openexr — Commit History

Addresses security vulnerabilities

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10

Obtained from:	GitHub repo
Security:	CVE-2026-39886
		CVE-2026-40244
		CVE-2026-40250

Addresses several security vulnerabilities

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.9/CHANGES.md#version-349-april--3-2026

PR:		294197
Security:       CVE-2026-34589, CVE-2026-34588, CVE-2026-34380,
		CVE-2026-34379, CVE-2026-34378,
		adb096d4-2e72-11f1-acc1-339a1a6999b0

Bugfix release

Changelog(s):
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.7
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.6

PR:		293859

"Patch release that fixes an incorrect size check in
istream_nonparallel_read that could lead to a buffer overflow on invalid
input data."

Also fix i386 self-tests by adding -msse2: i386 builds require SSE2, but
the upstream cmake stuff does not enable this, so use CFLAGS_i386.

To prevent people seeing SIGILL crashes down late at run-time,
check if the CPU is sse2-capable by querying the clang compiler from
the pre-install script (pkg-plist's @preexec). Suggested by diizzy@.
  Other than that we could use the cpuid or the lscpu port instead, but
let's for now assume everything that wants to run OpenEXR also has a
working cc that is clang and has -march=native and gives us CPU details).
(GCC also gives us this but will use a different output format.)

While here, make failed tests verbose through ctest's environment so we
can see what's up from the build log already. (We need to go through
this indirection because our cmake.mk's :testing feature wants to go
through the test target instead of calling ctest directly.)

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.5
Security:	716d25a6-0fdc-11f1-bfdf-ff9355aecb00
MFH:		2026Q1

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases

OpenEXR attempts to use F16C intrinsics when AVX available and
at least one of these is true: F16C available, GCC used, or clang used.

Intel Sandy Bridge processors do have AVX extensions,
but no F16C instruction set extension, so compilers (clang 19, 20, gcc 14)
complain:

work/openexr-3.4.4/src/lib/OpenEXRCore/unpack.c:37:18:
  error: always_inline function '_mm256_cvtph_ps' requires target feature 'f16c',
  but would be inlined into function 'half_to_float_buffer'
  that is compiled without support for 'f16c'
   37 |             out, _mm256_cvtph_ps (_mm_loadu_si128 ((const __m128i*) in)));
      |                  ^

Not bumping PORTREVISION because this is not a supported configuration.

https://github.com/AcademySoftwareFoundation/openexr/issues/2231

Reported by:	"UnitedMarsupials"
MFH:		2025Q4

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.4

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.3
Security:	c71a3914-ba96-11f0-aada-f59a8ea34d12
MFH:		2025Q4

We've developed an officially accepted solution with upstream and
upstream reporter of the issue that prompted the change that broke our
DEBUG builds, so let's switch to the official change to minimize
differences from upstream.

https://github.com/AcademySoftwareFoundation/openexr/issues/1981
https://github.com/AcademySoftwareFoundation/openexr/pull/2166/commits/efa3b861ab0ab515ec7923ce02500acf667eabb0

PR:		290615

Note I am not updating to v3.4.2 because it does not contain changes
for FreeBSD - it contains a fix for Windows, and the other Imath change
is unnecessary for us because our ports system handles the requisite.

Apparently broken with upstream commit
https://github.com/AcademySoftwareFoundation/openexr/commit/848f84ae7504adcd89ec0da182499d5cd4e3b245

Might fix
PR:		290615
MFH:		2025Q4

No PORTREVISION bump because packaging fails if the issue strikes.

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/aous72/OpenJPH/releases

ChangeLog:	<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.1>

- Add BUILD_DEPENDS check

Approved by:	portmgr (blanket)
Obtained from:	https://github.com/AcademySoftwareFoundation/openexr/pull/2122

Adds lossless compression with High Throughput JPEG-2000 (HTJ2K)
encoding, which adds an OpenJPH dependency.

The OneAPI TBB option isn't provided because it massively increases
self-test time on FreeBSD 14.3-amd64 and I don't see how production
use would be different.  This is with an AMD Ryzen processor.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.0

ChangeLog: https://github.com/AcademySoftwareFoundation/Imath/releases/tag/v3.2.0

Note this changes the .so versioning again, so I'll again need to
do additional cleanups because people don't just depend on Imath.
This is unneeded extra work except in the situation of OpenEXR
which is co-developed with Imath by the upstream maintainer,
Academy Software Foundation (ASWF).

I have no intentions of MFH'ing this due to the .so versioning change.

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.5
MFH:		2025Q3 (after a few days)

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.4
MFH:		2025Q2

This contains out-of-bounds memory access fixes, hence:

MFH:		2025Q1
ChangeLog: 	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3

And while here, decouple our PORTVERSION from the openexr version so we
don't break builds.

v3.3.2 seems to have a regression and causes a warning around Latest
News inserts on one site, so add -DSPHINX_OPTS= to override the default
of -W which means "treat warnings as errors", as of 3.3.2, I see one
warning.

We can now remove our patch to build the exrmetrics manpage.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.2

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.1

Also add a local docs/CMakeLists.txt patch to add an exrmetrics man
page, omission reported upstream to
https://github.com/AcademySoftwareFoundation/openexr/issues/1881

This changes the ABI (but not the API) and .so file name,
so we will need to bump all PORTREVISIONs of users, and we'll also fix
graphics/ctl and multimedia/olive.

This is not going to be MFHd to 2024Q4 due to API change, and therefore
has also waited for 2024Q4 to branch before we committed this to main,
so as to avoid 2024Q4 breakage.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.0
PR:		281859

In order to avoid ctest performance regressions, we also required
commit cbee39bcd1a2472b8f3e24754f5bb3a3429b79a0 from PR 278533.

PR:		278500

- share the distfiles directory and the NO_WRKSUBDIR
- update patch for updated upstream CMakeLists.txt infrastructure

ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/blob/main/CHANGES.md#version-324-march-26-2024
ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/blob/main/CHANGES.md#version-323-march-6-2024

Switch from auto-generated tarballs to those that use sigstore,
verify that -- see
https://github.com/AcademySoftwareFoundation/openexr/blob/main/SECURITY.md#signed-releases
and shuffle variables accordingly, including DISTFILES, EXTRACT_ONLY and NO_WRKSUBDIR updates.

...by replacing CPIO with a MKDIR/CP combo.

Reported by:	arrowd@

...and avoid downloading in the configure phase.

Reported by:	Tatsuki Makino

While here, revert TESTING_UNSAFE, which does not reproduce,
neither under WITH_TESTING=yes in make.conf in poudriere after "make
distclean".

Bump PORTREVISION.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.2.2/CHANGES.md#version-322-february-11-2024

Security:	CVE-2023-5841
Security:	f161a5ad-c9bd-11ee-b7a7-353f1e043d9a
MFH:		2024Q1

ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/blob/v3.2.1/CHANGES.md#version-321-september-27-2023

with one additional patch to change deflate_LIBRARIES to
deflate_LINK_LIBRARIES in the cmake stuff in order to unbreak
the build.

Reported upstream: https://github.com/AcademySoftwareFoundation/openexr/issues/1571

Upstream intended to release v3.2.2 on short notice, but the efforts
appear to have stalled, so ship 3.2.1 with our local fix.

I forgot to commit this change that was part of my test. Sorry.

Reported by:	antoine@

- Also install manual pages (generated through help2man)
- The website (formerly known "DOCS" build) requires the "convert(1)"
  tool, which is part of ImageMagick, which itself depends on OpenEXR.
  To break the loop, split out the offline website build to a new
  package, graphics/openexr-website-docs

Changelog: https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.11/CHANGES.md#version-3111-august-13-2023
MFH:       2023Q3

Reported by:	jkim@FreeBSD.org
Obtained from:	https://github.com/AcademySoftwareFoundation/openexr/pull/1507
MFH:		2023Q3

Changelog: 	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.10/CHANGES.md#version-3110-august-2-2023

MFH:		2023Q3

https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.9/CHANGES.md#version-319-june-25-2023

Security:       06428d91-152e-11ee-8b14-dbdd62da85fb

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.8

...because math/Imath 3.1.9 reset the major version of
libImath to 29 from 31. See math/Imath 3.1.9 for details.

...after its major revision update.

Changelog:
https://github.com/AcademySoftwareFoundation/Imath/blob/v3.1.8/CHANGES.md#version-318-May-22-2023

This is mostly to incorporate build fixes for ARMv7 regressions,
which our 3.1.6_1 port had already brought, and bumps the library's minor
version, so let's take it although it should be functionally the same.

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.7/CHANGES.md#version-317-march-28-2023

OpenEXR 3.1.6 introduced several NEON-based optimizations
that implied Aarch64. Add patched, either picked from
upstream, or written by mandree@, to enable those
NEON features that also require Aarch64 only there.

PR-1366 is cherry-picked from upstream, and patch-lib/patch-test files
are my work but build upon said PR.

Also cherry-pick PR1354 that adds a missing check for AVX,
which is why I am bumping PORTREVISION because it might change
code (I have not checked).

https://github.com/AcademySoftwareFoundation/openexr/issues/1365

PR:		270348
Reported by:	fuz@ (Robert Clausecker)

Upstream bug report:
https://github.com/AcademySoftwareFoundation/openexr/issues/1365

PR:		270348

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.6/CHANGES.md#version-316-march-9-2023

...to match the Imath 3.1.7 update.

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)

A big Thank You to the original contributors of these ports:

  *  "Waitman Gobble" <uzimac@da3m0n8t3r.com>
  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Abel Chow <ozsanh45vds001@sneakemail.com>
  *  Adam Weinberger <adamw@FreeBSD.org>
  *  Ade Lovett <ade@FreeBSD.org>
  *  Ade Lovett <ade@lovett.com>
  *  Akinori MUSHA aka knu <knu@idaemons.org>
  *  Aldis Berjoza <aldis@bsdroot.lv>
  *  Alex Hayward <xelah@xelah.com>
  *  Alex Ivasyuv <siegerstein@pochta.ru>
  *  Alex Samorukov <samm@os2.kiev.ua>
  *  Alexander Gromnitsky
  *  Alexander Kojevnikov <alexander@kojevnikov.com>
  *  Alexander Logvinov <ports@logvinov.com>
  *  Alexander Nedotsukov <bland@FreeBSD.org>
  *  Alexander Nedotsukov <bland@mail.ru>
  *  Alexander Y. Grigoryev <alexander.4mail@gmail.com>
  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Alonso Cardenas Marquez <acm@FreeBSD.org>
  *  Anatoliy Dmytriyev <tolid@plab.ku.dk>
  *  Anatoly Borodin <anatoly.borodin@gmail.com>
  *  Anders Nordby <anders@fix.no>
  *  Andras Horvath <han@log69.com>
  *  Andreas Daehn <ad001@uni-rostock.de>
  *  Andrew Pantyukhin <infofarmer@FreeBSD.org>
  *  Andrey Slusar <anray@FreeBSD.org>
  *  Andrey Zakhvatov
  *  Anes Mukhametov <anes@anes.su>
  *  Anonymous <swell.k@gmail.com>
  *  Anton Berezin <tobez@FreeBSD.org>
  *  Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>)
  *  Arjan van Leeuwen <avleeuwen@piwebs.com>
  *  Ashish SHUKLA <ashish@FreeBSD.org>
  *  Bill Fumerola <billf@chc-chimes.com>
  *  Björn König <bkoenig@alpha-tierchen.de>
  *  Brad Hendrickse <bradh@iafrica.com>
  *  Bruce M Simpson <bms@FreeBSD.org>
  *  Carlos Eduardo G. Carvalho <cartola@openit.com.br>
  *  Charlie Kester <corky1951@comcast.net>
  *  Choe, Cheng-Dae
  *  Choe, Cheng-Dae <whitekid@gmail.com>
  *  Chris D. Faulhaber <jedgar@FreeBSD.org>
  *  Chris D. Faulhaber <jedgar@fxp.org>
  *  Chris Piazza <cpiazza@FreeBSD.org>
  *  Christopher Key <cjk32@cam.ac.uk>
  *  Chuck Robey <chuckr@FreeBSD.org>
  *  Corey Smith <corsmith@gmail.com>
  *  Dan Langille <dvl@FreeBSD.org>
  *  Daniel O'Connor <darius@dons.net.au>
  *  Daniel Roethlisberger <daniel@roe.ch>
  *  Danilo Egea Gondolfo <danilo@FreeBSD.org>
  *  Dave Cottlehuber <dch@skunkwerks.at>
  *  David Bremner <bremner@unb.ca>
  *  David Gilbert <dgilbert@velocet.ca>
  *  David Naylor <dbn@FreeBSD.org>
  *  David Yeske <dyeske@gmail.com>
  *  Denis Barov <dindin@dindin.ru>
  *  Denis Podolskiy <bytestore@yandex.ru>
  *  Dennis Herrmann <adox@mcx2.org>
  *  Devaux Fabien <fab@gcu.info>
  *  Dmitry Sivachenko <dima@Chg.RU>
  *  Dominik Brettnacher <domi@nonsensss.de>
  *  Donn Miller <dmmiller@cvzoom.net>
  *  Douglas Carmichael <dcarmich@mcs.com>
  *  Douglas K. Rand <rand@meridian-enviro.com>
  *  Edwin Groothuis <edwin@mavetju.org>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@critical.ch>
  *  Emil J.V. Björsell (Jev)
  *  Emmanuel Vadot <manu@FreeBSD.org>
  *  Eric Anholt <anholt@FreeBSD.org>
  *  Eric Freeman <freebsdports@chillibear.com>
  *  Eric P. Scott <eps+pbug0703@ana.com>
  *  Erwin Lansing <erwin@FreeBSD.org>
  *  Eugene Mychlo <myc@barev.net>
  *  Fernan Aguero <fernan@iib.unsam.edu.ar>
  *  Franz Klammer <klammer@webonaut.com>
  *  FreeBSD GNOME Team <gnome@FreeBSD.org>
  *  G. Adam Stanislav <adam@whizkidtech.net>
  *  Garrett Wollman <wollman@lcs.mit.edu>
  *  Gea-Suan Lin <gslin@gslin.org>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  Gerrit Beine (<gerrit.beine@gmx.de>)
  *  Gerrit Beine (<tux@pinguru.net>)
  *  Glenn Johnson
  *  Greg Lewis <glewis@FreeBSD.org>
  *  Gustau Perez <gustau.perez@gmail.com>
  *  Gustau Pérez i Querol <gustau.perez@gmail.com>
  *  Gvozdikov Veniamin <g.veniamin@googlemail.com>
  *  Hernan Di Pietro <hernan.di.pietro@gmail.com>
  *  Hiroto Kagotani <hiroto.kagotani@gmail.com>
  *  Horia Racoviceanu <horia@racoviceanu.com>
  *  Hye-Shik Chang <perky@fallin.lv>
  *  Hye-Shik Chang <perky@python.or.kr>
  *  Igor Pokrovsky <ip@doom.homeunix.org>
  *  Igor Pokrovsky <tiamat@comset.net>
  *  James FitzGibbon <jfitz@FreeBSD.org>
  *  Jamie Hermans <jamie@hermans.ca>
  *  Jan Henrik Sylvester <me@janh.de>
  *  Janni
  *  Janos Mohacsi <janos.mohacsi@bsd.hu>
  *  Jason Helfman <jgh@FreeBSD.org>
  *  Jean-Marc Zucconi <jmz@FreeBSD.org>
  *  Jean-Sébastien Pédron <dumbbell@FreeBSD.org>
  *  Jean-Yves Lefort <jylefort@FreeBSD.org>
  *  Jean-Yves Lefort <jylefort@brutele.be>
  *  Jeff Molofee
  *  Jeremy Norris <ishmael127@home.com>
  *  Jeremy Norris <ishmael27@home.com>
  *  Joe Marcus Clarke <marcus@FreeBSD.org>
  *  Johannes Dieterich <jmd@FreeBSD.org>
  *  Johannes Jost Meixner <johannes@perceivon.net>
  *  Johannes Meixner <johannes@perceivon.net>
  *  John Hay
  *  John McAree <john@mcaree.org>
  *  John Prather
  *  John Reynolds <johnjen@reynoldsnet.org>
  *  Joris Dedieu <joris.dedieu@gmail.com>
  *  Jose Alonso Cardenas Marquez <acardenas@bsd.org.pe>
  *  Jose Jachuf <jjachuf@gmail.com>
  *  Joseph Koshy <koshy@india.hp.com>
  *  Juergen Unger <j.unger@choin.net>
  *  KANOU Hiroki <kanou@mil.allnet.ne.jp>
  *  KIRIYAMA Kazuhiko
  *  Kay Lehmann
  *  Kevin Golding <ports@caomhin.org>
  *  Kimura Fuyuki <fuyuki@hadaly.org>
  *  Koop Mast <kwm@FreeBSD.org>
  *  Kris Kennaway <kris@FreeBSD.org>
  *  Kris Moore <kmoore@FreeBSD.org>
  *  Kubilay Kocak <koobs@FreeBSD.org>
  *  Kurt Kanzenbach <kurt@kmk-computers.de>
  *  Kyle Martin <mkm@ieee.org>
  *  Laurent Courty
  *  Leonardo Martins <lmartins@nepe.eee.ufg.br>
  *  Lev Serebryakov <lev@FreeBSD.org>
  *  Malte Lance <malte.lance@gmx.net>
  *  Marc Fonvieille <blackend@FreeBSD.org>
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org> et al.
  *  Mark Atkinson <atkin901@gmail.com>
  *  Mark Murray <markm@FreeBSD.org>
  *  Mark Pulford <mark@kyne.com.au>
  *  Markus Brueffer <markus@FreeBSD.org>
  *  Martin Dieringer <martin.dieringe@gmx.de>
  *  Martin Dieringer <martin.dieringer@gmx.de>
  *  Martin Matuska <mm@FreeBSD.org>
  *  Martin Neubauer <m.ne@gmx.net>
  *  Martin Sugioarto <martin.sugioarto@udo.edu>
  *  Martin Tournoij <carpetsmoker@rwxrwxrwx.net>
  *  Martin Tournoij <carpetsmoker@xs4all.nl>
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Mateusz Piotrowski <0mp@FreeBSD.org>
  *  Mathieu Arnold
  *  Matthew Luckie <mjl@luckie.org.nz>
  *  Matthew X. Economou <xenophon+fbsdports@irtnog.org>
  *  Matthias Fechner <mfechner@FreeBSD.org>
  *  Matthieu Volat <mazhe@alkumuna.eu>
  *  Maurice Castro <maurice@serc.rmit.edu.au>
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Michael Gmelin <freebsd@grem.de>
  *  Michael Johnson <ahze@FreeBSD.org>
  *  Michael Johnson <ahze@ahze.net>
  *  Michael Nottebrock <lofi@FreeBSD.org>
  *  Michael Reifenberger <mr@FreeBSD.org>
  *  Mike Krutov <neko@takino.org>
  *  Mikhail T. <mi@aldan.algebra.com>
  *  Mikhail Teterin <mi@aldan.algebra.com>
  *  Muhammad Moinur Rahman <5u623l20@gmail.com>
  *  NAKATA Maho <maho@FreeBSD.org>
  *  Naram Qashat <cyberbotx@cyberbotx.com>
  *  Nick Hilliard <nick@foobar.org>
  *  Nicola Vitale <nivit@FreeBSD.org>
  *  Nicola Vitale <nivit@email.it>
  *  Nikolay Korotkiy <sikmir@gmail.com>
  *  Norio Suzuki <nosuzuki@e-mail.ne.jp>
  *  Oliver Heesakkers <dev2@heesakkers.info>
  *  Oliver Lehmann <oliver@FreeBSD.org>
  *  Olivier Duchateau
  *  Paul Everlund
  *  Pav Lucistnik <pav@FreeBSD.org>
  *  Pedro F. Giffuni
  *  Pedro Garcia Freitas <sawp@sawp.com.br>
  *  Pedro Giffuni
  *  Pedro Giffuni <pfg@FreeBSD.org>
  *  Pete Fritchman <petef@FreeBSD.org>
  *  Pete Fritchman <petef@databits.net>
  *  Peter Ankerstal <peter@pean.org>
  *  Peter Jeremy <peterjeremy@optushome.com.au>
  *  Peter Schmiedeskamp <pschmied@qwest.net>
  *  Phil Phillips <pphillips@experts-exchange.com>
  *  Pietro Cerutti <gahr@FreeBSD.org>
  *  Pietro Cerutti <gahr@gahr.ch>
  *  Piotr Kubaj <pkubaj@anongoth.pl>
  *  Piotr Smyrak <smyru@heron.pl>
  *  Piotr Smyrak, piotr.smyrak@heron.pl
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Quentin Stievenart <acieroid@awesom.eu>
  *  R Joseph Wright <rjoseph@mammalia.org>
  *  Radim Kolar
  *  Rainer Hurling <rhurlin@gwdg.de>
  *  Randall Hopper
  *  Randall Hopper <aa8vb@ipass.net>
  *  Randall Hopper <aa8vb@nc.rr.com>
  *  Reinier de Blois <rddeblois@gmail.com>
  *  Richard Hwang <rhwang@bigpanda.com>, Mikhail Teterin <mi@aldan.algebra.com>, Jun-ichiro itojun Itoh <itojun@itojun.org>
  *  Rick Elrod <codeblock@eighthbit.net>
  *  Rob Farmer <rfarmer@predatorlabs.net>
  *  Rod Person <rodperson@rodperson.com>
  *  Roland Jesse <roland.jesse@gmx.net>
  *  Romain Tartiere <romain@FreeBSD.org>
  *  Ron van Daal
  *  Ronald Kuehn <rk@ronald.org>
  *  Rong-En Fan <rafan@infor.org>
  *  Rusmir Dusko <nemysis@FreeBSD.org>
  *  Rusty Nejdl <rnejdl@ringofsaturn.com>
  *  Ryan Melcer <rmelcer@iteris.com>
  *  Ryan Steinmetz <zi@FreeBSD.org>
  *  Sahil Tandon <sahil@FreeBSD.org>
  *  Sam Lawrance
  *  Satoshi Asami <asami@FreeBSD.org>
  *  Satoshi Taoka <taoka@FreeBSD.org>
  *  Seiichirou Hiraoka
  *  Serge Negodyuck <petr@petrovich.kiev.ua>
  *  Sergey A. Osokin <osa@FreeBSD.org>
  *  Sergey Skvortsov <skv@protey.ru>
  *  Sergey V. Dyatko <sergey.dyatko@gmail.com>
  *  Shane Ambler
  *  Shaun Amott <shaun@inerd.com>
  *  Shell Hung <shell@shellhung.org>
  *  Shigeyuki FUKUSHIMA <shige@FreeBSD.org>
  *  Simun Mikecin <numisemis@yahoo.com>
  *  Sofian Brabez <sbrabez@gmail.com>
  *  Stanislav Sedov <ssedov@mbsd.msk.ru>
  *  Stanislav Sedov <stas@FreeBSD.org>
  *  Stas Timokhin <devel@stasyan.com>
  *  Stas Timokhin <stast@bsdportal.ru>
  *  Stefan Walter <sw@gegenunendlich.de>
  *  Stephen Roome <steve@pepcross.com>
  *  Steve Wills <steve@meatwad.mouf.net>
  *  Steve Wills <swills@FreeBSD.org>
  *  Steven Kreuzer <skreuzer@FreeBSD.org>
  *  Steven Wallace <swallace@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  TAKAHASHI Kaoru <kaoru@kaisei.org>
  *  TAKATSU Tomonari <tota@FreeBSD.org>
  *  TAKATSU Tomonari <tota@rtfm.jp>
  *  TAOKA Fumiyoshi
  *  TATEISHI Katsuyuki <katsu@iec.hiroshima-u.ac.jp>
  *  Tassilo Philipp <tphilipp@potion-studios.com>
  *  Thibault Payet <monwarez@mailoo.org>
  *  Thierry Thomas <thierry@pompo.net>
  *  Thomas Dreibholz <dreibh@iem.uni-due.de>
  *  Thomas Gellekum <tg@FreeBSD.org>
  *  Thomas Hurst <tom@hur.st>
  *  Tilman Linneweh <arved@FreeBSD.org>
  *  Tim Bishop <tim@bishnet.net>
  *  Tod McQuillin <devin@spamcop.net>
  *  Tomoyuki Sakurai <cherry@trombik.org>
  *  Tsung-Han Yeh <snowfly@yuntech.edu.tw>
  *  UMENO Takashi <umeno@rr.iij4u.or.jp>
  *  Ulrich Spoerlein <q@uni.de>
  *  Vasil Dimov <vd@FreeBSD.org>
  *  Veniamin Gvozdikov <vg@FreeBSD.org>
  *  Vincent Tantardini <vinc@FreeBSD-fr.org>
  *  Vladimir Chukharev
  *  Wen Heping <wen@FreeBSD.org>
  *  Wen Heping <wenheping@gmail.com>
  *  Wen heping <wenheping@gmail.com>
  *  Wen heping<wenheping@gmail.com>
  *  Will Andrews <andrews@technologist.com>
  *  Yi-Jheng Lin <yzlin@cs.nctu.edu.tw>
  *  Ying-Chieh Liao <ijliao@FreeBSD.org>
  *  Yinghong Liu <relaxbsd@gmail.com>
  *  Yinghong.Liu <relaxbsd@gmail.com>
  *  Yuan-Chung Hsiao <ychsiao@ychsiao.org>
  *  Yukihiro Nakai <Nakai@Mlab.t.u-tokyo.ac.jp>
  *  Yukihiro Nakai <nacai@iname.com>
  *  Yukihiro Nakai <nakai@mlab.t.u-tokyo.ac.jp>
  *  Yuri Victorovich <yuri@FreeBSD.org>
  *  Yuri Victorovich <yuri@rawbw.com>
  *  Yuu Yashiki
  *  Yuzo FURUKAWA <hurukawa@kuee.kyoto-u.ac.jp>
  *  Zhihao Yuan <lichray@gmail.com>
  *  Zsolt Udvari <udvzsolt@gmail.com>
  *  ache
  *  alepulver
  *  anhot
  *  antonakis@gmail.com
  *  argv[0] (Iouri V. Ivliev)
  *  arved
  *  asami
  *  bf <bf@FreeBSD.org>
  *  bmc@WillsCreek.COM
  *  buganini@gmail.com
  *  cacho@mexicano.gdl.iteso.mx
  *  cartola (Carlos E. G. Carvalho)
  *  cartola@openit.com.br
  *  cfs@ing.puc.cl (original)
  *  chinsan
  *  chinsan <chinsan.tw@gmail.com>
  *  coryking
  *  cracauer@cons.org "Martin Cracauer"
  *  demon@FreeBSD.org
  *  dillon
  *  dom@happygiraffe.net
  *  erich@FreeBSD.org
  *  fenner
  *  fernan@iib.unsam.edu.ar
  *  frankch@waru.life.nthu.edu.tw
  *  gahr
  *  gary@hotlava.com
  *  gerard
  *  giffunip@asme.org
  *  glebius@FreeBSD.org
  *  gurkan@phys.ethz.ch
  *  hsu
  *  ijliao
  *  jamie
  *  jedgar@FreeBSD.org
  *  jeff@cetlink.net
  *  jjachuf@gmail.com
  *  jmz
  *  johalun
  *  johan
  *  johans
  *  kwm@FreeBSD.org
  *  lbartoletti <lbartoletti@FreeBSD.org>
  *  lesi@FreeBSD.org
  *  lichray@gmail.com
  *  luigi@FreeBSD.org
  *  maho@FreeBSD.org
  *  marcus@FreeBSD.org
  *  mb@imp.ch
  *  mi
  *  mm@FreeBSD.org
  *  nemysis <nemysis@gmx.ch>
  *  nik
  *  nork@FreeBSD.org
  *  olgeni@FreeBSD.org
  *  paulo@isr.uc.pt
  *  petef@FreeBSD.org
  *  pgs
  *  ports@FreeBSD.org
  *  proff@iq.org
  *  punkt.de Hosting Team <mops@punkt.de>
  *  rfarmer@predatorlabs.net
  *  roberto
  *  roland.jesse@gmx.net
  *  rpsfa@rit.edu
  *  saper@system.pl
  *  smace
  *  sobomax
  *  stas
  *  stb@lassitu.de
  *  theraven@FreeBSD.org
  *  thierry@pompo.net
  *  tobez
  *  trasz <trasz@pin.if.uz.zgora.pl>
  *  trevor
  *  vanilla
  *  will
  *  wolman@cs.washington.edu
  *  yukinopo@livedoor.com

With hat:	portmgr

*  Add backwards-compatibilty flags to the core library to match
    original behavior of the the c++ library. Fixes reading of certain
    files by the new core.
  * Documentation refers to primary branch as "main"
  * Update the CI workflow matrix to VFX-CY2022

Specific OSS-fuzz issues addressed:

 *  OSS-fuzz 46309 Heap-buffer-overflow in Imf_3_1::memstream_read
 *  OSS-fuzz 46083 Out-of-memory in openexr_exrcheck_fuzzer
 *  OSS-fuzz 45899 Integer-overflow in internal_exr_compute_chunk_offset_size
 *  OSS-fuzz 44084 Out-of-memory in openexr_exrcheck_fuzzer

MFH:		2022Q2

* Several bug fixes to properly reject invalid input upon read
* Miscellaneous documentation improvements

This addresses one public security vulnerability:

* CVE-2021-45942 Heap-buffer-overflow in Imf_3_1::LineCompositeTask::execute

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.4/CHANGES.md#version-314-january-26-2022

Security:	CVE-2021-45942
MFH:		2022Q1

Note that the default zip compression level is changed from 6 to 4
by the upstream, to improve compression times by 2x "with only a tiny
drop in compression ratio."

Release notes:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.3

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.3/CHANGES.md#version-313-october-27-2021

Approved by:	portmgr (blanket)

Documentation now also available through
https://openexr.readthedocs.io/

Release Notes:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.2

Detailed ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.2/CHANGES.md#version-312-october-4-2021

Now requires py-breathe, Sphinx, and Doxygen, to build documentation.

- adds a new libOpenEXRCore library
- bumps so library version to 30
- requires PORTREVISION bump of its users

Release Notes:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.1/CHANGES.md

...and update LIB_DEPENDS to Imath's new name.

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.0.5

Security:	f2596f27-db4c-11eb-8bc6-c556d71493c9

Patch release that corrects a problem with the release version numbers
in v3.0.2/v3.0.3, and with the referenced Imath release.

Only upstream change is an install-fix that had previously been
cherry-picked by the FreeBSD port already.

Besides the version no., no impact on Imath or OpenEXR code, so
no PORTREVISION bumps of our users this time.

* removes two patches cherry-picked from upstream
* adds install fix cherry-picked from upstream

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.0.2

Cherry-pick an upstream fix to relax users to C++11, only the
OpenEXR code itself requires C++14.

Cherry-pick an upstream fix to prevent overflow in
getScanlineChunkOffsetTableSize.

While here, rename MAJORVER to _MAJORVER as portclippy cleanup.

This requires and uses the new Imath 3.0.1 port.

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5

"Specific OSS-fuzz issues include:

    OSS-fuzz #30291 Timeout in openexr_exrcheck_fuzzer
    OSS-fuzz #29106 Heap-buffer-overflow in Imf_2_5::FastHufDecoder::decode
    OSS-fuzz #28971 Undefined-shift in Imf_2_5::cachePadding
    OSS-fuzz #29829 Integer-overflow in Imf_2_5::DwaCompressor::initializeBuffers
    OSS-fuzz #30121 Out-of-memory in openexr_exrcheck_fuzzer"

Bump PORTREVISION of ports that directly depend on openexr and/or ilmbase.

MFH:		2021Q1
Security:	98044aba-6d72-11eb-aed7-1b1b8a70cc8b

Unfortunately, this was missed with the ilmbase update, and
causes yet another PORTREVISION bump on all dependent ports.

repeating ilmbase's commit log here:

"Patch release with various bug/sanitizer/security fixes, primarily related to
reading corrupted input files."
<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.4>

Cherry-pick upstream commit for GCC 11 compatibility:
<https://github.com/AcademySoftwareFoundation/openexr/commit/a40a6151c4e746eb8f93c7c06992d0ec11289fdc>

Since this changes the patchlevel of the solibs, bump PORTREVISION of dependent
ports just to be sure.
(graphics/py-openshadinglanguage is unaltered and .includes the revision bump
from .../openshadinglanguage.)

MFH:		2021Q1 (this requires discussion by ports-secteam@!)

Reported by:	VVD (IRC, #bsdports)

ChangeLog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.3

"Patch release with various bug/security fixes and build/install fixes, plus a performance optimization:

 * Various sanitizer/fuzz-identified issues related to handling of invalid input
 * Fixes to misc compiler warnings [...]
 * Read performance optimization (#782)
 * Fix for building on non-glibc (#798)
 * Fixes to tests"

The full name of shared libraries changed from *.25.0.1 to *.25.0.2
=> PORTREVISION bumps for all ports that use either ilmbase or openexr
coming up in separate commit to ease MFH.

All test builds of direct users succeeded on 12.1 amd64.

MFH:		2020Q3 (patchlevel update w/ security fixes)
Security:	b1d6b383-dd51-11ea-a688-7b12871ef3ad

ChangeLog: https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2
Verbosely: https://github.com/AcademySoftwareFoundation/openexr/blob/v2.5.2/CHANGES.md#version-252-june-15-2020

Security:  714e6c35-c75b-11ea-aa29-d74973d1f9f3
MFH:       2020Q3

USE_GCC=yes breaks build on head, because powerpc now uses libc++. On stable/11 and stable/12, it's redundant because there already is USES=compiler:c++14-lang.

Upstream release notes:
* A patch release that corrects the SO version for the v2.5 release,
  which missed getting bumped in v2.5.0.

* This release also fixes an improper failure in IlmImfTest
  when running on ARMv7 and AAarch64.

Bump PORTREVISION of all port directly requiring ilmbase or openexr
that are not marked BROKEN (shlib/.so file version bump).

Test build of all port directly depending on ilmbase or openexr
succeeded in poudriere in a 12.1-RELEASE amd64 jail.

ChangeLog:
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.0

* Bump PORTREVISION of all consumers except py-openimageio (BROKEN).

* cad/PrusaSlicer:
    LIB_DEPENDS: remove version from libHalf.so
    BUILD_DEPENDS+=qt5-buildtools as package (needed on bare metal builds)
    USE_GL+=gl
    USES+=pkgconfig (needed to find libHalf)

...to avoid permanent redirects, or broken sites.

MFH:		2020Q2 (blanket, download/WWW URL chase)

With the EXAMPLES option unset, the plist was mismatched.
Fix all found combinations of DOCS/EXAMPLES dis-/enabled.

While here, LARGE_STACK is apparently an ilmbase-only option as
reported by cmake, remove it.

Reported by:	Matthias Fechner

Changelog <https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1>:

Patch release with minor bug fixes.

Quoting Cary Phillips:
    Various fixes for memory leaks and invalid memory accesses
    Various fixes for integer overflow with large images.
    Various cmake fixes for build/install of python modules.
    ImfMisc.h is no longer installed, since it's a private header.

MFH:		2020Q1 (patchlevel/bugfixes but beware one private .h file removed)

- under WITH_DEBUG=yes builds, avoid renaming the libraries with _d suffix.
  (else it breaks packaging, and we don't want separate lib names) [1]
- while here, avoid creating symlinks from cmake, this causes staging
  violations due to cmake bug #17340, (poudriere testport)
  see https://gitlab.kitware.com/cmake/cmake/issues/17340
- while here, fix "make test" target - it is a left over from 2.3's
  gmake build. Use ctest instead. Removes TEST_TARGET.

No PORTREVISION bump necessary because each and every fixed bug would
cause a broken build and no install.

PR:		243274 [1]
Reported by:	Marcin Cieslak [1] against graphics/ilmbase

graphics/gstreamer1-plugins-openexr: switch from C++98 to C++11 to
match new OpenEXR headers and unbreak compilation.

Bump PORTREVISION of all ports depending directly on either, based
on assessing INDEX-12 (bump_portrevision.pl -l (shallow) used).

Release Notes:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0

The update was deliberately deferred until after 2020Q1, and should
not be MFH'd back to it.

Uses backported patches from upstream Git repository, without the
exr2aces parts, and regenerates all openexr patches from scratch.

MFH:		2019Q4 (blanket, security patches)
Security:	e4d9dffb-2a32-11ea-9693-e1b3f6feec79
Security:	CVE-2018-18443
Security:	CVE-2018-18444

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.

PR:		238330

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.

PR:		231590

Release notes: <https://github.com/openexr/openexr/releases/tag/v2.3.0>

Adjust LIB_DEPENDS of all ports that require ilmbase or openexr to chase
the new lower-case spelling of the name, and to omit the version from the
library name to ease future maintenance.

Bump PORTREVISION of all ports that depend on ilmbase or openexr directly,
so that they all get rebuilt on upgrades.

Add patches to graphics/ampasCTL to keep it alive, with (a) ilmbase now
that its Iex::BaseExc class is no longer derived from std::string,
details were given upstream through https://github.com/ampas/CTL/issues/71
and (b) to unwind semicolon/;-lists in cmake that stem from openexr/
ilmbase pkg-config variables.
(Note ampasCTL is unmaintained as FreeBSD port, and upstream,
and I cannot run-time test it.)

Poudriere build tests on 11.2-RELEASE-p1 amd64 of ALL ports depending
directly or indirectly on ilmbase and/or openexr have passed without
regressions.  Thus invoking due diligence, I believe I have done the
equivalent of an -exp run, and do not require approval for the dependency
chases to third-party ports.