Cut a 1.0.0 release

[darconeous]

We should consider cutting a 1.0.0 release soon.

Before we cut a 1.0.0 release, we need to do the following:

• Resolve all existing security issues (like mifare_desfire.c: buffer overflow at read_data #33 and security bug in mifare_crypto_postprocess_data() #90)
• Update the version information in configure.ac
• Increment the library compatibility version.
• Review all of the APIs and make sure we are satisfied with how they work.
• Designate who will sign the release, or what key to use to sign the release.

[smortex]

👍

I am not 100% sure but AFAICR, building libfreefare master branch against the latest libnfc release does not work. So maybe we should also release a new libnfc version in the process.

[clausecker]

Please consider removing pragma pack from all structures exposed in headers. You can do this for free since you already break the API in this new major release. This makes writing bindings to other languages a lot easier.

[clausecker]

The libnfc has meanwhile pushed an 1.7.2 version with a bunch of new APIs. Might be a good idea to push a new libfreefare version in tandem.

[mtdcr]

Review all of the APIs and make sure we are satisfied with how they work.

Functions like mifare_desfire_read_* don't know the size of the data buffer passed to it. If length is zero, the whole file will be read into this buffer. I don't know what's the maximum size of a file from the top of my head, and whether it's mandatory to pass a buffer with maximum file size when length is zero, but it's something I suspect many people can get wrong.

Therefore I suggest adding a size parameter to all functions writing into a buffer provided by a user of the library.

[clausecker]

Any progress on this one?

[graynk]

I'd like to remind everyone that there are Buildroot pipelines that are dependant on libnfc/libfreefare, but due to Buildroot's nature it downloads the latest release. Thankfully, libnfc's 1.8.0 is in somewhat OK state to use now, but libfreefare is still 6 years old at this point.

I had to .tar.gz the repo and upload it to my own hosting, adding LIBREEFARE_AUTORECONF = YES to Buildroot's config. It's not that much of a problem, but it's certainly a problem.