Harden the SDK analysis and future proof (esp for the Apple Silicon case)
Later versions of macOS do not provide a real Python, so be more agressive

For macs, we must baseline 11.0 as the oldest supported version, due
to Apple Silicon support

Merge branch 'bump-openssl-3.0.20' into trunk

Handle error/warning message about escaping

Bump bundled OpenSSL 3.0.13 -> 3.0.20

Updates the bundled OpenSSL to the latest 3.0 LTS patch release, pulling
in all security fixes between 3.0.13 and 3.0.20. Stays within the 3.0 LTS
line for lowe

Bump bundled OpenSSL 3.0.13 -> 3.0.20

Updates the bundled OpenSSL to the latest 3.0 LTS patch release, pulling
in all security fixes between 3.0.13 and 3.0.20. Stays within the 3.0 LTS
line for lowest regression risk (no API/ABI changes).

Note: the 3.0 LTS branch reaches end-of-life on 2026-09-07; a follow-up
move to a newer LTS (e.g. 3.5) should be planned separately.

Changes:
- external_deps.lst: new tarball name, MD5, and download URL
(MD5 fabdcf86f3f54e27689253f85b738959, verified against upstream tarball).
- openssl/makefile.mk: OPENSSL_NAME and TARFILE_MD5.
- openssl/openssl.patch: rebased the Windows compatibility guards
(_WIN32_WINNT version checks in init.c / threads_win.c and the
IPPROTO_IPV6 fallback in bio_sock2.c) onto 3.0.20 sources; context had
shifted so the original hunks no longer applied.
- openssl/opensslunx.patch: bumped the embedded version path to 3.0.20.

Verified: declared MD5 matches the upstream tarball, and both the Unix
(opensslunx.patch) and Windows (openssl.patch) patch sets apply cleanly
to the 3.0.20 source tree via the build's "cd misc && patch -p2" step.
Platform compile/link/runtime still to be confirmed by CI.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

show more ...

Update via autoupdate

commit LLM drafted review/assessment of the differneces between trunk (45x) and AOO42X for potential backports and general knowledge.

Fix crash, uninitialized-return, and buffer bugs in update check and macOS x86 bridge

updateprotocol.cxx: guard XNodeList dereferences so a swallowed
XPathException no longer leaves a null reference

Fix crash, uninitialized-return, and buffer bugs in update check and macOS x86 bridge

updateprotocol.cxx: guard XNodeList dereferences so a swallowed
XPathException no longer leaves a null reference to be dereferenced
(crash on malformed/hostile update descriptors); clear the list before
the relnote query so a thrown exception can't leave us iterating the
previous (sources) node list.

cpp2uno.cxx: the queryInterface fast-path guard used 'break', which
exited the switch and skipped the default case, returning an
uninitialized typelib_TypeClass. Guard the block with
'if (bHasHiddenReturn)' instead so control falls through to default and
eRet is always assigned.

updatecheck.cxx (getImageFromFileName): use bitwise '|' instead of
logical '||' when combining osl_Process flags; rewrite the trailing
CR/LF trim so it never reads/writes before the start of the buffer
(e.g. when osl_readFile returns 0 bytes).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

show more ...

Also protect AOO41X and AOO42X (#482)

They are our release branches and thus they are worth the extra protection.

Fix the macOS x86 bridge. Previous version was fragile.

Native Apple Silicon (arm64) support and bundled Python 3.10 baseline

Squashed combination of two efforts, applied onto trunk as a single
commit. (trunk is not intended to be buildable; this lands t

Native Apple Silicon (arm64) support and bundled Python 3.10 baseline

Squashed combination of two efforts, applied onto trunk as a single
commit. (trunk is not intended to be buildable; this lands the work for
reference/integration.)

=== Apple Silicon (macOS arm64 / AAPCS64) ===
Build plumbing: set_soenv.in + source_soenv.sh arm64 Darwin branch
(CPU=R, CPUNAME=AARCH64, OUTPATH=unxmaccr); new solenv/inc/unxmaccr.mk
and unx.mk dispatch; macro.hxx AARCH64 arch string; osarch.pm +
gbuild/platform/macosx.mk arch entries; configure.ac arm64 host
detection, Big Sur+ version math, and 11.0 deployment target.

C++/UNO bridge (new s5abi_macosx_aarch64): abi.cxx/hxx AAPCS64 classifier
(HFA + <=16B/>16B size rules), uno2cpp + call.s AArch64 trampoline,
cpp2uno incoming path + privateSnippetExecutor + AArch64 codeSnippet
codegen (x8 indirect-result handled, not displacing this/x0), share.hxx
__cxa_exception reserved-member alignment fix; Library_cpp_uno.mk +
makefile.mk wiring. sal/osl/unx/interlck.c arm64 atomics (__sync_* ->
LSE).

Externals: openssl darwin64-arm64-cc; icu arm64 little-endian. (NSS 3.39
deferred -- too old for arm64.)

Packaging/JVM: Info.plist LSMinimumSystemVersion 11.0; installer
download.pm/worker.pm/update_module_ignore_lists.pl recognize unxmaccr;
jvmfwk modern macOS JDK discovery (/Library/Java/JavaVirtualMachines +
Contents/Home probe).

The ABI/atomics/trampoline/JDK-discovery code was unit-tested natively
on an arm64 macOS host; a full AOO build (and bridgetest) was not run.
Code-signing infra (mandatory for arm64 distribution) is NOT included.

=== Bundled Python 2.7.18 -> 3.10 baseline (Unix/macOS first) ===
pyversion.mk/_dmake.mk -> 3.10.18 (single version knob). Shipped .py
fixes: imp -> types.ModuleType (pythonscript.py, pythonloader.py) and
file() -> open(); mailmerge.py Py3 email module imports + encoders.
Windows Python 3 build and the makefile.mk/d.lst/configure.ac Py3 work
are NOT included (separate, larger effort).

NOTE: macOS 11 becomes the minimum supported version. Python 3.10 is
EOL 2026-10; the version knob allows a later bump.

show more ...

Merge branch 'python-editing-embedding' into trunk

Fixes: #60849 - Python editing and embedding macros in documents
Patch by: me

Use a fixed width font for the Python editor.

Patch by: me

Set up default protection ruleset for default and release branches (#481)

Remove a duplicate method.

Patch by: me

Use pop() instead of del to delete keys from the self.modules
dictionary for Python scripts, so KeyError isn't thrown when the
key is missing.

Remove the saving to temporary files, it's not used for

Use pop() instead of del to delete keys from the self.modules
dictionary for Python scripts, so KeyError isn't thrown when the
key is missing.

Remove the saving to temporary files, it's not used for any
other scripting language, and can cause bugs when the temporary
files already exist from previous errors.

Patch by: me

show more ...

Forget Python modules from the cache after they are saved, so they
get reloaded in the future. This is necessary as getModuleByUrl()'s
self.sfa.getDateTimeModified() returns timestamps with all zeroe

Forget Python modules from the cache after they are saved, so they
get reloaded in the future. This is necessary as getModuleByUrl()'s
self.sfa.getDateTimeModified() returns timestamps with all zeroes
for documents (== ZIP files), breaking the test for whether the
embedded Python file has been changed. Also even if it worked, the
minimum granularity for timestamps in ZIP files is 2 seconds, which
isn't good enough.

Patch by: me

show more ...

Our PythonScriptProvider is now actively developed, not deprecated.

Patch by: me

Make the edit dialog permanent.

Patch by: me

Cleanups. Save in UTF-8 format just in case.

Patch by: me

Get Python file editing working.

Patch by: me

PackageBrowseNode also needs to implement XPropertySet and XInvocation,
otherwise the macro selector screen shows no macros!

Patch by: me

Verify that params has a name for Creatable and Renamable actions
in invoke().

Patch by: me

Cleanups. Remove excess debug info. Log exceptions across
the whole of invoke(), not just specific actions.

Patch by: me

Use the parent URI to dynamically derive ours, so renaming
the parent doesn't break our URI.

Patch by: me