RPM 4.18.0 released!

[pmatilai]

Year 2021 proved challenging in various ways, but here we go again. By far the biggest challenge in this release was dealing with the symlink CVE pile from last year, which required a big rework of the file handling code, and rewriting --restore to take advantage of the same code. Which is why there's perhaps less new exciting things than in some other recent releases, but there's some good stuff anyway.

The obligatory highlights summary:

• Big file handling rework to address a class of symlink vulnerabilities during install, restore and erasure
• More intuitive conditional builds macro %bcond
• Weak dependencies accept qualifiers like meta and pre now
• New interactive shell for working with macros (rpmspec --shell) and embedded Lua (rpmlua)
• New %conf spec section for build configuration
• New rpmuncompress cli tool simplifies unpacking multiple sources
• New Sequoia-based OpenPGP backend
• Numerous macro improvements and fixes
• Numerous OpenPGP parser correctness and security fixes to internal OpenPGP backend

As usual, further details and download information available at https://rpm.org/wiki/Releases/4.18.0

On behalf of the rpm-team,
Panu

[pmatilai]

FWIW, I've just put out an alpha2 release to address a handful of small but disruptive regressions in alpha1, and updated the download info in release notes accordingly.

[pmatilai]

Rpm 4.18.0 beta1 is out now. Misc fixes here and there, difference to alpha2 is probably best seen from this:
rpm-software-management/rpm-web@946c249

Full details in the release notes as usual.

[pmatilai]

Rpm 4.18.0 rc1 is out now. Apart from the usual minor fixes here and there, the big news here is the inclusion of the new opt-in Sequoia OpenPGP backend. Big kudos to @nwalfield for his efforts to make this happen!

Full details in the release notes as usual.

[pmatilai]

Rpm 4.18.0 final is out now. Aside from a couple of small last minute fixes, no changes since rc1.