XMLSec 1.3.13 (rc1)

[lsh123]

Please test the release candidate 1.3.13-rc1 (signature) and let me know if you see any issues. This release is API backward compatible but it is not ABI backward compatible and it has several non-backward compatible behavioral changes noted in the release notes:

• (xmlsec-core, not backward compatible) Fixed several issues with Relationship transform handling.
  To restore the old (broken) behaviour, use --relationship-legacy flag (or set the
  XMLSEC_DSIG_FLAGS_RELATIONSHIP_LEGACY flag in the xmlSecDSigCtx struct in your application code).
• (xmlsec-core, not backward compatible) Restricted the default enabled reference and transform URIs
  to empty and same document URIs only. Use --enabled-reference-uris, --enabled-retrieval-method-uris,
  --enabled-key-info-reference-uris, etc. parameters for XMLSec command line tool if local or remote URIs
  usage is required (or set corresponding flag in the xmlSecDSigCtx and xmlSecEncCtx structs in your
  application code). The any value is now accepted by these options to enable all URI types.
• (xmlsec-core, not backward compatible) Enforced restrictions on max depth when processing encrypted keys,
  key agreements, etc. Use the new --max-encrypted-key-level option to control the maximum depth level for
  these use cases. (default is 1).
• (xmlsec-core, not backward compatible) Include files have been cleaned up to remove unnecessary includes,
  fix circular dependencies, etc.
• (xmlsec-core, not backward compatible) Removed support for negative values in BN string conversion/parsing helpers;
  values are now treated as unsigned magnitudes.
• (xmlsec-core, not backward compatible) Added hard cap (adjustable at build time) on maximum number of the
  PBKDF2 iterations (1000000 by default).
• (xmlsec-openssl, xmlsec-nss, xmlsec-gnutls, xmlsec-mscng, xmlsec-mscrypto, xmlsec-gcrypt,
  not backward compatible) Reject zero-length CBC padding blocks in all CBC finalization paths.
• (xmlsec-mscng) Added support for using both current user and local machine certificates store for verifying
  the certificates (new xmlSecMSCngAppGetCurrentUserCertStoreName() / xmlSecMSCngAppGetLocalMachineCertStoreName()
  APIs; xmlSecMSCngAppGetCertStoreName is now a deprecated alias).
• (xmlsec-nss) Hardened CRL verification: CRLs without thisUpdate are rejected, nextUpdate is enforced
  when present, and the CRL issuer certificate is chain-verified with CA usage.
• (xmlsec-mscrypto, not backward compatible) Enforced the use of '--crypto-config' command line
  option value when opening certificate stores.
• (xmlsec-mscrypto, not backward compatible) Removed the fallback definitions for the old 32-bit
  MinGW.org toolchain; building the MSCrypto backend now requires the Windows SDK headers provided by
  the toolchain (e.g., MinGW-w64 or MSVC).
• (xmlsec-build, not backward compatible) Added '-std=c23' compiler flag for building the library
  on compilers that support it or '-std=c99' otherwise (this flag was only enabled with --enable-pedantic builds
  in the past).
• (xmlsec-build, not backward compatible) Added --enable-hardening option to configure script and
  hardening option to configure.ps1 script to enable security hardening flags on GCC, Clang, and MSVC
  when the compiler version and the target architecture support it (default: yes).
• (xmlsec-build) Deprecated the --enable-secure-memset option (memory cleansing is now always built in with
  the new xmlSecMemCleanse() function) and removed the test-only --enable-skm option; the fuzz targets in
  apps/oss-fuzz/ are now built and run by make check / nmake check by default.
• (xmlsec-windows) Added apps option to configure.ps1 to control whether the command-line binaries in
  the apps/ folder are built (default: yes).
• Many other small fixes (see commit log for more details).

Many thanks to everyone who submitted patches and bugs!

Best,
Aleksey

---

This discussion was created from the release XMLSec 1.3.13 (rc1).

[vmiklos]

Looks good here, apart from the previously discussed required change that the default dsigCtx->enabledReferenceUris is too strict for ODF signing/verification. But once that's relaxed, I don't see tests failing.

[lsh123]

Great, thanks for testing!

[mikaeldui]

I got this error when building:

conftest.c: In function 'main':
conftest.c:29:8: error: 'strchr' undeclared (first use in this function)
   29 | (void) strchr;
      |        ^~~~~~
conftest.c:1:1: note: 'strchr' is defined in header '<string.h>'; this is probably fixable by adding '#include <string.h>'
    1 | /* confdefs.h */
conftest.c:29:8: note: each undeclared identifier is reported only once for each function it appears in
   29 | (void) strchr;
      |        ^~~~~~
configure:20709: $? = 1
configure: failed program was:
| /* confdefs.h */
| #define PACKAGE_NAME "xmlsec1"
| #define PACKAGE_TARNAME "xmlsec1"
| #define PACKAGE_VERSION "1.3.13"
| #define PACKAGE_STRING "xmlsec1 1.3.13"
| #define PACKAGE_BUGREPORT "http://www.aleksey.com/xmlsec"
| #define PACKAGE_URL ""
| #define PACKAGE "xmlsec1"
| #define VERSION "1.3.13"
| #define HAVE_STDIO_H 1
| #define HAVE_STDLIB_H 1
| #define HAVE_STRING_H 1
| #define HAVE_INTTYPES_H 1
| #define HAVE_STDINT_H 1
| #define HAVE_STRINGS_H 1
| #define HAVE_SYS_STAT_H 1
| #define HAVE_SYS_TYPES_H 1
| #define HAVE_UNISTD_H 1
| #define STDC_HEADERS 1
| #define HAVE_DLFCN_H 1
| #define LT_OBJDIR ".libs/"
| #define HAVE_DIRENT_H 1
| #define HAVE_LTDL_H 1
| /* end confdefs.h.  */
| 
| int
| main (void)
| {
| (void) strchr;
|   ;
|   return 0;
| }
configure:20736: gcc -c -O2 -pipe -g -Wp,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer  -fno-strict-overflow -fno-strict-aliasing -O -pedantic -pedantic-errors -W -Wall -Wextra -fno-inline -Wformat=2 -Wformat-security -Wformat-nonliteral -Wconversion -Wunused -Wshadow -Wpointer-arith -Wcast-align -Wwrite-strings -Wmissing-prototypes -Wnested-externs -Wredundant-decls -Wdouble-promotion -Wformat-signedness -Wnull-dereference -Wformat-overflow=2 -std=c23 -fstack-protector-strong -fPIE -fcf-protection=full -fstack-clash-protection -D_FORTIFY_SOURCE=2 -fno-builtin-memset -fno-builtin  conftest.c >&5
<command-line>: error: '_FORTIFY_SOURCE' redefined
<command-line>: note: this is the location of the previous definition
configure:20736: $? = 1
configure: failed program was:
| /* confdefs.h */
| #define PACKAGE_NAME "xmlsec1"
| #define PACKAGE_TARNAME "xmlsec1"
| #define PACKAGE_VERSION "1.3.13"
| #define PACKAGE_STRING "xmlsec1 1.3.13"
| #define PACKAGE_BUGREPORT "http://www.aleksey.com/xmlsec"
| #define PACKAGE_URL ""
| #define PACKAGE "xmlsec1"
| #define VERSION "1.3.13"
| #define HAVE_STDIO_H 1
| #define HAVE_STDLIB_H 1
| #define HAVE_STRING_H 1
| #define HAVE_INTTYPES_H 1
| #define HAVE_STDINT_H 1
| #define HAVE_STRINGS_H 1
| #define HAVE_SYS_STAT_H 1
| #define HAVE_SYS_TYPES_H 1
| #define HAVE_UNISTD_H 1
| #define STDC_HEADERS 1
| #define HAVE_DLFCN_H 1
| #define LT_OBJDIR ".libs/"
| #define HAVE_DIRENT_H 1
| #define HAVE_LTDL_H 1
| /* end confdefs.h.  */
| #include <float.h>
| #include <limits.h>
| #include <stdarg.h>
| #include <stddef.h>
| extern void ac_decl (int, char *);
| 
| int
| main (void)
| {
| (void) ac_decl (0, (char *) 0);
|   (void) ac_decl;
| 
|   ;
|   return 0;
| }
configure:20756: result: cannot detect
configure:20760: error: in '/run/build/xmlsec':
configure:20762: error: cannot make gcc report undeclared builtins
See 'config.log' for more details

[lsh123]

This is likely caused by includes cleanup mentioned in release notes. Should be fixable by adding missing includes to your code.