download.lst                                                                   
    |   20 -
 external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1                 
    |   25 -
 external/lcms2/0017-Upgrade-Visual-studio-2017-15.8.patch.1                    
    |  172 ++++++++++
 external/lcms2/UnpackedTarball_lcms2.mk                                        
    |    2 
 external/libxml2/libxml2-android.patch                                         
    |   12 
 external/libxml2/libxml2-global-symbols.patch                                  
    |    4 
 external/mdnsresponder/UnpackedTarball_mDNSResponder.mk                        
    |    5 
 external/mdnsresponder/mDNSResponder_Win32_SOCKET.patch.1                      
    |   85 ----
 external/mdnsresponder/mDNSResponder_Win32_buildfix.patch.1                    
    |   16 
 external/poppler/StaticLibrary_poppler.mk                                      
    |    6 
 external/poppler/UnpackedTarball_poppler.mk                                    
    |   11 
 external/poppler/poppler-c++11.patch.1                                         
    |   31 +
 external/poppler/poppler-config.patch.1                                        
    |   12 
 
external/python3/0001-3.6-bpo-17239-Disable-external-entities-in-SAX-parse.patch.1
 |   59 +++
 external/python3/UnpackedTarball_python3.mk                                    
    |    1 
 postprocess/CustomTarget_signing.mk                                            
    |    2 
 postprocess/signing/signing.pl                                                 
    |    3 
 sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx                          
    |   38 +-
 sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx                          
    |   49 +-
 sdext/source/pdfimport/xpdfwrapper/pnghelper.cxx                               
    |    6 
 sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx                             
    |    4 
 solenv/bin/modules/installer.pm                                                
    |    2 
 solenv/bin/modules/installer/windows/msp.pm                                    
    |    2 
 23 files changed, 362 insertions(+), 205 deletions(-)

New commits:
commit 47e55ccd60c6701571dd71891fb092e1c537f89a
Author:     David Tardon <dtar...@redhat.com>
AuthorDate: Thu Mar 29 09:20:19 2018 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:40:56 2021 +0200

    upload openssl 1.0.2o
    
    Change-Id: Ib44570ff53d754d1d568378ef0dac4d4789f2042
    Reviewed-on: https://gerrit.libreoffice.org/52051
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: David Tardon <dtar...@redhat.com>

diff --git a/download.lst b/download.lst
index e826a49d6647..2a6a43bac53f 100644
--- a/download.lst
+++ b/download.lst
@@ -188,8 +188,8 @@ export OFFICEOTRON_SHA256SUM := 
f2443f27561af52324eee03a1892d9f569adc8db9e7bca55
 export OFFICEOTRON_JAR := 
8249374c274932a21846fa7629c2aa9b-officeotron-0.7.4-master.jar
 export OPENLDAP_SHA256SUM := 
cdd6cffdebcd95161a73305ec13fc7a78e9707b46ca9f84fb897cd5626df3824
 export OPENLDAP_TARBALL := openldap-2.4.45.tgz
-export OPENSSL_SHA256SUM := 
8c6ff15ec6b319b50788f42c7abc2890c08ba5a1cdcd3810eb9092deada37b0f
-export OPENSSL_TARBALL := openssl-1.0.2m.tar.gz
+export OPENSSL_SHA256SUM := 
ec3f5c9714ba0fd45cb4e087301eb1336c317e0d20b575a125050470e8089e4d
+export OPENSSL_TARBALL := openssl-1.0.2o.tar.gz
 export ORCUS_SHA256SUM := 
62e76de1fd3101e77118732b860354121b40a87bbb1ebfeb8203477fffac16e9
 export ORCUS_TARBALL := liborcus-0.13.3.tar.gz
 export OWNCLOUD_ANDROID_LIB_SHA256SUM := 
b18b3e3ef7fae6a79b62f2bb43cc47a5346b6330f6a383dc4be34439aca5e9fb
commit a3a6de809afb4ea2c58b0d8f05819612f421032a
Author:     Michael Stahl <michael.st...@cib.de>
AuthorDate: Wed Feb 20 15:23:11 2019 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:39:33 2021 +0200

    mDNSResponder: upgrade to release 878.200.35
    
    Apple can't afford the costly GPG licenses to sign releases apparently,
    but the sha256 matches some OpenWRT and FreshPorts repos...
    
    Fixes CVE-2015-7988.
    
    Removing windows build patches, fixed upstream (except for the last hunk
    of the SOCKET patch, but that is in code that is only used on MacOSX).
    
    Reviewed-on: https://gerrit.libreoffice.org/68092
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@cib.de>
    (cherry picked from commit 3a85c2db176db708c0ff9401c40858eb60e80f1e)
    Reviewed-on: https://gerrit.libreoffice.org/68139
    Reviewed-by: Thorsten Behrens <thorsten.behr...@cib.de>
    
    Change-Id: I9fdba5929badb75f995c66da0850d188780e7beb

diff --git a/download.lst b/download.lst
index d8c899a69cc5..e826a49d6647 100644
--- a/download.lst
+++ b/download.lst
@@ -164,8 +164,8 @@ export MARIADB_CONNECTOR_C_SHA256SUM := 
fd2f751dea049c1907735eb236aeace1d811d6a8
 export MARIADB_CONNECTOR_C_TARBALL := 
a233181e03d3c307668b4c722d881661-mariadb_client-2.0.0-src.tar.gz
 export MDDS_SHA256SUM := 
dcb8cd2425567a5a5ec164afea475bce57784bca3e352ad4cbdd3d1a7e08e5a1
 export MDDS_TARBALL := mdds-1.3.1.tar.bz2
-export MDNSRESPONDER_SHA256SUM := 
4737cb51378377e11d0edb7bcdd1bec79cbdaa7b27ea09c13e3006e58f8d92c0
-export MDNSRESPONDER_TARBALL := mDNSResponder-576.30.4.tar.gz
+export MDNSRESPONDER_SHA256SUM := 
e777b4d7dbf5eb1552cb80090ad1ede319067ab6e45e3990d68aabf6e8b3f5a0
+export MDNSRESPONDER_TARBALL := mDNSResponder-878.200.35.tar.gz
 export MSPUB_SHA256SUM := 
f0225f0ff03f6bec4847d7c2d8719a36cafc4b97a09e504b610372cc5b981c97
 export MSPUB_TARBALL := libmspub-0.1.3.tar.xz
 export MWAW_SHA256SUM := 
db55c728448f9c795cd71a0bb6043f6d4744e3e001b955a018a2c634981d5aea
diff --git a/external/mdnsresponder/UnpackedTarball_mDNSResponder.mk 
b/external/mdnsresponder/UnpackedTarball_mDNSResponder.mk
index 5b0140e4c149..9b436b2f077c 100644
--- a/external/mdnsresponder/UnpackedTarball_mDNSResponder.mk
+++ b/external/mdnsresponder/UnpackedTarball_mDNSResponder.mk
@@ -11,9 +11,4 @@ $(eval $(call 
gb_UnpackedTarball_UnpackedTarball,mDNSResponder))
 
 $(eval $(call 
gb_UnpackedTarball_set_tarball,mDNSResponder,$(MDNSRESPONDER_TARBALL)))
 
-$(eval $(call gb_UnpackedTarball_add_patches,mDNSResponder,\
-       external/mdnsresponder/mDNSResponder_Win32_SOCKET.patch.1 \
-       external/mdnsresponder/mDNSResponder_Win32_buildfix.patch.1 \
-))
-
 # vim: set noet sw=4 ts=4:
diff --git a/external/mdnsresponder/mDNSResponder_Win32_SOCKET.patch.1 
b/external/mdnsresponder/mDNSResponder_Win32_SOCKET.patch.1
deleted file mode 100644
index 9952f86e88ec..000000000000
--- a/external/mdnsresponder/mDNSResponder_Win32_SOCKET.patch.1
+++ /dev/null
@@ -1,85 +0,0 @@
-commit 77838efb0748689ee77007a92d9a01e03e6dbdb7
-Author:     Stephan Bergmann <sberg...@redhat.com>
-AuthorDate: Fri Nov 27 22:40:23 2015 +0100
-Commit:     Stephan Bergmann <sberg...@redhat.com>
-CommitDate: Sat Nov 28 14:00:07 2015 +0100
-
-    Use proper return type for DNSServiceRefSockFD
-    
-    ...which is e.g. unsigned long long for Windows 64-bit (and declaring the
-    function in dns_sd.h is not necessary, and the dnssd_sock_t typedef is not 
known
-    there)
-    
-    Change-Id: Iaa0eb03a83b76200204ba905313bcc27b5007b39
-
-diff --git a/mDNSShared/dns_sd.h b/mDNSShared/dns_sd.h
-index 31daaeb..faaa741 100644
---- a/mDNSShared/dns_sd.h
-+++ b/mDNSShared/dns_sd.h
-@@ -741,35 +741,6 @@ DNSServiceErrorType DNSSD_API DNSServiceGetProperty
- *
- 
*********************************************************************************************/
- 
--/* DNSServiceRefSockFD()
-- *
-- * Access underlying Unix domain socket for an initialized DNSServiceRef.
-- * The DNS Service Discovery implementation uses this socket to communicate 
between the client and
-- * the daemon. The application MUST NOT directly read from or write to this 
socket.
-- * Access to the socket is provided so that it can be used as a kqueue event 
source, a CFRunLoop
-- * event source, in a select() loop, etc. When the underlying event 
management subsystem (kqueue/
-- * select/CFRunLoop etc.) indicates to the client that data is available for 
reading on the
-- * socket, the client should call DNSServiceProcessResult(), which will 
extract the daemon's
-- * reply from the socket, and pass it to the appropriate application 
callback. By using a run
-- * loop or select(), results from the daemon can be processed asynchronously. 
Alternatively,
-- * a client can choose to fork a thread and have it loop calling 
"DNSServiceProcessResult(ref);"
-- * If DNSServiceProcessResult() is called when no data is available for 
reading on the socket, it
-- * will block until data does become available, and then process the data and 
return to the caller.
-- * The application is reponsible for checking the return value of 
DNSServiceProcessResult() to determine
-- * if the socket is valid and if it should continue to process data on the 
socket.
-- * When data arrives on the socket, the client is responsible for calling 
DNSServiceProcessResult(ref)
-- * in a timely fashion -- if the client allows a large backlog of data to 
build up the daemon
-- * may terminate the connection.
-- *
-- * sdRef:           A DNSServiceRef initialized by any of the DNSService 
calls.
-- *
-- * return value:    The DNSServiceRef's underlying socket descriptor, or -1 on
-- *                  error.
-- */
--
--int DNSSD_API DNSServiceRefSockFD(DNSServiceRef sdRef);
--
--
- /* DNSServiceProcessResult()
-  *
-  * Read a reply from the daemon, calling the appropriate application 
callback. This call will
-diff --git a/mDNSShared/dnssd_clientstub.c b/mDNSShared/dnssd_clientstub.c
-index c38197c..c6b50a2 100644
---- a/mDNSShared/dnssd_clientstub.c
-+++ b/mDNSShared/dnssd_clientstub.c
-@@ -799,7 +799,7 @@ cleanup:
-     return err;
- }
- 
--int DNSSD_API DNSServiceRefSockFD(DNSServiceRef sdRef)
-+dnssd_sock_t DNSSD_API DNSServiceRefSockFD(DNSServiceRef sdRef)
- {
-     if (!sdRef) { syslog(LOG_WARNING, "dnssd_clientstub DNSServiceRefSockFD 
called with NULL DNSServiceRef"); return dnssd_InvalidSocket; }
- 
-@@ -816,7 +816,7 @@ int DNSSD_API DNSServiceRefSockFD(DNSServiceRef sdRef)
-         return dnssd_InvalidSocket;
-     }
- 
--    return (int) sdRef->sockfd;
-+    return sdRef->sockfd;
- }
- 
- #if _DNS_SD_LIBDISPATCH
-@@ -2025,7 +2025,7 @@ DNSServiceErrorType DNSSD_API DNSServiceSetDispatchQueue
-     dispatch_queue_t queue
- )
- {
--    int dnssd_fd  = DNSServiceRefSockFD(service);
-+    dnssd_sock_t dnssd_fd  = DNSServiceRefSockFD(service);
-     if (dnssd_fd == dnssd_InvalidSocket) return kDNSServiceErr_BadParam;
-     if (!queue)
-     {
diff --git a/external/mdnsresponder/mDNSResponder_Win32_buildfix.patch.1 
b/external/mdnsresponder/mDNSResponder_Win32_buildfix.patch.1
deleted file mode 100644
index 9f5c06260b12..000000000000
--- a/external/mdnsresponder/mDNSResponder_Win32_buildfix.patch.1
+++ /dev/null
@@ -1,16 +0,0 @@
---- mDNSResponder/mDNSShared/dnssd_clientstub.c.orig   2015-11-30 
16:36:08.081554188 +0100
-+++ mDNSResponder/mDNSShared/dnssd_clientstub.c        2015-11-30 
16:38:35.749542735 +0100
-@@ -579,7 +579,12 @@
-             else 
-             {
-                 syslog(LOG_WARNING, "dnssd_clientstub ConnectToServer: 
connect() failed path:%s Socket:%d Err:%d Errno:%d %s", 
--                       uds_serverpath, sdr->sockfd, err, dnssd_errno, 
dnssd_strerror(dnssd_errno));
-+#if defined(USE_TCP_LOOPBACK)
-+                       MDNS_TCP_SERVERADDR,
-+#else
-+                       uds_serverpath,
-+#endif
-+                       sdr->sockfd, err, dnssd_errno, 
dnssd_strerror(dnssd_errno));
-                 dnssd_close(sdr->sockfd); 
-                 FreeDNSServiceOp(sdr); 
-                 return kDNSServiceErr_ServiceNotRunning; 
commit df21d29a51f24dc8b215ccb5ea9a634b530ee1db
Author:     Michael Stahl <michael.st...@cib.de>
AuthorDate: Mon Jan 14 15:12:24 2019 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:38:30 2021 +0200

    poppler: upgrade to release 0.73.0
    
    Reviewed-on: https://gerrit.libreoffice.org/66306
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@cib.de>
    (cherry picked from commit 0609ea4fc27f34367716bf41c0cdaa7785aed9da)
    Reviewed-on: https://gerrit.libreoffice.org/66369
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
    
    Change-Id: If20998f8565b5534a96b3f29ccec572273edca1d

diff --git a/download.lst b/download.lst
index fe0339d4ca36..d8c899a69cc5 100644
--- a/download.lst
+++ b/download.lst
@@ -202,8 +202,8 @@ export PIXMAN_SHA256SUM := 
21b6b249b51c6800dc9553b65106e1e37d0e25df942c90531d4c3
 export PIXMAN_TARBALL := e80ebae4da01e77f68744319f01d52a3-pixman-0.34.0.tar.gz
 export LIBPNG_SHA256SUM := 
2f1e960d92ce3b3abd03d06dfec9637dfbd22febf107a536b44f7a47c60659f6
 export LIBPNG_TARBALL := libpng-1.6.34.tar.xz
-export POPPLER_SHA256SUM := 
2c096431adfb74bc2f53be466889b7646e1b599f28fa036094f3f7235cc9eae7
-export POPPLER_TARBALL := poppler-0.66.0.tar.xz
+export POPPLER_SHA256SUM := 
e44b5543903128884ba4538c2a97d3bcc8889e97ffacc4636112101f0238db03
+export POPPLER_TARBALL := poppler-0.73.0.tar.xz
 export POSTGRESQL_SHA256SUM := 
db61d498105a7d5fe46185e67ac830c878cdd7dc1f82a87f06b842217924c461
 export POSTGRESQL_TARBALL := 
c0b4799ea9850eae3ead14f0a60e9418-postgresql-9.2.1.tar.bz2
 export PYTHON_SHA256SUM := 
063d2c3b0402d6191b90731e0f735c64830e7522348aeb7ed382a83165d45009
diff --git a/external/poppler/StaticLibrary_poppler.mk 
b/external/poppler/StaticLibrary_poppler.mk
index f145b7ae9c39..aa5ed693eb22 100644
--- a/external/poppler/StaticLibrary_poppler.mk
+++ b/external/poppler/StaticLibrary_poppler.mk
@@ -53,11 +53,8 @@ $(eval $(call 
gb_StaticLibrary_set_generated_cxx_suffix,poppler,cc))
 
 $(eval $(call gb_StaticLibrary_add_generated_exception_objects,poppler,\
        UnpackedTarball/poppler/goo/gfile \
-       UnpackedTarball/poppler/goo/gmempp \
-       UnpackedTarball/poppler/goo/GooList \
        UnpackedTarball/poppler/goo/GooTimer \
        UnpackedTarball/poppler/goo/GooString \
-       UnpackedTarball/poppler/goo/gmem \
        UnpackedTarball/poppler/goo/FixedPoint \
        UnpackedTarball/poppler/goo/NetPBMWriter \
        UnpackedTarball/poppler/goo/PNGWriter \
@@ -80,6 +77,7 @@ $(eval $(call 
gb_StaticLibrary_add_generated_exception_objects,poppler,\
        UnpackedTarball/poppler/poppler/BuiltinFontTables \
        UnpackedTarball/poppler/poppler/CachedFile \
        UnpackedTarball/poppler/poppler/Catalog \
+       UnpackedTarball/poppler/poppler/CertificateInfo \
        UnpackedTarball/poppler/poppler/CharCodeToUnicode \
        UnpackedTarball/poppler/poppler/CMap \
        UnpackedTarball/poppler/poppler/DateInfo \
@@ -114,7 +112,6 @@ $(eval $(call 
gb_StaticLibrary_add_generated_exception_objects,poppler,\
        UnpackedTarball/poppler/poppler/PDFDoc \
        UnpackedTarball/poppler/poppler/PDFDocEncoding \
        UnpackedTarball/poppler/poppler/PDFDocFactory \
-       UnpackedTarball/poppler/poppler/PopplerCache \
        UnpackedTarball/poppler/poppler/ProfileData \
        UnpackedTarball/poppler/poppler/PreScanOutputDev \
        UnpackedTarball/poppler/poppler/PSTokenizer \
@@ -135,7 +132,6 @@ $(eval $(call 
gb_StaticLibrary_add_generated_exception_objects,poppler,\
        UnpackedTarball/poppler/poppler/StdinPDFDocBuilder \
        UnpackedTarball/poppler/poppler/Sound \
        UnpackedTarball/poppler/poppler/ViewerPreferences \
-       UnpackedTarball/poppler/poppler/XpdfPluginAPI \
        UnpackedTarball/poppler/poppler/Movie \
        UnpackedTarball/poppler/poppler/Rendition \
        UnpackedTarball/poppler/poppler/DCTStream \
diff --git a/external/poppler/UnpackedTarball_poppler.mk 
b/external/poppler/UnpackedTarball_poppler.mk
index 68fd06d9403b..5b91e1628ba6 100644
--- a/external/poppler/UnpackedTarball_poppler.mk
+++ b/external/poppler/UnpackedTarball_poppler.mk
@@ -13,6 +13,17 @@ $(eval $(call 
gb_UnpackedTarball_set_tarball,poppler,$(POPPLER_TARBALL),,poppler
 
 $(eval $(call gb_UnpackedTarball_add_patches,poppler,\
        external/poppler/poppler-config.patch.1 \
+       external/poppler/poppler-c++11.patch.1 \
 ))
 
+# std::make_unique is only available in C++14
+# use "env -i" to avoid Cygwin "environment is too large for exec"
+# Mac OS X sed says "sed: RE error: illegal byte sequence"; Apple clang should
+# be happy with std::make_unique so just skip it
+ifneq ($(OS_FOR_BUILD),MACOSX)
+$(eval $(call gb_UnpackedTarball_set_post_action,poppler,\
+       env -i PATH="$(PATH)" $(FIND) . -name '*.cc' -exec sed -i -e 
's/std::make_unique/o3tl::make_unique/' {} \\; \
+))
+endif
+
 # vim: set noet sw=4 ts=4:
diff --git a/external/poppler/poppler-c++11.patch.1 
b/external/poppler/poppler-c++11.patch.1
new file mode 100644
index 000000000000..5a4d1a24e2e2
--- /dev/null
+++ b/external/poppler/poppler-c++11.patch.1
@@ -0,0 +1,31 @@
+remove usage of newfangled C++ that baseline toolchains don't support
+
+--- poppler/goo/gfile.cc.orig  2019-01-16 11:02:21.112911552 +0100
++++ poppler/goo/gfile.cc       2019-01-16 11:01:33.125975178 +0100
+@@ -67,7 +67,7 @@
+ 
+ #ifndef _WIN32
+ 
+-using namespace std::string_literals;
++//using namespace std::string_literals;
+ 
+ namespace {
+ 
+@@ -366,7 +366,7 @@
+   }
+ #else
+   // First try to atomically open the file with CLOEXEC
+-  const std::string modeStr = mode + "e"s;
++  const std::string modeStr = mode + std::string("e");
+   FILE *file = fopen(path, modeStr.c_str());
+   if (file != nullptr)
+     return file;
+--- poppler/goo/gmem.h.orig    2019-01-16 11:25:28.161920038 +0100
++++ poppler/goo/gmem.h 2019-01-16 11:25:53.756882295 +0100
+@@ -177,4 +177,6 @@
+   return std::strncpy(r, s, n);
+ }
+ 
++#include <o3tl/make_unique.hxx>
++
+ #endif // GMEM_H
diff --git a/external/poppler/poppler-config.patch.1 
b/external/poppler/poppler-config.patch.1
index 5328e680e2f2..e312573f1ff3 100644
--- a/external/poppler/poppler-config.patch.1
+++ b/external/poppler/poppler-config.patch.1
@@ -195,7 +195,7 @@ index 0fbd336a..451213f8 100644
 +#define PACKAGE_NAME "poppler"
 +
 +/* Define to the full name and version of this package. */
-+#define PACKAGE_STRING "poppler 0.66.0"
++#define PACKAGE_STRING "poppler 0.73.0"
 +
 +/* Define to the one symbol short name of this package. */
 +#define PACKAGE_TARNAME "poppler"
@@ -204,7 +204,7 @@ index 0fbd336a..451213f8 100644
 +#define PACKAGE_URL ""
 +
 +/* Define to the version of this package. */
-+#define PACKAGE_VERSION "0.66.0"
++#define PACKAGE_VERSION "0.73.0"
 +
 +/* Poppler data dir */
 +#define POPPLER_DATADIR "/usr/local/share/poppler"
@@ -228,7 +228,7 @@ index 0fbd336a..451213f8 100644
 +/* #undef USE_FLOAT */
 +
 +/* Version number of package */
-+#define VERSION "0.66.0"
++#define VERSION "0.73.0"
 +
 +#if defined(__APPLE__)
 +#elif defined (_WIN32)
@@ -304,7 +304,7 @@ index 0fbd336a..451213f8 100644
 +
 +/* Defines the poppler version. */
 +#ifndef POPPLER_VERSION
-+#define POPPLER_VERSION "0.66.0"
++#define POPPLER_VERSION "0.73.0"
 +#endif
 +
 +/* Enable multithreading support. */
@@ -466,9 +466,9 @@ index 0fbd336a..451213f8 100644
 +
 +#include "poppler-global.h"
 +
-+#define POPPLER_VERSION "0.66.0"
++#define POPPLER_VERSION "0.73.0"
 +#define POPPLER_VERSION_MAJOR 0
-+#define POPPLER_VERSION_MINOR 66
++#define POPPLER_VERSION_MINOR 73
 +#define POPPLER_VERSION_MICRO 0
 +
 +namespace poppler
diff --git a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx 
b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
index 95d8befdc55b..ced1a653a494 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
@@ -28,7 +28,9 @@
 # pragma GCC diagnostic ignored "-Wundef"
 # pragma GCC diagnostic ignored "-Wunused-parameter"
 #elif defined _MSC_VER
-#pragma warning(push, 1)
+#pragma warning(push)
+#pragma warning(disable : 4100) // unreferenced formal parameter
+#pragma warning(disable : 4310) // cast truncates constant value
 #endif
 
 #include <GfxState.h>
commit e3c8459002379aca7332eb4f5734d95078657bc7
Author:     Michael Stahl <michael.st...@cib.de>
AuthorDate: Mon Jan 14 15:08:42 2019 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:37:06 2021 +0200

    sdext: fix build with poppler 0.73
    
    ... which has removed Guchar, Gushort, Guint, Gulong...
    
    Change-Id: Ia54ad378031f167f6779f6ffe574b85c1e72f26d
    Reviewed-on: https://gerrit.libreoffice.org/66305
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@cib.de>
    (cherry picked from commit 50d371ae08c66648d9f32f633b2245e1746e2bb6)
    Reviewed-on: https://gerrit.libreoffice.org/66363
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>

diff --git a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx 
b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
index eb6815399f42..cd6a5b65e30a 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
@@ -310,7 +310,7 @@ void writePpm_( OutputBuffer&     o_rOutputBuf,
     o_rOutputBuf.resize(header_size);
 
     // initialize stream
-    Guchar *p;
+    unsigned char *p;
     GfxRGB rgb;
     std::unique_ptr<ImageStream> imgStr(
         new ImageStream(str,
@@ -415,7 +415,7 @@ void writeImage_( OutputBuffer&     o_rOutputBuf,
                 oneColor = { byteToCol( 0xff ), byteToCol( 0xff ), byteToCol( 
0xff ) };
         if( colorMap->getColorSpace()->getMode() == csIndexed || 
colorMap->getColorSpace()->getMode() == csDeviceGray )
         {
-            Guchar nIndex = 0;
+            unsigned char nIndex = 0;
             colorMap->getRGB( &nIndex, &zeroColor );
             nIndex = 1;
             colorMap->getRGB( &nIndex, &oneColor );
diff --git a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx 
b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
index 4e2d303b943b..95d8befdc55b 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
@@ -289,9 +289,13 @@ extern FILE* g_binary_out;
 
 // note: if you ever change Output_t, please keep in mind that the current code
 // relies on it being of 8 bit size
-typedef Guchar Output_t;
+typedef unsigned char Output_t;
 typedef std::vector< Output_t > OutputBuffer;
 
+#if !POPPLER_CHECK_VERSION(0, 73, 0)
+static_assert(std::is_same<Guchar, unsigned char>::value, "unexpected 
typedef");
+#endif
+
 #endif // INCLUDED_SDEXT_SOURCE_PDFIMPORT_XPDFWRAPPER_PDFIOUTDEV_GPL_HXX
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sdext/source/pdfimport/xpdfwrapper/pnghelper.cxx 
b/sdext/source/pdfimport/xpdfwrapper/pnghelper.cxx
index 3caed120648e..be778708a54f 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pnghelper.cxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pnghelper.cxx
@@ -242,7 +242,7 @@ void PngHelper::createPng( OutputBuffer& o_rOutputBuf,
     appendIHDR( o_rOutputBuf, width, height, 8, 6 ); // RGBA image
 
     // initialize stream
-    Guchar *p, *pm;
+    unsigned char *p, *pm;
     GfxRGB rgb;
     GfxGray alpha;
     ImageStream* imgStr =
@@ -328,7 +328,7 @@ void PngHelper::createPng( OutputBuffer& o_rOutputBuf,
     appendIHDR( o_rOutputBuf, width, height, 8, 6 ); // RGBA image
 
     // initialize stream
-    Guchar *p;
+    unsigned char *p;
     GfxRGB rgb;
     ImageStream* imgStr =
         new ImageStream(str,
@@ -374,7 +374,7 @@ void PngHelper::createPng( OutputBuffer& o_rOutputBuf,
     {
         for( int x = 0; x < maskWidth; ++x )
         {
-            Guchar aPixel = 0;
+            unsigned char aPixel = 0;
             imgStrMask->getPixel( &aPixel );
             int nIndex = (y*height/maskHeight) * (width*4+1) + // mapped line
                          (x*width/maskWidth)*4 + 1  + 3        // mapped column
commit 5e51644a32a1196bbfed6bedd11228d094f6b908
Author:     Andreas Sturmlechner <ast...@gentoo.org>
AuthorDate: Tue Jan 8 11:24:40 2019 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:35:28 2021 +0200

    Fix build with poppler-0.72
    
    Change-Id: I0664d1b39e97b7555c0a3cba442db52b84f37134
    Reviewed-on: https://gerrit.libreoffice.org/65960
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@cib.de>
    (cherry picked from commit 65a6c9ae4791188ffcecf489073cf38873ce5e17)
    Reviewed-on: https://gerrit.libreoffice.org/66376
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>

diff --git a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx 
b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
index e7c021e2ed49..eb6815399f42 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
@@ -569,7 +569,11 @@ void PDFOutDev::processLink(Link* link, Catalog*)
     LinkAction* pAction = link->getAction();
     if (pAction && pAction->getKind() == actionURI)
     {
+#if POPPLER_CHECK_VERSION(0, 72, 0)
+        const char* pURI = static_cast<LinkURI*>(pAction)->getURI()->c_str();
+#else
         const char* pURI = 
static_cast<LinkURI*>(pAction)->getURI()->getCString();
+#endif
 
         std::vector<char> aEsc( lcl_escapeLineFeeds(pURI) );
 
@@ -771,7 +775,11 @@ void PDFOutDev::updateFont(GfxState *state)
 
             aFont = it->second;
 
+#if POPPLER_CHECK_VERSION(0, 72, 0)
+            std::vector<char> aEsc( 
lcl_escapeLineFeeds(aFont.familyName.c_str()) );
+#else
             std::vector<char> aEsc( 
lcl_escapeLineFeeds(aFont.familyName.getCString()) );
+#endif
             printf( " %d %d %d %d %f %d %s",
                     aFont.isEmbedded,
                     aFont.isBold,
commit ea023ece3a5c4d86a7f43619804dd5e0d671e62e
Author:     Aleksei Nikiforov <darktemp...@basealt.ru>
AuthorDate: Thu Nov 22 17:54:00 2018 +0300
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:34:53 2021 +0200

    Fix build with poppler 0.71
    
    Change-Id: I470ece9dc4766e10e1ccb5e99b25a8d8cc4cbf38
    Reviewed-on: https://gerrit.libreoffice.org/63860
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
    (cherry picked from commit 8ff41a26caf51544699863c89598d37d93dc1b21)
    Reviewed-on: https://gerrit.libreoffice.org/66375
    Reviewed-by: Aleksei Nikiforov <darktemp...@basealt.ru>
    Reviewed-by: Michael Stahl <michael.st...@cib.de>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>

diff --git a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx 
b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
index abde6a8c9936..e7c021e2ed49 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
@@ -592,7 +592,11 @@ void PDFOutDev::restoreState(GfxState*)
     printf( "restoreState\n" );
 }
 
+#if POPPLER_CHECK_VERSION(0, 71, 0)
+void PDFOutDev::setDefaultCTM(const double *pMat)
+#else
 void PDFOutDev::setDefaultCTM(double *pMat)
+#endif
 {
     assert(pMat);
 
diff --git a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx 
b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
index 97c602dafc7c..4e2d303b943b 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
@@ -172,7 +172,11 @@ namespace pdfi
         //----- initialization and control
 
         // Set default transform matrix.
+#if POPPLER_CHECK_VERSION(0, 71, 0)
+        virtual void setDefaultCTM(const double *ctm) override;
+#else
         virtual void setDefaultCTM(double *ctm) override;
+#endif
 
         // Start a page.
         virtual void startPage(int pageNum, GfxState *state
diff --git a/sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx 
b/sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx
index 16db05afe870..cd559cab08ee 100644
--- a/sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx
+++ b/sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx
@@ -69,7 +69,7 @@ int main(int argc, char **argv)
 
     // read config file
     globalParams = new GlobalParams();
-    globalParams->setErrQuiet(gTrue);
+    globalParams->setErrQuiet(true);
 #if defined(_MSC_VER)
     globalParams->setupBaseFonts(nullptr);
 #endif
@@ -143,7 +143,7 @@ int main(int argc, char **argv)
                 i,
                 PDFI_OUTDEV_RESOLUTION,
                 PDFI_OUTDEV_RESOLUTION,
-                0, gTrue, gTrue, gTrue);
+                0, true, true, true);
         rDoc.processLinks(&aOutDev, i);
     }
 
commit 6cdd358a09cdf1b2424ecaa70662094cd89e8dc2
Author:     Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Tue Nov 20 08:45:38 2018 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:34:22 2021 +0200

    poppler dropped GBool since 0.71
    
    See 
https://lists.freedesktop.org/archives/libreoffice/2018-November/081410.html
    
    Change-Id: I258e08894486a925bed50a3a4232b6e805af6784
    Reviewed-on: https://gerrit.libreoffice.org/63625
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
    (cherry picked from commit 5e8bdd9203dd642111c62a6668ee665a20d4ba19)
    Reviewed-on: https://gerrit.libreoffice.org/66374
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>

diff --git a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx 
b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
index 9618e5b2a28f..abde6a8c9936 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
@@ -528,7 +528,7 @@ void PDFOutDev::printPath( GfxPath* pPath )
 PDFOutDev::PDFOutDev( PDFDoc* pDoc ) :
     m_pDoc( pDoc ),
     m_aFontMap(),
-    m_pUtf8Map( new UnicodeMap("UTF-8", gTrue, &mapUTF8) ),
+    m_pUtf8Map( new UnicodeMap("UTF-8", true, &mapUTF8) ),
     m_bSkipImages(false)
 {
 }
@@ -953,11 +953,11 @@ void PDFOutDev::endTextObject(GfxState*)
 }
 
 void PDFOutDev::drawImageMask(GfxState* pState, Object*, Stream* str,
-                              int width, int height, GBool invert,
+                              int width, int height, poppler_bool invert,
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                              GBool /*interpolate*/,
+                              poppler_bool /*interpolate*/,
 #endif
-                              GBool /*inlineImg*/ )
+                              poppler_bool /*inlineImg*/ )
 {
     if (m_bSkipImages)
         return;
@@ -986,9 +986,9 @@ void PDFOutDev::drawImageMask(GfxState* pState, Object*, 
Stream* str,
 void PDFOutDev::drawImage(GfxState*, Object*, Stream* str,
                           int width, int height, GfxImageColorMap* colorMap,
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                          GBool /*interpolate*/,
+                          poppler_bool /*interpolate*/,
 #endif
-                          int* maskColors, GBool /*inlineImg*/ )
+                          int* maskColors, poppler_bool /*inlineImg*/ )
 {
     if (m_bSkipImages)
         return;
@@ -1037,13 +1037,13 @@ void PDFOutDev::drawMaskedImage(GfxState*, Object*, 
Stream* str,
                                 int width, int height,
                                 GfxImageColorMap* colorMap,
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                                GBool /*interpolate*/,
+                                poppler_bool /*interpolate*/,
 #endif
                                 Stream* maskStr,
                                 int maskWidth, int maskHeight,
-                                GBool maskInvert
+                                poppler_bool maskInvert
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                                , GBool /*maskInterpolate*/
+                                , poppler_bool /*maskInterpolate*/
 #endif
                                )
 {
@@ -1059,13 +1059,13 @@ void PDFOutDev::drawSoftMaskedImage(GfxState*, Object*, 
Stream* str,
                                     int width, int height,
                                     GfxImageColorMap* colorMap,
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                                    GBool /*interpolate*/,
+                                    poppler_bool /*interpolate*/,
 #endif
                                     Stream* maskStr,
                                     int maskWidth, int maskHeight,
                                     GfxImageColorMap* maskColorMap
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                                    , GBool /*maskInterpolate*/
+                                    , poppler_bool /*maskInterpolate*/
 #endif
                                    )
 {
diff --git a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx 
b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
index 2a6268c0ba1d..97c602dafc7c 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.hxx
@@ -129,6 +129,13 @@ namespace pdfi
         { return const_cast<GooString &>(familyName); }
     };
 
+    // Versions before 0.15 defined GBool as int; 0.15 redefined it as bool; 
0.71 dropped GBool
+#if POPPLER_VERSION_MAJOR == 0 && POPPLER_VERSION_MINOR < 71
+    typedef GBool poppler_bool;
+#else
+    typedef bool poppler_bool;
+#endif
+
     class PDFOutDev : public OutputDev
     {
         // not owned by this class
@@ -150,17 +157,17 @@ namespace pdfi
 
         // Does this device use upside-down coordinates?
         // (Upside-down means (0,0) is the top left corner of the page.)
-        virtual GBool upsideDown() override { return gTrue; }
+        virtual poppler_bool upsideDown() override { return true; }
 
         // Does this device use drawChar() or drawString()?
-        virtual GBool useDrawChar() override { return gTrue; }
+        virtual poppler_bool useDrawChar() override { return true; }
 
         // Does this device use beginType3Char/endType3Char?  Otherwise,
         // text in Type 3 fonts will be drawn with drawChar/drawString.
-        virtual GBool interpretType3Chars() override { return gFalse; }
+        virtual poppler_bool interpretType3Chars() override { return false; }
 
         // Does this device need non-text content?
-        virtual GBool needNonText() override { return gTrue; }
+        virtual poppler_bool needNonText() override { return true; }
 
         //----- initialization and control
 
@@ -232,40 +239,40 @@ namespace pdfi
 
         //----- image drawing
         virtual void drawImageMask(GfxState *state, Object *ref, Stream *str,
-                                   int width, int height, GBool invert,
+                                   int width, int height, poppler_bool invert,
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                                   GBool interpolate,
+                                   poppler_bool interpolate,
 #endif
-                                   GBool inlineImg) override;
+                                   poppler_bool inlineImg) override;
         virtual void drawImage(GfxState *state, Object *ref, Stream *str,
                                int width, int height, GfxImageColorMap 
*colorMap,
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                               GBool interpolate,
+                               poppler_bool interpolate,
 #endif
-                               int *maskColors, GBool inlineImg) override;
+                               int *maskColors, poppler_bool inlineImg) 
override;
         virtual void drawMaskedImage(GfxState *state, Object *ref, Stream *str,
                                      int width, int height,
                                      GfxImageColorMap *colorMap,
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                                     GBool interpolate,
+                                     poppler_bool interpolate,
 #endif
                                      Stream *maskStr, int maskWidth, int 
maskHeight,
-                                     GBool maskInvert
+                                     poppler_bool maskInvert
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                                     , GBool maskInterpolate
+                                     , poppler_bool maskInterpolate
 #endif
                                     ) override;
         virtual void drawSoftMaskedImage(GfxState *state, Object *ref, Stream 
*str,
                                          int width, int height,
                                          GfxImageColorMap *colorMap,
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                                         GBool interpolate,
+                                         poppler_bool interpolate,
 #endif
                                          Stream *maskStr,
                                          int maskWidth, int maskHeight,
                                          GfxImageColorMap *maskColorMap
 #if POPPLER_CHECK_VERSION(0, 12, 0)
-                                         , GBool maskInterpolate
+                                         , poppler_bool maskInterpolate
 #endif
                                         ) override;
 
commit 67de1b2f989f1fd2c908a86f1a6de6690930e903
Author:     Michael Stahl <michael.st...@cib.de>
AuthorDate: Mon Jan 14 17:33:37 2019 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:27:17 2021 +0200

    python3: add patch bpo-17239: Disable external entities in SAX parser
    
    Change-Id: I44e969d8d3a8fe6b6426d61a1cbe83154c8518dd
    Reviewed-on: https://gerrit.libreoffice.org/66329
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@cib.de>
    (cherry picked from commit a57dd8eba9c0799dd42eb547a37622bce8fdb0b3)
    Reviewed-on: https://gerrit.libreoffice.org/66370
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>

diff --git 
a/external/python3/0001-3.6-bpo-17239-Disable-external-entities-in-SAX-parse.patch.1
 
b/external/python3/0001-3.6-bpo-17239-Disable-external-entities-in-SAX-parse.patch.1
new file mode 100644
index 000000000000..489e5d0e89ee
--- /dev/null
+++ 
b/external/python3/0001-3.6-bpo-17239-Disable-external-entities-in-SAX-parse.patch.1
@@ -0,0 +1,59 @@
+From 582d188e6e3487180891f1fc457a80dec8be26a8 Mon Sep 17 00:00:00 2001
+From: Christian Heimes <christ...@python.org>
+Date: Mon, 24 Sep 2018 14:38:31 +0200
+Subject: [PATCH] [3.6] bpo-17239: Disable external entities in SAX parser
+ (GH-9217) (GH-9512)
+
+The SAX parser no longer processes general external entities by default
+to increase security. Before, the parser created network connections
+to fetch remote files or loaded local files from the file system for DTD
+and entities.
+
+Signed-off-by: Christian Heimes <christ...@python.org>
+
+https://bugs.python.org/issue17239.
+(cherry picked from commit 17b1d5d4e36aa57a9b25a0e694affbd1ee637e45)
+
+Co-authored-by: Christian Heimes <christ...@python.org>
+
+
+
+https://bugs.python.org/issue17239
+---
+ Doc/library/xml.dom.pulldom.rst               | 14 +++++
+ Doc/library/xml.rst                           |  6 +-
+ Doc/library/xml.sax.rst                       |  8 +++
+ Doc/whatsnew/3.6.rst                          | 18 +++++-
+ Lib/test/test_pulldom.py                      |  7 +++
+ Lib/test/test_sax.py                          | 60 ++++++++++++++++++-
+ Lib/test/test_xml_etree.py                    | 13 ++++
+ Lib/xml/sax/expatreader.py                    |  2 +-
+ .../2018-09-11-18-30-55.bpo-17239.kOpwK2.rst  |  3 +
+ 9 files changed, 125 insertions(+), 6 deletions(-)
+ create mode 100644 
Misc/NEWS.d/next/Security/2018-09-11-18-30-55.bpo-17239.kOpwK2.rst
+
+diff --git a/Lib/xml/sax/expatreader.py b/Lib/xml/sax/expatreader.py
+index 421358fa5b..5066ffc2fa 100644
+--- a/Lib/xml/sax/expatreader.py
++++ b/Lib/xml/sax/expatreader.py
+@@ -95,7 +95,7 @@ class ExpatParser(xmlreader.IncrementalParser, 
xmlreader.Locator):
+         self._lex_handler_prop = None
+         self._parsing = 0
+         self._entity_stack = []
+-        self._external_ges = 1
++        self._external_ges = 0
+         self._interning = None
+ 
+     # XMLReader methods
+diff --git 
a/Misc/NEWS.d/next/Security/2018-09-11-18-30-55.bpo-17239.kOpwK2.rst 
b/Misc/NEWS.d/next/Security/2018-09-11-18-30-55.bpo-17239.kOpwK2.rst
+new file mode 100644
+index 0000000000..8dd0fe8c1b
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2018-09-11-18-30-55.bpo-17239.kOpwK2.rst
+@@ -0,0 +1,3 @@
++The xml.sax and xml.dom.minidom parsers no longer processes external
++entities by default. External DTD and ENTITY declarations no longer
++load files or create network connections.
+-- 
+2.20.1
+
diff --git a/external/python3/UnpackedTarball_python3.mk 
b/external/python3/UnpackedTarball_python3.mk
index 35d6e643a1b0..ec1bdabe4fdd 100644
--- a/external/python3/UnpackedTarball_python3.mk
+++ b/external/python3/UnpackedTarball_python3.mk
@@ -26,6 +26,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,python3,\
        external/python3/python-3.3.5-pyexpat-symbols.patch.1 \
        external/python3/ubsan.patch.0 \
        external/python3/python-3.5.tweak.strip.soabi.patch \
+       
external/python3/0001-3.6-bpo-17239-Disable-external-entities-in-SAX-parse.patch.1
 \
 ))
 
 ifneq ($(filter DRAGONFLY FREEBSD LINUX NETBSD OPENBSD SOLARIS,$(OS)),)
commit 8929448b71bde403f2b82a6dc5764b3e4995e85a
Author:     Michael Stahl <michael.st...@cib.de>
AuthorDate: Tue Jan 15 17:05:00 2019 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:26:24 2021 +0200

    lcms2: upgrade to release 2.9
    
    ... at least, that's the plan - this is harder than it appears, as the
    upstream maintainer appears to have released version 2.9 at least 3
    times:
    
    - Fedora has a file evidently downloaded before Nov. 17 with SHA512 of 
e30ad5a9a1ab9e7aaace9431434caa19a5ff6143db46644aba971a5ee37a265b26bf738e886d766405a7eb45a9d620d67c7ab3684ace86a107cf5a76642c04a5
    - Gentoo has a file evidently downloaded before Nov. 19 with SHA256 of 
d4ad6f8718f7f9dc8b2a3276c9f237aa3f5eccdcf98b86dedc4262d8a1e7f009
    - Debian has a file evidently downloaded before Dec. 17 with SHA256 of 
48c6fdf98396fa245ed86e622028caf49b96fa22f3e5734f853f806fbc8e7d20
    
    The lcms2-2.9.tar.gz available from sourceforge currently matches the
    one Debian has, so let's use it.
    
    * 0017-Upgrade-Visual-studio-2017-15.8.patch added (fixing CVE-2018-16435)
    * 0001-Added-an-extra-check-to-MLU-bounds.patch.1 removed (fixed upstream)
    
    Reviewed-on: https://gerrit.libreoffice.org/66400
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@cib.de>
    (cherry picked from commit 99b20e589e64fbcf374d84ae68911ef2a96e537c)
    Reviewed-on: https://gerrit.libreoffice.org/66428
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>
    
    Change-Id: Iab8dada8f6d77d5b2da8560993380b3332bc02f6

diff --git a/download.lst b/download.lst
index bbba011bdc77..fe0339d4ca36 100644
--- a/download.lst
+++ b/download.lst
@@ -134,8 +134,8 @@ export LANGTAGREG_SHA256SUM := 
b7ad618b7db518155f00490a11b861496864f18b23b4b537e
 export LANGTAGREG_TARBALL := language-subtag-registry-2018-03-30.tar.bz2
 export LANGUAGETOOL_SHA256SUM := 
48c87e41636783bba438b65fd895821e369ed139e1465fac654323ad93c5a82d
 export LANGUAGETOOL_TARBALL := 
b63e6340a02ff1cacfeadb2c42286161-JLanguageTool-1.7.0.tar.bz2
-export LCMS2_SHA256SUM := 
66d02b229d2ea9474e62c2b6cd6720fde946155cd1d0d2bffdab829790a0fb22
-export LCMS2_TARBALL := lcms2-2.8.tar.gz
+export LCMS2_SHA256SUM := 
48c6fdf98396fa245ed86e622028caf49b96fa22f3e5734f853f806fbc8e7d20
+export LCMS2_TARBALL := lcms2-2.9.tar.gz
 export LIBASSUAN_SHA256SUM := 
22843a3bdb256f59be49842abf24da76700354293a066d82ade8134bb5aa2b71
 export LIBASSUAN_TARBALL := libassuan-2.4.3.tar.bz2
 export LIBATOMIC_OPS_SHA256SUM := 
cf5c52f08a2067ae4fe7c8919e3c1ccf3ee917f1749e0bcc7efffff59c68d9ad
diff --git a/external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1 
b/external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1
deleted file mode 100644
index 913f82887cb2..000000000000
--- a/external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1
+++ /dev/null
@@ -1,25 +0,0 @@
-From 5ca71a7bc18b6897ab21d815d15e218e204581e2 Mon Sep 17 00:00:00 2001
-From: Marti <marti.ma...@tktbrainpower.com>
-Date: Mon, 15 Aug 2016 23:31:39 +0200
-Subject: [PATCH] Added an extra check to MLU bounds
-
-Thanks to Ibrahim el-sayed for spotting the bug
----
- src/cmstypes.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/cmstypes.c b/src/cmstypes.c
-index cb61860..c7328b9 100644
---- a/src/cmstypes.c
-+++ b/src/cmstypes.c
-@@ -1460,6 +1460,7 @@ void *Type_MLU_Read(struct _cms_typehandler_struct* 
self, cmsIOHANDLER* io, cmsU
- 
-         // Check for overflow
-         if (Offset < (SizeOfHeader + 8)) goto Error;
-+        if ((Offset + Len) > SizeOfTag + 8) goto Error;
- 
-         // True begin of the string
-         BeginOfThisString = Offset - SizeOfHeader - 8;
--- 
-2.7.4
-
diff --git a/external/lcms2/0017-Upgrade-Visual-studio-2017-15.8.patch.1 
b/external/lcms2/0017-Upgrade-Visual-studio-2017-15.8.patch.1
new file mode 100644
index 000000000000..f616e6d38239
--- /dev/null
+++ b/external/lcms2/0017-Upgrade-Visual-studio-2017-15.8.patch.1
@@ -0,0 +1,172 @@
+From 768f70ca405cd3159d990e962d54456773bb8cf8 Mon Sep 17 00:00:00 2001
+From: Marti Maria <i...@littlecms.com>
+Date: Wed, 15 Aug 2018 20:07:56 +0200
+Subject: [PATCH 17/18] Upgrade Visual studio 2017 15.8
+
+- Upgrade to 15.8
+- Add check on CGATS memory allocation (thanks to Quang Nguyen for
+pointing out this)
+---
+ Projects/VC2017/jpegicc/jpegicc.vcxproj           |  1 +
+ Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj       |  2 +-
+ Projects/VC2017/lcms2_static/lcms2_static.vcxproj |  2 +-
+ Projects/VC2017/linkicc/linkicc.vcxproj           |  2 +-
+ Projects/VC2017/psicc/psicc.vcxproj               |  2 +-
+ Projects/VC2017/testbed/testbed.vcxproj           |  2 +-
+ Projects/VC2017/tiffdiff/tiffdiff.vcxproj         |  2 +-
+ Projects/VC2017/tifficc/tifficc.vcxproj           |  2 +-
+ Projects/VC2017/transicc/transicc.vcxproj         |  1 +
+ src/cmscgats.c                                    | 14 ++++++++++----
+ 10 files changed, 19 insertions(+), 11 deletions(-)
+
+diff --git a/Projects/VC2017/jpegicc/jpegicc.vcxproj 
b/Projects/VC2017/jpegicc/jpegicc.vcxproj
+index ab26a53..39cfd00 100644
+--- a/Projects/VC2017/jpegicc/jpegicc.vcxproj
++++ b/Projects/VC2017/jpegicc/jpegicc.vcxproj
+@@ -22,6 +22,7 @@
+     <ProjectGuid>{62812507-F926-4968-96A9-17678460AD90}</ProjectGuid>
+     <RootNamespace>jpegicc</RootNamespace>
+     <Keyword>Win32Proj</Keyword>
++    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+   </PropertyGroup>
+   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" 
Label="Configuration">
+diff --git a/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj 
b/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj
+index 4c8aa3f..d1bf3eb 100644
+--- a/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj
++++ b/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj
+@@ -22,7 +22,7 @@
+     <ProjectGuid>{8C51BE48-ADB8-4089-A9EC-F6BF993A0548}</ProjectGuid>
+     <RootNamespace>lcms2_DLL</RootNamespace>
+     <Keyword>Win32Proj</Keyword>
+-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
++    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+   </PropertyGroup>
+   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" 
Label="Configuration">
+diff --git a/Projects/VC2017/lcms2_static/lcms2_static.vcxproj 
b/Projects/VC2017/lcms2_static/lcms2_static.vcxproj
+index 2a9988a..9fc05ce 100644
+--- a/Projects/VC2017/lcms2_static/lcms2_static.vcxproj
++++ b/Projects/VC2017/lcms2_static/lcms2_static.vcxproj
+@@ -22,7 +22,7 @@
+     <ProjectGuid>{71DEDE59-3F1E-486B-A899-4283000F76B5}</ProjectGuid>
+     <RootNamespace>lcms2_static</RootNamespace>
+     <Keyword>Win32Proj</Keyword>
+-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
++    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+   </PropertyGroup>
+   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" 
Label="Configuration">
+diff --git a/Projects/VC2017/linkicc/linkicc.vcxproj 
b/Projects/VC2017/linkicc/linkicc.vcxproj
+index 30c2b4e..51586dd 100644
+--- a/Projects/VC2017/linkicc/linkicc.vcxproj
++++ b/Projects/VC2017/linkicc/linkicc.vcxproj
+@@ -22,7 +22,7 @@
+     <ProjectGuid>{FBFBE1DC-DB84-4BA1-9552-B4780F457849}</ProjectGuid>
+     <RootNamespace>linkicc</RootNamespace>
+     <Keyword>Win32Proj</Keyword>
+-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
++    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+   </PropertyGroup>
+   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" 
Label="Configuration">
+diff --git a/Projects/VC2017/psicc/psicc.vcxproj 
b/Projects/VC2017/psicc/psicc.vcxproj
+index 9dcf89a..8f26e12 100644
+--- a/Projects/VC2017/psicc/psicc.vcxproj
++++ b/Projects/VC2017/psicc/psicc.vcxproj
+@@ -22,7 +22,7 @@
+     <ProjectGuid>{EF6A8851-65FE-46F5-B9EF-14F0B671F693}</ProjectGuid>
+     <RootNamespace>psicc</RootNamespace>
+     <Keyword>Win32Proj</Keyword>
+-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
++    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+   </PropertyGroup>
+   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" 
Label="Configuration">
+diff --git a/Projects/VC2017/testbed/testbed.vcxproj 
b/Projects/VC2017/testbed/testbed.vcxproj
+index 0af3762..3f6aea3 100644
+--- a/Projects/VC2017/testbed/testbed.vcxproj
++++ b/Projects/VC2017/testbed/testbed.vcxproj
+@@ -22,7 +22,7 @@
+     <ProjectGuid>{928A3A2B-46EF-4279-959C-513B3652FF0E}</ProjectGuid>
+     <RootNamespace>testbed</RootNamespace>
+     <Keyword>Win32Proj</Keyword>
+-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
++    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+   </PropertyGroup>
+   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" 
Label="Configuration">
+diff --git a/Projects/VC2017/tiffdiff/tiffdiff.vcxproj 
b/Projects/VC2017/tiffdiff/tiffdiff.vcxproj
+index 7edfe28..3a6d837 100644
+--- a/Projects/VC2017/tiffdiff/tiffdiff.vcxproj
++++ b/Projects/VC2017/tiffdiff/tiffdiff.vcxproj
+@@ -22,7 +22,7 @@
+     <ProjectGuid>{75B91835-CCD7-48BE-A606-A9C997D5DBEE}</ProjectGuid>
+     <RootNamespace>tiffdiff</RootNamespace>
+     <Keyword>Win32Proj</Keyword>
+-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
++    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+   </PropertyGroup>
+   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" 
Label="Configuration">
+diff --git a/Projects/VC2017/tifficc/tifficc.vcxproj 
b/Projects/VC2017/tifficc/tifficc.vcxproj
+index cd9f04c..5ef954f 100644
+--- a/Projects/VC2017/tifficc/tifficc.vcxproj
++++ b/Projects/VC2017/tifficc/tifficc.vcxproj
+@@ -22,7 +22,7 @@
+     <ProjectGuid>{2256DE16-ED92-4A6F-9C54-F65BB61E64A2}</ProjectGuid>
+     <RootNamespace>tifficc</RootNamespace>
+     <Keyword>Win32Proj</Keyword>
+-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
++    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+   </PropertyGroup>
+   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" 
Label="Configuration">
+diff --git a/Projects/VC2017/transicc/transicc.vcxproj 
b/Projects/VC2017/transicc/transicc.vcxproj
+index d9b77c6..b3173d8 100644
+--- a/Projects/VC2017/transicc/transicc.vcxproj
++++ b/Projects/VC2017/transicc/transicc.vcxproj
+@@ -22,6 +22,7 @@
+     <ProjectGuid>{9EE22D66-C849-474C-9ED5-C3E141DAB160}</ProjectGuid>
+     <RootNamespace>transicc</RootNamespace>
+     <Keyword>Win32Proj</Keyword>
++    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+   </PropertyGroup>
+   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" 
Label="Configuration">
+diff --git a/src/cmscgats.c b/src/cmscgats.c
+index 1a87613..8c3e96d 100644
+--- a/src/cmscgats.c
++++ b/src/cmscgats.c
+@@ -1,7 +1,7 @@
+ 
//---------------------------------------------------------------------------------
+ //
+ //  Little Color Management System
+-//  Copyright (c) 1998-2017 Marti Maria Saguer
++//  Copyright (c) 1998-2018 Marti Maria Saguer
+ //
+ // Permission is hereby granted, free of charge, to any person obtaining
+ // a copy of this software and associated documentation files (the 
"Software"),
+@@ -1506,10 +1506,16 @@ void AllocateDataSet(cmsIT8* it8)
+     t-> nSamples   = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_FIELDS"));
+     t-> nPatches   = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_SETS"));
+ 
+-    t-> Data = (char**)AllocChunk (it8, ((cmsUInt32Number) t->nSamples + 1) * 
((cmsUInt32Number) t->nPatches + 1) *sizeof (char*));
+-    if (t->Data == NULL) {
++    if (t -> nSamples < 0 || t->nSamples > 0x7ffe || t->nPatches < 0 || 
t->nPatches > 0x7ffe)
++    {
++        SynError(it8, "AllocateDataSet: too much data");
++    }
++    else {
++        t->Data = (char**)AllocChunk(it8, ((cmsUInt32Number)t->nSamples + 1) 
* ((cmsUInt32Number)t->nPatches + 1) * sizeof(char*));
++        if (t->Data == NULL) {
+ 
+-        SynError(it8, "AllocateDataSet: Unable to allocate data array");
++            SynError(it8, "AllocateDataSet: Unable to allocate data array");
++        }
+     }
+ 
+ }
+-- 
+2.17.1
+
diff --git a/external/lcms2/UnpackedTarball_lcms2.mk 
b/external/lcms2/UnpackedTarball_lcms2.mk
index 01d04802c739..c5e1839cfccc 100644
--- a/external/lcms2/UnpackedTarball_lcms2.mk
+++ b/external/lcms2/UnpackedTarball_lcms2.mk
@@ -16,9 +16,9 @@ $(eval $(call 
gb_UnpackedTarball_update_autoconf_configs,lcms2))
 $(eval $(call gb_UnpackedTarball_set_patchlevel,lcms2,3))
 
 $(eval $(call gb_UnpackedTarball_add_patches,lcms2,\
+       external/lcms2/0017-Upgrade-Visual-studio-2017-15.8.patch.1 \
        external/lcms2/lcms2-2.4-windows.patch \
        external/lcms2/lcms2-msvc-disable-sse2.patch.1 \
-       external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1 \
        external/lcms2/c++17.patch.0 \
 ))
 
commit 7238393363a8c81ba06fb3fdf83e439d04c33e1b
Author:     Michael Stahl <michael.st...@cib.de>
AuthorDate: Mon Jan 14 15:44:35 2019 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:25:12 2021 +0200

    libxml2: upgrade to release 2.9.9
    
    * fixes CVE-2018-14404
    * drop one hunk from libxml2-android.patch that was added in commit
      6a17d2f2ba7acfec277314b97b50e41532d6b44d; presumably nan() exists now
      given that other code is calling it.
    
    Change-Id: I696cc4e1da55536ea1c89a6e0446ce5bc8398ba4
    Reviewed-on: https://gerrit.libreoffice.org/66308
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@cib.de>
    (cherry picked from commit beea5852720b22043aefcd1e6b7243c202b40601)
    Reviewed-on: https://gerrit.libreoffice.org/66367
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>

diff --git a/download.lst b/download.lst
index a1cfbfaba064..bbba011bdc77 100644
--- a/download.lst
+++ b/download.lst
@@ -152,8 +152,8 @@ export LIBTOMMATH_SHA256SUM := 
083daa92d8ee6f4af96a6143b12d7fc8fe1a547e14f862304
 export LIBTOMMATH_TARBALL := ltm-1.0.zip
 export XMLSEC_SHA256SUM := 
967ca83edf25ccb5b48a3c4a09ad3405a63365576503bf34290a42de1b92fcd2
 export XMLSEC_TARBALL := xmlsec1-1.2.25.tar.gz
-export LIBXML_SHA256SUM := 
0b74e51595654f958148759cfef0993114ddccccbb6f31aee018f3558e8e2732
-export LIBXML_VERSION_MICRO := 8
+export LIBXML_SHA256SUM := 
94fb70890143e3c6549f265cee93ec064c80a84c42ad0f23e85ee1fd6540a871
+export LIBXML_VERSION_MICRO := 9
 export LIBXML_TARBALL := libxml2-2.9.$(LIBXML_VERSION_MICRO).tar.gz
 export LIBXSLT_SHA256SUM := 
526ecd0abaf4a7789041622c3950c0e7f2c4c8835471515fd77eec684a355460
 export LIBXSLT_VERSION_MICRO := 32
diff --git a/external/libxml2/libxml2-android.patch 
b/external/libxml2/libxml2-android.patch
index bd7e15b5d39e..714de61068fb 100644
--- a/external/libxml2/libxml2-android.patch
+++ b/external/libxml2/libxml2-android.patch
@@ -1,15 +1,3 @@
---- misc/libxml2-2.7.6/trionan.c
-+++ misc/build/libxml2-2.7.6/trionan.c
-@@ -327,7 +327,7 @@
- 
-   if (result == 0.0) {
- 
--#if defined(TRIO_COMPILER_SUPPORTS_C99)
-+#if defined(TRIO_COMPILER_SUPPORTS_C99) && !(defined(__ANDROID__) && 
defined(__clang__))
-     result = nan("");
- 
- #elif defined(NAN) && defined(__STDC_IEC_559__)
-
 --- misc/libxml2-2.7.6/Makefile.in
 +++ misc/build/libxml2-2.7.6/Makefile.in
 @@ -1635,7 +1635,7 @@
diff --git a/external/libxml2/libxml2-global-symbols.patch 
b/external/libxml2/libxml2-global-symbols.patch
index ba34ac9cc0c6..49ee73731562 100644
--- a/external/libxml2/libxml2-global-symbols.patch
+++ b/external/libxml2/libxml2-global-symbols.patch
@@ -14,8 +14,8 @@
  
  LIBXML2_2.6.32 {
 @@ -2231,3 +2231,43 @@
-   xmlXPathSetContextNode;
- } LIBXML2_2.9.0;
+   xmlHashDefaultDeallocator;
+ } LIBXML2_2.9.1;
  
 +# HACK: export global variable accessor functions (globals.h)
 +LIBXML2_GLOBAL_VARIABLES {
commit 4088b9214009eb5aa305bddcba7604d6ea2fca8c
Author:     Andras Timar <andras.ti...@collabora.com>
AuthorDate: Wed Apr 18 07:19:00 2018 -0700
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:22:39 2021 +0200

    [cp] HACK: sleep before sign
    
    On Windows, with 16x parallel build, build-nocheck target fails,
    because it tries to sign a file that is already in use (gengal).
    
    Change-Id: Ic582334f2c02f5e38f49d048fc0425025ffeee41
    Reviewed-on: https://gerrit.libreoffice.org/75235
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Andras Timar <andras.ti...@collabora.com>

diff --git a/postprocess/signing/signing.pl b/postprocess/signing/signing.pl
index 2d70fa8448fa..1c62c8dcedb2 100644
--- a/postprocess/signing/signing.pl
+++ b/postprocess/signing/signing.pl
@@ -41,6 +41,7 @@ my @args        = ();
 my @files_to_sign = ();
 
 #### main #####
+sleep(120);
 $myname = script_id();
 if ( $#ARGV < 2 ) {
     usage();
commit 6d953ca03556cdc3c533bda5e878c6b717f6d291
Author:     Andras Timar <andras.ti...@collabora.com>
AuthorDate: Thu Feb 11 08:27:23 2021 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Sat Oct 9 23:21:07 2021 +0200

    try to use a different timestamp service
    
    Change-Id: I0fdbe2871d74836d530a69532bf22c17f642c922

diff --git a/postprocess/CustomTarget_signing.mk 
b/postprocess/CustomTarget_signing.mk
index b8a764d899e4..0d9cfaaf6771 100644
--- a/postprocess/CustomTarget_signing.mk
+++ b/postprocess/CustomTarget_signing.mk
@@ -15,7 +15,7 @@ $(eval $(call 
gb_CustomTarget_register_targets,postprocess/signing,\
 ))
 
 # PFXFILE and PFXPASSWORD should be set in environment
-TIMESTAMPURL ?= "http://timestamp.globalsign.com/scripts/timestamp.dll";
+TIMESTAMPURL ?= "http://timestamp.digicert.com/";
 
 $(call gb_CustomTarget_get_workdir,postprocess/signing)/signing.done: \
        $(SRCDIR)/postprocess/signing/signing.pl \
diff --git a/postprocess/signing/signing.pl b/postprocess/signing/signing.pl
index bd5c2e3fe0d1..2d70fa8448fa 100644
--- a/postprocess/signing/signing.pl
+++ b/postprocess/signing/signing.pl
@@ -240,7 +240,7 @@ sub usage       #09.07.2007 08:39
     print "\t -e filename\t\t\tFile which contains a list of files which don't 
have to be signed.\n";
     print "\t -f pfx_filename\t\t\"Personal Information Exchange\" file.\n";
     print "\t -p password\t\t\tPassword for \"Personal Information Exchange\" 
file.\n";
-    print "\t -t timestamp\t\t\tTimestamp URL e.g. 
\"http://timestamp.verisign.com/scripts/timstamp.dll\"\n";;
+    print "\t -t timestamp\t\t\tTimestamp URL e.g. 
\"http://timestamp.digicert.com/\"\n";;
     print "\t -l log_filename\t\tFile for logging.\n";
     print "\t -v\t\t\t\tVerbose.\n";
 }   ##usage
diff --git a/solenv/bin/modules/installer.pm b/solenv/bin/modules/installer.pm
index 151462f94ffc..d2bc261b14e0 100644
--- a/solenv/bin/modules/installer.pm
+++ b/solenv/bin/modules/installer.pm
@@ -1671,7 +1671,7 @@ sub run {
                     my $systemcall = "signtool.exe sign ";
                     if ( defined($ENV{'PFXFILE'}) ) { $systemcall .= "-f 
$ENV{'PFXFILE'} "; }
                     if ( defined($ENV{'PFXPASSWORD'}) ) { $systemcall .= "-p 
$ENV{'PFXPASSWORD'} "; }
-                    if ( defined($ENV{'TIMESTAMPURL'}) ) { $systemcall .= "-t 
$ENV{'TIMESTAMPURL'} "; } else { $systemcall .= "-t 
http://timestamp.globalsign.com/scripts/timestamp.dll "; }
+                    if ( defined($ENV{'TIMESTAMPURL'}) ) { $systemcall .= "-t 
$ENV{'TIMESTAMPURL'} "; } else { $systemcall .= "-t 
http://timestamp.digicert.com/ "; }
                     $systemcall .= "-d \"" . 
installer::download::get_downloadname_productname($allvariableshashref) . " " . 
installer::download::get_download_version($allvariableshashref) . " " . 
installer::download::get_downloadname_language($languagestringref) . " " . 
installer::download::get_download_functionality($allvariableshashref) . "\" ";
                     $systemcall .= $finalinstalldir . 
$installer::globals::separator . $$downloadname . ".msi";
                     installer::logger::print_message( "... code signing and 
timestamping with signtool.exe ...\n" );
diff --git a/solenv/bin/modules/installer/windows/msp.pm 
b/solenv/bin/modules/installer/windows/msp.pm
index 1bbeea8d20cb..95f51d846c40 100644
--- a/solenv/bin/modules/installer/windows/msp.pm
+++ b/solenv/bin/modules/installer/windows/msp.pm
@@ -1194,7 +1194,7 @@ sub create_msp_patch
         my $systemcall = "signtool.exe sign ";
         if ( defined($ENV{'PFXFILE'}) ) { $systemcall .= "-f $ENV{'PFXFILE'} 
"; }
         if ( defined($ENV{'PFXPASSWORD'}) ) { $systemcall .= "-p 
$ENV{'PFXPASSWORD'} "; }
-        if ( defined($ENV{'TIMESTAMPURL'}) ) { $systemcall .= "-t 
$ENV{'TIMESTAMPURL'} "; } else { $systemcall .= "-t 
http://timestamp.globalsign.com/scripts/timestamp.dll "; }
+        if ( defined($ENV{'TIMESTAMPURL'}) ) { $systemcall .= "-t 
$ENV{'TIMESTAMPURL'} "; } else { $systemcall .= "-t 
http://timestamp.digicert.com/ "; }
         $systemcall .= "-d \"" . $allvariables->{'PRODUCTNAME'} . " " . 
$allvariables->{'PRODUCTVERSION'} . " Patch " . 
$allvariables->{'WINDOWSPATCHLEVEL'} . "\" ";
         $systemcall .= $localmspfilename;
         installer::logger::print_message( "... code signing and timestamping 
with signtool.exe ...\n" );

Reply via email to