zlib upgrade for CVE-2018-25032

[oxelson]

Upgrade to 1.2.12

[akrherz]

Thanks @oxelson , but doesn't the actual zlib 1.2.12 source need included as well?

[oxelson]

le sigh Sorry @akrherz! It's been a day. I'll get that added. 🤪

[akrherz]

Whelp, CI is green here, but is 1) not good and 2) makes me realize what the docker images were doing with extlibs. Ufff

[oxelson]

I double checked and did grab the source code for the latest zlib and put in the symlink -- but the v1.2.12 directory & contents were not pushed to the repo...? Sorry about that. I'll correct it.

Whelp, CI is green here, but is 1) not good and 2) makes me realize what the docker images were doing with extlibs. Ufff

How did you want to proceed?

[akrherz]

@oxelson I am unsure. It would certainly be nice just to jettison zlib from extlibs and let the OS provide the library, but that may be a bridge too far.

[oxelson]

I had to comment of the extlibs/ in .gitignore to get the libz source code added.

It would certainly be nice just to jettison zlib from extlibs and let the OS provide the library, but that may be a bridge too far.

I'll defer to you on this. Either way, we should probably rebuild gempak with the new/safe version of zlib and make that available. :-)

[akrherz]

we should probably rebuild gempak

We are not distributing binaries at this time, I am still boggling this.

[oxelson]

We are not distributing binaries at this time, I am still boggling this.

Sounds good. 👍

[akrherz]

Thanks again @oxelson , will take this once CI passes.