Release Expat 2.4.3

[hartwork]

Issues to be fixed prior to the release:

• [CVE-2021-45960] A large number of prefixed XML attributes on a single tag can crash libexpat (troublesome left shifts by >=29 bits in function storeAtts) #531
• [CVE-2021-46143] Crafted XML file can cause integer overflow on m_groupSize in function doProlog #532

Pull requests to be merged prior to the release:

• [CVE-2021-45960] lib: Detect and prevent troublesome left shifts in function storeAtts (fixes #531) #534
• [CVE-2021-46143] lib: Prevent integer overflow on m_groupSize in function doProlog (fixes #532) #538
• [CVE-2022-22822 to CVE-2022-22827] lib: Prevent more integer overflows #539
• run.sh.in: Do not use Wine with Cygwin and MSYS2 #541
• Prepare release 2.4.3 (part of #533) #543

Regular releases:

• Bump .so version info, document in change log
• Bump release version everywhere (including doc/reference.html)
• Fill release date (both change log and man page date)
• make distcheck source tarballs using ./distribute.sh
• Build Windows installer using AppVeyor CI — https://ci.appveyor.com/project/libexpat/libexpat/builds/42220232/artifacts
• Build Windows binaries zip file from installer a la expat-win32bin-2.3.0.exe showing virus warnings #461 (comment)
• SourceForge:
  • Upload Windows installer and binaries zip file
  • Upload source tarballs + .asc GPG signature (Feature request: GPG-signed release tarballs #193)
  • Make one new source tarball default download for all but Windows
  • Make new binary zip file default download for Windows
• GitHub:
  • Create signed Git tag and push it
  • Create new release — https://github.com/libexpat/libexpat/releases/tag/R_2_4_3
  • Upload source tarball + .asc GPG signature (Feature request: GPG-signed release tarballs #193)
  • Upload Windows installer and binaries zip file
  • Close current milestone and create a follow-up one
• Let the community know:
  • News item on https://libexpat.github.io/
  • Mail Expat distro maintainers directly
  • Write to the xml-dev mailing list — http://lists.xml.org/archives/xml-dev/202201/msg00145.html
  • Blog about it at blog.hartwork.org — https://blog.hartwork.org/posts/expat-2-4-3-released/
    • Submit to Hacker News — https://news.ycombinator.com/item?id=29957018
  • Blog about it at xml.com — https://www.xml.com/news/2022-01-expat-243-released/
  • Ask CMake to update their bundled copy (in case of relevant bugfixes) — https://gitlab.kitware.com/cmake/cmake/-/issues/23113
  • Ask CPython to update their bundled copy (in case of relevant bugfixes) — https://bugs.python.org/issue46400
• Bump ebuild in Gentoo — gentoo/gentoo@f37a82a

Specific to 2.4.3:

• security aspects

Related downstreams issues and pull requests:

• AOSC — expat: security update to 2.4.6 AOSC-Dev/aosc-os-abbs#3753
• Conan — [request] expat/2.4.3 (security fixes) conan-io/conan-center-index#8940
• Gobo Linux — Please bump vulnerable Expat to 2.4.3 gobolinux/Recipes#150
• msys2 — expat: Please update from vulnerable 2.4.2 to 2.4.3 msys2/MINGW-packages#10559
• NixOS — expat: 2.4.2 -> 2.4.3 (security) NixOS/nixpkgs#155253
• Pisi Linux — Please update vulnerable Expat to 2.4.6 pisilinux/core#1311
• Spack — expat: Add latest release 2.4.3 with security fixes spack/spack#28435
• vcpkg — [expat] update to 2.4.7 (with security fixes) microsoft/vcpkg#22551