3721 Commits

Author	SHA1	Message	Date
Adolf Belka	90dfbe816a	lz4: Update to version 1.10.0 ... - Update from version 1.9.4 to 1.10.0 - Update of rootfile - Changelog 1.10.0 cli : multithreading compression support: improves speed by X times threads allocated cli : overlap decompression with i/o, improving speed by ~+60% cli : support environment variables LZ4_CLEVEL and LZ4_NBWORKERS cli : license of CLI more clearly labelled GPL-2.0-or-later cli : fix: refuse to compress directories cli : fix dictionary compression benchmark on multiple files cli : change: no more implicit `stdout` (except when input is `stdin`) lib : new level 2, offering mid-way performance (speed and compression) lib : Improved lz4frame compression speed for small data (up to +160% at 1KB) lib : Slightly faster (+5%) HC compression speed (levels 3-9), by @JunHe77 lib : dictionary compression support now in stable status lib : lz4frame states can be safely reset and reused after a processing error (described by @QrczakMK) lib : `lz4file` API improvements, by @vsolontsov-volant and @t-mat lib : new experimental symbol `LZ4_compress_destSize_extState()` build: cmake minimum version raised to 3.5 build: cmake improvements, by @foxeng, @Ohjurot, @LocalSpook, @teo-tsirpanis, @ur4t and @t-mat build: meson scripts are now hosted into `build/` directory, by @eli-schwartz build: meson improvements, by @tristan957 build: Visual Studio solutions generated by `cmake` via scripts port : support for loongArch, risc-v, m68k, mips and sparc architectures port : improved Visual Studio compatibility, by @t-mat port : freestanding support improvements, by @t-mat Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-14 09:10:21 +00:00
Adolf Belka	cca1ef9a56	exfatprogs: Update to version 1.2.5 ... - Update from version 1.1.3 to 1.2.5 - Update of rootfile - Changelog 1.2.5 CHANGES : * exfatprogs: remove the limitation that the device path length cannot exceed 254 bytes. * exfatprogs: include the test images in the release package. NEW FEATURES : * fsck.exfat: check and repair the filename which has invalid characters. BUG FIXES : * tune.exfat: check whether the volume has invalid characters correctly. * fsck.exfat: check whether the filename and volume has invalid characters correctly. * fsck.exfat: fix endianess issues which happen in the big-endian system. 1.2.4 BUG FIXES : * tune.exfat: Fix "invalid serial number" error when setting an serial number. * fsck.exfat: Fix memory leak in an error path 1.2.3 CHANGES : * dump.exfat: Report sector size in bytes and cluster size in terms of sectors. * fsck.exfat: Show checksum value if the SetChecksum of File directory entry is invalid. * mkfs.exfat: Improve FAT length calculation to reduce the FAT size. NEW FEATURES : * mkfs.exfat: Add the option "--sector-size". * fsck.exfat: Support checking and repairing VendorAllcation and VendorExtension directory entries. BUG FIXES : * exfatprogs: Remove unnecessary memory allocations. * fsck.exfat: Fix corruption that can occur if the cluster size is 512-byte. * fsck.exfat: Fix the SecondaryCount of File directory entry when the count of Name directory entries is 17 or higher. * tune.exfat: Fix an error that accepts invalid serial numbers. 1.2.2 CHANGES : * exfat2img: Allow dumps for read-only devices. * fsck.exfat: Revert Repairing zero size directory. NEW FEATURES : * fsck.exfat: Repair duplicated filename. * mkfs.exfat: Add the option "q" to print only error messages. * mkfs.exfat: Add the option "U" to set volume GUID. * tune.exfat: Add the option "U" / "-u" to set or print volume GUID. BUG FIXES: * fsck.exfat: Fix some out-of-bounds memory accesses. * fsck.exfat: Change not to delete volume GUID directory entry. 1.2.1 CHANGES : * fsck.exfat: Repair zero size directory. * fsck.exfat: Four small clean-ups. 1.2.0 CHANGES : * fsck.exfat: Keep traveling files even if there is a corrupted directory entry set. * fsck.exfat: Introduce the option "b" to recover a boot sector even if an exFAT filesystem is not found. * fsck.exfat: Introduce the option "s" to create files in "/LOST+FOUND", which have clusters allocated but was not belonged to any files. * fsck.exfat: Rename '.' and '..' entry name to the one user want. NEW FEATURES : * fsck.exfat: Repair corruptions of an exFAT filesystem. Please refer to fsck.exfat manpage to see what kind of corruptions can be repaired. * exfat2img: Dump metadata of an exFAT filesystem. Please refer to exfat2img manpage to see how to use it. BUG FIXES: * fsck.exfat: Fix an infinite loop while traveling files. * tune.exfat: Fix bitmap entry corruption when adding new volume lablel. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-14 09:08:29 +00:00
Adolf Belka	b1be6000fe	curl: Update to version 8.9.1 ... - Update from version 8.8.0 to 8.9.1 - Update of rootfile - Changelog 8.9.1 Bugfixes: cmake: detect `libssh` via `pkg-config` cmake: detect `nettle` when building with GnuTLS cmake: drop `if(PKG_CONFIG_FOUND)` guard for `pkg_check_modules()` configure: limit `__builtin_available` test to Darwin connect: fix connection shutdown for event based processing contrithanks.sh: use -F with -v to match lines as strings curl: more defensive socket code for --ip-tos CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe example/multi-uv: remove the use of globals ftpserver.pl: make POP3 LIST serve content from the test file GHA/windows: increase timeout for vcpkg build step lib: survive some NULL input args macos: fix Apple SDK bug workaround for non-macOS targets misc: cleanup after removing years from copyright os400: build cli manual. os400: workaround an IBM ASCII run-time library bug RELEASE-PROCEDURE.md: remove the initial build step runtests: fold timing details with GHA, sync `-r` tflags tests: provide FTP directory contents in the test file tidy-up: URL updates TODO: thread-safe sharing transfer: speed limiting fix for 32bit systems vtls: avoid forward declaration in MultiSSL builds wolfSSL: allow wolfSSL's implementation of kyber to be used wolfssl: avoid calling get_cached_x509_store if store is uncachable wolfssl: CA store share fix x509asn1: unittests and fixes for gtime2str 8.9.0 Changes: curl: add --ip-tos (IP Type of Service / Traffic Class) curl: add --mptcp curl: add --vlan-priority curl: add -w '%{num_retries}' gnutls: support CA caching mbedtls: support CURLOPT_CERTINFO noproxy: patterns need to be comma separated socket: support binding to interface *AND* IP tcpkeepalive: add CURLOPT_TCP_KEEPCNT and --keepalive-cnt urlapi: add CURLU_NO_GUESS_SCHEME wolfssl: support CA caching Bugfixes: (lib)curl.rc: set debug flag also for `CURLDEBUG` and `UNITTESTS` asyn-thread: avoid using GetAddrInfoExW with impersonation aws-sigv4: url encode the canonical path BINDINGS: update java link to one that exists build: add Debug, TrackMemory, ECH to feature list build: add more supported attributes to the IAR compiler build: fix llvm 16 or older + Xcode 15 or newer, and gcc build: fix llvm 17 and older + macOS SDK 14.4 and newer build: sync warning options between autotools, cmake & compilers build: tidy up `__builtin_available` feature checks (Apple) build: untangle `CURLDEBUG` and `DEBUGBUILD` macros build: use `#error` instead of invalid syntax cd2nroff: convert two warnings to errors cd2nroff: use an empty "##" to signal end of .IP sequence cf-socket: improve SO_SNDBUF update for Winsock cf-socket: optimize curlx_nonblock() and check its return error cf-socket: remove obsolete recvbuf cf-socket: remove two "useless" assignments cfilters: make Curl_conn_connect always assign 'done' cmake: add CURL_USE_GSASL option with detection + CI test cmake: allow `ENABLE_CURLDEBUG=OFF` with `ENABLE_DEBUG=ON` cmake: allow SOVERSION override with `CURL_LIBCURL_SOVERSION` cmake: alpha-sort feature list cmake: always build unit tests with the `testdeps` target cmake: bring `curl-config.cmake` closer to `FindCURL` cmake: create `configurehelp.pm` like autotools does cmake: delete unused `HAVE_LIBSSH2`, `HAVE_LIBSOCKET` macros cmake: detect `libidn2` also via `pkg-config` cmake: enable SOVERSION for Cygwin and `CMAKE_DLL_NAME_WITH_SOVERSION` cmake: fix `-Wredundant-decls` in unity/mingw-w64 builds cmake: fix brotli lib order cmake: fix building `unit1600` due to missing `ssl/openssl.h` cmake: fix building in unity mode cmake: fix building with both md4 and md5 in unity mode cmake: fix builds with detected libidn2 lib but undetected header cmake: fix feature and protocol lists for SecureTransport cmake: fix quotes when appending multiple options (SecureTransport) cmake: fix test 1013 with websockets enabled and no TLS cmake: improve wolfSSL detection cmake: show protocols, then features cmake: stop setting SOVERSION for the static lib target cmake: sync CA bundle/path detection with autotools cmake: sync protocol/feature list with `curl -V` output cmake: use `APPLE` instead of `CMAKE_SYSTEM_NAME` string cmake: whitespace, formatting/tidy-up in comments cmdline-docs: "added in" cleanups cmdline-docs: fix `--proxy-ca-native` example + tidy-ups cmdline-opts/_PROTOCOLS.md: mention WS(S) cmdline-opts/ech.md: shorten the help text cmdline-opts/fail.md: expand and clarify cmdline-opts/interface.md: expand the documentation cmdline-opts: category cleanup cmdline-opts: expand the parallel explanations cmdline-opts: shorten six help texts cmdline: expand proxy option explanations code: language cleanup in comments configure: CA bundle/path detection fixes configure: fix `SystemConfiguration` detection configure: fix pkg-config library name 'libnghttp3' configure: fix pkg-config names (zstd, ngtcp2*) configure: limit `SystemConfiguration` test to non-c-ares, IPv6 builds configure: remove 'deeper' checks for `AC_CHECK_FUNCS` configure: require a QUIC library if nghttp3 is used configure: sort feature list, lowercase protocols, use backticks configure: use `$EGREP` in place of `grep -E` configure: use AC_MSG_WARN for TLS/experimental warning texts connect-to.md: expand with examples connection: shutdown TLS (for FTP) better cookie-jar.md: see also --junk-session-cookies curl-config: revert to backticks to support old target envs curl: allow etag and content-disposition for 3xx reply curl: bsearch the --write-out variable name curl: check for --disable case *sensitively* curl: list categories in --help curl: make warnings and other messages aware of terminal width curl: output "flying saucers" with leading carriage return curl_easy_escape: elaborate a little on encoding a URL curl_mprintf.md: add missing comma curl_multi_poll.md: expand the example with an custom file descriptor curl_str[n]equal.md: tidy up text to make them stand-alone curl_url_set.md: libcurl only parses :// URLs curl_url_set: elaborate on scheme guessing curldown: make 'added-in:' a mandatory header field CURLOPT_CONNECTTIMEOUT*: clarify, document the milliseond version CURLOPT_ECH.md: remove repeated 'if' CURLOPT_NETRC.md: clarify what it does on Windows CURLOPT_RESOLVE.md: mention hostname can be wildcard ('*') CURLOPT_SSL_VERIFYHOST.md: refresh CURLOPT_TLSAUTH_PASSWORD/USERNAME.md: language fixups DISTROS: add a link to the list archive DISTROS: add AlmaLinux package source link DISTROS: add MSYS2 (native) links docs/cmdline-opts: fix mail-auth example TLD typo docs/cmdline-opts: remove two superfluous "Added in" mentions docs/libcurl: polish the single-line descriptions docs/Makefile.am: make curl-config.1 install docs: reference non deprecated libcurl options docs: start markdown headers with capital letter where applicable doh-insecure.md: expand doh: fix cleanup doh: fix leak and zero-length HTTPS RR crash dump-header.md: mention minus for stdout examples/threaded-ssl: remove locking callback code examples: add missing binaries to .gitignore examples: delete unused includes examples: fix compiling with MSVC examples: suppress deprecation warnings locally FEATURES.md: refresh file: separate fake headers and body with a stand-alone CRLF ftp: remove redundant null pointer check in loop condition get.d: clarify the explanation GHA/windows: add MSVC wolfSSL job with test GHA/windows: ignore FTP test results for old-mingw-w64 GHA: add MSVC UWP job, expand jobs with more options GHA: detect and warn for more English contractions GHA: disable MQTT and WebSocket tests in Windows jobs GHA: disable TFTP tests in Windows jobs GHA: enable tests 1139, 1177, 1477 on Windows GHA: improve vcpkg cache, add BoringSSL ECH and LibreSSL MSVC jobs GHA: unify http3 workflows into one GHA: use vcpkg to install packages for MSVC jobs GIT-INFO.md: remove version requirements gnutls: improve TLS shutdown gnutls: pass in SNI name, not hostname when checking cert help: add flags to output and ssh categories hostip: skip error check for infallible function call http/3: add shutdown support http/3: resume upload on ack if we have more data to send http: remove "struct HTTP" http: write last header line late idn: fix ß with AppleIDN idn: make macidn fail before trying conversion if name too long idn: tweak buffer use when converting with macidn lib/v*: tidy up types and casts lib: add a few DEBUGASSERT(data) to aid code analyzers lib: add failure reason on bind errors lib: fix gcc warning in certain debug builds lib: fix thread entry point to return `DWORD` on WinCE lib: graceful connection shutdown lib: prefer `var = time(NULL)` over `time(&var)` lib: tidy up types and casts lib: xfer_setup and non-blocking shutdown libcurl-docs: make option lists alpha-sorted libcurl-easy.md: now *more* than 300 options libcurl.pc: add `Requires.private`, `Requires` for static linking libcurl.pc: add more `Requires.private`/`Requires` dependencies libssh: remove CURLOPT_SSL_VERIFYHOST check macos: add workaround for gcc, non-c-ares, IPv6, compile error macos: undo `availability` macro enabled by Homebrew gcc managen: "added in" fixes managen: cleanups to generate nicer-looking output managen: error on trailing blank lines in input files managen: fix removing backticks from subtitles managen: insert final .fi for files ending with a quote managen: introduce "Multi: per-URL" managen: only output .RE for manpage output managen: output tabs for each 8 leading spaces managen: warn on excessively long help texts MANUAL.md: wrap two example urls that overrun styling mbedtls: check version before getting tls version mbedtls: check version for cipher id mbedtls: correct the error message for cert blob parsing failure mbedtls: send close-notify on close mbedtls: v3.6.0 workarounds md4: fix compilation with OpenSSL 1.x with md4 disabled misc: fix typos mk-ca-bundle.pl: delay 'curl -V' execution until it is needed multi: add multi->proto_hash, a key-value store for protocol data multi: do a final progress update on connect failure multi: fix multi_wait() timeout handling multi: fix pollset during RESOLVING phase multi: multi_getsock(), check correct socket ngtcp2+quictls: fix cert-status use noproxy: test bad ipv6 net size first openssl/gnutls: rectify the TLS version checks for QUIC openssl: fix %-specifier in infof() call openssl: fix hostname handling when using ECH openssl: stop duplicate ssl key logging for legacy OpenSSL os400: make it compilable again pytest: add ftp upload tests pytest: include testenv/vsftpd.py in dist tarball quic: enable UDP GRO quic: openssl quic, cmake and doc version update to 3.3.0 quic: require at least OpenSSL 3.3 for QUIC quic: update to quiche 0.22.0 quiche: fix operand of ‘?:’ changes signedness request.md: language fix request: change the struct field bodywrites to a bool, only for hyper reuse: switch to REUSE 3.2 and REUSE.toml runtests: show name and keywords for failed tests in summary runtests: sort test IDs in summary lines runtests: support %DATEfor YYYY-MM-DD of right now runtests: support %VERNUM runtests: support crlf="yes" for the <stderr> section sectransp: fix `HAVE_BUILTIN_AVAILABLE` checks to not emit warnings sectransp: fix clang compiler warnings, stop silencing them sectransp: remove large cipher table sectransp: use common code for cipher suite lookup sendf: fix CRLF conversion of input smtp: for starttls, do full upgrade socket: change TCP keepalive from ms to seconds on DragonFly BSD socket: use SOCK_NONBLOCK to eliminate extra system call socketpair: add `eventfd` and use `SOCK_NONBLOCK` for `socketpair()` src/Makefile.am: remove SUBDIRS assignment system_win32: add missing curl.h include tcpkeepalive: support TCP keep-alive parameters on Solaris <11.4 test1119: adapt for `.md` input test1139: scan .md files instead of .3 ones test1175: scan libcurl-errors.md, not the generated .3 version test1486: verify that write-out.md and tool_writeout.c are in sync test2600: disable on win32 test: add test1484, for HEAD with content test: add test1546, chunked not last transfer encoding tests/scripts: call it 'manpage' (single word) tests: add pytest for --ciphers and --tls13-ciphers options tests: delete `CharConv` remains tests: delete redundant `!MSDOS` guard tests: extend user/password parsing test1620 tests: fix sshd IdentityFile path for MinGW/Cygwin tests: fix sshd UserKnownHostsFile path for MinGW/Cygwin tests: include current directory when running test Perl commands tests: log "Throwing away" messages before throwing away tests: run with "--trace-config all" to provide even more info tests: sync feature names with `curl -V` tests: test_17_ssl_use.py clarify mbedTLS TLSv1.3 support tests: use exec when spawning nghttpx tidy-up: use consistent casing for Windows directories TODO: remove some old, clarify, add something tool_cb_hdr: return error for failed header writes tool_operate: avoid explicitly setting verifypeer to 1 tool_operate: simplify return code handling from url_proto() tool_writeout: get certinfo only when needing it trace-ascii.md: mention "%" for stderr transfer: avoid polling socket every transfer loop transfer: conn close on paused upload transfer: do not use EXPIRE_NOW while blocked transfer: remove curl_upload_refill_watermark, no longer used transfer: set CSELECT_IN if there is data pending unit2604: use 'unitfail' instead of 'error' variable url: allow DoH transfers to override max connection limit urlapi: remove unused definition of HOST_BAD variable.md: make example use expand verify-synopsis.pl: work with .md files vms: fixed language in comment vtls: deprioritize Secure Transport vtls: replace addsessionid with set_sessionid winbuild: fix PE version info debug flag winbuild: MS-DOS batch tidy-ups winbuild: remove outdated WIN32 defines windows: fix UWP builds, add GHA job winsock: move SO_SNDBUF update into cf-socket wolfssl: assume key_file equal to clientcert if no key_file wolfssl: use larger error buffer when formatting errors x509asn1: add some common ECDSA OIDs x509asn1: ASN1tostr() should fail when 'constructed' is set x509asn1: fallback to dotted OID representation x509asn1: make Curl_extract_certinfo store error message x509asn1: prevent NULL dereference x509asn1: remove superfluous free() x509asn1: remove two static variables Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-14 09:07:56 +00:00
Adolf Belka	e891c3beca	poppler: Update to version 24.08.0 ... - Update from version 24.03.0 to 24.08.0 - Update of rootfile - sobump has dependency of cups-filters - Changelog 24.08.0 core: * Add support for modifying the appearance stream text in form field choice * Fix buffer overflow in Windows specific font selection code * Fix crashes in malformed files * Internal code improvements qt5: * Add support for modifying the appearance stream text in form field choice qt6: * Add support for modifying the appearance stream text in form field choice utils: * pdfinfo: Fix crash in malformed documents 24.07.0 core: * Fix crashes in broken files * Internal code improvements qt6: * Add getters for document additional actions * Implement reset forms link qt5: * Add getters for document additional actions * Implement reset forms link utils: * pdfinfo: Fix crash in broken documents when using -dests build system: * Mark glib-mkenums as required 24.06.0 core: * Performance improvements in some files * Fix some issues with files bigger than 2^31 bytes * Remove all cairo include guards for cairo < 1.16 * Fix MSVC build * Internal code improvements qt6: * Update Qt6 doc example * Use the non deprecated version of QString::fromUcs4 glib: * properly document return value from poppler_font_info_scan 24.05.0 core: * Fix signing not being totally correct in some kind of PDF files * Assume "Adobe-Identity" for character collection. Issue #1465 * Small improvements in annotation font rendering * Remove some GooString methods, use std::string ones instead * Move some GooString methods to UTF.h * Fix crash in broken files cpp: * cpp: Fix crash extracting text and font in some files. Issue #1477 * Change base class of ustring to char16_t qt6: * Add async API for certificate validation * Fix text extraction for Landscape/Seascape pages qt5: * Add async API for certificate validation * Fix text extraction for Landscape/Seascape pages utils: * pdfdetach: Small code improvements * pdftops: Write compliant ps header build system: * Increase minimum supported base to that provided by Ubuntu 22.04 24.04.0 core: * Optimize page text extraction speed * Fix clipping path handling in some files. Issue #739 * Fix regression in text selection * Fix text search across lines between paragraphs qt6: * Fix crash in SoundObject::data utils: * pdfsig: Add Catalan translation build system: * Build code as C++20 Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-14 09:06:09 +00:00
Michael Tremer	b058000c23	Merge remote-tracking branch 'ms/unbound-socket' into next	2024-08-13 09:27:25 +00:00
Adolf Belka	0216fe0228	libxml2: Update to version 2.13.3 ... - Update from version 2.12.3 to 2.13.3 - Update of rootfile - CVE fixes in 2.13.3, 2.12.7, 2.12.5 - Changelog 2.13.3 ### Security - [CVE-2024-40896] Fix XXE protection in downstream code ### Regressions - autotools: Use AC_CHECK_DECL to check for getentropy - xinclude: Fix fallback for text includes - io: Don't call getcwd in xmlParserGetDirectory - io: Fix return value of xmlFileRead - parser: Fix error return of xmlParseBalancedChunkMemory ### Improvements - xinclude: Set error handler when parsing text - Undeprecate xmlKeepBlanksDefault 2.13.2 ### Regressions - tree: Fix handling of empty strings in xmlNodeParseContent - valid: Restore ID lookup - parser: Reenable ctxt->directory - uri: Handle filesystem paths in xmlBuildRelativeURISafe - encoding: Make xmlFindCharEncodingHandler return UTF-8 handler - encoding: Fix encoding lookup with xmlOpenCharEncodingHandler - include: Define ATTRIBUTE_UNUSED for clang - uri: Fix xmlBuildURI with NULL base ### Improvements - uri: Enable Windows paths on Cygwin - tests: Clarify licence of test/intsubset2.xml 2.13.1 ### Regressions - parser: Selectively reenable reading from "-" - reader: Fix xmlTextReaderReadString - xinclude: Set XPath context doc - xinclude: Load included documents with XML_PARSE_DTDLOAD - include: Don't redefine ATTRIBUTE_UNUSED - include: Readd circular dependency between tree.h and parser.h - xinclude: Add missing include (Jan Alexander Steffens (heftig)) - win32, msvc: fix missing linking against Bcrypt.lib (Miklos Vajna) - xinclude: Don't raise error on empty nodeset - parser: Make failure to load main document a warning - tree: Fix freeing entities via xmlFreeNode - parser: Pass global object to sax->setDocumentLocator ### Improvements - io: Fix resetting xmlParserInputBufferCreateFilename hook ### Documentation - Fix typo in NEWS (--with-html -> --with-http) (Ryan Carsten Schmidt) - doc: Don't mention xmlNewInputURL 2.13.0 ### Major changes Most of the core code should now report malloc failures reliably. Some API functions were extended with versions that report malloc failures. New API functions for error handling were added: - xmlCtxtSetErrorHandler - xmlXPathSetErrorHandler - xmlXIncludeSetErrorHandler This makes it possible to register per-context error handlers without resorting to global handlers. A few error messages were improved and consolidated. Please update downstream test suites accordingly. A new parser option XML_PARSE_NO_XXE can be used to disable loading of external entities or DTDs. This is most useful in connection with XML_PARSE_NOENT. Support for HTTP POST was removed. Support for zlib, liblzma and HTTP is now disabled by default and has to be enabled by passing --with-zlib, --with-lzma or --with-http to configure. In legacy mode (--with-legacy) these options are enabled by default as before. Support for FTP will be removed in the next release. Support for the range and point extensions of the xpointer() scheme will be removed in the next release. The rest of the XPointer implementation won't be affected. The xpointer() scheme will behave like the xpath1() scheme. Several more legacy symbols were deprecated. Users of the old "SAX1" API functions are encouraged to upgrade to the new "SAX2" API, available since version 2.6.0 from 2003. Some deprecated global variables were made const: - htmlDefaultSAXHandler - oldXMLWDcompatibility - xmlDefaultSAXHandler - xmlDefaultSAXLocator - xmlParserDebugEntities ### Deprecations and removals - threads: Deprecate remaining ThrDef functions - unicode: Deprecate most xmlUCSIs* functions - memory: Remove memory debugging - tree: Deprecate xmlRegisterNodeDefault - tree: Deprecate xmlSetCompressMode - html: Deprecate htmlHandleOmittedElem - valid: Deprecate internal validation functions - valid: Deprecate old DTD serialization API - nanohttp: Deprecate public API - Remove VMS support - Remove Trio ### Bug fixes - parser: Fix base URI of internal parameter entities - tree: Handle predefined entities in xmlBufGetEntityRefContent - schemas: Allow unlimited length decimals, integers etc. (Tomáš Ženčák) - reader: Fix preservation of attributes - parser: Always decode entities in namespace URIs - relaxng: Fix tree corruption in xmlRelaxNGParseNameClass (Seiya Nakata) - schemas: Fix ADD_ANNOTATION - tree: Fix tree iteration in xmlDOMWrapRemoveNode - tree: Declare namespace on clone in xmlDOMWrapCloneNode - tree: Fix xmlAddSibling with last sibling - tree: Fix xmlDocSetRootElement with multiple top-level elements - catalog: Fetch XML catalog before dumping - html: Don't close fd in htmlCtxtReadFd ### Improvements - parser: Fix "Truncated multi-byte sequence" error - Add missing _cplusplus processing clause (Sadaf Ebrahimi) - parser: Rework handling of undeclared entities - SAX2: Warn if URI resolution failed - parser: Don't report error on invalid URI - xmllint: Clean up option handling - xmllint: Rework parsing - parser: Don't create undeclared entity refs in substitution mode - Make some globals const - reader: Make xmlTextReaderReadString non-recursive - reader: Rework xmlTextReaderRead{Inner,Outer}Xml - Remove redundant size check (Niels Dossche) - Remove redundant NULL check on cur (Niels Dossche) - Remove always-false check old == cur (Niels Dossche) - Remove redundant NULL check on cur (Niels Dossche) - tree: Don't return empty localname in xmlSplitQName{2,3} - xinclude: Don't try to fix base of non-elements - tree: Don't coalesce text nodes in xmlAdd{Prev,Next}Sibling - SAX2: Optimize appending children - tree: Align xmlAddChild with other node insertion functions - html: Use binary search in htmlEntityValueLookup - io: Allocate output buffer with XML_BUFFER_ALLOC_IO - encoding: Don't shrink input too early in xmlCharEncOutput - tree: Tighten source doc check in xmlDOMWrapAdoptNode - tree: Check destParent->doc in xmlDOMWrapCloneNode - tree: Refactor text node updates - tree: Refactor node insertion - tree: Refactor element creation and parsing of attribute values - tree: Simplify xmlNodeGetContent, xmlBufGetNodeContent - buf: Don't use default buffer size for small strings - string: Fix xmlStrncatNew(NULL, "") - entities: Don't allow null name in xmlNewEntity - html: Fix quadratic behavior in htmlNodeDump - tree: Rewrite xmlSetTreeDoc - valid: Rework xmlAddID - tree: Remove unused node types - tree: Make namespace comparison more consistent - tree: Don't allow NULL name in xmlSetNsProp - tree: Rework xmlNodeListGetString - tree: Rework xmlTextMerge - tree: Rework xmlNodeSetName - tree: Simplify xmlAddChild with text parent - tree: Disallow setting content of entity reference nodes - tree: Rework xmlReconciliateNs - schemas: fix spurious warning about truncated snprintf output (Benjamin Gilbert) - xmlschemastypes: Remove unreachable if statement (Maks Mishin) - relaxng: Remove useless if statement (Maks Mishin) - tree: Check for integer overflow in xmlStringGetNodeList - http: Improve error message for HTTPS redirects - catalog: Remove Windows hack - save: Move DTD serialization code to xmlsave.c - parser: Report fatal error if document entity couldn't be loaded - xpath: Fix return of empty node-set in xmlXPathNodeCollectAndTest - SAX2: Limit entity URI length to 2000 bytes - parser: Account for full size of non-well-formed entities - parser: Pop inputs if parsing DTD failed - parser: Fix quadratic behavior when copying entities - writer: Implement xmlTextWriterClose - parser: Avoid duplicate namespace errors - parser: Add XML_PARSE_NO_XXE parser option - parser: Make xmlParseContent more useful - error: Make xmlFormatError public - encoding: Check whether encoding handlers support input/output - SAX2: Enforce size limit in xmlSAX2Text with XML_PARSE_HUGE - parser: Lower maximum entity nesting depth - parser: Set depth limit to 2048 with XML_PARSE_HUGE - parser: Implement xmlCtxtSetOptions - parser: Always prefer option members over bitmask - parser: Don't modify SAX2 handler if XML_PARSE_SAX1 is set - parser: Rework parsing of attribute and entity values - save: Output U+FFFD replacement characters - parser: Simplify entity size accounting - parser: Avoid unwanted expansion of parameter entities - parser: Always copy content from entity to target - parser: Simplify control flow in xmlParseReference - parser: Remove xmlSetEntityReferenceFunc feature - parser: Push general entity input streams on the stack - parser: Move progressive flag into input struct - parser: Fix in-parameter-entity and in-external-dtd checks - xpath: Rewrite substring-before and substring-after - xinclude: Only set xml:base if necessary - xinclude: Allow empty nodesets - parser: Rework general entity parsing - io: Fix close error handling - io: Fix read/write error handling - io: More refactoring and unescaping fixes - io: Move some code from xmlIO.c to parserInternals.c - uri: Clean up special parsing modes - xinclude: Rework xml:base fixup - parser: Also set document properties when push parsing - include: Move non-generated parts from xmlversion.h.in - io: Remove support for HTTP POST - dict: Move local RNG state to global state - dict: Get random seed from system PRNG - io: Don't use "-" to read from stdin - io: Rework initialization - io: Consolidate error messages - xzlib: Fix harmless unsigned integer overflow - io: Always use unbuffered input - io: Fix detection of compressed streams - io: Pass error codes from xmlFileOpenReal to xmlNewInputFromFile - io: Rework default callbacks - error: Stop printing some errors by default - xpath: Don't free nodes of XSLT result value trees - valid: Fix handling of enumerations - parser: Allow recovery in xmlParseInNodeContext - encoding: Support ASCII in xmlLookupCharEncodingHandler - include: Remove useless 'const' from function arguments - Avoid EDG -Wignored-qualifiers warnings on wrong 'const *' to '* const' conversions (makise-homura) - Avoid EDG deprecation warnings for LCC compiler (makise-homura) - Avoid EDG -Woverflow warnings on truncating conversions by manually truncating operand (makise-homura) - Avoid EDG -Wtype-limits warnings on unsigned comparisons with zero by conversion from unsigned int to int (makise-homura) - Avoid using no_sanitize attribute on EDG even if compiler shows as GCC (makise-homura) ### Build systems - meson: convert boolean options to feature option (Rosen Penev) - meson: Pass LIBXML_STATIC in dependency (Andrew Potter) - meson: fix compilation with local binaries (Rosen Penev) - meson: don't use dl dependency on old meson (Rosen Penev) - meson: fix usage as a subproject (Rosen Penev) - autotools: Fix pthread detection on FreeBSD - build: Remove --with-fexceptions configuration option - autotools: Remove --with-coverage configuration option - build: Disable HTTP support by default - Stop defining _REENTRANT - doc: Don't install example code - meson: Initial commit (Vincent Torri) - build: Disable support for compression libraries by default - Set LIBXML2_FOUND if it has been properly configured (Michele Bianchi) - Makefile.am: omit $(top_builddir) from DEPS and LDADDS (Mike Dalessio) ### Test suite - runtest: Work around broken EUC-JP support in musl iconv - runtest: Check for IBM-1141 encoding handler - fuzz: Add xmllint fuzzer - fuzz: Add fuzzer for XML reader API - fuzz: New tree API fuzzer - tests: Remove testOOM - Don't let gentest.py cast types to 'const somethingPtr' to avoid -Wignored-qualifiers (makise-homura) 2.12.8 ### Regressions - parser: Fix performance regression when parsing namespaces 2.12.7 ### Security - [CVE-2024-34459] Fix buffer overread with `xmllint --htmlout` ### Regressions - xmllint: Fix --pedantic option - save: Handle invalid parent pointers in xhtmlNodeDumpOutput 2.12.6 ### Regressions - parser: Fix detection of duplicate attributes in XML namespace - xmlreader: Fix xmlTextReaderConstEncoding - html: Fix htmlCreatePushParserCtxt with encoding - xmllint: Return error code if XPath returns empty nodeset 2.12.5 ### Security - [CVE-2024-25062] xmlreader: Don't expand XIncludes when backtracking ### Regressions - parser: Fix crash in xmlParseInNodeContext with HTML documents 2.12.4 ### Regressions - parser: Fix regression parsing standalone declarations - autotools: Readd --with-xptr-locs configuration option - parser: Fix build --without-output - parser: Don't grow or shrink pull parser memory buffers - io: Fix memory lifetime issue with input buffers Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:10:36 +00:00
Adolf Belka	5814de8054	libusb: Update to version 1.0.27 ... - Update from version 1.0.26 to 1.0.27 - Update of rootfile - Changelog 1.0.27 * New libusb_init_context API to replace libusb_init * New libusb_get_max_alt_packet_size API * New libusb_get_platform_descriptor API (BOS) * Allow setting log callback with libusb_set_option/libusb_init_context * New WebAssembly + WebUSB backend using Emscripten * Fix regression in libusb_set_interface_alt_setting * Fix sync transfer completion race and use-after-free * Fix hotplug exit ordering * Linux: NO_DEVICE_DISCOVERY option set per context * macOS: Fix missing device list cleanup locking * macOS: Do not clear device data toggle for newer OS versions * macOS: Fix running binaries on older OS than build host * Windows: Allow claiming multiple associated interfaces * Windows: Ignore non-configured devices instead of waiting * Windows: Improved root hub detection Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:09:38 +00:00
Adolf Belka	db9698c9cc	libsodium: Update to version 1.0.20 ... - Update from version 1.0.19 to 1.0.20 - Update of rootfile - Changelog 1.0.20 This point release includes all the changes from 1.0.19-stable, mainly addressing compilation issues and improvements to the .NET packages. * Version 1.0.19-stable - Building with `zig build` now requires Zig 0.12. - When using the traditional build system, -O3 is used instead of -Ofast. - Improved detection of the compiler flags required on aarch64. - Improved compatibility with custom build systems on aarch64. - apple-xcframework: VisionOS packages are not built if Xcode doesn't include that SDK. - `crypto_kdf_hkdf_sha512_statebytes()` was added. - When using Visual Studio, runtime CPU feature detection is now enabled on Windows/aarch64. - There were issues with C++ guards affecting usage of libsodium using Swift on Windows. This has been fixed. - Emscripten: `crypto_aead_aegis*()` functions are now exported in JavaScript builds - Emscripten: unsupported `--memory-init-file` option has been removed. - apple-xcframework: the minimal deployment target can be set to iOS 11+. - .NET packages now include precompiled libraries for Windows/arm64, iOS, TvOS and Catalyst. - .NET precompiled libraries now work on any CPUs, using only runtime feature detection. - SYSV assembly should not be used when targeting Windows (reported by @meiyese, thanks!) - Compatibility issues with LLVM 18 and AVX512 have been addressed. - GitHub attestation build provenance are now added to NuGet packages. - JavaScript tests can now use Bun as an alternative to Node. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:09:07 +00:00
Adolf Belka	5bc1ac8143	libtiff: Update to version 4.6.0 ... - Update from version 4.5.1 to 4.6.0 - Update of rootfile - Included options to disable static library and docs. - The removed functionality mentioned in the changelog below was already mentioned in earlier version updates. As far as I could tell none of the functionality that has been removed is used in IPFire. - Changelog 4.6.0 Major changes warning This version removes a big number of utilities that have suffered from lack of maintenance over the years and were the source of various reported security issues. See "Removed functionality" below for the list of removed utilities. Starting with libtiff v4.6.0, the source code for most TIFF tools (except tiffinfo, tiffdump, tiffcp and tiffset) was discontinued, due to the lack of contributors able to address reported security issues. tiff2ps and tiff2pdf source code has been moved in a unsupported category, no longer built by default, but are still part of the the source distribution. Other retired utilities are in a archive/ directory, only available in the libtiff git repository. Issues related to unsupported and archived tools will no longer be accepted in the libtiff bug tracker. Software configuration changes TiffConfig.cmake.in: set TIFF_INCLUDE_DIR, TIFF_INCLUDE_DIRS and TIFF_LIBRARIES for compatibility with FindTIFF.cmake as shipped by CMake (fixes issue #589) Update CMake and autoconf scripts to consistently update LibTIFF version defines and references in various files when version definition in configure.ac has been changed. Move in tiffvers.h from libtiff source directory to libtiff build directory. Remove unused version information from tif_config.h With every CMake build the version defines (e.g. 4.5.1) within tiffvers.h are consistently updated from configure.ac. The version release-date is taken from file RELEASE-DATE. The files VERSION and RELEASE-DATE are only updated with a special CMake target build: cmake --build . --target tiff_release. For autotools, version information is updated from configure.ac with ./autogen.sh. LIBTIFF_RELEASE_DATE is taken form file RELEASE-DATE. ./configure generates tiffvers.h with the cached version information and LIBTIFF_RELEASE_DATE. "make release" updates tiffvers.h and VERSION file with cached version info and RELEASE-DATE file and tiffves.h with the current date. CMake: fix build with -Dstrip-chopping=off (fixes issue #600) Library changes New/improved functionalities: Fix using __attribute__ libtiff with clang-for-windows Bug fixes: WebP decoder: validate WebP blob width, height, band count against TIFF parameters to avoid use of uninitialized variable, or decoding corrupted content without explicit error (fixes issue #581, issue #582). WebP codec: turn exact mode when creating lossless files to avoid altering R,G,B values in areas where alpha=0 (https://github.com/OSGeo/gdal/issues/8038) Fix TransferFunction writing of only two transfer functions. TIFFReadDirectoryCheckOrder: avoid integer overflow. When it occurs, it should be harmless in practice though (https://gitlab.com/libtiff/libtiff/-/merge_requests/512) Documentation TiffField functions documentation updated with return behaviour for not defined tags and determination of write-/read-count size. Tools changes Removed functionality: The following tools are no longer compiled and have been moved to archive/tools: fax2ps fax2tiff pal2rgb ppm2tiff raw2tiff rgb2ycbcr thumbnail tiff2bw tiff2rgba tiffcmp tiffcrop tiffdither tiffgt tiffmedian The following tools are no longer compiled by default: tiff2ps and tiff2pdf. They have been moved to tools/unsupported. They can be built by setting --enable-tools-unsupported for autoconf, or -Dtiff-tools-unsupported for CMake, but as the name imply, they are no longer supported by upstream. Packagers are suggested not to enable those options. tiffcp: remove -i option (ignore errors), because almost all fuzzer issues were consequential errors from ignored errors because of the "-i" option. Bug fixes: tiffset: fix #597: warning: comparison of integer expressions of different signedness. (fixes issue #597) tiffcp: fix memory corruption (overflow) on hostile images (fixes issue #591) Test changes Add missing test_write_read_tags.c and test_transferfunction_write_read.c in tarball (fixes issue #585) and correct "long" issue. Don't use "long" because can be int32_t or int64_t, depending on compiler and system. Changes to contributed and unsupported tools raw2tiff: fix integer overflow and bypass of the check (fixes issue #592) Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:04:34 +00:00
Adolf Belka	5d00ef14b0	libqmi: Update to version 1.34.0 ... - Update from version 1.30.8 to 1.34.0 - Update of rootfile - Autotools build has been removed in 1.32.0 and changed to meson. In previous autotools version other protocol options were auto checked and if dependencies were not present then the options were not built. In meson those are defined by default as being required and if dependencies are not present then the build fails. So those other options have to be explicitly made false for meson. - Library is only built in shared form. - man pages have been disabled. - Changelog 1.34.0 * Build: ** Flag types are now generated in their own 'qmi-flag-types.[c|h]' files. ** A new 'enable_fuzzer' option is available to build LLVM LibFuzzer based unit testers. * New services: ** New 'ATR' service to support AT commands over QMI, defined by Telit, including "Send" request and "Received" indication. ** New 'IMS' service, including "Get IMS Services Enabled Setting" request/response. ** New 'IMSA' (IMS Application) service, including "Get IMS Registration Status" and "Get IMS Services Status" request/responses. ** New 'IMSP' (IMS Presence) service, including "Get Enabler State" request/response. ** New 'SSC' service (Qualcomm Snapdragon Sensor Core), including the "Control" request/response, and "Report Small"/"Report Large" indications. * New TLVs supported in existing messages: ** nas: added the "WCDMA RSCP" TLV in "Get Signal Info" response and "Signal Info" indication. ** wds: added the "Report Profile Changes" TLV in "Indication Register". * libqmi-glib: ** Support for 16-bit service ids added, used in the QRTR backend. ** Response and indication parser messages are now published in the API. ** The library now allows connecting to a unix domain socket named 'qmux_socket' instead of a device file. ** Extended the 'QmiWdsProfileType' enum type with EPC and ALL values. ** Extended the 'QmiUimCardApplicationPersonalizationFeature' enum type with additional GW-related values. ** New 'QmiUimCardApplicationPersonalizationFeatureStatus' enum type. ** New 'QmiImspEnablerState' enum type, used in the IMPS service. ** New 'QmiImsaImsRegistrationStatus', 'QmiImsaServiceStatus' and 'QmiImsaRegistrationTechnology' enum types, used in the IMSA service. ** Updated the QRTR endpoint to ensure error responses are returned early when the builtin CTL operations fail. ** Deprecated QMI_UIM_CARD_APPLICATION_PERSONALIZATION_FEATURE_UNKNOWN, and provided compat symbols. ** Updated the enum type of the "Personalization Feature" field in the Element struct type used in the Applications array in the "UIM Card Status" response and indication messages, and provided appropriate compat symbols. ** Flagged PIN/PUK value fields as personal info. ** Fixed missing 'since' tags in struct and common types. * qmicli: ** New '--uim-remote-unlock' command. ** New '--imsp-get-enabler-state' command. ** New '--imsa-get-ims-registration-status' and '--imsa-get-ims-services-status' commands. ** New '--ims-get-ims-services-enabled-setting' command. ** New '--atr-send', '--atr-send-only' and '--atr-monitor' commands. * collections: ** basic: added NAS cell location retrieval commands. ** basic: added WDS profile event change commands. * Several other minor improvements and fixes. * All fixes and improvements that were backported to 1.32.x releases are also present in libqmi 1.34.0. 1.32.0 * There is no longer an upstream-provided source tarball, please use the signed git tag '1.32.0' instead to refer to the sources of this release. * The verbose message logging will now by default hide all fields that are considered personal information. Extended message logging including all field contents should be explicitly requested. * Build: ** The GNU autotools (autoconf/automake/libtool) support has been fully removed, this release requires the use of the meson build system. ** The 'instrospection' meson option is now a boolean. ** New boolean 'man' meson option to allow disabling the man page generation. * New services: ** New 'FOX' service for operations defined by Foxconn, including "Get Firmware Version" for now. * New request/response/indications: ** pdc: implement "Refresh" indication. ** gas: implement "DMS Get USB composition" request/response. ** gas: implement "DMS Set USB composition" request/response. ** wds: implement "Indication Register" request/response. ** wds: implement "Extended Ip Config" indication. ** dsd: implement "Get System Status" request/response. ** dsd: implement "System Status Change" request/response. ** dsd: implement "System Status" indication. ** voice: implement "Burst DTMF" request/response. ** voice: implement "Start Continuous DTMF" request/response. ** voice: implement "Stop Continuous DTMF" request/response. ** uim: implement "Remote Unlock" request/response. ** nas: implement "Config Signal Info v2" request/response. * New TLVs supported in existing messages: ** pdc: added "Enable Refresh" TLV in "Register" request. ** nas: added "5G Signal Strength" TLV in "Signal Info" indication. ** dms: added "NR5G Band Capability" TLV in "Get Band Capabilities" response. ** nas: added "NR5G SA/NSA band preference" TLVs in "Get/Set System Selection Preference" request/response. ** wds: added "Operator Reserved PCO" TLV in "Get Current Settings". ** wda: added "Uplink Data Aggregation Max Datagrams" TLV in "Set Data Format" request. ** wda: added "Uplink Data Aggregation Max Size" TLV in "Set Data Format" request. * libqmi-glib: ** New 'QmiFoxFirmwareVersionType' enum type. ** New 'QmiPdcRefreshEventType' enum type. ** New 'QmiGasUsbCompositionEndpointType' enum type. ** New 'QmiDsdDataSystemNetworkType' enum type. ** New 'QmiDsdRadioAccessTechnology' enum type. ** New 'QmiDsdSoMask' enum type. ** New 'QMI_DMS_RADIO_INTERFACE_TDS' value in the 'QmiDmsRadioInterface' enum type. ** New 'QMI_WDS_GET_CURRENT_SETTINGS_REQUESTED_SETTINGS_OPERATOR_RESERVED_PCO' value in 'QmiWdsGetCurrentSettingsRequestedSettings'. ** New 'QMI_DEVICE_ADD_LINK_FLAGS_INGRESS_MAP_CKSUMV5' and 'QMI_DEVICE_ADD_LINK_FLAGS_INGRESS_MAP_CKSUMV5' values in the 'QmiDeviceAddLinkFlags' enum type, enabling support to request QMAPv5 checksum offload for both TX and RX paths. ** Extended the 'QmiNasActiveBand' enum type with 5GNR bands. ** Implemented support to monitor the consecutive QMI request timeouts in the QmiDevice object, with a 'QMI_DEVICE_CONSECUTIVE_TIMEOUTS' signal and a 'qmi_device_get_consecutive_timeouts()' method. ** Fixed the "GERAN Info" TLV in "NAS Get Cell Location Info" compat layer. ** Fixed leak on unexpected message error processing in QmiDevice. ** Renamed the 'QmiWdsGetCurrentSettingsRequestedSettings' flags type to 'QmiWdsRequestedSettings'. ** Updated the code generator to avoid needing intermediate struct types in several operations, and provided appropriate compat methods: *** pdc: removed the 'QmiConfigTypeAndId' intermediate struct. *** loc: removed the 'QmiIndicationLoc...GpsTime intermediate' structs. *** loc: removed the 'QmiIndicationLoc...DilutionOfPrecision' intermediate structs. *** dms: removed the 'QmiMessageDmsGetStoredImageInfoInputImage' intermediate struct. *** dms: removed the 'QmiMessageDmsDeleteStoredImageInputImage' intermediate struct. ** Updated the code generator to avoid needing arrays of arrays in several operations, and provided appropriate compat methods: *** uim: avoid array of arrays in "Slot EID Information". *** uim: avoid array of arrays in "Personalization Status Other". ** Updated the code generator to generate GIR compat helpers for arrays of structs, so that language bindings can properly use the methods using that kind of types. This change makes the library include a lot of new methods suffixed with _gir() which are only expected to be used via introspection. ** Implemented a lot of cleanups and improvements in the code generator. * qmicli: ** New '--verbose-full' option to request enabling logs that include personal information. ** New '--pdc-monitor-refresh' command. ** New '--gas-dms-set-usb-composition' and '--gas-dms-get-usb-composition' commands. ** New '--wms-set-routes' command. ** New '--dsd-get-system-status' command. ** Updated the '--wda-set-data-format' command with new optional fields to configure the uplink data aggregation max size and max datagrams. * qmi-firmware-update: ** Implemented support for normal upgrade operations even when udev is not available in the system (e.g. openwrt). * collections: ** basic: added UIM remote unlock operation. ** basic: added NAS signal info v2 operation. ** basic: added SAR management operations. ** basic: added LTE attach PDN list operation. ** basic: added PCO support related operations. ** basic: added Foxconn firmware version management operation. ** basic: added DSD system status and attach/detach related operations. ** basic: added voice DTMF support operations. * Several other minor improvements and fixes. The following features which were backported to 1.30.x releases are also present in libqmi 1.32.0: ** libqmi-glib: use unaligned netlink attribute length. ** qmi-proxy: remove assert when attempting to close ghost device. ** qmi-firmware-update: use defaults if FLASH variables not reported, enabling support to flash the Sierra Wireless EM91xx modules in USB mode. ** voice: implement "Get All Call Info" request/response. ** dms: implement "Foxconn Set FCC Authentication v2" request/response. ** qmicli: new '--dms-foxconn-set-fcc-authentication-v2' command. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-13 09:04:04 +00:00
Adolf Belka	99b2ac48af	libcap: Update to version 2.70 ... - Update from version 2.69 to 2.70 - Update of rootfile - sobump means following core packages need to be shipped arping cdrkit iproute2 iputils ntp squid udev and the following addons will be shipped with the pak_ver increments in the other patches that are part ofg this set avahi bacula cifs-utils dnsdist freeradius frr htop nfs rng-tools samba tor tshark vdr wavemon - Changelog 2.70 setcap changes to make it harder to set invalid file capabilities (Bug 217592\ reported by parke.nexus) Lots of documentation fixes (contributions from Jakub Wilk and Carlos Rodriguez-Fernandez) Fix c89 compilation syntax for the C code in the libraries. libpam has deprecated providing the _pam_overwrite() function, so use memset() instead Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-09 14:22:12 +00:00
Adolf Belka	3192cd3036	libnet: Update to version 1.3 ... - Update from version 1.1.6 to 1.3 - Update of rootfile - sobump gives suricata and arping as dependencies so those packages also need to be shipped. - Changelog 1.3 ### Changes - License change of critical files from 4-clause BSD to 3-clause and 2-clause BSD. This fixes issue #85: "GPL license compatibility". - Migrate from Travis-CI (Linux) and Appveyor (Win32) to GitHub Actions - Win32 changes: - switch to npcap from winpcap - Simplify and update build scripts - Encode version in DLL instead of in filename - Add support for LLDP, mandatory TLVs. - Add support for Cisco UniDirectional Link Detection (UDLD), RFC5171 - Initial support for unit tests: - `libnet-build_ethernet()` - Complete UDLD API tests - Initial "devcontainer": provide VS Code development environment for rapid setup of a development environment - Run unit tests in GitHub Actions - New GitHub Action for FreeBSD 13 clang/gcc - Calling `libnet_init()` with a RAW type no longer sets a TX buffer max size. Use the new `libnet_setfd_max_sndbuf()` instead when needed. - Remove support for `SOCK_PACKET` sockets causing invalid builds on, e.g., musl libc. We assume everyone on Linux has `PF_PACKET` now. ### Fixes - Fix #139: fail-to-build-from-source on FreeBSD - Fix #122: unused parameter warnings - Fix #123: potential memory leak in `libnet_cq_add()` - Fix #124: potential name conflict with C++ keyword `new` - Fix #96: pointer type warnings when dumping raw data with `%p` - Fix #97: non-standard types: - `int64_t` instead of `__int64_t` for mingw cross build - `uint32_t` instead of `u_int` and `uint16_t` instead of `u_short` - Fix #98: lots of signed vs unsigned comparisons - Fix #102: possible buffer overflows in `libnet_plist_chain_dump_string()` - Reproducible build fixes for man-page generation, use LC_ALL=C and UTC - Simplify `fixmanpages` - Fix #120: possible NULL pointer dereference in `libnet_cq_add()` - Fix #120: memory leak in `libnet_plist_chain_new()` - Fix segmentation fault in `libnet_ifaddrlist()` - Fix #150: segfault when number of IPs > 512 1.2 ### Changes - Removed Lua bindings from repo and dist files, now available separately - Removed generated HTML and Nroff (man pages) documentation files, must be regenerated with Doxygen using `make doc` - Add `pkg-config` support with `libnet.pc`, replaces `libnet-config` tool, although it is kept for compatibility for now - Factorize socket setup code for socket opening to provide output device selection for IPv4 - Make `libnet_get_hwaddr()` work with 802.1q interfaces in bpf (BSD) - New API for OSPF HELLO messages, with neighbor ### Fixes - Use `getifaddrs()` on OpnBSD and Linux - For samples, `netinet/in.h` is not on windows - Fix errors with missing `IPPROTO_MH` on windows - Fix build error on Mac OS X - Fix #34 checksum caculation when IPv6 extension headers being used - Remove unneeded trailing `-Wl` from `-version-info` line - `libnet_build_snmp()` fix warning - Use `LIBNET_*RESOLVE` const in `libnet_name2addr*` - Fix i486 sample synflood6 warning - Some samples need `#include<netinet/in.h>` for `IPPROTO_*` on OpenBSD 5.2 - Fix gcc warnings - Check for `socklen_t`. Suggested by g.esp and Stefanos Harhalakis - libnet: update for obsolete INCLUDE directive - Fix warning inside comment - Automatic link options `#pragma comment(lib, ...)` are only for MSVC - Fix several warnings for MS C/C++ compiler - `libnet_open_raw4()` doesn't return a SOCKET on win32 - Fixes error messages sometimes include newline, sometimes not - Properly set `l->err_buf` if `libnet_ifaddrlist()` fails - dlpi: Try harder to find the device for the interface - dlpi: Correctly extract unit number from devices with numbers in their name - Make interface selection work for interfaces with multiple addresses - Fix memory leak, device list needs to freed after use - Fix file descriptor leak in `libnet_ifaddrlist()` - Fix `libnet_get_hwaddr()` for large(!) number of interfaces - Fix to support musl libc, removes support for GLIBC <2.1 - Fix win32 buffer overrun in `libnet_get_ipaddr4()` - Interface selection was ignoring interfaces with IPv6 - Use `LIBNET_API` on public functions, instead of an export file - Add Visual Studio 2010 project files, with build instructions - Define INET6 on IRIX, making libnet compile cleanly - Check for FreeBSD pre-11 before enabling `LIBNET_BSD_BYTE_SWAP` - Use `LIBNET_BSDISH_OS` and `LIBNET_BSD_BYTE_SWAP` on Darwin - Add BSD byteswap for Darwin. Otherwise `sendto(` returns `EINVAL` - `netinet/in.h` is needed for `IPPROTO_` and `sockaddr_in` Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-09 14:21:42 +00:00
Adolf Belka	05971bd7d0	libgcrypt: Update to version 1.11.0 ... - Update from version 1.10.3 to 1.11.0 - Update of rootfile - Update of libgcrypt requires an update of netatalk as old version will not build with libgcrypt-1.11.0 - Changelog 1.11.0 * New and extended interfaces: - Add an API for Key Encapsulation Mechanism (KEM). [T6755] - Add Streamlined NTRU Prime sntrup761 algorithm. [rCcf9923e1a5] - Add Kyber algorithm according to FIPS 203 ipd 2023-08-24. [rC18e5c0d268] - Add Classic McEliece algorithm. [rC003367b912] - Add One-Step KDF with hash and MAC. [T5964] - Add KDF algorithm HKDF of RFC-5869. [T5964] - Add KDF algorithm X963KDF for use in CMS. [rC3abac420b3] - Add GMAC-SM4 and Poly1305-SM4. [rCd1ccc409d4] - Add ARIA block cipher algorithm. [rC316c6d7715] - Add explicit FIPS indicators for MD and MAC algorithms. [T6376] - Add support for SHAKE as MGF in RSA. [T6557] - Add gcry_md_read support for SHAKE algorithms. [T6539] - Add gcry_md_hash_buffers_ext function. [T7035] - Add cSHAKE hash algorithm. [rC065b3f4e02] - Support internal generation of IV for AEAD cipher mode. [T4873] * Performance: - Add SM3 ARMv8/AArch64/CE assembly implementation. [rCfe891ff4a3] - Add SM4 ARMv8/AArch64 assembly implementation. [rCd8825601f1] - Add SM4 GFNI/AVX2 and GFI/AVX512 implementation. [rC5095d60af4,rCeaed633c16] - Add SM4 ARMv9 SVE CE assembly implementation. [rC2dc2654006] - Add PowerPC vector implementation of SM4. [rC0b2da804ee] - Optimize ChaCha20 and Poly1305 for PPC P10 LE. [T6006] - Add CTR32LE bulk acceleration for AES on PPC. [rC84f2e2d0b5] - Add generic bulk acceleration for CTR32LE mode (GCM-SIV) for SM4 and Camellia. [rCcf956793af] - Add GFNI/AVX2 implementation of Camellia. [rC4e6896eb9f] - Add AVX2 and AVX512 accelerated implementations for GHASH (GCM) and POLYVAL (GCM-SIV). [rCd857e85cb4, rCe6f3600193] - Add AVX512 implementation for SHA512. [rC089223aa3b] - Add AVX512 implementation for Serpent. [rCce95b6ec35] - Add AVX512 implementation for Poly1305 and ChaCha20 [rCcd3ed49770, rC9a63cfd617] - Add AVX512 accelerated implementation for SHA3 and Blake2 [rCbeaad75f46,rC909daa700e] - Add VAES/AVX2 accelerated i386 implementation for AES. [rC4a42a042bc] - Add bulk processing for XTS mode of Camellia and SM4. [rC32b18cdb87, rCaad3381e93] - Accelerate XTS and ECB modes for Twofish and Serpent. [rCd078a928f5,rC8a1fe5f78f] - Add AArch64 crypto/SHA512 extension implementation for SHA512. [rCe51d3b8330] - Add AArch64 crypto-extension implementation for Camellia. [rC898c857206] - Accelerate OCB authentication on AMD with AVX2. [rC6b47e85d65] * Bug fixes: - For PowerPC check for missing optimization level for vector register usage. [T5785] - Fix EdDSA secret key check. [T6511] - Fix decoding of PKCS#1-v1.5 and OAEP padding. [rC34c2042792] - Allow use of PKCS#1-v1.5 with SHA3 algorithms. [T6976] - Fix AESWRAP padding length check. [T7130] * Other: - Allow empty password for Argon2 KDF. [rCa20700c55f] - Various constant time operation imporvements. - Add "bp256", "bp384", "bp512" aliases for Brainpool curves. - Support for the random server has been removed. [T5811] - The control code GCRYCTL_ENABLE_M_GUARD is deprecated and not supported any more. Please use valgrind or other tools. [T5822] - Logging is now done via the libgpg-error logging functions. [rCab0bdc72c7] Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-09 10:41:05 +00:00
Adolf Belka	31f0c0b289	libjpeg: Update to version 3.0.3 ... - Update from version 2.1.4 to 3.0.3 - Update of rootfile - CVE fix in 3.0.0 - Changelog 3.0.3 1. Fixed an issue in the build system, introduced in 3.0.2, that caused all libjpeg-turbo components to depend on the Visual C++ run-time DLL when built with Visual C++ and CMake 3.15 or later, regardless of value of the `WITH_CRT_DLL` CMake variable. 2. The x86-64 SIMD extensions now include support for Intel Control-flow Enforcement Technology (CET), which is enabled automatically if CET is enabled in the C compiler. 3. Fixed a regression introduced by 3.0 beta2[6] that made it impossible for calling applications to supply custom Huffman tables when generating 12-bit-per-component lossy JPEG images using the libjpeg API. 4. Fixed a segfault that occurred when attempting to use the jpegtran `-drop` option with a specially-crafted malformed input image or drop image (specifically an image in which all of the scans contain fewer components than the number of components specified in the Start Of Frame segment.) 3.0.2 1. Fixed a signed integer overflow in the `tj3CompressFromYUV8()`, `tj3DecodeYUV8()`, `tj3DecompressToYUV8()`, and `tj3EncodeYUV8()` functions, detected by the Clang and GCC undefined behavior sanitizers, that could be triggered by setting the `align` parameter to an unreasonably large value. This issue did not pose a security threat, but removing the warning made it easier to detect actual security issues, should they arise in the future. 2. Introduced a new parameter (`TJPARAM_MAXMEMORY` in the TurboJPEG C API and `TJ.PARAM_MAXMEMORY` in the TurboJPEG Java API) and a corresponding TJBench option (`-maxmemory`) for specifying the maximum amount of memory (in megabytes) that will be allocated for intermediate buffers, which are used with progressive JPEG compression and decompression, optimized baseline entropy coding, lossless JPEG compression, and lossless transformation. The new parameter and option serve the same purpose as the `max_memory_to_use` field in the `jpeg_memory_mgr` struct in the libjpeg API, the `JPEGMEM` environment variable, and the cjpeg/djpeg/jpegtran `-maxmemory` option. 3. Introduced a new parameter (`TJPARAM_MAXPIXELS` in the TurboJPEG C API and `TJ.PARAM_MAXPIXELS` in the TurboJPEG Java API) and a corresponding TJBench option (`-maxpixels`) for specifying the maximum number of pixels that the decompression, lossless transformation, and packed-pixel image loading functions/methods will process. 4. Fixed an error ("Unsupported color conversion request") that occurred when attempting to decompress a 3-component lossless JPEG image without an Adobe APP14 marker. The decompressor now assumes that a 3-component lossless JPEG image without an Adobe APP14 marker uses the RGB colorspace if its component IDs are 1, 2, and 3. 3.0.1 1. The x86-64 SIMD functions now use a standard stack frame, prologue, and epilogue so that debuggers and profilers can reliably capture backtraces from within the functions. 2. Fixed two minor issues in the interblock smoothing algorithm that caused mathematical (but not necessarily perceptible) edge block errors when decompressing progressive JPEG images exactly two MCU blocks in width or that use vertical chrominance subsampling. 3. Fixed a regression introduced by 3.0 beta2[6] that, in rare cases, caused the C Huffman encoder (which is not used by default on x86 and Arm CPUs) to generate incorrect results if the Neon SIMD extensions were explicitly disabled at build time (by setting the `WITH_SIMD` CMake variable to `0`) in an AArch64 build of libjpeg-turbo. 3.0.0 1. The TurboJPEG API now supports 4:4:1 (transposed 4:1:1) chrominance subsampling, which allows losslessly transposed or rotated 4:1:1 JPEG images to be losslessly cropped, partially decompressed, or decompressed to planar YUV images. 2. Fixed various segfaults and buffer overruns (CVE-2023-2804) that occurred when attempting to decompress various specially-crafted malformed 12-bit-per-component and 16-bit-per-component lossless JPEG images using color quantization or merged chroma upsampling/color conversion. The underlying cause of these issues was that the color quantization and merged chroma upsampling/color conversion algorithms were not designed with lossless decompression in mind. Since libjpeg-turbo explicitly does not support color conversion when compressing or decompressing lossless JPEG images, merged chroma upsampling/color conversion never should have been enabled for such images. Color quantization is a legacy feature that serves little or no purpose with lossless JPEG images, so it is also now disabled when decompressing such images. (As a result, djpeg can no longer decompress a lossless JPEG image into a GIF image.) 3. Fixed an oversight in 1.4 beta1[8] that caused various segfaults and buffer overruns when attempting to decompress various specially-crafted malformed 12-bit-per-component JPEG images using djpeg with both color quantization and RGB565 color conversion enabled. 4. Fixed an issue whereby `jpeg_crop_scanline()` sometimes miscalculated the downsampled width for components with 4x2 or 2x4 subsampling factors if decompression scaling was enabled. This caused the components to be upsampled incompletely, which caused the color converter to read from uninitialized memory. With 12-bit data precision, this caused a buffer overrun or underrun and subsequent segfault if the sample value read from uninitialized memory was outside of the valid sample range. 5. Fixed a long-standing issue whereby the `tj3Transform()` function, when used with the `TJXOP_TRANSPOSE`, `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or `TJXOP_ROT270` transform operation and without automatic JPEG destination buffer (re)allocation or lossless cropping, computed the worst-case transformed JPEG image size based on the source image dimensions rather than the transformed image dimensions. If a calling program allocated the JPEG destination buffer based on the transformed image dimensions, as the API documentation instructs, and attempted to transform a specially-crafted 4:2:2, 4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a large amount of metadata, the issue caused `tj3Transform()` to overflow the JPEG destination buffer rather than fail gracefully. The issue could be worked around by setting `TJXOPT_COPYNONE`. Note that, irrespective of this issue, `tj3Transform()` cannot reliably transform JPEG source images that contain a large amount of metadata unless automatic JPEG destination buffer (re)allocation is used or `TJXOPT_COPYNONE` is set. 6. Fixed a regression introduced by 3.0 beta2[6] that prevented the djpeg `-map` option from working when decompressing 12-bit-per-component lossy JPEG images. 7. Fixed an issue that caused the C Huffman encoder (which is not used by default on x86 and Arm CPUs) to read from uninitialized memory when attempting to transform a specially-crafted malformed arithmetic-coded JPEG source image into a baseline Huffman-coded JPEG destination image. 2.1.91 1. Significantly sped up the computation of optimal Huffman tables. This speeds up the compression of tiny images by as much as 2x and provides a noticeable speedup for images as large as 256x256 when using optimal Huffman tables. 2. All deprecated fields, constructors, and methods in the TurboJPEG Java API have been removed. 3. Arithmetic entropy coding is now supported with 12-bit-per-component JPEG images. 4. Overhauled the TurboJPEG API to address long-standing limitations and to make the API more extensible and intuitive: - All C function names are now prefixed with `tj3`, and all version suffixes have been removed from the function names. Future API overhauls will increment the prefix to `tj4`, etc., thus retaining backward API/ABI compatibility without versioning each individual function. - Stateless boolean flags have been replaced with stateful integer API parameters, the values of which persist between function calls. New functions/methods (`tj3Set()`/`TJCompressor.set()`/`TJDecompressor.set()` and `tj3Get()`/`TJCompressor.get()`/`TJDecompressor.get()`) can be used to set and query the value of a particular API parameter. - The JPEG quality and subsampling are now implemented using API parameters rather than stateless function arguments (C) or dedicated set/get methods (Java.) - `tj3DecompressHeader()` now stores all relevant information about the JPEG image, including the width, height, subsampling type, entropy coding algorithm, etc., in API parameters rather than returning that information through pointer arguments. - `TJFLAG_LIMITSCANS`/`TJ.FLAG_LIMITSCANS` has been reimplemented as an API parameter (`TJPARAM_SCANLIMIT`/`TJ.PARAM_SCANLIMIT`) that allows the number of scans to be specified. - Optimized baseline entropy coding (the computation of optimal Huffman tables, as opposed to using the default Huffman tables) can now be specified, using a new API parameter (`TJPARAM_OPTIMIZE`/`TJ.PARAM_OPTIMIZE`), a new transform option (`TJXOPT_OPTIMIZE`/`TJTransform.OPT_OPTIMIZE`), and a new TJBench option (`-optimize`.) - Arithmetic entropy coding can now be specified or queried, using a new API parameter (`TJPARAM_ARITHMETIC`/`TJ.PARAM_ARITHMETIC`), a new transform option (`TJXOPT_ARITHMETIC`/`TJTransform.OPT_ARITHMETIC`), and a new TJBench option (`-arithmetic`.) - The restart marker interval can now be specified, using new API parameters (`TJPARAM_RESTARTROWS`/`TJ.PARAM_RESTARTROWS` and `TJPARAM_RESTARTBLOCKS`/`TJ.PARAM_RESTARTBLOCKS`) and a new TJBench option (`-restart`.) - Pixel density can now be specified or queried, using new API parameters (`TJPARAM_XDENSITY`/`TJ.PARAM_XDENSITY`, `TJPARAM_YDENSITY`/`TJ.PARAM_YDENSITY`, and `TJPARAM_DENSITYUNITS`/`TJ.PARAM_DENSITYUNITS`.) - The accurate DCT/IDCT algorithms are now the default for both compression and decompression, since the "fast" algorithms are considered to be a legacy feature. (The "fast" algorithms do not pass the ISO compliance tests, and those algorithms are not any faster than the accurate algorithms on modern x86 CPUs.) - All C initialization functions have been combined into a single function (`tj3Init()`) that accepts an integer argument specifying the subsystems to initialize. - All C functions now use the `const` keyword for pointer arguments that point to unmodified buffers (and for both dimensions of pointer arguments that point to sets of unmodified buffers.) - All C functions now use `size_t` rather than `unsigned long` to represent buffer sizes, for compatibility with `malloc()` and to avoid disparities in the size of `unsigned long` between LP64 (Un*x) and LLP64 (Windows) operating systems. - All C buffer size functions now return 0 if an error occurs, rather than trying to awkwardly return -1 in an unsigned data type (which could easily be misinterpreted as a very large value.) - Decompression scaling is now enabled explicitly, using a new function/method (`tj3SetScalingFactor()`/`TJDecompressor.setScalingFactor()`), rather than implicitly using awkward "desired width"/"desired height" arguments. - Partial image decompression has been implemented, using a new function/method (`tj3SetCroppingRegion()`/`TJDecompressor.setCroppingRegion()`) and a new TJBench option (`-crop`.) - The JPEG colorspace can now be specified explicitly when compressing, using a new API parameter (`TJPARAM_COLORSPACE`/`TJ.PARAM_COLORSPACE`.) This allows JPEG images with the RGB and CMYK colorspaces to be created. - TJBench no longer generates error/difference images, since identical functionality is already available in ImageMagick. - JPEG images with unknown subsampling configurations can now be fully decompressed into packed-pixel images or losslessly transformed (with the exception of lossless cropping.) They cannot currently be partially decompressed or decompressed into planar YUV images. - `tj3Destroy()` now silently accepts a NULL handle. - `tj3Alloc()` and `tj3Free()` now return/accept void pointers, as `malloc()` and `free()` do. - The C image I/O functions now accept a TurboJPEG instance handle, which is used to transmit/receive API parameter values and to receive error information. 5. Added support for 8-bit-per-component, 12-bit-per-component, and 16-bit-per-component lossless JPEG images. A new libjpeg API function (`jpeg_enable_lossless()`), TurboJPEG API parameters (`TJPARAM_LOSSLESS`/`TJ.PARAM_LOSSLESS`, `TJPARAM_LOSSLESSPSV`/`TJ.PARAM_LOSSLESSPSV`, and `TJPARAM_LOSSLESSPT`/`TJ.PARAM_LOSSLESSPT`), and a cjpeg/TJBench option (`-lossless`) can be used to create a lossless JPEG image. (Decompression of lossless JPEG images is handled automatically.) Refer to [libjpeg.txt](libjpeg.txt), [usage.txt](usage.txt), and the TurboJPEG API documentation for more details. 6. Added support for 12-bit-per-component (lossy and lossless) and 16-bit-per-component (lossless) JPEG images to the libjpeg and TurboJPEG APIs: - The existing `data_precision` field in `jpeg_compress_struct` and `jpeg_decompress_struct` has been repurposed to enable the creation of 12-bit-per-component and 16-bit-per-component JPEG images or to detect whether a 12-bit-per-component or 16-bit-per-component JPEG image is being decompressed. - New 12-bit-per-component and 16-bit-per-component versions of `jpeg_write_scanlines()` and `jpeg_read_scanlines()`, as well as new 12-bit-per-component versions of `jpeg_write_raw_data()`, `jpeg_skip_scanlines()`, `jpeg_crop_scanline()`, and `jpeg_read_raw_data()`, provide interfaces for compressing from/decompressing to 12-bit-per-component and 16-bit-per-component packed-pixel and planar YUV image buffers. - New 12-bit-per-component and 16-bit-per-component compression, decompression, and image I/O functions/methods have been added to the TurboJPEG API, and a new API parameter (`TJPARAM_PRECISION`/`TJ.PARAM_PRECISION`) can be used to query the data precision of a JPEG image. (YUV functions are currently limited to 8-bit data precision but can be expanded to accommodate 12-bit data precision in the future, if such is deemed beneficial.) - A new cjpeg and TJBench command-line argument (`-precision`) can be used to create a 12-bit-per-component or 16-bit-per-component JPEG image. (Decompression and transformation of 12-bit-per-component and 16-bit-per-component JPEG images is handled automatically.) 2.1.5.1 1. The SIMD dispatchers in libjpeg-turbo 2.1.4 and prior stored the list of supported SIMD instruction sets in a global variable, which caused an innocuous race condition whereby the variable could have been initialized multiple times if `jpeg_start_*compress()` was called simultaneously in multiple threads. libjpeg-turbo 2.1.5 included an undocumented attempt to fix this race condition by making the SIMD support variable thread-local. However, that caused another issue whereby, if `jpeg_start_*compress()` was called in one thread and `jpeg_read_*()` or `jpeg_write_*()` was called in a second thread, the SIMD support variable was never initialized in the second thread. On x86 systems, this led the second thread to incorrectly assume that AVX2 instructions were always available, and when it attempted to use those instructions on older x86 CPUs that do not support them, an illegal instruction error occurred. The SIMD dispatchers now ensure that the SIMD support variable is initialized before dispatching based on its value. 2.1.5 1. Fixed issues in the build system whereby, when using the Ninja Multi-Config CMake generator, a static build of libjpeg-turbo (a build in which `ENABLE_SHARED` is `0`) could not be installed, a Windows installer could not be built, and the Java regression tests failed. 2. Fixed a regression introduced by 2.0 beta1[15] that caused a buffer overrun in the progressive Huffman encoder when attempting to transform a specially-crafted malformed 12-bit-per-component JPEG image into a progressive 12-bit-per-component JPEG image using a 12-bit-per-component build of libjpeg-turbo (`-DWITH_12BIT=1`.) Given that the buffer overrun was fully contained within the progressive Huffman encoder structure and did not cause a segfault or other user-visible errant behavior, given that the lossless transformer (unlike the decompressor) is not generally exposed to arbitrary data exploits, and given that 12-bit-per-component builds of libjpeg-turbo are uncommon, this issue did not likely pose a security risk. 3. Fixed an issue whereby, when using a 12-bit-per-component build of libjpeg-turbo (`-DWITH_12BIT=1`), passing samples with values greater than 4095 or less than 0 to `jpeg_write_scanlines()` caused a buffer overrun or underrun in the RGB-to-YCbCr color converter. 4. Fixed a floating point exception that occurred when attempting to use the jpegtran `-drop` and `-trim` options to losslessly transform a specially-crafted malformed JPEG image. 5. Fixed an issue in `tjBufSizeYUV2()` whereby it returned a bogus result, rather than throwing an error, if the `align` parameter was not a power of 2. Fixed a similar issue in `tjCompressFromYUV()` whereby it generated a corrupt JPEG image in certain cases, rather than throwing an error, if the `align` parameter was not a power of 2. 6. Fixed an issue whereby `tjDecompressToYUV2()`, which is a wrapper for `tjDecompressToYUVPlanes()`, used the desired YUV image dimensions rather than the actual scaled image dimensions when computing the plane pointers and strides to pass to `tjDecompressToYUVPlanes()`. This caused a buffer overrun and subsequent segfault if the desired image dimensions exceeded the scaled image dimensions. 7. Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG image (`-DWITH_12BIT=1`) using an alpha-enabled output color space such as `JCS_EXT_RGBA`, the alpha channel was set to 255 rather than 4095. 8. Fixed an issue whereby the Java version of TJBench did not accept a range of quality values. 9. Fixed an issue whereby, when `-progressive` was passed to TJBench, the JPEG input image was not transformed into a progressive JPEG image prior to decompression. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-09 10:40:29 +00:00
Adolf Belka	0a94237668	libgpg-error: Update to version 1.50 ... - Update from version 1.48 to 1.50 - Update of rootfile - Changelog 1.50 * New set of process spawn functions. [T6249] * Fixed return type for gpgrt_b64dec_proc and gpgrt_b64dec_finish to gpg_err_code_t. This enum return type is in almost all cases compatible to the formerly used gpg_error_t (i.e. unsigned int). * Interface changes relative to the 1.49 release: gpgrt_process_t CHANGED (never used). gpgrt_spawn_actions_t NEW type. gpgrt_process_requests NEW enum. gpgrt_process_spawn NEW. gpgrt_process_terminate NEW. gpgrt_process_get_streams NEW. gpgrt_process_ctl NEW. gpgrt_process_wait NEW. gpgrt_process_release NEW. gpgrt_spawn_actions_new NEW. gpgrt_spawn_actions_release NEW. gpgrt_spawn_actions_set_redirect NEW. gpgrt_spawn_actions_set_environ NEW (posix only). gpgrt_spawn_actions_set_inherit_fds NEW (posix only). gpgrt_spawn_actions_set_atfork NEW (posix only). gpgrt_spawn_actions_set_envvars NEW (w32 only). gpgrt_spawn_actions_set_inherit_handles NEW (w32 only). GPGRT_PROCESS_DETACHED NEW. GPGRT_PROCESS_NO_CONSOLE NEW. GPGRT_PROCESS_NO_EUID_CHECK NEW. GPGRT_PROCESS_STDIN_PIPE NEW. GPGRT_PROCESS_STDOUT_PIPE NEW. GPGRT_PROCESS_STDERR_PIPE NEW. GPGRT_PROCESS_STDINOUT_SOCKETPAIR NEW. GPGRT_PROCESS_STDIN_KEEP NEW. GPGRT_PROCESS_STDOUT_KEEP NEW. GPGRT_PROCESS_STDERR_KEEP NEW. GPGRT_PROCESS_STDFDS_SETTING NEW. GPGRT_SPAWN_INHERIT_FILE REMOVED (never used). GPGRT_SPAWN_NONBLOCK REMOVED (never used). GPGRT_SPAWN_RUN_ASFW REMOVED (never used). GPGRT_SPAWN_DETACHED REMOVED (never used). GPGRT_SPAWN_KEEP_STDIN REMOVED (never used). GPGRT_SPAWN_KEEP_STDOUT REMOVED (never used). GPGRT_SPAWN_KEEP_STDERR REMOVED (never used). 1.49 * Two new functions to improve the logging interface. The gpgrt_logv_domain is currently the same as gpgrt_logv_prefix but allows to pass a domain string so that in future we will be able to select log output by domain. It also provide a non yet functional feature to include a hex dump. * Add a "trunc" keyword to gpgrt_log_printhex. [rE0a39fbefcb] * Avoid an endless loop in the argparser due to a conf file read error. [rE2dc93cfecc] * Interface changes relative to the 1.48 release: gpgrt_add_post_log_func NEW. gpgrt_logv_domain NEW. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-09 10:39:03 +00:00
Adolf Belka	f6e2ccf3ab	libarchive: Update to version 3.7.4 ... - Update from version 3.7.0 to 3.7.4 - Update of rootfile - CVE fix in 3.7.4 - Changelog 3.7.4 Security fixes: rar: Fix OOB in rar e8 filter (#2135) (CVE-2024-26256) zip: Fix out of boundary access (#2145) Important bugfixes: 7zip: Limit amount of properties (#2131) bsdtar: Fix error handling around strtol() usages (#2110) passphrase: Improve newline handling on Windows (#2115) passphrase: Never allow empty passwords (#2116) rar: Fix "File CRC Error" when extracting specific rar4 archives (#2124) xar: Avoid infinite link loop (#2123) zip: Update AppleDouble support for directories (#2108) zstd: Implement core detection (#2083, #2071) 3.7.3 New features: PCRE2 support (#2031) add trailing letter b to bsdtar(1) substitute pattern (#2012) add support for long options "--group" and "--owner" to tar(1) (#2054) Security fixes: Fix possible vulnerability in tar error reporting introduced in f27c173 (#2101) Important bugfixes: ISO9660: preserve the natural order of links (#1974) rar5: fix decoding unicode filenames on Windows (#1978) rar5: fix infinite loop if during rar5 decompression the last block produced no data (#2105) xz filter: fix incorrect eof at the end of an lzip member (#2027) zip: fix end-of-data marker processing when decompressing zip archives (#2042) multiple bsdunzip(1) fixes (#2022, #2030) filetime truncation fix on Windows (#2050) 3.7.2 Security fixes: Multiple vulnerabilities have been fixed in the PAX writer (1b4e0d0) Important bugfixes: bsdunzip(1) now correctly handles arguments following an -x after the zipfile New features: bsdunzip(1) now supports the "--version" flag 7-zip reader now translates Windows permissions into UNIX permissions (#1943) uudecode filter in raw mode now supports file name and file mode zstd filter now supports the "long" write option (#1962) 3.7.1 Security fixes: SEGV and stack buffer overflow in verbose mode of cpio (#1934, #1935) Feature updates: bsdunzip updated to match latest upstream code (#1926) Important bugfixes: miscellaneous functional bugfixes (#1731, #1929, #1930) build fixes on multiple platforms (Android #1921, older MacOS X #1919, #1933 and others) Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-09 10:38:14 +00:00
Michael Tremer	76f429d5d8	licenses: Remove the braindead GPL acception stage ... The GPL is not an EULA and so there is no value in having users accept it. The UI is very broken and so I believe it is best to drop this entirely. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-06 16:48:27 +02:00
Michael Tremer	41bc16ac0b	br2684ctl: Remove rootfile, too ... Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-06 13:48:39 +00:00
Michael Tremer	fd4ee38136	cyrus-sasl: Update to 2.1.28 ... Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-06 09:13:42 +00:00
Michael Tremer	d44788101b	libxslt: Update to 1.1.42 ... Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-06 09:12:58 +00:00
Michael Tremer	b734e6f7b6	linux-atm: Update to 2.5.2 ... Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-06 09:11:59 +00:00
Adolf Belka	acf2754880	openssl: Update to version 3.3.0 ... - Update from version 3.2.1 to 3.3.0 - Update of rootfile - Changelog 3.3 This release adds the following new features: * Support for qlog for tracing QUIC connections has been added * Added APIs to allow configuring the negotiated idle timeout for QUIC connections, and to allow determining the number of additional streams that can currently be created for a QUIC connection. * Added APIs to allow disabling implicit QUIC event processing for QUIC SSL objects * Added APIs to allow querying the size and utilisation of a QUIC stream's write buffer * New API `SSL_write_ex2`, which can be used to send an end-of-stream (FIN) condition in an optimised way when using QUIC. * Limited support for polling of QUIC connection and stream objects in a non-blocking manner. * Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple times with different output sizes. * Added exporter for CMake on Unix and Windows, alongside the pkg-config exporter. * The BLAKE2s hash algorithm matches BLAKE2b's support for configurable output length. * The EVP_PKEY_fromdata function has been augmented to allow for the derivation of CRT (Chinese Remainder Theorem) parameters when requested * Added API functions SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex() using time_t which is Y2038 safe on 32 bit systems when 64 bit time is enabled * Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms config options and the respective calls to SSL[_CTX]_set1_sigalgs() and SSL[_CTX]_set1_client_sigalgs() that start with `?` character are ignored and the configuration will still be used. * Added `-set_issuer` and `-set_subject` options to `openssl x509` to override the Issuer and Subject when creating a certificate. The `-subj` option now is an alias for `-set_subject`. * Added several new features of CMPv3 defined in RFC 9480 and RFC 9483 * New option `SSL_OP_PREFER_NO_DHE_KEX`, which allows configuring a TLS1.3 server to prefer session resumption using PSK-only key exchange over PSK with DHE, if both are available. * New atexit configuration switch, which controls whether the OPENSSL_cleanup is registered when libcrypto is unloaded. * Added X509_STORE_get1_objects to avoid issues with the existing X509_STORE_get0_objects API in multi-threaded applications. This release incorporates the following potentially significant or incompatible changes: * Applied AES-GCM unroll8 optimisation to Microsoft Azure Cobalt 100 * Optimized AES-CTR for ARM Neoverse V1 and V2 * Enable AES and SHA3 optimisations on Applie Silicon M3-based MacOS systems similar to M1/M2. * Various optimizations for cryptographic routines using RISC-V vector crypto extensions * Added assembly implementation for md5 on loongarch64 * Accept longer context for TLS 1.2 exporters * The activate and soft_load configuration settings for providers in openssl.cnf have been updated to require a value of [1|yes|true|on] (in lower or UPPER case) to enable the setting. Conversely a value of [0|no|false|off] will disable the setting. * In `openssl speed`, changed the default hash function used with `hmac` from `md5` to `sha256`. * The `-verify` option to the `openssl crl` and `openssl req` will make the program exit with 1 on failure. * The d2i_ASN1_GENERALIZEDTIME(), d2i_ASN1_UTCTIME(), ASN1_TIME_check(), and related functions have been augmented to check for a minimum length of the input string, in accordance with ITU-T X.690 section 11.7 and 11.8. * OPENSSL_sk_push() and sk_<TYPE>_push() functions now return 0 instead of -1 if called with a NULL stack argument. * New limit on HTTP response headers is introduced to HTTP client. The default limit is set to 256 header lines. This release incorporates the following bug fixes and mitigations: * The BIO_get_new_index() function can only be called 127 times before it reaches its upper bound of BIO_TYPE_MASK and will now return -1 once its exhausted. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-06 09:10:28 +00:00
Matthias Fischer	6f6c9f6b6a	rrdtool: Update tp 1.9.0 ... For details see: https://github.com/oetiker/rrdtool-1.x/releases/tag/v1.9.0 "RRDtool 1.9.0 — 2024-07-29 Bugfixes Fix ytop and ybase adjustments for overlaping area issue on transparent areas @turban Suppress warnings of implicit fall through @youpong Update tarball download link in doc @c72578 Fix unsigned integer overflow in rrdtool first. Add test for rrd_first() @c72578 Fix tests under MSYS2 (Windows) @c72578 Fix BUILD_DATE in rrdtool help output @c72578 acinclude.m4: Include <stdlib.h> when using exit @ryandesign rrdtool-release: Create NUMVERS from VERSION file @c72578 Avoids leaking of file descriptors in multi threaded programs by @ensc Avoids potential unterminated string because of fixed PATH_MAX buffer Fix extra reference of parameters of rrd_fetch_dbi_{long,double} @jamborm" Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-08-03 09:42:07 +00:00
Michael Tremer	ed2c97b799	Merge remote-tracking branch 'origin/next' into next	2024-07-24 16:40:47 +00:00
Michael Tremer	10210334fe	Merge remote-tracking branch 'ms/cleanup' into next	2024-07-24 16:32:28 +00:00
Arne Fitzenreiter	6460dbbfc5	Merge branch 'master' into next	2024-07-23 21:59:26 +02:00
Arne Fitzenreiter	55f2a39cea	util-linux: ship /usr/bin/unshare ... the updated biuldscripts need unshare to build IPFire on IPFire systems. Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	2024-07-23 17:27:42 +02:00
Adolf Belka	180d3e3eeb	gettext: Update to version 0.22.5 ... - Update from version 0.22.4 to 0.22.5 - Update of rootfile - Changelog 0.22.5 * The replacements for the printf()/fprintf()/... functions that are provided through <libintl.h> on native Windows and NetBSD now enable GCC's format string analysis (-Wformat). * Bug fixes: - xgettext's processing of Vala files with printf method invocations has been corrected (regression in 0.22). - Build fixes on macOS. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Adolf Belka	2fc3c29093	coreutils: Update to version 9.5 ... - Update from version 9.0 to 9.5 - Update of the uname patch to 9.5 - Obtained the 9.5 version of the i18n patch. However this caused the coreutils build to fail. Without the patch the build had no problems. After investigating for some time I identified that coreutils used to have the mbchar.h and mbchar.c files in its source tarball lib directory. However those are no longer needed by coreutils so they have been deleted in the source tarball. However the i18n patch still requires them. The patch creates the code for the mbchar.h and mbchar.c files. However it has made the availability of the members buf & mb_setascii and some code related to old_mbc dependent on GNULIB being defined. This is specified in configure.ac but that define did not make it into the prepared configure file. This causes those members to not be found and the build fails. - Removing the three #if defined GNLIB_MBFILE statements from the coreutils-9.5-i18n patch, so that the code is executed in the build, causes the members to be present and the build is successfull. - Update of rootfile - Changelog 9.5 ** Bug fixes chmod -R now avoids a race where an attacker may replace a traversed file with a symlink, causing chmod to operate on an unintended file. [This bug was present in "the beginning".] cp, mv, and install no longer issue spurious diagnostics like "failed to preserve ownership" when copying to GNU/Linux CIFS file systems. They do this by working around some Linux CIFS bugs. cp --no-preserve=mode will correctly maintain set-group-ID bits for created directories. Previously on systems that didn't support ACLs, cp would have reset the set-group-ID bit on created directories. [bug introduced in coreutils-8.20] join and uniq now support multi-byte characters better. For example, 'join -tX' now works even if X is a multi-byte character, and both programs now treat multi-byte characters like U+3000 IDEOGRAPHIC SPACE as blanks if the current locale treats them so. numfmt options like --suffix no longer have an arbitrary 127-byte limit. [bug introduced with numfmt in coreutils-8.21] mktemp with --suffix now better diagnoses templates with too few X's. Previously it conflated the insignificant --suffix in the error. [bug introduced in coreutils-8.1] sort again handles thousands grouping characters in single-byte locales where the grouping character is greater than CHAR_MAX. For e.g. signed character platforms with a 0xA0 (aka &nbsp) grouping character. [bug introduced in coreutils-9.1] split --line-bytes with a mixture of very long and short lines no longer overwrites the heap (CVE-2024-0684). [bug introduced in coreutils-9.2] tail no longer mishandles input from files in /proc and /sys file systems, on systems with a page size larger than the stdio BUFSIZ. [This bug was present in "the beginning".] timeout avoids a narrow race condition, where it might kill arbitrary processes after a failed process fork. [bug introduced with timeout in coreutils-7.0] timeout avoids a narrow race condition, where it might fail to kill monitored processes immediately after forking them. [bug introduced with timeout in coreutils-7.0] wc no longer fails to count unprintable characters as parts of words. [bug introduced in textutils-2.1] ** Changes in behavior base32 and base64 no longer require padding when decoding. Previously an error was given for non padded encoded data. base32 and base64 have improved detection of corrupted encodings. Previously encodings with non zero padding bits were accepted. basenc --base16 -d now supports lower case hexadecimal characters. Previously an error was given for lower case hex digits. cp --no-clobber, and mv -n no longer exit with failure status if existing files are encountered in the destination. Instead they revert to the behavior from before v9.2, silently skipping existing files. ls --dired now implies long format output without hyperlinks enabled, and will take precedence over previously specified formats or hyperlink mode. numfmt will accept lowercase 'k' to indicate Kilo or Kibi units on input, and uses lowercase 'k' when outputting such units in '--to=si' mode. pinky no longer tries to canonicalize the user's login location by default, rather requiring the new --lookup option to enable this often slow feature. wc no longer ignores encoding errors when counting words. Instead, it treats them as non white space. ** New features chgrp now accepts the --from=OWNER:GROUP option to restrict changes to files with matching current OWNER and/or GROUP, as already supported by chown(1). chmod adds support for -h, -H,-L,-P, and --dereference options, providing more control over symlink handling. This supports more secure handling of CLI arguments, and is more consistent with chown, and chmod on other systems. cp now accepts the --keep-directory-symlink option (like tar), to preserve and follow existing symlinks to directories in the destination. cp and mv now accept the --update=none-fail option, which is similar to the --no-clobber option, except that existing files are diagnosed, and the command exits with failure status if existing files. The -n,--no-clobber option is best avoided due to platform differences. env now accepts the -a,--argv0 option to override the zeroth argument of the command being executed. mv now accepts an --exchange option, which causes the source and destination to be exchanged. It should be combined with --no-target-directory (-T) if the destination is a directory. The exchange is atomic if source and destination are on a single file system that supports atomic exchange; --exchange is not yet supported in other situations. od now supports printing IEEE half precision floating point with -t fH, or brain 16 bit floating point with -t fB, where supported by the compiler. tail now supports following multiple processes, with repeated --pid options. ** Improvements cp,mv,install,cat,split now read and write a minimum of 256KiB at a time. This was previously 128KiB and increasing to 256KiB was seen to increase throughput by 10-20% when reading cached files on modern systems. env,kill,timeout now support unnamed signals. kill(1) for example now supports sending such signals, and env(1) will list them appropriately. SELinux operations in file copy operations are now more efficient, avoiding unneeded MCS/MLS label translation. sort no longer dynamically links to libcrypto unless -R is used. This decreases startup overhead in the typical case. wc is now much faster in single-byte locales and somewhat faster in multi-byte locales. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Adolf Belka	da8ffd403d	ncurses: Update to version 6.5 ... - Update from version 6.4 to 6.5 - Update of rootfile - --with-pkg-config-libdir as the previous default has been changed to $(LIBDIR) and this does not work and resulted in procps not building as it could not find ncurses. - Likely other packages after procps would have also failed. - Explicitly specifying the pkgconfig directory location worked. - Changelog 6.5 The changelog details are in the NEWS file in the source tarball. Version 6.5 is covered by lines 49 to 530 Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Adolf Belka	7e1596d07c	pcre2: Update to version 10.44 ... - Update from version 10.43 to 10.44 - Update of rootfile - Changelog 10.44 This is mostly a bug-fix and tidying release. There is one new function, to set a maximum size for a compiled pattern. The maximum name length for groups is increased to 128. Some auxiliary files for building under VMS are added. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Adolf Belka	2e8e20eea1	man-pages: Update to version 6.9.1 ... - Update from 6.8 to 6.9.1 - Update of rootfile - Changelog details can be see in the file named Changes in the source tarball. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Adolf Belka	cbc034036f	btrfs-progs: Update to version 6.9.2 ... - Update from 6.7.1 to 6.9.2 - Update of rootfile - Update of e2fsprogs to 1.47.1 changed a variable from inode_includes to ext2fs_inode_includes. btrfs-progs version 6.7.1 failed to build as it was still looking for the old variable name. The fix for e2fsprogs 1.47.1 was implemented in btrfs-progs version 6.9 - Changelog 6.9.2 subvol list: fix accidental trimming of subvolume name check: revert checking file extent item 'ram_bytes' libbtrfsutil: patchlevel version update 1.3.2 fix accidentally closing fd passed to subvolume iterator 6.9.1 (Not to be used) fix detection of intermediate super block flags (e.g. csum change and other conversions) raid-stripe-tree support (still experimental): moved under experimental build flags (mkfs, convert) format change, removed encoding type; backward incompatible receive dump: escape special chars in xattr names and values, and clone source path tune change csum: fix reservation size when starting a transaction other: new and updated tests updated CI images, new reference build targets cleanups and refactoring 6.9 mkfs: if --force used, don't continue if the mount status cannot be determined (e.g. due to permissions) fix minimum size calculation on zoned devices, make it work with option -b check: option --clear-ino-cache removed (functionality still provided in 'rescue' command group) detect and repair wrong file extent item ram_bytes value qgroup clear-stale: sync the filesystem before search to read the up to date state handle cases where qgroup cannot be deleted due to uncleaned subvolume or when squota is enabled qgroup show: display status of qgroup regarding the cleaning of the subvolume or if it's squota receive: fix stream parsing on strict alignment hosts (e.g. ARM v5 or v6) tune change-csum: fix check of dev-replace status item, continue if no dev-replace in progress dump-tree: print contents of dev-replace status item convert: fix extent iteration to handle prealloc/unwritten extents libbtrfsutil: patchlevel version update 1.3.1 fix potentially unaligned access to send stream create library links to all version levels libbtrfs: patchlevel version update 0.1.3 fix potentially unaligned access to send stream create library links to all version levels build: fix compatibility with e2fsprogs 1.47.1 fix header file dependency tracking -O2 by default other: new and updated tests ASAN and UBSAN test coverage in CI documentation updates 6.8.1 mkfs: fix writing on zoned device when block-group-tree is selected tune: fix writing on zoned device with option --convert-to-block-group-tree check: more progress and error messages unify handling of unknown command line options with other commands subvolume delete: remove options --delete-qgroup and --no-delete-qgroup (added in 6.6.3), qgroup deletion does not always work due to delayed background processing of subvolume or set value in sysfs:ggroup/drop_subtree_threshold other: misc refactoring error handling fixes reported by gcc -fanalyzer documentation updates new and updated tests 6.8 fix --enqueue option timeout handling subvolume: remove support for undocumented options -c and -x, functionality disabled in kernel libbtrfsutil: version 0.1.3, backward compabile add aliases for all existing functions with unified naming scheme updated header defintions for recently added kernel features send: v3 supported in experimental mode other: docs: manual page references, graphs, enhancements, clarifications error handling fixes cleanups and refactoring Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Adolf Belka	7f2e089be4	shadow: Update to version 4.16.0 ... - Update from version 4.15.1 to 4.16.0 - Update rootfile - sobump in rootfile. Ran find-dependencies but no other linked programs identified. - nscd is disabled in glibc so it has been disabled in shadow. nscd is enabled by default. - id and groups (deprecated in shadow) are used from coreutils in IPFire. - Changelog 4.16.0 The shadow implementations of id(1) and groups(1) are deprecated in favor of the GNU coreutils and binutils versions. They will be removed in 4.17.0. Support for rlogind in the login(1) implementation has been removed. That is, the login(1) -r flag has been removed. The libsubid major version has been bumped, since it now requires specification of the module's free() implementation. 4.15.2 Bugfix release. This release includes a large amount of fixes, including memory leaks, leaks of other resources such as file descriptors, added missing error handling, and more. 4.15.3 Bugfix release. This release includes changes to the build system, packaging, and tests; most of which, were reported by Debian packagers. There's also a fix for check_subid_range. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-22 15:21:21 +00:00
Arne Fitzenreiter	97067db786	Revert "squid: Comment out access.log in rootfile" ... the file was created to be shipped with permissions so it is needed in the rootfile. This reverts commit 516d541c29.	2024-07-18 09:07:08 +02:00
Adolf Belka	516d541c29	squid: Comment out access.log in rootfile ... - Everytime an update has been done on squid the access.log file has been replaced with an empty file, losing whatever messages have been in the log. - This has been the case since squid was implemented in IPFire. - Update of rootfile to comment out var/log/squid/access.log Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-08 15:32:58 +00:00
Michael Tremer	1e2401a148	ruby: Add rootfile for all architectures ... Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-04 16:13:42 +00:00
Michael Tremer	86c80346f1	riscv64: Update util-linux rootfile ... Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-04 16:11:56 +00:00
Michael Tremer	e5d8276638	OpenSSH: Ship the entire suite of helper programs ... The SSH daemon has been split into a listener and session daemon to have a smaller attack vector since the listener does not need to implement the SSH protocol. In order to keep SSH working, we need to ship the session daemon, too. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:25:09 +00:00
Adolf Belka	0a574ab660	openssh: Update to version 9.8p1 ... - Update from version 9.7p1 to 9.8p1 - Update of rootfile - Changelog 9.8p1 -There is a fix for CVE-2024-6387 -The number of changes is too large to show all here. As well as the CVE fix and another security related fix there are a log of bug fixes as well. The details can seen at https://www.openssh.com/txt/release-9.8 Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:19:48 +00:00
Matthias Fischer	6c269a854b	bind: Update to 9.16.50 ... For details see: https://downloads.isc.org/isc/bind9/9.16.50/doc/arm/html/notes.html#notes-for-bind-9-16-50 "New Features Added RESOLVER.ARPA to the built in empty zones." Important: "This is the last maintenance release of BIND 9.16. This version is now end of life. Please upgrade to BIND 9.18, the current stable version." Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:18:29 +00:00
Adolf Belka	5b24b5559a	speexdsp: New package required for build of tshark-4.2.5 ... - tshark in the past had its own version of speexdsp used only for some "arbitrary resampling code" used for the build of tshark. - speexdsp has been removed from tshark so it is now a build requirement. - It is only used for the build of tshark so the rootfile has all entries commented out. Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:17:00 +00:00
Adolf Belka	da19d30078	asciidoctor: New package required for build of tshark-4.2.5 ... - Only used for build of tshark so rootfile has all entries commented out. Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:17:00 +00:00
Adolf Belka	d6cb864e1c	ruby: New package required for build of asciidoctor required for tshark-4.2.5 ... - Only used for build of asciidoctor so rootfile has all entries commented out. Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:17:00 +00:00
Adolf Belka	464ae625df	zstd: Update to version 1.5.6 ... - Update from version 1.5.5 to 1.5.6 - Update of rootfile - Changelog 1.5.6 (Mar 2024) api: Promote `ZSTD_c_targetCBlockSize` to Stable API by @felixhandte api: new `ZSTD_d_maxBlockSize` experimental parameter, to reduce streaming decompression memory, by @terrelln perf: improve performance of param `ZSTD_c_targetCBlockSize`, by @Cyan4973 perf: improved compression of arrays of integers at high compression, by @Cyan4973 lib: reduce binary size with selective built-time exclusion, by @felixhandte lib: improved huffman speed on small data and linux kernel, by @terrelln lib: accept dictionaries with partial literal tables, by @terrelln lib: fix CCtx size estimation with external sequence producer, by @embg lib: fix corner case decoder behaviors, by @Cyan4973 and @aimuz lib: fix zdict prototype mismatch in static_only mode, by @ldv-alt lib: fix several bugs in magicless-format decoding, by @embg cli: add common compressed file types to `--exclude-compressed`` by @daniellerozenblit cli: fix mixing `-c` and `-o` commands with `--rm`, by @Cyan4973 cli: fix erroneous exclusion of hidden files with `--output-dir-mirror` by @felixhandte cli: improved time accuracy on BSD, by @felixhandte cli: better errors on argument parsing, by @KapJI tests: better compatibility with older versions of `grep`, by @Cyan4973 tests: lorem ipsum generator as default backup content, by @Cyan4973 build: cmake improvements by @terrelln, @sighingnow, @gjasny, @JohanMabille, @Saverio976, @gruenich, @teo-tsirpanis build: bazel support, by @jondo2010 build: fix cross-compiling for AArch64 with lld by @jcelerier build: fix Apple platform compatibility, by @nidhijaju build: fix Visual 2012 and lower compatibility, by @Cyan4973 build: improve win32 support, by @DimitriPapadopoulos build: better C90 compliance for zlibWrapper, by @emaste port: make: fat binaries on macos, by @mredig port: ARM64EC compatibility for Windows, by @dunhor port: QNX support by @klausholstjacobsen port: MSYS2 and Cygwin makefile installation and test support, by @QBos07 port: risc-v support validation in CI, by @Cyan4973 port: sparc64 support validation in CI, by @Cyan4973 port: AIX compatibility, by @likema port: HP-UX compatibility, by @likema doc: Improved specification accuracy, by @elasota bug: Fix and deprecate ZSTD_generateSequences (#3981) Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:16:27 +00:00
Adolf Belka	5c232ac6b0	xfsprogs: Update to version 6.8.0 ... - Update from version 6.5.0 to 6.8.0 - Update of rootfile - Changelog There is no changelog for this package. Change details can be found from the git commit log https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/log/ Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:15:58 +00:00
Adolf Belka	5e19137801	utfcpp: Required for build of latest version of taglib ... - lfs copies the required headers to the /usr/include directory. - rootfile has all entries commented out as utfcpp is only required for the build. - Added utfcpp into make.sh prior to taglib. Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:14:10 +00:00
Adolf Belka	4748e517ea	curl: Update to version 8.8.0 ... - Update from version 8.2.1 to 8.8.0 - Update of rootfile - Removal of patch as the content now included in the source tarball. - Changelog 8.8.0 Changes: curl_version_info: provide librtmp version file: add support for directory listings idn: add native AppleIDN (icucore) support for macOS/iOS lib: add curl_multi_waitfds mbedTLS: implement CURLOPT_SSL_CIPHER_LIST option NTLM_WB: drop support TLS: add support for ECH (Encrypted Client Hello) urlapi: add CURLU_GET_EMPTY for empty queries and fragments Bugfixes: appveyor: drop unnecessary `--clean-first` cmake option appveyor: guard against crash-build with VS2008 appveyor: make gcc 6 mingw64 job build-only asyn-thread: fix curl_global_cleanup crash in Windows asyn-thread: fix Curl_thread_create result check autotools: delete unused functions autotools: fix `HAVE_IOCTLSOCKET_FIONBIO` test for gcc 14 autotools: only probe for SGI MIPS compilers on IRIX bearssl: fix compiler warnings bearssl: use common code for cipher suite lookup bufq: remove duplicate word in comment BUG-BOUNTY.md: clarify the third party situation build: prefer `USE_IPV6` macro internally (was: `ENABLE_IPV6`) build: remove MacOSX-Framework script cd2nroff/manage: use UTC when SOURCE_DATE_EPOCH is set cf-https-connect: use timeouts as unsigned ints cf-socket: don't try getting local IP without socket cf-socket: remove references to l_ip, l_port ci: add curl-for-win builds: Linux MUSL, macOS, Windows cmake: add `BUILD_EXAMPLES` option to build examples cmake: add librtmp/rtmpdump option and detection cmake: check fseeko after detecting HAVE_FILE_OFFSET_BITS cmake: do not pass linker flags to the static library tool cmake: enable `-pedantic-errors` for clang when `CURL_WERROR=ON` cmake: FindNGHTTP2 add static lib name to find_library call cmake: fix `CURL_WERROR=ON` for old CMake and use it in GHA/linux-old cmake: fix `HAVE_IOCTLSOCKET_FIONBIO` test with gcc 14 cmake: fixup `DEPENDS` filename cmake: forward `USE_LIBRTMP` option to C cmake: generate misc manpages and install `mk-ca-bundle.pl` cmake: initialize `BUILD_TESTING` before first use cmake: speed up libcurl doc building again cmake: tidy-up to use `WORKING_DIRECTORY` cmake: use namespaced custom target names cmdline-docs: fix make install with configure --disable-docs configure: error on missing perl if docs or manual is enabled configure: make --disable-docs imply --disable-manual content_encoding: brotli and others, pass through 0-length writes content_encoding: ignore duplicate chunked encoding content_encoding: reject transfer-encoding after chunked contrithanks: honor `CURLWWW` variable curl-confopts.m4: define CARES_NO_DEPRECATED when c-ares is used curl.h: change CURL_SSLVERSION_* from enum to defines curl: make --help adapt to the terminal width curl: use curl_getenv instead of the curlx_ version Curl_creader_read: init two variables to avoid using them uninited curl_easy_pause.md: use correct defines in example curl_getdate.md: document two-digit year handling curl_global_trace.md: shorten the description curl_multibyte: remove access() function wrapper for Windows curl_path: make Curl_get_pathname use dynbuf curl_setup.h: add support for IAR compiler curl_setup.h: detect 'inline' support curl_sha512_256: do not use workaround for NetBSD when not needed curl_sha512_256: fix detection of OpenSSL 1.1.1 or later curl_url_get.md: clarify queries and fragments and CURLU_GET_EMPTY CURLINFO_REQUEST_SIZE: fixed, add tests for transfer infos reported CURLOPT_WRITEFUNCTION.md: fix the callback proto in the example cw-out: improved error handling DEPRECATE.md: TLS libraries without 1.3 support digest: replace strcpy for empty string with simple assignment dist: `set -eu`, fix shellcheck, make reproducible and smaller tarballs dist: add files missing from release tarball dist: add reproducible dir entries to tarballs dist: do not require Perl in `maketgz` dist: remove the curl-config.1 from the tarball dist: verify tarball reproducibility in CI DISTROS: add patch and issues link for curl-for-win DISTROS: Cygwin updates dllmain: Call OpenSSL thread cleanup for Windows and Cygwin doc: pytest `--repeat` -> `--count` docs/cmdline-opts: invoke managen using a relative path docs/cmdline-opts: mention STARTTLS for --ssl and --ssl-reqd docs: add CURLOPT_NOPROGRESS to CURLOPT_XFERINFOFUNCTION example docs: clarify CURLOPT_MAXFILESIZE and CURLOPT_MAXFILESIZE_LARGE docs: fix some CURLINFO examples doh: fix typo in comment doh: remove unused function prototype dynbuf: fix returncode on memory error examples: fix/silence `-Wsign-conversion` EXPERIMENTAL: add graduation requirements for each feature file: remove useless assignment ftp: add tracing support ftp: fix build for CURL_DISABLE_VERBOSE_STRINGS ftp: fix socket leak on rare error GHA: add NetBSD, OpenBSD, FreeBSD/arm64 and OmniOS jobs GHA: add shellcheck job and fix warnings, shell tidy-ups GHA: add valgrind to a wolfSSL build GHA: on macOS remove $HOME/.curlrc GHA: pin dependencies gnutls: lazy init the trust settings h3/ngtcp2: improve error handling hash: change 'slots' to size_t from int hash: delete unused debug function hsts: explicitly skip blank lines hsts: remove single-use single-line function http tests: in CI skip test_02_23* for quiche http2 + ngtcp2: pass CURLcode errors from callbacks http2, http3: decouple stream state from easy handle http2: emit RST when client write fails http3: quiche+ngtcp2 improvements http: acknowledge a returned error code http: HEAD response body tolerance http: reject HTTP major version switch mid connection http: remove redundant check http: with chunked POST forced, disable length check on read callback http_aws_sigv4: remove useless assignment idn: make Curl_idnconvert_hostname() use Curl_idn_decode() if2ip: make the buf_size arg a size_t INSTALL-CMAKE.md: explain `cmake -G <generator-name>` krb5: use dynbuf ldap: fix unused variables (seen on OmniOS) lib/cf-h1-proxy: silence compiler warnings (gcc 14) lib: add trace support for client reads and writes lib: bump hash sizes to `size_t` lib: clear the easy handle's saved errno before transfer lib: fix compiler warnings (gcc) lib: make protocol handlers store scheme name lowercase lib: merge `ENABLE_QUIC` C macro into `USE_HTTP3` lib: remove two instances of "only only" messages lib: silence `-Wsign-conversion` in base64, strcase, mprintf lib: silence warnings on comma misuse lib: use `#error` instead of invalid syntax in `curl_setup_once.h` lib: use multi instead of multi_easy for the active multi libcurl-opts: mention pipelining less libssh2: delete redundant feature guard libssh2: replace `access()` with `stat()` libssh2: set length to 0 if strdup failed m4: fix rustls pkg-config codepath MAIL-ETIQUETTE: convert to markdown makefile: remove the sorting from the vc-ide action maketgz: put docs/RELEASE-TOOL.md into the tarball managen: fix the option sort order mbedtls: call mbedtls_ssl_setup() after RNG callback is set mbedtls: cut off trailing newlines from debug logs mbedtls: fix building with v3 in CMake Unity mode mbedtls: support TLS 1.3 mime: avoid using access() misc: fix typos misc: fix typos, quoting and spelling mprintf: check fputc error rather than matching returned character mqtt: when Curl_xfer_recv returns error, don't use nread multi: avoid memory-leak risk multi: introduce SETUP state for better timeouts multi: multi_wait improvements multi: remove the unused Curl_preconnect function multi: remove useless assignment multi: timeout handles even without connection openldap: create ldap URLs correctly for IPv6 addresses openssl: do not set SSL_MODE_RELEASE_BUFFERS openssl: revert keylog_callback support for LibreSSL OS400: fix shellcheck warnings in scripts projects: drop MSVC project files for recent versions pytest: add DELETE tests, check server version pytest: fixes for recent python, add FTP tests quic: fixup duplicate static function name (for cmake unity) quiche: expire all active transfers on connection close quiche: trust its timeout handling RELEASE-PROCEDURE: mention an initial working build request: make Curl_req_init return void request: paused upload on completed download, assess connection reuse: add copyright + license info to individual docs/*.md files ROADMAP: remove completed entries, mention websocket rustls: fix handshake done handling rustls: fix partial send handling rustls: remove incorrect SSLSUPP_TLS13_CIPHERSUITES flag rustsls: fix error code on receive sendf: fix two typos in comments sendf: useless assignment in cr_lc_read() setopt: acknowledge errors proper for CURLOPT_COOKIEJAR setopt: make the setstropt_userpwd args compulsory setopt: remove check for 'option' that is always true setopt: warn on Curl_set*opt() uses not using the return value smtp: result of Curl_bufq_cread was not used socket: remove redundant call to getsockname socketpair: fix compilation when USE_UNIX_SOCKETS is not defined src: tidy up types, add necessary casts telnet: check return code from fileno() tests/http: fix compiler warning tests: add -q as first option when invoking curl for tests tests: check caddy server version to match test expectations tests: enable test 1117 for hyper tests: fix feature case in test1481 tests: fix test 1167 to skip digit-only symbols tests: make the unit test result type `CURLcode` tests: Mark tftpd timer function as noreturn tests: tidy up types in server code tls: fix SecureTransport + BearSSL cmake unity builds tls: remove EXAMPLEs from deprecated options tls: use shared init code for TCP+QUIC tool: move tool_ftruncate64 to tool_util.c tool_cb_rea: limit rate unpause for -T . uploads tool_cfgable: free {proxy_}cipher13_list on exit tool_getparam: output warning for leading unicode quote character tool_getparam: remove two redundant conditions tool_operate: don't truncate the etag save file by default tool_operate: init vars unconditionally in post_per_transfer tool_paramhlp: remove duplicate assign tool_xattr: "guess" URL scheme if none is provided tool_xattr: in debug builds, act normally if CURL_FAKE_XATTR is not set transfer: remove useless assignment url: do not URL decode proxy crendentials url: fix use of an uninitialized variable url: make parse_login_details use memdup0 url: remove duplicate call to Curl_conncache_remove_conn when pruning urlapi: allow setting port number zero urlapi: fix relative redirects to fragment-only urldata: remove fields not used depending on used features vauth: make two functions void that always just returned OK version: use msnprintf instead of strncpy vquic-tls: use correct cert name check API for wolfSSL vquic: use CURL_FORMAT_CURL_OFF_T for 64 bit printf output vtls: TLS session storage overhaul wakeup_create: use FD_CLOEXEC/SOCK_CLOEXEC warnless: delete orphan declarations websocket: avoid memory leak in error path winbuild: add ENABLE_WEBSOCKETS option winbuild: use $(RC) correctly wolfssl: plug memory leak in wolfssl_connect_step2() x509asn1: return error on missing OID 8.7.1 Bugfixes: Fixed empty tool_hugehelp.c file 8.7.0 Changes: configure: add --disable-docs flag CURLINFO_USED_PROXY: return bool whether the proxy was used digest: support SHA-512/256 DoH: add trace configuration write-out: add '%{proxy_used}' Bugfixes: ALTSVC.md: correct a typo asyn-ares: fix data race warning asyn-thread: use wakeup_close to close the read descriptor badwords: use hostname, not host name BINDINGS: add mcurl, the python binding bufq: writing into a softlimit queue cannot be partial c-hyper: add header collection writer in hyper builds cd2nroff: gen: make `\>` in input to render as plain '>' in output cd2nroff: remove backticks from titles checksrc.pl: fix handling .checksrc with CRLF cmake: add USE_OPENSSL_QUIC support cmake: add warning for using TLS libraries without 1.3 support cmake: enable `ENABLE_CURL_MANUAL` by default cmake: fix `CURL_WINDOWS_SSPI=ON` with Schannel disabled cmake: fix function description in comment cmake: fix install for older CMake versions cmake: fix libcurl.pc and curl-config library specifications cmdline-docs/Makefile: avoid using a fixed temp file name cmdline-docs: quote and angle bracket cleanup cmdline-opts/_EXITCODES: sync with libcurl-errors cmdline-opts/_VARIABLES.md: improve the description cmdline-opts/_VERSION: provide %VERSION correctly cmdline-opts: shorter help texts configure: add pkg-config support to rustls detection configure: add warning for using TLS libraries without 1.3 support configure: build & install shell completions when enabled configure: do not link with nghttp3 unless necessary configure: Don't build shell completions when disabled configure: Don't make shell completions without perl configure: find libpsl with pkg-config connect.c: fix typo CONTRIBUTE: update the section on documentation format cookie.md: provide an example sending a fixed cookie cookie: if psl fails, reject the cookie curl: exit on config file parser errors curl: make --libcurl output better CURLOPT_*SSLVERSION curl: when allocating variables, add the name into the struct curl_setup.h: add curl_uint64_t internal type curldown: fix email address in Copyright CURLMOPT_MAX*: mention what happens if changed mid-transfer CURLOPT_INTERFACE.md: remove spurious amp, add see-also CURLOPT_POSTQUOTE.md: fix typo CURLOPT_SSL_CTX_FUNCTION.md: no promises of lifetime after return CURLOPT_WRITEFUNCTION.md: typo fix digest: add check for hashing error dist: make sure the http tests are in the tarball DISTROS: add document with distro pointers docs/libcurl: add TLS backend info for all TLS options docs/libcurl: generate PROTOCOLS from meta-data docs: add missing slashes to SChannel client certificate documentation docs: add necessary setup for nghttp3 docs: ascii version of manpage without nroff docs: dist curl*.1 and install without perl docs: make curldown do angle brackets like markdown docs: make each libcurl man specify protocol(s) docs: make sure curl.1 is included in dist tarballs docs: update minimal binary size in INSTALL.md docs: use present tense examples: use present tense in comments file: use xfer buf for file:// transfers fopen: fix narrowing conversion warning on 32-bit Android form-string.md: correct the example ftp: do lineend conversions in client writer ftp: fix socket wait activity in ftp_domore_getsock ftp: tracing improvements ftp: treat a 226 arriving before data as a signal to read data gen.pl: make the "manpageification" faster gen: make `\>` in input to render as plain '>' in output getparam: make --ftp-ssl work again GHA/linux: add sysctl trick to work-around GitHub runner issue GIT-INFO: convert to markdown GOVERNANCE: document the core team header.md: remove backslash, make nicer markdown HTTP/2: write response directly http2, http3: return CURLE_PARTIAL_FILE when bytes were received http2: fix push discard http2: memory errors in the push callbacks are fatal http2: minor tweaks to optimize two struct sizes http2: push headers better cleanup http2: remove the third (unused) argument from http2_data_done() HTTP3.md: adjust the OpenSSL QUIC install instructions http: better error message for HTTP/1.x response without status line http: improve response header handling, save cpu cycles http: move headers collecting to writer http: remove stale comment about rewindbeforesend http: separate response parsing from response action http_chunks: fix the accounting of consumed bytes http_chunks: remove unused 'endptr' variable https-proxy: use IP address and cert with ip in alt names hyper: implement unpausing via client reader ipv6.md: mention IPv4 mapped addresses KNOWN_BUGS: POP3 issue when reading small chunks lib1598: fix `CURLOPT_POSTFIELDSIZE` usage lib582: remove code causing warning that is never run lib: add `void *ctx` to reader/writer instances lib: convert Curl_get_line to use dynbuf lib: Curl_read/Curl_write clarifications lib: enhance client reader resume + rewind lib: initialize output pointers to NULL before calling strto[ff,l,ul] lib: keep conn IP information together lib: move 'done' parameter to SingleRequests lib: remove curl_mimepart object when CURL_DISABLE_MIME libcurl-docs: cleanups libcurl-security.md: Active FTP passes on the local IP address libssh/libssh2: return error on too big range MANUAL.md: fix typo mbedtls: fix building when MBEDTLS_X509_REMOVE_INFO flag is defined mbedtls: fix pytest for newer versions mbedtls: properly cleanup the thread-shared entropy mbedtls: use mbedtls_ssl_conf_{min|max}_tls_version md4: include strdup.h for the memdup proto mime: add client reader misc: fix typos in docs and lib mkhelp: simplify the generated hugehelp program mprintf: fix format prefix I32/I64 for windows compilers multi: add xfer_buf to multi handle multi: fix multi_sock handling of select_bits multi: make add_handle free any multi_easy ngtcp2: no recvbuf for stream ntml_wb: fix buffer type typo OpenSSL QUIC: adapt to v3.3.x openssl-quic: check on Windows that socket conv to int is possible openssl-quic: fix BIO leak and Windows warning openssl-quic: fix unity build, casing, indentation OS400: avoid using awk in the build scripts paramhlp: fix CRLF-stripping files with "-d @file" proxy1.0.md: fix example pytest: adapt to API change request: clarify message when request has been sent off rustls: make curl compile with 0.12.0 schannel: fix hang on unexpected server close scripts: fix cijobs.pl for Azure and GHA sendf: ignore response body to HEAD setopt: fix check for CURLOPT_PROXY_TLSAUTH_TYPE value setopt: fix disabling all protocols sha512_256: add support for GnuTLS and OpenSSL smtp: fix STARTTLS SPONSORS: describe the basics strtoofft: fix the overflow check test 1541: verify getinfo values on first header callback test1165: improve pattern matching tests: support setting/using blank content env variables TIMER_STARTTRANSFER: set the same for everyone TLS: start shutdown only when peer did not already close TODO: update 13.11 with more information tool_cb_hdr: only parse etag + content-disposition for 2xx tool_getparam: accept a blank -w "" tool_getparam: handle non-existing (out of range) short-options tool_operate: change precedence of server Retry-After time tool_operate: do not set CURLOPT_QUICK_EXIT in debug builds trace-config.md: remove the mutexed options list transfer.c: break receive loop in speed limited transfers transfer: improve Windows SO_SNDBUF update limit urldata: move authneg bit from conn to Curl_easy version: allow building with ancient libpsl vquic-tls: fix the error code returned for bad CA file vtls: fix tls proxy peer verification vtls: revert "receive max buffer" + add test case VULN-DISCLOSURE-POLICY.md: update detail about CVE requests websocket: fix curl_ws_recv() wolfSSL: do not call the stub function wolfSSL_BIO_set_init() write-out.md: clarify error handling details 8.6.0 Changes: add CURLE_TOO_LARGE add CURLINFO_QUEUE_TIME_T add CURLOPT_SERVER_RESPONSE_TIMEOUT_MS: add asyn-thread: use GetAddrInfoExW on >= Windows 8 configure: make libpsl detection failure cause error docs/cmdline: change to .md for cmdline docs docs: introduce "curldown" for libcurl man page format runtests: support -gl. Like -g but for lldb. Bugfixes: altsvc: free 'as' when returning error appveyor: replace PowerShell with bash + parallel autotools appveyor: switch to out-of-tree builds asyn-ares: with modern c-ares, use its default timeout build: delete unused `HAVE_{GSSHEIMDAL,GSSMIT,HEIMDAL}` build: delete/replace clang warning pragmas build: enable missing OpenSSF-recommended warnings, with fixes build: fix `-Wconversion`/`-Wsign-conversion` warnings build: fix Windows ADDRESS_FAMILY detection build: more `-Wformat` fixes build: remove redundant `CURL_PULL_*` settings cf-h1-proxy: no CURLOPT_USERAGENT in CONNECT with hyper cf-socket: show errno in tcpkeepalive error messages CI/distcheck: run full tests cmake: add option to disable building docs cmake: fix generation for system name iOS cmake: fix typo cmake: freshen up docs/INSTALL.cmake cmake: prefill/cache `HAVE_STRUCT_SOCKADDR_STORAGE` cmake: rework options to enable curl and libcurl docs cmake: when USE_MANUAL=YES, build the curl.1 man page cmdline-opts/write-out.d: remove spurious double quotes cmdline-opts: update availability for the *-ca-native options cmdline/gen: fix the sorting of the man page options configure: add libngtcp2_crypto_boringssl detection configure: fix no default int compile error in ipv6 detection configure: when enabling QUIC, check that TLS supports QUIC connect: remove margin from eyeballer alloc content_encoding: change return code to typedef'ed enum cookie.d: document use of empty string to enable cookie engine cookie: avoid fopen with empty file name curl.h: CURLOPT_DNS_SERVERS is only available with c-ares curl: show ipfs and ipns as supported "protocols" curl_easy_getinfo.3: remove the wrong time value count curl_multi_fdset.3: remove mention of null pointer support CURLINFO_REFERER.3: clarify that it is the *request* header CURLOPT_AUTOREFERER.3: mention CURLINFO_REFERER CURLOPT_POSTFIELDS.3: fix incorrect C string escape in example CURLOPT_SSH_*_KEYFILE: clarify dist: add tests/errorcodes.pl to the tarball docs: clean up Protocols: for cmdline options docs: describe and highlight super cookies docs: do not start lines/sentences with So, But nor And docs: install curl.1 with cmake docs: mention env vars not used by schannel doh: remove unused local variable examples: add four new examples file+ftp: use stack buffers instead of data->state.buffer ftp: handle the PORT parsing without allocation ftp: use dynbuf to store entrypath ftp: use memdup0 to store the OS from a SYST 215 response ftpserver.pl: send 213 SIZE response without spurious newline gen.pl: support ## for doing .IP in table-like lists gen: do italics/bold for a range of letters, not just single word GHA: add a job scanning for "bad words" in markdown GHA: bump ngtcp2, gnutls, mod_h2, quiche gnutls: fix build with --disable-verbose haproxy-clientip.d: document the arg headers: make sure the trailing newline is not stored headers: remove assert from Curl_headers_push hostip: return error immediately when Curl_ip2addr() fails hsts: remove assert for zero length domain http2: improved on_stream_close/data_done handling http3/quiche: fix result code on a stream reset http3: initial support for OpenSSL 3.2 QUIC stack http: adjust_pollset fix http: check for "Host:" case insensitively http: fix off-by-one error in request method length check http: only act on 101 responses when they are HTTP/1.1 http: remove comment reference to a removed solution http: use stack scratch buffer http_proxy: a blank CURLOPT_USERAGENT should not be used in CONNECT krb5: add prototype to silence clang warnings on mvsnprintf() lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT lib: error out on multissl + http3 lib: fix variable undeclared error caused by `infof` changes lib: reduce use of strncpy lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding lib: replace readwrite with write_resp lib: strndup/memdup instead of malloc, memcpy and null-terminate libssh2: use `libssh2_session_callback_set2()` with v1.11.1 libssh: improve the deprecation warning dismissal libssh: supress warnings without version check Makefile.am: fix the MSVC project generation Makefile.mk: drop Windows support mbedtls: fix `-Wnull-dereference` and `-Wredundant-decls` mbedtls: free the entropy when threaded mime: use memdup0 instead of malloc + memcpy mksymbolsmanpage.pl: provide references to where the symbol is used mprintf: overhaul and bugfixes mqtt: use stack scratch buffer for recv+publish multi: remove total timer reset in file_do() while fetching file:// ngtcp2: put h3 at the front of alpn ntlm_wb: do not use data->state.buffer any longer openldap: fix an LDAP crash openldap: fix STARTTLS openssl: re-match LibreSSL deinit with init openssl: when verifystatus fails, remove session id from cache OS400: sync ILE/RPG binding pingpong: stop using the download buffer pop3: replace calloc + memcpy with memdup0 pytest: scorecard tracking CPU and RSS quiche: return CURLE_HTTP3 on send to invalid stream readwrite_data: loop less Revert "urldata: move async resolver state from easy handle to connectdata" rtsp: deal with borked server responses runtests: for mode="text" on <stdout>, fix newlines on both parts sasl: make login option string override http auth schannel: fix `-Warith-conversion` gcc 13 warning sectransp: do verify_cert without memdup for blobs sectransp_ make TLSCipherNameForNumber() available in non-verbose config sendf: fix compiler warning with CURL_DISABLE_HEADERS_API setopt: clear mimepost when formp is freed setopt: use memdup0 when cloning COPYPOSTFIELDS socks: fix generic output string to say SOCKS instead of SOCKS4 socks: use own buffer instead of data->state.buffer ssh: fix namespace of two local macros ssh: use stack scratch buffer for seeks strerror: repair get_winsock_error() system.h: sync mingw `CURL_TYPEOF_CURL_SOCKLEN_T` with other compilers system_win32: fix a function pointer assignment warning telnet: use dynbuf instad of malloc for escape buffer telnet: use stack scratch buffer for do tests/server: delete workaround for old-mingw tests: avoid int/size_t conversion size/sign warnings tests: respect $TMPDIR when creating unix domain sockets tool: make parser reject blank arguments if not supported tool: prepend output_dir in header callback tool_getparam: bsearch cmdline options tool_getparam: do not try to expand without an argument tool_getparam: stop supporting `@filename` style for --cookie tool_listhelp: regenerate after recent .d updates tool_operate: make --remove-on-error only remove "real" files tool_operate: stop setting the file comment on Amiga transfer: adjust_pollset improvements transfer: fix upload rate limiting, add test cases transfer: make the select_bits_paused condition check both directions transfer: remove warning: Value stored to 'blen' is never read url: don't set default CA paths for Secure Transport backend url: for disabled protocols, mention if found in redirect urlapi: remove assert verify-examples.pl: fail verification on unescaped backslash version: show only the libpsl version, not its dependencies vquic: extract TLS setup into own source vtls: fix missing multissl version info vtls: receive max buffer vtls: remove the Curl_cft_ssl_proxy object if CURL_DISABLE_PROXY websockets: check for negative payload lengths websockets: refactor decode chain windows: delete redundant headers windows: simplify detecting and using system headers wolfssl: load certificate *chain* for PEM client certs x509asn1: remove code for WANT_VERIFYHOST x509asn1: switch from malloc to dynbuf 8.5.0 Changes: gnutls: support CURLSSLOPT_NATIVE_CA HTTP3: ngtcp2 builds are no longer experimental Bugfixes: appveyor: make VS2008-built curl tool runnable asyn-thread: use pipe instead of socketpair for IPC when available autotools: accept linker flags via `CURL_LDFLAGS_{LIB,BIN}` autotools: avoid passing `LDFLAGS` twice to libcurl autotools: delete LCC compiler support bits autotools: fix/improve gcc and Apple clang version detection autotools: stop setting `-std=gnu89` with `--enable-warnings` autotools: update references to deleted `crypt-auth` option BINDINGS: add V binding build: add `src/.checksrc` to source tarball build: add more picky warnings and fix them build: always revert `#pragma GCC diagnostic` after use build: delete `HAVE_STDINT_H` and `HAVE_INTTYPES_H` build: delete support bits for obsolete Windows compilers build: fix 'threadsafe' feature detection for older gcc build: fix builds that disable protocols but not digest auth build: fix compiler warning with auths disabled build: fix libssh2 + `CURL_DISABLE_DIGEST_AUTH` + `CURL_DISABLE_AWS` build: picky warning updates build: require Windows XP or newer cfilter: provide call to tell connection to forget a socket CI: add autotools, out-of-tree, debug build to distro check job CI: ignore test 286 on Appveyor gcc 9 build cmake: add `CURL_DISABLE_BINDLOCAL` option cmake: add test for `DISABLE` options, add `CURL_DISABLE_HEADERS_API` cmake: dedupe Windows system libs cmake: fix `HAVE_H_ERRNO_ASSIGNABLE` detection cmake: fix CURL_DISABLE_GETOPTIONS cmake: fix multiple include of CURL package cmake: fix OpenSSL quic detection in quiche builds cmake: option to disable install & drop `curlu` target when unused cmake: pre-fill rest of detection values for Windows cmake: replace `check_library_exists_concat()` cmake: speed up threads setup for Windows cmake: speed up zstd detection config-win32: set `HAVE_SNPRINTF` for mingw-w64 configure: better --disable-http configure: check for the fseeko declaration too conncache: use the closure handle when disconnecting surplus connections content_encoding: make Curl_all_content_encodings allocless cookie: lowercase the domain names before PSL checks curl.h: delete Symbian OS references curl.h: on FreeBSD include sys/param.h instead of osreldate.h curl.rc: switch out the copyright symbol for plain ASCII curl: improved IPFS and IPNS URL support curl_easy_duphandle.3: clarify how HSTS and alt-svc are duped Curl_http_body: cleanup properly when Curl_getformdata errors curl_setup: disallow Windows IPv6 builds missing getaddrinfo curl_sspi: support more revocation error names in error messages CURLINFO_PRETRANSFER_TIME_T.3: fix time explanation CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range CURLOPT_CAINFO_BLOB.3: explain what CURL_BLOB_COPY does CURLOPT_WRITEFUNCTION.3: clarify libcurl returns for CURL_WRITEFUNC_ERROR CURPOST_POSTFIELDS.3: add CURLOPT_COPYPOSTFIELDS in SEE ALSO docs/example/keepalive.c: show TCP keep-alive options docs/example/localport.c: show off CURLOPT_LOCALPORT docs/examples/interface.c: show CURLOPT_INTERFACE use docs/libcurl: fix three minor man page format mistakes docs/libcurl: SYNSOPSIS cleanup docs: add supported version for the json write-out docs: clarify that curl passes on input unfiltered docs: fix function typo in curl_easy_option_next.3 docs: KNOWN_BUGS cleanup docs: preserve the modification date when copying the prebuilt man page docs: remove bold from some man page SYNOPSIS sections docs: use SOURCE_DATE_EPOCH for generated manpages doh: provide better return code for responses w/o addresses doh: use PIPEWAIT when HTTP/2 is attempted duphandle: also free 'outcurl->cookies' in error path duphandle: make dupset() not return with pointers to old alloced data duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set easy: in duphandle, init the cookies for the new handle easy: remove duplicate wolfSSH init call easy_lock: add a pthread_mutex_t fallback fopen: create new file using old file's mode fopen: create short(er) temporary file name getenv: PlayStation doesn't have getenv() GHA: move mod_h2 version in CI to v2.0.25 hostip: show the list of IPs when resolving is done hostip: silence compiler warning `-Wparentheses-equality` hsts: skip single-dot hostname HTTP/2, HTTP/3: handle detach of onoing transfers http2: header conversion tightening http2: provide an error callback and failf the message http2: safer invocation of populate_binsettings http: allow longer HTTP/2 request method names http: avoid Expect: 100-continue if Upgrade: is used http: consider resume with CURLOPT_FAILONERRROR and 416 to be fine http: fix `-Wunused-parameter` with no auth and no proxy http: fix `-Wunused-variable` compiler warning http: fix empty-body warning http_aws_sigv4: canonicalise valueless query params hyper: temporarily remove HTTP/2 support INSTALL: update list of ports and CPU archs IPFS: fix IPFS_PATH and file parsing keylog: disable if unused lib: add and use Curl_strndup() lib: apache style infof and trace macros/functions lib: fix gcc warning in printf call libcurl-errors.3: sync with current public headers libcurl-thread.3: simplify the TLS section Makefile.am: drop vc10, vc11 and vc12 projects from dist Makefile.mk: fix `-rtmp` option for non-Windows mime: store "form escape" as a single bit misc: fix -Walloc-size warnings msh3: error when built with CURL_DISABLE_SOCKETPAIR set multi: during ratelimit multi_getsock should return no sockets multi: use pipe instead of socketpair to *wakeup() ngtcp2: fix races in stream handling ntlm_wb: use pipe instead of socketpair when possible openldap: move the alloc of ldapconninfo to *connect() openldap: set the callback argument in oldap_do openssl: avoid BN_num_bits() NULL pointer derefs openssl: fix building with v3 `no-deprecated` + add CI test openssl: fix infof() to avoid compiler warning for %s with null openssl: identify the "quictls" backend correctly openssl: include SIG and KEM algorithms in verbose openssl: make CURLSSLOPT_NATIVE_CA import Windows intermediate CAs openssl: two multi pointer checks should probably rather be asserts openssl: when a session-ID is reused, skip OCSP stapling page-footer: clarify exit code 25 projects: add VC14.20 project files pytest: use lower count in repeat tests quic: make eyeballers connect retries stop at weird replies quic: manage connection idle timeouts quiche: use quiche_conn_peer_transport_params() rand: fix build error with autotools + LibreSSL resolve.d: drop a multi use-sentence RTSP: improved RTP parser sasl: fix `-Wunused-function` compiler warning schannel: add CA cache support for files and memory blobs setopt: check CURLOPT_TFTP_BLKSIZE range on set setopt: remove outdated cookie comment setopt: remove superfluous use of ternary expressions socks: better buffer size checks for socks4a user and hostname socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice symbols-in-versions: the CLOSEPOLICY options are deprecated test1683: remove commented-out check alternatives test3103: add missing quotes around a test tag attribute test613: stop showing an error on missing output file tests/README: SOCKS tests are not using OpenSSH, it has its own server tests/server: add more SOCKS5 handshake error checking tests: Fix Windows test helper tool search & use it for handle64 tidy-up: casing typos, delete unused Windows version aliases tool: fix --capath when proxy support is disabled tool: support bold headers in Windows tool_cb_hdr: add an additional parsing check tool_cb_prg: make the carriage return fit for wide progress bars tool_cb_wrt: fix write output for very old Windows versions tool_getparam: limit --rate to be smaller than number of ms tool_operate: do not mix memory models tool_operate: fix links in ipfs errors tool_parsecfg: make warning output propose double-quoting tool_urlglob: fix build for old gcc versions tool_urlglob: make multiply() bail out on negative values tool_writeout_json: fix JSON encoding of non-ascii bytes transfer: abort pause send when connection is marked for closing transfer: avoid calling the read callback again after EOF transfer: only reset the FTP wildcard engine in CLEAR state url: don't touch the multi handle when closing internal handles url: find scheme with a "perfect hash" url: fix `-Wzero-length-array` with no protocols url: fix builds with `CURL_DISABLE_HTTP` url: protocol handler lookup tidy-up url: proxy ssl connection reuse fix urlapi: avoid null deref if setting blank host to url encode urlapi: skip appending NULL pointer query urlapi: when URL encoding the fragment, pass in the right length urldata: make maxconnects a 32 bit value urldata: move async resolver state from easy handle to connectdata urldata: move cookielist from UserDefined to UrlState urldata: move hstslist from 'set' to 'state' urldata: move the 'internal' boolean to the state struct vssh: remove the #ifdef for Curl_ssh_init, use empty macro vtls: cleanup SSL config management vtls: consistently use typedef names for OpenSSL structs vtls: late clone of connection ssl config vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0 VULN-DISCLOSURE-POLICY: escape sequences are not a security flaw windows: use built-in `_WIN32` macro to detect Windows wolfssh: remove redundant static prototypes wolfssl: add default case for wolfssl_connect_step1 switch wolfssl: require WOLFSSL_SYS_CA_CERTS for loading system CA 8.4.0 Changes: curl: add support for the IPFS protocols via HTTP gateway curl_multi_get_handles: get easy handles from a multi handle mingw: delete support for legacy mingw.org toolchain Bugfixes: acinclude.m4: Document proper system truststore on FreeBSD appveyor: fix yamlint issues, indent appveyor: rewrite batch in PowerShell + CI improvements autotools: adjust `CURL_CA_PATH` value to CMake autotools: restore `HAVE_IOCTL_*` detections base64: also build for curl bufq: remove Curl_bufq_skip_and_shift (unused) build: delete checks for C89 standard headers build: do not publish `HAVE_BORINGSSL`, `HAVE_AWSLC` macros cf-socket: simulate slow/blocked receives in debug cmake, configure: also link with CoreServices cmake: add check for suseconds_t cmake: add feature checks for `memrchr` and `getifaddrs` cmake: add missing checks cmake: delete old `HAVE_LDAP_URL_PARSE` logic cmake: detect `HAVE_CLOCK_GETTIME_MONOTONIC_RAW` cmake: detect `HAVE_GETADDRINFO_THREADSAFE` cmake: detect `sys/wait.h` and `netinet/udp.h` cmake: detect TLS-SRP in OpenSSL/wolfSSL/GnuTLS cmake: disable unity mode with Windows Unicode + TrackMemory cmake: fix `HAVE_LDAP_SSL`, `HAVE_LDAP_URL_PARSE` on non-Windows cmake: fix `HAVE_WRITABLE_ARGV` detection cmake: fix duplicate symbols when linking tests cmake: fix missing `zlib.h` when compiling `libcurltool` cmake: fix stderr initialization in unity builds cmake: fix the help text to the static build option in CMakeLists.txt cmake: fix unity builds for more build combinations cmake: fix unity symbol collisions in h2 builds cmake: fix unity with Windows Unicode + TrackMemory cmake: improve OpenLDAP builds cmake: lib `CURL_STATICLIB` fixes (Windows) cmake: move global headers to specific checks cmake: pre-cache `HAVE_BASENAME` for mingw-w64 and MSVC cmake: pre-cache `HAVE_POLL_FINE` on Windows cmake: tidy-up `NOT_NEED_LBER_H` detection cmake: validate `CURL_DEFAULT_SSL_BACKEND` config value configure: check for the capath by default configure: remove unused checks configure: replace adhoc domain with `localhost` in tests configure: sort AC_CHECK_FUNCS connect: expire the timeout when trying next connect: only start the happy eyeballs timer when needed cookie: do not store the expire or max-age strings cookie: remove unnecessary struct fields cookie: set ->running in cookie_init even if data is NULL create-dirs.d: clarify it also uses --output-dirs curl.h: mark CURLSSLBACKEND_NSS as deprecated since 8.3.0 curl_easy_pause.3: mention h2/h3 buffering curl_easy_pause.3: mention it works within callbacks curl_easy_pause: set "in callback" true on exit if true CURLOPT_DEBUGFUNCTION.3: warn about internal handles docs/libcurl/opts/Makefile.inc: add missing manpage files docs: adapt SEE ALSO sections to new requirements docs: explain how PINNEDPUBLICKEY is independent of VERIFYPEER docs: replace made up domains with example.com docs: update curl man page references docs: use CURLSSLBACKEND_NONE doh: inherit DEBUGFUNCTION/DATA escape: replace Curl_isunreserved with ISUNRESERVED FAQ: How do I upgrade curl.exe in Windows? GHA/linux: run singleuse to detect single-use global functions GHA: add workflow to compare configure vs cmake outputs h2-proxy: remove left-over mistake in drain_tunnel() h2: testcase and fix for pausing h2 streams h3: add support for ngtcp2 with AWS-LC builds http2: refused stream handling for retry http: fix CURL_DISABLE_BEARER_AUTH breakage http: h1/h2 proxy unification http: remove wrong comment for http_should_fail http: use per-request counter to check too large headers http_aws_sigv4: fix sorting with empty parts idn: fix WinIDN null ptr deref on bad host idn: if idn2_check_version returns NULL, return error inet_ntop: add typecast to silence Coverity lib: disambiguate Curl_client_write flag semantics lib: enable hmac for digest as well lib: failf/infof compiler warnings lib: let the max filesize option stop too big transfers too lib: move handling of `data->req.writer_stack` into Curl_client_write() lib: provide and use Curl_hexencode lib: remove TIME_WITH_SYS_TIME lib: use wrapper for curl_mime_data fseek callback libssh2: fix error message on failed pubkey-from-file libssh: cap SFTP packet size sent Makefile.mk: always set `CURL_STATICLIB` for lib (Windows) MANUAL.md: change domain to example.com misc: better random strings MQTT: improve receive of ACKs multi: do CURLM_CALL_MULTI_PERFORM at two more places multi: fix small timeouts multi: remove Curl_multi_dump multi: round the timeout up to prevent early wakeups multi: set CURLM_CALL_MULTI_PERFORM after switch to DOING_MORE openssl: improve ssl shutdown handling openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR pytest: exclude test_03_goaway in CI runs due to timing dependency quic: set ciphers/curves the same way regular TLS does quiche: fix build error with --with-ca-fallback RELEASE-PROCEDURE.md: updated coming release dates runtests: display the test status if tests appear hung runtests: eliminate a warning on old perl versions socks: return error if hostname too long for remote resolve src/mkhelp: make generated code pass `checksrc` test1056: disable on Windows test1474: disable test on NetBSD, OpenBSD and Solaris 10 test1592: greatly increase the maximum test timeout test1903: actually verify the cookies after the test test1906: set a lower timeout since it's hit on Windows test2600: remove special case handling for USE_ALARM_TIMEOUT test650: fix an end tag typo test661: return from test early in case of curl error test: add missing <feature>s tests: close the shell used to start sshd tests: fix a race condition in ftp server disconnect tests: fix compiler warnings tests: Fix zombie processes left behind by FTP tests. tests: improve SLOWDOWN test reliability by reducing sent data tests: increase lib571 timeout from 3s to 30s tests: log the test result code after each libtest tests: propagate errors in libtests tests: set --expect100-timeout to improve test reliability tests: show which curl tool `runtests.pl` is using tests: stop overriding the lock timeout tftpd: always use curl's own tftp.h tool: use our own stderr variable tool_cb_wrt: fix debug assertion tool_getparam: accept variable expansion on file names too tool_setopt: remove unused function tool_setopt_flags upload-file.d: describe the file name slash/backslash handling url: fall back to http/https proxy env-variable if ws/wss not set url: fix netrc info message warnless: remove unused functions wolfssh: do cleanup in Curl_ssh_cleanup wolfssl: allow capath with CURLOPT_CAINFO_BLOB wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files wolfssl: ignore errors in CA path 8.3.0 Changes: curl: make %output{} in -w specify a file to write to gskit: remove lib: --disable-bindlocal builds curl without local binding support nss: remove support for this TLS library tool: add "variable" support trace: make tracing available in non-debug builds url: change default value for CURLOPT_MAXREDIRS to 30 urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name wolfssl: support loading system CA certificates Bugfixes: altsvc: accept and parse IPv6 addresses in response headers asyn-ares: reduce timeout to 2000ms aws-sigv4: canonicalize the query aws-sigv4: fix having date header twice in some cases aws-sigv4: handle no-value user header entries bearssl: don't load CA certs when peer verification is disabled bearssl: handshake fix, provide proper get_select_socks() implementation build: fix portability of mancheck and checksrc targets build: streamline non-UWP wincrypt detections c-hyper: adjust the hyper to curlcode conversion c-hyper: fix memory leaks in `Curl_http` cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP cf-socket: log successful interface bind CI/cirrus: disable python install on FreeBSD CI: add a 32-bit i686 Linux build CI: add caching to many jobs CI: move on to ngtcp2 v0.19.1 CI: move the Alpine build from Cirrus to GHA CI: ngtcp2-linux: use separate caches for tls libraries CI: remove Windows builds from Cirrus, without replacement CI: switch macOS ARM build from Cirrus to Circle CI CI: use master again for wolfssl cirrus: install everthing with pkg, avoid pip cmake: add GnuTLS option cmake: add support for `CURL_DEFAULT_SSL_BACKEND` cmake: add support for single libcurl compilation pass cmake: allow `SHARE_LIB_OBJECT=ON` on all platforms cmake: assume `wldap32` availability on Windows cmake: cache more config and delete unused ones cmake: detect `SSL_set0_wbio` in OpenSSL cmake: drop `HAVE_LIBWINMM` and `HAVE_LIBWS2_32` feature checks cmake: fix to use variable for the curl namespace cmake: fixup H2 duplicate symbols for unity builds cmake: set SIZEOF_LONG_LONG in curl_config.h cmake: support building static and shared libcurl in one go cmdline-docs: make sure to phrase it as "added in ...." cmdline-docs: use present tense, not future cmdline-opts/docs: mention the negative option part cmdline-opts/page-header: clarify stronger that !opt == URL cmdline-opts/page-header: reorder, clean up configure, cmake, lib: more form api deprecation configure: fix `HAVE_TIME_T_UNSIGNED` check configure: trust pkg-config when it's used for zlib configure: use the pkg-config --libs-only-l flag for libssh2 connect: stop halving the remaining timeout when less than 600 ms left cookie-jar.d: emphasize that this option is ONLY writing cookies crypto: ensure crypto initialization works curl_url_get/set.3: add missing semicolon in SYNOPSIS CURLINFO_CERTINFO.3: better explain curl_certinfo struct CURLINFO_TLS_SSL_PTR.3: clarify a recommendation CURLOPT_*TIMEOUT*: extend and clarify CURLOPT_SSL_VERIFYPEER.3: mention it does not load CA certs when disabled CURLOPT_URL.3: add two URL API calls in the see-also section CURLOPT_URL.3: explain curl_url_set() uses the same parser digest: Use hostname to generate spn instead of realm disable.d: explain --disable not implemented prior to 7.50.0 docs/cmdline-opts/gen.pl: hide "added in" before 7.50.0 docs/cmdline-opts: match the current output docs/cmdline-opts: spellfixes, typos and polish docs/cmdline: add small "warning" to verbose options docs/cmdline: remove repeated working for negotiate + ntlm docs/HYPER.md: document a workaround for a link error docs: add curl_global_trace to some SEE ALSO sections docs: link to the website versions instead of markdowns docs: mark --ssl-revoke-best-effort as Schannel specific docs: mention critical files in same directories as curl saves docs: removing "pausing transfers" from HYPER.md. docs: rewrite to present tense easy: remove #ifdefs to make code easier on the eye egd: delete feature detection and related source code ftp: fix temp write of ipv6 address gen.pl: escape all dashes (ascii minus) to avoid unicode hyphens gen.pl: replace all single quotes with aq GHA: adding quiche workflow headers: accept leading whitespaces on first response header http2: avoid too early connection re-use/multiplexing http2: cleanup trace messages http2: disable asssertion blocking OSSFuzz testing http2: fix in h2 proxy tunnel: progress in ingress on sending http2: polish things around POST http2: upgrade tests and add fix for non-existing stream http3/ngtcp2: shorten handshake, trace cleanup http3: quiche, handshake optimization, trace cleanup http: close the connection after a late 417 is received http: do not require a user name when using CURLAUTH_NEGOTIATE http: fix sending of large requests http: remove the p_pragma struct field http: return error when receiving too large header set hyper: fix a progress upload counter bug hyper: fix ownership problems hyper: remove `hyptransfer->endtask` imap: add a check for failing strdup() imap: remove the only sscanf() call in the IMAP code include.d: explain headers not printed with --fail before 7.75.0 include/curl/mprintf.h: add __attribute__ for the prototypes krb5: fix "implicit conversion loses integer precision" warnings lib: add ability to disable auths individually lib: build fixups when built with most things disabled lib: fix a few *printf() flag mistakes lib: fix null ptr derefs and uninitialized vars (h2/h3) lib: move mimepost data from ->req.p.http to ->state libtest: use curl_free() to free libcurl allocated data list-only.d: mention SFTP as supported protocol macOS: fix target detection more misc: fix various typos multi.h: the 'revents' field of curl_waitfd is supported multi: more efficient pollfd count for poll multi: remove 'processing: <url>' debug message ngtcp2: fix handling of large requests openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED` openssl: clear error queue after SSL_shutdown openssl: make aws-lc version support OCSP openssl: Support async cert verify callback openssl: switch to modern init for LibreSSL 2.7.0+ openssl: use `SSL_CTX_set_ciphersuites` with LibreSSL 3.4.1 openssl: use `SSL_CTX_set_keylog_callback` with LibreSSL 3.5.0 openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before os400: build test servers os400: do not check translatable options at build time os400: implement CLI tool page-footer: QLOGDIR works with ngtcp2 and quiche page-header: move up a URL paragraph from GLOBBING to URL pytest: fix check for slow_network skips to only apply when intended quic: don't set SNI if hostname is an IP address quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s quiche: enable quiche to handle timeout events resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set revert "schannel: reverse the order of certinfo insertions" schannel: fix ordering of cert chain info schannel: fix user-set legacy algorithms in Windows 10 & 11 schannel: verify hostname independent of verify cert sectransp: fix compiler warnings sectransp: prevent CFRelease() of NULL secureserver.pl: fix stunnel path quoting secureserver.pl: fix stunnel version parsing SECURITY-PROCESS.md: not a sec issue: Tricking user to run a cmdline system.h: add CURL_OFF_T definitions on HP-UX with HP aCC test1304: build and skip without netrc support test1554: check translatable string options in OS400 wrapper test1608: make it build and get skipped without shuffle DNS support test687/688: two more basic --xattr tests tests/tftpd+mqttd: make variables static to silence picky warnings tests: add 'large-time' as a testable feature tests: add support for nested %if conditions tests: don't call HTTP errors OK in test cases tests: ensure `libcurl.def` contains all exports tests: fix h3 server check and parallel instances tests: TLS session sharing test tests: update cookie expiry dates to far in the future time-cond.d: mention what happens on a missing file tool: avoid including leading spaces in the Location hyperlink tool: change some fopen failures from warnings to errors tool: make the length argument an int for printf()-.* flags tool_cb_wrt: fix invalid unicode for windows console tool_filetime: make -z work with file dates before 1970 tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR tool_operate: make aws-sigv4 not require TLS to be used tool_paramhlp: improve str2num(): avoid unnecessary call to strlen() tool_urlglob: use the correct format specifier for curl_off_t in msnprintf transfer: also stop the sending on closed connection transfer: don't set TIMER_STARTTRANSFER on first send unit2600: fix build warning if built without verbose messages url: remove infof() output for "still name resolving" urlapi: fix heap buffer overflow urlapi: make sure zoneid is also duplicated in curl_url_dup urlapi: return CURLUE_BAD_HOSTNAME if puny2idn encoding fails urlapi: setting a blank URL ("") is not an ok URL vquic: show stringified messages for errno vtls: clarify "ALPN: offers" message winbuild: improve check for static zlib wolfSSL: avoid the OpenSSL compat API when not needed workflows/macos.yml: disable zstd and alt-svc in the http-only build write-out.d: clarify %{time_starttransfer} ws: fix spelling mistakes in examples and tests Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:06:23 +00:00
Adolf Belka	ba021d4721	libedit: Update to version 20240517-3.1 ... - Update from version 20230828-3.1 to 20240517-3.1 - Update of rootfile - Changelog 20240517-3.1 * all: sync with upstream source Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:05:40 +00:00
Adolf Belka	fe3c0962f4	gnutls: Update to version 3.8.5 ... - Update from version 3.8.3 to 3.8.5 - Update of rootfile - Changelog 3.8.5 ** libgnutls: Due to majority of usages and implementations of RSA decryption with PKCS#1 v1.5 padding being incorrect, leaving them vulnerable to Marvin attack, the RSAES-PKCS1-v1_5 is being deprecated (encryption and decryption) and will be disabled in the future. A new option `allow-rsa-pkcs1-encrypt` has been added into the system-wide library configuration which allows to enable/disable the RSAES-PKCS1-v1_5. Currently, the RSAES-PKCS1-v1_5 is enabled by default. ** libgnutls: Added support for RIPEMD160 and PBES1-DES-SHA1 for backward compatibility with GCR. ** libgnutls: A couple of memory related issues have been fixed in RSA PKCS#1 v1.5 decryption error handling and deterministic ECDSA with earlier versions of GMP. These were a regression introduced in the 3.8.4 release. See #1535 and !1827. ** build: Fixed a bug where building gnutls statically failed due to a duplicate definition of nettle_rsa_compute_root_tr(). ** API and ABI modifications: GNUTLS_PKCS_PBES1_DES_SHA1: New enum member of gnutls_pkcs_encrypt_flags_t Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	2024-07-02 09:05:03 +00:00