Merge version 4:7.4.7-1+rpi1+deb12u8 and 4:7.4.7-1+deb12u9 to produce 4:7.4.7-1+rpi1+deb12u9

Merge libreoffice (4:7.4.7-1+deb12u9) import into refs/heads/workingbranch

[PATCH] add EUR for Bulgaria/Lew

Bulgaria will join Eurozone 2026-01-01 at which time around the default
needs to be switched

see https://www.ecb.europa.eu/press/pr/date/2025/html/ecb.pr250708~b9676a9fa8.de.html for the conversion rate

This is the < 26.2 version including the euro wizard (cf.
b1a2f727ca99ecd3402d4b051b99cbfd24266e59)

Change-Id: I840ddda4308549703c53f998812848888dd830f6
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189279
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Jenkins
Gbp-Pq: Name add-EUR-for-Bulgaria-Lew.diff

[PATCH] Improve adbe.pkcs7.sha1 signature verification

For PDF signatures with SubFilter == adbe.pkcs7.sha1, we only
compared hash values and never actually checked SignatureValue
within SignerInfo.

Fix bugs introduced by 055fd58711d57af4d96214aebd71b713303d5527 and
e58ed17e35989350afe3e9fd77b24515df782eac by verifying the actual
(public-key) signature after the hash values compare equal.

Change-Id: I5fa3d60df214cc5efedd1c0eba6cf1b9faf05360
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/183059
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins
(cherry picked from commit 9f687b06fc25156a2a3f4d688b56542612995aa9)

Gbp-Pq: Name Improve-adbe.pkcs7.sha1-signature-verification.diff

Filter out more unwanted command URIs

Change-Id: I24c95d73b4fee89bdf044d5dd6efc9cd89627c54
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/181016
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Gbp-Pq: Name Filter-out-more-unwanted-command-URIs.diff

[PATCH] look at 'embedded' protocols too

Change-Id: Ie99f5f5a390639bdc69397c831e0a32594a5030c
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/177981
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 59891cd3985469bc44dbd05c9fc704eeb07f0c78)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/177987
Reviewed-by: Stephan Bergmann <stephan.bergmann@allotropia.de>
(cherry picked from commit b63aa51c55244ee67410201fa5e7c003427b1009)

Gbp-Pq: Name look-at-embedded-protocols-too.diff

[PATCH] consider VndSunStarExpand an exotic protocol

and generally don't bother with it when fetching data
from urls

Change-Id: I51a2601c6fb7d6c32f9e2d1286ee0d3b05b370b9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/176922
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
(cherry picked from commit 4fbe740677b90d8b73842b60863e2f4c9f4ea382)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/178313
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Gbp-Pq: Name consider-VndSunStarExpand-an-exotic-protocol.diff

[PATCH] be conservative on allowed temp font names

Change-Id: Iefdc1a8c9b4c7e8c08c84f747f8287ac3c419839
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/176236
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Tested-by: Jenkins
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/178289
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Gbp-Pq: Name be-coservative-about-allowed-font-names.diff

sfx2: SfxObjectShell should not trust any signature on repaired package

Change-Id: I0317f80989e9dabd23e88e3caab26ede3fb5bd56
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169883
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 8b333575ee680664fa3d83249ccec90881754ad7)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169930
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171910
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Gbp-Pq: Name do-not-trust-any-signature-on-repaired-package.diff

[PATCH] remove ability to trust not validated macro signatures in high security

Giving the user the option to determine if they should trust an
invalid signature in HIGH macro security doesn't make sense.
CommonName of the signature is the most prominent feature presented
and the CommonName of a certificate can be easily forged for an
invalid signature, tricking the user into accepting an invalid
signature.

in the HIGH macro security setting only show the pop-up to
enable/disable signed macro if the certificate signature can be
validated.

cherry-picked without UI/String altering bits for 24-2

Change-Id: Ia766fb701660160ee5dc9f6e077f4012a44ce721
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168667
Tested-by: Jenkins
Reviewed-by: Sarper Akdemir <sarper.akdemir@allotropia.de>
(cherry picked from commit 2beaa3be3829303e948d401f492dbfd239d60aad)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169525
Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171279
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171312
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Gbp-Pq: Name remove-ability-to-trust-not-validated-macro-signatures-in-high-security.diff

[PATCH] Blind fix for Linux 32-bit builds

...which, according to
<https://lists.freedesktop.org/archives/libreoffice/2024-March/091666.html> "32
bit build failure (smb, narrowing)", started to fail with

> /<<PKGBUILDDIR>>/sal/osl/unx/file.cxx: In function ‘void osl_file_adjustLockFlags(const rtl::OString&, int*, sal_uInt32*)’:
> /<<PKGBUILDDIR>>/sal/osl/unx/file.cxx:71:26: error: narrowing conversion of ‘4283649346’ from ‘unsigned int’ to ‘int’ [-Wnarrowing]
>     71 | #define CIFS_SUPER_MAGIC 0xFF534D42
>        |                          ^~~~~~~~~~
> /<<PKGBUILDDIR>>/sal/osl/unx/file.cxx:795:14: note: in expansion of macro ‘CIFS_SUPER_MAGIC’
>    795 |         case CIFS_SUPER_MAGIC:
>        |              ^~~~~~~~~~~~~~~~

etc.  My Fedora 39 "Linux man-pages 6.05" statfs(2) man page explains about the
struct statfs f_type field of __fsword_t type:  "The __fsword_t type used for
various fields in the statfs structure definition is a glibc internal type, not
intended for public use.  This leaves the programmer in a bit of a conundrum
when trying to copy or compare these fields to local variables in a program.
Using unsigned int for such variables suffices on most systems."  But the
underlying __FSWORD_T_TYPE looks like it is actually defined as a signed type in
/usr/include/bits/typesizes.h.

Change-Id: Ida3ae84031c4e48b0d6e69d76b66b4e4facfa1ae

Gbp-Pq: Name fix-32bit-build.diff

tdf#55004 Fix backup copy creation for files on mounted samba shares

There is an unfortunate interaction between file locking and backup
creation at save time.

openFilePath has logic to lock a file when opening. This goes through
fcntl to set a write lock on the file. Later on, when the user wants to
save changes, a backup copy might be created (very likely now since this
is the defaults in the settings). To create this backup, the file is
opened again for reading. Unfortunately this open call fails due to the
lock (even though it is a write lock).

This commit changes the behavior. osl_file_adjustLockFlags now checks if
the file is on a mounted samba share. If that's the case we force the
osl_File_OpenFlag_NoLock flag. No issue is then exhibited at backup
creation, allowing the save to proceed properly.

Change-Id: Ieab252f9f68598834e13339fc5fcea440f0a4c2f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162935
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <stephan.bergmann@allotropia.de>
Gbp-Pq: Name Fix-backup-copy-creation-for-files-on-mounted-samba-shares.diff

add notify for script use

Change-Id: I84af197cec7755f6803a578e1e21c03966ad5f3e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165412
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Gbp-Pq: Name add-notify-for-script-use.diff

work-around-expired-certificiate-in-test

Gbp-Pq: Name work-around-expired-certificiate-in-test.diff

reuse AllowedLinkProtocolFromDocument in impress/draw

Change-Id: I73ca4f087946a45dbf92d69a0dc1e769de9b5690
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159843
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit f0942eed2eb328b04856f20613f5226d66b66a20)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159759
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159884
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Gbp-Pq: Name reuse-AllowedLinkProtocolFromDocument-2.diff

reuse AllowedLinkProtocolFromDocument in writer

reorg calc hyperlink check to reuse elsewhere

Change-Id: I20ae3c5df15502c3a0a366fb4a2924c06ffac3d0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159487
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit e6a7537762e19fde446441edd10d301f9b37ce75)

reuse AllowedLinkProtocolFromDocument in writer

Change-Id: Iacf5e313fc6ca5f7d69ca6986a036f0e1ab1f2a0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159488
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 32535dfa82200b54296838b52285c054fbe5e51d)

combine these hyperlink dispatchers into one call

Change-Id: Icb7822e811013de648ccf2fbb23a5f0be9e29bb0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159489
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 0df175ccc6ea542bc5801f631ff72bed187042eb)

we can have just one LoadURL for writer

Change-Id: Ia0162ee1c275292fcf200bad4662e4c2c6b7b972
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159557
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 521ca9cf6acbae96cf95d9740859c9682212013d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159858
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit e32b8601dbd63cf01497889601d6c9c1241106d6)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159883

Gbp-Pq: Name reuse-AllowedLinkProtocolFromDocument-1.diff

default to ignoring libreoffice special-purpose protocols in calc hyperlink

Change-Id: Ib9f62be3acc05f24ca234dec0fec21e24579e9de
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158911
Tested-by: Jenkins
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit b6062623b4d69c79e90e9365ac7c5e7f11986793)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159045
Reviewed-by: Eike Rathke <erack@redhat.com>
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159882
Tested-by: Miklos Vajna <vmiklos@collabora.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Gbp-Pq: Name ignore-LO-special-purpose-hyperlinks-per-default.diff

warn about exotic protocols as well

Change-Id: I50dcf4f36cd20d75f5ad3876353143268740a50f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151834
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 1305f70cff8a81a58a5a6d9c96c5bb032005389e)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159034
Reviewed-by: Eike Rathke <erack@redhat.com>
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159881
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Gbp-Pq: Name warn-about-exotic-protocols-as-well.diff

add some protocols that don't make sense as floating frame targets

Change-Id: Id900a5eef248731d1184c1df501a2cf7a2de7eb9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158910
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 11ebdfef16501c6d35c3e3d0d62507f706557c71)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158900
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit bab433911bdecb344f7ea94dbd00690241a08c54)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159582

Gbp-Pq: Name floating-frame-targets-unneeded-protocols.diff

escape url passed to gstreamer

Change-Id: I3c93ee34800cc8563370f75ef3ef6f8a9220e6ec
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158894
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit f41dcadf6492a6ffd32696d50f818e44355b9ad9)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159583

Gbp-Pq: Name escape-url-passed-to-gstreamer.diff

[PATCH] Remove dependency on BitArray.h from zxing-1.2.0

In zxing-1.4.0, numerous headers are no longer public. Rework the
ConvertToSVGFormat method so it uses bitmatrix.get instead of
bitmatrix.getRow, similar to the ToSVG method in zxing itself.

See https://github.com/zxing-cpp/zxing-cpp/issues/361

Gbp-Pq: Name 0004-Remove-dependency-on-BitArray.h-from-zxing-1.2.0.patch

i18n: fix build with Boost 1.81.0

Boost.Locale since 1.81.0 switch to enum classes for facet type [1].
Switch our resource manager accordingly.

1: https://github.com/boostorg/locale/commit/e5ed439ea39a4de915e9fb939cca95cae7d9d8d1

Change-Id: Ief215363ceb79b2019606b20a7cde55c8df6a042
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143343
Reviewed-by: Heiko Becker <heirecka@exherbo.org>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 23dcd4339428e4080029ec5ae658e75f01e79a62)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144310
Reviewed-by: Danh Doan <congdanhqx@gmail.com>
Tested-by: Jenkins
Gbp-Pq: Name boost-1.81.diff

fix-system-libfixmath

Gbp-Pq: Name fix-system-libfixmath.diff

dragonbox-1.1.3

Gbp-Pq: Name dragonbox-1.1.3.diff

Related: tdf#150011 Add HRK Croatian Kuna to Euro conversion wizard

Maybe just for completeness, it's removed from menu but might be
callable as macro.

Change-Id: Iade0be845186d3deb2f00f4aaa230c0b344cea72
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137372
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Jenkins
Gbp-Pq: Name hrk-euro.diff

do-not-ABORT_ON_NON_APPLICATION_FONT_USE

Gbp-Pq: Name do-not-ABORT_ON_NON_APPLICATION_FONT_USE.diff

moreIconsDialog-accesses-internet

Gbp-Pq: Name moreIconsDialog-accesses-internet.diff

Explicitly set fpu mode on armhf

Gbp-Pq: Name arm-fp-mode.diff

temporarily-disable-test-metadata-test

Gbp-Pq: Name temporarily-disable-test-metadata-test.diff

Support tofu+pgp trust model in GnuPG

Bug-Debian: https://bugs.debian.org/955271
Forwarded: no

GnuPG supports a trust-on-first-use layer that sits on top of the
standard PGP trust model. If this is enabled, 'gpg --list-keys' needs
write and lock permissions on the TOFU database to return any useful
data. Allow this access through AppArmor.

Gbp-Pq: Name apparmor-gnupg-tofu.diff

apparmor-updates

Gbp-Pq: Name apparmor-updates.diff

[PATCH] Resolves: rhbz#1432468 disable opencl by default

Change-Id: Ie037fcabdd219f195425979dd721501fb5527573

Gbp-Pq: Name no-opencl-per-default.diff

disable-shortcuts_tab_navigation-uitest

Gbp-Pq: Name disable-shortcuts_tab_navigation-uitest.diff

add-access2base-doc

Gbp-Pq: Name add-access2base-doc.diff

Add safer float comparisons to bridgetest equals()

Bug-Ubuntu: https://launchpad.net/bugs/1832360

Gbp-Pq: Name fix-flaky-bridgetest.diff

apparmor-opencl

apparmor: Add opencl support

AppArmor in Debian Buster now has OpenCL abstractions.

Include OpenCL abstractions to fix OpenCL usage in Calc.

Gbp-Pq: Name apparmor-opencl.diff

[PATCH] mariadb

Gbp-Pq: Name use-mariadb-java-instead-of-mysql-java.diff

disableClassPathURLCheck

Gbp-Pq: Name disableClassPathURLCheck.diff

apparmor-mesa

Gbp-Pq: Name apparmor-mesa.diff

[PATCH] apparmor: use dri-enumerate abstraction

Remove backported rule and use new dri-enumerate abstraction instead.
dri-enumerate is available in AppArmor 2.13, which recently migrated
into Debian Buster.

Change-Id: I64919edc1882f7bc1e65cfb94686464c5350f699

Gbp-Pq: Name apparmor-cleanups.diff

apparmor-allow-java.security

Gbp-Pq: Name apparmor-allow-java.security.diff

do-not-hide-test-output

Gbp-Pq: Name do-not-hide-test-output.diff

disable-java-in-odk-build-examples-on-zero-vm

Gbp-Pq: Name disable-java-in-odk-build-examples-on-zero-vm.diff

appstream-ignore-startcenter

Gbp-Pq: Name appstream-ignore-startcenter.diff

Hide startcenter and math from the shell

Bug-Ubuntu: https://launchpad.net/bugs/1696250
Forwarded: not-needed

Gbp-Pq: Name hide-math-desktop-file.patch

apparmor-complain

Gbp-Pq: Name apparmor-complain.diff

cppunit-optional

Gbp-Pq: Name cppunit-optional.diff

system-officeotron-and-odfvalidator

Gbp-Pq: Name system-officeotron-and-odfvalidator.diff

no-packagekit-per-default

Gbp-Pq: Name no-packagekit-per-default.diff

hppa-is-32bit

Gbp-Pq: Name hppa-is-32bit.diff

javadoc-optional

Gemeinsame Unterverzeichnisse: odk-old/config und odk/config.
Gemeinsame Unterverzeichnisse: odk-old/docs und odk/docs.
Gemeinsame Unterverzeichnisse: odk-old/examples und odk/examples.

Gemeinsame Unterverzeichnisse: odk-old/config und odk/config.
Gemeinsame Unterverzeichnisse: odk-old/docs und odk/docs.
Gemeinsame Unterverzeichnisse: odk-old/examples und odk/examples.

Gbp-Pq: Name javadoc-optional.diff

fix-internal-hsqldb-build

Gbp-Pq: Name fix-internal-hsqldb-build.diff

disable-flaky-tests

14:13 < mst__> _rene_, the toolkit unoapi tests are known to be flaky (in some
               system dependent way) e.g. on the Win@6 tinderbox it always
               crashes
14:14 < mst__> _rene_, sc.ScAccessible* tests also fail on some systems some of
               the time

Gbp-Pq: Name disable-flaky-tests.diff

debian-hardened-buildflags-no-LO-fstack-protector-strong

don't hardcode -fstack-protector-strong in configure.ac/gbuild. We get the
hardening flags from dpkg-buildflags anyway.

Gbp-Pq: Name debian-hardened-buildflags-no-LO-fstack-protector-strong.diff

debian-hardened-buildflags-CPPFLAGS

Gbp-Pq: Name debian-hardened-buildflags-CPPFLAGS.diff

mediwiki-oor-replace

Gbp-Pq: Name mediwiki-oor-replace.diff

make-package-modules-not-suck

Gbp-Pq: Name make-package-modules-not-suck.diff

jdbc-driver-classpaths

Gbp-Pq: Name jdbc-driver-classpaths.diff

reportdesign-mention-package

Gbp-Pq: Name reportdesign-mention-package.diff

sensible-lomua

===================================================================

Gbp-Pq: Name sensible-lomua.diff

help-msg-add-package-info

Gbp-Pq: Name help-msg-add-package-info.diff

mention-java-common-package

Gbp-Pq: Name mention-java-common-package.diff

install-fixes

Gbp-Pq: Name install-fixes.diff

build-against-shared-lpsolve

Gbp-Pq: Name build-against-shared-lpsolve.diff

debian-debug

Gbp-Pq: Name debian-debug.diff

split-evoab

Gbp-Pq: Name split-evoab.diff

jurt-soffice-location

commit b71107fb12e3c3125e0cb62c5a4f6636a80c6408
Author:     Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
AuthorDate: Tue Jun 7 11:52:37 2011 +0200
Commit:     Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
CommitDate: Tue Jun 7 11:52:37 2011 +0200

    on debian-based systems, we know where our soffice binary is

Gbp-Pq: Name jurt-soffice-location.diff

debian-opt

Gbp-Pq: Name debian-opt.diff

no-check-if-root

Gbp-Pq: Name no-check-if-root.diff

libreoffice (4:7.4.7-1+deb12u9) bookworm; urgency=medium

   * debian/patches/add-EUR-for-Bulgaria-Lew.diff: add Euro support for
     Bulgaria from libreoffice-25-8 branch (to-be 25.8.1)

[dgit import unpatched libreoffice 4:7.4.7-1+deb12u9]

Import libreoffice_7.4.7-1+deb12u9.debian.tar.xz

[dgit import tarball libreoffice 4:7.4.7-1+deb12u9 libreoffice_7.4.7-1+deb12u9.debian.tar.xz]

Merge version 4:7.4.7-1+rpi1+deb12u5 and 4:7.4.7-1+deb12u8 to produce 4:7.4.7-1+rpi1+deb12u8

Merge libreoffice (4:7.4.7-1+deb12u8) import into refs/heads/workingbranch

[PATCH] Improve adbe.pkcs7.sha1 signature verification

For PDF signatures with SubFilter == adbe.pkcs7.sha1, we only
compared hash values and never actually checked SignatureValue
within SignerInfo.

Fix bugs introduced by 055fd58711d57af4d96214aebd71b713303d5527 and
e58ed17e35989350afe3e9fd77b24515df782eac by verifying the actual
(public-key) signature after the hash values compare equal.

Change-Id: I5fa3d60df214cc5efedd1c0eba6cf1b9faf05360
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/183059
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins
(cherry picked from commit 9f687b06fc25156a2a3f4d688b56542612995aa9)

Gbp-Pq: Name Improve-adbe.pkcs7.sha1-signature-verification.diff

Filter out more unwanted command URIs

Change-Id: I24c95d73b4fee89bdf044d5dd6efc9cd89627c54
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/181016
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Gbp-Pq: Name Filter-out-more-unwanted-command-URIs.diff

[PATCH] look at 'embedded' protocols too

Change-Id: Ie99f5f5a390639bdc69397c831e0a32594a5030c
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/177981
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 59891cd3985469bc44dbd05c9fc704eeb07f0c78)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/177987
Reviewed-by: Stephan Bergmann <stephan.bergmann@allotropia.de>
(cherry picked from commit b63aa51c55244ee67410201fa5e7c003427b1009)

Gbp-Pq: Name look-at-embedded-protocols-too.diff

[PATCH] consider VndSunStarExpand an exotic protocol

and generally don't bother with it when fetching data
from urls

Change-Id: I51a2601c6fb7d6c32f9e2d1286ee0d3b05b370b9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/176922
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
(cherry picked from commit 4fbe740677b90d8b73842b60863e2f4c9f4ea382)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/178313
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Gbp-Pq: Name consider-VndSunStarExpand-an-exotic-protocol.diff

[PATCH] be conservative on allowed temp font names

Change-Id: Iefdc1a8c9b4c7e8c08c84f747f8287ac3c419839
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/176236
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Tested-by: Jenkins
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/178289
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Gbp-Pq: Name be-coservative-about-allowed-font-names.diff

sfx2: SfxObjectShell should not trust any signature on repaired package

Change-Id: I0317f80989e9dabd23e88e3caab26ede3fb5bd56
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169883
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 8b333575ee680664fa3d83249ccec90881754ad7)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169930
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171910
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Gbp-Pq: Name do-not-trust-any-signature-on-repaired-package.diff

[PATCH] remove ability to trust not validated macro signatures in high security

Giving the user the option to determine if they should trust an
invalid signature in HIGH macro security doesn't make sense.
CommonName of the signature is the most prominent feature presented
and the CommonName of a certificate can be easily forged for an
invalid signature, tricking the user into accepting an invalid
signature.

in the HIGH macro security setting only show the pop-up to
enable/disable signed macro if the certificate signature can be
validated.

cherry-picked without UI/String altering bits for 24-2

Change-Id: Ia766fb701660160ee5dc9f6e077f4012a44ce721
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168667
Tested-by: Jenkins
Reviewed-by: Sarper Akdemir <sarper.akdemir@allotropia.de>
(cherry picked from commit 2beaa3be3829303e948d401f492dbfd239d60aad)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169525
Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171279
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171312
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Gbp-Pq: Name remove-ability-to-trust-not-validated-macro-signatures-in-high-security.diff

[PATCH] Blind fix for Linux 32-bit builds

...which, according to
<https://lists.freedesktop.org/archives/libreoffice/2024-March/091666.html> "32
bit build failure (smb, narrowing)", started to fail with

> /<<PKGBUILDDIR>>/sal/osl/unx/file.cxx: In function ‘void osl_file_adjustLockFlags(const rtl::OString&, int*, sal_uInt32*)’:
> /<<PKGBUILDDIR>>/sal/osl/unx/file.cxx:71:26: error: narrowing conversion of ‘4283649346’ from ‘unsigned int’ to ‘int’ [-Wnarrowing]
>     71 | #define CIFS_SUPER_MAGIC 0xFF534D42
>        |                          ^~~~~~~~~~
> /<<PKGBUILDDIR>>/sal/osl/unx/file.cxx:795:14: note: in expansion of macro ‘CIFS_SUPER_MAGIC’
>    795 |         case CIFS_SUPER_MAGIC:
>        |              ^~~~~~~~~~~~~~~~

etc.  My Fedora 39 "Linux man-pages 6.05" statfs(2) man page explains about the
struct statfs f_type field of __fsword_t type:  "The __fsword_t type used for
various fields in the statfs structure definition is a glibc internal type, not
intended for public use.  This leaves the programmer in a bit of a conundrum
when trying to copy or compare these fields to local variables in a program.
Using unsigned int for such variables suffices on most systems."  But the
underlying __FSWORD_T_TYPE looks like it is actually defined as a signed type in
/usr/include/bits/typesizes.h.

Change-Id: Ida3ae84031c4e48b0d6e69d76b66b4e4facfa1ae

Gbp-Pq: Name fix-32bit-build.diff

tdf#55004 Fix backup copy creation for files on mounted samba shares

There is an unfortunate interaction between file locking and backup
creation at save time.

openFilePath has logic to lock a file when opening. This goes through
fcntl to set a write lock on the file. Later on, when the user wants to
save changes, a backup copy might be created (very likely now since this
is the defaults in the settings). To create this backup, the file is
opened again for reading. Unfortunately this open call fails due to the
lock (even though it is a write lock).

This commit changes the behavior. osl_file_adjustLockFlags now checks if
the file is on a mounted samba share. If that's the case we force the
osl_File_OpenFlag_NoLock flag. No issue is then exhibited at backup
creation, allowing the save to proceed properly.

Change-Id: Ieab252f9f68598834e13339fc5fcea440f0a4c2f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162935
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <stephan.bergmann@allotropia.de>
Gbp-Pq: Name Fix-backup-copy-creation-for-files-on-mounted-samba-shares.diff

add notify for script use

Change-Id: I84af197cec7755f6803a578e1e21c03966ad5f3e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165412
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Gbp-Pq: Name add-notify-for-script-use.diff

work-around-expired-certificiate-in-test

Gbp-Pq: Name work-around-expired-certificiate-in-test.diff

reuse AllowedLinkProtocolFromDocument in impress/draw

Change-Id: I73ca4f087946a45dbf92d69a0dc1e769de9b5690
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159843
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit f0942eed2eb328b04856f20613f5226d66b66a20)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159759
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159884
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Gbp-Pq: Name reuse-AllowedLinkProtocolFromDocument-2.diff

reuse AllowedLinkProtocolFromDocument in writer

reorg calc hyperlink check to reuse elsewhere

Change-Id: I20ae3c5df15502c3a0a366fb4a2924c06ffac3d0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159487
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit e6a7537762e19fde446441edd10d301f9b37ce75)

reuse AllowedLinkProtocolFromDocument in writer

Change-Id: Iacf5e313fc6ca5f7d69ca6986a036f0e1ab1f2a0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159488
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 32535dfa82200b54296838b52285c054fbe5e51d)

combine these hyperlink dispatchers into one call

Change-Id: Icb7822e811013de648ccf2fbb23a5f0be9e29bb0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159489
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 0df175ccc6ea542bc5801f631ff72bed187042eb)

we can have just one LoadURL for writer

Change-Id: Ia0162ee1c275292fcf200bad4662e4c2c6b7b972
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159557
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 521ca9cf6acbae96cf95d9740859c9682212013d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159858
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit e32b8601dbd63cf01497889601d6c9c1241106d6)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159883

Gbp-Pq: Name reuse-AllowedLinkProtocolFromDocument-1.diff

default to ignoring libreoffice special-purpose protocols in calc hyperlink

Change-Id: Ib9f62be3acc05f24ca234dec0fec21e24579e9de
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158911
Tested-by: Jenkins
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit b6062623b4d69c79e90e9365ac7c5e7f11986793)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159045
Reviewed-by: Eike Rathke <erack@redhat.com>
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159882
Tested-by: Miklos Vajna <vmiklos@collabora.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Gbp-Pq: Name ignore-LO-special-purpose-hyperlinks-per-default.diff

warn about exotic protocols as well

Change-Id: I50dcf4f36cd20d75f5ad3876353143268740a50f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151834
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 1305f70cff8a81a58a5a6d9c96c5bb032005389e)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159034
Reviewed-by: Eike Rathke <erack@redhat.com>
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159881
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Gbp-Pq: Name warn-about-exotic-protocols-as-well.diff

add some protocols that don't make sense as floating frame targets

Change-Id: Id900a5eef248731d1184c1df501a2cf7a2de7eb9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158910
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 11ebdfef16501c6d35c3e3d0d62507f706557c71)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158900
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit bab433911bdecb344f7ea94dbd00690241a08c54)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159582

Gbp-Pq: Name floating-frame-targets-unneeded-protocols.diff

escape url passed to gstreamer

Change-Id: I3c93ee34800cc8563370f75ef3ef6f8a9220e6ec
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158894
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit f41dcadf6492a6ffd32696d50f818e44355b9ad9)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159583

Gbp-Pq: Name escape-url-passed-to-gstreamer.diff

[PATCH] Remove dependency on BitArray.h from zxing-1.2.0

In zxing-1.4.0, numerous headers are no longer public. Rework the
ConvertToSVGFormat method so it uses bitmatrix.get instead of
bitmatrix.getRow, similar to the ToSVG method in zxing itself.

See https://github.com/zxing-cpp/zxing-cpp/issues/361

Gbp-Pq: Name 0004-Remove-dependency-on-BitArray.h-from-zxing-1.2.0.patch

i18n: fix build with Boost 1.81.0

Boost.Locale since 1.81.0 switch to enum classes for facet type [1].
Switch our resource manager accordingly.

1: https://github.com/boostorg/locale/commit/e5ed439ea39a4de915e9fb939cca95cae7d9d8d1

Change-Id: Ief215363ceb79b2019606b20a7cde55c8df6a042
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143343
Reviewed-by: Heiko Becker <heirecka@exherbo.org>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 23dcd4339428e4080029ec5ae658e75f01e79a62)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144310
Reviewed-by: Danh Doan <congdanhqx@gmail.com>
Tested-by: Jenkins
Gbp-Pq: Name boost-1.81.diff

fix-system-libfixmath

Gbp-Pq: Name fix-system-libfixmath.diff

dragonbox-1.1.3

Gbp-Pq: Name dragonbox-1.1.3.diff

Related: tdf#150011 Add HRK Croatian Kuna to Euro conversion wizard

Maybe just for completeness, it's removed from menu but might be
callable as macro.

Change-Id: Iade0be845186d3deb2f00f4aaa230c0b344cea72
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137372
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Jenkins
Gbp-Pq: Name hrk-euro.diff

do-not-ABORT_ON_NON_APPLICATION_FONT_USE

Gbp-Pq: Name do-not-ABORT_ON_NON_APPLICATION_FONT_USE.diff

moreIconsDialog-accesses-internet

Gbp-Pq: Name moreIconsDialog-accesses-internet.diff

Explicitly set fpu mode on armhf

Gbp-Pq: Name arm-fp-mode.diff

temporarily-disable-test-metadata-test

Gbp-Pq: Name temporarily-disable-test-metadata-test.diff

Support tofu+pgp trust model in GnuPG

Bug-Debian: https://bugs.debian.org/955271
Forwarded: no

GnuPG supports a trust-on-first-use layer that sits on top of the
standard PGP trust model. If this is enabled, 'gpg --list-keys' needs
write and lock permissions on the TOFU database to return any useful
data. Allow this access through AppArmor.

Gbp-Pq: Name apparmor-gnupg-tofu.diff