Closing because OpenH264 2.6.0 is broken: there is a different soversion depending on whether you use Makefile or Meson build. We should just skip this release entirely. Upstream is going to have to create a corrected release.

https://github.com/cisco/openh264/issues/3856

Well maybe closing is harsh. It can be fixed with a one line patch. I'll reopen.

Due to this security advisory this task has increased in priority and now needs to be handled ASAP.

Note: this update contains an soname bump but it seems to be unnecessary/accidental with no apparent actual ABI changes, so we should just revert the soname bump in Fedora builds so that we can release the security update without rebuilding everything.

Also, due to the security advisory, updating just Fedora rawhide and F42 is no longer sufficient. We additionally need to update F41 and F40.

I think we are ready from the releng side. We just need someone to build it and test it and confirm that it's all working before shipping to cisco.

Is that the case @patrikp ?

openh264-2.6.0-1.fc43, openh264-2.6.0-1.fc42, and openh264-2.6.0-1.fc41 are built in koji thanks to @wtaymans. Still need F40 and EPEL builds.

The download links in koji redirect to https://fedoraproject.org/wiki/Non-distributable-rpms so I don't see a way to test those builds directly, but I did a mockbuild and tested that. It's pretty broken in Epiphany, but so is the previous version 2.4.0, so that's not a regression. Firefox seems to work decently. Ship it?

@wtaymans please note: you should build with '--skip-tag' passed so the builds don't land in the normal updates tags.
Then you or releng can tag them into the fN-openh264 tag.

Yeah, we try and have things setup so we don't distribute these builds, since we cannot legally.
That said, we could probibly get you a copy securely if you would like to test? Or we could just go.

I would suggest we start with just rawhide and then we can see how it looks and push the others after a short while?

@patrikp can you make these repos and ship to cisco for rawhide at least?

Let's add a warning about --skip-tag to the spec file, right above the NVR, so there's no way for a packager to miss it when updating the version.

I would suggest we start with just rawhide and then we can see how it looks and push the others after a short while?

OK, but should be short since the stable branch updates are urgent.

Let's add a warning about --skip-tag to the spec file, right above the NVR, so there's no way for a packager to miss it when updating the version.

Great idea! +1

I would suggest we start with just rawhide and then we can see how it looks and push the others after a short while?

OK, but should be short since the stable branch updates are urgent.

Yeah, true.

f40 and epel9 and epel10 builds are also done now.

Thanks @wtaymans!
I created a new tracker ticket so that we have everything in one place.
Here: https://pagure.io/releng/issue/12617

@catanzaro who is going to update noopenh264 to match?

Not going to update noopenh264 at least until https://github.com/cisco/openh264/issues/3863 is resolved, which may be a while. It only matters when the ABI version changes and Fedora has reverted the ABI bump, so not a problem for us.