GraphicsMagick: Update the news. Add docs regaring SHA-256. Ge...
GraphicsMagick Commits <[email protected]>
| Newsgroups | gmane.comp.video.graphicsmagick.cvs |
|---|---|
| Message-ID | <mailman.50220.1648310089.1623.graphicsmagick-commit@lists.sourceforge.net> |
changeset 8ce98e7f842b in /hg/GraphicsMagick details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=8ce98e7f842b summary: Update the news. Add docs regaring SHA-256. Generate SHA-256 checksum files. diffstat: ChangeLog | 7 +++++++ Makefile.am | 3 +++ Makefile.in | 3 +++ NEWS.txt | 31 +++++++++++++++++++------------ www/Changelog.html | 9 +++++++-- www/NEWS.html | 26 ++++++++++++++++---------- www/download.html | 42 ++++++++++++++++++++++++------------------ www/download.rst | 40 +++++++++++++++++++++++----------------- 8 files changed, 102 insertions(+), 59 deletions(-) diffs (348 lines): diff -r 94f4bcf448ad -r 8ce98e7f842b ChangeLog --- a/ChangeLog Sat Mar 26 08:32:13 2022 -0500 +++ b/ChangeLog Sat Mar 26 10:54:38 2022 -0500 @@ -1,5 +1,12 @@ 2022-03-26 Bob Friesenhahn <[email protected]> + * Makefile.am (release, snapshot): Generate SHA-256 checksums as a + by-product of 'make snapshot' or 'make release'. + + * www/download.rst: Add documentation regaring SHA-256 checksums. + + * NEWS.txt: Update the news again. + * coders/miff.c (ReadMIFFImage): Validate claimed bzip2-compressed row length prior to reading data into fixed size buffer. Addresses SourceForge bug #664 "[bug]Heap buffer overflow when diff -r 94f4bcf448ad -r 8ce98e7f842b Makefile.am --- a/Makefile.am Sat Mar 26 08:32:13 2022 -0500 +++ b/Makefile.am Sat Mar 26 10:54:38 2022 -0500 @@ -393,6 +393,7 @@ for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ rm -f $${file}.sig ; \ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ + sha256sum $${file} > $${file}.sum ; \ done SRCDIR=$(SRCDIR) $(GRAPHICSMAGICK_SNAPSHOT_COPY) $(SNAPSHOT_DIST_ARCHIVES) \ `for f in $(SNAPSHOT_DIST_ARCHIVES) ; do printf "%s.sig " $$f ; done` \ @@ -407,6 +408,7 @@ $(MAKE) $(DIST_WINDOWS_SRC_7ZIP) for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ + sha256sum $${file} > $${file}.sum ; \ done $(RM) $(SNAPSHOT_DIRECTORY)/$(PACKAGE_NAME)-*.tar.* $(RM) $(SNAPSHOT_DIRECTORY)/$(PACKAGE_NAME)-*-windows.7z* @@ -464,4 +466,5 @@ for file in $(DIST_ARCHIVES) $(DIST_WINDOWS_SRC_7ZIP) ; do \ rm -f $${file}.sig ; \ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ + sha256sum $${file} > $${file}.sum ; \ done diff -r 94f4bcf448ad -r 8ce98e7f842b Makefile.in --- a/Makefile.in Sat Mar 26 08:32:13 2022 -0500 +++ b/Makefile.in Sat Mar 26 10:54:38 2022 -0500 @@ -11425,6 +11425,7 @@ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ rm -f $${file}.sig ; \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ +@HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ sha256sum $${file} > $${file}.sum ; \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ done @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ SRCDIR=$(SRCDIR) $(GRAPHICSMAGICK_SNAPSHOT_COPY) $(SNAPSHOT_DIST_ARCHIVES) \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ `for f in $(SNAPSHOT_DIST_ARCHIVES) ; do printf "%s.sig " $$f ; done` \ @@ -11434,6 +11435,7 @@ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ $(MAKE) $(DIST_WINDOWS_SRC_7ZIP) @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ +@HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ sha256sum $${file} > $${file}.sum ; \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ done @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ $(RM) $(SNAPSHOT_DIRECTORY)/$(PACKAGE_NAME)-*.tar.* @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ $(RM) $(SNAPSHOT_DIRECTORY)/$(PACKAGE_NAME)-*-windows.7z* @@ -11468,6 +11470,7 @@ for file in $(DIST_ARCHIVES) $(DIST_WINDOWS_SRC_7ZIP) ; do \ rm -f $${file}.sig ; \ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ + sha256sum $${file} > $${file}.sum ; \ done # Tell versions [3.59,3.63) of GNU make to not export all variables. diff -r 94f4bcf448ad -r 8ce98e7f842b NEWS.txt --- a/NEWS.txt Sat Mar 26 08:32:13 2022 -0500 +++ b/NEWS.txt Sat Mar 26 10:54:38 2022 -0500 @@ -6,7 +6,7 @@ GraphicsMagick News =================== -This file was last updated to reflect changes up to March 22, 2022 +This file was last updated to reflect changes up to March 26, 2022 Please note that this file records news for the associated development branch and that each development branch has its own NEWS file. See the @@ -56,29 +56,34 @@ Bug fixes: -* Fixed portability issue related to 'sed' which broke - utilities/tests/convert.tap test script. - -* WPG: Fix incorrect TrX and TrY elements in CTM. +* Documentation: Generator scripts in 'doc' directory now produce + similar results using GNU sed and Solaris/Illumos sed and don't + produce warnings. * JNG: Fixes to error handling to avoid temporary file leaks and avoiding returning a broken image. -* JPEG: Always store embedded profiles in image, even if in 'ping' mode. +* JPEG: Always store embedded profiles in image, even if in 'ping' + mode. * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and check all related calculations for overload. +* MIFF: Fix heap buffer overflow which may be provoked in builds with + BZLIB support. + +* MogrifyImage() and Magick::Image::trim(): Trim requires + NorthWestGravity. + * PICT: Fixed a heap overflow. -* MogrifyImage() and Magick::Image::trim(): Trim requires NorthWestGravity. - * PerlMagick: Fix issue that image fill attribute had its opacity reset to transparent so it could not be usefully set at image scope. -* Documentation generator scripts in 'doc' directory now produce - similar results using GNU sed and Solaris/Illumos sed and don't - produce warnings. +* Test Suite: Fixed portability issue related to 'sed' which broke + utilities/tests/convert.tap test script. + +* WPG: Fix incorrect TrX and TrY elements in CTM. New Features: @@ -94,7 +99,9 @@ * Added support for reading and writing JPEG XL format. -* Support for JasPer 3.0.0 is completed. +* Support for JasPer 3.0.0 is completed. Upgrading to JasPer 3.0.0 is + strongly recommended due to its many security fixes and integration + with GraphicsMagick's resource-limited memory allocator. * PNG: Support the define png:chunk-malloc-max=limit in order to allow reading PNG files which report "chunk data is too large" or to diff -r 94f4bcf448ad -r 8ce98e7f842b www/Changelog.html --- a/www/Changelog.html Sat Mar 26 08:32:13 2022 -0500 +++ b/www/Changelog.html Sat Mar 26 10:54:38 2022 -0500 @@ -37,11 +37,16 @@ <p>2022-03-26 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> <blockquote> -* coders/miff.c (ReadMIFFImage): Validate claimed bzip2-compressed +<p>* Makefile.am (release, snapshot): Generate SHA-256 checksums as a +by-product of 'make snapshot' or 'make release'.</p> +<p>* www/download.rst: Add documentation regaring SHA-256 checksums.</p> +<p>* NEWS.txt: Update the news again.</p> +<p>* coders/miff.c (ReadMIFFImage): Validate claimed bzip2-compressed row length prior to reading data into fixed size buffer. Addresses SourceForge bug #664 "[bug]Heap buffer overflow when parsing MIFF". This severe bug only impacts builds with BZLIB -support.</blockquote> +support.</p> +</blockquote> <p>2022-03-22 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> <blockquote> * coders/jxl.c (ReadJXLImage): Added patch from Tobias Mark to diff -r 94f4bcf448ad -r 8ce98e7f842b www/NEWS.html --- a/www/NEWS.html Sat Mar 26 08:32:13 2022 -0500 +++ b/www/NEWS.html Sat Mar 26 10:54:38 2022 -0500 @@ -38,7 +38,7 @@ <!-- -*- mode: rst -*- --> <!-- This text is in reStucturedText format, so it may look a bit odd. --> <!-- See http://docutils.sourceforge.net/rst.html for details. --> -<p>This file was last updated to reflect changes up to March 22, 2022</p> +<p>This file was last updated to reflect changes up to March 26, 2022</p> <p>Please note that this file records news for the associated development branch and that each development branch has its own NEWS file. See the ChangeLog file, and/or the Mercurial changesets, for full details.</p> @@ -125,21 +125,25 @@ </ul> <p>Bug fixes:</p> <ul class="simple"> -<li>Fixed portability issue related to 'sed' which broke -utilities/tests/convert.tap test script.</li> -<li>WPG: Fix incorrect TrX and TrY elements in CTM.</li> +<li>Documentation: Generator scripts in 'doc' directory now produce +similar results using GNU sed and Solaris/Illumos sed and don't +produce warnings.</li> <li>JNG: Fixes to error handling to avoid temporary file leaks and avoiding returning a broken image.</li> -<li>JPEG: Always store embedded profiles in image, even if in 'ping' mode.</li> +<li>JPEG: Always store embedded profiles in image, even if in 'ping' +mode.</li> <li>MAT: Change from using 'int' for sizes/offsets to using 'size_t' and check all related calculations for overload.</li> +<li>MIFF: Fix heap buffer overflow which may be provoked in builds with +BZLIB support.</li> +<li>MogrifyImage() and Magick::Image::trim(): Trim requires +NorthWestGravity.</li> <li>PICT: Fixed a heap overflow.</li> -<li>MogrifyImage() and Magick::Image::trim(): Trim requires NorthWestGravity.</li> <li>PerlMagick: Fix issue that image fill attribute had its opacity reset to transparent so it could not be usefully set at image scope.</li> -<li>Documentation generator scripts in 'doc' directory now produce -similar results using GNU sed and Solaris/Illumos sed and don't -produce warnings.</li> +<li>Test Suite: Fixed portability issue related to 'sed' which broke +utilities/tests/convert.tap test script.</li> +<li>WPG: Fix incorrect TrX and TrY elements in CTM.</li> </ul> <p>New Features:</p> <ul class="simple"> @@ -152,7 +156,9 @@ provides more protections as well.</li> <li>Added support for reading HEIF/HEIC format.</li> <li>Added support for reading and writing JPEG XL format.</li> -<li>Support for JasPer 3.0.0 is completed.</li> +<li>Support for JasPer 3.0.0 is completed. Upgrading to JasPer 3.0.0 is +strongly recommended due to its many security fixes and integration +with GraphicsMagick's resource-limited memory allocator.</li> <li>PNG: Support the define png:chunk-malloc-max=limit in order to allow reading PNG files which report "chunk data is too large" or to reduce the default limit.</li> diff -r 94f4bcf448ad -r 8ce98e7f842b www/download.html --- a/www/download.html Sat Mar 26 08:32:13 2022 -0500 +++ b/www/download.html Sat Mar 26 10:54:38 2022 -0500 @@ -43,7 +43,7 @@ <li><a class="reference internal" href="#download-sites" id="id1">Download Sites</a></li> <li><a class="reference internal" href="#verifying-the-download" id="id2">Verifying The Download</a><ul> <li><a class="reference internal" href="#using-a-pgp-key" id="id3">Using a PGP key</a></li> -<li><a class="reference internal" href="#using-a-sha-1-checksum" id="id4">Using a SHA-1 checksum</a></li> +<li><a class="reference internal" href="#using-a-sha-256-or-sha-1-checksum" id="id4">Using a SHA-256 or SHA-1 checksum</a></li> </ul> </li> </ul> @@ -55,13 +55,14 @@ This is also where 'snapshot' distribution archives may be found.</p> <p>Until recently (December, 2021) GraphicsMagick provided its own ftp site for downloads but this has been disabled due to abusive download -practices and because support for FTP has been removed from popular -browsers. This is unfortunate since the same site also provided -PNG-related files and a libtiff mirror. The ftp site directory tree -continues to exist and will be maintained. If you are an -administrator of a high-bandwidth ftp or https mirror site and would -like to provide a GraphicsMagick mirror, please contact <a class="reference external" href="mailto:bfriesen%40graphicsmagick.org">Bob -Friesenhahn</a> and we will work something out.</p> +practices (by using it as the primary download site) and because +support for FTP has been removed from popular browsers. This is +unfortunate since the same site also provided PNG-related files and a +libtiff mirror. The ftp site directory tree continues to exist and +will be maintained. If you are an administrator of a high-bandwidth +ftp or https mirror site and would like to provide a GraphicsMagick +mirror, please contact <a class="reference external" href="mailto:bfriesen%40graphicsmagick.org">Bob Friesenhahn</a> and we will work something +out.</p> </div> <div class="section" id="verifying-the-download"> <h1><a class="toc-backref" href="#id2">Verifying The Download</a></h1> @@ -110,22 +111,27 @@ gpg: aka "[jpeg image of size 4917]" [ultimate] </pre> </div> -<div class="section" id="using-a-sha-1-checksum"> -<h2><a class="toc-backref" href="#id4">Using a SHA-1 checksum</a></h2> +<div class="section" id="using-a-sha-256-or-sha-1-checksum"> +<h2><a class="toc-backref" href="#id4">Using a SHA-256 or SHA-1 checksum</a></h2> <p>While verifying distribution files using GnuPG is by far the most -secure way to validate a release file, you may find SHA-1 checksums in -a distribution release announcement (e.g. from the +secure way to validate a release file, you may find SHA-256 or SHA-1 +checksums in a distribution release announcement (e.g. from the graphicsmagick-announce list at <a class="reference external" href="https://sourceforge.net/p/graphicsmagick/mailman/graphicsmagick-announce/">https://sourceforge.net/p/graphicsmagick/mailman/graphicsmagick-announce/</a> -which you <em>should</em> subscribe to). In this case you may do:</p> +which you <em>should</em> subscribe to). In this case you may do this for a +SHA-256 checksum:</p> +<pre class="literal-block"> +sha256sum GraphicsMagick-1.3.37.tar.xz +</pre> +<p>and this for a SHA-1 checksum:</p> <pre class="literal-block"> sha1sum GraphicsMagick-1.3.37.tar.xz </pre> -<p>and then compare the generated checksum with the checksum provided in -the release announcement. While this is much more secure than doing -nothing, it does not fully defend against forgery. If someone is able -to forge a modified release archive as well as a release announcment, -then you could be duped!</p> +<p>and then compare the generated checksum (hex format) with the checksum +provided in the release announcement. While this is much more secure +than doing nothing, it does not fully defend against forgery. If +someone is able to forge a modified release archive as well as a +release announcment, then you could be duped!</p> </div> </div> </div> diff -r 94f4bcf448ad -r 8ce98e7f842b www/download.rst --- a/www/download.rst Sat Mar 26 08:32:13 2022 -0500 +++ b/www/download.rst Sat Mar 26 10:54:38 2022 -0500 @@ -21,13 +21,14 @@ Until recently (December, 2021) GraphicsMagick provided its own ftp site for downloads but this has been disabled due to abusive download -practices and because support for FTP has been removed from popular -browsers. This is unfortunate since the same site also provided -PNG-related files and a libtiff mirror. The ftp site directory tree -continues to exist and will be maintained. If you are an -administrator of a high-bandwidth ftp or https mirror site and would -like to provide a GraphicsMagick mirror, please contact `Bob -Friesenhahn`_ and we will work something out. +practices (by using it as the primary download site) and because +support for FTP has been removed from popular browsers. This is +unfortunate since the same site also provided PNG-related files and a +libtiff mirror. The ftp site directory tree continues to exist and +will be maintained. If you are an administrator of a high-bandwidth +ftp or https mirror site and would like to provide a GraphicsMagick +mirror, please contact `Bob Friesenhahn`_ and we will work something +out. Verifying The Download ====================== @@ -80,20 +81,25 @@ gpg: aka "Bob Friesenhahn <[email protected]>" [ultimate] gpg: aka "[jpeg image of size 4917]" [ultimate] -Using a SHA-1 checksum ----------------------- +Using a SHA-256 or SHA-1 checksum +--------------------------------- While verifying distribution files using GnuPG is by far the most -secure way to validate a release file, you may find SHA-1 checksums in -a distribution release announcement (e.g. from the +secure way to validate a release file, you may find SHA-256 or SHA-1 +checksums in a distribution release announcement (e.g. from the graphicsmagick-announce list at https://sourceforge.net/p/graphicsmagick/mailman/graphicsmagick-announce/ -which you *should* subscribe to). In this case you may do:: +which you *should* subscribe to). In this case you may do this for a +SHA-256 checksum:: + + sha256sum GraphicsMagick-1.3.37.tar.xz + +and this for a SHA-1 checksum:: sha1sum GraphicsMagick-1.3.37.tar.xz -and then compare the generated checksum with the checksum provided in -the release announcement. While this is much more secure than doing -nothing, it does not fully defend against forgery. If someone is able -to forge a modified release archive as well as a release announcment, -then you could be duped! +and then compare the generated checksum (hex format) with the checksum +provided in the release announcement. While this is much more secure +than doing nothing, it does not fully defend against forgery. If +someone is able to forge a modified release archive as well as a +release announcment, then you could be duped!