14:04 Matthias Andree (mandree) 

graphics/openexr: update to bugfix release v3.2.4

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/main/CHANGES.md#version-324-march-26-2024
ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/main/CHANGES.md#version-323-march-6-2024

Switch from auto-generated tarballs to those that use sigstore,
verify that -- see
https://github.com/AcademySoftwareFoundation/openexr/blob/main/SECURITY.md#signed-releases
and shuffle variables accordingly, including DISTFILES, EXTRACT_ONLY and
NO_WRKSUBDIR updates.

    5dde67a

15:53 Matthias Andree (mandree) 

graphics/openexr: security update to v3.2.2

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.2.2/CHANGES.md#version-322-february-11-2024

Security:	CVE-2023-5841
Security:	f161a5ad-c9bd-11ee-b7a7-353f1e043d9a
MFH:		2024Q1

    7b057a3

14:14 Matthias Andree (mandree) 

graphics/openexr: update to v3.2.1

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.2.1/CHANGES.md#version-321-september-27-2023

with one additional patch to change deflate_LIBRARIES to
deflate_LINK_LIBRARIES in the cmake stuff in order to unbreak
the build.

Reported upstream:
https://github.com/AcademySoftwareFoundation/openexr/issues/1571

Upstream intended to release v3.2.2 on short notice, but the efforts
appear to have stalled, so ship 3.2.1 with our local fix.

    9a529da

11:44 Matthias Andree (mandree) 

graphics/openexr: update to 3.2.0

- Also install manual pages (generated through help2man)
- The website (formerly known "DOCS" build) requires the "convert(1)"
  tool, which is part of ImageMagick, which itself depends on OpenEXR.
  To break the loop, split out the offline website build to a new
  package, graphics/openexr-website-docs

    49fa964

16:21 Matthias Andree (mandree) 

graphics/openexr: update to 3.1.11

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.11/CHANGES.md#version-3111-august-13-2023
MFH:       2023Q3

    7936ba1

17:46 Matthias Andree (mandree) 

graphics/openexr: bugfix update to 3.1.10

Changelog:
	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.10/CHANGES.md#version-3110-august-2-2023

MFH:		2023Q3

    fccca1f

21:16 Matthias Andree (mandree) 

graphics/openexr: bugfix update → 3.1.9

https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.9/CHANGES.md#version-319-june-25-2023

Security:       06428d91-152e-11ee-8b14-dbdd62da85fb

    d8e18f3

15:11 Matthias Andree (mandree) 

graphics/openexr: bugfix update to 3.1.8

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.8

    e9a55ec

22:26 Matthias Andree (mandree) 

graphics/openexr: upgrade to 3.1.7

This is mostly to incorporate build fixes for ARMv7 regressions,
which our 3.1.6_1 port had already brought, and bumps the library's minor
version, so let's take it although it should be functionally the same.

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.7/CHANGES.md#version-317-march-28-2023

    8601441

14:03 Matthias Andree (mandree) 

graphics/openexr: bugfix update to 3.1.6

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.6/CHANGES.md#version-316-march-9-2023

    5f57f50

19:24 Matthias Andree (mandree) 

graphics/openexr: bugfix update to 3.1.5

 *  Add backwards-compatibilty flags to the core library to match
    original behavior of the the c++ library. Fixes reading of certain
    files by the new core.
  * Documentation refers to primary branch as "main"
  * Update the CI workflow matrix to VFX-CY2022

Specific OSS-fuzz issues addressed:

 *  OSS-fuzz 46309 Heap-buffer-overflow in Imf_3_1::memstream_read
 *  OSS-fuzz 46083 Out-of-memory in openexr_exrcheck_fuzzer
 *  OSS-fuzz 45899 Integer-overflow in internal_exr_compute_chunk_offset_size
 *  OSS-fuzz 44084 Out-of-memory in openexr_exrcheck_fuzzer

MFH:		2022Q2

    21b4db1

01:52 Matthias Andree (mandree) 

graphics/openexr: security update to 3.1.4

* Several bug fixes to properly reject invalid input upon read
* Miscellaneous documentation improvements

This addresses one public security vulnerability:

* CVE-2021-45942 Heap-buffer-overflow in Imf_3_1::LineCompositeTask::execute

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.4/CHANGES.md#version-314-january-26-2022

Security:	CVE-2021-45942
MFH:		2022Q1

    c67fbf1

12:04 Matthias Andree (mandree) 

graphics/openexr: bug fix update to 3.1.3

Note that the default zip compression level is changed from 6 to 4
by the upstream, to improve compression times by 2x "with only a tiny
drop in compression ratio."

Release notes:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.3

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.3/CHANGES.md#version-313-october-27-2021

    130a5d7

19:51 Matthias Andree (mandree) 

graphics/openexr: bug fix update to 3.1.2

Documentation now also available through
https://openexr.readthedocs.io/

Release Notes:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.2

Detailed ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.2/CHANGES.md#version-312-october-4-2021

Now requires py-breathe, Sphinx, and Doxygen, to build documentation.

    d038b32

18:19 Matthias Andree (mandree) 

graphics/openexr: update to v3.1.1

- adds a new libOpenEXRCore library
- bumps so library version to 30
- requires PORTREVISION bump of its users

Release Notes:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.1/CHANGES.md

    31f2cf9

05:01 Matthias Andree (mandree) 

graphics/openexr: security update to v3.0.5

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.0.5

Security:	f2596f27-db4c-11eb-8bc6-c556d71493c9

    f764ab5

10:30 Matthias Andree (mandree) 

graphics/openexr: Update to 3.0.4

Patch release that corrects a problem with the release version numbers
in v3.0.2/v3.0.3, and with the referenced Imath release.

    6d1e3ee

07:45 Matthias Andree (mandree) 

graphics/openexr: math/Imath: update to v3.0.3

Only upstream change is an install-fix that had previously been
cherry-picked by the FreeBSD port already.

Besides the version no., no impact on Imath or OpenEXR code, so
no PORTREVISION bumps of our users this time.

    0aafc89

17:15 Matthias Andree (mandree) 

graphics/openexr: update to v3.0.2

* removes two patches cherry-picked from upstream
* adds install fix cherry-picked from upstream

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.0.2

    9a948c5

00:33 Matthias Andree (mandree) 

graphics/openexr: update to 3.0.1

This requires and uses the new Imath 3.0.1 port.

    398a42d

11:08 mandree 

graphics/openexr, ilmbase: security update to v2.5.5

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5

"Specific OSS-fuzz issues include:

    OSS-fuzz #30291 Timeout in openexr_exrcheck_fuzzer
    OSS-fuzz #29106 Heap-buffer-overflow in Imf_2_5::FastHufDecoder::decode
    OSS-fuzz #28971 Undefined-shift in Imf_2_5::cachePadding
    OSS-fuzz #29829 Integer-overflow in
Imf_2_5::DwaCompressor::initializeBuffers
    OSS-fuzz #30121 Out-of-memory in openexr_exrcheck_fuzzer"

Bump PORTREVISION of ports that directly depend on openexr and/or ilmbase.

MFH:		2021Q1
Security:	98044aba-6d72-11eb-aed7-1b1b8a70cc8b

 

16:57 mandree 

graphics/openexr: really commit v2.5.4 update.

Unfortunately, this was missed with the ilmbase update, and
causes yet another PORTREVISION bump on all dependent ports.

repeating ilmbase's commit log here:

"Patch release with various bug/sanitizer/security fixes, primarily related to
reading corrupted input files."
<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.4>

Cherry-pick upstream commit for GCC 11 compatibility:
<https://github.com/AcademySoftwareFoundation/openexr/commit/a40a6151c4e746eb8f93c7c06992d0ec11289fdc>

Since this changes the patchlevel of the solibs, bump PORTREVISION of dependent
ports just to be sure.
(graphics/py-openshadinglanguage is unaltered and .includes the revision bump
from .../openshadinglanguage.)

MFH:		2021Q1 (this requires discussion by ports-secteam@!)

Reported by:	VVD (IRC, #bsdports)

 

22:04 mandree 

graphics/ilmbase, graphics/openexr: security update to v2.5.3

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.3

"Patch release with various bug/security fixes and build/install fixes, plus a
performance optimization:

 * Various sanitizer/fuzz-identified issues related to handling of invalid input
 * Fixes to misc compiler warnings [...]
 * Read performance optimization (#782)
 * Fix for building on non-glibc (#798)
 * Fixes to tests"

The full name of shared libraries changed from *.25.0.1 to *.25.0.2
=> PORTREVISION bumps for all ports that use either ilmbase or openexr
coming up in separate commit to ease MFH.

All test builds of direct users succeeded on 12.1 amd64.

MFH:		2020Q3 (patchlevel update w/ security fixes)
Security:	b1d6b383-dd51-11ea-a688-7b12871ef3ad

 

12:09 mandree 

graphics/ilmbase: graphics/openexr: security update to 2.5.2

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2
Verbosely:
https://github.com/AcademySoftwareFoundation/openexr/blob/v2.5.2/CHANGES.md#version-252-june-15-2020

Security:  714e6c35-c75b-11ea-aa29-d74973d1f9f3
MFH:       2020Q3

 

15:47 mandree 

graphics/ilmbase: graphics/openexr: update to upstream release 2.5.1

Upstream release notes:
* A patch release that corrects the SO version for the v2.5 release,
  which missed getting bumped in v2.5.0.

* This release also fixes an improper failure in IlmImfTest
  when running on ARMv7 and AAarch64.

Bump PORTREVISION of all port directly requiring ilmbase or openexr
that are not marked BROKEN (shlib/.so file version bump).

Test build of all port directly depending on ilmbase or openexr
succeeded in poudriere in a 12.1-RELEASE amd64 jail.

 

11:57 mandree 

graphics/ilmbase: graphics/openexr: update to v2.5.0

ChangeLog:
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.0

* Bump PORTREVISION of all consumers except py-openimageio (BROKEN).

* cad/PrusaSlicer:
    LIB_DEPENDS: remove version from libHalf.so
    BUILD_DEPENDS+=qt5-buildtools as package (needed on bare metal builds)
    USE_GL+=gl
    USES+=pkgconfig (needed to find libHalf)

 

17:41 mandree 

ilmbase, openexr: Update to upstream release v2.4.1 (bugfixes)

Changelog
<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1>:

Patch release with minor bug fixes.

Quoting Cary Phillips:
    Various fixes for memory leaks and invalid memory accesses
    Various fixes for integer overflow with large images.
    Various cmake fixes for build/install of python modules.
    ImfMisc.h is no longer installed, since it's a private header.

MFH:		2020Q1 (patchlevel/bugfixes but beware one private .h file removed)

 

02:17 mandree 

graphics/ilmbase, graphics/openexr: upgrade to upstream v2.4.0

graphics/gstreamer1-plugins-openexr: switch from C++98 to C++11 to
match new OpenEXR headers and unbreak compilation.

Bump PORTREVISION of all ports depending directly on either, based
on assessing INDEX-12 (bump_portrevision.pl -l (shallow) used).

Release Notes:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0

The update was deliberately deferred until after 2020Q1, and should
not be MFH'd back to it.

 

10:15 mandree 

Update ilmbase and openexr to 2.3.0, rename OpenEXR to openexr.

Release notes: <https://github.com/openexr/openexr/releases/tag/v2.3.0>

Adjust LIB_DEPENDS of all ports that require ilmbase or openexr to chase
the new lower-case spelling of the name, and to omit the version from the
library name to ease future maintenance.

Bump PORTREVISION of all ports that depend on ilmbase or openexr directly,
so that they all get rebuilt on upgrades.

Add patches to graphics/ampasCTL to keep it alive, with (a) ilmbase now
that its Iex::BaseExc class is no longer derived from std::string,
details were given upstream through https://github.com/ampas/CTL/issues/71
and (b) to unwind semicolon/;-lists in cmake that stem from openexr/
ilmbase pkg-config variables.
(Note ampasCTL is unmaintained as FreeBSD port, and upstream,
and I cannot run-time test it.)

Poudriere build tests on 11.2-RELEASE-p1 amd64 of ALL ports depending
directly or indirectly on ilmbase and/or openexr have passed without
regressions.  Thus invoking due diligence, I believe I have done the
equivalent of an -exp run, and do not require approval for the dependency
chases to third-party ports.