[Ftp-release] Announcing dbus 1.14.0 (new stable branch)

[Simon McVittie]

dbus is the reference implementation of D-Bus, a message bus for
communication between applications and system services.

1.14.x is a new stable branch, superseding 1.12.x as the recommended
branch for stable OS distributions.

<http://dbus.freedesktop.org/releases/dbus/dbus-1.14.0.tar.xz>
<http://dbus.freedesktop.org/releases/dbus/dbus-1.14.0.tar.xz.asc>
git tag: dbus-1.14.0

1.12.x is now the legacy branch. The intention is that it will continue
to receive security fixes until Debian 11 reaches end-of-life, which is
expected to happen in mid 2024.

As a reminder, all older stable branches (such as 1.10.x) have
already reached end-of-life, and should only be used as part of a
long-term-support OS distribution that has taken responsibility for
backporting any necessary security fixes, such as Debian 9.

Development leading to dbus 1.16.x will occur in 1.15.x development
releases. The 1.13.x development releases are no longer supported, and
should be upgraded to 1.14.x. As a reminder, all older development
branches (such as 1.11.x) were already unsupported, and should be upgraded
to a supported stable branch.

Summary of major changes between 1.12.x and 1.14.0
--------------------------------------------------

Dependencies:

• dbus now requires at least a basic level of support for C99 variadic
  macros, as implemented in gcc >= 3, all versions of Clang, and
  MSVC >= 2005. In practice this requirement has existed since version
  1.9.2, but it is now official.

• dbus now requires a C99-compatible va_copy() macro (or a __va_copy()
  macro with the same behaviour), except when building for Windows using
  MSVC and CMake.

• On Unix platforms, if getpwnam_r() and getgrnam_r() are implemented,
  they must be POSIX-conformant. The non-POSIX signature seen in ancient
  Solaris versions will no longer work.

• All Windows builds now require Windows Vista or later.
  (Note that we do not recommend or support use of dbus on operating
  systems outside their vendor's security support lifetime, such as Vista.)

• GLib >= 2.38 is required if full test coverage is enabled
  (reduced from 2.40 in dbus 1.12.x.)

• Building using CMake now requires CMake 3.4.

• Building documentation using CMake now requires xsltproc, Docbook DTDs
  (for example docbook-xml on Debian derivatives), and Docbook XSLT
  stylesheets (for example docbook-xsl on Debian derivatives). Using
  KDE's meinproc4 documentation processor is no longer supported.

Build-time configuration changes:

• Move CMake build system to top level, matching normal practice for
  CMake projects

Deprecations:

• Third-party software should install default dbus policies for the system
  bus into ${datadir}/dbus-1/system.d (this has been supported since dbus
  1.10, released in August 2015). Installing default dbus policies in
  ${sysconfdir}/dbus-1/system.d is now considered to be deprecated. Policy
  files in ${sysconfdir}/dbus-1/system.d continue to be read, but this
  directory should only be used by system administrators wishing to
  override the default policies.

  The ${datadir} applicable to dbus is usually /usr/share and the
  ${sysconfdir} is usually /etc.

• A similar pattern applies to the session bus policies in session.d.

• The dbus-send(1) man page now documents --bus and --peer instead of
  the old --address synonym for --peer, which has been deprecated since
  the introduction of --bus and --peer in 1.7.6

• The dbus-daemon man page now has scarier warnings about
  <allow_anonymous/> and non-local TCP, which are insecure and should
  not be used, particularly for the standard system and session buses

• DBusServer (and hence the dbus-daemon) no longer accepts usernames
  (login names) for the recommended EXTERNAL authentication mechanism,
  only numeric user IDs or the empty string. See 1.13.0 release notes
  for full details.

New features:

• On Linux 4.13 or later when built against a suitable glibc version,
  GetConnectionCredentials() now includes UnixGroupIDs, the effective
  group IDs of the initiator of the connection, taken from
  SO_PEERGROUPS.

• On Linux 4.13 or later, <policy group="…"> now uses the SO_PEERGROUPS
  credentials-passing socket option to get the effective group IDs
  of the initiator of the connection. See 1.13.4 release notes for details.

• Add a --sender option to dbus-send, which requests a name and holds it
  until the signal has been sent

• dbus-daemon <allow> and <deny> rules can now specify a
  send_destination_prefix attribute, which is like a combination of
  send_destination and the arg0namespace keyword in match rules.
  See 1.13.12 release notes for more details

• The dbus-daemon now filters the messages that it relays, removing
  header fields that it does not understand. Clients must not rely on
  this behaviour unless they have confirmed that they are connected to
  a suitable message bus implementation, for example by querying its
  Features property.

• The dbus-daemon now emits a signal, ActivatableServicesChanged, when
  the list of activatable services may have changed. Support for this
  signal can be discovered by querying the Features property.

• It is now possible to disable traditional (non-systemd) service
  activation at build-time (Autotools: --disable-traditional-activation,
  CMake: -DENABLE_TRADITIONAL_ACTIVATION=OFF). See 1.13.10 release notes
  for details.

• The API reference manual can be built as a Qt compiled help file if
  qhelpgenerator(-qt5) is available. See 1.13.16 release notes for details.

Miscellaneous behaviour changes:

• When using the "user bus" (--enable-user-session), put the dbus-daemon
  in the session slice

• Several environment variables set by systemd are no longer passed
  on to activated services

• If the dbus-daemon is compiled for Linux with systemd support, it
  now informs systemd that it is ready for use via the sd_notify()
  mechanism

• Tarball releases no longer contain pre-2007 changelogs and are now
  compressed with xz, making them around 35% smaller.

Changes since 1.13.22
---------------------

• On Windows, consistently use msvcrt.dll-style printf formats, fixing
  builds with mingw-w64 8.0.0 (dbus#380, Simon McVittie)

• Fix some broken links in the API design document
  (dbus!257, Michael Nosthoff)

• CI updates
  · Enable -Werror for the CMake builds
  · Use https to download MSYS packages
  · Use Debian 11 for most builds
  · Stop testing on Debian 9, which is EOL
  · Stop testing on Ubuntu 16.04, which is EOL
  · Remove workarounds for missing/outdated packages in Debian 8, Debian 9
    and Ubuntu 16.04
  (dbus#380, dbus!260; Simon McVittie)

-- 
Simon McVittie, Collabora Ltd. / Debian
on behalf of the dbus maintainers