libpano13-2.9.22 release candidate rc1

[Bruno Postle]

libpano13 is the PanoTools library for panoramic imaging.

A libpano13-2.9.22 rc1 tarball has been uploaded to sourceforge, this is
a release candidate for testing that may become the final release:

https://sourceforge.net/projects/panotools/files/libpano13/libpano13-2.9.22/

This release should be binary compatible with previous versions - This means
that prebuilt Hugin executables should just work with this libpano13.

There have been some changes since 2.9.21:

* Fix some insecure data handling in command-line tools, this doesn't affect Hugin usage

* Clean-up some older deprecated C code, minor build improvements

* Fixes big endian check for Mac OS

* Write TIFFTAG_EXTRASAMPLE tag for files with alpha channel

SHA256SUM: b7a3c43c8bb6ec144b3694e59de7b43872162ee64cb39b9e162100ca2575337e libpano13-2.9.22_rc1.tar.gz

This rc1 release is equivalent to HG 922:3005eda747af

Here is the full ChangeLog since 2.9.21 for more details:

2023-06-29 17:38 +0200 tmodes <tmodes> (3005eda747af [tip])

* adjust.c, file.c, filter.h, parser.c, ptpicker.c, ptutils.h,
sys_X11.c, sys_ansi.c, sys_mac.c, sys_win.c, tools/PTAInterpolate.c,
tools/PToptimizer.c:
Removed ShowScript and LaunchAndSendScript function

They are not used by libpano itself. For external callers both
functions are only a thin wrapper around system calls

2023-06-22 21:03 +0200 tmodes <tmodes> (ad7616ee8c26)

* ColourBrightness.c:
Correctly initialize variable

Only needed when we exit with an error in between without running
the whole algorithm

2023-06-22 20:45 +0200 tmodes <tmodes> (271b8ab4bd66)

* ColourBrightness.c:
Use PrintError own formating instead of using a temporary string

2023-06-22 17:54 +0200 tmodes <tmodes> (18ed65577fbc)

* sys_ansi.c:
ShowScript: Check if file exists before opening vi

2023-01-21 16:23 +0000 Bruno Postle <br...@postle.net> (778a20784e24)

* man/Makefile, version.h:
Bump version to 2.9.22

2023-01-21 16:11 +0000 Bruno Postle <br...@postle.net> (da06997f4c2f)

* ColourBrightness.c:
Include <arpa/inet.h> if it is available, for the htons
function/macro (Florian Weimer)

2022-08-03 18:56 +0200 tmodes <tmodes> (4074ee48e255)

* panorama.h:
Fixes big endian check for Mac OS Patch by lacard

2022-05-13 17:10 +0200 tmodes <tmodes> (b15a90eb756b)

* tools/PTuncrop.c:
Ptuncrop: Fixes usage screen

2022-05-13 17:09 +0200 tmodes <tmodes> (bc7577ea6020)

* tiff.c:
Write TIFFTAG_EXTRASAMPLE tag for files with alpha channel (patch by
Kevin Mehall)

2022-03-31 17:16 +0200 tmodes <tmodes> (ecac1adc7bb6)

* tests/simpleStitch/simple.pto: deleted file.
* tests/simpleStitch/simple.pto:
Removed unused simple.pto

It is unused and were written by a very early Hugin version

2022-03-13 09:24 +0100 tmodes <tmodes> (4f255f7c9c49)

* pt_stdint.h: deleted file.
* CMakeLists.txt, ColourBrightness.c, PTcommon.h, panorama.h,
panotypes.h, pt_stdint.h:
Get rid of now obosolete wrapper pt_stdint.h

2022-03-13 09:23 +0100 tmodes <tmodes> (4d676676de11)

* rgbe.c, rgbe.h:
Fixes inline for newer compiler versions

2022-03-13 08:48 +0100 tmodes <tmodes> (99edb0ca8a2b)

* queryfeature.c:
Fixes assert

typeof is a gcc extension and not supported by MSVC

2022-03-12 09:01 +0100 tmodes <tmodes> (8c72869bd9f7)

* ColourBrightness.c, file.c, ptstitch.c:
Fix some more deprecated uint16/uint32 types

2022-03-06 13:49 +0100 tmodes <tmodes> (f56143ee0588)

* ColourBrightness.c, tiff.c:
Use uint16/32_t instead of depreacated uint16/32 types

2022-03-06 13:48 +0100 tmodes <tmodes> (c887e1348df6)

* CMakeLists.txt:
Added new lzma.dll name (Windows only)

2021-12-16 22:14 +0000 Bruno Postle <br...@postle.net> (2d4aeb9ca433)

* ChangeLog.hg:
update ChangeLog.hg

--
Bruno

[Andreas Metzler]

On 2023-07-18 Bruno Postle <br...@postle.net> wrote:
> libpano13 is the PanoTools library for panoramic imaging.

> A libpano13-2.9.22 rc1 tarball has been uploaded to sourceforge, this is
> a release candidate for testing that may become the final release:

Hello,

This breaks the ABI:

a) Removed ShowScript and LaunchAndSendScript function
b)
-PANO13_IMPEX int WriteScript ( char* res, fullPath* scriptFile, int launch );
+PANO13_IMPEX int WriteScript ( char* res, fullPath* scriptFile );

-PANO13_IMPEX void WriteResults ( char* script, fullPath *sfile, AlignInfo *g, double ds( int i) , int launch);
+PANO13_IMPEX void WriteResults ( char* script, fullPath *sfile, AlignInfo *g, double ds( int i) );


I have not found any users on codesearch.debian.net but still a soname
bump is required. This should do the trick:
--- libpano13-2.9.22~rc1+dfsg.orig/CMakeLists.txt
+++ libpano13-2.9.22~rc1+dfsg/CMakeLists.txt
@@ -286,7 +286,7 @@ if(NOT WIN32)
# Create and install shared library on non-windows
add_library(pano13 SHARED ${pano13_hdr} ${pano13_src})
target_link_libraries(pano13 ${_common_libs})
- set_target_properties(pano13 PROPERTIES VERSION "3.0.0" SOVERSION "3")
+ set_target_properties(pano13 PROPERTIES VERSION "4.0.0" SOVERSION "4")
install(TARGETS pano13 LIBRARY COMPONENT libraries)
set(_pano_target pano13)
#create and install static library
@@ -299,7 +299,7 @@ else()
ADD_DEFINITIONS(-DPANO13_DLL)
add_library(pano13 SHARED ${pano13_hdr} ${pano13_res} ${pano13_src})
target_link_libraries(pano13 ${_common_libs})
- set_target_properties(pano13 PROPERTIES VERSION "3.0.0" SOVERSION "3")
+ set_target_properties(pano13 PROPERTIES VERSION "4.0.0" SOVERSION "4")
IF(MINGW)
set_target_properties(pano13 PROPERTIES PREFIX "")
ENDIF()

cu Andreas

[Bruno Postle]

Thanks, and I am a little ignorant about these details: since no known tools actually use these functions, will leaving the soname unchanged be a problem for tools that use other parts of the library eg. Hugin, nona etc..? My testing seems to be ok.

We could bump the soname, or we could replace these functions with no-op stubs to quieten the abi checkers. What do you think?

-- 

Bruno

On Sat, 22 Jul 2023, 13:36 Andreas Metzler, wrote:

[Robert Clausecker]

I strongly recommend not changing the function ABIs. Instead, provide
a new symbol without the extra argument or document tha the argument is
now ignored.

Failing that, bump the soname and make this a major or at least a minor
release so it's clear that this release has an ABI break. ABI breaks
in patch-level releases are not a good move.

Yours,
Robert Clausecker

> --
> A list of frequently asked questions is available at:
> http://wiki.panotools.org/Hugin_FAQ
> ---
> You received this message because you are subscribed to the Google
> Groups "hugin and other free panoramic software" group.
> To unsubscribe from this group and stop receiving emails from it,
> send an email to hugin-ptx+...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/hugin-ptx/CAJV99ZjU4jCd_fbvQC7qY%3DdgXc8pUm311HQ6iw%2BVNidrx%3D1FXQ%40mail.gmail.com
> .

[Andreas Metzler]

On 2023-07-22 Bruno Postle <br...@postle.net> wrote:
> On Sat, 22 Jul 2023, 13:36 Andreas Metzler, wrote:
>> On 2023-07-18 Bruno Postle wrote:
>>> libpano13 is the PanoTools library for panoramic imaging.

>>> A libpano13-2.9.22 rc1 tarball has been uploaded to sourceforge, this is
>>> a release candidate for testing that may become the final release:

>> This breaks the ABI:

>> a) Removed ShowScript and LaunchAndSendScript function
>> b)
>> -PANO13_IMPEX int WriteScript ( char* res,
>> fullPath* scriptFile, int launch );
>> +PANO13_IMPEX int WriteScript ( char* res,
>> fullPath* scriptFile );

[...]

> Thanks, and I am a little ignorant about these details: since no known
> tools actually use these functions, will leaving the soname unchanged be a
> problem for tools that use other parts of the library eg. Hugin, nona
> etc..? My testing seems to be ok.

Hello Bruno,

Yes, if they do not use either the removed or the changed functions they
should continue to work.

> We could bump the soname, or we could replace these functions with no-op
> stubs to quieten the abi checkers. What do you think?

I am not in favour of that, you'd still break the functional (but
unused, yeah) interface. Also WriteScript/WriteResults changes would
need to be reverted to keep the ABI unchanged.

Imho there is a simple way to do this cleanly and no need to try to be
clever about it.

cu Andreas
--
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'

[Bruno Postle]

On Sat, 22 Jul 2023, 17:38 Robert Clausecker wrote:

Failing that, bump the soname and make this a major or at least a minor
release so it's clear that this release has an ABI break.  ABI breaks
in patch-level releases are not a good move.

I agree, if we are changing the ABI and soname, this release should be 2.10.0, but it seems like a shame to have maintained the ABI for all these years and break it for such a minor thing.

-- 

Bruno

[Andreas Metzler]

On 2023-07-22 Andreas Metzler <amet...@bebt.de> wrote:
[...]

> I am not in favour of that, you'd still break the functional (but
> unused, yeah) interface. Also WriteScript/WriteResults changes would
> need to be reverted to keep the ABI unchanged.

> Imho there is a simple way to do this cleanly and no need to try to be
> clever about it.

Hello,

Would it be possible to find/list the externally "useful" functions?
If that were the case we could change the buildsystem to only export
these in the library ABI and would not have ABI breakage on further
internal cleanups like this one.

[Bruno Postle]

The immediate need is to put out a bugfix release. If we bump the soname then it won't be a drop-in replacement, and Hugin will need to be rebuilt for all platforms etc..

These bugs are not relevant to Hugin users, but they are still security issues, so Linux distros will be looking to update their pano13 packages as soon as we do a release. It would be nice to have this be a minimal change without bumping the soname.

I'm not confident I can do this change that keeps the ABI intact, so looking for help here.

-- 

Bruno

On Sun, 30 Jul 2023, 13:13 Andreas Metzler wrote:

[T. Modes]

bruno...@gmail.com schrieb am Sonntag, 30. Juli 2023 um 19:49:36 UTC+2:

The immediate need is to put out a bugfix release. If we bump the soname then it won't be a drop-in replacement, and Hugin will need to be rebuilt for all platforms etc..

These bugs are not relevant to Hugin users, but they are still security issues, so Linux distros will be looking to update their pano13 packages as soon as we do a release. It would be nice to have this be a minimal change without bumping the soname.

I'm not confident I can do this change that keeps the ABI intact, so looking for help here.

I found a possibility to keep the ABI constant. All public functions keep their signature and exist furthermore. But the critical functions have been replace with a stub which prints only a message to stdout and does nothing else.  So the security issue should be fixed.

The complete removal of these function will be postponed to the next version.

To keep the changes more cleanly I created a new branch in the mercurial repo. So the release should use this branch. All further work goes again to the default branch.

Thomas

[Bruno Postle]

On Mon, 31 Jul 2023, 17:33 T. Modes wrote:

I found a possibility to keep the ABI constant. All public functions keep their signature and exist furthermore. But the critical functions have been replace with a stub which prints only a message to stdout and does nothing else.  So the security issue should be fixed.

The complete removal of these function will be postponed to the next version.

Thanks, I'll do another release candidate next week - Bruno

[Jeff Welty]

FWIW, I downloaded rc1, reviewed the source code changes relative to 13-2.9.21, compiled/installed and tested it on a couple of panos with the hugin interface.

rc1 looks good to me.   I'll do the same for rc2 when it shows up.

Cheers,

Jeff

--

A list of frequently asked questions is available at: http://wiki.panotools.org/Hugin_FAQ
---
You received this message because you are subscribed to the Google Groups "hugin and other free panoramic software" group.
To unsubscribe from this group and stop receiving emails from it, send an email to hugin-ptx+...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/hugin-ptx/CAJV99ZgfmZRo94g8ZN%3D80dxr84hjqUMJ%2BPaFQbOreCPcJth0JA%40mail.gmail.com.