- Fix bz#2179854, Qt 5 render the Bold style CJK character very thick

with Noto CJK variable fonts

.gitignore

@@ -12,3 +12,8 @@
 /kde-5.15-rollup-20220824.patch.gz
 /qtbase-everywhere-opensource-src-5.15.6.tar.xz
 /kde-5.15-rollup-20220920.patch.gz
+/qtbase-everywhere-opensource-src-5.15.7.tar.xz
+/kde-5.15-rollup-20221031.patch.gz
+/qtbase-everywhere-opensource-src-5.15.8.tar.xz
+/kde-5.15-rollup-20230105.patch.gz
+/kde-5.15-rollup-20230227.patch.gz

qt5-qtbase.spec

@@ -2,16 +2,12 @@
 %global multilib_archs x86_64 %{ix86} %{?mips} ppc64 ppc s390x s390 sparc64 sparcv9
 %global multilib_basearchs x86_64 %{?mips64} ppc64 s390x sparc64
 
-%global openssl -openssl-linked
-
 %if 0%{?fedora} < 29 && 0%{?rhel} < 9
 %ifarch %{ix86}
 %global no_sse2  -no-sse2
 %endif
 %endif
 
-# zstd support
-%global zstd 1
 
 # workaround https://bugzilla.redhat.com/show_bug.cgi?id=1668865
 # for current stable releases
@@ -50,21 +46,17 @@
 %global qt_settings 1
 %endif
 
-%global journald -journald
-BuildRequires: make
-BuildRequires: pkgconfig(libsystemd)
-
 %global examples 1
 ## skip for now, until we're better at it --rex
 #global tests 1
 
 Name:    qt5-qtbase
 Summary: Qt5 - QtBase components
-Version: 5.15.6
-Release: 1%{?dist}
+Version: 5.15.8
+Release: 8%{?dist}
 
 # See LGPL_EXCEPTIONS.txt, for exception details
-License: LGPLv2 with exceptions or GPLv3 with exceptions
+License: LGPL-3.0-only OR GPL-3.0-only WITH Qt-GPL-exception-1.0
 Url:     http://qt-project.org/
 %global  majmin %(echo %{version} | cut -d. -f1-2)
 Source0: https://download.qt.io/official_releases/qt/%{majmin}/%{version}/submodules/%{qt_module}-everywhere-opensource-src-%{version}.tar.xz
@@ -86,6 +78,9 @@ Source10: macros.qt5-qtbase
 # support multilib optflags
 Patch2: qtbase-multilib_optflags.patch
 
+# make mixing versions with private apis a warning instead of fatal error
+Patch3: qtbase-everywhere-src-5.15.6-private_api_warning.patch
+
 # upstreamable patches
 # namespace QT_VERSION_CHECK to workaround major/minor being pre-defined (#1396755)
 Patch50: qtbase-opensource-src-5.8.0-QT_VERSION_CHECK.patch
@@ -138,13 +133,19 @@ Patch90: %{name}-gcc11.patch
 
 ## upstream patches
 # https://invent.kde.org/qt/qt/qtbase, kde/5.15 branch
-# git diff v5.15.5-lts-lgpl..HEAD | gzip > kde-5.15-rollup-$(date +%Y%m%d).patch.gz
+# git diff v5.15.8-lts-lgpl..HEAD | gzip > kde-5.15-rollup-$(date +%Y%m%d).patch.gz
 # patch100 in lookaside cache due to large'ish size -- rdieter
-Patch100: kde-5.15-rollup-20220920.patch.gz
+Patch100: kde-5.15-rollup-20230227.patch.gz
 # HACK to make 'fedpkg sources' consider it 'used"
-Source100: kde-5.15-rollup-20220920.patch.gz
-# CVS-2021-38593
-Patch101: qtbase-everywhere-src-5.15.4-cve-2021-38593.patch
+Source100: kde-5.15-rollup-20230227.patch.gz
+
+Patch101: qtbase-5.15.8-fix-missing-qtsan-include.patch
+
+# Workaround for font rendering issue with cjk-vf-fonts
+# https://bugreports.qt.io/browse/QTBUG-111994
+# https://bugreports.qt.io/browse/QTBUG-112136
+Patch102: qtbase-QTBUG-111994.patch
+Patch103: qtbase-QTBUG-112136.patch
 
 # Do not check any files in %%{_qt5_plugindir}/platformthemes/ for requires.
 # Those themes are there for platform integration. If the required libraries are
@@ -155,8 +156,15 @@ Patch101: qtbase-everywhere-src-5.15.4-cve-2021-38593.patch
 # filter plugin provides
 %global __provides_exclude_from ^%{_qt5_plugindir}/.*\\.so$
 
+%if 0%{?use_clang}
+BuildRequires: clang >= 3.7.0
+%else
+BuildRequires: gcc-c++
+%endif
+BuildRequires: make
 BuildRequires: cups-devel
 BuildRequires: desktop-file-utils
+BuildRequires: double-conversion-devel
 BuildRequires: findutils
 BuildRequires: libjpeg-devel
 BuildRequires: libmng-devel
@@ -164,22 +172,14 @@ BuildRequires: libtiff-devel
 BuildRequires: pkgconfig(alsa)
 # required for -accessibility
 BuildRequires: pkgconfig(atspi-2)
-%if 0%{?use_clang}
-BuildRequires: clang >= 3.7.0
-%else
-BuildRequires: gcc-c++
-%endif
-# http://bugzilla.redhat.com/1196359
-%if 0%{?fedora} || 0%{?rhel} > 6
-%global dbus -dbus-linked
 BuildRequires: pkgconfig(dbus-1)
-%endif
 BuildRequires: pkgconfig(libdrm)
 BuildRequires: pkgconfig(fontconfig)
 BuildRequires: pkgconfig(gl)
 BuildRequires: pkgconfig(glib-2.0)
 BuildRequires: pkgconfig(gtk+-3.0)
 BuildRequires: pkgconfig(libproxy-1.0)
+BuildRequires: pkgconfig(libsctp)
 # xcb-sm
 BuildRequires: pkgconfig(ice) pkgconfig(sm)
 BuildRequires: pkgconfig(libpng)
@@ -187,6 +187,7 @@ BuildRequires: pkgconfig(libudev)
 BuildRequires: openssl-devel
 BuildRequires: pkgconfig(libpulse) pkgconfig(libpulse-mainloop-glib)
 BuildRequires: pkgconfig(libinput)
+BuildRequires: pkgconfig(libsystemd)
 BuildRequires: pkgconfig(xcb-xkb) >= 1.10
 BuildRequires: pkgconfig(xcb-util)
 BuildRequires: pkgconfig(xkbcommon) >= 0.4.1
@@ -217,6 +218,7 @@ BuildRequires: libicu-devel
 %endif
 BuildRequires: pkgconfig(xcb) pkgconfig(xcb-glx) pkgconfig(xcb-icccm) pkgconfig(xcb-image) pkgconfig(xcb-keysyms) pkgconfig(xcb-renderutil)
 BuildRequires: pkgconfig(zlib)
+BuildRequires: pkgconfig(libzstd)
 BuildRequires: perl-generators
 # see patch68
 BuildRequires: python3
@@ -229,9 +231,6 @@ BuildRequires: time
 BuildRequires: xorg-x11-server-Xvfb
 %endif
 
-%if 0%{?zstd}
-BuildRequires: pkgconfig(libzstd)
-%endif
 
 %if 0%{?qtchooser}
 %if 0%{?fedora}
@@ -390,6 +389,9 @@ Qt5 libraries used for drawing widgets and OpenGL items.
 %prep
 %setup -q -n %{qt_module}-everywhere-src-%{version}
 
+## dowstream patches
+%patch3 -p1 -b .private_api_warning
+
 ## upstream fixes
 
 %patch50 -p1 -b .QT_VERSION_CHECK
@@ -420,6 +422,8 @@ Qt5 libraries used for drawing widgets and OpenGL items.
 ## upstream patches
 %patch100 -p1
 %patch101 -p1
+%patch102 -p1
+%patch103 -p1
 
 # move some bundled libs to ensure they're not accidentally used
 pushd src/3rdparty
@@ -492,16 +496,18 @@ export MAKEFLAGS="%{?_smp_mflags}"
   -release \
   -shared \
   -accessibility \
-  %{?dbus}%{!?dbus:-dbus-runtime} \
+  -dbus-linked \
   %{?egl:-egl -eglfs} \
   -fontconfig \
   -glib \
   -gtk \
   %{?ibase} \
   -icu \
-  %{?journald} \
+  -journald \
   -optimized-qmake \
-  %{?openssl} \
+  -openssl-linked \
+  -libproxy \
+  -sctp \
   %{!?examples:-nomake examples} \
   %{!?tests:-nomake tests} \
   -no-pch \
@@ -581,7 +587,7 @@ translationdir=%{_qt5_translationdir}
 
 Name: Qt5
 Description: Qt5 Configuration
-Version: 5.15.6
+Version: 5.15.8
 EOF
 
 # rpm macros
@@ -1097,6 +1103,42 @@ fi
 
 
 %changelog
+* Mon Mar 27 2023 Than Ngo <than@redhat.com> - 5.15.8-8
+- Fix bz#2179854, Qt 5 render the Bold style CJK character very thick
+  with Noto CJK variable fonts
+
+* Mon Mar 20 2023 Than Ngo <than@redhat.com> - 5.15.8-7
+- Fix bz#2178389, Qt application render very thin fonts after
+  switch to VF version of Noto CJK fonts
+
+* Mon Feb 27 2023 Jan Grulich <jgrulich@redhat.com> - 5.15.8-6
+- refresh kde-5.15-rollup patch
+
+* Wed Feb 08 2023 Jan Grulich <jgrulich@redhat.com> - 5.15.8-5
+- Fix possible DOS involving the Qt SQL ODBC driver plugin
+  CVE-2023-24607
+
+* Tue Jan 31 2023 Jan Grulich <jgrulich@redhat.com> - 5.15.8-4
+- migrated to SPDX license
+
+* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5.15.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Thu Jan 05 2023 Jan Grulich <jgrulich@redhat.com> - 5.15.8-2
+- Correctly install qtsan header file
+
+* Thu Jan 05 2023 Jan Grulich <jgrulich@redhat.com> - 5.15.8-1
+- 5.15.8
+
+* Sat Dec 31 2022 Pete Walter <pwalter@fedoraproject.org> - 5.15.7-2
+- Rebuild for ICU 72
+
+* Mon Oct 31 2022 Jan Grulich <jgrulich@redhat.com> - 5.15.7-1
+- 5.15.7
+
+* Tue Oct 11 2022 Rex Dieter <rdieter@gmail.com> - 5.15.6-2
+- make mixing verisons and private api usage a warning instead of fatal error
+
 * Tue Sep 20 2022 Jan Grulich <jgrulich@redhat.com> - 5.15.6-1
 - 5.15.6
 

qtbase-QTBUG-111994.patch

@@ -0,0 +1,11 @@
+diff -pruN qtbase-everywhere-src-5.15.8.orig/src/platformsupport/fontdatabases/fontconfig/qfontconfigdatabase.cpp qtbase-everywhere-src-5.15.8/src/platformsupport/fontdatabases/fontconfig/qfontconfigdatabase.cpp
+--- qtbase-everywhere-src-5.15.8.orig/src/platformsupport/fontdatabases/fontconfig/qfontconfigdatabase.cpp	2023-03-16 16:21:48.574489839 +0900
++++ qtbase-everywhere-src-5.15.8/src/platformsupport/fontdatabases/fontconfig/qfontconfigdatabase.cpp	2023-03-17 15:58:39.312498612 +0900
+@@ -564,6 +564,7 @@ void QFontconfigDatabase::populateFontDa
+             FcObjectSetAdd(os, *p);
+             ++p;
+         }
++        FcPatternAddBool(pattern, FC_VARIABLE, FcFalse);
+         fonts = FcFontList(nullptr, pattern, os);
+         FcObjectSetDestroy(os);
+         FcPatternDestroy(pattern);

qtbase-QTBUG-112136.patch

@@ -0,0 +1,113 @@
+diff -pruN qtbase-everywhere-src-5.15.8.orig/src/platformsupport/fontdatabases/fontconfig/qfontconfigdatabase.cpp qtbase-everywhere-src-5.15.8/src/platformsupport/fontdatabases/fontconfig/qfontconfigdatabase.cpp
+--- qtbase-everywhere-src-5.15.8.orig/src/platformsupport/fontdatabases/fontconfig/qfontconfigdatabase.cpp	2023-03-24 14:40:24.844713011 +0900
++++ qtbase-everywhere-src-5.15.8/src/platformsupport/fontdatabases/fontconfig/qfontconfigdatabase.cpp	2023-03-24 21:22:35.466115667 +0900
+@@ -954,6 +954,7 @@ void QFontconfigDatabase::setupFontEngin
+     QFontEngine::GlyphFormat format;
+     // try and get the pattern
+     FcPattern *pattern = FcPatternCreate();
++    FcPattern *match = NULL;
+ 
+     FcValue value;
+     value.type = FcTypeString;
+@@ -980,7 +981,41 @@ void QFontconfigDatabase::setupFontEngin
+     FcConfigSubstitute(nullptr, pattern, FcMatchPattern);
+     FcDefaultSubstitute(pattern);
+ 
+-    FcPattern *match = FcFontMatch(nullptr, pattern, &result);
++    if (!fid.filename.isEmpty()) {
++        // FC_INDEX is ignored during processing in FcFontMatch.
++        // So iterate FcPatterns directly and find it out.
++        FcFontSet *fcsets[2], *fcfs;
++
++        fcsets[0] = FcConfigGetFonts(nullptr, FcSetSystem);
++        fcsets[1] = FcConfigGetFonts(nullptr, FcSetApplication);
++        for (int nset = 0; nset < 2; nset++) {
++            fcfs = fcsets[nset];
++            for (int fnum = 0; fnum < fcfs->nfont; fnum++) {
++                FcPattern *fcpat = fcfs->fonts[fnum];
++                FcChar8 *fcfile;
++                FcBool variable;
++                int fcindex;
++
++                // FIXME: Ignore a FcPattern which has variable=true at this point.
++                if (FcPatternGetBool(fcpat, FC_VARIABLE, 0, &variable) == FcResultMatch &&
++                    variable == FcTrue)
++                    continue;
++                if (FcPatternGetString(fcpat, FC_FILE, 0, &fcfile) == FcResultMatch &&
++                    FcPatternGetInteger(fcpat, FC_INDEX, 0, &fcindex) == FcResultMatch) {
++                    QByteArray f = QByteArray::fromRawData((const char *)fcfile,
++                                                           strlen((const char *)fcfile));
++                    if (f == fid.filename && fcindex == fid.index) {
++                        // We found it.
++                        match = FcFontRenderPrepare(nullptr, pattern, fcpat);
++                        goto bail;
++                    }
++                }
++            }
++        }
++    }
++bail:
++    if (!match)
++        match = FcFontMatch(nullptr, pattern, &result);
+     if (match) {
+         engine->setDefaultHintStyle(defaultHintStyleFromMatch((QFont::HintingPreference)fontDef.hintingPreference, match, useXftConf));
+ 
+diff -pruN qtbase-everywhere-src-5.15.8.orig/src/platformsupport/fontdatabases/freetype/qfontengine_ft.cpp qtbase-everywhere-src-5.15.8/src/platformsupport/fontdatabases/freetype/qfontengine_ft.cpp
+--- qtbase-everywhere-src-5.15.8.orig/src/platformsupport/fontdatabases/freetype/qfontengine_ft.cpp	2022-11-11 16:29:17.000000000 +0900
++++ qtbase-everywhere-src-5.15.8/src/platformsupport/fontdatabases/freetype/qfontengine_ft.cpp	2023-03-24 23:03:02.165756803 +0900
+@@ -68,6 +68,7 @@
+ #include FT_GLYPH_H
+ #include FT_MODULE_H
+ #include FT_LCD_FILTER_H
++#include FT_MULTIPLE_MASTERS_H
+ 
+ #if defined(FT_CONFIG_OPTIONS_H)
+ #include FT_CONFIG_OPTIONS_H
+@@ -740,6 +741,29 @@ bool QFontEngineFT::init(FaceId faceId,
+     freetype->computeSize(fontDef, &xsize, &ysize, &defaultGlyphSet.outline_drawing, &scalableBitmapScaleFactor);
+ 
+     FT_Face face = lockFace();
++    FT_MM_Var *master = nullptr;
++    FT_Error ftresult;
++    double weight_mult = 1.0;
++
++    ftresult = FT_Get_MM_Var(face, &master);
++    if (face_id.index >> 16 && ftresult == FT_Err_Ok) {
++        if ((face_id.index >> 16) - 1 < master->num_namedstyles) {
++            // Pull out weight and width from named-instance.
++            FT_Var_Named_Style *instance = &master->namedstyle[(face_id.index >> 16) - 1];
++
++            for (unsigned int i = 0; i < master->num_axis; i++) {
++                double value = instance->coords[i] / (double) (1U << 16);
++                double default_value = master->axis[i].def / (double) (1U << 16);
++                double mult = default_value ? value / default_value : 1;
++
++                switch (master->axis[i].tag) {
++                case FT_MAKE_TAG('w', 'g', 'h', 't'):
++                    weight_mult = mult;
++                    break;
++                }
++            }
++        }
++    }
+ 
+     if (FT_IS_SCALABLE(face)) {
+         bool fake_oblique = (fontDef.style != QFont::StyleNormal) && !(face->style_flags & FT_STYLE_FLAG_ITALIC) && !qEnvironmentVariableIsSet("QT_NO_SYNTHESIZED_ITALIC");
+@@ -750,7 +774,7 @@ bool QFontEngineFT::init(FaceId faceId,
+         // fake bold
+         if ((fontDef.weight >= QFont::Bold) && !(face->style_flags & FT_STYLE_FLAG_BOLD) && !FT_IS_FIXED_WIDTH(face) && !qEnvironmentVariableIsSet("QT_NO_SYNTHESIZED_BOLD")) {
+             if (const TT_OS2 *os2 = reinterpret_cast<const TT_OS2 *>(FT_Get_Sfnt_Table(face, ft_sfnt_os2))) {
+-                if (os2->usWeightClass < 700 && fontDef.pixelSize < 64)
++                if (os2->usWeightClass * weight_mult < 700 && fontDef.pixelSize < 64)
+                     embolden = true;
+             }
+         }
+@@ -829,6 +853,8 @@ bool QFontEngineFT::init(FaceId faceId,
+     } else {
+         Q_ASSERT(!face_);
+     }
++    if (master && face->glyph)
++        FT_Done_MM_Var(face->glyph->library, master);
+     // we share the HB face in QFreeTypeFace, so do not let ~QFontEngine() destroy it
+     face_ = Holder(freetype->hbFace.get(), dont_delete);
+ 

qtbase-everywhere-src-5.15.4-cve-2021-38593.patch

@@ -1,12 +0,0 @@
-diff -up qtbase-everywhere-src-5.15.4/src/gui/painting/qpaintengineex.cpp.me qtbase-everywhere-src-5.15.4/src/gui/painting/qpaintengineex.cpp
---- qtbase-everywhere-src-5.15.4/src/gui/painting/qpaintengineex.cpp.me	2022-05-30 14:21:52.215469841 +0200
-+++ qtbase-everywhere-src-5.15.4/src/gui/painting/qpaintengineex.cpp	2022-05-30 14:22:39.552558748 +0200
-@@ -426,7 +426,7 @@ void QPaintEngineEx::stroke(const QVecto
-         patternLength *= pw;
-         if (qFuzzyIsNull(patternLength)) {
-             pen.setStyle(Qt::NoPen);
--        } else if (extent / patternLength > 10000) {
-+        } else if (qFuzzyIsNull(extent) || extent / patternLength > 10000) {
-             // approximate stream of tiny dashes with semi-transparent solid line
-             pen.setStyle(Qt::SolidLine);
-             QColor color(pen.color());

qtbase-everywhere-src-5.15.6-private_api_warning.patch

@@ -0,0 +1,12 @@
+diff -up qtbase-everywhere-src-5.15.6/src/corelib/kernel/qobject_p.h.private_api_warning qtbase-everywhere-src-5.15.6/src/corelib/kernel/qobject_p.h
+--- qtbase-everywhere-src-5.15.6/src/corelib/kernel/qobject_p.h.private_api_warning	2022-10-11 09:08:33.712070523 -0500
++++ qtbase-everywhere-src-5.15.6/src/corelib/kernel/qobject_p.h	2022-10-11 09:10:58.647038619 -0500
+@@ -435,7 +435,7 @@ inline void QObjectPrivate::checkForInco
+     Q_UNUSED(version);
+ #else
+     if (Q_UNLIKELY(version != QObjectPrivateVersion)) {
+-        qFatal("Cannot mix incompatible Qt library (%d.%d.%d) with this library (%d.%d.%d)",
++        qWarning("Cannot mix incompatible Qt library (%d.%d.%d) with this library (%d.%d.%d)",
+                 (version >> 16) & 0xff, (version >> 8) & 0xff, version & 0xff,
+                 (QObjectPrivateVersion >> 16) & 0xff, (QObjectPrivateVersion >> 8) & 0xff, QObjectPrivateVersion & 0xff);
+     }

sources

@@ -1,2 +1,2 @@
-SHA512 (qtbase-everywhere-opensource-src-5.15.6.tar.xz) = 4fc6973b9250cd78c4797ed9bb58bec949243cc5e8c3a546b5fbe8c6e6480d5e0745d273fac812f9f5f1fcd675cd8b867d47f57563bf6d23118b58032550103f
-SHA512 (kde-5.15-rollup-20220920.patch.gz) = bbfe6a34185f99500ee2ec0c75ae36f007d13cccf03765b49f271ec55bd76b562647a45b400a329af85fd74b22a38223796039ebb6b9b98c0e75ce1a2a81bbd0
+SHA512 (qtbase-everywhere-opensource-src-5.15.8.tar.xz) = 29e8877bafdbc908072209f1b27a5040b022e2b71f17f4ab4cecd570adeae21597f9af7f1d38758760f3cb30376eeb15c5f066bf02c6e9a9e3a4d07f967046ce
+SHA512 (kde-5.15-rollup-20230227.patch.gz) = beb2171fe7eda2074dc28f35f001a71a94418cf17b9a5556b8f2041ed2f9b654f0aadcd02ec48a734cb8dccabd3f4ec971a8e389bef67c94398a11698278e1bc