Merge in updated libraries from Cantaloup 5.0.6

.github/workflows/ci.yml

@@ -6,31 +6,25 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest]
-        java: [jdk11, jdk15, graalvm]
+        java: [jdk11, jdk18, graalvm]
       fail-fast: false
     steps:
       - name: Check out the repository
         uses: actions/checkout@v2
       - name: Test in Linux JDK 11
         if: matrix.os == 'ubuntu-latest' && matrix.java == 'jdk11'
-        run: docker-compose -f docker/Linux-JDK11/docker-compose.yml up --exit-code-from cantaloupe
-      - name: Test in Linux JDK 15
-        if: matrix.os == 'ubuntu-latest' && matrix.java == 'jdk15'
-        run: docker-compose -f docker/Linux-JDK15/docker-compose.yml up --exit-code-from cantaloupe
-      - name: Test in Linux JDK 16
-        if: matrix.os == 'ubuntu-latest' && matrix.java == 'jdk16'
-        run: docker-compose -f docker/Linux-JDK16/docker-compose.yml up --exit-code-from cantaloupe
+        run: docker-compose -f docker/Linux-JDK11/docker-compose.yml up --build --exit-code-from cantaloupe
+      - name: Test in Linux JDK 18
+        if: matrix.os == 'ubuntu-latest' && matrix.java == 'jdk18'
+        run: docker-compose -f docker/Linux-JDK18/docker-compose.yml up --build --exit-code-from cantaloupe
       - name: Test in Linux GraalVM
         if: matrix.os == 'ubuntu-latest' && matrix.java == 'graalvm'
-        run: docker-compose -f docker/Linux-GraalVM20/docker-compose.yml up --exit-code-from cantaloupe
+        run: docker-compose -f docker/Linux-GraalVM20/docker-compose.yml up --build --exit-code-from cantaloupe
       - name: Test in Windows JDK 11
         if: matrix.os == 'windows-latest' && matrix.java == 'jdk11'
-        run: docker-compose -f docker/Windows-JDK11/docker-compose.yml up --exit-code-from cantaloupe
-      - name: Test in Windows JDK 15
-        if: matrix.os == 'windows-latest' && matrix.java == 'jdk15'
-        run: docker-compose -f docker/Windows-JDK15/docker-compose.yml up --exit-code-from cantaloupe
-      - name: Test in Windows JDK 16
-        if: matrix.os == 'windows-latest' && matrix.java == 'jdk16'
-        run: docker-compose -f docker/Windows-JDK16/docker-compose.yml up --exit-code-from cantaloupe
+        run: docker-compose -f docker/Windows-JDK11/docker-compose.yml up --build --exit-code-from cantaloupe
+      - name: Test in Windows JDK 18
+        if: matrix.os == 'windows-latest' && matrix.java == 'jdk18'
+        run: docker-compose -f docker/Windows-JDK18/docker-compose.yml up --build --exit-code-from cantaloupe
       # TODO: Windows+GraalVM
 

CHANGES.md

@@ -37,10 +37,14 @@
 ## 5.0.6
 
 * IIIF information endpoints always return JSON in HTTP 4xx responses.
+* Fixed a bug whereby the values of the `operations` and `page_count` keys
+  in the delegate context were not set.
 * TurboJpegProcessor is able to generate non-JPEG derivative images, which
   fixes an HTTP 415 error that would occur when trying to do that.
 * Fixed a crop-offset bug that could occur when using PdfBoxProcessor to
   generate JPEGs with libjpeg-turbo active.
+* Updating libraries to fix security issues. Full details in [#634](https://github.com/cantaloupe-project/cantaloupe/issues/634)  
+* Update of Jena to 4.8 requires RDF to have a populated rdf:about field. May impact some XMP header processing.
 
 ## 5.0.5
 

CREDITS.md

@@ -0,0 +1,9 @@
+# Credits
+
+The success of this project is down to the great work done by the developers at the University of Illinois and particularly Alex Dolski who has been the main developer on the project. In 2023 the IIIF consortium offered to help release a security patch as so many IIIF community members are using this great software. 
+
+- Cantaloupe 5.0.6
+ * [Glen Robson](https://github.com/glenrobson/) with support from the [IIIF Consortium](https://iiif.io/community/consortium/)
+
+- Cantaloupe v1 - v6
+ * [Alex Dolski](https://github.com/adolski), University of Illinois

docker/Linux-GraalVM20/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:latest
+FROM ubuntu:lunar
 
 ENV JAVA_HOME=/opt/graalvm-ce-java11-20.3.0
 ENV GRAALVM_HOME=/opt/graalvm-ce-java11-20.3.0
@@ -20,6 +20,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
                 zlib1g-dev \
                 libwebp-dev \
                 libimage-exiftool-perl \
+                libgrokj2k1 \
+                grokj2k-tools \ 
+                adduser \
     && rm -rf /var/lib/apt/lists/*
 
 # Install TurboJpegProcessor dependencies
@@ -30,10 +33,10 @@ COPY docker/Linux-JDK11/image_files/libjpeg-turbo/lib64 /opt/libjpeg-turbo/lib
 COPY dist/deps/Linux-x86-64/lib/* /usr/lib/
 
 # Install GrokProcessor dependencies
-RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
-    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
-    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
-    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb
+#RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
+#    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
+#    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb
+#    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
 
 # Install GraalVM
 RUN wget -q https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-20.3.0/graalvm-ce-java11-linux-amd64-20.3.0.tar.gz \

docker/Linux-JDK11/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:latest
+FROM ubuntu:lunar
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -18,6 +18,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
                 zlib1g-dev \
                 libwebp-dev \
                 libimage-exiftool-perl \
+                libgrokj2k1 \
+                grokj2k-tools \ 
+                adduser \
     && rm -rf /var/lib/apt/lists/*
 
 # Install TurboJpegProcessor dependencies
@@ -28,16 +31,16 @@ COPY docker/Linux-JDK11/image_files/libjpeg-turbo/lib64 /opt/libjpeg-turbo/lib
 COPY dist/deps/Linux-x86-64/lib/* /usr/lib/
 
 # Install GrokProcessor dependencies
-RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
-    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
-    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
-    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb
+#RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
+#    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
+#    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
+#    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb
 
 # A non-root user is needed for some FilesystemSourceTest tests to work.
 ARG user=cantaloupe
 ARG home=/home/$user
 RUN adduser --home $home $user
-RUN chown -R $user $home
+RUN chown -R $user $home 
 USER $user
 WORKDIR $home
 

docker/Linux-JDK16/Dockerfile → docker/Linux-JDK18/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:latest
+FROM ubuntu:lunar
 
 ENV JAVA_HOME=/opt/jdk
 ENV PATH=$PATH:/opt/jdk/bin:/opt/maven/bin
@@ -23,6 +23,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     zlib1g-dev \
     libwebp-dev \
     libimage-exiftool-perl \
+    libgrokj2k1 \
+    grokj2k-tools \ 
+    adduser \
     && rm -rf /var/lib/apt/lists/*
 
 # Install TurboJpegProcessor dependencies
@@ -34,19 +37,19 @@ COPY dist/deps/Linux-x86-64/lib/* /usr/lib/
 
 # Install various other dependencies that aren't in apt
 # Install GrokProcessor dependencies
-RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
-    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
-    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
-    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb \
+#RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
+#    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
+#    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
+#    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb \
     # Install OpenJDK
-    && wget -q https://github.com/AdoptOpenJDK/openjdk16-binaries/releases/download/jdk-16.0.1%2B9/OpenJDK16U-jdk_x64_linux_hotspot_16.0.1_9.tar.gz \
-    && tar xfz OpenJDK16U-jdk_x64_linux_hotspot_16.0.1_9.tar.gz \
-    && mv jdk-16.0.1+9 /opt/jdk \
-    # Install Maven (the one in apt is too old for JDK16 as of 2020-05-14)
-    && wget -q https://mirrors.ocf.berkeley.edu/apache/maven/maven-3/3.8.1/binaries/apache-maven-3.8.1-bin.tar.gz \
-    && tar xfz apache-maven-3.8.1-bin.tar.gz \
-    && mv apache-maven-3.8.1 /opt/maven \
-    && rm apache-maven-3.8.1-bin.tar.gz
+RUN wget -q https://download.java.net/java/GA/jdk18/43f95e8614114aeaa8e8a5fcf20a682d/36/GPL/openjdk-18_linux-x64_bin.tar.gz \
+    && tar xfz openjdk-18_linux-x64_bin.tar.gz \
+    && mv jdk-18 /opt/jdk \
+    # Install a newer Maven than the one in apt
+    && wget -q https://dlcdn.apache.org/maven/maven-3/3.8.8/binaries/apache-maven-3.8.8-bin.tar.gz \
+    && tar xfz apache-maven-3.8.8-bin.tar.gz \
+    && mv apache-maven-3.8.8 /opt/maven \
+    && rm apache-maven-3.8.8-bin.tar.gz
 
 # A non-root user is needed for some FilesystemSourceTest tests to work.
 ARG user=cantaloupe

docker/Linux-JDK16/docker-compose.yml → docker/Linux-JDK18/docker-compose.yml

@@ -8,7 +8,7 @@ services:
   cantaloupe:
     build:
       context: ../../
-      dockerfile: $PWD/docker/Linux-JDK16/Dockerfile
+      dockerfile: $PWD/docker/Linux-JDK18/Dockerfile
   minio:
     image: minio/minio
     environment:

docker/Windows-JDK11/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/windows/servercore:ltsc2019
+FROM mcr.microsoft.com/windows/servercore:ltsc2022
 
 ENV chocolateyUseWindowsCompression false
 

docker/Windows-JDK11/Dockerfile-minio

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/windows/servercore:ltsc2019
+FROM mcr.microsoft.com/windows/servercore:ltsc2022
 
 ENV MINIO_ACCESS_KEY=MinioUser
 ENV MINIO_SECRET_KEY=OpenSesame

docker/Windows-JDK16/Dockerfile → docker/Windows-JDK18/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/windows/servercore:ltsc2019
+FROM mcr.microsoft.com/windows/servercore:ltsc2022
 
 ENV chocolateyUseWindowsCompression false
 
@@ -10,8 +10,9 @@ RUN powershell -Command \
 
 # Install various dependencies
 # TODO: openjpeg
-RUN choco install -y adoptopenjdk16 maven ffmpeg
-
+RUN choco install -y maven ffmpeg
+RUN choco install -y openjdk --version=18.0.2
+
 # Install TurboJpegProcessor dependencies TODO: libjpeg-turbo
 #RUN mkdir -p /opt/libjpeg-turbo/lib
 #COPY docker/Windows10-JDK11/image_files/libjpeg-turbo/lib64 c:\windows\system32

docker/Windows-JDK16/Dockerfile-minio → docker/Windows-JDK18/Dockerfile-minio

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/windows/servercore:ltsc2019
+FROM mcr.microsoft.com/windows/servercore:ltsc2022
 
 ENV MINIO_ACCESS_KEY=MinioUser
 ENV MINIO_SECRET_KEY=OpenSesame

docker/Windows-JDK16/docker-compose.yml → docker/Windows-JDK18/docker-compose.yml

@@ -8,11 +8,11 @@ services:
   cantaloupe:
     build:
       context: ../../
-      dockerfile: docker/Windows-JDK16/Dockerfile
+      dockerfile: docker/Windows-JDK18/Dockerfile
   minio:
     build:
       context: ../../
-      dockerfile: docker/Windows-JDK16/Dockerfile-minio
+      dockerfile: docker/Windows-JDK18/Dockerfile-minio
     environment:
       MINIO_ACCESS_KEY: MinioUser
       MINIO_SECRET_KEY: OpenSesame