update to 0.10.4 (resolves rhbz#2384428)

- fixes CVE-2024-11403 and CVE-2024-11498

.gitignore

@@ -20,6 +20,5 @@
 /third_party-0.10.2.tar.gz
 /jpegxl-0.10.3.tar.gz
 /third_party-0.10.3.tar.gz
-/jpegxl-0.11.1.tar.gz
-/third_party-0.11.1.tar.gz
-/testdata-0.11.1.tar.gz
+/jpegxl-0.10.4.tar.gz
+/third_party-0.10.4.tar.gz

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.104.1.
+The file was generated using packit 0.97.3.post1.dev7+g1954e49a.

jpegxl.spec

@@ -1,16 +1,16 @@
 # epel 8 need this other already have it
 %undefine __cmake_in_source_build
 
-# developper recommendation
-%global toolchain clang
 
 # Uncomment for special build to rebuild aom on bumped soname.
-#global new_soname 1
-%global sover_old 0.10
-%global sover 0.11
+#%%global new_soname 1
+%global sover_old 0.8
+%global sover 0.10
+
+%global gdk_pixbuf_moduledir $(pkgconf gdk-pixbuf-2.0 --variable=gdk_pixbuf_moduledir)
 
-%bcond_with gimp_plugin
 %if 0%{?fedora}
+%bcond_without gimp_plugin
 %bcond_without tcmalloc
 %endif
 
@@ -20,7 +20,7 @@ decoder).}
 
 Name:           jpegxl
 Epoch:          1
-Version:        0.11.1
+Version:        0.10.4
 Release:        %autorelease %{?new_soname:-p -e 0~sonamebump}
 Summary:        JPEG XL image format reference implementation
 
@@ -32,27 +32,25 @@ License:        BSD-3-Clause AND Apache-2.0 AND Zlib
 URL:            https://jpeg.org/jpegxl/
 Source0:        https://github.com/libjxl/libjxl/archive/v%{version}/%{name}-%{version}.tar.gz
 
-# set VERSION and run ./update_third_party.sh to get Source1 and Source2
+# set VERSION and run ./update_third_party.sh to get Source1
 Source1:        third_party-%{version}.tar.gz
-Source2:        testdata-%{version}.tar.gz
 
 BuildRequires:  asciidoc
 BuildRequires:  cmake
 BuildRequires:  doxygen
-BuildRequires:  clang
+BuildRequires:  gcc-c++
 BuildRequires:  giflib-devel
 %if %{with tcmalloc}
 BuildRequires:  gperftools-devel
 %endif
 BuildRequires:  ninja-build
 %if %{with gimp_plugin}
-BuildRequires:  pkgconfig(gimp-3.0)
+BuildRequires:  pkgconfig(gimp-2.0)
 %endif
 ## sjpeg examples are not built
 #BuildRequires:  (pkgconfig(glut) or pkgconfig(freeglut))
 BuildRequires:  gtest-devel
 BuildRequires:  gflags-devel
-BuildRequires:  gmock-devel
 BuildRequires:  pkgconfig(libhwy)
 BuildRequires:  pkgconfig(libbrotlicommon)
 BuildRequires:  pkgconfig(lcms2)
@@ -73,15 +71,16 @@ BuildRequires:  libjxl < %{epoch}:%{version}
 %endif
 
 # No official release
-Provides:       bundled(sjpeg) = 0-0.1.20230608gite5ab130
+Provides:       bundled(sjpeg) = 0-0.1.20210522git868ab55
 # Build system is Bazel, which is not packaged by Fedora
-Provides:       bundled(skcms) = 0-0.1.20240122git51b7f2a
+Provides:       bundled(skcms) = 0-0.1.20210522git6437475
 
 %description
 %common_description
 
 %package     -n libjxl-utils
 Summary:        Utilities for manipulating JPEG XL images
+Recommends:     jxl-pixbuf-loader = %{epoch}:%{version}-%{release}
 Recommends:     gimp-jxl-plugin   = %{epoch}:%{version}-%{release}
 Provides:       jpegxl-utils = %{epoch}:%{version}-%{release}
 Obsoletes:      jpegxl-utils < 0.3.7-5
@@ -110,12 +109,9 @@ Documentation for JPEG-XL.
 %package     -n libjxl
 Summary:        Library files for JPEG-XL
 Requires:       shared-mime-info
+Recommends:     jxl-pixbuf-loader = %{epoch}:%{version}-%{release}
 Provides:       jpegxl-libs = %{epoch}:%{version}-%{release}
 Obsoletes:      jpegxl-libs < 0.3.7-5
-Obsoletes:      jxl-pixbuf-loader < %{epoch}:%{version}-%{release}
-%if %{without gimp_plugin}
-Obsoletes:      gimp-jxl-plugin < 1:0.10.3-4
-%endif
 
 %description -n libjxl
 %{common_description}
@@ -133,6 +129,14 @@ Obsoletes:      jpegxl-devel < 0.3.7-5
 
 Development files for JPEG-XL.
 
+%package     -n jxl-pixbuf-loader
+Summary:        JPEG-XL image loader for GTK+ applications
+BuildRequires:  pkgconfig(gdk-pixbuf-2.0)
+Requires:       gdk-pixbuf2
+
+%description -n jxl-pixbuf-loader
+Jxl-pixbuf-loader contains a plugin to load JPEG-XL images in GTK+ applications.
+
 %if %{with gimp_plugin}
 %package     -n gimp-jxl-plugin
 Summary:        A plugin for loading and saving JPEG-XL images
@@ -144,17 +148,15 @@ This is a GIMP plugin for loading and saving JPEG-XL images.
 
 %prep
 %autosetup -p1 -n libjxl-%{version}
-rm -rf testdata/ third_party/
-%setup -q -T -D -a 1 -a 2 -n libjxl-%{version}
+rm -rf third_party/
+%setup -q -T -D -a 1 -n libjxl-%{version}
 
 %build
-export CC=clang CXX=clang++
 %cmake  -DENABLE_CCACHE=1 \
-        -DBUILD_TESTING=ON \
+        -DBUILD_TESTING=OFF \
         -DINSTALL_GTEST:BOOL=OFF \
         -DJPEGXL_ENABLE_BENCHMARK:BOOL=OFF \
         -DJPEGXL_ENABLE_PLUGINS:BOOL=ON \
-        -DJPEGXL_ENABLE_PLUGIN_GDKPIXBUF:BOOL=OFF \
         -DJPEGXL_FORCE_SYSTEM_BROTLI:BOOL=ON \
         -DJPEGXL_FORCE_SYSTEM_GTEST:BOOL=ON \
         -DJPEGXL_FORCE_SYSTEM_HWY:BOOL=ON \
@@ -172,33 +174,26 @@ export CC=clang CXX=clang++
 %if 0%{?new_soname}
 cp -p %{_libdir}/libjxl.so.%{sover_old}*     \
   %{_libdir}/libjxl_threads.so.%{sover_old}* \
-  %{_libdir}/libjxl_cms.so.%{sover_old}* \
   %{buildroot}%{_libdir}
 %endif
 
-%check
-%ifarch s390x
-# https://github.com/libjxl/libjxl/issues/3629
-%ctest -E 'DecodeTest\.(ProgressionTestLosslessAlpha|FlushTestLosslessProgressiveAlpha)|EncodeTest\.FrameSettingsTest|JxlTest\.RoundtripAlpha(Resampling(OnlyAlpha)?|16)|JxlTest\.RoundtripProgressive(Level2Slow)?|ModularTest\.RoundtripLossy(DeltaPalette|16)?|RoundtripLossless/ModularTestParam\.RoundtripLossless/1bitSqueeze|RoundtripLossless/ModularTestParam\.RoundtripLossless/(1|2[01467]|30)bitSqueeze|PassesTest\.ProgressiveDownsample2DegradesCorrectly(Grayscale)?'
-%else
-%ctest
-%endif
-
 %files -n libjxl-utils
 %doc CONTRIBUTING.md CONTRIBUTORS README.md
 %{_bindir}/cjxl
 %{_bindir}/djxl
+%{_bindir}/cjpegli
+%{_bindir}/djpegli
 %{_bindir}/jxlinfo
 %{_mandir}/man1/cjxl.1*
 %{_mandir}/man1/djxl.1*
 
 %files -n libjxl-devtools
 %{_bindir}/djxl_fuzzer_corpus
+%{_bindir}/jpegli_dec_fuzzer_corpus
 %{_bindir}/butteraugli_main
 %{_bindir}/decode_and_encode
 %{_bindir}/display_to_hlg
 %{_bindir}/exr_to_pq
-%{_bindir}/icc_simplify
 %{_bindir}/pq_to_hlg
 %{_bindir}/render_hlg
 %{_bindir}/tone_map
@@ -220,11 +215,13 @@ cp -p %{_libdir}/libjxl.so.%{sover_old}*     \
 %{_libdir}/libjxl.so.%{sover}*
 %{_libdir}/libjxl_threads.so.%{sover}*
 %{_libdir}/libjxl_cms.so.%{sover}*
+%{_libdir}/libjxl_extras_codec.so.%{sover}*
 %if 0%{?new_soname}
 %{_libdir}/libjxl.so.%{sover_old}*
 %{_libdir}/libjxl_threads.so.%{sover_old}*
-%{_libdir}/libjxl_cms.so.%{sover_old}*
 %endif
+%dir %{_datadir}/thumbnailers
+%{_datadir}/thumbnailers/jxl.thumbnailer
 %{_datadir}/mime/packages/image-jxl.xml
 
 %files -n libjxl-devel
@@ -233,11 +230,15 @@ cp -p %{_libdir}/libjxl.so.%{sover_old}*     \
 %{_libdir}/libjxl.so
 %{_libdir}/libjxl_threads.so
 %{_libdir}/libjxl_cms.so
-%{_libdir}/libjxl_extras_codec.a
+%{_libdir}/libjxl_extras_codec.so
 %{_libdir}/pkgconfig/libjxl.pc
 %{_libdir}/pkgconfig/libjxl_threads.pc
 %{_libdir}/pkgconfig/libjxl_cms.pc
 
+%files -n jxl-pixbuf-loader
+%license LICENSE
+%{_libdir}/gdk-pixbuf-2.0/*/loaders/libpixbufloader-jxl.so
+
 %if %{with gimp_plugin}
 %files -n gimp-jxl-plugin
 %license LICENSE

sources

@@ -1,3 +1,2 @@
-SHA512 (jpegxl-0.11.1.tar.gz) = 0cfd81d9d3b783f96bd04f244d73ffbc12186c89993d46064a2751bef0a446a5e86be05add5c10f60d4482d39333d9bf3f9a866d6eb84f8fa0d4e8b5828fd74c
-SHA512 (testdata-0.11.1.tar.gz) = e775be0e8a56a828a4b70a174c841b3d474dbd170d899c50343896b21e46c6ae20f017f905ad7b83e097031e8add2788a00b1c452aa22e159b1f3a4e72a47155
-SHA512 (third_party-0.11.1.tar.gz) = 720544bd722cbc6ef81db660786e4b022f156d05672b7d7ee6110d367272dcf22a35458f51e0d850df2f6fb368978c43fa4fff99763010360a8b5673d2e556ca
+SHA512 (jpegxl-0.10.4.tar.gz) = db713ec5627ce66750209b7a62345ba0fa74568bbf43627fe86053aa70295a9b7ba738dac34c5449bb258c99909a19416465a971447ebb28c69514c65f0b9295
+SHA512 (third_party-0.10.4.tar.gz) = c048e5c1892b92d2014411a1dc0013d281a22fd35e537f9107512ba5fa8318507463ff409cc33a7fc58562ea10d75aa122c1bb7d7da3ea4b271021e8faa887d9

update_third_party.sh

@@ -1,20 +1,18 @@
-VERSION=0.11.1
+VERSION=0.10.4
 
 git clone https://github.com/libjxl/libjxl
 cd libjxl/
 git checkout .
 git checkout v${VERSION}
 ./deps.sh
-rm -rvf third_party/brotli/
-rm -rvf third_party/googletest/
-rm -rvf third_party/HEVCSoftware/
-rm -rvf third_party/highway/
-rm -rvf third_party/lcms/
-rm -rvf third_party/libjpeg-turbo
-rm -rvf third_party/libpng/
-rm -rvf third_party/skcms/profiles/
-rm -rvf third_party/zlib
+rm -r third_party/brotli/
+rm -r third_party/googletest/
+rm -r third_party/HEVCSoftware/
+rm -r third_party/highway/
+rm -r third_party/lcms/
+rm -r third_party/libpng/
+rm -r third_party/skcms/profiles/
+rm -r third_party/zlib
 tar -zcf ../third_party-${VERSION}.tar.gz third_party/
-tar -zcf ../testdata-${VERSION}.tar.gz testdata/
 cd ..
 rm -rf libjxl/