nokogiri 1.6.7 → 1.6.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fbe7bb154e401bfe8898f4007e337ed4dde1f95d
-  data.tar.gz: 50a017cac7c2659a4b5006840515d57ed84d945b
+  metadata.gz: 7aba1b02c58b5803189789642e2509a8c37f7c17
+  data.tar.gz: 27b7137433f9b0ad54bdc5818ca6bfaf94d41f55
 SHA512:
-  metadata.gz: fc15e6bf53fc885e7255e1a71208171f27de0e3b82a835a565380f913cdf356da0be1fff592f126443a2eb528e2ca0d2aadae1211b6e7eb12eace35191ea43f5
-  data.tar.gz: dee4a2c8648fbed9ef2ff90752347a7c777ef917530f2d296e87bb212c741800c68576b25423ae175ef8e141f1dd8c80c7d215c09ccae861781a92e92f02191a
+  metadata.gz: c18fc20453e6fbc27da1d006224cc63106bf82db2e777373e8d9c9746cc70bb9ea4f801795f27d9be7d5136e98177751ed02e029fd0f4129494524b872682ae2
+  data.tar.gz: 9991ca8a13901c1ef526781107797a9be90ab18badfb0bcd39e312bd3cdadeaa9489b2b94a7e290a07f8503d44aea94c887fb93e4e45728ad71d8b1969bef7f8

data/.cross_rubies

@@ -5,3 +5,5 @@
 2.1.6:x86_64-w64-mingw32
 2.2.2:i686-w64-mingw32
 2.2.2:x86_64-w64-mingw32
+2.3.0:i686-w64-mingw32
+2.3.0:x86_64-w64-mingw32

data/.travis.yml

@@ -4,13 +4,15 @@ sudo: false
 
 rvm:
 - ruby-1.9.2
-- ruby-1.9.3
-- ruby-2.0.0
-- ruby-2.1.7
-- ruby-2.2.2
+- 1.9.3
+- 2.0
+- 2.1
+- 2.2.3
+- 2.3.0
 - jruby-19mode
-- jruby-1.7.22
-- jruby-9.0.0.0
+- jruby
+- jruby-9.0.4.0
+- jruby-head
 - rbx-19mode
 - rbx-2
 
@@ -19,15 +21,20 @@ os:
 - osx
 
 matrix:
+  allow_failures:
+  # https://github.com/travis-ci/travis-ci/issues/5361
+  - os: osx
+    rvm: 2.3.0
+  - rvm: jruby-head
   exclude:
   - os: osx
     rvm: ruby-1.9.2
   - os: osx
     rvm: jruby-19mode
   - os: osx
-    rvm: jruby-1.7.22
+    rvm: jruby
   - os: osx
-    rvm: jruby-9.0.0.0
+    rvm: jruby-9.0.4.0
   - os: osx
     rvm: rbx-19mode
   - os: osx
@@ -37,5 +44,8 @@ notifications:
   irc:
     channels:
       - "chat.freenode.net#nokogiri"
-    use_notice: true
+    on_success: always
+    on_failure: always
+    template:
+      - "%{repository} (%{branch}:%{commit} by %{author}): %{message} (%{build_url})"
     skip_join: true

data/CHANGELOG.rdoc

@@ -1,3 +1,113 @@
+=== 1.6.8.1 / 2016-10-03
+
+==== Dependency License Notes
+
+Removes required dependency on the `pkg-config` gem. This dependency
+was introduced in v1.6.8 and, because it's distributed under LGPL, was
+objectionable to many Nokogiri users (#1488, #1496).
+
+This version makes `pkg-config` an optional dependency. If it's
+installed, it's used; but otherwise Nokogiri will attempt to work
+around its absence.
+
+
+=== 1.6.8 / 2016-06-06
+
+==== Security Notes
+
+[MRI] Bundled libxml2 is upgraded to 2.9.4, which fixes many security issues. Many of these had previously been patched in the vendored libxml 2.9.2 in the 1.6.7.x branch, but some are newer.
+
+See these libxml2 email posts for more:
+
+* https://mail.gnome.org/archives/xml/2015-November/msg00012.html
+* https://mail.gnome.org/archives/xml/2016-May/msg00023.html
+
+For a more detailed analysis, you may care to read Canonical's take on these security issues:
+
+* http://www.ubuntu.com/usn/usn-2994-1
+
+
+[MRI] Bundled libxslt is upgraded to 1.1.29, which fixes a security issue as well as many long-known outstanding bugs, some features, some portability improvements, and general cleanup.
+
+See this libxslt email post for more:
+
+* https://mail.gnome.org/archives/xslt/2016-May/msg00004.html
+
+
+==== Features
+
+Several changes were made to improve performance:
+
+* [MRI] Simplify NodeSet#to_a with a minor speed-up. (#1397)
+* XML::Node#ancestors optimization. (#1297) (Thanks, Bruno Sutic!)
+* Use Symbol#to_proc where we weren't previously. (#1296) (Thanks, Bruno Sutic!)
+* XML::DTD#each uses implicit block calls. (Thanks, @glaucocustodio!)
+* Fall back to the `pkg-config` gem if we're having trouble finding the system libxml2. This should help many FreeBSD users. (#1417)
+* Set document encoding appropriately even on blank document. (#1043) (Thanks, @batter!)
+
+
+==== Bug Fixes
+
+* [JRuby] fix slow add_child (#692)
+* [JRuby] fix load errors when deploying to JRuby/Torquebox (#1114) (Thanks, @atambo and @jvshahid!)
+* [JRuby] fix NPE when inspecting nodes returned by NodeSet#drop (#1042) (Thanks, @mkristian!)
+* [JRuby] fix nil attriubte node's namespace in reader (#1327) (Thanks, @codekitchen!)
+* [JRuby] fix Nokogiri munging unicode characters that require more than 2 bytes (#1113) (Thanks, @mkristian!)
+* [JRuby] allow unlinking an unparented node (#1112, #1152) (Thanks, @esse!)
+* [JRuby] allow Fragment parsing on a frozen string (#444, #1077)
+* [JRuby] HTML `style` tags are no longer encoded (#1316) (Thanks, @tbeauvais!)
+* [MRI] fix assertion failure while accessing attribute node's namespace in reader (#843) (Thanks, @2potatocakes!)
+* [MRI] fix issue with GCing namespace nodes returned in an xpath query. (#1155)
+* [MRI] Ensure C strings are null-terminated. (#1381)
+* [MRI] Ensure Rubygems is loaded before using mini_portile2 at installation. (#1393, #1411) (Thanks, @JonRowe!)
+* [MRI] Handling another edge case where the `libxml-ruby` gem's global callbacks were smashing the heap. (#1426). (Thanks to @bbergstrom for providing an isolated test case!)
+* [MRI] Ensure encodings are passed to Sax::Parser xmldecl callback. (#844)
+* [MRI] Ensure default ns prefix is applied correctly when reparenting nodes to another document. (#391) (Thanks, @ylecuyer!)
+* [MRI] Ensure Reader handles non-existent attributes as expected. (#1254) (Thanks, @ccutrer!)
+* [MRI] Cleanup around namespace handling when reparenting nodes. (#1332, #1333, #1444) (Thanks, @cuttrer and @bradleybeddoes!)
+* unescape special characters in CSS queries (#1303) (Thanks, @twalpole!)
+* consistently handle empty documents (#1349)
+* Update to mini_portile2 2.1.0 to address whitespace-handling during patching. (#1402)
+* Fix encoding of xml node namespaces.
+* Work around issue installing Nokogiri on overlayfs (commonly used in Docker containers). (#1370, #1405)
+
+
+
+==== Other Notes
+
+* Removed legacy code remaining from Ruby 1.8.x support.
+* Removed legacy code remaining from REE support.
+* Removing hacky workarounds for bugs in some older versions of libxml2.
+* Handling C strings in a forward-compatible manner, see https://github.com/ruby/ruby/blob/v2_2_0/NEWS#L319
+
+
+=== 1.6.7.2 / 2016-01-20
+
+This version pulls in several upstream patches to the vendored libxml2 and libxslt to address:
+
+  CVE-2015-7499
+
+Ubuntu classifies this as "Priority: Low", RedHat classifies this as "Impact: Moderate", and NIST classifies this as "Severity: 5.0 (MEDIUM)".
+
+MITRE record is https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499
+
+
+=== 1.6.7.1 / 2015-12-16
+
+This version pulls in several upstream patches to the vendored libxml2 and libxslt to address:
+
+  CVE-2015-5312
+  CVE-2015-7497
+  CVE-2015-7498
+  CVE-2015-7499
+  CVE-2015-7500
+  CVE-2015-8241
+  CVE-2015-8242
+  CVE-2015-8317
+
+See also http://www.ubuntu.com/usn/usn-2834-1/
+
+
 === 1.6.7 / 2015-11-29
 
 ==== Notes
@@ -25,7 +135,7 @@ See #1374 and #1376 for details.
 * [JRuby] reset the namespace cache when replacing the document's innerHtml (#1265) (Thanks, @mkristian!)
 * [JRuby] Document#parse should support IO objects that respond to #read. (#1124) (Thanks, Jake Byman!)
 * [MRI] Duplicate-id errors when setting the `id` attribute on HTML documents are now silenced. (#1262)
-* [JRuby] SAX parser cuts texts in peices when quare brackets exist. (#1261)
+* [JRuby] SAX parser cuts texts in pieces when square brackets exist. (#1261)
 * [JRuby] Namespaced attributes aren't removed by remove_attribute. (#1299)
 
 
@@ -35,7 +145,7 @@ This version pulls in an upstream patch to the vendored libxml2 to address:
 
 * unclosed comment uninitialized access issue (#1376)
 
-This issue does not have a CVE assigned to it as this time.
+This issue was assigned CVE-2015-8710 after the fact. See http://seclists.org/oss-sec/2015/q4/616 for details.
 
 
 === 1.6.6.3 / 2015-11-16

data/CONTRIBUTING.md

@@ -0,0 +1,42 @@
+# Issue and Pull Request Guidelines
+
+Thank you for getting involved in making Nokogiri better!
+
+
+## Code of Conduct
+
+For best results, be nice. Remember that Nokogiri maintainers are
+volunteers, and treat them with respect.
+
+Do not act entitled to service. Do not be rude. Do not use judgmental
+or foul language.
+
+The maintainers reserve the right to delete comments that are rude, or
+that contain foul language. The maintainers reserve the right to
+delete comments that they deem harassing or offensive.
+
+
+## Issues
+
+Please read the
+["Getting Help" tutorial](http://www.nokogiri.org/tutorials/getting_help.html)
+at the [nokogiri.org](http://nokogiri.org) site.
+
+If you're reporting an issue, it must contain:
+
+* Example code that reproduces the **observed** behavior.
+* An explanation of what the **expected** behavior is.
+
+That's it. If you don't provide that information, we'll ask you for
+it, tag the story "needs more information", and then after a time will
+close it if the information isn't provided.
+
+
+## Pull Requests
+
+Pull requests must always contain a test to prevent
+regressions. Preferably, the test should demonstrate the __intent__ of
+the code.
+
+We may ask you for clarification if we don't understand the intent of
+the change.

data/Gemfile

@@ -4,19 +4,19 @@
 
 source "https://rubygems.org/"
 
-gem "mini_portile2", "~>2.0.0.rc2"
+gem "mini_portile2", "~>2.1.0"
 
 gem "rdoc", "~>4.0", :group => [:development, :test]
-gem "hoe-bundler", ">=1.1", :group => [:development, :test]
-gem "hoe-debugging", "~>1.2.0", :group => [:development, :test]
-gem "hoe-gemspec", ">=1.0", :group => [:development, :test]
-gem "hoe-git", ">=1.4", :group => [:development, :test]
-gem "minitest", "~>2.2.2", :group => [:development, :test]
-gem "rake", ">=0.9", :group => [:development, :test]
+gem "hoe-bundler", "~>1.2.0", :group => [:development, :test]
+gem "hoe-debugging", "~>1.2.1", :group => [:development, :test]
+gem "hoe-gemspec", "~>1.0.0", :group => [:development, :test]
+gem "hoe-git", "~>1.6.0", :group => [:development, :test]
+gem "minitest", "~>5.8.4", :group => [:development, :test]
+gem "rake", "~>10.5.0", :group => [:development, :test]
 gem "rake-compiler", "~>0.9.2", :group => [:development, :test]
-gem "rake-compiler-dock", "~>0.4.2", :group => [:development, :test]
-gem "racc", ">=1.4.6", :group => [:development, :test], :platform => :ruby
-gem "rexical", ">=1.0.5", :group => [:development, :test], :platform => :ruby
+gem "rake-compiler-dock", "~>0.5.1", :group => [:development, :test]
+gem "racc", "~>1.4.14", :group => [:development, :test], :platform => :ruby
+gem "rexical", "~>1.0.5", :group => [:development, :test], :platform => :ruby
 gem "hoe", "~>3.14", :group => [:development, :test]
 
 # vim: syntax=ruby

data/LICENSE.txt

@@ -1,6 +1,6 @@
 (The MIT License)
 
-Copyright (c) 2008 - 2015:
+Copyright (c) 2008 - 2016:
 
 * [Aaron Patterson](http://tenderlovemaking.com)
 * [Mike Dalessio](http://mike.daless.io)

data/Manifest.txt

@@ -3,8 +3,8 @@
 .editorconfig
 .gemtest
 .travis.yml
-CHANGELOG.ja.rdoc
 CHANGELOG.rdoc
+CONTRIBUTING.md
 C_CODING_STYLE.rdoc
 Gemfile
 LICENSE.txt
@@ -241,7 +241,10 @@ lib/nokogiri/xml/xpath/syntax_error.rb
 lib/nokogiri/xml/xpath_context.rb
 lib/nokogiri/xslt.rb
 lib/nokogiri/xslt/stylesheet.rb
+lib/serializer.jar
+lib/xalan.jar
 lib/xercesImpl.jar
+lib/xml-apis.jar
 lib/xsd/xmlparser/nokogiri.rb
 patches/sort-patches-by-date
 suppressions/README.txt
@@ -256,6 +259,7 @@ test/css/test_tokenizer.rb
 test/css/test_xpath_visitor.rb
 test/decorators/test_slop.rb
 test/files/2ch.html
+test/files/GH_1042.html
 test/files/address_book.rlx
 test/files/address_book.xml
 test/files/atom.xml
@@ -268,6 +272,7 @@ test/files/exslt.xml
 test/files/exslt.xslt
 test/files/foo/foo.xsd
 test/files/metacharset.html
+test/files/namespace_pressure_test.xml
 test/files/noencoding.html
 test/files/po.xml
 test/files/po.xsd
@@ -314,7 +319,6 @@ test/test_css_cache.rb
 test/test_encoding_handler.rb
 test/test_memory_leak.rb
 test/test_nokogiri.rb
-test/test_reader.rb
 test/test_soap4r_sax.rb
 test/test_xslt_transforms.rb
 test/xml/node/test_save_options.rb
@@ -346,6 +350,7 @@ test/xml/test_node_reparenting.rb
 test/xml/test_node_set.rb
 test/xml/test_parse_options.rb
 test/xml/test_processing_instruction.rb
+test/xml/test_reader.rb
 test/xml/test_reader_encoding.rb
 test/xml/test_relax_ng.rb
 test/xml/test_schema.rb

data/README.md

@@ -22,9 +22,6 @@ Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser.  Among
 Nokogiri's many features is the ability to search documents via XPath
 or CSS3 selectors.
 
-XML is like violence - if it doesn’t solve your problems, you are not
-using enough of it.
-
 
 ## Features
 
@@ -86,29 +83,28 @@ There are open-source tutorials (to which we invite contributions!) here: http:/
 Nokogiri is a large library, but here is example usage for parsing and examining a document:
 
 ```ruby
-  require 'nokogiri'
-  require 'open-uri'
-
-  # Fetch and parse HTML document
-  doc = Nokogiri::HTML(open('http://www.nokogiri.org/tutorials/installing_nokogiri.html'))
-
-  ####
-  # Search for nodes by css
-  doc.css('nav ul.menu li a').each do |link|
-    puts link.content
-  end
-
-  ####
-  # Search for nodes by xpath
-  doc.xpath('//h2 | //h3').each do |link|
-    puts link.content
-  end
-
-  ####
-  # Or mix and match.
-  doc.search('code.sh', '//h2').each do |link|
-    puts link.content
-  end
+#! /usr/bin/env ruby
+
+require 'nokogiri'
+require 'open-uri'
+
+# Fetch and parse HTML document
+doc = Nokogiri::HTML(open('http://www.nokogiri.org/tutorials/installing_nokogiri.html'))
+
+puts "### Search for nodes by css"
+doc.css('nav ul.menu li a', 'article h2').each do |link|
+  puts link.content
+end
+
+puts "### Search for nodes by xpath"
+doc.xpath('//nav//ul//li/a', '//article//h2').each do |link|
+  puts link.content
+end
+
+puts "### Or mix and match."
+doc.search('nav ul.menu li a', '//article//h2').each do |link|
+  puts link.content
+end
 ```
 
 
@@ -121,7 +117,7 @@ Nokogiri is a large library, but here is example usage for parsing and examining
   gem, but if you want to use the system versions:
 
   * at install time, set the environment variable
-    `USING_SYSTEM_ALLOCATOR_LIBRARY` or else use the
+    `NOKOGIRI_USE_SYSTEM_LIBRARIES` or else use the
     `--use-system-libraries` argument. (See
     http://nokogiri.org/tutorials/installing_nokogiri.html#using_your_system_libraries
     for specifics.)

data/ROADMAP.md

@@ -1,4 +1,4 @@
-# Roadmap for 2.0
+# Roadmap for API Changes
 
 ## overhaul serialize/pretty printing API
 
@@ -99,3 +99,13 @@ So, instead, let's make alternative methods like
 `Nokogiri::XML::Document#new_comment`, and recommend those as the
 proper convention.
 
+
+## `collect_namespaces` is just broken
+
+`collect_namespaces` is returning a hash, which means it can't return
+namespaces with the same prefix. See this issue for background:
+
+> https://github.com/sparklemotion/nokogiri/issues/885
+
+Do we care? This seems like a useless method, but then again I hate
+XML, so what do I know?

data/Rakefile

@@ -8,7 +8,6 @@ Hoe.plugin :debugging
 Hoe.plugin :git
 Hoe.plugin :gemspec
 Hoe.plugin :bundler
-Hoe.add_include_dirs '.'
 
 GENERATED_PARSER    = "lib/nokogiri/css/parser.rb"
 GENERATED_TOKENIZER = "lib/nokogiri/css/tokenizer.rb"
@@ -128,22 +127,21 @@ HOE = Hoe.spec 'nokogiri' do
 
   unless java?
     self.extra_deps += [
-      # Keep this version in sync with the one in extconf.rb !
-      ["mini_portile2",    "~> 2.0.0.rc2"],
+      ["mini_portile2",    "~> 2.1.0"], # keep version in sync with extconf.rb
     ]
   end
 
   self.extra_dev_deps += [
-    ["hoe-bundler",     ">= 1.1"],
-    ["hoe-debugging",   "~> 1.2.0"],
-    ["hoe-gemspec",     ">= 1.0"],
-    ["hoe-git",         ">= 1.4"],
-    ["minitest",        "~> 2.2.2"],
-    ["rake",            ">= 0.9"],
-    ["rake-compiler",   "~> 0.9.2"],
-    ["rake-compiler-dock", "~> 0.4.2"],
-    ["racc",            ">= 1.4.6"],
-    ["rexical",         ">= 1.0.5"]
+    ["hoe-bundler",        "~> 1.2.0"],
+    ["hoe-debugging",      "~> 1.2.1"],
+    ["hoe-gemspec",        "~> 1.0.0"],
+    ["hoe-git",            "~> 1.6.0"],
+    ["minitest",           "~> 5.8.4"],
+    ["rake",               "~> 10.5.0"],
+    ["rake-compiler",      "~> 0.9.2"],
+    ["rake-compiler-dock", "~> 0.5.1"],
+    ["racc",               "~> 1.4.14"],
+    ["rexical",            "~> 1.0.5"]
   ]
 
   if java?
@@ -184,6 +182,7 @@ if java?
     ext.target_version = '1.6'
     jars = ["#{jruby_home}/lib/jruby.jar"] + FileList['lib/*.jar']
     ext.classpath = jars.map { |x| File.expand_path x }.join ':'
+    ext.debug = true if ENV['JAVA_DEBUG']
   end
 
   task gem_build_path => [:compile] do
@@ -206,7 +205,7 @@ else
 
   task gem_build_path do
     %w[libxml2 libxslt].each do |lib|
-      version = dependencies[lib]
+      version = dependencies[lib]["version"]
       archive = File.join("ports", "archives", "#{lib}-#{version}.tar.gz")
       add_file_to_gem archive
       patchesdir = File.join("patches", lib)
@@ -231,7 +230,7 @@ else
       ext.cross_platform = CROSS_RUBIES.map(&:platform).uniq
       ext.cross_config_options << "--enable-cross-build"
       ext.cross_compiling do |spec|
-        libs = dependencies.map { |name, version| "#{name}-#{version}" }.join(', ')
+        libs = dependencies.map { |name, dep| "#{name}-#{dep["version"]}" }.join(', ')
 
         spec.required_ruby_version = [
           '>= 1.9.2',
@@ -292,10 +291,11 @@ task :debug do
   ENV['CFLAGS'] += " -DDEBUG"
 end
 
-require 'tasks/test'
+require File.join File.dirname(__FILE__), 'tasks/test'
 
 task :java_debug do
-  ENV['JAVA_OPTS'] = '-Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=y' if java? && ENV['JAVA_DEBUG']
+  ENV['JRUBY_OPTS'] = "#{ENV['JRUBY_OPTS']} --debug --dev"
+  ENV['JAVA_OPTS'] = '-Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=y' if ENV['JAVA_DEBUG']
 end
 
 if java?
@@ -316,6 +316,24 @@ if Hoe.plugins.include?(:debugging)
   end
 end
 
+task "test:libxml-ruby" do
+  ENV['TEST_NOKOGIRI_WITH_LIBXML_RUBY'] = "1"
+  warn "#{__FILE__}:#{__LINE__}: --- running tests with libxml-ruby loaded ---"
+  Rake::Task[:test].execute
+  ENV['TEST_NOKOGIRI_WITH_LIBXML_RUBY'] = nil
+end
+
+Rake::Task["test:libxml-ruby"].prerequisites << :compile
+
+task "test:valgrind:libxml-ruby" do
+  ENV['TEST_NOKOGIRI_WITH_LIBXML_RUBY'] = "1"
+  warn "#{__FILE__}:#{__LINE__}: --- running tests with libxml-ruby loaded ---"
+  Rake::Task["test:valgrind"].execute
+  ENV['TEST_NOKOGIRI_WITH_LIBXML_RUBY'] = nil
+end
+
+Rake::Task["test:valgrind:libxml-ruby"].prerequisites << :compile
+
 # ----------------------------------------
 
 def verify_dll(dll, cross_ruby)

data/bin/nokogiri

@@ -41,9 +41,9 @@ opts = OptionParser.new do |opts|
   opts.define_head "Usage: nokogiri <uri|path> [options]"
   opts.separator ""
   opts.separator "Examples:"
-  opts.separator "  nokogiri http://www.ruby-lang.org/"
+  opts.separator "  nokogiri https://www.ruby-lang.org/"
   opts.separator "  nokogiri ./public/index.html"
-  opts.separator "  curl -s http://nokogiri.org | nokogiri -e'p $_.css(\"h1\").length'"
+  opts.separator "  curl -s http://www.nokogiri.org | nokogiri -e'p $_.css(\"h1\").length'"
   opts.separator ""
   opts.separator "Options:"
 

data/build_all

@@ -16,7 +16,7 @@ else
 fi
 
 set -o errexit
-set -x
+#set -x
 
 rm -rf tmp pkg
 bundle exec rake clean clobber

data/dependencies.yml

@@ -1,4 +1,29 @@
-libxml2: "2.9.2"
-libxslt: "1.1.28"
-zlib: "1.2.8"
-libiconv: "1.14"
+libxml2:
+  version: "2.9.4"
+  md5: "ae249165c173b1ff386ee8ad676815f5" # manually confirmed via `gpg --verify`
+  # gpg: Signature made Mon 23 May 2016 04:02:13 AM EDT using DSA key ID DE95BC1F
+  # gpg: Good signature from "Daniel Veillard (Red Hat work email) <veillard@redhat.com>"
+  # gpg:                 aka "Daniel Veillard <Daniel.Veillard@w3.org>"
+  # gpg: WARNING: This key is not certified with a trusted signature!
+  # gpg:          There is no indication that the signature belongs to the owner.
+  # Primary key fingerprint: C744 15BA 7C9C 7F78 F02E  1DC3 4606 B8A5 DE95 BC1F
+
+libxslt:
+  version: "1.1.29"
+  md5: "a129d3c44c022de3b9dcf6d6f288d72e"
+  # gpg: Signature made Mon 23 May 2016 09:58:52 PM EDT using DSA key ID DE95BC1F
+  # gpg: Good signature from "Daniel Veillard (Red Hat work email) <veillard@redhat.com>"
+  # gpg:                 aka "Daniel Veillard <Daniel.Veillard@w3.org>"
+  # gpg: WARNING: This key is not certified with a trusted signature!
+  # gpg:          There is no indication that the signature belongs to the owner.
+  # Primary key fingerprint: C744 15BA 7C9C 7F78 F02E  1DC3 4606 B8A5 DE95 BC1F
+
+zlib:
+  version: "1.2.8"
+  md5: "44d667c142d7cda120332623eab69f40"
+
+libiconv:
+  version: "1.14"
+  md5: "e34509b1623cec449dfeb73d7ce9c6c6"
+  # gpg: Signature made Sun 07 Aug 2011 01:58:18 PM EDT using DSA key ID F059B1D1
+  # gpg: BAD signature from "Bruno Haible (Open Source Development) <bruno@clisp.org>"