Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xmlgraphics-fop for openSUSE:Factory checked in at 2024-10-13 17:33:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xmlgraphics-fop (Old) and /work/SRC/openSUSE:Factory/.xmlgraphics-fop.new.19354 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xmlgraphics-fop" Sun Oct 13 17:33:19 2024 rev:52 rq:1207477 version:2.10 Changes: -------- --- /work/SRC/openSUSE:Factory/xmlgraphics-fop/xmlgraphics-fop.changes 2024-10-04 17:08:39.772121542 +0200 +++ /work/SRC/openSUSE:Factory/.xmlgraphics-fop.new.19354/xmlgraphics-fop.changes 2024-10-13 17:33:23.925548796 +0200 @@ -1,0 +2,89 @@ +Sat Oct 12 16:27:41 UTC 2024 - Fridrich Strba <fst...@suse.com> + +- version 2.10 + * fixes XXE vulnerability bsc#1231428, CVE-2024-28168 + * Changes of 2.10 + + FOP-2764: footnote-body ignores rl-tb writing mode + + FOP-3135: SVG tspan content is displayed out of place + + FOP-3144: Add new schema to handle pdf/a and pdfa/ua + + FOP-3146: Correct fop version at runtime + + FOP-3148: NoSuchElementException when using font with no + family name + + FOP-3150: Resolve classpath for binary distribution + + FOP-3158: Switch to spotbugs + + FOP-3159: Set an automatic module name + + FOP-3160: Rename packages to avoid conflicts with modules + + FOP-3161: Resize table only for multicolumn page + + FOP-3162: Missing jars in servlet + + FOP-3163: Optimise performance of PNG with alpha using raw + loader + + FOP-3164: basic-link not navigating to corresponding footnote + + FOP-3166: Add option to sign PDF + + FOP-3168: Add secure processing for XSL input + + FOP-3174: Allow sections which need security permissions to + be run when AllPermission denied in caller code + + FOP-3176: Remove unused PDFStructElem + + FOP-3177: Remove space generated by fo:wrapper + + FOP-3178: Reset content length for table changing ipd + + FOP-3182: Add alt text to PDF signature + + FOP-3184: Allow change of resource level for SVG in AFP + + FOP-3185: Exclude shape not in clipping path for AFP + + FOP-3186: Only support 1 column for redo of layout without + page pos only + + FOP-3188: Switch to Jakarta servlet API + + FOP-3190: NPE when list item is split alongside an ipd change + + FOP-3191: Add mandatory MODCA triplet to AFP + + FOP-3192: Redo layout for multipage columns + + FOP-3194: Add image mask option for AFP + + FOP-3195: Skip written block ipds inside float + + FOP-3198: Allow curly braces for src url + + FOP-3204: Missing content for last page with change ipd + + FOP-3207: Add warning when different pdf languages are used + + FOP-3208: Only restart line manager when there is a linebreak + for blocklayout + * Changes of 2.9 + + FOP-1722: Values in PDF Number Trees must be indirect + references + + FOP-2903: Do not delete files on syntax errors using command + line + + FOP-2920: Surrogate pair edge-case causes Exception + + FOP-2985: Reset character spacing + + FOP-3042: SVG text containing certain glyphs isn't rendered + + FOP-3088: Remove duplicate classes from maven classpath + + FOP-3090: Allow use of page position only on redo of layout + + FOP-3098: Failure to render multi-block itemBody alongside + float + + FOP-3107: Update to PDFBox 2.0.27 + + FOP-3110: NPE if link destination is missing with + accessibility + + FOP-3111: Make property cache thread safe + + FOP-3114: Font size was rounded to 0 for AFP TTF + + FOP-3115: Cannot process a SVG using mvn jars + + FOP-3116: Remove serializer jar + + FOP-3117: Allow creating a PDF 2.0 document + + FOP-3118: Text missing after page break inside table inline + + FOP-3120: IllegalArgumentException for list in a table + + FOP-3121: Table width may be too wide when layout width + changes + + FOP-3125: NPE when using broken link and PDF 1.5 + + FOP-3127: Allow XMP at PDF page level + + FOP-3129: Symbol font was not being mapped to unicode + + FOP-3130: Correct font differences table for Chrome + + FOP-3132: Link against Java 8 API + + FOP-3139: Add support for + font-selection-strategy=character-by-character + + FOP-3140: Merge form fields in external PDFs + + XGC-133: Fix test for Java 11 +- Modified patches: + * java8-compatibility.patch + + approach problem differently and use release in ant javac task + * xmlgraphics-fop-cli.patch + * fop-2.5-QDox-2.0.patch -> fop-2.10-QDox-2.0.patch + + rediff +- Added patches: + * encoding.patch + + specify encoding utf-8 to fix build with some versions of JDK +- Adapt the scripts to the fact that javapackages-tools do not + require the JAVA_HOME to be set any more + +------------------------------------------------------------------- Old: ---- fop-2.5-QDox-2.0.patch fop-2.8-src.tar.gz New: ---- encoding.patch fop-2.10-QDox-2.0.patch fop-2.10-src.tar.gz BETA DEBUG BEGIN: Old: * xmlgraphics-fop-cli.patch * fop-2.5-QDox-2.0.patch -> fop-2.10-QDox-2.0.patch + rediff BETA DEBUG END: BETA DEBUG BEGIN: New:- Added patches: * encoding.patch + specify encoding utf-8 to fix build with some versions of JDK New: * xmlgraphics-fop-cli.patch * fop-2.5-QDox-2.0.patch -> fop-2.10-QDox-2.0.patch + rediff BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xmlgraphics-fop.spec ++++++ --- /var/tmp/diff_new_pack.S5rJ3x/_old 2024-10-13 17:33:24.989592903 +0200 +++ /var/tmp/diff_new_pack.S5rJ3x/_new 2024-10-13 17:33:24.993593069 +0200 @@ -19,7 +19,7 @@ %define bname fop Name: xmlgraphics-fop -Version: 2.8 +Version: 2.10 Release: 0 Summary: Formatter for Printing XSLT Processed XML Files License: Apache-2.0 @@ -38,25 +38,29 @@ Patch1: xmlgraphics-fop-cli.patch Patch2: hyphenation-more-stack.patch Patch3: fix-javadoc-java8.patch -Patch4: java8-compatibility.patch +Patch4: encoding.patch # PATCH-FEATURE-OPENSUSE reproducible-build-manifest.patch -- boo#1110024 Patch5: reproducible-build-manifest.patch -Patch6: fop-2.5-QDox-2.0.patch +Patch6: fop-2.10-QDox-2.0.patch Patch7: reproducible.patch +Patch8: java8-compatibility.patch BuildRequires: ant >= 1.9.15 BuildRequires: apache-pdfbox >= 2.0.23 +BuildRequires: bouncycastle +BuildRequires: bouncycastle-pkix +BuildRequires: bouncycastle-util BuildRequires: commons-io >= 2.4 BuildRequires: commons-logging BuildRequires: docbook-xsl-stylesheets -BuildRequires: glassfish-servlet-api +BuildRequires: jakarta-servlet BuildRequires: java-devel >= 1.8 -BuildRequires: javapackages-local +BuildRequires: javapackages-local >= 6 BuildRequires: libxslt BuildRequires: qdox >= 2.0 BuildRequires: unzip BuildRequires: xml-commons-apis -BuildRequires: xmlgraphics-batik >= 1.14 -BuildRequires: xmlgraphics-commons >= 2.6 +BuildRequires: xmlgraphics-batik >= 1.18 +BuildRequires: xmlgraphics-commons >= 2.10 #!BuildIgnore: saxon Requires: java >= 1.8 Requires: xml-commons-apis @@ -83,6 +87,9 @@ %patch -P 5 -p1 %patch -P 6 -p1 %patch -P 7 -p1 +%if %{?pkg_vcmp:%pkg_vcmp java-devel >= 9}%{!?pkg_vcmp:0} +%patch -P 8 -p1 +%endif # Replace keyword "VERSION" in XML files with the real one: for x in %{SOURCE10} %{SOURCE11} %{SOURCE12}; do @@ -113,19 +120,22 @@ %build build-jar-repository -s fop/lib \ + bcpkix \ + bcprov \ + bcutil \ commons-io \ commons-logging \ fontbox \ - glassfish-servlet-api \ + jakarta-servlet/jakarta.servlet-api \ batik-all \ xml-commons-apis \ xml-commons-apis-ext \ xmlgraphics-commons \ qdox -export CLASSPATH= LANG=en_US.UTF-8 -%{ant} -f fop/build.xml \ - -Djavac.source=1.8 -Djavac.target=1.8 \ +ant \ + -f fop/build.xml \ + -Ddev=true \ package # Build the manpage(s) and HTML ++++++ encoding.patch ++++++ diff -urEwbB fop-2.10/fop/build.xml fop-2.10/fop/build.xml --- fop-2.10/fop/build.xml 2024-10-11 13:58:44.468271086 +0200 +++ fop-2.10/fop/build.xml 2024-10-11 14:04:37.160704185 +0200 @@ -185,7 +186,7 @@ <javac fork="${javac.fork}" debug="${javac.debug}" deprecation="${javac.deprecation}" - optimize="${javac.optimize}" + optimize="${javac.optimize}" encoding="utf-8" source="${javac.source}" target="${javac.target}"/> </presetdef> ++++++ fop-2.5-QDox-2.0.patch -> fop-2.10-QDox-2.0.patch ++++++ --- /work/SRC/openSUSE:Factory/xmlgraphics-fop/fop-2.5-QDox-2.0.patch 2020-06-08 23:43:57.637351255 +0200 +++ /work/SRC/openSUSE:Factory/.xmlgraphics-fop.new.19354/fop-2.10-QDox-2.0.patch 2024-10-13 17:33:23.497531054 +0200 @@ -1,5 +1,6 @@ ---- fop-2.5/fop-events/src/main/java/org/apache/fop/tools/EventProducerCollector.java 2020-05-05 11:42:05.000000000 +0200 -+++ fop-2.5/fop-events/src/main/java/org/apache/fop/tools/EventProducerCollector.java 2020-06-03 10:49:58.195555295 +0200 +diff -urEbwB fop-2.10/fop-events/src/main/java/org/apache/fop/eventtools/EventProducerCollector.java fop-2.10/fop-events/src/main/java/org/apache/fop/eventtools/EventProducerCollector.java +--- fop-2.10/fop-events/src/main/java/org/apache/fop/eventtools/EventProducerCollector.java 2024-10-11 13:58:44.578271844 +0200 ++++ fop-2.10/fop-events/src/main/java/org/apache/fop/eventtools/EventProducerCollector.java 2024-10-11 14:09:42.446141414 +0200 @@ -21,6 +21,7 @@ import java.io.File; ++++++ fop-2.8-src.tar.gz -> fop-2.10-src.tar.gz ++++++ /work/SRC/openSUSE:Factory/xmlgraphics-fop/fop-2.8-src.tar.gz /work/SRC/openSUSE:Factory/.xmlgraphics-fop.new.19354/fop-2.10-src.tar.gz differ: char 25, line 1 ++++++ java8-compatibility.patch ++++++ --- /var/tmp/diff_new_pack.S5rJ3x/_old 2024-10-13 17:33:25.077596551 +0200 +++ /var/tmp/diff_new_pack.S5rJ3x/_new 2024-10-13 17:33:25.085596883 +0200 @@ -1,228 +1,25 @@ ---- fop-2.5/fop-core/src/main/java/org/apache/fop/afp/fonts/CharactersetEncoder.java 2020-05-05 11:42:04.000000000 +0200 -+++ fop-2.5/fop-core/src/main/java/org/apache/fop/afp/fonts/CharactersetEncoder.java 2020-06-03 11:18:04.577537190 +0200 -@@ -21,6 +21,7 @@ - - import java.io.IOException; - import java.io.OutputStream; -+import java.nio.Buffer; - import java.nio.ByteBuffer; - import java.nio.CharBuffer; - import java.nio.charset.CharacterCodingException; -@@ -68,7 +69,7 @@ - if (bb.hasArray()) { - return getEncodedChars(bb.array(), bb.limit()); - } else { -- bb.rewind(); -+ ((Buffer)bb).rewind(); - byte[] bytes = new byte[bb.remaining()]; - bb.get(bytes); - return getEncodedChars(bytes, bytes.length); ---- fop-2.5/fop-core/src/main/java/org/apache/fop/area/AreaTreeParser.java 2020-05-05 11:42:04.000000000 +0200 -+++ fop-2.5/fop-core/src/main/java/org/apache/fop/area/AreaTreeParser.java 2020-06-03 11:18:04.581537214 +0200 -@@ -24,6 +24,7 @@ - import java.awt.geom.Rectangle2D; - import java.io.FileNotFoundException; - import java.io.IOException; -+import java.nio.Buffer; - import java.nio.CharBuffer; - import java.util.List; - import java.util.Map; -@@ -326,7 +327,7 @@ - throws SAXException { - lastAttributes = new AttributesImpl(attributes); - Maker maker = makers.get(localName); -- content.clear(); -+ ((Buffer)content).clear(); - ignoreCharacters = true; - if (maker != null) { - ignoreCharacters = maker.ignoreCharacters(); -@@ -357,7 +358,7 @@ - Maker maker = makers.get(localName); - if (maker != null) { - maker.endElement(); -- content.clear(); -+ ((Buffer)content).clear(); - } - ignoreCharacters = true; - } else { -@@ -845,7 +846,7 @@ - boolean reversed = XMLUtil.getAttributeAsBoolean(lastAttributes, "reversed", false); - int[][] gposAdjustments - = XMLUtil.getAttributeAsPositionAdjustments(lastAttributes, "position-adjust"); -- content.flip(); -+ ((Buffer)content).flip(); - WordArea word = new WordArea( - offset, level, content.toString().trim(), letterAdjust, - null, gposAdjustments, reversed); -@@ -865,7 +866,7 @@ - int offset = XMLUtil.getAttributeAsInt(lastAttributes, "offset", 0); - //TODO the isAdjustable parameter is currently not used/implemented - if (content.position() > 0) { -- content.flip(); -+ ((Buffer)content).flip(); - boolean adjustable = XMLUtil.getAttributeAsBoolean(lastAttributes, "adj", true); - int level = XMLUtil.getAttributeAsInt(lastAttributes, "level", -1); - SpaceArea space = new SpaceArea(offset, level, content.charAt(0), adjustable); -@@ -1254,17 +1255,17 @@ - // allocate a larger buffer and transfer content - CharBuffer newContent - = CharBuffer.allocate(this.content.position() + length); -- this.content.flip(); -+ ((Buffer)(this.content)).flip(); - newContent.put(this.content); - this.content = newContent; - } - // make sure the full capacity is used -- this.content.limit(this.content.capacity()); -+ ((Buffer)(this.content)).limit(this.content.capacity()); - // add characters to the buffer - this.content.put(ch, start, length); - // decrease the limit, if necessary - if (this.content.position() < this.content.limit()) { -- this.content.limit(this.content.position()); -+ ((Buffer)(this.content)).limit(this.content.position()); - } - } - } ---- fop-2.5/fop-core/src/main/java/org/apache/fop/fo/FOText.java 2020-05-05 11:42:04.000000000 +0200 -+++ fop-2.5/fop-core/src/main/java/org/apache/fop/fo/FOText.java 2020-06-03 11:18:04.581537214 +0200 -@@ -20,6 +20,7 @@ - package org.apache.fop.fo; - - import java.awt.Color; -+import java.nio.Buffer; - import java.nio.CharBuffer; - import java.text.CharacterIterator; - import java.text.StringCharacterIterator; -@@ -134,17 +135,17 @@ - newCapacity = requires; - } - CharBuffer newBuffer = CharBuffer.allocate(newCapacity); -- charBuffer.rewind(); -+ ((Buffer)charBuffer).rewind(); - newBuffer.put(charBuffer); - charBuffer = newBuffer; - } - } - // extend limit to capacity -- charBuffer.limit(charBuffer.capacity()); -+ ((Buffer)charBuffer).limit(charBuffer.capacity()); - // append characters - charBuffer.put(data, start, length); - // shrink limit to position -- charBuffer.limit(charBuffer.position()); -+ ((Buffer)charBuffer).limit(((Buffer)charBuffer).position()); - } - - /** -@@ -156,7 +157,7 @@ - if (this.charBuffer == null) { - return null; - } -- this.charBuffer.rewind(); -+ ((Buffer)(this.charBuffer)).rewind(); - return this.charBuffer.asReadOnlyBuffer().subSequence(0, this.charBuffer.limit()); - } - -@@ -169,9 +170,9 @@ - // pointed to is really a different one - if (charBuffer != null) { - ft.charBuffer = CharBuffer.allocate(charBuffer.limit()); -- charBuffer.rewind(); -+ ((Buffer)charBuffer).rewind(); - ft.charBuffer.put(charBuffer); -- ft.charBuffer.rewind(); -+ ((Buffer)(ft.charBuffer)).rewind(); - } - } - ft.prevFOTextThisBlock = null; -@@ -203,7 +204,7 @@ - /** {@inheritDoc} */ - public void endOfNode() throws FOPException { - if (charBuffer != null) { -- charBuffer.rewind(); -+ ((Buffer)charBuffer).rewind(); - } - super.endOfNode(); - getFOEventHandler().characters(this); -@@ -230,7 +231,7 @@ - } - - char ch; -- charBuffer.rewind(); -+ ((Buffer)charBuffer).rewind(); - while (charBuffer.hasRemaining()) { - ch = charBuffer.get(); - if (!((ch == CharUtilities.SPACE) -@@ -238,7 +239,7 @@ - || (ch == CharUtilities.CARRIAGE_RETURN) - || (ch == CharUtilities.TAB))) { - // not whitespace -- charBuffer.rewind(); -+ ((Buffer)charBuffer).rewind(); - return true; - } - } -@@ -281,7 +282,7 @@ - return; - } - -- charBuffer.rewind(); -+ ((Buffer)charBuffer).rewind(); - CharBuffer tmp = charBuffer.slice(); - char c; - int lim = charBuffer.limit(); -@@ -548,19 +549,19 @@ - public void remove() { - - if (this.canRemove) { -- charBuffer.position(currentPosition); -+ ((Buffer)charBuffer).position(currentPosition); - // Slice the buffer at the current position - CharBuffer tmp = charBuffer.slice(); - // Reset position to before current character -- charBuffer.position(--currentPosition); -+ ((Buffer)charBuffer).position(--currentPosition); - if (tmp.hasRemaining()) { - // Transfer any remaining characters -- charBuffer.mark(); -+ ((Buffer)charBuffer).mark(); - charBuffer.put(tmp); -- charBuffer.reset(); -+ ((Buffer)charBuffer).reset(); - } - // Decrease limit -- charBuffer.limit(charBuffer.limit() - 1); -+ ((Buffer)charBuffer).limit(((Buffer)charBuffer).limit() - 1); - // Make sure following calls fail, unless nextChar() was called - this.canRemove = false; - } else { -@@ -743,7 +744,7 @@ - */ - public void resetBuffer() { - if (charBuffer != null) { -- charBuffer.rewind(); -+ ((Buffer)charBuffer).rewind(); - } - } - ---- fop-2.5/fop-core/src/main/java/org/apache/fop/fonts/MultiByteFont.java 2020-05-05 11:42:05.000000000 +0200 -+++ fop-2.5/fop-core/src/main/java/org/apache/fop/fonts/MultiByteFont.java 2020-06-03 11:19:29.182037444 +0200 -@@ -21,6 +21,7 @@ - - import java.awt.Rectangle; - import java.io.InputStream; -+import java.nio.Buffer; - import java.nio.CharBuffer; - import java.nio.IntBuffer; - import java.util.ArrayList; -@@ -731,7 +732,7 @@ - cb.put(c); - } - -- cb.flip(); -+ ((Buffer)cb).flip(); - return cb; - } - +diff -urEwbB fop-2.10/fop/build.xml fop-2.10/fop/build.xml +--- fop-2.10/fop/build.xml 2024-10-11 13:58:44.468271086 +0200 ++++ fop-2.10/fop/build.xml 2024-10-11 14:04:37.160704185 +0200 +@@ -94,8 +94,9 @@ + <property name="javac.debug" value="on"/> + <property name="javac.optimize" value="off"/> + <property name="javac.deprecation" value="on"/> +- <property name="javac.source" value="1.8"/> +- <property name="javac.target" value="1.8"/> ++ <property name="javac.release" value="8"/> ++ <property name="javac.source" value="1.${javac.release}"/> ++ <property name="javac.target" value="${javac.source}"/> + <property name="javac.fork" value="no"/> + <property name="junit.fork" value="yes"/> + <property name="junit.haltonfailure" value="off"/> +@@ -186,7 +187,7 @@ + debug="${javac.debug}" + deprecation="${javac.deprecation}" + optimize="${javac.optimize}" encoding="utf-8" +- source="${javac.source}" target="${javac.target}"/> ++ release="${javac.release}" source="${javac.source}" target="${javac.target}"/> + </presetdef> + + <presetdef name="junit"> ++++++ xmlgraphics-fop-cli.patch ++++++ --- /var/tmp/diff_new_pack.S5rJ3x/_old 2024-10-13 17:33:25.105597711 +0200 +++ /var/tmp/diff_new_pack.S5rJ3x/_new 2024-10-13 17:33:25.109597877 +0200 @@ -1,16 +1,16 @@ ---- fop-2.5/fop-core/src/main/java/org/apache/fop/cli/Main.java -+++ fop-2.5/fop-core/src/main/java/org/apache/fop/cli/Main.java -@@ -210,11 +210,7 @@ +diff -urEwbB fop-2.10/fop-core/src/main/java/org/apache/fop/cli/Main.java fop-2.10/fop-core/src/main/java/org/apache/fop/cli/Main.java +--- fop-2.10/fop-core/src/main/java/org/apache/fop/cli/Main.java 2024-10-11 13:58:44.478271155 +0200 ++++ fop-2.10/fop-core/src/main/java/org/apache/fop/cli/Main.java 2024-10-11 13:59:33.158606975 +0200 +@@ -207,11 +207,7 @@ * @param args the command line parameters */ public static void main(String[] args) { - if (checkDependencies()) { -- startFOP(args); + startFOP(args); - } else { - startFOPWithDynamicClasspath(args); - } -+ startFOP(args); } - } + /** ++++++ xmlgraphics-fop-fontlist.script ++++++ --- /var/tmp/diff_new_pack.S5rJ3x/_old 2024-10-13 17:33:25.129598707 +0200 +++ /var/tmp/diff_new_pack.S5rJ3x/_new 2024-10-13 17:33:25.133598872 +0200 @@ -1,8 +1,5 @@ #!/bin/bash -# Set default JAVA_HOME -export JAVA_HOME="${JAVA_HOME:-%{?java_home}}" - # Source functions library if [ -f /usr/share/java-utils/java-functions ] ; then . /usr/share/java-utils/java-functions ++++++ xmlgraphics-fop-fontmetrics.script ++++++ --- /var/tmp/diff_new_pack.S5rJ3x/_old 2024-10-13 17:33:25.165600198 +0200 +++ /var/tmp/diff_new_pack.S5rJ3x/_new 2024-10-13 17:33:25.169600364 +0200 @@ -1,8 +1,5 @@ #!/bin/bash -# Set default JAVA_HOME -export JAVA_HOME="${JAVA_HOME:-%{?java_home}}" - # Source functions library if [ -f /usr/share/java-utils/java-functions ] ; then . /usr/share/java-utils/java-functions ++++++ xmlgraphics-fop.script ++++++ --- /var/tmp/diff_new_pack.S5rJ3x/_old 2024-10-13 17:33:25.197601525 +0200 +++ /var/tmp/diff_new_pack.S5rJ3x/_new 2024-10-13 17:33:25.201601691 +0200 @@ -4,9 +4,6 @@ # JPackage Project <http://www.jpackage.org/> # $Id$ -# Set default JAVA_HOME -export JAVA_HOME="${JAVA_HOME:-%{?java_home}}" - # Source functions library if [ -f /usr/share/java-utils/java-functions ] ; then . /usr/share/java-utils/java-functions