head 1.13; access; symbols pkgsrc-2023Q3:1.12.0.8 pkgsrc-2023Q3-base:1.12 pkgsrc-2023Q2:1.12.0.6 pkgsrc-2023Q2-base:1.12 pkgsrc-2023Q1:1.12.0.4 pkgsrc-2023Q1-base:1.12 pkgsrc-2022Q4:1.12.0.2 pkgsrc-2022Q4-base:1.12 pkgsrc-2022Q3:1.11.0.4 pkgsrc-2022Q3-base:1.11 pkgsrc-2022Q2:1.11.0.2 pkgsrc-2022Q2-base:1.11 pkgsrc-2022Q1:1.10.0.8 pkgsrc-2022Q1-base:1.10 pkgsrc-2021Q4:1.10.0.6 pkgsrc-2021Q4-base:1.10 pkgsrc-2021Q3:1.10.0.4 pkgsrc-2021Q3-base:1.10 pkgsrc-2021Q2:1.10.0.2 pkgsrc-2021Q2-base:1.10 pkgsrc-2021Q1:1.8.0.2 pkgsrc-2021Q1-base:1.8 pkgsrc-2020Q4:1.7.0.2 pkgsrc-2020Q4-base:1.7 pkgsrc-2020Q3:1.4.0.4 pkgsrc-2020Q3-base:1.4 pkgsrc-2020Q2:1.4.0.2 pkgsrc-2020Q2-base:1.4 pkgsrc-2020Q1:1.2.0.14 pkgsrc-2020Q1-base:1.2 pkgsrc-2019Q4:1.2.0.16 pkgsrc-2019Q4-base:1.2 pkgsrc-2019Q3:1.2.0.12 pkgsrc-2019Q3-base:1.2 pkgsrc-2019Q2:1.2.0.10 pkgsrc-2019Q2-base:1.2 pkgsrc-2019Q1:1.2.0.8 pkgsrc-2019Q1-base:1.2 pkgsrc-2018Q4:1.2.0.6 pkgsrc-2018Q4-base:1.2 pkgsrc-2018Q3:1.2.0.4 pkgsrc-2018Q3-base:1.2 pkgsrc-2018Q2:1.2.0.2; locks; strict; comment @# @; 1.13 date 2023.11.15.12.23.27; author wiz; state dead; branches; next 1.12; commitid 9iX1sAumtlcJEHME; 1.12 date 2022.10.03.12.55.13; author wiz; state Exp; branches; next 1.11; commitid TLEMMiNqIZNjWgWD; 1.11 date 2022.04.25.09.26.14; author wiz; state Exp; branches; next 1.10; commitid npm2uswLxP6TXyBD; 1.10 date 2021.05.04.14.31.57; author nia; state Exp; branches; next 1.9; commitid gvAN983Xo8Dg6QRC; 1.9 date 2021.04.23.07.23.29; author nia; state Exp; branches; next 1.8; commitid loexbe372jS35oQC; 1.8 date 2021.01.04.10.20.15; author wiz; state Exp; branches; next 1.7; commitid Gorf7lL6JwnQyoCC; 1.7 date 2020.12.06.10.33.39; author wiz; state Exp; branches; next 1.6; commitid BSshKzwN2xa5zFyC; 1.6 date 2020.11.17.16.12.02; author wiz; state Exp; branches; next 1.5; commitid y0ugP9RxiWPm3gwC; 1.5 date 2020.11.09.11.39.46; author wiz; state Exp; branches; next 1.4; commitid YobSvfOTA2cSNcvC; 1.4 date 2020.06.08.10.23.18; author tm; state Exp; branches 1.4.4.1; next 1.3; commitid magatvscKyyskpbC; 1.3 date 2020.06.08.07.56.06; author tm; state dead; branches; next 1.2; commitid TalG8cpUsz4MvobC; 1.2 date 2018.08.23.14.52.22; author leot; state Exp; branches 1.2.2.1; next 1.1; commitid zpbsmUQUiBB9SfPA; 1.1 date 2018.08.22.13.39.24; author leot; state Exp; branches; next ; commitid shrIOwHGpsJXu7PA; 1.4.4.1 date 2020.11.24.18.28.37; author bsiegert; state Exp; branches; next 1.4.4.2; commitid PhMXagFnfsxaAaxC; 1.4.4.2 date 2020.12.11.10.00.20; author bsiegert; state Exp; branches; next ; commitid PG9S8QCXVK14ejzC; 1.2.2.1 date 2018.08.23.14.52.22; author bsiegert; state dead; branches; next 1.2.2.2; commitid QNmlZ1o6fJcolxPA; 1.2.2.2 date 2018.08.25.19.29.35; author bsiegert; state Exp; branches; next ; commitid QNmlZ1o6fJcolxPA; desc @@ 1.13 log @ImageMagick: remove unused patch @ text @$NetBSD: patch-config_policy.xml,v 1.12 2022/10/03 12:55:13 wiz Exp $ Update default policies for better resistance to untrusted input. Discussion: http://mail-index.netbsd.org/tech-pkg/2021/04/03/msg024740.html --- config/policy.xml.orig 2022-09-24 14:42:19.000000000 +0000 +++ config/policy.xml @@@@ -76,6 +76,30 @@@@ + + + + + + + + + + + + + + + + + + + + + @ 1.12 log @ImageMagick, p5-PerlMagick: update to 7.1.0.49 Upstream provides no summaries any longer, just lists of commits, see https://github.com/ImageMagick/Website/blob/main/ChangeLog.md @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.11 2022/04/25 09:26:14 wiz Exp $ @ 1.11 log @ImageMagick: update to 7.1.0.31. - Use the generated ChangeLog.md file instead. - release commits - Changed the minimum version for libheif to 1.4.0. - Get the intensity before changing the of the pixel channels (thanks Snibgo) #5067. - initialize composite variables as they are declared - Use version 3 of checkout. - bump revisition - Create ChangeLog during the release build. - fix rare but possible memory leak - use old-style comment declarations - Try without %GITHUB_WORKSPACE% - autoconf latest update - eliminate Coverity defect - ensure we don't dereference null pointer - The default fetch-depth is 1. - Use date of latest change to m4/version.m4 instead. - laterst automake/autoconf update - latest autoconf update - eliminate Coverity defects - Added option to mark the version as beta. - Call CloseBlob earlier because we read the image from the file instead. - latest autoconf/automake updates - release - set threshold policy by default - Added missing with. - fix compiler warning - Added version checks for heif_check_filetype (#5049). - eliminate compiler warning - Changed triggers for the release build. - unecessary check for null - off-by-one fix - Removed path. - Changed fetch depth. - Temporary list folder content. - Corrected typo. - fix copyright format - proper check for number of channels - Silenced warning when version is lower that 1.4.0. - Removed parentheses. - Also correct stroke opacity. - Added missing cd. @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.10 2021/05/04 14:31:57 nia Exp $ d8 1 a8 1 --- config/policy.xml.orig 2022-04-23 13:47:41.000000000 +0000 d38 2 a39 1 a40 1 @ 1.10 log @ImageMagick: fix deforaos-icon-theme package @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.9 2021/04/23 07:23:29 nia Exp $ d8 1 a8 1 --- config/policy.xml.orig 2021-04-29 02:01:58.000000000 +0000 a38 1 d40 1 @ 1.9 log @ImageMagick: overhaul default policy following discussion allow writing PDF/PostScript, disallow other coders following "imagetragick" recommendations bump PKGREVISION @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.8 2021/01/04 10:20:15 wiz Exp $ d8 1 a8 1 --- config/policy.xml.orig 2021-04-17 15:26:24.000000000 +0000 d10 1 a10 1 @@@@ -76,6 +76,29 @@@@ d30 2 a31 1 + @ 1.8 log @ImageMagick: update to 7.0.10.54. 2020-12-27 7.0.10-54 * Release ImageMagick version 7.0.10-54 GIT revision 18... 2020-12-27 7.0.10-54 Dirk Lemstra * replaced jxl coder with an implementation that uses the jpeg-xl reference library. * added -define trim:edges=(north,east,south,west) that can be used to trim a single or multiple edges. 2020-12-25 7.0.10-54 * enable reading of a certain grayscale TIFF image. * support HEIC depth masks (reference https://github.com/ImageMagick/ImageMagick/discussions/3040). * validate pixel cache offsets (reference https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29039). 2020-12-24 7.0.10-53 * Release ImageMagick version 7.0.10-53 GIT revision 18083:3b141f557:20201224 2020-12-20 7.0.10-53 * CSS colors no longer require commas. * eliminate possible arthimetic overflow (reference https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28849) * support display-p3, Adobe-98, and Pro-photo colorspaces * read/write 1024 colors Sixel images (reference https://github.com/ImageMagick/ImageMagick/discussions/3018). 2020-12-19 7.0.10-52 * Release ImageMagick version 7.0.10-52 GIT revision 18057:1f5bab30b:20201219 2020-12-19 7.0.10-52 * return alpha bytes with stream utility (reference https://github.com/ImageMagick/ImageMagick/discussions/2862). * percentage -border in x no longer adds one pixel border in y (reference https://github.com/ImageMagick/ImageMagick/issues/2978). 2020-12-18 7.0.10-51 * Release ImageMagick version 7.0.10-51 GIT revision 18052:475508769:20201218 2020-12-17 7.0.10-51 * reduce time to identify PDF/PS/XPS/PCL image width/height (reference https://github.com/ImageMagick/ImageMagick/discussions/2993). 2020-12-16 7.0.10-50 * Release ImageMagick version 7.0.10-50 GIT revision 18046:83c162886:20201216 2020-12-15 7.0.10-50 * revert patch to ready gray alpha TIFF image. 2020-12-14 7.0.10-49 * Release ImageMagick version 7.0.10-49 GIT revision 18040:7976abf6e:20201214 2020-12-13 7.0.10-49 * correct previous patch to read planar RGB TIFF images. 2020-12-10 7.0.10-48 * Release ImageMagick version 7.0.10-48 GIT revision 18026:4646e5fd1:20201210 2020-12-09 7.0.10-48 * Repair unit test failures (reference https://github.com/ImageMagick/ImageMagick/issues/2959). 2020-12-09 7.0.10-47 * Release ImageMagick version 7.0.10-47 GIT revision 18020:6f1ee6104:20201209 2020-12-06 7.0.10-47 * support YAML image format. * use generic TIFF read method for LZW-compressed strips (reference https://github.com/ImageMagick/ImageMagick/discussions/2935). @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.7 2020/12/06 10:33:39 wiz Exp $ d3 1 a3 2 Disable ghostscript coders by default to workaround VU#332928: d5 4 a8 1 --- config/policy.xml.orig 2021-01-02 12:53:07.000000000 +0000 d10 1 a10 1 @@@@ -76,6 +76,18 @@@@ d16 1 a16 1 + -- Disable ghostscript coders as suggested by VU#332928 d19 17 a35 6 + + + + + + @ 1.7 log @ImageMagick: update to 7.0.10.46. 2020-12-05 7.0.10-46 * Release ImageMagick version 7.0.10-46 GIT revision 18001:7c75b33a1:20201205 2020-11-30 7.0.10-46 * possible TIFF related-heap buffer overflow (alert & POC by Hardik Shah). * set default system fault in policy.xml configuration file. * support portable float map format 16-bit half. 2020-11-30 7.0.10-45 * Release ImageMagick version 7.0.10-45 GIT revision 17972:6c0cb7f72:20201130 2020-11-30 7.0.10-45 Dirk Lemstra * added support for the farbfeld format (reference https://github.com/ImageMagick/ImageMagick/discussions/2664). 2020-11-29 7.0.10-45 * specify the bilateral neighbor as width/height rather than radius/sigma. @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.6 2020/11/17 16:12:02 wiz Exp $ d6 1 a6 1 --- config/policy.xml.orig 2020-12-05 21:20:02.000000000 +0000 d26 1 a26 1 @ 1.6 log @ImageMagick: update to 7.0.10.38. 2020-11-14 7.0.10-38 * Release ImageMagick version 7.0.10-38 GIT revision 17815:bf51a3f1f:20201114 2020-11-07 7.0.10-38 * add image settings support to -fx. * better support for TIFF YCbCr photometric. * verify TTF glyph format before dereferencing (reference https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26932). * force single HEIC image per container. @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.5 2020/11/09 11:39:46 wiz Exp $ d6 1 a6 1 --- config/policy.xml.orig 2020-11-14 14:52:59.000000000 +0000 d8 1 a8 1 @@@@ -72,6 +72,18 @@@@ d26 1 a26 1 @ 1.5 log @ImageMagick: update to 7.0.10.37. 2020-11-07 7.0.10-37 * Release ImageMagick version 7.0.10-37 GIT revision 17780:47a8392ef:20201107 2020-11-07 7.0.10-37 * correct soversioning. 2020-11-07 7.0.10-36 * Release ImageMagick version 7.0.10-36 GIT revision 17776:6bb35345c:20201107 2020-11-02 7.0.10-36 * check and report if profile is corrupt. * do not add entropy based on mkstemp() unique filename. 2020-10-31 7.0.10-35 * Release ImageMagick version 7.0.10-35 GIT revision 17762:df5df8489:20201031 2020-10-14 7.0.10-35 * Prefer ffmpeg over avconv. * Support median image statistic and median property. * Add -extend option to {display,animate,import}. @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.4 2020/06/08 10:23:18 tm Exp $ d6 1 a6 1 --- config/policy.xml.orig 2020-11-07 19:03:18.000000000 +0000 a8 1 d11 1 @ 1.4 log @ImageMagick: restore policy.xml After some short discussion, we will keep the policy.xml patch for now. @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.2 2018/08/23 14:52:22 leot Exp $ d6 1 a6 1 --- config/policy.xml.orig 2018-08-13 11:05:28.000000000 +0000 d8 2 a9 2 @@@@ -74,4 +74,16 @@@@ d24 2 @ 1.4.4.1 log @Pullup ticket #6368 - requested by wiz graphics/ImageMagick: security fix (via patch) @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.4 2020/06/08 10:23:18 tm Exp $ d6 1 a6 1 --- config/policy.xml.orig 2020-11-07 19:03:18.000000000 +0000 d8 2 a9 2 @@@@ -72,6 +72,18 @@@@ a23 2 @ 1.4.4.2 log @Pullup ticket #6373 - requested by wiz graphics/ImageMagick: security fix Revisions pulled up: - graphics/ImageMagick/Makefile.common 1.221-1.222 - graphics/ImageMagick/PLIST 1.114 - graphics/ImageMagick/distinfo 1.238-1.239 - graphics/ImageMagick/patches/patch-config_policy.xml 1.6 --- Module Name: pkgsrc Committed By: wiz Date: Tue Nov 17 16:12:02 UTC 2020 Modified Files: pkgsrc/graphics/ImageMagick: Makefile.common distinfo pkgsrc/graphics/ImageMagick/patches: patch-config_policy.xml Log Message: ImageMagick: update to 7.0.10.38. 2020-11-14 7.0.10-38 * Release ImageMagick version 7.0.10-38 GIT revision 17815:bf51a3f1f:20201114 2020-11-07 7.0.10-38 * add image settings support to -fx. * better support for TIFF YCbCr photometric. * verify TTF glyph format before dereferencing (reference https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26932). * force single HEIC image per container. --- Module Name: pkgsrc Committed By: wiz Date: Mon Nov 23 15:45:24 UTC 2020 Modified Files: pkgsrc/graphics/ImageMagick: Makefile.common PLIST distinfo Log Message: ImageMagick: update to 7.0.10.41. 2020-11-21 7.0.10-41 * Release ImageMagick version 7.0.10-41 GIT revision 17864:20680f349:20201121 2020-11-21 7.0.10-41 * 2020-11-20 7.0.10-40 * Release ImageMagick version 7.0.10-40 GIT revision 17860:2594cd0a5:20201120 2020-11-19 7.0.10-40 * remove Linux shell artifact from Windows delegate configuration file. * fix shell injection vulnerability via the -authenticate option (reference alex@@cure...). 2020-11-17 7.0.10-39 * Release ImageMagick version 7.0.10-39 GIT revision 17837:ffb8da39c:20201117 2020-11-07 7.0.10-39 * support DPX 4:2:2 sampling. @ text @d1 1 a1 1 $NetBSD$ d6 1 a6 1 --- config/policy.xml.orig 2020-11-14 14:52:59.000000000 +0000 d9 1 a11 1 @ 1.3 log @ImageMagick: remove policy.xml because it's no longer required Remove no longer required security fix in policy.xml because we already provide a fixed version of GhostScript and ImageMagick. @ text @@ 1.2 log @ImageMagick: Also block PS2 and PS3 coders in policy.xml At least when reading PS2 and PS3 files via `convert PS2: ' and `convert PS3: ' gslib/ghostscript will be invoked and hence subject to VU#332928. Pointed out by Bob Friesenhahn via oss-security@@ ML (and follow up from VU#332928 update). @ text @d1 1 a1 1 $NetBSD: patch-config_policy.xml,v 1.1 2018/08/22 13:39:24 leot Exp $ @ 1.2.2.1 log @file patch-config_policy.xml was added on branch pkgsrc-2018Q2 on 2018-08-25 19:29:35 +0000 @ text @d1 24 @ 1.2.2.2 log @Pullup ticket #5820 - requested by leot graphics/ImageMagick: security fix Revisions pulled up: - graphics/ImageMagick/Makefile 1.246-1.247 - graphics/ImageMagick/Makefile.common 1.175 - graphics/ImageMagick/distinfo 1.190-1.192 - graphics/ImageMagick/patches/patch-config_policy.xml 1.1-1.2 --- Module Name: pkgsrc Committed By: wiz Date: Thu Aug 16 08:23:16 UTC 2018 Modified Files: pkgsrc/graphics/ImageMagick: Makefile.common distinfo Log Message: ImageMagick: update to 7.0.8.10. 2018-08-13 7.0.8-10 Cristy * Release ImageMagick version 7.0.8-10, GIT revision 14646:48fba3256:201= 80813 2018-08-12 7.0.8-10 Dirk Lemstra * Added dcraw coder (dcraw:img.cr2) that can be used to force the use of= the dcraw delegate when libraw is the default raw delegate. * Restored thread support for the HEIC coder. 2018-08-08 7.0.8-10 Cristy * ThumbnailImage function no longer reveals sensitive information (refer= ence https://github.com/ImageMagick/ImageMagick/issues/1243). 2018-08-06 7.0.8-9 Cristy * Release ImageMagick version 7.0.8-9, GIT revision 14618:a3663c3dc:2018= 0805. 2018-07-24 7.0.8-9 Cristy * XBM coder leaves the hex image data uninitialized if hex value of the pixel is negative. * More improvements to SVG text handling. * New -range threshold option that combines hard and soft thresholding. 2018-07-23 7.0.8-8 Cristy * Release ImageMagick version 7.0.8-8, GIT revision 14583:300fdbcfd:2018= 0723. 2018-07-20 7.0.8-8 Cristy * Non-HDRI ScaleLongToQuantum() private method no longer adds a half int= erval. * Fixed memset() negative-size-param (reference https://github.com/ImageMagick/ImageMagick/issues/1217). 2018-07-16 7.0.8-7 Cristy * Release ImageMagick version 7.0.8-7, GIT revision 14561:f85c23180:2018= 0716. 2018-07-15 7.0.8-7 Cristy * Fixed numerous use of uninitialized values, integer overflow, memory exceeded, and timeouts (credit to OSS Fuzz). 2018-07-08 7.0.8-6 Cristy * Release ImageMagick version 7.0.8-6, GIT revision 14541:db940ccd2:2018= 0708. 2018-07-06 7.0.8-6 Cristy * Improve SVG support for tspan element. * Add support for -fx image.extent. 2018-07-04 7.0.8-5 Cristy * Release ImageMagick version 7.0.8-5, GIT revision 14514:bba545bbb:2018= 0704. 2018-07-04 7.0.8-5 Cristy * Fixed a few potential memory leaks https://github.com/ImageMagick/ImageMagick/issues). 2018-07-02 7.0.8-4 Cristy * Release ImageMagick version 7.0.8-4, GIT revision 14505:4613eed4a:2018= 0702. 2018-06-28 7.0.8-4 Cristy * Small tweaks to compile under Cygwin. * Fixed numerous use of uninitialized values, integer overflow, memory exceeded, and timeouts (credit to OSS Fuzz). * Support %B property, the image file size without any decorations. 2018-06-24 7.0.8-3 Cristy * Release ImageMagick version 7.0.8-3, GIT revision 14489:c63c504e8:2018= 0624. 2018-06-24 7.0.8-3 Cristy * Apply translate component of SVG transform rotate. --- Module Name: pkgsrc Committed By: leot Date: Wed Aug 22 13:39:24 UTC 2018 Modified Files: pkgsrc/graphics/ImageMagick: Makefile distinfo Added Files: pkgsrc/graphics/ImageMagick/patches: patch-config_policy.xml Log Message: ImageMagick: Disable ghostscript coders by default in policy.xml Disable ghostscript coders in policy.xml as a workaround for VU#332928 (). Please note that apart commenting/removing lines added in policy.xml, the ghostscript coders can be enabled per-user by copying policy.xml to ~/.config/ImageMagick/policy.xml and adjusting it with the following lines: | [...] | | | | | [...] Bump PKGREVISION --- Module Name: pkgsrc Committed By: leot Date: Thu Aug 23 14:52:23 UTC 2018 Modified Files: pkgsrc/graphics/ImageMagick: Makefile distinfo pkgsrc/graphics/ImageMagick/patches: patch-config_policy.xml Log Message: ImageMagick: Also block PS2 and PS3 coders in policy.xml At least when reading PS2 and PS3 files via `convert PS2: ' and `convert PS3: ' gslib/ghostscript will be invoked and hence subject to VU#332928. Pointed out by Bob Friesenhahn via oss-security@@ ML (and follow up from VU#332928 update). @ text @a0 24 $NetBSD: patch-config_policy.xml,v 1.2 2018/08/23 14:52:22 leot Exp $ Disable ghostscript coders by default to workaround VU#332928: --- config/policy.xml.orig 2018-08-13 11:05:28.000000000 +0000 +++ config/policy.xml @@@@ -74,4 +74,16 @@@@ + + + + + + + + + @ 1.1 log @ImageMagick: Disable ghostscript coders by default in policy.xml Disable ghostscript coders in policy.xml as a workaround for VU#332928 (). Please note that apart commenting/removing lines added in policy.xml, the ghostscript coders can be enabled per-user by copying policy.xml to ~/.config/ImageMagick/policy.xml and adjusting it with the following lines: | [...] | | | | | [...] Bump PKGREVISION @ text @d1 1 a1 1 $NetBSD$ d8 1 a8 1 @@@@ -74,4 +74,14 @@@@ d18 2 @