openexr 3.4.10

Addresses security vulnerabilities

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10

Obtained from:	GitHub repo
Security:	CVE-2026-39886
		CVE-2026-40244
		CVE-2026-40250

Addresses several security vulnerabilities

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.9/CHANGES.md#version-349-april--3-2026

PR:		294197
Security:       CVE-2026-34589, CVE-2026-34588, CVE-2026-34380,
		CVE-2026-34379, CVE-2026-34378,
		adb096d4-2e72-11f1-acc1-339a1a6999b0

Bugfix release

Changelog(s):
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.7
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.6

PR:		293859

"Patch release that fixes an incorrect size check in
istream_nonparallel_read that could lead to a buffer overflow on invalid
input data."

Also fix i386 self-tests by adding -msse2: i386 builds require SSE2, but
the upstream cmake stuff does not enable this, so use CFLAGS_i386.

To prevent people seeing SIGILL crashes down late at run-time,
check if the CPU is sse2-capable by querying the clang compiler from
the pre-install script (pkg-plist's @preexec). Suggested by diizzy@.
  Other than that we could use the cpuid or the lscpu port instead, but
let's for now assume everything that wants to run OpenEXR also has a
working cc that is clang and has -march=native and gives us CPU details).
(GCC also gives us this but will use a different output format.)

While here, make failed tests verbose through ctest's environment so we
can see what's up from the build log already. (We need to go through
this indirection because our cmake.mk's :testing feature wants to go
through the test target instead of calling ctest directly.)

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.5
Security:	716d25a6-0fdc-11f1-bfdf-ff9355aecb00
MFH:		2026Q1

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases

OpenEXR attempts to use F16C intrinsics when AVX available and
at least one of these is true: F16C available, GCC used, or clang used.

Intel Sandy Bridge processors do have AVX extensions,
but no F16C instruction set extension, so compilers (clang 19, 20, gcc 14)
complain:

work/openexr-3.4.4/src/lib/OpenEXRCore/unpack.c:37:18:
  error: always_inline function '_mm256_cvtph_ps' requires target feature 'f16c',
  but would be inlined into function 'half_to_float_buffer'
  that is compiled without support for 'f16c'
   37 |             out, _mm256_cvtph_ps (_mm_loadu_si128 ((const __m128i*) in)));
      |                  ^

Not bumping PORTREVISION because this is not a supported configuration.

https://github.com/AcademySoftwareFoundation/openexr/issues/2231

Reported by:	"UnitedMarsupials"
MFH:		2025Q4

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.4

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.3
Security:	c71a3914-ba96-11f0-aada-f59a8ea34d12
MFH:		2025Q4

We've developed an officially accepted solution with upstream and
upstream reporter of the issue that prompted the change that broke our
DEBUG builds, so let's switch to the official change to minimize
differences from upstream.

https://github.com/AcademySoftwareFoundation/openexr/issues/1981
https://github.com/AcademySoftwareFoundation/openexr/pull/2166/commits/efa3b861ab0ab515ec7923ce02500acf667eabb0

PR:		290615

Note I am not updating to v3.4.2 because it does not contain changes
for FreeBSD - it contains a fix for Windows, and the other Imath change
is unnecessary for us because our ports system handles the requisite.

Apparently broken with upstream commit
https://github.com/AcademySoftwareFoundation/openexr/commit/848f84ae7504adcd89ec0da182499d5cd4e3b245

Might fix
PR:		290615
MFH:		2025Q4

No PORTREVISION bump because packaging fails if the issue strikes.

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases

ChangeLog:	<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.1>

- Add BUILD_DEPENDS check

Approved by:	portmgr (blanket)
Obtained from:	https://github.com/AcademySoftwareFoundation/openexr/pull/2122

Adds lossless compression with High Throughput JPEG-2000 (HTJ2K)
encoding, which adds an OpenJPH dependency.

The OneAPI TBB option isn't provided because it massively increases
self-test time on FreeBSD 14.3-amd64 and I don't see how production
use would be different.  This is with an AMD Ryzen processor.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.0

ChangeLog: https://github.com/AcademySoftwareFoundation/Imath/releases/tag/v3.2.0

Note this changes the .so versioning again, so I'll again need to
do additional cleanups because people don't just depend on Imath.
This is unneeded extra work except in the situation of OpenEXR
which is co-developed with Imath by the upstream maintainer,
Academy Software Foundation (ASWF).

I have no intentions of MFH'ing this due to the .so versioning change.

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.5
MFH:		2025Q3 (after a few days)

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.4
MFH:		2025Q2

This contains out-of-bounds memory access fixes, hence:

MFH:		2025Q1
ChangeLog: 	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3

And while here, decouple our PORTVERSION from the openexr version so we
don't break builds.

v3.3.2 seems to have a regression and causes a warning around Latest
News inserts on one site, so add -DSPHINX_OPTS= to override the default
of -W which means "treat warnings as errors", as of 3.3.2, I see one
warning.

We can now remove our patch to build the exrmetrics manpage.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.2

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.1

Also add a local docs/CMakeLists.txt patch to add an exrmetrics man
page, omission reported upstream to
https://github.com/AcademySoftwareFoundation/openexr/issues/1881

This changes the ABI (but not the API) and .so file name,
so we will need to bump all PORTREVISIONs of users, and we'll also fix
graphics/ctl and multimedia/olive.

This is not going to be MFHd to 2024Q4 due to API change, and therefore
has also waited for 2024Q4 to branch before we committed this to main,
so as to avoid 2024Q4 breakage.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.0
PR:		281859

In order to avoid ctest performance regressions, we also required
commit cbee39bcd1a2472b8f3e24754f5bb3a3429b79a0 from PR 278533.

PR:		278500

- share the distfiles directory and the NO_WRKSUBDIR
- update patch for updated upstream CMakeLists.txt infrastructure

ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/blob/main/CHANGES.md#version-324-march-26-2024
ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/blob/main/CHANGES.md#version-323-march-6-2024

Switch from auto-generated tarballs to those that use sigstore,
verify that -- see
https://github.com/AcademySoftwareFoundation/openexr/blob/main/SECURITY.md#signed-releases
and shuffle variables accordingly, including DISTFILES, EXTRACT_ONLY and NO_WRKSUBDIR updates.

...by replacing CPIO with a MKDIR/CP combo.

Reported by:	arrowd@

...and avoid downloading in the configure phase.

Reported by:	Tatsuki Makino

While here, revert TESTING_UNSAFE, which does not reproduce,
neither under WITH_TESTING=yes in make.conf in poudriere after "make
distclean".

Bump PORTREVISION.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.2.2/CHANGES.md#version-322-february-11-2024

Security:	CVE-2023-5841
Security:	f161a5ad-c9bd-11ee-b7a7-353f1e043d9a
MFH:		2024Q1

ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/blob/v3.2.1/CHANGES.md#version-321-september-27-2023

with one additional patch to change deflate_LIBRARIES to
deflate_LINK_LIBRARIES in the cmake stuff in order to unbreak
the build.

Reported upstream: https://github.com/AcademySoftwareFoundation/openexr/issues/1571

Upstream intended to release v3.2.2 on short notice, but the efforts
appear to have stalled, so ship 3.2.1 with our local fix.

I forgot to commit this change that was part of my test. Sorry.

Reported by:	antoine@

- Also install manual pages (generated through help2man)
- The website (formerly known "DOCS" build) requires the "convert(1)"
  tool, which is part of ImageMagick, which itself depends on OpenEXR.
  To break the loop, split out the offline website build to a new
  package, graphics/openexr-website-docs

Changelog: https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.11/CHANGES.md#version-3111-august-13-2023
MFH:       2023Q3

Reported by:	jkim@FreeBSD.org
Obtained from:	https://github.com/AcademySoftwareFoundation/openexr/pull/1507
MFH:		2023Q3

Changelog: 	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.10/CHANGES.md#version-3110-august-2-2023

MFH:		2023Q3

https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.9/CHANGES.md#version-319-june-25-2023

Security:       06428d91-152e-11ee-8b14-dbdd62da85fb

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.8

...because math/Imath 3.1.9 reset the major version of
libImath to 29 from 31. See math/Imath 3.1.9 for details.

...after its major revision update.

Changelog:
https://github.com/AcademySoftwareFoundation/Imath/blob/v3.1.8/CHANGES.md#version-318-May-22-2023

This is mostly to incorporate build fixes for ARMv7 regressions,
which our 3.1.6_1 port had already brought, and bumps the library's minor
version, so let's take it although it should be functionally the same.

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.7/CHANGES.md#version-317-march-28-2023

OpenEXR 3.1.6 introduced several NEON-based optimizations
that implied Aarch64. Add patched, either picked from
upstream, or written by mandree@, to enable those
NEON features that also require Aarch64 only there.

PR-1366 is cherry-picked from upstream, and patch-lib/patch-test files
are my work but build upon said PR.

Also cherry-pick PR1354 that adds a missing check for AVX,
which is why I am bumping PORTREVISION because it might change
code (I have not checked).

https://github.com/AcademySoftwareFoundation/openexr/issues/1365

PR:		270348
Reported by:	fuz@ (Robert Clausecker)

Upstream bug report:
https://github.com/AcademySoftwareFoundation/openexr/issues/1365

PR:		270348

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.6/CHANGES.md#version-316-march-9-2023

...to match the Imath 3.1.7 update.

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)