- Update from version 24.01.0 to 24.03.0
- Update of rootfile
- find-dependencies run due to sobump. No issues found
- Changelog
24.03.0:
core:
* Fix opening some malformed files. Issue #1447
* Skip drawing image when it has singular matrix. Issue #1114
* Fix crash on malformed files
* Small internal code cleanup
utils:
* pdfdetach: Fix potential directory traversal
* pdfimages: Enable to print filenames to stdout.
* pdfsig: Add visible name/date when signing an existing form signature field
24.02.0:
core:
* Fix reading some JBIG2 streams. Issue #1319
* Fix saving some annotation interior color when it's empty
* Make searching for fonts when adding annotations a bit faster
* Make sure images are compressed when adding them
* Small internal code cleanup
utils:
* pdfimages: return exit code 2 when error opening output files
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 1.4 to 1.5.1
- Update of rootfile
- Changelog
1.5.1
Opus 1.5.1 fixes the meson build that was broken in 1.5.
1.5
Opus 1.5 is the first release to make extended use of ML in the encoder and
decoder. You can read all the details in the release demo page. In summary, major
changes since 1.4 include:
Significant improvement to packet loss robustness using Deep Redundancy (DRED)
Improved packet loss concealment through Deep PLC
Low-bitrate speech quality enhancement down to 6 kb/s wideband
Improved x86 (AVX2) and Arm (Neon) optimizations
Support for 4th and 5th order ambisonics
In addition to the improvements above, this release includes many minor bug fixes.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 20231114 to 20240312
- Update of rootfile
- For the changelog details see the releasenote.md file in the source tarball.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- use Encode was missed out in the previous patch for dns.cgi This would mean that the
decode from UTF-8 would fail. I had tested the previous change but forgot to copy across
the use Encode line when I created the patch.
- This patch adds an encode back to UTF-8 after running the cleanhtml command. This way
the text is decoded from UTF-8 so that the cleanhtml command works correctly on
umlauted characters and then is encoded back to UTF-8 so that all text in the cgi page
is UTF-8.
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 0.52.23 to 0.52.24
- Update of rootfile
- Changelog
0.52.24
- add support for python3.13
- fix compiler warnings
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 2.3.0 to 2.4.0
- Update of rootfile
- Changelog
2.4.0
- Changes:
* Add a PLIST_OPT_NONE value to plist_write_options_t
* autoconf: Allow disabling build of test suite
* Update doxygen config and document undocumented macros
* Add an explicit PLIST_FORMAT_NONE value
* Add a libplist_version() function to the interface
* docs: Use README.md to generate mainpage with doxygen
- Bugfixes:
* Several compiler-related fixes and code improvements
* Plug memory leak in plist_write_to_stream()
* Prevent adding NULL items to array/dictionary nodes
* Fix parallel running of test suite
* Fix cython bindings
* Fix OOB read in plist_from_memory()
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 3.2.4 to 3.3.5
- Update of rootfile
- Changelog
3.3.5 (2024-03-06)
Features:
- knotd: new module mod-authsignal for automatic authenticated DNSSEC
bootstrapping records synthesis (Thanks to Peter Thomassen)
- kzonecheck: new optional ZONEMD verification (see option '-z')
Improvements:
- knotd: new DNSSEC key rollover log informs about next planned key action
- knotd, kzonecheck: added limit on non-matching keys with a duplicate keytag
- knot-exporter: added counter-type variant for each metric (Thanks to Marcel Koch)
- libs: upgraded embedded libngtcp2 to 1.3.0
- doc: various fixes and updates
Bugfixes:
- knotd, kzonecheck: failed to validate RRSIG if there are more keys with the same keytag
- knotd, kzonecheck: failed to validate zone with more CSK keys
- libknot: insufficient check for malformed TCP header options over XDP
3.3.4 (2024-01-24)
Features:
- knotd: new configuration item for clearing configuration sections (see 'clear')
- knotc: configuration import can preserve database contents (see '+nopurge' flag)
- kxdpgun: new parameter for setting UDP payload size in EDNS (see '--edns-size') #915
Improvements:
- knotd: extended configuration check for 'zonefile-load' and 'journal-content'
- knotd: lowered check limit for additional NSEC3 iterations to 0
- knotd: lowered severity level of an informational backup log
- knotd: better log message when flushing the journal
- knotd: zone restore checks if requested contents are in the provided backup
- knotc: '+quic' is default for zone backup, '+noquic' is default for zone restore
- kdig: better processing of timeouts and reduced sent datagrams over QUIC
- kdig: no retries are attempted over QUIC
- keymgr: improved compatibility with bind9-generated keys
- libs: some improvements in XDP buffer allocation
- libs: upgraded embedded libngtcp2 to 1.2.0
- doc: various fixes and updates
Bugfixes:
- knotd: failed to build on macOS #909
- knotd: 'nsec3-salt-lifetime: -1' doesn't work if 'ixfr-from-axfr' is enabled
- knotd: unnecessarily updated RRSIGs if 'ixfr-from-axfr' and signing are enabled
- knotc: zone check complains about missing zone file #913
- kdig: failed to try another target address over QUIC
- libknot: infinite loop in knot_rrset_to_wire_extra() #916
3.3.3 (2023-12-13)
Features:
- knotd: new 'pattern' mode of ACL update owner matching (see 'acl.update-owner-match')
- knotc: new '+keysonly' filter for zone backup/restore
Improvements:
- knotd: zone purging waits for finished zone expiration for better reliability
- knotd: remote configuration considers more 'via' with the same address family
- knotd: refresh doesn't fall back from IXFR to AXFR upon a network error
- knotd: increased default for 'policy.rrsig-refresh' by (0.1 * 'rrsig-lifetime')
- knotd: new control flag 'u' for unix time output format from zone status
- knotd: extended check for inconsistent acl settings
- knotd/libknot: simplified TCP/QUIC sweep logging
- mod-dnsproxy: all configured remote addresses are used for fallback operation
- mod-dnsproxy: module responds locally if forwarding fails instead of SERVFAIL
- libs: upgraded embedded libngtcp2 to 1.1.0
- doc: various fixes and extensions
Bugfixes:
- knotd: zone backup fails due to improper backup context deinitialization #891
- knotd: failed to sign the zone if maximum zone's TTL is too high
- knotd: malformed TCP header if used with QUIC in the generic XDP mode
- knotd: server can crash when processing new TCP connections over XDP
- knotd: incorrect initialization of TCP limits
- knotd: orphaned PEM file not deleted when key generation fails
- knotd/libknot: connection timeouts over QUIC due to incomplete retransfer handling #894
- kdig: crashed when querying DNS over TLS if TLS handshake times out #896
- kzonecheck: failed to check DS with SHA-1 or GOST if not supported by local policy
- libdnssec: failed to compile with GnuTLS if PKCS #11 support is disabled
3.3.2 (2023-10-20)
Features:
- knotd: support for IXFR from AXFR computation (see 'zone.ixfr-from-axfr')
- knotd: support benevolent IXFR (see 'zone.ixfr-benevolent')
- knot-exporter: new configuration option '--no-zone-serial' #880
Improvements:
- libs: upgraded embedded libngtcp2 to 1.0.0
- knotd: added logging of new SOA serial when signing is finished
- knotd: unified some XDP-related logging
- keymgr: improved error message if a key file is not accessible
- keymgr: added offline RRSIGs validation at the end of their validity intervals
- kdig: upgraded EDNS presentation format to draft version -02
- kdig: simplified QUIC connection without extra PING frames
- kzonecheck: removed requirement that DS is at delegation point
- doc: various fixes and improvements
Bugfixes:
- knotd: logged incorrect new SOA serial if 'zonefile-load: difference' is set #875
- knotd: more signing threads with a PKCS #11 keystore has no effect #876
- knotd: DNAME record returned with query domain name instead of actual name #873
- knotd: failed to import configuration file if mod-geoip is in use #881
- knotd: failed to sign RRSet that fits to 64k only if compressed
- knotd: broken zone update context upon failed operation over control interface
- keymgr: offline RRSIGs not refreshed if 'rrsig-refresh' is not set
- knsupdate: incorrect processing of @ in the delete operation #879
- knot-exporter: failed to parse knotd PIDs on FreeBSD
Packaging:
- docker: added support for (inter-container) D-Bus signaling
3.3.1 (2023-09-11)
Improvements:
- knotd: multiple catalog groups per member are tolerated, but only one is used
- modules: added const qualifier to various function parameters #877 (Thanks to Robert Edmonds)
- libs: upgraded embedded libngtcp2 to 0.19.1
Bugfixes:
- knotd: TCP over XDP fails to respond
- knotd: server can crash when adjusting a wildcard glue
- knotd: failed to forward DDNS if 'zone.master' points to 'remotes'
- knotd: broken YAML statistics if more modules are configured #874
- knotd: DDNS forwarding isn't RFC 8945 compliant
3.3.0 (2023-08-28)
Features:
- knotd: full DNS over QUIC (DoQ, RFC 9250) implementation, also without XDP
- knotd: bidirectional XFR over QUIC (XoQ) support with opportunistic, strict,
and mutual authentication profiles
- knotd: automatic reverse PTR records pre-generation (see 'zone.reverse-generate')
- knotd: new per zone statistic counters 'zone.size' and 'zone.max-ttl'
- knotd: new primary server pinning (see 'zone.master-pin-tolerance')
- knotd: new SOA serial modulo policy (see 'zone.serial-modulo')
- knotd: new multi-signer operation mode (see 'policy.dnskey-sync' and 'DNSSEC multi-signer')
- kdig: support for EDNS presentation format, also in JSON mode (see '+optpresent')
- kxdpgun: new TCP/QUIC debug mode 'R' for connection reuse
- kxdpgun: new XDP mode parameter '--mode' (Thanks to Jan Včelák)
- kxdpgun: new parameter '--qlog' for qlog destination specification
- kzonecheck: new '--print' parameter for dumping the zone on stdout
Improvements:
- knotd: secondary can be configured not to forward DDNS (see 'zone.ddns-master')
- knotd: extended support for UNIX socket configuration (remote, acl)
- knotd: stats no longer dump empty or zero counters
- knotd: new 'keys-updated' D-Bus event
- knotd: added transport protocol information to outgoing event and nameserver logs
- knotd: server cleans up stale LMDB readers when opening a RW transaction
- knotd,kzonecheck: semantic check allows DS only at delegation point
- knotc: new zone backup filters '+quic' and '+noquic' for QUIC key backup
- mod-dnstap: DNS over QUIC traffic is marked as QUIC
- kxdpgun: QUIC connections are closed by default
- libs: upgraded embedded libngtcp2 to 0.18.0
- kdig: QUIC, TLS, or HTTPS protocol is printed in the final statistics
- doc: new sections 'DNS over QUIC' and 'DNSSEC multi-signer'
- doc: various improvements
Bugfixes:
- knotd: server can crash if a shared module is loaded and dynamic configuration used
- knotd: inaccurate transfer size is logged if EDNS EXPIRE, PADDING, or TSIG is present
- knotd: subsequent addition and removal to catalog zone isn't handled properly
- knotc: configuration import fails if an explicit shared module is configured
- utils: database transactions not properly closed when terminated prematurely
- kdig: double-free on some malformed responses over QUIC #869
- kdig: some TLS parameters override QUIC parameters
- libs: NULL record with empty RDATA isn't allowed
- tests: dthreads destructor test sometimes fails
Compatibility:
- knotd: responses to forwarded DDNS requests are signed with local TSIG key
- knotd: NOTIFY-initiated refresh tries all configured addresses of the remote
- knotd: configuration option 'xdp.quic-log' was replaced with 'log.quic'
- libs: removed embedded libbpf, an external one is necessary for XDP
- libs: DNS over QUIC implementation only supports 'doq' ALPN
- ctl: removed 'Version: ' prefix from 'status version' output
- modules: reduced parameters of 'knotd_qdata_local_addr()'
Packaging:
- knot-exporter: Prometheus exporter imported from GitHub
- knot-exporter: packages for Debian, Ubuntu, and PyPI
- debian,ubuntu: new self-hosted repository (see https://pkg.labs.nic.cz/doc/)
- docker: upgraded to Debian bookworm-slim
3.2.9 (2023-07-27)
Improvements:
- keymgr: 'import-pkcs11' not allowed if no PKCS #11 keystore backend is configured
- keymgr: more verbose key import errors
- doc: extended migration notes
- doc: various improvements
Bugfixes:
- knotd: server may crash when storing changeset of a big zone migrating to/from NSEC3
- knotd: zone refresh loop when all masters are outdated and timers cleared
- knotd: failed to active D-Bus notifications if not started as systemd service
- kjournalprint: database transaction not properly closed when terminated prematurely
3.2.8 (2023-06-26)
Improvements:
- kdig: malformed messages are parsed and printed using a best-effort approach
- python: new dname from wire initialization
Bugfixes:
- knotd: missing outgoing NOTIFY upon refresh if one of more primaries is up-to-date
- knotd: journal loop detection can prevent zone from loading
- knotd: cryptic error message when journal is full #842
- knotd: failed to query catalog zone over UDP
- configure: libngtcp2 check wrongly requires version 0.13.0 instead of 0.13.1
3.2.7 (2023-06-06)
Features:
- knotd: new configuration option for preserving incoming IXFR changeset history
(see 'zone.ixfr-by-one')
Improvements:
- knotd: journal ensures the stored changeset's SOA serials are strictly increasing
- knotd: more effective handling of zero KNOT_ZONE_LOAD_TIMEOUT_SEC environment value
- knotd, kdig: incoming transfer fails if a message has the TC bit set
- knotd, kjournalprint: store or print the timestamp of changeset creation
- kxdpgun: load only necessary number of queries (Thanks to Petr Špaček)
- kxdpgun: print ratio of sent vs. requested queries (Thanks to Petr Špaček)
- kxdpgun: print percentages as floats (Thanks to Petr Špaček)
- kjournalprint: ability to print a changeset loop
- kjournalprint: added changset serials information to '-z -d' output
- packaging: RHEL9 requires libxdp like fedora since RHEL 9.2 #844
- doc: various improvements
Bugfixes:
- knotd: journal loading can get stuck in a multi-changeset loop
- knotd: missing RCU lock when reading zone through the control interface
- knotd: server start D-Bus signaling doesn't work well if the zone file is
missing, catalog zones are used, or in the async-start mode
- knotd: test suite fails on 32bit architectures on musl 1.2 and newer #843
- knotd: failed to process zero-length messages over QUIC
- libs: compilation with embedded ngtcp2 fails if there is another ngtcp2 in the path
3.2.6 (2023-04-04)
Improvements:
- libs: upgraded embedded libngtcp2 to 0.13.1
- libs: added support for building on Cygwin and MSYS (Thanks to Christopher Ng)
- mod-dnstap: improved precision of stored time values
- kdig: added option for EDNS EXPIRE (see '+expire') #836
- kdig: extended description of SOA timers in the multiline mode
- kdig: reduced latency of TLS communication
- libknot: added EDE codes 28 and 29
- doc: various improvements
Bugfixes:
- knotd: generated catalog zone not updated upon server reload #834
- knotd: failed to check shared module configuration
- knotd: missing RCU registration of the statistics thread (Thanks to Qin Longfei)
- knotd: server logs failed to send QUIC packets in the XDP mode
- libs: inconsistent transformation of IPv4-Compatible IPv6 Addresses
- utils: failed to load configuration if dnstap module is enabled #831
- libknot: missing include string.h
3.2.5 (2023-02-02)
Features:
- knotd: new configuration option for enforcing IXFR fallback (see 'zone.provide-ixfr')
Improvements:
- knotd: changed UNIX socket file mode to 0222 for answering and 0220 for control
- mod-probe: new support for communication over a UNIX socket
- kdig: new support for communication over a UNIX socket
- libs: upgraded embedded libngtcp2 to 0.13.0
- doc: various improvements
Bugfixes:
- knotd: failed to get catalog member configuration if catalog template is in a template
- knotd: failed to respond over a UNIX socket with EDNS
- knotd: unexpected zone update upon restart or zone reload if ZONEMD generation is enabled
- knotd: redundant zone flush of unchanged zone if zone file load is 'difference-no-serial'
- knotd/kxdpgun: failed to receive messages over XDP with drivers tap or ena
- knotc: zone check doesn't report missing zone file #829
- kxdpgun: program crashes when remote closes QUIC connection instead of resumption
- mod-geoip: configuration check leaks memory in the geodb mode
- utils: unwanted color reset sequences in non-color output
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 10.02.1 to 10.03.0
- Update of rootfile
- Changelog
10.03.0
Highlights in this release include:
A vulnerability was identified in the way Ghostscript/GhostPDL called
tesseract for the OCR devices, which could allow arbitrary code execution.
As as result, we strongly urge anyone including the OCR devices in their
build to update as soon as possible.
As of this release (10.03.0) pdfwrite creates PDF files with XRef streams and
ObjStm streams. This can result in considerably smaller PDF output files.
See Vector Devices for more details.
Ghostscript/pdfwrite now supports passing through PDF "Optional Content".
Our efforts in code hygiene and maintainability continue.
The usual round of bug fixes, compatibility changes, and incremental
improvements.
(9.53.0) We have added the capability to build with the Tesseract OCR engine.
In such a build, new devices are available (pdfocr8/pdfocr24/pdfocr32)
which render the output file to an image, OCR that image, and output the
image "wrapped" up as a PDF file, with the OCR generated text information
included as "invisible" text (in PDF terms, text rendering mode 3).
Mainly due to time constraints, we only support including Tesseract from
source included in our release packages, and not linking to
Tesseract/Leptonica shared libraries. Whether we add this capability will be
largely dependent on community demand for the feature.
See Enabling OCR for more details.
Incompatible changes
(10.03.0) Almost all the "internal" PostScript procedures defined during the
interpreter startup are now "executeonly", further reducing the attack
surface of the interpreter.
The nature of these procedures means there should be no impact for legitimate
usage, but it is possible it will impact uses which abuse the previous
accessibility (even for legitimate reasons). Such cases may now require
"DELAYBIND", See DELAYBIND
(10.03.0) The "makeimagedevice" non-standard operator has been removed. It
allowed low level access to the graphics library in a way that was,
essentially impossible to secure.
(10.03.0) The "putdeviceprops", "getdeviceprops", "finddevice", "copydevice",
"findprotodevice" non-standard operators have all been removed. They
provided functionality that is either accessible through standard operators,
or should not be used by user PostScript.
(10.03.0) The process of "tidying" the PostScript namespace should have
removed only non-standard and undocumented operators. Nevertheless, it is
possible that any integrations or utilities that rely on those non-standard
and undocumented operators may stop working or may change behaviour.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 13.2 to 14.2
- Update of rootfile
- Changelog
14.2
This is a minor corrective release over GDB 14.1, fixing the following issues:
PR symtab/31112 (DLL export forwarding is broken)
PR c++/31128 (gdb crashes when trying to print a global variable stub without
a running inferior)
PR tdep/31254 ([gdb/tdep, arm] FAIL: gdb.threads/staticthreads.exp: up 10)
PR gdb/31256 (Crash with basic 'list .')
PR python/31366 (Frame.static_link() segfaults)
14.1
This version of GDB includes the following changes and enhancements:
Removed features, removed configurations:
GDB no longer support AiX 4.x, 5.x and 6.x. The minimum version supported
is AiX 7.1.
GDB/MI version 1 support has been removed
Initial built-in support for Debugger Adapter Protocol (DAP)
GDB now recognizes the NO_COLOR environment variable
Initial support for integer types larger than 64 bits
Breakpoints can now be inferior-specific
New convenience function "$_shell", to execute a shell command and return its
result.
Python support
New class gdb.Thread
New class gdb.unwinder.FrameId
New class gdb.ValuePrinter
New gdb.Inferior.arguments attribute, holding the command-line arguments
to the inferior, if known
New gdb.Inferior.main_name attribute, holding the name of the inferior's
'main', if known.
New gdb.Breakpoint.inferior attribute
New gdb.Progspace.symbol_file attribute
New gdb.Progspace.executable_filename attribute
New function gdb.execute_mi(COMMAND, [ARG]...)
New function gdb.block_signals()
New method gdb.Frame.static_link
New gdb.Inferior 'clear_env', 'set_env' and 'unset_env' methods
New gdb.Type now has the 'is_array_like' and 'is_string_like' methods
New gdb.Value 'assign' method
New gdb.Value 'to_array' method
New gdb.Progspace 'objfile_for_address' method
New methods added to the gdb.PendingFrame class, with behavior which is
the same as the corresponding methods on gdb.Frame.
gdb.LazyString now implements the __str__ method
New event gdb.ThreadExitedEvent
New event gdb.ExecutableChangedEvent
New event gdb.NewProgspaceEvent
New event gdb.FreeProgspaceEvent
The frame-id passed to gdb.PendingFrame.create_unwind_info now use either
an integer or a gdb.Value object for each of its 'sp', 'pc', and
'special' attributes.
The Disassembler API from the gdb.disassembler module has been extended
to include styling support
gdb.parse_and_eval now has a new "global_context" parameter, allowing the
request to only examine global symbols.
The name argument passed to gdb.unwinder.Unwinder.__init__ must now be of
type 'str' otherwise a TypeError will be raised.
The gdb.unwinder.Unwinder.enabled attribute can now only accept values of
type 'bool'. Changing this attribute will now invalidate GDB's
frame-cache.
It is now no longer possible to sub-class the
gdb.disassembler.DisassemblerResult type.
Remote protocol
Support for enabling or disabling individual remote target features
GDB/MI support
New 'no-history' stop reason
Support for inferior-specific breakpoints
The bkpt tuple, which appears in breakpoint-created notifications, and in
the result of the -break-insert command can now include an optional
'inferior' field for both the main breakpoint, and each location, when
the breakpoint is inferior-specific.
Trying to create a thread-specific breakpoint using a non-existent thread
ID now results in an error
New "simple-values-ref-types" -list-feature value indicating how the
--simple-values option in various commands take reference types into
account.
Enhanced AArch64 support
Initial support for Scalable Matrix Extension (SME) and for Scalable
Matrix Extension 2 (SME2)
The 'org.gnu.gdb.aarch64.pauth' Pointer Authentication feature is now
deprecated in favor of the 'org.gnu.gdb.aarch64.pauth_v2' feature string
Enhanced Ada support
Support for the Ada 2022 target name symbol ('@')
Support for the The Ada 2022 'Enum_Rep and 'Enum_Val attributes
Miscellaneous
The 'list' command now accepts '.' as an argument, telling GDB to print
the location around the point of execution within the current frame
New '%V' output format for printf and dprintf commands.
The printf command now limits the size of strings fetched from the
inferior to the value of the 'max-value-size' setting.
Support for extending at configure time the default value of the
'debug-file-directory' GDB parameter via the new
--additional-debug-dirs=PATHs configure option.
New command "info main"
New command "set tui mouse-events [on|off]" (on by default)
New command "set always-read-ctf on|off" (off by default)
Various new debug and maitenance commands
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 0.190 to 0.191
- Update of rootfile
- Changelog
0.191
libdw: dwarf_addrdie now supports binaries lacking a .debug_aranges
section.
Improved support for DWARF package files. Add new function
dwarf_cu_dwp_section_info.
debuginfod: Caching eviction logic improvements to improve retention
of small/frequent/slow files such as Fedora's vdso.debug.
srcfiles: Can now fetch the source files of a DWARF/ELF file and
place them into a zip.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 9.6p1 to 9.7p1
- Update of rootfile not required
- Changelog
9.7p1
Future deprecation notice
OpenSSH plans to remove support for the DSA signature algorithm in
early 2025 and compile-time disable it later this year.
DSA, as specified in the SSHv2 protocol, is inherently weak - being
limited to a 160 bit private key and use of the SHA1 digest. Its
estimated security level is only 80 bits symmetric equivalent.
OpenSSH has disabled DSA keys by default since 2015 but has retained
run-time optional support for them. DSA was the only mandatory-to-
implement algorithm in the SSHv2 RFCs[3], mostly because alternative
algorithms were encumbered by patents when the SSHv2 protocol was
specified.
This has not been the case for decades at this point and better
algorithms are well supported by all actively-maintained SSH
implementations. We do not consider the costs of maintaining DSA in
OpenSSH to be justified and hope that removing it from OpenSSH can
accelerate its wider deprecation in supporting cryptography
libraries.
This release makes DSA support in OpenSSH compile-time optional,
defaulting to on. We intend the next release to change the default
to disable DSA at compile time. The first OpenSSH release of 2025
will remove DSA support entirely.
This release contains mostly bugfixes.
New features
* ssh(1), sshd(8): add a "global" ChannelTimeout type that watches
all open channels and will close all open channels if there is no
traffic on any of them for the specified interval. This is in
addition to the existing per-channel timeouts added recently.
This supports situations like having both session and x11
forwarding channels open where one may be idle for an extended
period but the other is actively used. The global timeout could
close both channels when both have been idle for too long.
* All: make DSA key support compile-time optional, defaulting to on.
Bugfixes
* sshd(8): don't append an unnecessary space to the end of subsystem
arguments (bz3667)
* ssh(1): fix the multiplexing "channel proxy" mode, broken when
keystroke timing obfuscation was added. (GHPR#463)
* ssh(1), sshd(8): fix spurious configuration parsing errors when
options that accept array arguments are overridden (bz3657).
* ssh-agent(1): fix potential spin in signal handler (bz3670)
* Many fixes to manual pages and other documentation, including
GHPR#462, GHPR#454, GHPR#442 and GHPR#441.
* Greatly improve interop testing against PuTTY.
Portability
* Improve the error message when the autoconf OpenSSL header check
fails (bz#3668)
* Improve detection of broken toolchain -fzero-call-used-regs support
(bz3645).
* Fix regress/misc/fuzz-harness fuzzers and make them compile without
warnings when using clang16
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- If Freifunk München e.V. is entered as a remark it gets converted to
Freifunk München e.V.
- This is because cleanhtml is used on the UTF-8 remark text before saving it to the file
and the HTML::Entities::encode_entities command that is run on that remark text does
not work with UTF-8 text.
- If the UTF-8 text in the remark is decoded before running through the cleanhtml command
then the characters with diacritical marks are correctly shown.
- Have tested out the fix on a remark with a range of different characters with
diacritical marks and all of the ones tested were displayed correctly with the fix while
in the original form they were mangled.
Fixes: Bug#12395
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- This reverts commit 7c6ff5ff12
- That commit removed the cleanhtml command which is not advised, based on feedback from
Michael Tremer from other patch submissions as it creates a potential security problem.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 5.4.6 to 5.6.0
- Update of rootfile
- Changelog
5.6.0 (2024-02-24)
This bumps the minor version of liblzma because new features were
added. The API and ABI are still backward compatible with liblzma
5.4.x and 5.2.x and 5.0.x.
NOTE: As described in the NEWS for 5.5.2beta, the core components
are now under the BSD Zero Clause License (0BSD).
Since 5.5.2beta:
* liblzma:
- Disabled the branchless C variant in the LZMA decoder based
on the benchmark results from the community.
- Disabled x86-64 inline assembly on x32 to fix the build.
* Sandboxing support in xz:
- Landlock is now used even when xz needs to create files.
In this case the sandbox is has to be more permissive than
when no files need to be created. A similar thing was
already in use with pledge(2) since 5.3.4alpha.
- Landlock and pledge(2) are now stricter when reading from
more than one input file and only writing to standard output.
- Added support for Landlock ABI version 4.
* CMake:
- Default to -O2 instead of -O3 with CMAKE_BUILD_TYPE=Release.
-O3 is not useful for speed and makes the code larger.
- Now builds lzmainfo and lzmadec.
- xzdiff, xzgrep, xzless, xzmore, and their symlinks are now
installed. The scripts are also tested during "make test".
- Added translation support for xz, lzmainfo, and the
man pages.
- Applied the symbol versioning workaround for MicroBlaze that
is used in the Autotools build.
- The general XZ Utils and liblzma API documentation is now
installed.
- The CMake component names were changed a little and several
were added. liblzma_Runtime and liblzma_Development are
unchanged.
- Minimum required CMake version is now 3.14. However,
translation support is disabled with CMake versions
older than 3.20.
- The CMake-based build is now close to feature parity with the
Autotools-based build. Most importantly a few tests aren't
run yet. Testing the CMake-based build on different operating
systems would be welcome now. See the comment at the top of
CMakeLists.txt.
* Fixed a bug in the Autotools feature test for ARM64 CRC32
instruction support for old versions of Clang. This did not
affect the CMake build.
* Windows:
- The build instructions in INSTALL and windows/INSTALL*.txt
were revised completely.
- windows/build-with-cmake.bat along with the instructions
in windows/INSTALL-MinGW-w64_with_CMake.txt should make
it very easy to build liblzma.dll and xz.exe on Windows
using CMake and MinGW-w64 with either GCC or Clang/LLVM.
- windows/build.bash was updated. It now works on MSYS2 and
on GNU/Linux (cross-compiling) to create a .zip and .7z
package for 32-bit and 64-bit x86 using GCC + MinGW-w64.
* The TODO file is no longer installed as part of the
documentation. The file is out of date and does not reflect
the actual tasks that will be completed in the future.
* Translations:
- Translated lzmainfo man pages are now installed. These
had been forgotten in earlier versions.
- Updated Croatian, Esperanto, German, Hungarian, Korean,
Polish, Romanian, Spanish, Swedish, Vietnamese, and Ukrainian
translations.
- Updated German, Korean, Romanian, and Ukrainian man page
translations.
* Added a few tests.
Summary of new features added in the 5.5.x development releases:
* liblzma:
- LZMA decoder: Speed optimizations to the C code and
added GCC & Clang compatible inline assembly for x86-64.
- Added lzma_mt_block_size() to recommend a Block size for
multithreaded encoding.
- Added CLMUL-based CRC32 on x86-64 and E2K with runtime
processor detection. Similar to CRC64, on 32-bit x86 it
isn't available unless --disable-assembler is used.
- Optimized the CRC32 calculation on ARM64 platforms using the
CRC32 instructions. Runtime detection for the instruction is
used on GNU/Linux, FreeBSD, Windows, and macOS. If the
compiler flags indicate unconditional CRC32 instruction
support (+crc) then the generic version is not built.
- Added definitions of mask values like
LZMA_INDEX_CHECK_MASK_CRC32 to <lzma/index.h>.
* xz:
- Multithreaded mode is now the default. This improves
compression speed and creates .xz files that can be
decompressed in multithreaded mode. The downsides are
increased memory usage and slightly worse compression ratio.
- Added a new command line option --filters to set the filter
chain using the liblzma filter string syntax.
- Added new command line options --filters1 ... --filters9 to
set additional filter chains using the liblzma filter string
syntax. The --block-list option now allows specifying filter
chains that were set using these new options.
- Ported the command line tools to Windows MSVC.
Visual Studio 2015 or later is required.
* Added lz4 support to xzdiff/xzcmp and xzgrep.
5.5.2beta (2024-02-14)
* Licensing change: The core components are now under the
BSD Zero Clause License (0BSD). In XZ Utils 5.4.6 and older
and 5.5.1alpha these components are in the public domain and
obviously remain so; the change affects the new releases only.
0BSD is an extremely permissive license which doesn't require
retaining or reproducing copyright or license notices when
distributing the code, thus in practice there is extremely
little difference to public domain.
* liblzma
- Significant speed optimizations to the LZMA decoder were
made. There are now three variants that can be chosen at
build time:
* Basic C version: This is a few percent faster than
5.4.x due to some new optimizations.
* Branchless C: This is currently the default on platforms
for which there is no assembly code. This should be a few
percent faster than the basic C version.
* x86-64 inline assembly. This works with GCC and Clang.
The default choice can currently be overridden by setting
LZMA_RANGE_DECODER_CONFIG in CPPFLAGS: 0 means the basic
version and 3 means that branchless C version.
- Optimized the CRC32 calculation on ARM64 platforms using the
CRC32 instructions. The instructions are optional in ARMv8.0
and are required in ARMv8.1 and later. Runtime detection for
the instruction is used on GNU/Linux, FreeBSD, Windows, and
macOS. If the compiler flags indicate unconditional CRC32
instruction support (+crc) then the generic version is not
built.
* Added lz4 support to xzdiff/xzcmp and xzgrep.
* Man pages of xzdiff/xzcmp, xzgrep, and xzmore were rewritten
to simplify licensing of the man page translations.
* Translations:
- Updated Chinese (simplified), German, Korean, Polish,
Romanian, Spanish, Swedish, and Ukrainian translations.
- Updated German, Korean, Romanian, and Ukrainian man page
translations.
* Small improvements to the tests.
* Added doc/examples/11_file_info.c. It was added to the Git
repository in 2017 but forgotten to be added into distribution
tarballs.
* Removed doc/examples_old. These were from 2012.
* Removed the macos/build.sh script. It had not been updated
since 2013.
5.5.1alpha (2024-01-26)
* Added a new filter for RISC-V binaries. The filter can be used
for 32-bit and 64-bit binaries with either little or big
endianness. In liblzma, the Filter ID is LZMA_FILTER_RISCV (0x0B)
and the xz option is --riscv. liblzma filter string syntax
recognizes this filter as "riscv".
* liblzma:
- Added lzma_mt_block_size() to recommend a Block size for
multithreaded encoding
- Added CLMUL-based CRC32 on x86-64 and E2K with runtime
processor detection. Similar to CRC64, on 32-bit x86 it
isn't available unless --disable-assembler is used.
- Implemented GNU indirect function (IFUNC) as a runtime
function dispatching method for CRC32 and CRC64 fast
implementations on x86. Only GNU/Linux (glibc) and FreeBSD
builds will use IFUNC, unless --enable-ifunc is specified to
configure.
- Added definitions of mask values like
LZMA_INDEX_CHECK_MASK_CRC32 to <lzma/index.h>.
- The XZ logo is now included in the Doxygen generated
documentation. It is licensed under Creative Commons
Attribution-ShareAlike 4.0.
* xz:
- Multithreaded mode is now the default. This improves
compression speed and creates .xz files that can be
decompressed multithreaded at the cost of increased memory
usage and slightly worse compression ratio.
- Added new command line option --filters to set the filter
chain using liblzma filter string syntax.
- Added new command line options --filters1 ... --filters9 to
set additional filter chains using liblzma filter string
syntax. The --block-list option now allows specifying filter
chains that were set using these new options.
- Added support for Linux Landlock as a sandboxing method.
- xzdec now supports pledge(2), Capsicum, and Linux Landlock as
sandboxing methods.
- Progress indicator time stats remain accurate after pausing
xz with SIGTSTP.
- Ported xz and xzdec to Windows MSVC. Visual Studio 2015 or
later is required.
* CMake Build:
- Supports pledge(2), Capsicum, and Linux Landlock sandboxing
methods.
- Replacement functions for getopt_long() are used on platforms
that do not have it.
* Enabled unaligned access by default on PowerPC64LE and on RISC-V
targets that define __riscv_misaligned_fast.
* Tests:
- Added two new fuzz targets to OSS-Fuzz.
- Implemented Continuous Integration (CI) testing using
GitHub Actions.
* Changed quoting style from `...' to '...' in all messages,
scripts, and documentation.
* Added basic Codespell support to help catch typo errors.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 5.5.18 to 5.5.21
- Update of rootfile not required
- Changelog
5.5.21
* Updated the .cv and .sd TLD servers.
* Remove 4 new gTLDs which are no longer active.
5.5.20
* Added the .gn TLD server.
* Removed 6 new gTLDs which are no longer active.
* Enabled getopt_long(3) support on Solaris.
5.5.19
* Fixed english support for Japanese queries to not add again the /e
argument if it had already been provided by the user. (Closes: #1050171)
* Added the .ye and .বাংলা (.xn--54b7fta0cc, Bangladesh) TLD servers.
* Updated the .ba, .bb, .dk, .es, .gt, .jo, .ml, .mo, .pa, .pn, .sv,
.uy, .ﺍﻻﺭﺪﻧ (.xn--mgbayh7gpa, Jordan) and .澳門 (.xn--mix891f, Macao)
TLD servers.
* Upgraded the TLD URLs to HTTPS whenever possible.
* Updated the charset for whois.jprs.jp.
* Removed 3 new gTLDs which are no longer active.
* Removed support for the obsolete as32 dot notation.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 11.7.0 to 11.9.0
- Update of rootfile
- Changelog
11.9.0
* Add ENABLE_COVERAGE cmake option to assist with generating
coverage reports.
* From M. Holger: add QPDFObjectHandle::writeJSON to directly
write a JSON representation to a pipeline. This is much faster
than writing the serialized result of getJSON.
* The previous fix to #1056 was incomplete. When setting a check
box value, the previous fix allowed any value other than /Off to
mean checked. Now we also set the actual value based on the
allowable non-/Off value in the normal appearance dictionary.
Fixes#1056.
* Add fuzz testing for JSON.
* Add JSON::getDictItem (from m-holger)
* Allow --overlay and --underlay to be repeated. They may appear
multiple times on the command-line and will be stacked in the
order in which they appear. In QPDFJob JSON, the overlay and
underlay keys may contain arrays. For compatibility, they may also
contain a single dictionary.
* Add new command-line arguments --file and --range which can be
used within --pages in place of positional arguments. Allow --file
to be used inside of --overlay and --underlay as well. These new
options can be freely intermixed with positional arguments. Also
add file(), range(), and password() to QPDFJob::PagesConfig as an
alternative to pageSpec.
11.8.0
* Bug fix: treat references to older generations of objects as
null.
* When recovering a file's xref table, attempt to find xref
streams if a traditional trailer dictionary is not found. Fixes
#1103.
* Add --set-page-labels command-line argument and supporting API.
Fixes#939.
- QPDFJob::Config::setPageLabels
- pdf_page_label_e enumerated type
- QPDFPageLabelDocumentHelper::pageLabelDict
* Support comma-separated numeric values with --collate to select
different group sizes from different files. Fixes#505.
* Support "x" before a group in a numeric range to exclude a group
from the previous group. Details are in the manual. Fixes#564,
#790.
* When flattening annotations, preserve annotations without any
appearance information at all, such as types /Link, /Popup, and
/Projection. Fixes#1039.
* Detect overlong UTF-8 in the UTF-8 decoder, and fix detection of
8-bit characters in erroneous UTF-8 strings.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 0.43.0 to 0.43.4
- Update of rootfile
- Changelog
0.43.4
Revert the changes to fix the problem in big-endian architectures
Allow to build pixman on clang/arm32
pixman-arm: Fix build on clang/arm32
pixman-x86: Use cpuid.h header
pixman-x86: Move #include "cpuid.h" inside conditionals
Revert "Allow to build pixman on clang/arm32"
pixman-arm: Use unified syntax
0.43.2
Note, in the past pixman used a numbering scheme with odd minor number
numbers for development versions and even minor number for stable
versions. This is no longer the case, all releases (including this one)
are stable production versions now.
Drop automatic DEBUG define
Drop ChangeLog
Drop contrib/ci.sh
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 3.10.0 to 3.11.1
- Update of rootfile
- Changelog
3.11.1
* Fixed wrong API version in lib/pci.h.
* Updated README.Windows.
* Fix compilation on Windows.
3.11.0
* update-pciids now supports XZ compression. If libpci is configured
with support for compression, all downloaded files are recompressed
as gzip. Otherwise they are stored as plain text.
* update-pciids now sends itself as the User-Agent.
* Added a pcilmr utility for PCIe lane margining. Thanks to Nikita
Proshkin for contributing it.
* Re-factored access to i386 ports on all relevant platforms.
* Added i386 port access on OpenBSD.
* Back-ends for Windows received many bug fixes and improvements.
* ECAM back-end now scans ACPI and BIOS memory faster.
* Linux systems without pread/pwrite are no longer supported
as they are hopefully long gone. This helps avoid the tricky check
for presence of pread which was found to fail on musl libc.
* Improved decoding of PCIe control and status registers.
* Decoding of CXL capabilities now supports up to CXL 3.0.
* lspci now displays interrupt message numbers consistently across
different capabilities.
* Cache of IDs resolved via DNS, which was located in ~/.pci-ids
by default, is now stored according to the XDG base directory
specification in $XDG_CACHE_HOME/pci-ids.
* All source files now have SPDX license identifiers.
* Internal: The "aux" fields of structs pci_access and pci_dev
reserved for use by back-ends were renamed to backend_data to better
reflect their meaning.
* As usually, various minor bug fixes and updated pci.ids.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 1.50.13 to 1.52.0
- Update of rootfile
- Changelog
1.52.0
- Add pango_font_map_reload_font
- Improve formatting of font sizes
1.51.2
- Build improvements on Windows
- Use single fontconfig thread
- Fix problems with spaces at line ends
- Allow custom fonts on Windows
- pango-viewer: Fix hint-metrics options
- Pangofont: Add properties
1.51.0
- itemize: Improve script itemization
- build: Check for cairo DWrite dependency
- win32: Fix various issues and crashes
- layout: Add a missing switch case
1.50.14
- Fix underline thickness in scaled contexts
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 6.2.0 to 6.2.1
- Update of rootfile
- Changelog
2.6.1 Thu February 29 2024
Bug fixes:
#817 Make tests independent of CPU speed, and thus more robust
#828#836 Expose billion laughs API with XML_DTD defined and
XML_GE undefined, regression from 2.6.0
Other changes:
#829 Hide test-only code behind new internal macro
#833 Autotools: Reject expat_config.h.in defining SIZEOF_VOID_P
#819 Address compiler warnings
#832#834 Version info bumped from 10:0:9 (libexpat*.so.1.9.0)
to 10:1:9 (libexpat*.so.1.9.1); see https://verbump.de/
for what these numbers do
Infrastructure:
#818 CI: Adapt to breaking changes in clang-format
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 6.3 to 6.7
- Update of rootfile not required
- Changelog
6.7 - January 29, 2024
* Feature: support for setting TCP data split
* Fix: fix new gcc14 warning
* Fix: fix SFF-8472 transceiver module identification (-m)
* Misc: code cleanup
6.6 - November 23, 2023
* Feature: support for more CMIS transceiver modules (-m)
* Fix: fix build on systems with old kernel uapi headers
6.5 - September 12, 2023
* Feature: register dump for hns3 driver (-d)
* Fix: fix fallback to ioctl for sset (-s)
* Fix: fix empty slot search in rmgr (-N)
6.4 - July 1, 2023
* Feature: get/set Tx push buffer length (-G)
* Feature: sff-8636 and cmis: report LOL / LOS / Tx Fault (-m)
* Fix: fix duplex setting parser (-s)
* Misc: check and require C11 language standard
* Misc: clean up obsolete pre-build checks
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
