support for the Yawman Arrow flightstick
Added a gamepad mapping for the Defender Joystick Cobra R4
Fixed the gamepad mapping for the Sanwa Supply JY-P76USV controller
Poll for the initial controller state when using DirectInput
Allow using SDL_RWFromFile() with named pipes
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
6f10be4979 |
core188: Ship readline
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
8127b73812 |
core188: Ship lz4
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
90dfbe816a |
lz4: Update to version 1.10.0
- Update from version 1.9.4 to 1.10.0
- Update of rootfile
- Changelog
1.10.0
cli : multithreading compression support: improves speed by X times threads allocated
cli : overlap decompression with i/o, improving speed by ~+60%
cli : support environment variables LZ4_CLEVEL and LZ4_NBWORKERS
cli : license of CLI more clearly labelled GPL-2.0-or-later
cli : fix: refuse to compress directories
cli : fix dictionary compression benchmark on multiple files
cli : change: no more implicit `stdout` (except when input is `stdin`)
lib : new level 2, offering mid-way performance (speed and compression)
lib : Improved lz4frame compression speed for small data (up to +160% at 1KB)
lib : Slightly faster (+5%) HC compression speed (levels 3-9), by @JunHe77
lib : dictionary compression support now in stable status
lib : lz4frame states can be safely reset and reused after a processing error (described by @QrczakMK)
lib : `lz4file` API improvements, by @vsolontsov-volant and @t-mat
lib : new experimental symbol `LZ4_compress_destSize_extState()`
build: cmake minimum version raised to 3.5
build: cmake improvements, by @foxeng, @Ohjurot, @LocalSpook, @teo-tsirpanis, @ur4t and @t-mat
build: meson scripts are now hosted into `build/` directory, by @eli-schwartz
build: meson improvements, by @tristan957
build: Visual Studio solutions generated by `cmake` via scripts
port : support for loongArch, risc-v, m68k, mips and sparc architectures
port : improved Visual Studio compatibility, by @t-mat
port : freestanding support improvements, by @t-mat
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
4ebb8df54e |
core188: Ship knot
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
16f1486a94 |
core188: Ship iproute2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
e083a19f8f |
core188: Ship hwdata
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
292817ad93 |
git: Update to version 2.46.0
- Update from version 2.45.2 to 2.46.0
- Update of rootfile
- Changelog
2.46.0
UI, Workflows & Features
* The "--rfc" option of "git format-patch" learned to take an
optional string value to be used in place of "RFC" to tweak the
"[PATCH]" on the subject header.
* The credential helper protocol, together with the HTTP layer, have
been enhanced to support authentication schemes different from
username & password pair, like Bearer and NTLM.
* Command line completion script (in contrib/) learned to complete
"git symbolic-ref" a bit better (you need to enable plumbing
commands to be completed with GIT_COMPLETION_SHOW_ALL_COMMANDS).
* When the user responds to a prompt given by "git add -p" with an
unsupported command, list of available commands were given, which
was too much if the user knew what they wanted to type but merely
made a typo. Now the user gets a much shorter error message.
* The color parsing code learned to handle 12-bit RGB colors, spelled
as "#RGB" (in addition to "#RRGGBB" that is already supported).
* The operation mode options (like "--get") the "git config" command
uses have been deprecated and replaced with subcommands (like "git
config get").
* "git tag" learned the "--trailer" option to futz with the trailers
in the same way as "git commit" does.
* A new global "--no-advice" option can be used to disable all advice
messages, which is meant to be used only in scripts.
* Updates to symbolic refs can now be made as a part of ref
transaction.
* The trailer API has been reshuffled a bit.
* Terminology to call various ref-like things are getting
straightened out.
* The command line completion script (in contrib/) has been adjusted
to the recent update to "git config" that adopted subcommand based
UI.
* The knobs to tweak how reftable files are written have been made
available as configuration variables.
* When "git push" notices that the commit at the tip of the ref on
the other side it is about to overwrite does not exist locally, it
used to first try fetching it if the local repository is a partial
clone. The command has been taught not to do so and immediately
fail instead.
* The promisor.quiet configuration knob can be set to true to make
lazy fetching from promisor remotes silent.
* The inter/range-diff output has been moved to the end of the patch
when format-patch adds it to a single patch, instead of writing it
before the patch text, to be consistent with what is done for a
cover letter for a multi-patch series.
* A new command has been added to migrate a repository that uses the
files backend for its ref storage to use the reftable backend, with
limitations.
* "git diff --exit-code --ext-diff" learned to take the exit status
of the external diff driver into account when deciding the exit
status of the overall "git diff" invocation when configured to do
so.
* "git update-ref --stdin" learned to handle transactional updates of
symbolic-refs.
* "git format-patch --interdiff" for multi-patch series learned to
turn on cover letters automatically (unless told never to enable
cover letter with "--no-cover-letter" and such).
* The "--heads" option of "ls-remote" and "show-ref" has been been
deprecated; "--branches" replaces "--heads".
* For over a year, setting add.interactive.useBuiltin configuration
variable did nothing but giving a "this does not do anything"
warning. The warning has been removed.
* The http transport can now be told to send request with
authentication material without first getting a 401 response.
* A handful of entries are added to the GitFAQ document.
* "git var GIT_SHELL_PATH" should report the path to the shell used
to spawn external commands, but it didn't do so on Windows, which
has been corrected.
Performance, Internal Implementation, Development Support etc.
* Advertise "git contacts", a tool for newcomers to find people to
ask review for their patches, a bit more in our developer
documentation.
* In addition to building the objects needed, try to link the objects
that are used in fuzzer tests, to make sure at least they build
without bitrot, in Linux CI runs.
* Code to write out reftable has seen some optimization and
simplification.
* Tests to ensure interoperability between reftable written by jgit
and our code have been added and enabled in CI.
* The singleton index_state instance "the_index" has been eliminated
by always instantiating "the_repository" and replacing references
to "the_index" with references to its .index member.
* Git-GUI has a new maintainer, Johannes Sixt.
* The "test-tool" has been taught to run testsuite tests in parallel,
bypassing the need to use the "prove" tool.
* The "whitespace check" task that was enabled for GitHub Actions CI
has been ported to GitLab CI.
* The refs API lost functions that implicitly assumes to work on the
primary ref_store by forcing the callers to pass a ref_store as an
argument.
* Code clean-up to reduce inter-function communication inside
builtin/config.c done via the use of global variables.
* The pack bitmap code saw some clean-up to prepare for a follow-up topic.
* Preliminary code clean-up for "git send-email".
* The default "creation-factor" used by "git format-patch" has been
raised to make it more aggressively find matching commits.
* Before discovering the repository details, We used to assume SHA-1
as the "default" hash function, which has been corrected. Hopefully
this will smoke out codepaths that rely on such an unwarranted
assumptions.
* The project decision making policy has been documented.
* The strcmp-offset tests have been rewritten using the unit test
framework.
* "git add -p" learned to complain when an answer with more than one
letter is given to a prompt that expects a single letter answer.
* The alias-expanded command lines are logged to the trace output.
* A new test was added to ensure git commands that are designed to
run outside repositories do work.
* A few tests in reftable library have been rewritten using the
unit test framework.
* A pair of test helpers that essentially are unit tests on hash
algorithms have been rewritten using the unit-tests framework.
* A test helper that essentially is unit tests on the "decorate"
logic has been rewritten using the unit-tests framework.
* Many memory leaks in the sparse-checkout code paths have been
plugged.
* "make check-docs" noticed problems and reported to its output but
failed to signal its findings with its exit status, which has been
corrected.
* Building with "-Werror -Wwrite-strings" is now supported.
* To help developers, the build procedure now allows builders to use
CFLAGS_APPEND to specify additional CFLAGS.
* "oidtree" tests were rewritten to use the unit test framework.
* The structure of the document that records longer-term project
decisions to deprecate/remove/update various behaviour has been
outlined.
* The pseudo-merge reachability bitmap to help more efficient storage
of the reachability bitmap in a repository with too many refs has
been added.
* When "git merge" sees that the index cannot be refreshed (e.g. due
to another process doing the same in the background), it died but
after writing MERGE_HEAD etc. files, which was useless for the
purpose to recover from the failure.
* The output from "git cat-file --batch-check" and "--batch-command
(info)" should not be unbuffered, for which some tests have been
added.
* A CPP macro USE_THE_REPOSITORY_VARIABLE is introduced to help
transition the codebase to rely less on the availability of the
singleton the_repository instance.
* "git version --build-options" reports the version information of
OpenSSL and other libraries (if used) in the build.
* Memory ownership rules for the in-core representation of
remote.*.url configuration values have been straightened out, which
resulted in a few leak fixes and code clarification.
* When bundleURI interface fetches multiple bundles, Git failed to
take full advantage of all bundles and ended up slurping duplicated
objects, which has been corrected.
* The code to deal with modified paths that are out-of-cone in a
sparsely checked out working tree has been optimized.
* An existing test of oidmap API has been rewritten with the
unit-test framework.
* The "ort" merge backend saw one bugfix for a crash that happens
when inner merge gets killed, and assorted code clean-ups.
* A new warning message is issued when a command has to expand a
sparse index to handle working tree cruft that are outside of the
sparse checkout.
* The test framework learned to take the test body not as a single
string but as a here-document.
* "git push '' HEAD:there" used to hit a BUG(); it has been corrected
to die with "fatal: bad repository ''".
* What happens when http.cookieFile gets the special value "" has
been clarified in the documentation.
Bug Fixes
* "git rebase --signoff" used to forget that it needs to add a
sign-off to the resulting commit when told to continue after a
conflict stops its operation.
* The procedure to build multi-pack-index got confused by the
replace-refs mechanism, which has been corrected by disabling the
latter.
* The "-k" and "--rfc" options of "format-patch" will now error out
when used together, as one tells us not to add anything to the
title of the commit, and the other one tells us to add "RFC" in
addition to "PATCH".
* "git stash -S" did not handle binary files correctly, which has
been corrected.
* A scheduled "git maintenance" job is expected to work on all
repositories it knows about, but it stopped at the first one that
errored out. Now it keeps going.
* zsh can pretend to be a normal shell pretty well except for some
glitches that we tickle in some of our scripts. Work them around
so that "vimdiff" and our test suite works well enough with it.
* Command line completion support for zsh (in contrib/) has been
updated to stop exposing internal state to end-user shell
interaction.
* Tests that try to corrupt in-repository files in chunked format did
not work well on macOS due to its broken "mv", which has been
worked around.
* The maximum size of attribute files is enforced more consistently.
* Unbreak CI jobs so that we do not attempt to use Python 2 that has
been removed from the platform.
* Git 2.43 started using the tree of HEAD as the source of attributes
in a bare repository, which has severe performance implications.
For now, revert the change, without ripping out a more explicit
support for the attr.tree configuration variable.
* The "--exit-code" option of "git diff" command learned to work with
the "--ext-diff" option.
* Windows CI running in GitHub Actions started complaining about the
order of arguments given to calloc(); the imported regex code uses
the wrong order almost consistently, which has been corrected.
* Expose "name conflict" error when a ref creation fails due to D/F
conflict in the ref namespace, to improve an error message given by
"git fetch".
(merge 9339fca23e it/refs-name-conflict later to maint).
* The SubmittingPatches document now refers folks to manpages
translation project.
* The documentation for "git diff --name-only" has been clarified
that it is about showing the names in the post-image tree.
* The credential helper that talks with osx keychain learned to avoid
storing back the authentication material it just got received from
the keychain.
(merge e1ab45b2da kn/osxkeychain-skip-idempotent-store later to maint).
* The chainlint script (invoked during "make test") did nothing when
it failed to detect the number of available CPUs. It now falls
back to 1 CPU to avoid the problem.
* Revert overly aggressive "layered defence" that went into 2.45.1
and friends, which broke "git-lfs", "git-annex", and other use
cases, so that we can rebuild necessary counterparts in the open.
* "git init" in an already created directory, when the user
configuration has includeif.onbranch, started to fail recently,
which has been corrected.
* Memory leaks in "git mv" has been plugged.
* The safe.directory configuration knob has been updated to
optionally allow leading path matches.
* An overly large ".gitignore" files are now rejected silently.
* Upon expiration event, the credential subsystem forgot to clear
in-core authentication material other than password (whose support
was added recently), which has been corrected.
* Fix for an embarrassing typo that prevented Python2 tests from running
anywhere.
* Varargs functions that are unannotated as printf-like or execl-like
have been annotated as such.
* "git am" has a safety feature to prevent it from starting a new
session when there already is a session going. It reliably
triggers when a mbox is given on the command line, but it has to
rely on the tty-ness of the standard input. Add an explicit way to
opt out of this safety with a command line option.
(merge 62c71ace44 jk/am-retry later to maint).
* A leak in "git imap-send" that somehow escapes LSan has been
plugged.
* Setting core.abbrev too early before the repository set-up
(typically in "git clone") caused segfault, which as been
corrected.
* When the user adds to "git rebase -i" instruction to "pick" a merge
commit, the error experience is not pleasant. Such an error is now
caught earlier in the process that parses the todo list.
* We forgot to normalize the result of getcwd() to NFC on macOS where
all other paths are normalized, which has been corrected. This still
does not address the case where core.precomposeUnicode configuration
is not defined globally.
* Earlier we stopped using the tree of HEAD as the default source of
attributes in a bare repository, but failed to document it. This
has been corrected.
* "git update-server-info" and "git commit-graph --write" have been
updated to use the tempfile API to avoid leaving cruft after
failing.
* An unused extern declaration for mingw has been removed to prevent
it from causing build failure.
* A helper function shared between two tests had a copy-paste bug,
which has been corrected.
* "git fetch-pack -k -k" without passing "--lock-pack" (which we
never do ourselves) did not work at all, which has been corrected.
* CI job to build minimum fuzzers learned to pass NO_CURL=NoThanks to
the build procedure, as its build environment does not offer, or
the rest of the build needs, anything cURL.
(merge 4e66b5a990 jc/fuzz-sans-curl later to maint).
* "git diff --no-ext-diff" when diff.external is configured ignored
the "--color-moved" option.
(merge 0f4b0d4cf0 rs/diff-color-moved-w-no-ext-diff-fix later to maint).
* "git archive --add-virtual-file=<path>:<contents>" never paid
attention to the --prefix=<prefix> option but the documentation
said it would. The documentation has been corrected.
(merge 72c282098d jc/archive-prefix-with-add-virtual-file later to maint).
* When GIT_PAGER failed to spawn, depending on the code path taken,
we failed immediately (correct) or just spew the payload to the
standard output (incorrect). The code now always fail immediately
when GIT_PAGER fails.
(merge 78f0a5d187 rj/pager-die-upon-exec-failure later to maint).
* date parser updates to be more careful about underflowing epoch
based timestamp.
(merge 9d69789770 db/date-underflow-fix later to maint).
* The Bloom filter used for path limited history traversal was broken
on systems whose "char" is unsigned; update the implementation and
bump the format version to 2.
(merge 9c8a9ec787 tb/path-filter-fix later to maint).
* Typofix.
(merge 231cf7370e as/pathspec-h-typofix later to maint).
* Code clean-up.
(merge 4b837f821e rs/simplify-submodule-helper-super-prefix-invocation later
to maint).
* "git describe --dirty --broken" forgot to refresh the index before
seeing if there is any chang, ("git describe --dirty" correctly did
so), which has been corrected.
(merge b8ae42e292 as/describe-broken-refresh-index-fix later to maint).
* Test suite has been taught not to unnecessarily rely on DNS failing
a bogus external name.
(merge 407cdbd271 jk/tests-without-dns later to maint).
* GitWeb update to use committer date consistently in rss/atom feeds.
(merge cf6ead095b am/gitweb-feed-use-committer-date later to maint).
* Custom control structures we invented more recently have been
taught to the clang-format file.
(merge 1457dff9be rs/clang-format-updates later to maint).
* Developer build procedure fix.
(merge df32729866 tb/dev-build-pedantic-fix later to maint).
* "git push" that pushes only deletion gave an unnecessary and
harmless error message when push negotiation is configured, which
has been corrected.
(merge 4d8ee0317f jc/disable-push-nego-for-deletion later to maint).
* Address-looking strings found on the trailer are now placed on the
Cc: list after running through sanitize_address by "git send-email".
(merge c852531f45 cb/send-email-sanitize-trailer-addresses later to maint).
* Tests that use GIT_TEST_SANITIZE_LEAK_LOG feature got their exit
status inverted, which has been corrected.
(merge 8c1d6691bc rj/test-sanitize-leak-log-fix later to maint).
* The http.cookieFile and http.saveCookies configuration variables
have a few values that need to be avoided, which are now ignored
with warning messages.
(merge 4f5822076f jc/http-cookiefile later to maint).
* Repacking a repository with multi-pack index started making stupid
pack selections in Git 2.45, which has been corrected.
(merge 8fb6d11fad ds/midx-write-repack-fix later to maint).
* Fix documentation mark-up regression in 2.45.
(merge 6474da0aa4 ja/doc-markup-updates-fix later to maint).
* Work around asciidoctor's css that renders `monospace` material
in the SYNOPSIS section of manual pages as block elements.
(merge d44ce6ddd5 js/doc-markup-updates-fix later to maint).
* Other code cleanup, docfix, build fix, etc.
(merge 493fdae046 ew/object-convert-leakfix later to maint).
(merge 00f3661a0a ss/doc-eol-attr-fix later to maint).
(merge 428c40da61 ri/doc-show-branch-fix later to maint).
(merge 58696bfcaa jc/where-is-bash-for-ci later to maint).
(merge 616e94ca24 tb/doc-max-tree-depth-fix later to maint).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
727284bf0e |
core188: Ship exfatprogs
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
cca1ef9a56 |
exfatprogs: Update to version 1.2.5
- Update from version 1.1.3 to 1.2.5
- Update of rootfile
- Changelog
1.2.5
CHANGES :
* exfatprogs: remove the limitation that the device
path length cannot exceed 254 bytes.
* exfatprogs: include the test images in the release
package.
NEW FEATURES :
* fsck.exfat: check and repair the filename which has
invalid characters.
BUG FIXES :
* tune.exfat: check whether the volume has invalid
characters correctly.
* fsck.exfat: check whether the filename and volume
has invalid characters correctly.
* fsck.exfat: fix endianess issues which happen
in the big-endian system.
1.2.4
BUG FIXES :
* tune.exfat: Fix "invalid serial number" error when
setting an serial number.
* fsck.exfat: Fix memory leak in an error path
1.2.3
CHANGES :
* dump.exfat: Report sector size in bytes and cluster size in
terms of sectors.
* fsck.exfat: Show checksum value if the SetChecksum of File
directory entry is invalid.
* mkfs.exfat: Improve FAT length calculation to reduce
the FAT size.
NEW FEATURES :
* mkfs.exfat: Add the option "--sector-size".
* fsck.exfat: Support checking and repairing VendorAllcation and
VendorExtension directory entries.
BUG FIXES :
* exfatprogs: Remove unnecessary memory allocations.
* fsck.exfat: Fix corruption that can occur if the cluster size
is 512-byte.
* fsck.exfat: Fix the SecondaryCount of File directory entry
when the count of Name directory entries is 17 or higher.
* tune.exfat: Fix an error that accepts invalid serial numbers.
1.2.2
CHANGES :
* exfat2img: Allow dumps for read-only devices.
* fsck.exfat: Revert Repairing zero size directory.
NEW FEATURES :
* fsck.exfat: Repair duplicated filename.
* mkfs.exfat: Add the option "q" to print only error messages.
* mkfs.exfat: Add the option "U" to set volume GUID.
* tune.exfat: Add the option "U" / "-u" to set or print volume GUID.
BUG FIXES:
* fsck.exfat: Fix some out-of-bounds memory accesses.
* fsck.exfat: Change not to delete volume GUID directory entry.
1.2.1
CHANGES :
* fsck.exfat: Repair zero size directory.
* fsck.exfat: Four small clean-ups.
1.2.0
CHANGES :
* fsck.exfat: Keep traveling files even if there is a corrupted
directory entry set.
* fsck.exfat: Introduce the option "b" to recover a boot sector even
if an exFAT filesystem is not found.
* fsck.exfat: Introduce the option "s" to create files in
"/LOST+FOUND", which have clusters allocated but was not belonged to
any files.
* fsck.exfat: Rename '.' and '..' entry name to the one user want.
NEW FEATURES :
* fsck.exfat: Repair corruptions of an exFAT filesystem. Please refer
to fsck.exfat manpage to see what kind of corruptions can be repaired.
* exfat2img: Dump metadata of an exFAT filesystem. Please refer to
exfat2img manpage to see how to use it.
BUG FIXES:
* fsck.exfat: Fix an infinite loop while traveling files.
* tune.exfat: Fix bitmap entry corruption when adding new volume lablel.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
d150ecb42f |
core188: Ship cURL
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
b1be6000fe |
curl: Update to version 8.9.1
- Update from version 8.8.0 to 8.9.1
- Update of rootfile
- Changelog
8.9.1
Bugfixes:
cmake: detect `libssh` via `pkg-config`
cmake: detect `nettle` when building with GnuTLS
cmake: drop `if(PKG_CONFIG_FOUND)` guard for `pkg_check_modules()`
configure: limit `__builtin_available` test to Darwin
connect: fix connection shutdown for event based processing
contrithanks.sh: use -F with -v to match lines as strings
curl: more defensive socket code for --ip-tos
CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching
CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe
example/multi-uv: remove the use of globals
ftpserver.pl: make POP3 LIST serve content from the test file
GHA/windows: increase timeout for vcpkg build step
lib: survive some NULL input args
macos: fix Apple SDK bug workaround for non-macOS targets
misc: cleanup after removing years from copyright
os400: build cli manual.
os400: workaround an IBM ASCII run-time library bug
RELEASE-PROCEDURE.md: remove the initial build step
runtests: fold timing details with GHA, sync `-r` tflags
tests: provide FTP directory contents in the test file
tidy-up: URL updates
TODO: thread-safe sharing
transfer: speed limiting fix for 32bit systems
vtls: avoid forward declaration in MultiSSL builds
wolfSSL: allow wolfSSL's implementation of kyber to be used
wolfssl: avoid calling get_cached_x509_store if store is uncachable
wolfssl: CA store share fix
x509asn1: unittests and fixes for gtime2str
8.9.0
Changes:
curl: add --ip-tos (IP Type of Service / Traffic Class)
curl: add --mptcp
curl: add --vlan-priority
curl: add -w '%{num_retries}'
gnutls: support CA caching
mbedtls: support CURLOPT_CERTINFO
noproxy: patterns need to be comma separated
socket: support binding to interface *AND* IP
tcpkeepalive: add CURLOPT_TCP_KEEPCNT and --keepalive-cnt
urlapi: add CURLU_NO_GUESS_SCHEME
wolfssl: support CA caching
Bugfixes:
(lib)curl.rc: set debug flag also for `CURLDEBUG` and `UNITTESTS`
asyn-thread: avoid using GetAddrInfoExW with impersonation
aws-sigv4: url encode the canonical path
BINDINGS: update java link to one that exists
build: add Debug, TrackMemory, ECH to feature list
build: add more supported attributes to the IAR compiler
build: fix llvm 16 or older + Xcode 15 or newer, and gcc
build: fix llvm 17 and older + macOS SDK 14.4 and newer
build: sync warning options between autotools, cmake & compilers
build: tidy up `__builtin_available` feature checks (Apple)
build: untangle `CURLDEBUG` and `DEBUGBUILD` macros
build: use `#error` instead of invalid syntax
cd2nroff: convert two warnings to errors
cd2nroff: use an empty "##" to signal end of .IP sequence
cf-socket: improve SO_SNDBUF update for Winsock
cf-socket: optimize curlx_nonblock() and check its return error
cf-socket: remove obsolete recvbuf
cf-socket: remove two "useless" assignments
cfilters: make Curl_conn_connect always assign 'done'
cmake: add CURL_USE_GSASL option with detection + CI test
cmake: allow `ENABLE_CURLDEBUG=OFF` with `ENABLE_DEBUG=ON`
cmake: allow SOVERSION override with `CURL_LIBCURL_SOVERSION`
cmake: alpha-sort feature list
cmake: always build unit tests with the `testdeps` target
cmake: bring `curl-config.cmake` closer to `FindCURL`
cmake: create `configurehelp.pm` like autotools does
cmake: delete unused `HAVE_LIBSSH2`, `HAVE_LIBSOCKET` macros
cmake: detect `libidn2` also via `pkg-config`
cmake: enable SOVERSION for Cygwin and `CMAKE_DLL_NAME_WITH_SOVERSION`
cmake: fix `-Wredundant-decls` in unity/mingw-w64 builds
cmake: fix brotli lib order
cmake: fix building `unit1600` due to missing `ssl/openssl.h`
cmake: fix building in unity mode
cmake: fix building with both md4 and md5 in unity mode
cmake: fix builds with detected libidn2 lib but undetected header
cmake: fix feature and protocol lists for SecureTransport
cmake: fix quotes when appending multiple options (SecureTransport)
cmake: fix test 1013 with websockets enabled and no TLS
cmake: improve wolfSSL detection
cmake: show protocols, then features
cmake: stop setting SOVERSION for the static lib target
cmake: sync CA bundle/path detection with autotools
cmake: sync protocol/feature list with `curl -V` output
cmake: use `APPLE` instead of `CMAKE_SYSTEM_NAME` string
cmake: whitespace, formatting/tidy-up in comments
cmdline-docs: "added in" cleanups
cmdline-docs: fix `--proxy-ca-native` example + tidy-ups
cmdline-opts/_PROTOCOLS.md: mention WS(S)
cmdline-opts/ech.md: shorten the help text
cmdline-opts/fail.md: expand and clarify
cmdline-opts/interface.md: expand the documentation
cmdline-opts: category cleanup
cmdline-opts: expand the parallel explanations
cmdline-opts: shorten six help texts
cmdline: expand proxy option explanations
code: language cleanup in comments
configure: CA bundle/path detection fixes
configure: fix `SystemConfiguration` detection
configure: fix pkg-config library name 'libnghttp3'
configure: fix pkg-config names (zstd, ngtcp2*)
configure: limit `SystemConfiguration` test to non-c-ares, IPv6 builds
configure: remove 'deeper' checks for `AC_CHECK_FUNCS`
configure: require a QUIC library if nghttp3 is used
configure: sort feature list, lowercase protocols, use backticks
configure: use `$EGREP` in place of `grep -E`
configure: use AC_MSG_WARN for TLS/experimental warning texts
connect-to.md: expand with examples
connection: shutdown TLS (for FTP) better
cookie-jar.md: see also --junk-session-cookies
curl-config: revert to backticks to support old target envs
curl: allow etag and content-disposition for 3xx reply
curl: bsearch the --write-out variable name
curl: check for --disable case *sensitively*
curl: list categories in --help
curl: make warnings and other messages aware of terminal width
curl: output "flying saucers" with leading carriage return
curl_easy_escape: elaborate a little on encoding a URL
curl_mprintf.md: add missing comma
curl_multi_poll.md: expand the example with an custom file descriptor
curl_str[n]equal.md: tidy up text to make them stand-alone
curl_url_set.md: libcurl only parses :// URLs
curl_url_set: elaborate on scheme guessing
curldown: make 'added-in:' a mandatory header field
CURLOPT_CONNECTTIMEOUT*: clarify, document the milliseond version
CURLOPT_ECH.md: remove repeated 'if'
CURLOPT_NETRC.md: clarify what it does on Windows
CURLOPT_RESOLVE.md: mention hostname can be wildcard ('*')
CURLOPT_SSL_VERIFYHOST.md: refresh
CURLOPT_TLSAUTH_PASSWORD/USERNAME.md: language fixups
DISTROS: add a link to the list archive
DISTROS: add AlmaLinux package source link
DISTROS: add MSYS2 (native) links
docs/cmdline-opts: fix mail-auth example TLD typo
docs/cmdline-opts: remove two superfluous "Added in" mentions
docs/libcurl: polish the single-line descriptions
docs/Makefile.am: make curl-config.1 install
docs: reference non deprecated libcurl options
docs: start markdown headers with capital letter where applicable
doh-insecure.md: expand
doh: fix cleanup
doh: fix leak and zero-length HTTPS RR crash
dump-header.md: mention minus for stdout
examples/threaded-ssl: remove locking callback code
examples: add missing binaries to .gitignore
examples: delete unused includes
examples: fix compiling with MSVC
examples: suppress deprecation warnings locally
FEATURES.md: refresh
file: separate fake headers and body with a stand-alone CRLF
ftp: remove redundant null pointer check in loop condition
get.d: clarify the explanation
GHA/windows: add MSVC wolfSSL job with test
GHA/windows: ignore FTP test results for old-mingw-w64
GHA: add MSVC UWP job, expand jobs with more options
GHA: detect and warn for more English contractions
GHA: disable MQTT and WebSocket tests in Windows jobs
GHA: disable TFTP tests in Windows jobs
GHA: enable tests 1139, 1177, 1477 on Windows
GHA: improve vcpkg cache, add BoringSSL ECH and LibreSSL MSVC jobs
GHA: unify http3 workflows into one
GHA: use vcpkg to install packages for MSVC jobs
GIT-INFO.md: remove version requirements
gnutls: improve TLS shutdown
gnutls: pass in SNI name, not hostname when checking cert
help: add flags to output and ssh categories
hostip: skip error check for infallible function call
http/3: add shutdown support
http/3: resume upload on ack if we have more data to send
http: remove "struct HTTP"
http: write last header line late
idn: fix ß with AppleIDN
idn: make macidn fail before trying conversion if name too long
idn: tweak buffer use when converting with macidn
lib/v*: tidy up types and casts
lib: add a few DEBUGASSERT(data) to aid code analyzers
lib: add failure reason on bind errors
lib: fix gcc warning in certain debug builds
lib: fix thread entry point to return `DWORD` on WinCE
lib: graceful connection shutdown
lib: prefer `var = time(NULL)` over `time(&var)`
lib: tidy up types and casts
lib: xfer_setup and non-blocking shutdown
libcurl-docs: make option lists alpha-sorted
libcurl-easy.md: now *more* than 300 options
libcurl.pc: add `Requires.private`, `Requires` for static linking
libcurl.pc: add more `Requires.private`/`Requires` dependencies
libssh: remove CURLOPT_SSL_VERIFYHOST check
macos: add workaround for gcc, non-c-ares, IPv6, compile error
macos: undo `availability` macro enabled by Homebrew gcc
managen: "added in" fixes
managen: cleanups to generate nicer-looking output
managen: error on trailing blank lines in input files
managen: fix removing backticks from subtitles
managen: insert final .fi for files ending with a quote
managen: introduce "Multi: per-URL"
managen: only output .RE for manpage output
managen: output tabs for each 8 leading spaces
managen: warn on excessively long help texts
MANUAL.md: wrap two example urls that overrun styling
mbedtls: check version before getting tls version
mbedtls: check version for cipher id
mbedtls: correct the error message for cert blob parsing failure
mbedtls: send close-notify on close
mbedtls: v3.6.0 workarounds
md4: fix compilation with OpenSSL 1.x with md4 disabled
misc: fix typos
mk-ca-bundle.pl: delay 'curl -V' execution until it is needed
multi: add multi->proto_hash, a key-value store for protocol data
multi: do a final progress update on connect failure
multi: fix multi_wait() timeout handling
multi: fix pollset during RESOLVING phase
multi: multi_getsock(), check correct socket
ngtcp2+quictls: fix cert-status use
noproxy: test bad ipv6 net size first
openssl/gnutls: rectify the TLS version checks for QUIC
openssl: fix %-specifier in infof() call
openssl: fix hostname handling when using ECH
openssl: stop duplicate ssl key logging for legacy OpenSSL
os400: make it compilable again
pytest: add ftp upload tests
pytest: include testenv/vsftpd.py in dist tarball
quic: enable UDP GRO
quic: openssl quic, cmake and doc version update to 3.3.0
quic: require at least OpenSSL 3.3 for QUIC
quic: update to quiche 0.22.0
quiche: fix operand of ‘?:’ changes signedness
request.md: language fix
request: change the struct field bodywrites to a bool, only for hyper
reuse: switch to REUSE 3.2 and REUSE.toml
runtests: show name and keywords for failed tests in summary
runtests: sort test IDs in summary lines
runtests: support %DATEfor YYYY-MM-DD of right now
runtests: support %VERNUM
runtests: support crlf="yes" for the <stderr> section
sectransp: fix `HAVE_BUILTIN_AVAILABLE` checks to not emit warnings
sectransp: fix clang compiler warnings, stop silencing them
sectransp: remove large cipher table
sectransp: use common code for cipher suite lookup
sendf: fix CRLF conversion of input
smtp: for starttls, do full upgrade
socket: change TCP keepalive from ms to seconds on DragonFly BSD
socket: use SOCK_NONBLOCK to eliminate extra system call
socketpair: add `eventfd` and use `SOCK_NONBLOCK` for `socketpair()`
src/Makefile.am: remove SUBDIRS assignment
system_win32: add missing curl.h include
tcpkeepalive: support TCP keep-alive parameters on Solaris <11.4
test1119: adapt for `.md` input
test1139: scan .md files instead of .3 ones
test1175: scan libcurl-errors.md, not the generated .3 version
test1486: verify that write-out.md and tool_writeout.c are in sync
test2600: disable on win32
test: add test1484, for HEAD with content
test: add test1546, chunked not last transfer encoding
tests/scripts: call it 'manpage' (single word)
tests: add pytest for --ciphers and --tls13-ciphers options
tests: delete `CharConv` remains
tests: delete redundant `!MSDOS` guard
tests: extend user/password parsing test1620
tests: fix sshd IdentityFile path for MinGW/Cygwin
tests: fix sshd UserKnownHostsFile path for MinGW/Cygwin
tests: include current directory when running test Perl commands
tests: log "Throwing away" messages before throwing away
tests: run with "--trace-config all" to provide even more info
tests: sync feature names with `curl -V`
tests: test_17_ssl_use.py clarify mbedTLS TLSv1.3 support
tests: use exec when spawning nghttpx
tidy-up: use consistent casing for Windows directories
TODO: remove some old, clarify, add something
tool_cb_hdr: return error for failed header writes
tool_operate: avoid explicitly setting verifypeer to 1
tool_operate: simplify return code handling from url_proto()
tool_writeout: get certinfo only when needing it
trace-ascii.md: mention "%" for stderr
transfer: avoid polling socket every transfer loop
transfer: conn close on paused upload
transfer: do not use EXPIRE_NOW while blocked
transfer: remove curl_upload_refill_watermark, no longer used
transfer: set CSELECT_IN if there is data pending
unit2604: use 'unitfail' instead of 'error' variable
url: allow DoH transfers to override max connection limit
urlapi: remove unused definition of HOST_BAD
variable.md: make example use expand
verify-synopsis.pl: work with .md files
vms: fixed language in comment
vtls: deprioritize Secure Transport
vtls: replace addsessionid with set_sessionid
winbuild: fix PE version info debug flag
winbuild: MS-DOS batch tidy-ups
winbuild: remove outdated WIN32 defines
windows: fix UWP builds, add GHA job
winsock: move SO_SNDBUF update into cf-socket
wolfssl: assume key_file equal to clientcert if no key_file
wolfssl: use larger error buffer when formatting errors
x509asn1: add some common ECDSA OIDs
x509asn1: ASN1tostr() should fail when 'constructed' is set
x509asn1: fallback to dotted OID representation
x509asn1: make Curl_extract_certinfo store error message
x509asn1: prevent NULL dereference
x509asn1: remove superfluous free()
x509asn1: remove two static variables
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
1e046ced88 |
core188: Ship bash
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
ad4f573733 |
core188: Ship poppler
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
e891c3beca |
poppler: Update to version 24.08.0
- Update from version 24.03.0 to 24.08.0
- Update of rootfile
- sobump has dependency of cups-filters
- Changelog
24.08.0
core:
* Add support for modifying the appearance stream text in form field choice
* Fix buffer overflow in Windows specific font selection code
* Fix crashes in malformed files
* Internal code improvements
qt5:
* Add support for modifying the appearance stream text in form field choice
qt6:
* Add support for modifying the appearance stream text in form field choice
utils:
* pdfinfo: Fix crash in malformed documents
24.07.0
core:
* Fix crashes in broken files
* Internal code improvements
qt6:
* Add getters for document additional actions
* Implement reset forms link
qt5:
* Add getters for document additional actions
* Implement reset forms link
utils:
* pdfinfo: Fix crash in broken documents when using -dests
build system:
* Mark glib-mkenums as required
24.06.0
core:
* Performance improvements in some files
* Fix some issues with files bigger than 2^31 bytes
* Remove all cairo include guards for cairo < 1.16
* Fix MSVC build
* Internal code improvements
qt6:
* Update Qt6 doc example
* Use the non deprecated version of QString::fromUcs4
glib:
* properly document return value from poppler_font_info_scan
24.05.0
core:
* Fix signing not being totally correct in some kind of PDF files
* Assume "Adobe-Identity" for character collection. Issue #1465
* Small improvements in annotation font rendering
* Remove some GooString methods, use std::string ones instead
* Move some GooString methods to UTF.h
* Fix crash in broken files
cpp:
* cpp: Fix crash extracting text and font in some files. Issue #1477
* Change base class of ustring to char16_t
qt6:
* Add async API for certificate validation
* Fix text extraction for Landscape/Seascape pages
qt5:
* Add async API for certificate validation
* Fix text extraction for Landscape/Seascape pages
utils:
* pdfdetach: Small code improvements
* pdftops: Write compliant ps header
build system:
* Increase minimum supported base to that provided by Ubuntu 22.04
24.04.0
core:
* Optimize page text extraction speed
* Fix clipping path handling in some files. Issue #739
* Fix regression in text selection
* Fix text search across lines between paragraphs
qt6:
* Fix crash in SoundObject::data
utils:
* pdfsig: Add Catalan translation
build system:
* Build code as C++20
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
25365003f6 |
core188: Ship DHCP/Unbound Bridge socket implementation
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
b058000c23 | Merge remote-tracking branch 'ms/unbound-socket' into next | ||
|
Adolf Belka
|
ca9abd894e |
nmap: Update to version 7.95
- Update from version 7.94 to 7.95
- Update of rootfile
- Changelog
7.95
o [Windows] Upgraded Npcap (our Windows raw packet capturing and
transmission driver) from version 1.75 to the latest version 1.79. It
includes many performance improvements, bug fixes and feature
enhancements described at https://npcap.com/changelog.
o Integrated over 4000 IPv4 OS fingerprints submitted since June 2020. Added
336 fingerprints, bringing the new total to 6036. Additions include iOS 15 &
16, macOS Ventura & Monterey, Linux 6.1, OpenBSD 7.1, and lwIP 2.2
o Integrated over 2500 service/version detection fingerprints submitted since
June 2020. The signature count went up 1.4% to 12089, including 9 new
softmatches. We now detect 1246 protocols, including new additions of grpc,
mysqlx, essnet, remotemouse, and tuya.
o [NSE] Four new scripts from the DINA community
(https://github.com/DINA-community)
for querying industrial control systems:
+ hartip-info reads device information from devices using the Highway
Addressable Remote Transducer protocol
+ iec61850-mms queries devices using Manufacturing Message Specification
requests. [Dennis Rösch, Max Helbig]
+ multicast-profinet-discovery Sends a multicast PROFINET DCP Identify All
message and prints the responses. [Stefan Eiwanger, DINA-community]
+ profinet-cm-lookup queries the DCERPC endpoint mapper exposed via the
PNIO-CM service.
o Upgraded included libraries: Lua 5.4.6, libpcre2 10.43, zlib 1.3.1,
libssh2 1.11.0, liblinear 2.47
o [GH#2639] Upgraded OpenSSL binaries (for the Windows builds and for
RPMs) to version 3.0.13. CVEs resolved in this update include only 2
moderate-severity issues which we do not believe affect Nmap:
CVE-2023-5363 and CVE-2023-2650
o [Zenmap][Ndiff][GH#2649] Zenmap and Ndiff now use setuptools, not distutils
for packaging.
o [Ncat][GH#2685] Fixed Ncat UDP server mode to not quit after EOF on stdin.
Reported as Debian bug:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039613
o [GH#2672] Fixed an issue where TCP Connect scan (-sT) on Windows would fail to
open any sockets, leading to scans that never finish. [Daniel Miller]
o [NSE] ssh-auth-methods will now print the pre-authentication banner text when
available. Requires libssh2 1.11.0 or later. [Daniel Miller]
o [Zenmap][GH#2739] Fix a crash in Zenmap when changing a host comment.
o [NSE][GH#2766] Fix TLS 1.2 signature algorithms for EdDSA.
[Daniel Roethlisberger]
o [Zenmap][GH#2706] RPM spec files now correctly require the python3 package,
not python>=3
o Improvements to OS detection fingerprint matching, including a syntax change
for nmap-os-db that allows ranges within the TCP Options string. This leads
to more concise and maintainable fingerprints. [Daniel Miller]
o Improved the OS detection engine by using a new source port for each retry.
Scans from systems such as Windows that do not send RST for unsolicited
SYN|ACK responses were previously unable to get a response in subsequent
tries. [Daniel Miller]
o Several profile-guided optimizations of the port scan engine. [Daniel Miller]
o [GH#2731] Fix an out-of-bounds read which led to out-of-memory errors when
duplicate addresses were used with --exclude
o [GH#2609] Fixed a memory leak in Nsock: compiled pcap filters were not freed.
o [GH#2658] Fixed a crash when using service name wildcards with -p, as in -p
"http*"
o [NSE] Fixed DNS TXT record parsing which caused asn-query to fail in Nmap
7.80 and later. [David Fifield, Mike Pattrick]
o [NSE][GH#2727][GH#2728] Fixed packet size testing in KNX scripts [f0rw4rd]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Adolf Belka
|
cbaff8bcb4 |
ncat: Update to version 7.95
- Update from version 7.94 to 7.95
- Update of rootfile
- Changelog
7.95
o [Windows] Upgraded Npcap (our Windows raw packet capturing and
transmission driver) from version 1.75 to the latest version 1.79. It
includes many performance improvements, bug fixes and feature
enhancements described at https://npcap.com/changelog.
o Integrated over 4000 IPv4 OS fingerprints submitted since June 2020. Added
336 fingerprints, bringing the new total to 6036. Additions include iOS 15 &
16, macOS Ventura & Monterey, Linux 6.1, OpenBSD 7.1, and lwIP 2.2
o Integrated over 2500 service/version detection fingerprints submitted since
June 2020. The signature count went up 1.4% to 12089, including 9 new
softmatches. We now detect 1246 protocols, including new additions of grpc,
mysqlx, essnet, remotemouse, and tuya.
o [NSE] Four new scripts from the DINA community
(https://github.com/DINA-community)
for querying industrial control systems:
+ hartip-info reads device information from devices using the Highway
Addressable Remote Transducer protocol
+ iec61850-mms queries devices using Manufacturing Message Specification
requests. [Dennis Rösch, Max Helbig]
+ multicast-profinet-discovery Sends a multicast PROFINET DCP Identify All
message and prints the responses. [Stefan Eiwanger, DINA-community]
+ profinet-cm-lookup queries the DCERPC endpoint mapper exposed via the
PNIO-CM service.
o Upgraded included libraries: Lua 5.4.6, libpcre2 10.43, zlib 1.3.1,
libssh2 1.11.0, liblinear 2.47
o [GH#2639] Upgraded OpenSSL binaries (for the Windows builds and for
RPMs) to version 3.0.13. CVEs resolved in this update include only 2
moderate-severity issues which we do not believe affect Nmap:
CVE-2023-5363 and CVE-2023-2650
o [Zenmap][Ndiff][GH#2649] Zenmap and Ndiff now use setuptools, not distutils
for packaging.
o [Ncat][GH#2685] Fixed Ncat UDP server mode to not quit after EOF on stdin.
Reported as Debian bug:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039613
o [GH#2672] Fixed an issue where TCP Connect scan (-sT) on Windows would fail to
open any sockets, leading to scans that never finish. [Daniel Miller]
o [NSE] ssh-auth-methods will now print the pre-authentication banner text when
available. Requires libssh2 1.11.0 or later. [Daniel Miller]
o [Zenmap][GH#2739] Fix a crash in Zenmap when changing a host comment.
o [NSE][GH#2766] Fix TLS 1.2 signature algorithms for EdDSA.
[Daniel Roethlisberger]
o [Zenmap][GH#2706] RPM spec files now correctly require the python3 package,
not python>=3
o Improvements to OS detection fingerprint matching, including a syntax change
for nmap-os-db that allows ranges within the TCP Options string. This leads
to more concise and maintainable fingerprints. [Daniel Miller]
o Improved the OS detection engine by using a new source port for each retry.
Scans from systems such as Windows that do not send RST for unsolicited
SYN|ACK responses were previously unable to get a response in subsequent
tries. [Daniel Miller]
o Several profile-guided optimizations of the port scan engine. [Daniel Miller]
o [GH#2731] Fix an out-of-bounds read which led to out-of-memory errors when
duplicate addresses were used with --exclude
o [GH#2609] Fixed a memory leak in Nsock: compiled pcap filters were not freed.
o [GH#2658] Fixed a crash when using service name wildcards with -p, as in -p
"http*"
o [NSE] Fixed DNS TXT record parsing which caused asn-query to fail in Nmap
7.80 and later. [David Fifield, Mike Pattrick]
o [NSE][GH#2727][GH#2728] Fixed packet size testing in KNX scripts [f0rw4rd]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Adolf Belka
|
c8490adecf |
hplip: Update to version 3.24.4
- Update from version 3.23.12 to 3.24.4
- Update of rootfile
- Changelog
3.24.4
Added support for the following new Printers:
HP OfficeJet 8120 All-in-One series
HP OfficeJet Pro 8120 All-in-One series
HP OfficeJet 8130 All-in-One series
HP OfficeJet Pro 8130 All-in-One series
HP OfficeJet Pro 9720 Series
HP OfficeJet Pro 9730 Series
Added support for following new Distro:
Ubuntu 23.10
Debian 12
Fedora 39
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Adolf Belka
|
fdbd6bd32f |
frr: Update to version 10.1
- Update from version 9.1 to 10.1
- Update of rootfile
- CVE Fixes in 9.1.1
- Changelog
10.1
Breaking changes
Enable BGP dynamic capability by default for datacenter profile
Advertise BGP "Dynamic" capability by default if using a datacenter
profile. The dynamic capability gives more flexibility in terms of
changing some parameters (e.g. Graceful-Restart,
Long-lived Graceful-Restart timers, Addpath, Role, etc.) without
resetting the session.
Split BGP rpki cache command into separate per SSH/TCP
The old command is broken at some level. When configuring a TCP session
with the source, the command thinks it's an SSH session with a username.
Add deprecation cycle for OSPF router-info X [A.B.C.D] command
Features
BGP dampening per-neighbor support
It is now possible to configure BGP dampening parameters on a
per-neighbor basis. In previous releases, BGP dampening could only be
configured globally or per-SAFI.
BMP send-experimental stats
We added an option to send experimental BMP (RFC 7854) stats
[65531-65534].
RFC 7854 defines BMP statistics types:
Values 65531 through 65534 are Experimental, and value 65535
is Reserved.
Implement extended link-bandwidth for BGP
By default bandwidth in extended communities is encoded in IEEE
floating-point format, and is limited to a maximum of 25 Gbps. Since
not every vendor implements this correctly (due to IEEE floating-point),
another draft is implemented to encode the bandwidth into IPv6
address-specific extended community.
Paths Limit for Multiple Paths in BGP
Implemented this draft as an extension for the Addpath capability, that
tells the sender to send only an arbitrary number of paths per prefix
instead of sending all of the known paths.
New command for OSPFv2 ip ospf neighbor-filter NAME [A.B.C.D]
Configure an IP prefix list to filter packets received from OSPF
neighbors on the OSPF interface.
Implement non-broadcast support for point-to-multipoint networks
This extends non-broadcast support to point-to-multipoint networks.
The AllOSPFRouters (224.0.0.5) is still joined for non-broadcast
networks since it is joined for NBMA networks.
Other significant changes
bgpd
Fix route leaking from the default l3vrf
Fix match peer when switching between IPv4/IPv6/interface
Fix dynamic peer graceful restart race condition
Fix colored routes not installed after a switchover
Fix crash when deleting the SRv6 locator
Fix no set as-path prepend ASNUM...
Fix negative commands for Graceful-Restart operations (avoid
entering incorrect state)
Fix ipv4-mapped ipv6 on non 6pe
Fix show run of network route-distinguisher
Fix display when using missing-as-worst
Fix show bgp neighbors output
Fix error handling for MP/GR capabilities as a dynamic capability
Fix error handling when receiving BGP Prefix-SID attribute
Fix route-target display with a dotted format
Fix no bgp as-path access-list
Fix no form for neighbor X capability software-version
Check against extended community unit size for link bandwidth
Make sure we have enough data to handle extended link bandwidth
Check if FQDN capability length is in valid ranges
Allow using different ASNs per VRF instances
Send End-of-RIB not only if Graceful-Restart capability is received
Implement backpressure to avoid CPU hog
Ignore validating the attribute flags if path-attribute is configured
Prevent deletion of BGP peer groups associated with bgp listen range
Inherit some peer flags from the peer-group
Allow specification of AS 0 for RPKI commands
Allow using maximum-prefix for EVPN
Increase install/uninstall speed of EVPN VNIs
Update default-originate route-map actual map structure
Include unsuppress-map as a valid outgoing eBGP policy
Allow dynamically disable graceful-restart/long-lived graceful-restart
Unset advertised capabilities if the capability is disabled
Aggregated summary-only remove suppressed from EVPN
isisd
Fix crash when deactivating ISIS adjacency on the interface
Fix show isis database [detail] json
Fix show isis algorithm
Fix crash when configuring the circuit type for the interface
Fix IP/IPv6 reachability TLVs
When the metric-type is configured as "wide", the IS-IS generates
incorrect metric values for IPv4 directly connected routes
Add link state support for SRv6 adjacencies
The hold time of hello packets on a P2P link does not match the
sending interval
mgmtd
Implement YANG RPC/action support
ospfd
Fix crash in OSPF TE parsing
Fix the bug where ip_ospf_dead-interval_minimal_hello-multiplier did
not reset the hello timer
Fix no write-multiplier command
Fix no maximum-paths command
Solved crash in RI parsing with OSPF TE
Assure OSPF AS External routes are installed after the link flap
Send LS Updates in response to LS Request as unicast
ospf6d
Handle topo change in Graceful-Restart Helper mode for max-age LSAs
Prevent heap-buffer-overflow with an unknown type
Redistribute metric for AS-external route
Fix next-hop computation for inter-area multi-ABR ECMP
Fix interface type vs. connected routes updates
pathd
Retry synchronous label-manager ZAPI connection
pimd
Fix null register before aging out reg-stop
Fix dr-priority range
Fix crash unconfiguring rp keepalive timer
lib
Fix keychain NB crash
Do not convert EVPN prefixes into IPv4/IPv6 if not needed
ripd
Fix clear ip rip command
ripngd
Fix clear ipv6 ripng command
tools
Handle seq num for BGP as-path in frr-reload.py
vtysh
Fix 'show ip[v6] prefix-list ... json' formatting by moving it to vtysh
Fix show route-map command when calling via do
Show ip ospf network ... even if it's not the same as the interface
type
zebra
Fix mpls label bind command
Fix excessive exit commands
Fix static SRv6 segment-list SID order
Fix JSON output for show route summary json
Fix malformed json output for multiple vrfs in command show ip route
vrf all json
Fix crash if MAC-VLAN link in another netns
Fix crash on MAC-VLAN link down/up
Deny the routes if ip protocol CLI refers to an undefined route-map
Bridge flap handle VLAN membership update
Add show fpm status [json] command
9.1.1
Fixed CVEs
CVE-2024-31950
CVE-2024-31951
CVE-2024-31949
Bug Fixes
bgpd
"default-originate" shouldn't withdraw non-default routes
Aggr summary-only suppressed export to evpn
Allow using optional table id for negative `no set table x` command
Arrange peer notification to after zebra announce
Check bgp evpn instance presence in soo
Convert the bgp_advertise_attr->adv to a fifo
Do not show tcp mss if the socket is broken
Ensure bgp does not stop monitoring nexthops
Ensure community data is freed in some cases.
Ensure that the correct aspath is free'd
Fix `match peer` when switching between ipv4/ipv6/interface
Fix `no set as-path prepend asnum...`
Fix bgp_best_selection heap-use-after-free
Fix crash when deleting the srv6 locator
Fix display when using `missing-as-worst`
Fix dynamic peer graceful restart race condition
Fix ecommunity_fill_pbr_action heap-buffer-overflow
Fix error handling when receiving bgp prefix sid attribute
Fix errors handling for mp/gr capabilities as dynamic capability
Fix format overflow for graceful-restart debug logs
Fix logging message when receiving a software version capability
Fix no bgp as-path access-list issue
Fix route-map match probability deconfiguration callback
Fix srv6 memory leak detection
Fix the order of null check and zapi decode
Fix vrf leaking with 'no bgp network import-check
Free memory for srv6 functions and locator chunks
Ignore validating the attribute flags if path-attribute is configured
Include unsuppress-map as a valid outgoing policy
Lttng tp add evpn route events
Make `suppress-fib-pending` clear peering
Note when receiving but not understanding a route notification
Prevent from one more cve triggering this place
Set correct ttl for the dynamic neighbor peers
Update default-originate route-map actual map structure
Revert "Fix pointer arithmetic in bgp snmp module"
doc
Add param range for graceful-restart helper supported-grace-time
Remove duplicated show route-map
isisd
Fix _isis_spftree_del heap-use-after-free
Fix dislaying lsp id
Fix heap-after-free with prefix sid
Fix ip/ipv6 reachability tlvs
lib
Check for not being a blackhole route
Fix show route map json output
Do not convert evpn prefixes into ipv4/ipv6 if not needed
Replace deprecated ares_gethostbyname
Replace deprecated ares_process()
nhrpd
Fix race condition
Fix core dump on shutdown
ospf6d
Ospfv3 route change comparision fixed for asbr-only change
Prevent heap-buffer-overflow with unknown type
ospfd
Add support for "no router-info [<area|as>] command"
Can not delete "segment-routing node-msd" when sr if off
Correct lsa parser which fulfill the ted
Correct opaque lsa extended parser
Correct sid check size
Fix ospf dead-interval minimal hello-multiplier param range
Fix the bug where ip_ospf_dead-interval_minimal_hello-multiplier did
not reset hello timer
Protect call to get_edge() in ospf_te.c
Solved crash in ospf te parsing
Solved crash in ri parsing with ospf te
Revert "Fix some dicey pointer arith in snmp module"
pbrd
Fix map seq installed flag in json
Fix pbr handling for last rule deletion
pimd
Fix crash unconfiguring rp keepalive timer
Fix crash when configuring ssmpingd
Fix dr-priority range
Fix null register before aging out reg-stop
Fix order of operations for evaluating join
Re-evaluated s,g oils upon rp changes and for empty sg upstream oils
Fix crash when mixing ssm/any-source joins
staticd
Fix changing to source auto in bfd monitor
tests
Check for 0.0.0.0/1 in bgp_default_route
Check if ibgp session can drop invalid aigp attribute
Extend tests for aspath exclude
Update ospf te topotests
tools
Apply black formatting for tools/frr-reload.py
Fix frr-reload interface desc cmd
Fix frr-reload multiple no description cmds
Fix frr-reload multiple no description cmds
Use error log level when failing to execute commands via frr-reload.py
topotests
Do not check table version
Redispatch tests in bfd_topo3
Test wrong bfd source in bfd_topo3
Vpnv4 route leaking with no import-check
vtysh
Show `ip ospf network ...` even if it's not the same as the
interface type
zebra
Add missing whitespace when printing route entry status
Deny the routes if ip protocol cli refers to an undefined rmap
Don't deref vxlan-vni array
Fix crash if macvlan link in another netns
Fix crash on macvlan link down/up
Fix evpn svd based remote nh neigh del
Fix mpls command
Fix route deletion during zebra shutdown
The dplane_fpm_nl return path leaks memory
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Adolf Belka
|
733e957885 |
freeradius: Update to version 3.2.5
- Update from version 3.2.3 to 3.2.5
- Update of rootfile
- Various options removed from ./configure as they are all unrecognised and don't have
any effect. Most of them look to have been related to freeradius-1.x
- There is no command that gets recognised for disabling or not using static libs
- Changelog
3.2.5
Feature Improvements
TOTP now supports TOTP-Time-Offset for tokens with times that are out of sync.
See mods-available/totp.
radclient now supports forcing the Request Authenticator and ID for
Access-Request packets.
Update dictionary.3gpp.
Update advice on shared secrets, including suggesting a secure method for
generating useful secrets.
Bug Fixes
Allow proxying by pool / home server name to work with auth+acct servers.
Fix OpenSSL API usage which sometimes caused crash in MS-CHAP Previously it
would either always crash immediately, or never crash.
Fix packet statistics. Stop double counting some packets, and track packet
statistics even if a socket is closed.
Reverted patch in TTLS which broke compatibility with some systems.
Don't crash in debug mode when multiple intermediate certs are used Patch
from Alexander Chernikov.
3.2.4
Feature Improvements
Preliminary support for TEAP.
Update EAP module pre_proxy checks to make them less restrictive This
prevents the "middle box" effect from affecting future traffic.
Many fixes and updates for Docker images.
Add dpsk module. See mods-available/dpsk.
Print out what cause the TLS operations to be made, such as the EAP method
name (peap, ttls, etc), or RADIUS/TLS listen / proxy socket.
Add auto_escape to sample SQL module config.
Add 'if not exists' to mysql create table queries. ref #5032 (#5137).
Update dictionary.aruba; add dictionary.tplink, dictionary.alphion.
Allow for 'encrypt=1' attributes to be longer than 128 characters.
Added "radsecret" program which generates strong secrets. See the top of the
"clients.conf" file for more information.
radclient now prints packets as hex when using -xxx.
Added "-t timeout" to radsniff. It will stop processing packets after
<timeout> seconds.
Support "interface = ..." on OSX and other *BSD which have IP_BOUND_IF.
The detail module now has a "dates_as_integer" configuration item See
mods-available/detail for more information.
Add lookback/lookforward steps and more configuration to totp. See
mods-available/totp.
Add "time_since" xlat to calculate elapsed time in seconds, milliseconds and
microseconds.
Support "Post-Auth-Type Challenge" in the inner tunnel. Patch from Alexander
Clouter. PR #5320.
Add "proxy_dedup_window". See radiusd.conf.
Document KRB5_CLIENT_KTNAME in the "env" section of radiusd.conf.
Add "dedup_key" for misbehaving supplicants. See mods-available/eap.
Bug Fixes
Fix corner case with empty defaults in rlm_files. Fixes #5035.
When we have multiple attributes of the same name, always use the canonical
attribute.
Make FreeRADIUS-Server-EMA* attributes work again for home server exponential
moving average statistics.
Don't send the global server stats when asked for client stats. They use the
same attributes, so the result is confusing.
Fix multiple typos in MongoDB query.conf (#5130).
Add define for illumos. Fixes #5135.
Add client configuration for TLS PSK.
Permit originate CoA after proxying to an internal virtual server.
Use virtual server "default" when passed "-i" and "-p" on the command line.
Fix locking issues with rlm_python3.
The detail file reader will catch bad times in the file, and will not update
Acct-Delay-Time with extreme values.
Fix issue where Message-Authenticator was calculated incorrectly for
CoA / Disconnect ACK and NAK packets.
Update Python thread and error handling. Fixes #5208.
Fix handling of Session-State when proxying. Fixes #5288.
Run relevant post-proxy Fail-* section on CoA / Disconnect timeout.
Add "limit" section to AWS health check configurtion. Fixes 35300.
Use MAX in sqlite queries instead of GREATEST.
Fix typo in Mongo queries. Fixes #5301.
Fix occasional crash with bad home servers. Fixes #5308.
Minor bug fixes to the SQL freetds modules.
Fix blocking issue with RADIUS/TLS connection checks.
Fix run-time crash on configuration typos of %{substr ...} instead of
%{substr:...} Fixes #5321.
Fix crash with TLS Status-Server requests. Fixes #5326.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
1561f65244 |
core188: Ship libxml2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
0216fe0228 |
libxml2: Update to version 2.13.3
- Update from version 2.12.3 to 2.13.3
- Update of rootfile
- CVE fixes in 2.13.3, 2.12.7, 2.12.5
- Changelog
2.13.3
### Security
- [CVE-2024-40896] Fix XXE protection in downstream code
### Regressions
- autotools: Use AC_CHECK_DECL to check for getentropy
- xinclude: Fix fallback for text includes
- io: Don't call getcwd in xmlParserGetDirectory
- io: Fix return value of xmlFileRead
- parser: Fix error return of xmlParseBalancedChunkMemory
### Improvements
- xinclude: Set error handler when parsing text
- Undeprecate xmlKeepBlanksDefault
2.13.2
### Regressions
- tree: Fix handling of empty strings in xmlNodeParseContent
- valid: Restore ID lookup
- parser: Reenable ctxt->directory
- uri: Handle filesystem paths in xmlBuildRelativeURISafe
- encoding: Make xmlFindCharEncodingHandler return UTF-8 handler
- encoding: Fix encoding lookup with xmlOpenCharEncodingHandler
- include: Define ATTRIBUTE_UNUSED for clang
- uri: Fix xmlBuildURI with NULL base
### Improvements
- uri: Enable Windows paths on Cygwin
- tests: Clarify licence of test/intsubset2.xml
2.13.1
### Regressions
- parser: Selectively reenable reading from "-"
- reader: Fix xmlTextReaderReadString
- xinclude: Set XPath context doc
- xinclude: Load included documents with XML_PARSE_DTDLOAD
- include: Don't redefine ATTRIBUTE_UNUSED
- include: Readd circular dependency between tree.h and parser.h
- xinclude: Add missing include (Jan Alexander Steffens (heftig))
- win32, msvc: fix missing linking against Bcrypt.lib (Miklos Vajna)
- xinclude: Don't raise error on empty nodeset
- parser: Make failure to load main document a warning
- tree: Fix freeing entities via xmlFreeNode
- parser: Pass global object to sax->setDocumentLocator
### Improvements
- io: Fix resetting xmlParserInputBufferCreateFilename hook
### Documentation
- Fix typo in NEWS (--with-html -> --with-http) (Ryan Carsten Schmidt)
- doc: Don't mention xmlNewInputURL
2.13.0
### Major changes
Most of the core code should now report malloc failures reliably. Some
API functions were extended with versions that report malloc failures.
New API functions for error handling were added:
- xmlCtxtSetErrorHandler
- xmlXPathSetErrorHandler
- xmlXIncludeSetErrorHandler
This makes it possible to register per-context error handlers without
resorting to global handlers.
A few error messages were improved and consolidated. Please update
downstream test suites accordingly.
A new parser option XML_PARSE_NO_XXE can be used to disable loading
of external entities or DTDs. This is most useful in connection with
XML_PARSE_NOENT.
Support for HTTP POST was removed.
Support for zlib, liblzma and HTTP is now disabled by default and has
to be enabled by passing --with-zlib, --with-lzma or --with-http to
configure. In legacy mode (--with-legacy) these options are enabled
by default as before.
Support for FTP will be removed in the next release.
Support for the range and point extensions of the xpointer() scheme
will be removed in the next release. The rest of the XPointer
implementation won't be affected. The xpointer() scheme will behave
like the xpath1() scheme.
Several more legacy symbols were deprecated. Users of the old "SAX1"
API functions are encouraged to upgrade to the new "SAX2" API,
available since version 2.6.0 from 2003.
Some deprecated global variables were made const:
- htmlDefaultSAXHandler
- oldXMLWDcompatibility
- xmlDefaultSAXHandler
- xmlDefaultSAXLocator
- xmlParserDebugEntities
### Deprecations and removals
- threads: Deprecate remaining ThrDef functions
- unicode: Deprecate most xmlUCSIs* functions
- memory: Remove memory debugging
- tree: Deprecate xmlRegisterNodeDefault
- tree: Deprecate xmlSetCompressMode
- html: Deprecate htmlHandleOmittedElem
- valid: Deprecate internal validation functions
- valid: Deprecate old DTD serialization API
- nanohttp: Deprecate public API
- Remove VMS support
- Remove Trio
### Bug fixes
- parser: Fix base URI of internal parameter entities
- tree: Handle predefined entities in xmlBufGetEntityRefContent
- schemas: Allow unlimited length decimals, integers etc. (Tomáš Ženčák)
- reader: Fix preservation of attributes
- parser: Always decode entities in namespace URIs
- relaxng: Fix tree corruption in xmlRelaxNGParseNameClass (Seiya Nakata)
- schemas: Fix ADD_ANNOTATION
- tree: Fix tree iteration in xmlDOMWrapRemoveNode
- tree: Declare namespace on clone in xmlDOMWrapCloneNode
- tree: Fix xmlAddSibling with last sibling
- tree: Fix xmlDocSetRootElement with multiple top-level elements
- catalog: Fetch XML catalog before dumping
- html: Don't close fd in htmlCtxtReadFd
### Improvements
- parser: Fix "Truncated multi-byte sequence" error
- Add missing _cplusplus processing clause (Sadaf Ebrahimi)
- parser: Rework handling of undeclared entities
- SAX2: Warn if URI resolution failed
- parser: Don't report error on invalid URI
- xmllint: Clean up option handling
- xmllint: Rework parsing
- parser: Don't create undeclared entity refs in substitution mode
- Make some globals const
- reader: Make xmlTextReaderReadString non-recursive
- reader: Rework xmlTextReaderRead{Inner,Outer}Xml
- Remove redundant size check (Niels Dossche)
- Remove redundant NULL check on cur (Niels Dossche)
- Remove always-false check old == cur (Niels Dossche)
- Remove redundant NULL check on cur (Niels Dossche)
- tree: Don't return empty localname in xmlSplitQName{2,3}
- xinclude: Don't try to fix base of non-elements
- tree: Don't coalesce text nodes in xmlAdd{Prev,Next}Sibling
- SAX2: Optimize appending children
- tree: Align xmlAddChild with other node insertion functions
- html: Use binary search in htmlEntityValueLookup
- io: Allocate output buffer with XML_BUFFER_ALLOC_IO
- encoding: Don't shrink input too early in xmlCharEncOutput
- tree: Tighten source doc check in xmlDOMWrapAdoptNode
- tree: Check destParent->doc in xmlDOMWrapCloneNode
- tree: Refactor text node updates
- tree: Refactor node insertion
- tree: Refactor element creation and parsing of attribute values
- tree: Simplify xmlNodeGetContent, xmlBufGetNodeContent
- buf: Don't use default buffer size for small strings
- string: Fix xmlStrncatNew(NULL, "")
- entities: Don't allow null name in xmlNewEntity
- html: Fix quadratic behavior in htmlNodeDump
- tree: Rewrite xmlSetTreeDoc
- valid: Rework xmlAddID
- tree: Remove unused node types
- tree: Make namespace comparison more consistent
- tree: Don't allow NULL name in xmlSetNsProp
- tree: Rework xmlNodeListGetString
- tree: Rework xmlTextMerge
- tree: Rework xmlNodeSetName
- tree: Simplify xmlAddChild with text parent
- tree: Disallow setting content of entity reference nodes
- tree: Rework xmlReconciliateNs
- schemas: fix spurious warning about truncated snprintf output
(Benjamin Gilbert)
- xmlschemastypes: Remove unreachable if statement (Maks Mishin)
- relaxng: Remove useless if statement (Maks Mishin)
- tree: Check for integer overflow in xmlStringGetNodeList
- http: Improve error message for HTTPS redirects
- catalog: Remove Windows hack
- save: Move DTD serialization code to xmlsave.c
- parser: Report fatal error if document entity couldn't be loaded
- xpath: Fix return of empty node-set in xmlXPathNodeCollectAndTest
- SAX2: Limit entity URI length to 2000 bytes
- parser: Account for full size of non-well-formed entities
- parser: Pop inputs if parsing DTD failed
- parser: Fix quadratic behavior when copying entities
- writer: Implement xmlTextWriterClose
- parser: Avoid duplicate namespace errors
- parser: Add XML_PARSE_NO_XXE parser option
- parser: Make xmlParseContent more useful
- error: Make xmlFormatError public
- encoding: Check whether encoding handlers support input/output
- SAX2: Enforce size limit in xmlSAX2Text with XML_PARSE_HUGE
- parser: Lower maximum entity nesting depth
- parser: Set depth limit to 2048 with XML_PARSE_HUGE
- parser: Implement xmlCtxtSetOptions
- parser: Always prefer option members over bitmask
- parser: Don't modify SAX2 handler if XML_PARSE_SAX1 is set
- parser: Rework parsing of attribute and entity values
- save: Output U+FFFD replacement characters
- parser: Simplify entity size accounting
- parser: Avoid unwanted expansion of parameter entities
- parser: Always copy content from entity to target
- parser: Simplify control flow in xmlParseReference
- parser: Remove xmlSetEntityReferenceFunc feature
- parser: Push general entity input streams on the stack
- parser: Move progressive flag into input struct
- parser: Fix in-parameter-entity and in-external-dtd checks
- xpath: Rewrite substring-before and substring-after
- xinclude: Only set xml:base if necessary
- xinclude: Allow empty nodesets
- parser: Rework general entity parsing
- io: Fix close error handling
- io: Fix read/write error handling
- io: More refactoring and unescaping fixes
- io: Move some code from xmlIO.c to parserInternals.c
- uri: Clean up special parsing modes
- xinclude: Rework xml:base fixup
- parser: Also set document properties when push parsing
- include: Move non-generated parts from xmlversion.h.in
- io: Remove support for HTTP POST
- dict: Move local RNG state to global state
- dict: Get random seed from system PRNG
- io: Don't use "-" to read from stdin
- io: Rework initialization
- io: Consolidate error messages
- xzlib: Fix harmless unsigned integer overflow
- io: Always use unbuffered input
- io: Fix detection of compressed streams
- io: Pass error codes from xmlFileOpenReal to xmlNewInputFromFile
- io: Rework default callbacks
- error: Stop printing some errors by default
- xpath: Don't free nodes of XSLT result value trees
- valid: Fix handling of enumerations
- parser: Allow recovery in xmlParseInNodeContext
- encoding: Support ASCII in xmlLookupCharEncodingHandler
- include: Remove useless 'const' from function arguments
- Avoid EDG -Wignored-qualifiers warnings on wrong 'const *' to '* const'
conversions (makise-homura)
- Avoid EDG deprecation warnings for LCC compiler (makise-homura)
- Avoid EDG -Woverflow warnings on truncating conversions by manually
truncating operand (makise-homura)
- Avoid EDG -Wtype-limits warnings on unsigned comparisons with zero by
conversion from unsigned int to int (makise-homura)
- Avoid using no_sanitize attribute on EDG even if compiler shows as GCC
(makise-homura)
### Build systems
- meson: convert boolean options to feature option (Rosen Penev)
- meson: Pass LIBXML_STATIC in dependency (Andrew Potter)
- meson: fix compilation with local binaries (Rosen Penev)
- meson: don't use dl dependency on old meson (Rosen Penev)
- meson: fix usage as a subproject (Rosen Penev)
- autotools: Fix pthread detection on FreeBSD
- build: Remove --with-fexceptions configuration option
- autotools: Remove --with-coverage configuration option
- build: Disable HTTP support by default
- Stop defining _REENTRANT
- doc: Don't install example code
- meson: Initial commit (Vincent Torri)
- build: Disable support for compression libraries by default
- Set LIBXML2_FOUND if it has been properly configured (Michele Bianchi)
- Makefile.am: omit $(top_builddir) from DEPS and LDADDS (Mike Dalessio)
### Test suite
- runtest: Work around broken EUC-JP support in musl iconv
- runtest: Check for IBM-1141 encoding handler
- fuzz: Add xmllint fuzzer
- fuzz: Add fuzzer for XML reader API
- fuzz: New tree API fuzzer
- tests: Remove testOOM
- Don't let gentest.py cast types to 'const somethingPtr' to avoid
-Wignored-qualifiers (makise-homura)
2.12.8
### Regressions
- parser: Fix performance regression when parsing namespaces
2.12.7
### Security
- [CVE-2024-34459] Fix buffer overread with `xmllint --htmlout`
### Regressions
- xmllint: Fix --pedantic option
- save: Handle invalid parent pointers in xhtmlNodeDumpOutput
2.12.6
### Regressions
- parser: Fix detection of duplicate attributes in XML namespace
- xmlreader: Fix xmlTextReaderConstEncoding
- html: Fix htmlCreatePushParserCtxt with encoding
- xmllint: Return error code if XPath returns empty nodeset
2.12.5
### Security
- [CVE-2024-25062] xmlreader: Don't expand XIncludes when backtracking
### Regressions
- parser: Fix crash in xmlParseInNodeContext with HTML documents
2.12.4
### Regressions
- parser: Fix regression parsing standalone declarations
- autotools: Readd --with-xptr-locs configuration option
- parser: Fix build --without-output
- parser: Don't grow or shrink pull parser memory buffers
- io: Fix memory lifetime issue with input buffers
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
6f16477a9c |
core188: Ship libuv
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
1bbb3e3684 |
core188: Ship libusb
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
5814de8054 |
libusb: Update to version 1.0.27
- Update from version 1.0.26 to 1.0.27
- Update of rootfile
- Changelog
1.0.27
* New libusb_init_context API to replace libusb_init
* New libusb_get_max_alt_packet_size API
* New libusb_get_platform_descriptor API (BOS)
* Allow setting log callback with libusb_set_option/libusb_init_context
* New WebAssembly + WebUSB backend using Emscripten
* Fix regression in libusb_set_interface_alt_setting
* Fix sync transfer completion race and use-after-free
* Fix hotplug exit ordering
* Linux: NO_DEVICE_DISCOVERY option set per context
* macOS: Fix missing device list cleanup locking
* macOS: Do not clear device data toggle for newer OS versions
* macOS: Fix running binaries on older OS than build host
* Windows: Allow claiming multiple associated interfaces
* Windows: Ignore non-configured devices instead of waiting
* Windows: Improved root hub detection
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
3807bb2ada |
core188: Ship libsodium
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
db9698c9cc |
libsodium: Update to version 1.0.20
- Update from version 1.0.19 to 1.0.20
- Update of rootfile
- Changelog
1.0.20
This point release includes all the changes from 1.0.19-stable,
mainly addressing compilation issues and improvements to the .NET
packages.
* Version 1.0.19-stable
- Building with `zig build` now requires Zig 0.12.
- When using the traditional build system, -O3 is used instead of -Ofast.
- Improved detection of the compiler flags required on aarch64.
- Improved compatibility with custom build systems on aarch64.
- apple-xcframework: VisionOS packages are not built if Xcode doesn't
include that SDK.
- `crypto_kdf_hkdf_sha512_statebytes()` was added.
- When using Visual Studio, runtime CPU feature detection is now enabled
on Windows/aarch64.
- There were issues with C++ guards affecting usage of libsodium
using Swift on Windows. This has been fixed.
- Emscripten: `crypto_aead_aegis*()` functions are now exported in
JavaScript builds
- Emscripten: unsupported `--memory-init-file` option has been removed.
- apple-xcframework: the minimal deployment target can be set to iOS 11+.
- .NET packages now include precompiled libraries for Windows/arm64,
iOS, TvOS and Catalyst.
- .NET precompiled libraries now work on any CPUs, using only runtime
feature detection.
- SYSV assembly should not be used when targeting Windows (reported by
@meiyese, thanks!)
- Compatibility issues with LLVM 18 and AVX512 have been addressed.
- GitHub attestation build provenance are now added to NuGet packages.
- JavaScript tests can now use Bun as an alternative to Node.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
4ca8417fe3 |
core188: Ship libtirpc
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
c692b5ca7e |
core188: Ship libtiff
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
5bc1ac8143 |
libtiff: Update to version 4.6.0
- Update from version 4.5.1 to 4.6.0
- Update of rootfile
- Included options to disable static library and docs.
- The removed functionality mentioned in the changelog below was already mentioned in
earlier version updates. As far as I could tell none of the functionality that has
been removed is used in IPFire.
- Changelog
4.6.0
Major changes warning
This version removes a big number of utilities that have suffered from lack of
maintenance over the years and were the source of various reported security
issues. See "Removed functionality" below for the list of removed utilities.
Starting with libtiff v4.6.0, the source code for most TIFF tools
(except tiffinfo, tiffdump, tiffcp and tiffset) was discontinued, due to the
lack of contributors able to address reported security issues. tiff2ps and
tiff2pdf source code has been moved in a unsupported category, no longer built
by default, but are still part of the the source distribution. Other retired
utilities are in a archive/ directory, only available in the libtiff git
repository. Issues related to unsupported and archived tools will no longer be
accepted in the libtiff bug tracker.
Software configuration changes
TiffConfig.cmake.in: set TIFF_INCLUDE_DIR, TIFF_INCLUDE_DIRS and
TIFF_LIBRARIES for compatibility with FindTIFF.cmake as shipped by CMake
(fixes issue #589)
Update CMake and autoconf scripts to consistently update LibTIFF version
defines and references in various files when version definition in
configure.ac has been changed.
Move in tiffvers.h from libtiff source directory to libtiff build
directory.
Remove unused version information from tif_config.h
With every CMake build the version defines (e.g. 4.5.1) within tiffvers.h
are consistently updated from configure.ac. The version release-date is
taken from file RELEASE-DATE.
The files VERSION and RELEASE-DATE are only updated with a special CMake
target build: cmake --build . --target tiff_release.
For autotools, version information is updated from configure.ac with
./autogen.sh. LIBTIFF_RELEASE_DATE is taken form file RELEASE-DATE.
./configure generates tiffvers.h with the cached version information and
LIBTIFF_RELEASE_DATE.
"make release" updates tiffvers.h and VERSION file with cached version
info and RELEASE-DATE file and tiffves.h with the current date.
CMake: fix build with -Dstrip-chopping=off (fixes issue #600)
Library changes
New/improved functionalities:
Fix using __attribute__ libtiff with clang-for-windows
Bug fixes:
WebP decoder: validate WebP blob width, height, band count against TIFF
parameters to avoid use of uninitialized variable, or decoding corrupted
content without explicit error (fixes issue #581, issue #582).
WebP codec: turn exact mode when creating lossless files to avoid altering
R,G,B values in areas where alpha=0
(https://github.com/OSGeo/gdal/issues/8038)
Fix TransferFunction writing of only two transfer functions.
TIFFReadDirectoryCheckOrder: avoid integer overflow. When it occurs, it
should be harmless in practice though
(https://gitlab.com/libtiff/libtiff/-/merge_requests/512)
Documentation
TiffField functions documentation updated with return behaviour for not
defined tags and determination of write-/read-count size.
Tools changes
Removed functionality:
The following tools are no longer compiled and have been moved to
archive/tools:
fax2ps
fax2tiff
pal2rgb
ppm2tiff
raw2tiff
rgb2ycbcr
thumbnail
tiff2bw
tiff2rgba
tiffcmp
tiffcrop
tiffdither
tiffgt
tiffmedian
The following tools are no longer compiled by default: tiff2ps and tiff2pdf.
They have been moved to tools/unsupported. They can be built by setting
--enable-tools-unsupported for autoconf, or -Dtiff-tools-unsupported for
CMake, but as the name imply, they are no longer supported by upstream.
Packagers are suggested not to enable those options.
tiffcp: remove -i option (ignore errors), because almost all fuzzer issues
were consequential errors from ignored errors because of the "-i" option.
Bug fixes:
tiffset: fix #597: warning: comparison of integer expressions of different
signedness. (fixes issue #597)
tiffcp: fix memory corruption (overflow) on hostile images (fixes issue #591)
Test changes
Add missing test_write_read_tags.c and test_transferfunction_write_read.c in
tarball (fixes issue #585) and correct "long" issue.
Don't use "long" because can be int32_t or int64_t, depending on compiler
and system.
Changes to contributed and unsupported tools
raw2tiff: fix integer overflow and bypass of the check (fixes issue #592)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
56b9d098bf |
core188: Ship libqmi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
5d00ef14b0 |
libqmi: Update to version 1.34.0
- Update from version 1.30.8 to 1.34.0
- Update of rootfile
- Autotools build has been removed in 1.32.0 and changed to meson. In previous autotools
version other protocol options were auto checked and if dependencies were not present
then the options were not built. In meson those are defined by default as being
required and if dependencies are not present then the build fails. So those other
options have to be explicitly made false for meson.
- Library is only built in shared form.
- man pages have been disabled.
- Changelog
1.34.0
* Build:
** Flag types are now generated in their own 'qmi-flag-types.[c|h]' files.
** A new 'enable_fuzzer' option is available to build LLVM LibFuzzer
based unit testers.
* New services:
** New 'ATR' service to support AT commands over QMI, defined by Telit,
including "Send" request and "Received" indication.
** New 'IMS' service, including "Get IMS Services Enabled Setting"
request/response.
** New 'IMSA' (IMS Application) service, including "Get IMS Registration
Status" and "Get IMS Services Status" request/responses.
** New 'IMSP' (IMS Presence) service, including "Get Enabler State"
request/response.
** New 'SSC' service (Qualcomm Snapdragon Sensor Core), including the
"Control" request/response, and "Report Small"/"Report Large"
indications.
* New TLVs supported in existing messages:
** nas: added the "WCDMA RSCP" TLV in "Get Signal Info" response and "Signal
Info" indication.
** wds: added the "Report Profile Changes" TLV in "Indication Register".
* libqmi-glib:
** Support for 16-bit service ids added, used in the QRTR backend.
** Response and indication parser messages are now published in the API.
** The library now allows connecting to a unix domain socket named
'qmux_socket' instead of a device file.
** Extended the 'QmiWdsProfileType' enum type with EPC and ALL values.
** Extended the 'QmiUimCardApplicationPersonalizationFeature' enum type with
additional GW-related values.
** New 'QmiUimCardApplicationPersonalizationFeatureStatus' enum type.
** New 'QmiImspEnablerState' enum type, used in the IMPS service.
** New 'QmiImsaImsRegistrationStatus', 'QmiImsaServiceStatus' and
'QmiImsaRegistrationTechnology' enum types, used in the IMSA service.
** Updated the QRTR endpoint to ensure error responses are returned early
when the builtin CTL operations fail.
** Deprecated QMI_UIM_CARD_APPLICATION_PERSONALIZATION_FEATURE_UNKNOWN, and
provided compat symbols.
** Updated the enum type of the "Personalization Feature" field in the
Element struct type used in the Applications array in the "UIM Card
Status" response and indication messages, and provided appropriate compat
symbols.
** Flagged PIN/PUK value fields as personal info.
** Fixed missing 'since' tags in struct and common types.
* qmicli:
** New '--uim-remote-unlock' command.
** New '--imsp-get-enabler-state' command.
** New '--imsa-get-ims-registration-status' and
'--imsa-get-ims-services-status' commands.
** New '--ims-get-ims-services-enabled-setting' command.
** New '--atr-send', '--atr-send-only' and '--atr-monitor' commands.
* collections:
** basic: added NAS cell location retrieval commands.
** basic: added WDS profile event change commands.
* Several other minor improvements and fixes.
* All fixes and improvements that were backported to 1.32.x releases are also
present in libqmi 1.34.0.
1.32.0
* There is no longer an upstream-provided source tarball, please use the signed
git tag '1.32.0' instead to refer to the sources of this release.
* The verbose message logging will now by default hide all fields that are
considered personal information. Extended message logging including all
field contents should be explicitly requested.
* Build:
** The GNU autotools (autoconf/automake/libtool) support has been fully
removed, this release requires the use of the meson build system.
** The 'instrospection' meson option is now a boolean.
** New boolean 'man' meson option to allow disabling the man page generation.
* New services:
** New 'FOX' service for operations defined by Foxconn, including "Get
Firmware Version" for now.
* New request/response/indications:
** pdc: implement "Refresh" indication.
** gas: implement "DMS Get USB composition" request/response.
** gas: implement "DMS Set USB composition" request/response.
** wds: implement "Indication Register" request/response.
** wds: implement "Extended Ip Config" indication.
** dsd: implement "Get System Status" request/response.
** dsd: implement "System Status Change" request/response.
** dsd: implement "System Status" indication.
** voice: implement "Burst DTMF" request/response.
** voice: implement "Start Continuous DTMF" request/response.
** voice: implement "Stop Continuous DTMF" request/response.
** uim: implement "Remote Unlock" request/response.
** nas: implement "Config Signal Info v2" request/response.
* New TLVs supported in existing messages:
** pdc: added "Enable Refresh" TLV in "Register" request.
** nas: added "5G Signal Strength" TLV in "Signal Info" indication.
** dms: added "NR5G Band Capability" TLV in "Get Band Capabilities" response.
** nas: added "NR5G SA/NSA band preference" TLVs in "Get/Set System Selection
Preference" request/response.
** wds: added "Operator Reserved PCO" TLV in "Get Current Settings".
** wda: added "Uplink Data Aggregation Max Datagrams" TLV in "Set Data
Format" request.
** wda: added "Uplink Data Aggregation Max Size" TLV in "Set Data Format"
request.
* libqmi-glib:
** New 'QmiFoxFirmwareVersionType' enum type.
** New 'QmiPdcRefreshEventType' enum type.
** New 'QmiGasUsbCompositionEndpointType' enum type.
** New 'QmiDsdDataSystemNetworkType' enum type.
** New 'QmiDsdRadioAccessTechnology' enum type.
** New 'QmiDsdSoMask' enum type.
** New 'QMI_DMS_RADIO_INTERFACE_TDS' value in the 'QmiDmsRadioInterface' enum
type.
** New 'QMI_WDS_GET_CURRENT_SETTINGS_REQUESTED_SETTINGS_OPERATOR_RESERVED_PCO'
value in 'QmiWdsGetCurrentSettingsRequestedSettings'.
** New 'QMI_DEVICE_ADD_LINK_FLAGS_INGRESS_MAP_CKSUMV5' and
'QMI_DEVICE_ADD_LINK_FLAGS_INGRESS_MAP_CKSUMV5' values in the
'QmiDeviceAddLinkFlags' enum type, enabling support to request QMAPv5
checksum offload for both TX and RX paths.
** Extended the 'QmiNasActiveBand' enum type with 5GNR bands.
** Implemented support to monitor the consecutive QMI request timeouts in the
QmiDevice object, with a 'QMI_DEVICE_CONSECUTIVE_TIMEOUTS' signal and a
'qmi_device_get_consecutive_timeouts()' method.
** Fixed the "GERAN Info" TLV in "NAS Get Cell Location Info" compat layer.
** Fixed leak on unexpected message error processing in QmiDevice.
** Renamed the 'QmiWdsGetCurrentSettingsRequestedSettings' flags type to
'QmiWdsRequestedSettings'.
** Updated the code generator to avoid needing intermediate struct types in
several operations, and provided appropriate compat methods:
*** pdc: removed the 'QmiConfigTypeAndId' intermediate struct.
*** loc: removed the 'QmiIndicationLoc...GpsTime intermediate' structs.
*** loc: removed the 'QmiIndicationLoc...DilutionOfPrecision' intermediate
structs.
*** dms: removed the 'QmiMessageDmsGetStoredImageInfoInputImage'
intermediate struct.
*** dms: removed the 'QmiMessageDmsDeleteStoredImageInputImage'
intermediate struct.
** Updated the code generator to avoid needing arrays of arrays in several
operations, and provided appropriate compat methods:
*** uim: avoid array of arrays in "Slot EID Information".
*** uim: avoid array of arrays in "Personalization Status Other".
** Updated the code generator to generate GIR compat helpers for arrays of
structs, so that language bindings can properly use the methods using
that kind of types. This change makes the library include a lot of new
methods suffixed with _gir() which are only expected to be used via
introspection.
** Implemented a lot of cleanups and improvements in the code generator.
* qmicli:
** New '--verbose-full' option to request enabling logs that include personal
information.
** New '--pdc-monitor-refresh' command.
** New '--gas-dms-set-usb-composition' and '--gas-dms-get-usb-composition'
commands.
** New '--wms-set-routes' command.
** New '--dsd-get-system-status' command.
** Updated the '--wda-set-data-format' command with new optional fields to
configure the uplink data aggregation max size and max datagrams.
* qmi-firmware-update:
** Implemented support for normal upgrade operations even when udev is not
available in the system (e.g. openwrt).
* collections:
** basic: added UIM remote unlock operation.
** basic: added NAS signal info v2 operation.
** basic: added SAR management operations.
** basic: added LTE attach PDN list operation.
** basic: added PCO support related operations.
** basic: added Foxconn firmware version management operation.
** basic: added DSD system status and attach/detach related operations.
** basic: added voice DTMF support operations.
* Several other minor improvements and fixes.
The following features which were backported to 1.30.x releases are also present
in libqmi 1.32.0:
** libqmi-glib: use unaligned netlink attribute length.
** qmi-proxy: remove assert when attempting to close ghost device.
** qmi-firmware-update: use defaults if FLASH variables not reported,
enabling support to flash the Sierra Wireless EM91xx modules in USB mode.
** voice: implement "Get All Call Info" request/response.
** dms: implement "Foxconn Set FCC Authentication v2" request/response.
** qmicli: new '--dms-foxconn-set-fcc-authentication-v2' command.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
933387ccee |
core188: Ship libnl-3
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
924ba58b50 |
core188: Ship libcap
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
99b2ac48af |
libcap: Update to version 2.70
- Update from version 2.69 to 2.70 - Update of rootfile - sobump means following core packages need to be shipped arping cdrkit iproute2 iputils ntp squid udev and the following addons will be shipped with the pak_ver increments in the other patches that are part ofg this set avahi bacula cifs-utils dnsdist freeradius frr htop nfs rng-tools samba tor tshark vdr wavemon - Changelog 2.70 setcap changes to make it harder to set invalid file capabilities (Bug 217592\ reported by parke.nexus) Lots of documentation fixes (contributions from Jakub Wilk and Carlos Rodriguez-Fernandez) Fix c89 compilation syntax for the C code in the libraries. libpam has deprecated providing the _pam_overwrite() function, so use memset() instead Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Michael Tremer
|
8057ad9965 |
core188: Ship libnet
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
3192cd3036 |
libnet: Update to version 1.3
- Update from version 1.1.6 to 1.3
- Update of rootfile
- sobump gives suricata and arping as dependencies so those packages also need to be
shipped.
- Changelog
1.3
### Changes
- License change of critical files from 4-clause BSD to 3-clause and
2-clause BSD. This fixes issue #85: "GPL license compatibility".
- Migrate from Travis-CI (Linux) and Appveyor (Win32) to GitHub Actions
- Win32 changes:
- switch to npcap from winpcap
- Simplify and update build scripts
- Encode version in DLL instead of in filename
- Add support for LLDP, mandatory TLVs.
- Add support for Cisco UniDirectional Link Detection (UDLD), RFC5171
- Initial support for unit tests:
- `libnet-build_ethernet()`
- Complete UDLD API tests
- Initial "devcontainer": provide VS Code development environment for
rapid setup of a development environment
- Run unit tests in GitHub Actions
- New GitHub Action for FreeBSD 13 clang/gcc
- Calling `libnet_init()` with a RAW type no longer sets a TX buffer max
size. Use the new `libnet_setfd_max_sndbuf()` instead when needed.
- Remove support for `SOCK_PACKET` sockets causing invalid builds on,
e.g., musl libc. We assume everyone on Linux has `PF_PACKET` now.
### Fixes
- Fix #139: fail-to-build-from-source on FreeBSD
- Fix #122: unused parameter warnings
- Fix #123: potential memory leak in `libnet_cq_add()`
- Fix #124: potential name conflict with C++ keyword `new`
- Fix #96: pointer type warnings when dumping raw data with `%p`
- Fix #97: non-standard types:
- `int64_t` instead of `__int64_t` for mingw cross build
- `uint32_t` instead of `u_int` and `uint16_t` instead of `u_short`
- Fix #98: lots of signed vs unsigned comparisons
- Fix #102: possible buffer overflows in `libnet_plist_chain_dump_string()`
- Reproducible build fixes for man-page generation, use LC_ALL=C and UTC
- Simplify `fixmanpages`
- Fix #120: possible NULL pointer dereference in `libnet_cq_add()`
- Fix #120: memory leak in `libnet_plist_chain_new()`
- Fix segmentation fault in `libnet_ifaddrlist()`
- Fix #150: segfault when number of IPs > 512
1.2
### Changes
- Removed Lua bindings from repo and dist files, now available separately
- Removed generated HTML and Nroff (man pages) documentation files, must
be regenerated with Doxygen using `make doc`
- Add `pkg-config` support with `libnet.pc`, replaces `libnet-config`
tool, although it is kept for compatibility for now
- Factorize socket setup code for socket opening to provide output
device selection for IPv4
- Make `libnet_get_hwaddr()` work with 802.1q interfaces in bpf (BSD)
- New API for OSPF HELLO messages, with neighbor
### Fixes
- Use `getifaddrs()` on OpnBSD and Linux
- For samples, `netinet/in.h` is not on windows
- Fix errors with missing `IPPROTO_MH` on windows
- Fix build error on Mac OS X
- Fix #34 checksum caculation when IPv6 extension headers being used
- Remove unneeded trailing `-Wl` from `-version-info` line
- `libnet_build_snmp()` fix warning
- Use `LIBNET_*RESOLVE` const in `libnet_name2addr*`
- Fix i486 sample synflood6 warning
- Some samples need `#include<netinet/in.h>` for `IPPROTO_*` on OpenBSD 5.2
- Fix gcc warnings
- Check for `socklen_t`. Suggested by g.esp and Stefanos Harhalakis
- libnet: update for obsolete INCLUDE directive
- Fix warning inside comment
- Automatic link options `#pragma comment(lib, ...)` are only for MSVC
- Fix several warnings for MS C/C++ compiler
- `libnet_open_raw4()` doesn't return a SOCKET on win32
- Fixes error messages sometimes include newline, sometimes not
- Properly set `l->err_buf` if `libnet_ifaddrlist()` fails
- dlpi: Try harder to find the device for the interface
- dlpi: Correctly extract unit number from devices with numbers in their
name
- Make interface selection work for interfaces with multiple addresses
- Fix memory leak, device list needs to freed after use
- Fix file descriptor leak in `libnet_ifaddrlist()`
- Fix `libnet_get_hwaddr()` for large(!) number of interfaces
- Fix to support musl libc, removes support for GLIBC <2.1
- Fix win32 buffer overrun in `libnet_get_ipaddr4()`
- Interface selection was ignoring interfaces with IPv6
- Use `LIBNET_API` on public functions, instead of an export file
- Add Visual Studio 2010 project files, with build instructions
- Define INET6 on IRIX, making libnet compile cleanly
- Check for FreeBSD pre-11 before enabling `LIBNET_BSD_BYTE_SWAP`
- Use `LIBNET_BSDISH_OS` and `LIBNET_BSD_BYTE_SWAP` on Darwin
- Add BSD byteswap for Darwin. Otherwise `sendto(` returns `EINVAL`
- `netinet/in.h` is needed for `IPPROTO_` and `sockaddr_in`
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
3341244fef |
core188: Ship libgcrypt
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
0382036f71 |
netatalk: Update to version 3.2.5
- Update from version 3.1.2 to 3.2.5
- Update of rootfile
- Change to meson build
- Bundled libevent was removed in 3.1.13 so configure option no longer needed.
- The latest netatalk places the prefix value onto all other directories. No way to change
this via the meson options. So sysconfdir and localstatedir would end up being under
/usr. Patch created to remove the prefix value at the beginning of sysconfdir and
localstatedir so that the locations stay the same as for the previous versions.
- The default value for pam.d is in /usr/etc/ but option available to change this.
- Large number of CVE fixes in some of the updates - 3.2.1, 3.1.18, 3.1.17, 3.1.16,
3.1.15, 3.1.13, 3.1.12,
- Changelog
3.2.5
* BREAKING: meson: Allow choosing shared or static libraries to build,
GitHub #1321
In practice, only shared libraries are built by default now.
Use the `default_library' option to control what is built.
* FIX: meson: Control the MySQL CNID backend, and support MariaDB, GitHub #1341
Introduces a new boolean `with-cnid-mysql-backend' option.
* FIX: meson: Implement with-init-dir option, GitHub #1346
* FIX: autotools/meson: Install FreeBSD init script into correct location,
GitHub #1345
* FIX: meson: Fix syntax error with libiconv path, GitHub #1279
* FIX: meson: Correct description for with-manual option, GitHub #1282
* FIX: meson: Correct prefix lookup for tracker-control, GitHub #1284
* FIX: meson: default OPEN_NOFOLLOW_ERRNO overwrites platform customization,
GitHub #1286
* FIX: meson: Don't make dtags depend on rpath, GitHub #1293
* FIX: meson: Remove duplicate dependency check for posix threads, GitHub #1297
* FIX: meson: Better output when cryptographic UAMs aren't built, GitHub #1302
* FIX: meson: Prioritize tests and run single-threaded to avoid race condition,
GitHub #1312
* FIX: meson: Better way to handle rpath executable targets, GitHub #1315
* FIX: meson: Refactor libcrypto check and print better status messages,
GitHub #1299
* FIX: meson: Look for libmariadb dependency to appease Fedora, GitHub #1348
* FIX: meson: Declare have_atfuncs globally to avoid failure later, GitHub #1357
* FIX: meson: Do a compiler sanity check before header checks, GitHub #1356
* FIX: Avoid using reserved keyword to build the tests on NetBSD, GitHub #1328
3.2.4
* UPD: autotools: Restore ABI versioning of libatalk,
and set it to 18.0.0, GitHub #1261
* UPD: meson: Define long-form soversion as 18.0.0, GitHub #1256
Previously, only `18' was defined.
* NEW: meson: Introduce pkgconfdir override option, GitHub #1241
The new option is called `with-pkgconfdir-path'
and is analogous to the `with-pkgconfdir' Autotools option.
Additionally, the hard-coded "netatalk" path suffix has been removed.
* NEW: meson: Introduce `debian' init style option
that installs both sysv and systemd, GitHub #1239
* FIX: meson: Add have_atfuncs check,
and make dtags dependent on rpath flag, GitHub #1236
* FIX: meson: Correct overwrite install logic for config files, GitHub #1253
* FIX: Fix typo in netatalk_conf.c log message
3.2.3
* UPD: Record note of permission to upgrade CNID code
to a later GPL, GitHub #1194
* UPD: Remove long-obsoleted cnid2_create script, GitHub #1203
* UPD: docker: Add option to enable ClearText and Guest UAMs, GitHub #1202
* FIX: docs: Standardize reference entry naming
for netatalk-config man page, GitHub #1208
* FIX: meson: Generate afppasswd manual html page, GitHub #1210
* UPD: meson: Remove obsolete 64 bit library check, GitHub #1207
* FIX: meson: Enable rpath for binaries
only when with-rpath is enabled, GitHub #1214
* FIX: meson: Require kerberos before enabling krb5 UAM,
not just GSSAPI, GitHub #1218
* FIX: meson: Restore linking with 64-bit libdb on Solaris, GitHub #1222
* FIX: meson: Fixing linking when building with
the `with-ssl-override' option, GitHub #1227
3.2.2
* UPD: meson: Use external SSL dependency to provide cast header, GitHub #1186
This reintroduces OpenSSL/LibreSSL as a dependency for the DHX UAM,
while removing all source files with the SSLeay copyright notice.
* UPD: meson: Add option to override system WolfSSL
with embedded WolfSSL: `with-ssl-override', GitHub #1176
* UPD: Remove obsolete Red Hat Upstart and SuSE SysV init scripts, GitHub #1163
* FIX: meson: Fix errors in PAM support macro, GitHub #1178
* FIX: meson: Fix perl shebang substitution in cnid2_create script, GitHub #1183
* FIX: meson: Fix operation of D-Bus path macros, GitHub #1182
* FIX: meson: Fix errors in shadow password macro, GitHub #1192
* FIX: autotools: gcc 8.5 expects explicit library flags
for libgcrypt, GitHub #1188
* NEW: Create a security policy, GitHub #1166
3.2.1
* FIX: CVE-2024-38439,CVE-2024-38440,CVE-2024-38441: Harden user login,
GitHub #1158
* BREAKING: meson: Rework option semantics and feature macros, GitHub #1099
- Consistent syntax of the build options to make them user-friendly
- Standardises the syntax of the feature macros
- Fixes the logic of the largefile support macro
- Disables gssapi support if the Kerberos V UAM is not required
- All options are now defined either as `with-*' or `with-*-path'
- Please see the Release Notes for a full list of changed options
* UPD: meson: Enable building with system WolfSSL library, GitHub #1160
- Build system will attempt to detect
that all required headers and symbols are supported
- Falls back to the bundled WolfSSL library
* FIX: meson: Fix -Doption paths on systems
where rpath is enabled by default, GitHub #1053
* FIX: meson: Fix library search macro on OmniOS hosts, GitHub #1056
* FIX: meson: Fix rules for installing scripts, GitHub #1070
- Install afpstats only when Perl is detected
- Don't install scripts only used by netatalk developers
* FIX: meson: set setuid bit to allow user afppasswd changing, GitHub #1071
* FIX: meson: Fix logic of libiconv detection macro, GitHub #1075
* FIX: meson: Address various issues with the meson build system, GitHub #1082
- Enables quota support on all flavours of linux and BSD, plus macOS
- Adds the quota provider to the configuration summary
- Adds a user option to disable LDAP support
- Sets dependencies according to user configuration
- Improves the syntax of the ACL macro
* FIX: meson: Further refinements to meson build system, GitHub #1086
- Adds user options to disable cracklib and GSSAPI support
- Automates Berkeley DB library detection on macOS
* FIX: meson: Fix issues with quota support on linux and macOS, GitHub #1092
- Enables quota support on macOS hosts
- Restores missing configuration option for linux hosts
- Removes obsolete quota configuration data for linux and macOS hosts
* FIX: meson: Set executable flags when installing scripts, GitHub #1117
* UPD: autotools and meson: Use pkg-config to find libgcrypt, GitHub #1132
- This removes dependency on the now-obsolete libgcrypt-config
* FIX: Use portable linux macro in etc/afpd header, GitHub #1083
* UPD: Debian Trixie expects systemd scripts in /usr/lib, GitHub #1135
* UPD: Add copyright for mac_roman.h, GitHub #1137
* FIX: Cleanup of copyright headers to make them scanner friendly, GitHub #1142
* FIX: Remove unused atalk/talloc.h header, GitHub #1154
* FIX: docker: Don't bail out when password is longer than 8 chars, GitHub #1067
* UPD: docker: Bump to Alpine 3.20 base image, GitHub #1111
* FIX: docker: Rework AFP user's GROUP and GID settings, GitHub #1116
- GID now requires GROUP to be set, and applies to that group
rather than that of the user.
* UPD: docs: Indicate license for software package,
and add SSLeay notice, GitHub #1125
* FIX: docs: Rephrase tarball section of manual, GitHub #1164
3.2.0
* NEW: BREAKING: Introduce the Meson build system, GitHub #707
GNU Autotools is still supported, but will be removed
in a future release. See the newly added INSTALL file.
* NEW: BREAKING: Bundle WolfSSL for DHX/RandNum UAM encryption, GitHub #358
This is enabled by default, controlled by option "-Dwith-embedded-ssl"
Requires the Meson build system.
External OpenSSL 1.1 and LibreSSL are still supported.
* NEW: BREAKING: LDAP API bump, OpenLDAP v2.3 or later required, GitHub #762
afp.conf option "ldap server" has been replaced with "ldap uri"
and has a new syntax. See the manual for details.
* UPD: BREAKING: Remove legacy cdb and tdb CNID backends, GitHub #508
* UPD: BREAKING: Remove Andrew File System (AFS) support, GitHub #554
* UPD: BREAKING: Remove bundled talloc, GitHub #479
For Spotlight support, use the talloc library supplied by your OS,
or get the source code from the Samba project and build it yourself.
* UPD: BREAKING: Remove generated SPARQL code, GitHub #337
This introduces a compile time dependency on
a yacc parser and a lexer to build with Spotlight support.
* UPD: BREAKING: Rename macOS launchd plist to io.netatalk.*, GitHub #778
Note: Only the Meson build system will clean up the old plist.
* UPD: BREAKING: Renamed Gentoo init script to openrc, GitHub #868
OpenRC is cross platform; confirmed working on Alpine Linux.
* NEW: FreeBSD init script, borrowed from FreeBSD ports, GitHub #876
Special thanks to the author, Joe Marcus Clarke.
* NEW: OpenBSD init script, GitHub #870
* NEW: Introduce an official Dockerfile and entry script, GitHub #713
* NEW: Option to log to file with second (not us) accuracy, GitHub #580
Enable with afp.conf option: "log microseconds = no"
* NEW: Option to add delay to FCE event emission, GitHub #849
Set a ms delay with afp.conf option: "fce sendwait"
* NEW: afppasswd: Add -w option to set password from the CLI, GitHub #936
* NEW: docs: Distribute a manual appendix with the GNU GPL v2, GitHub #745
* NEW: docs: Distribute the Japanese localization of the manual, GitHub #806
* NEW: docs: Generate a manual appendix with build instructions, GitHub #791
The appendix is generated from the GitHub CI workflow yaml file.
* UPD: docs: Document libraries, init scripts in manual, GitHub #808
* UPD: docs: Remove substituted file system paths from manual, GitHub #514
* FIX: afpd: Prevent theoretical crash in FPSetACL, GitHub #364
* FIX: libatalk: Fix parsing of macOS-created AppleDouble files, GitHub #270
* FIX: libatalk: Restore invalid EA metadata cleanup, GitHub #400
* FIX: quota: Use the NetBSD 6 quota API, GitHub #1028
* FIX: quota: Workaround for rquota.h symbol name on Fedora 40, GitHub #1040
* FIX: uams: Allow linking of the PGP UAM, GitHub #548
* FIX: Shore up error handling and type safety, GitHub #952
* UPD: Rewrite the afpstats script in Perl, GitHub #893
And, improve the formatting of the standard output.
Requires the Net::DBus Perl extension.
This removes the effective dependency on a Python runtime.
* UPD: Make Perl and grep optional requirements, GitHub #886
When either is missing, do not install the optional Perl scripts.
* NEW: Build system option "disable-init-hooks", GitHub #796
Will skip init script enablement commands that require
elevated privileges on the system.
* FIX: Make cracklib macro properly detect dictionary, GitHub #940
* FIX: Build with PAM support on FreeBSD 14, GitHub #560
* FIX: Allow libevent2 linking on OpenIndiana, GitHub #512
* FIX: Control all Spotlight dependencies at compile time, GitHub #571
* UPD: Remove redundant AUTHORS file, GitHub #538
3.1.18
* FIX: CVE-2022-22995: Harden create_appledesktop_folder(), GitHub #480
* FIX: Disable dtrace support on aarch64 FreeBSD hosts, Github #498
* FIX: Correct syntax for libwrap check in tcp-wrappers.m4, GitHub #500
* FIX: Correct syntax for libiconv check in iconv.m4, GitHub #491
* FIX: quota is not supported on macOS, GitHub #492
3.1.17
* FIX: CVE-2023-42464: Validate data type in dalloc_value_for_key(), GitHub #486
* FIX: Declare a variable before using it in a loop,
which was throwing off the default compiler on RHEL7, GitHub #481
* UPD: Distribute tarballs with xz compression by default, not gzip, GitHub #478
* UPD: Add AUTHOR sections to all man pages with a reference to CONTRIBUTORS,
and standardize headers and footers, GitHub #462
3.1.16
* FIX: libatalk: Fix CVE-2022-23121, CVE-2022-23123 regression
- Added guard check before access ad_entry(), GitHub#357
- Allow zero length entry, for AppleDouble specification, GitHub#368
- Remove special handling for COMMENT entries, GitHub#236
- The assertion for invalid entires is still enabled,
so please report any future "Invalid metadata EA" errors!
* FIX: build system: Fix autoconf warnings and modernize bootstrap
and configure.ac, GitHub#331
* FIX: build system: Correct syntax in libevent search macro,
summary macro and netatalk executable makefile, GitHub#342
* FIX: build system: Fix native libiconv detection on macOS, GitHub#343
* FIX: build system: Use non-interactive PAM session when available, GitHub#361
* FIX: build system: Fix detection of Berkeley DB installed
in multiarch location, GitHub#380
* FIX: build system: Fix support for cross-compilation
with mysql_config and dtrace, GitHub#384
* FIX: build system: Support building quota against libtirpc, GitHub#385
* FIX: build system: Fix variable substitution in configure summary, GitHub#443
* UPD: build system: Remove ABI checks and the --enable-developer option, GitHub#262
* FIX: initscript: Improvements to Debian SysV init script
- Source init-functions, GitHub#386
- Add a Description and Short-Description, GitHub#428
* FIX: docs: Clarify localstate dir configurability in manual, GitHub#401
* UPD: docs: Make BerkeleyDB 5.3.x the recommended version, GitHub#8
* FIX: docs: Update SourceForge URLs to fix CSS styles and download links
* FIX: docs: Remove obsoleted bug reporting sections, GitHub#455
* FIX: Sundry typo fixes in user visible strings and docs, GitHub#381, GitHub#382
* UPD: Rename asip-status.pl as asip-status
to make naming implementation-agnostic, GitHub#379
* UPD: Remove redundant uid.c|h files in etc/afpd
* UPD: Don't build and distribute deprecated cnid2_create tool, GitHub#412
* UPD: Remove deprecated megatron code and man page, GitHub#456
* UPD: Remove deprecated uniconv code and man page, GitHub#457
* UPD: Improvements to the GitHub CI workflow
3.1.15
* FIX: CVE-2022-43634
* FIX: CVE-2022-45188
* NEW: Support for macOS hosts, Intel and Apple silicon, GitHub#281
* FIX: configure.ac: update deprecated autoconf syntax
* UPD: configure.ac: Support linking with system shared libraries
Introduces the --with-talloc option
* FIX: macros: largefile-check macro for largefile (clang 16)
* UPD: macros: Update pthread macro to the latest from gnu.org
* FIX: initscripts: Modernize Systemd service file.
* FIX: libatalk/conf: include sys/file.h for LOCK_EX
* FIX: libatalk: Change log level for realpath() error, SF bug#666
* FIX: libatalk: Change log level for real_name error, SF bug#596
* FIX: libatalk: The my_bool type is deprecated as of MySQL 8.0.1, GitHub#129
* UPD: libatalk: allow afpd to read read-protected afp.conf, SF bug#546
* UPD: libatalk: Make the "valid users" option work in the Homes section, SF bug#449
* UPD: libatalk: Check that FPDisconnectOldSession is successful, SF bug#634
* UPD: libatalk: Bring iniparser library codebase in line with current version 4.1
* FIX: afpd: Provide MNTTYPE_NFS on OmniOS to make quota work, GitHub#117
* FIX: afpd: Avoid triggering realpath() lookups with empty path, GitHub#277
* FIX: spotlight: Spotlight searches can cause afpd to segfault, GitHub#56
* UPD: spotlight: add support for tracker3, SF patch#147
* FIX: macusers: Fix output for long usernames
* FIX: macusers: account for usernames with non-word characters
* FIX: macusers: Support NetBSD
* FIX: Fix all function declarations without a prototype
* FIX: Fix C99 compliance issues
* FIX: Fix gcc10 compiler warnings
* UPD: Remove acsiidocs sources and release notes script
* FIX: manpages: afp.conf: Parameters are not quoted, SF bug#617
* FIX: manpages: afp.conf: Document $u in home name, GitHub#123
* FIX: manpages: afp.conf: Document the usage of guest user, GitHub#298
* FIX: Document how the mysql cnid backend is configured, GitHub#69
* FIX: Fix user-visible typos in log output and man pages.
* FIX: Fix spelling, syntax, and dead URLs in html manual.
* NEW: Create README.md
* NEW: Set up GitHub workflow and static analysis with Sonarcloud
3.1.14
* FIX: fix build with libressl >= 2.7.0, GitHub#105
* NEW: Added Ignore Directories Feature
* UPD: Generate Unicode source code based on Unicode 14.0, GitHub#114
* FIX: Protect against removing AFP metadata xattr
* FIX: avoid setting adouble entries on symlinks
* FIX: add handling for cases where ad_entry() returns NULL, GitHub#175
* FIX: Fix setting of LD_LIBRARY_FLAGS ($shlibpath_var).
* FIX: afpstats: Fedora migrating away from IO::Socket::INET6, GitHub#130
* FIX: afpd: check return values from setXXid() functions, GitHub#115
* FIX: afpd: drop groups in become_user_permanently(), GitHub#126
* FIX: Fix use after free in get_tm_used()
* FIX: Fix sign extension problem in bsd_attr_list()
* FIX: Fix garbage read in bsd_attr_list
* FIX: make afpstats python 3 compatible
* UPD: docs: manual: Remove wrong TCP-over-TCP info; minor copy editing
* FIX: configure.ac: fix macro ordering for CentOS 6
* FIX: configure.ac: fix typo
* FIX: configure.ac: remove some trailing whitespace
* FIX: configure.ac: fix deprecated macro invocation
* FIX: configure.ac: replace obsolete macro
* FIX: libatalk/dsi/Makefile.am: fix deprecation warning
* FIX: Store AutoMake helper script in build-aux/
* FIX: configure.ac: define a dir for macros
* FIX: configure.ac: AM_CONFIG_HEADER is deprecated
* FIX: autotools: Fix another deprecation warning
* FIX: libgcrypt typo in configuration error message
* UPD: Various CI improvements
* FIX: libatalk/conf: re-generation of afp_voluuid.conf
* UPD: libatalk/conf: code cleanup and add locking to get_vol_uuid()
* UPD: add documentation for the lv_flags_t
* FIX: No need to check for attropen on Solaris, GitHub#44
3.1.13
* FIX: CVE-2021-31439
* FIX: CVE-2022-23121
* FIX: CVE-2022-23123
* FIX: CVE-2022-23122
* FIX: CVE-2022-23125
* FIX: CVE-2022-23124
* FIX: CVE-2022-0194
* FIX: afpd: make a variable declaration a definition
* UPD: Remove bundled libevent
3.1.12
* FIX: dhx uams: build with LibreSSL, GitHub#91
* FIX: various spelling errors
* FIX: CVE-2018-1160
3.1.11
* NEW: Global option "zeroconf name", FR#99
* NEW: show Zeroconf support by "netatalk -V", FR#100
* UPD: gentoo: Switch openrc init script to openrc-run, GitHub#77
* FIX: log message: name of function doese not match, GitHub#78
* UPD: volume capacity reporting to match Samba behavior, GitHub#83
* FIX: debian: sysv init status command exits with proper exit code, GitHub#84
* FIX: dsi_stream_read: len:0, unexpected EOF, GitHub#82
* UPD: dhx uams: OpenSSL 1.1 support, GitHub#87
3.1.10
* FIX: cannot build when ldap is not defined, bug #630
* FIX: SIGHUP can cause core dump when mdns is enabled, bug #72
* FIX: Solaris: stale pid file puts netatalk into maintenance mode, bug #73
* FIX: dsi_stream_read: len:0, unexpected EOF, bug #633
3.1.9
* FIX: afpd: fix "admin group" option
* NEW: afpd: new options "force user" and "force group"
* FIX: listening on IPv6 wildcard address may fail if IPv6 is
disabled, bug #606
* NEW: LibreSSL support, FR #98
* FIX: cannot build when acl is not defined, bug #574
* UPD: configure option "--with-init-style=" for Gentoo.
"gentoo" is renamed to "gentoo-openrc".
"gentoo-openrc" is same as "openrc".
"gentoo-systemd" is same as "systemd".
* NEW: configure option "--with-dbus-daemon=PATH" for Spotlight feature
* UPD: use "tracker daemon" command instead of "tracker-control" command
if Gnome Tracker is the recent version.
* NEW: configure options "--enable-rpath" and "--disable-rpath" which
can be used to force setting of RPATH (default on Solaris/NetBSD)
or disable it.
* NEW: configure option "--with-tracker-install-prefix" allows setting
an alternate install prefix for tracker when cross-compiling.
* UPD: asip-status.pl: IPv6 support
* UPD: asip-status.pl: show GSS-UAM SPNEGO blob
* FIX: afpd: don't use network IDs without LDAP, bug #621
* FIX: afpd: reading from file may fail, bug #619
* NEW: AFP clients should not be able to copy or manipulate special
extended attributes set by NFS and SMB servers on Solaris, issue #36
* FIX: ad: ad cp may crash, bug #622
* UPD: Update Unicode support to version 9.0.0
3.1.8
* FIX: CNID/MySQL: Quote UUID table names.
https://sourceforge.net/p/netatalk/bugs/585/
* FIX: Crash in cnid_metad, bug #593
* UPD: Update Unicode support to version 8.0.0
* FIX: larger server side copyfile buffer for improved IO performance,
bug #599
* NEW: afpd: new option "ea = samba". Use Samba vfs_streams_xattr
compatible xattrs which means adding a 0 byte at the end of
xattrs.
* FIX: remove #541 workaround patch. There was this problem with only early
Fedora 20.
* FIX: rpmbuild fails on Fedora x86_64, bug #598
* FIX: Listen on IPv6 wildcard address by default, bug #602
* FIX: FCE protocol version 1 packets, bug #603
* UPD: Update list of BerkeleyDB versions searched at configure time
3.1.7
* UPD: Spotlight: enhance behaviour for long running queries, client
will now show "progress wheel" while waiting for first results.
* FIX: netatalk: fix a crash on Solaris when registering with mDNS
* FIX: netatalk: SIGHUP would kill the process instead of being resent
to the other Netatalk processes, bug #579
* FIX: afpd: Solaris locking problem, bug #559
* FIX: Handling of malformed UTF8 strings, bug #524
* FIX: afpd: umask handling, bug #576
* FIX: Spotlight: Limiting searches to subfolders, bug #581
* FIX: afpd: reloading logging config may result in privilege
escalation in afpd processes
* FIX: afpd: ACL related error messages, now logged with loglevel
debug instead of error
* FIX: cnid_metad: fix tsockfd_create() return value on error
* FIX: CNID/MySQL: volume table name generation, bug #566.
3.1.6
* FIX: Spotlight: fix for long running queries
* UPD: afpd: distribute SIGHUP from parent afpd to children and force
reload shares
* FIX: netatalk: refresh Zeroconf registration when receiving SIGHUP
* NEW: configure option "--with-init-style=debian-systemd" for Debian 8 jessie
and later.
"--with-init-style=debian" is renamed "--with-init-style=debian-sysv".
3.1.5
* FIX: Spotlight: several important fixes
3.1.4
* FIX: afpd: Hangs in Netatalk which causes it to stop responding to
connections, bug #572.
* NEW: afpd: new option "force xattr with sticky bit = yes|no"
(default: no), FR #94
* UPD: afpd: FCE version 2 with new event types and new config options
"fce ignore names" and "fce notify script"
* UPD: afpd: check for modified included config file, FR #95.
* UPD: libatalk: logger: remove flood protection and allocate messages
* UPD: Spotlight: use async Tracker SPARQL API
* NEW: afpd: new option "case sensitive = yes|no" (default: yes)
In spite of being case sensitive as a matter of fact, netatalk
3.1.3 and earlier did not notify kCaseSensitive flag to the client.
Now, it is notified correctly by default, FR #62.
3.1.3
* UPD: Spotlight: more SPARQL query optimisations
* UPD: Spotlight: new options "sparql results limit", "spotlight
attributes" and "spotlight expr"
* FIX: afpd: Unarchiving certain ZIP archives fails, bug #569
* UPD: Update Unicode support to version 7.0.0
* FIX: Memory overflow caused by 'basedir regex', bug #567
* NEW: afpd: delete empty resource forks, from FR #92
* FIX: afpd: fix a crash when accessing ._ AppleDouble files created
by OS X via SMB, bug #564
* FIX: afpd and dbd: Converting from AppleDouble v2 to ea may corrupt
the resource fork. In some circumstances an offset calculation
is wrong resulting in corrupt resource forks after the
conversion. Bug #568.
* FIX: ad: fix for bug #563 broke ad file utilities, bug #570.
* NEW: afpd: new advanced option controlling permissions and ACLs,
from FR #93
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Adolf Belka
|
05971bd7d0 |
libgcrypt: Update to version 1.11.0
- Update from version 1.10.3 to 1.11.0
- Update of rootfile
- Update of libgcrypt requires an update of netatalk as old version will not build with
libgcrypt-1.11.0
- Changelog
1.11.0
* New and extended interfaces:
- Add an API for Key Encapsulation Mechanism (KEM). [T6755]
- Add Streamlined NTRU Prime sntrup761 algorithm. [rCcf9923e1a5]
- Add Kyber algorithm according to FIPS 203 ipd 2023-08-24.
[rC18e5c0d268]
- Add Classic McEliece algorithm. [rC003367b912]
- Add One-Step KDF with hash and MAC. [T5964]
- Add KDF algorithm HKDF of RFC-5869. [T5964]
- Add KDF algorithm X963KDF for use in CMS. [rC3abac420b3]
- Add GMAC-SM4 and Poly1305-SM4. [rCd1ccc409d4]
- Add ARIA block cipher algorithm. [rC316c6d7715]
- Add explicit FIPS indicators for MD and MAC algorithms. [T6376]
- Add support for SHAKE as MGF in RSA. [T6557]
- Add gcry_md_read support for SHAKE algorithms. [T6539]
- Add gcry_md_hash_buffers_ext function. [T7035]
- Add cSHAKE hash algorithm. [rC065b3f4e02]
- Support internal generation of IV for AEAD cipher mode. [T4873]
* Performance:
- Add SM3 ARMv8/AArch64/CE assembly implementation. [rCfe891ff4a3]
- Add SM4 ARMv8/AArch64 assembly implementation. [rCd8825601f1]
- Add SM4 GFNI/AVX2 and GFI/AVX512 implementation.
[rC5095d60af4,rCeaed633c16]
- Add SM4 ARMv9 SVE CE assembly implementation. [rC2dc2654006]
- Add PowerPC vector implementation of SM4. [rC0b2da804ee]
- Optimize ChaCha20 and Poly1305 for PPC P10 LE. [T6006]
- Add CTR32LE bulk acceleration for AES on PPC. [rC84f2e2d0b5]
- Add generic bulk acceleration for CTR32LE mode (GCM-SIV) for SM4
and Camellia. [rCcf956793af]
- Add GFNI/AVX2 implementation of Camellia. [rC4e6896eb9f]
- Add AVX2 and AVX512 accelerated implementations for GHASH (GCM)
and POLYVAL (GCM-SIV). [rCd857e85cb4, rCe6f3600193]
- Add AVX512 implementation for SHA512. [rC089223aa3b]
- Add AVX512 implementation for Serpent. [rCce95b6ec35]
- Add AVX512 implementation for Poly1305 and ChaCha20
[rCcd3ed49770, rC9a63cfd617]
- Add AVX512 accelerated implementation for SHA3 and Blake2
[rCbeaad75f46,rC909daa700e]
- Add VAES/AVX2 accelerated i386 implementation for AES.
[rC4a42a042bc]
- Add bulk processing for XTS mode of Camellia and SM4.
[rC32b18cdb87, rCaad3381e93]
- Accelerate XTS and ECB modes for Twofish and Serpent.
[rCd078a928f5,rC8a1fe5f78f]
- Add AArch64 crypto/SHA512 extension implementation for
SHA512. [rCe51d3b8330]
- Add AArch64 crypto-extension implementation for Camellia.
[rC898c857206]
- Accelerate OCB authentication on AMD with AVX2. [rC6b47e85d65]
* Bug fixes:
- For PowerPC check for missing optimization level for vector
register usage. [T5785]
- Fix EdDSA secret key check. [T6511]
- Fix decoding of PKCS#1-v1.5 and OAEP padding. [rC34c2042792]
- Allow use of PKCS#1-v1.5 with SHA3 algorithms. [T6976]
- Fix AESWRAP padding length check. [T7130]
* Other:
- Allow empty password for Argon2 KDF. [rCa20700c55f]
- Various constant time operation imporvements.
- Add "bp256", "bp384", "bp512" aliases for Brainpool curves.
- Support for the random server has been removed. [T5811]
- The control code GCRYCTL_ENABLE_M_GUARD is deprecated and not
supported any more. Please use valgrind or other tools. [T5822]
- Logging is now done via the libgpg-error logging functions.
[rCab0bdc72c7]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|
||
|
Michael Tremer
|
efd4db4bb0 |
core188: Ship libjpeg
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> |
||
|
Adolf Belka
|
31f0c0b289 |
libjpeg: Update to version 3.0.3
- Update from version 2.1.4 to 3.0.3
- Update of rootfile
- CVE fix in 3.0.0
- Changelog
3.0.3
1. Fixed an issue in the build system, introduced in 3.0.2, that caused all
libjpeg-turbo components to depend on the Visual C++ run-time DLL when built
with Visual C++ and CMake 3.15 or later, regardless of value of the
`WITH_CRT_DLL` CMake variable.
2. The x86-64 SIMD extensions now include support for Intel Control-flow
Enforcement Technology (CET), which is enabled automatically if CET is enabled
in the C compiler.
3. Fixed a regression introduced by 3.0 beta2[6] that made it impossible for
calling applications to supply custom Huffman tables when generating
12-bit-per-component lossy JPEG images using the libjpeg API.
4. Fixed a segfault that occurred when attempting to use the jpegtran `-drop`
option with a specially-crafted malformed input image or drop image
(specifically an image in which all of the scans contain fewer components than
the number of components specified in the Start Of Frame segment.)
3.0.2
1. Fixed a signed integer overflow in the `tj3CompressFromYUV8()`,
`tj3DecodeYUV8()`, `tj3DecompressToYUV8()`, and `tj3EncodeYUV8()` functions,
detected by the Clang and GCC undefined behavior sanitizers, that could be
triggered by setting the `align` parameter to an unreasonably large value.
This issue did not pose a security threat, but removing the warning made it
easier to detect actual security issues, should they arise in the future.
2. Introduced a new parameter (`TJPARAM_MAXMEMORY` in the TurboJPEG C API and
`TJ.PARAM_MAXMEMORY` in the TurboJPEG Java API) and a corresponding TJBench
option (`-maxmemory`) for specifying the maximum amount of memory (in
megabytes) that will be allocated for intermediate buffers, which are used with
progressive JPEG compression and decompression, optimized baseline entropy
coding, lossless JPEG compression, and lossless transformation. The new
parameter and option serve the same purpose as the `max_memory_to_use` field in
the `jpeg_memory_mgr` struct in the libjpeg API, the `JPEGMEM` environment
variable, and the cjpeg/djpeg/jpegtran `-maxmemory` option.
3. Introduced a new parameter (`TJPARAM_MAXPIXELS` in the TurboJPEG C API and
`TJ.PARAM_MAXPIXELS` in the TurboJPEG Java API) and a corresponding TJBench
option (`-maxpixels`) for specifying the maximum number of pixels that the
decompression, lossless transformation, and packed-pixel image loading
functions/methods will process.
4. Fixed an error ("Unsupported color conversion request") that occurred when
attempting to decompress a 3-component lossless JPEG image without an Adobe
APP14 marker. The decompressor now assumes that a 3-component lossless JPEG
image without an Adobe APP14 marker uses the RGB colorspace if its component
IDs are 1, 2, and 3.
3.0.1
1. The x86-64 SIMD functions now use a standard stack frame, prologue, and
epilogue so that debuggers and profilers can reliably capture backtraces from
within the functions.
2. Fixed two minor issues in the interblock smoothing algorithm that caused
mathematical (but not necessarily perceptible) edge block errors when
decompressing progressive JPEG images exactly two MCU blocks in width or that
use vertical chrominance subsampling.
3. Fixed a regression introduced by 3.0 beta2[6] that, in rare cases, caused
the C Huffman encoder (which is not used by default on x86 and Arm CPUs) to
generate incorrect results if the Neon SIMD extensions were explicitly disabled
at build time (by setting the `WITH_SIMD` CMake variable to `0`) in an AArch64
build of libjpeg-turbo.
3.0.0
1. The TurboJPEG API now supports 4:4:1 (transposed 4:1:1) chrominance
subsampling, which allows losslessly transposed or rotated 4:1:1 JPEG images to
be losslessly cropped, partially decompressed, or decompressed to planar YUV
images.
2. Fixed various segfaults and buffer overruns (CVE-2023-2804) that occurred
when attempting to decompress various specially-crafted malformed
12-bit-per-component and 16-bit-per-component lossless JPEG images using color
quantization or merged chroma upsampling/color conversion. The underlying
cause of these issues was that the color quantization and merged chroma
upsampling/color conversion algorithms were not designed with lossless
decompression in mind. Since libjpeg-turbo explicitly does not support color
conversion when compressing or decompressing lossless JPEG images, merged
chroma upsampling/color conversion never should have been enabled for such
images. Color quantization is a legacy feature that serves little or no
purpose with lossless JPEG images, so it is also now disabled when
decompressing such images. (As a result, djpeg can no longer decompress a
lossless JPEG image into a GIF image.)
3. Fixed an oversight in 1.4 beta1[8] that caused various segfaults and buffer
overruns when attempting to decompress various specially-crafted malformed
12-bit-per-component JPEG images using djpeg with both color quantization and
RGB565 color conversion enabled.
4. Fixed an issue whereby `jpeg_crop_scanline()` sometimes miscalculated the
downsampled width for components with 4x2 or 2x4 subsampling factors if
decompression scaling was enabled. This caused the components to be upsampled
incompletely, which caused the color converter to read from uninitialized
memory. With 12-bit data precision, this caused a buffer overrun or underrun
and subsequent segfault if the sample value read from uninitialized memory was
outside of the valid sample range.
5. Fixed a long-standing issue whereby the `tj3Transform()` function, when used
with the `TJXOP_TRANSPOSE`, `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or
`TJXOP_ROT270` transform operation and without automatic JPEG destination
buffer (re)allocation or lossless cropping, computed the worst-case transformed
JPEG image size based on the source image dimensions rather than the
transformed image dimensions. If a calling program allocated the JPEG
destination buffer based on the transformed image dimensions, as the API
documentation instructs, and attempted to transform a specially-crafted 4:2:2,
4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a large amount of metadata,
the issue caused `tj3Transform()` to overflow the JPEG destination buffer
rather than fail gracefully. The issue could be worked around by setting
`TJXOPT_COPYNONE`. Note that, irrespective of this issue, `tj3Transform()`
cannot reliably transform JPEG source images that contain a large amount of
metadata unless automatic JPEG destination buffer (re)allocation is used or
`TJXOPT_COPYNONE` is set.
6. Fixed a regression introduced by 3.0 beta2[6] that prevented the djpeg
`-map` option from working when decompressing 12-bit-per-component lossy JPEG
images.
7. Fixed an issue that caused the C Huffman encoder (which is not used by
default on x86 and Arm CPUs) to read from uninitialized memory when attempting
to transform a specially-crafted malformed arithmetic-coded JPEG source image
into a baseline Huffman-coded JPEG destination image.
2.1.91
1. Significantly sped up the computation of optimal Huffman tables. This
speeds up the compression of tiny images by as much as 2x and provides a
noticeable speedup for images as large as 256x256 when using optimal Huffman
tables.
2. All deprecated fields, constructors, and methods in the TurboJPEG Java API
have been removed.
3. Arithmetic entropy coding is now supported with 12-bit-per-component JPEG
images.
4. Overhauled the TurboJPEG API to address long-standing limitations and to
make the API more extensible and intuitive:
- All C function names are now prefixed with `tj3`, and all version
suffixes have been removed from the function names. Future API overhauls will
increment the prefix to `tj4`, etc., thus retaining backward API/ABI
compatibility without versioning each individual function.
- Stateless boolean flags have been replaced with stateful integer API
parameters, the values of which persist between function calls. New
functions/methods (`tj3Set()`/`TJCompressor.set()`/`TJDecompressor.set()` and
`tj3Get()`/`TJCompressor.get()`/`TJDecompressor.get()`) can be used to set and
query the value of a particular API parameter.
- The JPEG quality and subsampling are now implemented using API
parameters rather than stateless function arguments (C) or dedicated set/get
methods (Java.)
- `tj3DecompressHeader()` now stores all relevant information about the
JPEG image, including the width, height, subsampling type, entropy coding
algorithm, etc., in API parameters rather than returning that information
through pointer arguments.
- `TJFLAG_LIMITSCANS`/`TJ.FLAG_LIMITSCANS` has been reimplemented as an
API parameter (`TJPARAM_SCANLIMIT`/`TJ.PARAM_SCANLIMIT`) that allows the number
of scans to be specified.
- Optimized baseline entropy coding (the computation of optimal Huffman
tables, as opposed to using the default Huffman tables) can now be specified,
using a new API parameter (`TJPARAM_OPTIMIZE`/`TJ.PARAM_OPTIMIZE`), a new
transform option (`TJXOPT_OPTIMIZE`/`TJTransform.OPT_OPTIMIZE`), and a new
TJBench option (`-optimize`.)
- Arithmetic entropy coding can now be specified or queried, using a new
API parameter (`TJPARAM_ARITHMETIC`/`TJ.PARAM_ARITHMETIC`), a new transform
option (`TJXOPT_ARITHMETIC`/`TJTransform.OPT_ARITHMETIC`), and a new TJBench
option (`-arithmetic`.)
- The restart marker interval can now be specified, using new API
parameters (`TJPARAM_RESTARTROWS`/`TJ.PARAM_RESTARTROWS` and
`TJPARAM_RESTARTBLOCKS`/`TJ.PARAM_RESTARTBLOCKS`) and a new TJBench option
(`-restart`.)
- Pixel density can now be specified or queried, using new API parameters
(`TJPARAM_XDENSITY`/`TJ.PARAM_XDENSITY`,
`TJPARAM_YDENSITY`/`TJ.PARAM_YDENSITY`, and
`TJPARAM_DENSITYUNITS`/`TJ.PARAM_DENSITYUNITS`.)
- The accurate DCT/IDCT algorithms are now the default for both
compression and decompression, since the "fast" algorithms are considered to be
a legacy feature. (The "fast" algorithms do not pass the ISO compliance tests,
and those algorithms are not any faster than the accurate algorithms on modern
x86 CPUs.)
- All C initialization functions have been combined into a single function
(`tj3Init()`) that accepts an integer argument specifying the subsystems to
initialize.
- All C functions now use the `const` keyword for pointer arguments that
point to unmodified buffers (and for both dimensions of pointer arguments that
point to sets of unmodified buffers.)
- All C functions now use `size_t` rather than `unsigned long` to
represent buffer sizes, for compatibility with `malloc()` and to avoid
disparities in the size of `unsigned long` between LP64 (Un*x) and LLP64
(Windows) operating systems.
- All C buffer size functions now return 0 if an error occurs, rather than
trying to awkwardly return -1 in an unsigned data type (which could easily be
misinterpreted as a very large value.)
- Decompression scaling is now enabled explicitly, using a new
function/method (`tj3SetScalingFactor()`/`TJDecompressor.setScalingFactor()`),
rather than implicitly using awkward "desired width"/"desired height"
arguments.
- Partial image decompression has been implemented, using a new
function/method (`tj3SetCroppingRegion()`/`TJDecompressor.setCroppingRegion()`)
and a new TJBench option (`-crop`.)
- The JPEG colorspace can now be specified explicitly when compressing,
using a new API parameter (`TJPARAM_COLORSPACE`/`TJ.PARAM_COLORSPACE`.) This
allows JPEG images with the RGB and CMYK colorspaces to be created.
- TJBench no longer generates error/difference images, since identical
functionality is already available in ImageMagick.
- JPEG images with unknown subsampling configurations can now be
fully decompressed into packed-pixel images or losslessly transformed (with the
exception of lossless cropping.) They cannot currently be partially
decompressed or decompressed into planar YUV images.
- `tj3Destroy()` now silently accepts a NULL handle.
- `tj3Alloc()` and `tj3Free()` now return/accept void pointers, as
`malloc()` and `free()` do.
- The C image I/O functions now accept a TurboJPEG instance handle, which
is used to transmit/receive API parameter values and to receive error
information.
5. Added support for 8-bit-per-component, 12-bit-per-component, and
16-bit-per-component lossless JPEG images. A new libjpeg API function
(`jpeg_enable_lossless()`), TurboJPEG API parameters
(`TJPARAM_LOSSLESS`/`TJ.PARAM_LOSSLESS`,
`TJPARAM_LOSSLESSPSV`/`TJ.PARAM_LOSSLESSPSV`, and
`TJPARAM_LOSSLESSPT`/`TJ.PARAM_LOSSLESSPT`), and a cjpeg/TJBench option
(`-lossless`) can be used to create a lossless JPEG image. (Decompression of
lossless JPEG images is handled automatically.) Refer to
[libjpeg.txt](libjpeg.txt), [usage.txt](usage.txt), and the TurboJPEG API
documentation for more details.
6. Added support for 12-bit-per-component (lossy and lossless) and
16-bit-per-component (lossless) JPEG images to the libjpeg and TurboJPEG APIs:
- The existing `data_precision` field in `jpeg_compress_struct` and
`jpeg_decompress_struct` has been repurposed to enable the creation of
12-bit-per-component and 16-bit-per-component JPEG images or to detect whether
a 12-bit-per-component or 16-bit-per-component JPEG image is being
decompressed.
- New 12-bit-per-component and 16-bit-per-component versions of
`jpeg_write_scanlines()` and `jpeg_read_scanlines()`, as well as new
12-bit-per-component versions of `jpeg_write_raw_data()`,
`jpeg_skip_scanlines()`, `jpeg_crop_scanline()`, and `jpeg_read_raw_data()`,
provide interfaces for compressing from/decompressing to 12-bit-per-component
and 16-bit-per-component packed-pixel and planar YUV image buffers.
- New 12-bit-per-component and 16-bit-per-component compression,
decompression, and image I/O functions/methods have been added to the TurboJPEG
API, and a new API parameter (`TJPARAM_PRECISION`/`TJ.PARAM_PRECISION`) can be
used to query the data precision of a JPEG image. (YUV functions are currently
limited to 8-bit data precision but can be expanded to accommodate 12-bit data
precision in the future, if such is deemed beneficial.)
- A new cjpeg and TJBench command-line argument (`-precision`) can be used
to create a 12-bit-per-component or 16-bit-per-component JPEG image.
(Decompression and transformation of 12-bit-per-component and
16-bit-per-component JPEG images is handled automatically.)
2.1.5.1
1. The SIMD dispatchers in libjpeg-turbo 2.1.4 and prior stored the list of
supported SIMD instruction sets in a global variable, which caused an innocuous
race condition whereby the variable could have been initialized multiple times
if `jpeg_start_*compress()` was called simultaneously in multiple threads.
libjpeg-turbo 2.1.5 included an undocumented attempt to fix this race condition
by making the SIMD support variable thread-local. However, that caused another
issue whereby, if `jpeg_start_*compress()` was called in one thread and
`jpeg_read_*()` or `jpeg_write_*()` was called in a second thread, the SIMD
support variable was never initialized in the second thread. On x86 systems,
this led the second thread to incorrectly assume that AVX2 instructions were
always available, and when it attempted to use those instructions on older x86
CPUs that do not support them, an illegal instruction error occurred. The SIMD
dispatchers now ensure that the SIMD support variable is initialized before
dispatching based on its value.
2.1.5
1. Fixed issues in the build system whereby, when using the Ninja Multi-Config
CMake generator, a static build of libjpeg-turbo (a build in which
`ENABLE_SHARED` is `0`) could not be installed, a Windows installer could not
be built, and the Java regression tests failed.
2. Fixed a regression introduced by 2.0 beta1[15] that caused a buffer overrun
in the progressive Huffman encoder when attempting to transform a
specially-crafted malformed 12-bit-per-component JPEG image into a progressive
12-bit-per-component JPEG image using a 12-bit-per-component build of
libjpeg-turbo (`-DWITH_12BIT=1`.) Given that the buffer overrun was fully
contained within the progressive Huffman encoder structure and did not cause a
segfault or other user-visible errant behavior, given that the lossless
transformer (unlike the decompressor) is not generally exposed to arbitrary
data exploits, and given that 12-bit-per-component builds of libjpeg-turbo are
uncommon, this issue did not likely pose a security risk.
3. Fixed an issue whereby, when using a 12-bit-per-component build of
libjpeg-turbo (`-DWITH_12BIT=1`), passing samples with values greater than 4095
or less than 0 to `jpeg_write_scanlines()` caused a buffer overrun or underrun
in the RGB-to-YCbCr color converter.
4. Fixed a floating point exception that occurred when attempting to use the
jpegtran `-drop` and `-trim` options to losslessly transform a
specially-crafted malformed JPEG image.
5. Fixed an issue in `tjBufSizeYUV2()` whereby it returned a bogus result,
rather than throwing an error, if the `align` parameter was not a power of 2.
Fixed a similar issue in `tjCompressFromYUV()` whereby it generated a corrupt
JPEG image in certain cases, rather than throwing an error, if the `align`
parameter was not a power of 2.
6. Fixed an issue whereby `tjDecompressToYUV2()`, which is a wrapper for
`tjDecompressToYUVPlanes()`, used the desired YUV image dimensions rather than
the actual scaled image dimensions when computing the plane pointers and
strides to pass to `tjDecompressToYUVPlanes()`. This caused a buffer overrun
and subsequent segfault if the desired image dimensions exceeded the scaled
image dimensions.
7. Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG image
(`-DWITH_12BIT=1`) using an alpha-enabled output color space such as
`JCS_EXT_RGBA`, the alpha channel was set to 255 rather than 4095.
8. Fixed an issue whereby the Java version of TJBench did not accept a range of
quality values.
9. Fixed an issue whereby, when `-progressive` was passed to TJBench, the JPEG
input image was not transformed into a progressive JPEG image prior to
decompression.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
|