Skip to content

v1.8.0

Choose a tag to compare

View all tags
@Snesnopic Snesnopic released this 09 Jul 16:20
v1.8.0
165e800

Major release adding Linux x86 support, a new optimal for MSEED files, and some fixes

What's new

Security fixes

  • Fixed a path traversal vulnerability in archive extraction (ArchiveProcessor) and in Office/OpenDocument extraction (OOXMLProcessor, OdfProcessor): a maliciously crafted .zip/.tar/.docx/.xlsx/.pptx/.odt/.ods/.odp file could write files outside the intended extraction directory, via unsanitized entry paths or unsanitized symlink targets. All three processors now validate every entry (and symlink target) against the extraction sandbox before writing anything to disk
  • Added a maximum container nesting depth (256)

Platforms

  • Added Linux x86 (32-bit) support to the build matrix, CI, and release assets, because why not
  • Added a Windows x86 (32-bit) CI/release target, because why not
  • All Windows binaries are now statically linked against the MSVC runtime MSVC runtime

MSEED compression

  • Replaced libmseed with mseedout: The MseedProcessor no longer uses libmseed directly for repacking. Instead, it delegates to the new mseedout library, which is slower but yield way better results

Container correctness fixes

  • Containers are no longer replaced if they don't actually shrink; previously, containers were always replaced by their finalized version, even if it ended up larger than the original. This is now guarded consistently with how individual files are already handled
  • EPUB containers were being written entirely uncompressed instead of just the mandatory mimetype entry, due to a libarchive toggle not being properly reset afterwards. EPUBs are now correctly compressed again
  • Hardlink detection when creating an archive is now cross-platform (previously POSIX-only, now also works on Windows), and a bug that broke extraction of any archive containing hardlinks (tar/cpio) has been fixed
  • Failed or partial archive extraction/creation no longer leaves orphaned files behind in the system temp directory

General improvements

  • Fixed a bug where processing a container file would spam the console with more logs than necessary
  • Fixed brew install --HEAD builds failing due to an incorrect build output path
  • Deduplicated OOXML/ODF/Archive zip extraction logic into a single helper
  • Removed unreachable code paths and duplicate entries in the internal MIME/format lookup tables
  • macOS GCC compatibility fix

Dependencies

  • Updated qadmimes to v1.1.0 to improve MIME type recognition accuracy
  • Updated mp3packercpp to v1.1.0 to fix some bugs
  • Updated libtiff from v4.7.1 to v4.7.2 (brings fixes and general improvements for Apple framework build support and CMake)
  • Updated sqlite3 from 3.52.0 to 3.53.3
  • Updated libpng to the latest libpng18 branch
  • Updated libarchive to the latest master branch
  • Updated libjxl to the latest main branch

macOS: removing the Gatekeeper quarantine

When downloading binaries from the internet, macOS automatically marks them as “quarantined”.
If you try to run chsl and macOS shows a warning like:

“chsl cannot be opened because it is from an unidentified developer”

…you need to remove the quarantine attribute manually.

How to remove the quarantine flag
Open Terminal in the folder where you downloaded chsl and run:

xattr -d com.apple.quarantine ./chsl

To verify that the quarantine flag is gone:

xattr ./chsl

If com.apple.quarantine no longer appears, you're good to go.
Now you can run:

./chsl ...

Note
This issue does not occur if you compile chsl yourself.

Assets 14
Loading