Release Expat 2.2.7

[hartwork]

Regular releases:

• Bump .so version info, document in change log
• make distcheck source tarballs using ./distribute.sh
• Build and test Windows installer (Karl)
• SourceForge:
  • Upload Windows installer
  • Upload source tarballs + .asc GPG signature (Feature request: GPG-signed release tarballs #193)
  • Make one new source tarball default download for all but Windows
  • Make new installer binary default download for Windows
• GitHub:
  • Create signed Git tag and push it
  • Upload source tarball + .asc GPG signature (Feature request: GPG-signed release tarballs #193)
  • Upload Windows installer (Karl)
• Let the community know:
  • News item on https://libexpat.github.io/
  • Mail Expat distro maintainers directly
  • Write to the xml-dev mailing list (mail)
  • Blog about it at blog.hartwork.org: post
    • Submit to Hacker News (thread)
  • Blog about it at xml.com: post
• (Bump ebuild in Gentoo)

Specific to 2.2.7:

• Request CVE for [CVE-2018-20843] 88k xml file uses >2G memory #186 / xmlparse.c: Fix extraction of namespace prefix from XML name (#186) #262 — submitted 2019-06-20, received CVE-2018-20843 on 2019-06-24
  • Add CVE to change log
  • (Open security bug in Gentoo — https://bugs.gentoo.org/688734)

[Mistuke]

Hi,

I was wondering why the release tarballs still require autoreconf. As in why isn't just a configure file distributed?

The reason I ask is because libexpath requires a specific version of autoreconf which of course differs from the version from other projects and we're building libexpat as part of a much wider toolchain. This then ends up with a version mismatch and requires build scripts to change the path of tools..

I understand why the git repo doesn't contain one, just wondering why the tarballs don't.

[hartwork]

I was wondering why the release tarballs still require autoreconf. As in why isn't just a configure file distributed?

Hi! I have good and bad news: You have the wrong file, the release archive does contain configure.

The reason I ask is because libexpath requires a specific version of autoreconf which of course differs from the version from other projects and we're building libexpat as part of a much wider toolchain. This then ends up with a version mismatch and requires build scripts to change the path of tools..

May I ask what version of Automake, Autoconf, libtool you have that are not good enough to autoreconf expat? What distro are you basing on?

[Mistuke]

Hi! I have good and bad news: You have the wrong file, the release archive does contain configure.

Ah indeed! I was using the source tarballs but of course that's just the snapshot of the repo!

May I ask what version of Automake, Autoconf, libtool you have that are not good enough to autoreconf expat? What distro are you basing on?

We have some projects that unfortunately require exactly 2.64 so this is too old for libexpat.

We're building Automaker etc them from source so not tied to a particular distro but most of the builds happen on Ubuntu 16.04 or 18.04 and RHEL5

[hartwork]

2.2.7 is coming up in the next few days. If anyone wants to give latest Git master a spin in their environment, now would be a good time 😄