component/imagemagick: version up 7.1.1-20, including security fixes.

component/imagemagick/allow_svg_in_limited_policy.patch

+--- ImageMagick-7.1.1-20.orig/config/policy-limited.xml	2023-10-08 23:05:13.000000000 +0200
++++ ImageMagick-7.1.1-20/config/policy-limited.xml	2023-10-10 09:33:34.880236626 +0200
+@@ -20,7 +20,7 @@
+   The primary objective of the limited security policy is to find a
+   middle ground between convenience and security. This policy involves the
+   deactivation of potentially hazardous functionalities, like specific coders
+-  such as SVG or HTTP. Furthermore, it establishes several constraints on
++  such as HTTP. Furthermore, it establishes several constraints on
+   the utilization of resources like memory, storage, and processing duration,
+   all of which are adjustable. This policy proves advantageous in situations
+   where there's a need to mitigate the potential threat of handling possibly
+@@ -85,7 +85,7 @@
+   <!-- Indirect reads are not permitted. -->
+   <policy domain="path" rights="none" pattern="@*"/>
+   <!-- These image types are security risks on read, but write is fine -->
+-  <policy domain="module" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/>
++  <policy domain="module" rights="write" pattern="{MSL,MVG,PS,URL,XPS}"/>
+   <!-- This policy sets the number of times to replace content of certain
+        memory buffers and temporary files before they are freed or deleted. -->
+   <!-- <policy domain="system" name="shred" value="1"/> -->

component/imagemagick/buildout.cfg

@@ -25,16 +25,21 @@ extends =
 [imagemagick]
 recipe = slapos.recipe.cmmi
 shared = true
-version = 7.0.2-10
+version = 7.1.1-20
 url = https://www.imagemagick.org/download/releases/ImageMagick-${:version}.tar.xz
-md5sum = e1cb23d9c10a8eff228ef30ee281711a
-pkg_config_depends = ${fontconfig:location}/lib/pkgconfig:${fontconfig:pkg_config_depends}:${lcms2:location}/lib/pkgconfig:${xz-utils:location}/lib/pkgconfig
+md5sum = 4ce5c6854c1f8ab6ce5571a9377b1f2f
+pkg_config_depends = ${fontconfig:location}/lib/pkgconfig:${fontconfig:pkg_config_depends}:${lcms2:location}/lib/pkgconfig:${libtiff:location}/lib/pkgconfig:${xz-utils:location}/lib/pkgconfig
+# Change export-filename to export-png for inkscape < 1.0
+pre-configure =
+  sed -i -e 's,--export-filename=,--export-png=,' config/delegates.xml.in
 configure-options =
   --disable-static
   --without-x
+  --with-frozenpaths
   --with-magick-plus-plus
   --disable-openmp
   --disable-opencl
+  --without-dmr
   --without-dps
   --without-djvu
   --without-fftw
@@ -43,6 +48,8 @@ configure-options =
   --with-fontconfig
   --without-gslib
   --without-gvc
+  --without-heic
+  --without-jxl
   --with-lcms
   --without-openjp2
   --without-lqr
@@ -50,17 +57,22 @@ configure-options =
   --without-openexr
   --without-pango
   --without-raqm
+  --without-raw
   --without-rsvg
+  --without-webp
   --without-wmf
+  --without-zip
+  --without-zstd
   --with-bzlib=${bzip2:location}
   --with-zlib=${zlib:location}
   --with-frozenpaths
+  --with-security-policy=limited
 patch-options = -p1
 patches =
-  ${:_profile_base_location_}/imagemagick-7.0.2-10-no-gsx-gsc-probe.patch#64898455d5175efedd1a7bef9f1f18b5
-  ${:_profile_base_location_}/safe_policy.patch#383c0392de7257c9dff7270973342914
+  ${:_profile_base_location_}/imagemagick-7.1.1-20-no-gsx-gsc-probe.patch#98762d1977e5bce2e12954818a671eb9
+  ${:_profile_base_location_}/allow_svg_in_limited_policy.patch#d79216fd31d974c0b7e6c1da12d50f22
 environment =
   PATH=${freetype:location}/bin:${ghostscript:location}/bin:${inkscape:location}/bin:${libxml2:location}/bin:${patch:location}/bin:${pkgconfig:location}/bin:${xz-utils:location}/bin:%(PATH)s
   PKG_CONFIG_PATH=${:pkg_config_depends}
-  CPPFLAGS=-I${bzip2:location}/include -I${zlib:location}/include -I${jbigkit:location}/include -I${libjpeg:location}/include -I${libtiff:location}/include -I${libtool:location}/include -I${libpng:location}/include -I${jasper:location}/include -I${freetype:location}/include
-  LDFLAGS=-L${bzip2:location}/lib -Wl,-rpath=${bzip2:location}/lib -L${zlib:location}/lib -Wl,-rpath=${zlib:location}/lib -L${jbigkit:location}/lib -Wl,-rpath=${jbigkit:location}/lib -L${libjpeg:location}/lib -Wl,-rpath=${libjpeg:location}/lib -L${libtiff:location}/lib -Wl,-rpath=${libtiff:location}/lib -L${libtool:location}/lib -Wl,-rpath=${libtool:location}/lib -L${libpng:location}/lib -Wl,-rpath=${libpng:location}/lib -L${jasper:location}/lib -Wl,-rpath=${jasper:location}/lib -L${freetype:location}/lib -Wl,-rpath=${freetype:location}/lib
+  CPPFLAGS=-I${bzip2:location}/include -I${zlib:location}/include -I${jbigkit:location}/include -I${libjpeg:location}/include -I${libtool:location}/include -I${libpng:location}/include -I${jasper:location}/include -I${freetype:location}/include
+  LDFLAGS=-L${bzip2:location}/lib -Wl,-rpath=${bzip2:location}/lib -L${zlib:location}/lib -Wl,-rpath=${zlib:location}/lib -L${jbigkit:location}/lib -Wl,-rpath=${jbigkit:location}/lib -L${libjpeg:location}/lib -Wl,-rpath=${libjpeg:location}/lib -L${libtool:location}/lib -Wl,-rpath=${libtool:location}/lib -L${libpng:location}/lib -Wl,-rpath=${libpng:location}/lib -L${jasper:location}/lib -Wl,-rpath=${jasper:location}/lib -L${freetype:location}/lib -Wl,-rpath=${freetype:location}/lib

component/imagemagick/imagemagick-7.0.2-10-no-gsx-gsc-probe.patch

---- ImageMagick-7.0.2-10/configure.ac.orig      2016-08-30 11:33:39.160279386 +0200
-+++ ImageMagick-7.0.2-10/configure.ac   2016-08-30 11:35:34.753290590 +0200
-@@ -3110,7 +3110,7 @@
- AC_PATH_PROG(MrSIDDecodeDelegate, "$MrSIDDecodeDelegateDefault", "$MrSIDDecodeDelegateDefault")
- AC_PATH_PROG(MVDelegate, "$MVDelegateDefault", "$MVDelegateDefault")
- AC_PATH_PROG(PCLDelegate, "$PCLDelegateDefault", "$PCLDelegateDefault")
--AC_PATH_PROGS(PSDelegate, gsx gsc "$PSDelegateDefault", "$PSDelegateDefault")
-+AC_PATH_PROGS(PSDelegate, "$PSDelegateDefault", "$PSDelegateDefault")
- AC_PATH_PROG(RMDelegate, "$RMDelegateDefault", "$RMDelegateDefault")
- AC_PATH_PROG(RSVGDecodeDelegate, "$RSVGDecodeDelegateDefault", "$RSVGDecodeDelegateDefault")
- AC_PATH_PROG(SVGDecodeDelegate, "$SVGDecodeDelegateDefault", "$SVGDecodeDelegateDefault")

component/imagemagick/imagemagick-7.1.1-20-no-gsx-gsc-probe.patch

+--- ImageMagick-7.1.1-20/configure.ac.orig	2023-10-08 23:05:13.000000000 +0200
++++ ImageMagick-7.1.1-20/configure.ac	2023-10-10 09:22:13.287693848 +0200
+@@ -3317,7 +3317,7 @@
+ AC_PATH_PROG([MrSIDDecodeDelegate],["$MrSIDDecodeDelegateDefault"],["$MrSIDDecodeDelegateDefault"])
+ AC_PATH_PROG([MVDelegate],["$MVDelegateDefault"],["$MVDelegateDefault"])
+ AC_PATH_PROG([PCLDelegate],["$PCLDelegateDefault"],["$PCLDelegateDefault"])
+-AC_PATH_PROGS([PSDelegate],[gsx gsc "$PSDelegateDefault"],["$PSDelegateDefault"])
++AC_PATH_PROGS([PSDelegate],["$PSDelegateDefault"],["$PSDelegateDefault"])
+ AC_PATH_PROG([RMDelegate],["$RMDelegateDefault"],["$RMDelegateDefault"])
+ AC_PATH_PROG([RSVGDecodeDelegate],["$RSVGDecodeDelegateDefault"],["$RSVGDecodeDelegateDefault"])
+ AC_PATH_PROG([SVGDecodeDelegate],["$SVGDecodeDelegateDefault"],["$SVGDecodeDelegateDefault"])

component/imagemagick/safe_policy.patch

---- ImageMagick-7.0.2-10/config/policy.xml.orig	2016-08-30 11:37:29.110253211 +0200
-+++ ImageMagick-7.0.2-10/config/policy.xml	2016-08-30 11:40:09.719555899 +0200
-@@ -50,19 +50,28 @@
- -->
- <policymap>
-   <!-- <policy domain="resource" name="temporary-path" value="/tmp"/> -->
--  <!-- <policy domain="resource" name="memory" value="2GiB"/> -->
--  <!-- <policy domain="resource" name="map" value="4GiB"/> -->
--  <!-- <policy domain="resource" name="width" value="10MP"/> -->
--  <!-- <policy domain="resource" name="height" value="10MP"/> -->
--  <!-- <policy domain="resource" name="area" value="1GB"/> -->
--  <!-- <policy domain="resource" name="disk" value="16EB"/> -->
--  <!-- <policy domain="resource" name="file" value="768"/> -->
--  <!-- <policy domain="resource" name="thread" value="4"/> -->
--  <!-- <policy domain="resource" name="throttle" value="0"/> -->
--  <!-- <policy domain="resource" name="time" value="3600"/> -->
--  <!-- <policy domain="system" name="precision" value="6"/> -->
--  <!-- <policy domain="coder" rights="none" pattern="MVG" /> -->
--  <!-- <policy domain="delegate" rights="none" pattern="HTTPS" /> -->
--  <!-- <policy domain="path" rights="none" pattern="@*" /> -->
-+  <policy domain="resource" name="memory" value="2GiB"/>
-+  <policy domain="resource" name="map" value="4GiB"/>
-+  <policy domain="resource" name="width" value="10MP"/>
-+  <policy domain="resource" name="height" value="10MP"/>
-+  <policy domain="resource" name="area" value="1GB"/>
-+  <policy domain="resource" name="disk" value="16EB"/>
-+  <policy domain="resource" name="file" value="768"/>
-+  <policy domain="resource" name="thread" value="4"/>
-+  <policy domain="resource" name="throttle" value="0"/>
-+  <policy domain="resource" name="time" value="3600"/>
-+  <policy domain="system" name="precision" value="6"/>
-+  <policy domain="coder" rights="none" pattern="MVG" />
-+  <policy domain="delegate" rights="none" pattern="HTTPS" />
-+  <policy domain="path" rights="none" pattern="@*" />
-   <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/>
-+  <policy domain="coder" rights="none" pattern="EPHEMERAL" />
-+  <policy domain="coder" rights="none" pattern="HTTPS" />
-+  <policy domain="coder" rights="none" pattern="MSL" />
-+  <policy domain="coder" rights="none" pattern="MVG" />
-+  <policy domain="coder" rights="none" pattern="PLT" />
-+  <policy domain="coder" rights="none" pattern="SHOW" />
-+  <policy domain="coder" rights="none" pattern="TEXT" />
-+  <policy domain="coder" rights="none" pattern="URL" />
-+  <policy domain="coder" rights="none" pattern="WIN" />
- </policymap>