.gegl04.metadata

@@ -1 +1 @@
-055c28bb3c942f85b744201009ac8e02e4182624 SOURCES/gegl-0.4.34.tar.xz
+b709b5051228014371ff07c065b156923baa817a SOURCES/gegl-0.4.4.tar.bz2

.gitignore

@@ -1 +1 @@
-SOURCES/gegl-0.4.34.tar.xz
+SOURCES/gegl-0.4.4.tar.bz2

SOURCES/gegl-CVE-2021-45463.patch

@@ -0,0 +1,70 @@
+From bfce470f0f2f37968862129d5038b35429f2909b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=98yvind=20Kol=C3=A5s?= <pippin@gimp.org>
+Date: Thu, 16 Dec 2021 00:10:24 +0100
+Subject: [PATCH] magick-load: use more robust g_spawn_async() instead of
+ system()
+
+This fixes issue #298 by avoiding the shell parsing being invoked at
+all, this less brittle than any forms of escaping characters, while
+retaining the ability to address all existing files.
+---
+ operations/common/magick-load.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/operations/common/magick-load.c b/operations/common/magick-load.c
+index e2055b2e9..595169115 100644
+--- a/operations/common/magick-load.c
++++ b/operations/common/magick-load.c
+@@ -41,20 +41,23 @@ load_cache (GeglProperties *op_magick_load)
+   if (!op_magick_load->user_data)
+     {
+       gchar    *filename;
+-      gchar    *cmd;
+       GeglNode *graph, *sink, *loader;
+       GeglBuffer *newbuf = NULL;
+ 
+       /* ImageMagick backed fallback FIXME: make this robust.
+        * maybe use pipes in a manner similar to the raw loader,
+        * or at least use a properly unique filename  */
++      char     *argv[4]  = {"convert", NULL, NULL, NULL};
+ 
+       filename = g_build_filename (g_get_tmp_dir (), "gegl-magick.png", NULL);
+-      cmd = g_strdup_printf ("convert \"%s\"'[0]' \"%s\"",
+-                             op_magick_load->path, filename);
+-      if (system (cmd) == -1)
++
++      argv[1] = g_strdup_printf ("%s[0]", op_magick_load->path);
++      argv[2] = filename;
++      if (!g_spawn_sync (NULL, argv, NULL, G_SPAWN_DEFAULT, 
++                         NULL, NULL, NULL, NULL, NULL, NULL))
+         g_warning ("Error executing ImageMagick convert program");
+ 
++      g_free (argv[1]);
+ 
+       graph = gegl_node_new ();
+       sink = gegl_node_new_child (graph,
+@@ -67,7 +70,6 @@ load_cache (GeglProperties *op_magick_load)
+       gegl_node_process (sink);
+       op_magick_load->user_data = (gpointer) newbuf;
+       g_object_unref (graph);
+-      g_free (cmd);
+       g_free (filename);
+     }
+ }
+-- 
+GitLab
+
+
+diff -urNp a/tools/exp_combine.cpp b/tools/exp_combine.cpp
+--- a/tools/exp_combine.cpp	2022-01-10 15:03:42.765909209 +0100
++++ b/tools/exp_combine.cpp	2022-01-10 15:04:16.864158424 +0100
+@@ -8,8 +8,7 @@
+ 
+ #include <iostream>
+ 
+-#include <exiv2/image.hpp>
+-#include <exiv2/exif.hpp>
++#include <exiv2/exiv2.hpp>
+ 
+ using namespace std;
+ 

SOURCES/gegl04-gtk.patch

@@ -1,30 +0,0 @@
-From cf7e328c931a46997fbc4a40540afccd2da8f1e9 Mon Sep 17 00:00:00 2001
-From: Simon McVittie <smcv@debian.org>
-Date: Thu, 9 Sep 2021 13:00:36 +0100
-Subject: [PATCH] docs: Don't scan ctx.h with gtk-doc
-
-ctx.h contains both declarations and implementation, causing gtk-doc to
-fail. It isn't part of GEGL's public API anyway, so don't try to
-document it as such.
-
-Signed-off-by: Simon McVittie <smcv@debian.org>
----
- docs/reference/meson.build | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/docs/reference/meson.build b/docs/reference/meson.build
-index 8193a25ba..2348cec92 100644
---- a/docs/reference/meson.build
-+++ b/docs/reference/meson.build
-@@ -12,6 +12,7 @@ if gtkdoc_scan.found()
-       project_source_root / 'gegl',
-       project_build_root / 'gegl',
-     ],
-+    ignore_headers: ['ctx.h'],
-     fixxref_args: [
-       '--html-dir=@0@'.format(gegl_gtk_docdir),
-       '--extra-dir=@0@'.format(glib_gtk_docdir),
--- 
-GitLab
-
-

SOURCES/gegl04-meson.patch

@@ -1,21 +0,0 @@
-diff -up gegl-0.4.34/gegl/meson.build.orig gegl-0.4.34/gegl/meson.build
---- gegl-0.4.34/gegl/meson.build.orig	2022-11-04 14:51:55.429964084 +0100
-+++ gegl-0.4.34/gegl/meson.build	2022-11-04 14:52:57.611332244 +0100
-@@ -92,8 +92,7 @@ install_headers(gegl_headers,
- gegl_ldflags = os_osx ? ['-framework', 'OpenCL'] : []
- 
- opencl_dep = declare_dependency(
--    sources : [opencl_headers],
--    link_with : [gegl_sources],
-+  sources : [opencl_headers],
- )
- 
- gegl_lib = library(api_name,
-@@ -105,6 +104,7 @@ gegl_lib = library(api_name,
-     gio,
-     math,
-     gmodule,
-+    opencl_dep,
-   ],
-   c_args: gegl_cflags,
-   link_args: gegl_ldflags,

SOURCES/gegl04-openexr.patch

@@ -1,12 +0,0 @@
-Index: gegl-0.4.30/operations/external/exr-save.cc
-===================================================================
---- gegl-0.4.30.orig/operations/external/exr-save.cc
-+++ gegl-0.4.30/operations/external/exr-save.cc
-@@ -39,6 +39,7 @@ extern "C" {
- } /* extern "C" */
- 
- #include <exception>
-+#include <ImfFrameBuffer.h>
- #include <ImfTiledOutputFile.h>
- #include <ImfOutputFile.h>
- #include <ImfChannelList.h>

SOURCES/gegl04-raw-load-LibRaw-0.21.0.patch

@@ -1,30 +0,0 @@
-From e2bc7a1fe46c0dcee708584555d445c9e066b6a1 Mon Sep 17 00:00:00 2001
-From: Chris Mayo <aklhfex@gmail.com>
-Date: Wed, 21 Dec 2022 19:32:02 +0000
-Subject: [PATCH] raw-load: make compatible with LibRaw 0.21.0
-
-imgdata.params.shot_select moved to imgdata.rawparams.shot_select
-https://github.com/LibRaw/LibRaw/blob/979160ff13/Changelog.txt#L182
----
- operations/external/raw-load.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/operations/external/raw-load.c b/operations/external/raw-load.c
-index 13eb661c2f8b..7de2e232df46 100644
---- a/operations/external/raw-load.c
-+++ b/operations/external/raw-load.c
-@@ -114,7 +114,11 @@ prepare (GeglOperation *operation)
-         g_warning ("raw-load: Error Initializing raw library");
-       else
-         {
-+#if LIBRAW_COMPILE_CHECK_VERSION_NOTLESS(0, 21)
-+          p->LibRaw->rawparams.shot_select = o->image_num;
-+#else
-           p->LibRaw->params.shot_select = o->image_num;
-+#endif
-     
-           p->LibRaw->params.aber[0] = 1.0;
-           p->LibRaw->params.aber[2] = 1.0;
--- 
-2.41.0
-

SPECS/gegl04.spec

@@ -1,77 +1,59 @@
 %global apiver 0.4
 
 Name:           gegl04
-Version:        0.4.34
+Version:        0.4.4
-Release:        3%{?dist}
+Release:        7%{?dist}
 Summary:        Graph based image processing framework
 
 # The binary is under the GPL, while the libs are under LGPL.
 # The main package only installs the libs, which makes the license:
 License:        LGPLv3+
 URL:            http://www.gegl.org/
-Source0:        http://download.gimp.org/pub/gegl/%{apiver}/gegl-%{version}.tar.xz
+Source0:        http://download.gimp.org/pub/gegl/%{apiver}/gegl-%{version}.tar.bz2
 
-Patch0:         gegl04-openexr.patch
+Patch1:         gegl-CVE-2021-45463.patch
-Patch1:         gegl04-gtk.patch
-# https://gitlab.gnome.org/GNOME/gegl/-/commit/54f760de6a0e14487ccfb033e270aa6a80ee66e2
-Patch2:         gegl04-meson.patch
-Patch3:         gegl04-raw-load-LibRaw-0.21.0.patch
 
 BuildRequires:  chrpath
 BuildRequires:  enscript
 BuildRequires:  gcc-c++
 BuildRequires:  gettext-devel >= 0.19.8
 BuildRequires:  gobject-introspection-devel >= 1.32.0
-BuildRequires:  gtk-doc
 BuildRequires:  libspiro-devel
-BuildRequires:  meson
 BuildRequires:  perl-interpreter
 BuildRequires:  ruby
+BuildRequires:  SDL-devel >= 1.2.0
 BuildRequires:  suitesparse-devel
-BuildRequires:  vala
+BuildRequires:  vala-tools
 
-BuildRequires:  pkgconfig(babl) >= 0.1.78
+BuildRequires:  pkgconfig(babl) >= 0.1.52
 BuildRequires:  pkgconfig(cairo) >= 1.12.2
 BuildRequires:  pkgconfig(exiv2) >= 0.25
 BuildRequires:  pkgconfig(gdk-pixbuf-2.0) >= 2.32.0
-BuildRequires:  pkgconfig(gexiv2)
 BuildRequires:  pkgconfig(glib-2.0) >= 2.44.0
 BuildRequires:  pkgconfig(jasper) >= 1.900.1
 BuildRequires:  pkgconfig(json-glib-1.0)
 BuildRequires:  pkgconfig(lcms2) >= 2.8
-BuildRequires:  pkgconfig(libraw) >= 0.21.1
+BuildRequires:  pkgconfig(lensfun) >= 0.2.5
+BuildRequires:  pkgconfig(libraw) >= 0.19.0
 BuildRequires:  pkgconfig(libpng) >= 1.6.0
 BuildRequires:  pkgconfig(librsvg-2.0) >= 2.40.6
 BuildRequires:  pkgconfig(libv4l2) >= 1.0.1
 BuildRequires:  pkgconfig(libwebp) >= 0.5.0
 BuildRequires:  pkgconfig(lua) >= 5.1.0
-
+BuildRequires:  pkgconfig(OpenEXR) >= 1.6.1
-%if ! 0%{?rhel}
-%ifarch %{arm} %{ix86} x86_64
-BuildRequires:  pkgconfig(luajit) >= 2.0.4
-%endif
-BuildRequires:  pkgconfig(OpenEXR) >= 2.5.4
-%endif
-
 BuildRequires:  pkgconfig(pango) >= 1.38.0
 BuildRequires:  pkgconfig(pangocairo) >= 1.38.0
 BuildRequires:  pkgconfig(pygobject-3.0) >= 3.2
-BuildRequires:  pkgconfig(sdl2) >= 2.0.5
 BuildRequires:  pkgconfig(vapigen) >= 0.20.0
 BuildRequires:  pkgconfig(libtiff-4) >= 4.0.0
 
-# operations/common/magick-load.c has a fallback image loader which uses /usr/bin/convert
-# However, this code path has no error handling, so no application should rely on it; and
-# there is a general trend to migrate away from ImageMagick.
-# Requires:       /usr/bin/convert
-
 # gegl contains a stripped down version of poly2tri-c, a C+glib port of
 # poly2tri, a 2D constrained Delaunay triangulation library.
 # Version information:
 #     CURRENT REVISION: b27c5b79df2ffa4e2cb37f9e5536831f16afb11b
 #     CACHED ON: August 11th, 2012
 Provides:       bundled(poly2tri-c)
-Obsoletes:      gegl03 < 0.3.31
+
 
 %description
 GEGL (Generic Graphics Library) is a graph based image processing framework.
@@ -84,7 +66,6 @@ minimal dependencies and a simple well defined API.
 Summary:        Development files for %{name}
 Requires:       %{name}%{?_isa} = %{version}-%{release}
 Obsoletes:      %{name}-devel < 0.4.2
-Obsoletes:      gegl03-devel < 0.3.31
 Conflicts:      %{name}-devel < 0.4.2
 
 %description    devel
@@ -96,7 +77,6 @@ developing applications that use GEGL API version %{apiver}.
 Summary:        Documentation files for developing with %{name}
 Requires:       %{name}%{?_isa} = %{version}-%{release}
 Obsoletes:      %{name}-devel < 0.4.2
-Obsoletes:      gegl03-devel-docs < 0.3.31
 Conflicts:      %{name}-devel < 0.4.2
 Conflicts:      gegl-devel < 0.4
 
@@ -109,7 +89,6 @@ applications that use GEGL API version %{apiver}.
 Summary:        Command line tools for %{name}
 Requires:       %{name}%{?_isa} = %{version}-%{release}
 License:        GPLv3+
-Obsoletes:      gegl03-tools < 0.3.31
 Conflicts:      gegl < 0.4
 
 %description    tools
@@ -118,22 +97,25 @@ GEGL library.
 
 
 %prep
-%autosetup -p1 -n gegl-%{version}
+%setup -q -n gegl-%{version}
-
+%patch1 -p1 -b .CVE-2021-45463
 
 %build
-%meson --auto-features=auto -Ddocs=true -Dgtk-doc=true
+%configure --disable-static
-%meson_build
+make %{?_smp_mflags}
 
 
 %install
-%meson_install
+%make_install
 
 # Remove rpaths
 chrpath --delete %{buildroot}%{_bindir}/*
 chrpath --delete %{buildroot}%{_libdir}/*.so*
 chrpath --delete %{buildroot}%{_libdir}/gegl-%{apiver}/*.so
 
+# Remove .la files
+find %{buildroot} -name '*.la' -delete
+
 %find_lang gegl-%{apiver}
 
 
@@ -148,13 +130,6 @@ chrpath --delete %{buildroot}%{_libdir}/gegl-%{apiver}/*.so
 %{_libdir}/libgegl-sc-%{apiver}.so
 %{_libdir}/girepository-1.0/Gegl-%{apiver}.typelib
 
-%if ! 0%{?rhel}
-%ifarch %{arm} %{ix86} x86_64
-%dir %{_datadir}/gegl-%{apiver}/
-%{_datadir}/gegl-%{apiver}/lua/
-%endif
-%endif
-
 %files devel
 %{_includedir}/gegl-%{apiver}/
 %{_libdir}/libgegl-%{apiver}.so
@@ -176,100 +151,20 @@ chrpath --delete %{buildroot}%{_libdir}/gegl-%{apiver}/*.so
 
 
 %changelog
-* Tue Oct 03 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.4.34-3
+* Tue Jan 11 2022 Josef Ridky <jridky@redhat.com> - 0.4.4-7
+- Fix CVE-2021-45463 (#2035424)
+
+* Wed Oct 03 2018 Debarshi Ray <rishi@fedoraproject.org> - 0.4.4-6
 - Rebuild against new LibRaw soname
-Resolves: RHEL-770
+Resolves: #1633708
 
-* Fri Nov 04 2022 Tomas Popela <tpopela@redhat.com> - 0.4.34-2
+* Thu Aug 23 2018 Josef Ridky <jridky@redhat.com> - 0.4.4-5
-- Fix FTBFS for a possible Meson rebase
+- Remove ImageMagick requirement
-- Resolves: rhbz#2140107
+Resolves: #1620209
 
-* Wed Feb 02 2022 Josef Ridky <jridky@redhat.com> - 0.4.34-1
+* Mon Aug 06 2018 Josef Ridky <jridky@redhat.com> - 0.4.4-4
-- New upstream release 0.4.34 (#2045018)
+- Remove luajit requirement, because it is not available on RHEL-8
-- Fix CVE-2021-45463
+Resolves: #1609985
-
-* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 0.4.30-5
-- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
-
-* Wed Jun 30 2021 Josef Ridky <jridky@redhat.com> - 0.4.30-4
-- Remove lensfun from buildrequires (#1975916)
-
-* Fri Apr 16 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.4.30-3
-- Disable luajit on RHEL
-Resolves: #1950052
-
-* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 0.4.30-2
-- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
-
-* Fri Apr 02 2021 Kalev Lember <klember@redhat.com> - 0.4.30-1
-- Update to 0.4.30
-
-* Thu Jan 28 2021 Josef Ridky <jridky@redhat.com> - 0.4.26-4
-- Disable OpenEXR on RHEL
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.26-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Fri Jan 01 2021 Richard Shaw <hobbes1069@gmail.com> - 0.4.26-2
-- Rebuild for OpenEXR 2.5.3.
-
-* Mon Aug 24 2020 Josef Ridky <jridky@redhat.com> - 0.4.26-1
-- New upstream release 0.4.26
-
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.24-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon Jun 15 2020 Josef Ridky <jridky@redhat.com> - 0.4.24-1
-- New upstream release 0.4.24
-
-* Mon May 11 2020 Gwyn Ciesla <gwync@protonmail.com> - 0.4.22-2
-- Rebuild for new LibRaw
-
-* Wed Feb 19 2020 Josef Ridky <jridky@redhat.com> - 0.4.22-1
-- Update to 0.4.22
-
-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.18-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Mon Nov 04 2019 Kalev Lember <klember@redhat.com> - 0.4.18-1
-- Update to 0.4.18
-- Switch to meson build system
-- Build against SDL2 instead of SDL 1
-- Enable gexiv2 support
-
-* Thu Sep 12 2019 Josef Ridky <jridky@redhat.com> -0.4.16-4
-- Obsoletes gegl03 (#1751416)
-
-* Tue Aug 27 2019 Kevin Fenzi <kevin@scrye.com> - 0.4.16-3
-- Rebuild for new libspiro
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.16-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Mon Jun 10 2019 Kalev Lember <klember@redhat.com> - 0.4.16-1
-- Update to 0.4.16
-
-* Wed Apr 10 2019 Richard Shaw <hobbes1069@gmail.com> - 0.4.14-2
-- Rebuild for OpenEXR 2.3.0.
-
-* Mon Mar 25 2019 Josef Ridky <jridky@redhat.com> - 0.4.14-1
-- version 0.4.14
-
-* Mon Feb 04 2019 Kalev Lember <klember@redhat.com> - 0.4.12-3
-- Update BRs for vala packaging changes
-
-* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.12-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Sat Nov 10 2018 Nils Philippsen <nils@tiptoe.de> - 0.4.12-1
-- version 0.4.12
-
-* Fri Aug 24 2018 Debarshi Ray <rishi@fedoraproject.org> - 0.4.8-2
-- Drop the run-time requirement on ImageMagick
-
-* Mon Aug 20 2018 Nils Philippsen <nils@tiptoe.de> - 0.4.8-1
-- version 0.4.8
 
 * Thu Jul 19 2018 Christian Dersch <lupinix@fedoraproject.org> - 0.4.4-3
 - Rebuilt for LibRaw soname bump