Package signatures

To ensure the integrity of the libjpeg-turbo binary packages, the RPM and DEB files and the source tarball are signed using the following key:
https://www.libjpeg-turbo.org/key/LJT-GPG-KEY
https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x0338c8d8d9fda62cf9c421bd7ec2dbb6f4dbf434
and the Windows installers are signed using a code signing certificate.

Packaging changes

• New RPMs with SHA-256 digests were uploaded on 2022-09-12. This fixes an issue whereby the RPM signatures could not be successfully verified on Red Hat Enterprise Linux 9 when using its default crypto policy, which restricts the use of the SHA-1 algorithm.

2.1.1

Significant changes relative to 2.1.0

1. Fixed a regression introduced in 2.1.0 that caused build failures with non-GCC-compatible compilers for Un*x/Arm platforms.

2. Fixed a regression introduced by 2.1 beta1[13] that prevented the Arm 32-bit (AArch32) Neon SIMD extensions from building unless the C compiler flags included -mfloat-abi=softfp or -mfloat-abi=hard.

3. Fixed an issue in the AArch32 Neon SIMD Huffman encoder whereby reliance on undefined C compiler behavior led to crashes ("SIGBUS: illegal alignment") on Android systems when running AArch32/Thumb builds of libjpeg-turbo built with recent versions of Clang.

4. Added a command-line argument (-copy icc) to jpegtran that causes it to copy only the ICC profile markers from the source file and discard any other metadata.

5. libjpeg-turbo should now build and run on CHERI-enabled architectures, which use capability pointers that are larger than the size of size_t.

6. Fixed a regression (CVE-2021-37972) introduced by 2.1 beta1[5] that caused a segfault in the 64-bit SSE2 Huffman encoder when attempting to losslessly transform a specially-crafted malformed JPEG image.