[2/5] shairport-sync: Update to version 5.5.1

- Update from version 4.3.7 to 5.5.1
- No change in rootfile
- shairport-sync had to be updated to version 5.5.1 to be able to build with ffmpeg-9.0.1
   present.
- --with-apple-alac is deprecated ddue to security concerns and will be removed in a
   future release. With this option selected you cannot have --with-airplay-2
- shairport-sync from version 5.0 onwards has been fully integrated with ffmpeg and it
   is recommended to use ffmpeg for alac decoding in place of apple-alac
- The alac version that was available had not been updated for 10 years.
- So --with-apple-alac is removed and replaced with --with-ffmpeg
- alac is removed with another patch in this set and so it is removed from the
   shairport-sync dependecies list
- Although there are no CVE's in the changelogs, several of the updates have security
   fixes applied
- Changelog
5.5.1
The version number has been bumped from 5.2.3 to 5.5.1 to harmonise version numbers
	across release and development branches, so that it can be stated that "these
	security updates apply to any version of Shairport Sync from 5.5 onwards".
(This version is identical to Version 5.5, but has been bumped to 5.5.1 to invoke the
	Docker image-generation workflow.)
Security Updates
This update contains important security updates:
    An AirPlay 2 client could crash Shairport Sync by sending a SETUP request whose
	timingPeerInfo.Addresses array contains a non-string element. Fixed by
	improved checking.
    The AirPlay-2 SETUP shk (session key) value's length was not validated, so a
	short shk could cause an out-of-bounds read, potentially leaking information
	or causing a crash. Fixed by improved validation.
    On a classic-AirPlay session using the (deprecated) Hammerton decoder that
	negotiates an uncompressed PCM session, the audio buffer is sized for exactly
	one packet, but the decode copy was bounded by the received packet length and
	was not checked against the allocation. Thus, a single oversized UDP audio
	packet could overflow the heap with attacker-controlled data. Fixed by extra
	bounds checking.
    Note that use of the Hammerton decoder continues to be deprecated for security
	reasons.
    A unauthenticated client on an AirPlay 2 receiver could overflow a stack buffer
	by sending an RTSP request with an unrecognised method and a large body.
	Fixed by sizing the buffer correctly.
    A remote, unauthenticated client could crash the daemon with a two-byte pairing
	message. Fixed by improved operand checking.
    A number of updates have been made for classic-AirPlay builds that use the
	(deprecated) tinysvcmdns mDNS library.
    Note that the tinysvcmdns library is no longer maintained upstream, and its use
	is strongly deprecated for security reasons.
5.2.3
Bug Fix
    Fix a memory allocation bug in the convolution code. This occurred at high output
	rates, e.g. 192,000 frames per second.
5.2.2.2
Enhancement
    If the output rate is different to the input rate (e.g. 48,000 vs 44,100), the
	deepest output bit depth will be chosen so that the transcoder has the
	maximum dynamic range available to minimise transcoding inaccuracies.
Bug Fixes
    Fixed a bug whereby the audio backend latency offset was mishandled in AirPlay 2
	operation.
    Background: the audio_backend_latency_offset_in_seconds in the general section of
	the configuration file allows you to delay or advance the output by a fixed
	amount relative to the exact synchronisation time. It can be used, for
	example, to delay the audio slightly so that it synchronises with audio
	coming from another device that is delayed by internal processing.
    The bug was that the latency offset value was being used before the frame rate of
	the incoming audio was properly set, resulting in an incorrect calculation of
	the number of frames to offset.
    Many thanks to prhodey for discovering and investigating the problem and for a
	PR that fixes the problem for Buffered Audio streams. An adjustment has also
	been made to the treatment of Realtime streams.
    Fixed a subtle output format selection bug thanks to nicolas314's report.
    The bug would occur only in specific circumstances when searching for a suitable
     output rate and format to match the input. Rather ironically, it arose from an
     attempt to maximise audio fidelity, as follows:
        If it can be determined from the settings that Shairport Sync ("SPS") does
	 not have to modify the audio, e.g. by changing volume, then SPS will look
	 for an output format with the exact same rate and format as the input, so
	 that audio passes through SPS without alteration of any kind.
        Unfortunately, due to the bug, if it failed to find an exact match, SPS would
	 start searching at a different output rate.
        The bug only showed up when it could be determined that no modification of
	 the audio was to be performed. So the bug only occured if
	 ignore_volume_control was set to yes and the output device could not exactly
	 match the input format.
    The fix means that if SPS fails to find an exact format match, it will now look
	for another format at the same rate before searching at other rates.
    In addition, to be sure that no further audio processing is needed, SPS checks
	to ensure that neither convolution not loudness are enabled.
Documentation Update
    Update the README reference to the MPRIS specification to the latest version.
	Thanks to Dmitry Batin for the PR.
Building Enhancement
    Remove the explicit - for xxd to read from STDIN. It's not necessary, and
	removing it makes it easier to package Shairport Sync on other build systems,
	such as OpenWrt. Thanks to kel-mo for the PR.
Dependabot Updates
    Dependabout updates were made to some of the tools in the CI / GitHub build system.
5.2.2 and 5.2.2.2
Identical to 5.2.2.2 The extra point releases were created in order to debug and fix
	a GitHub Actions problem.
5.2
New Features and Enhancements
    A new MQTT command, queue_next, has been added -- thanks to Scott Simon for the PR:
    A new queue_next MQTT command enqueues a track by its Persistent ID
	(hexadecimal track_id), for example: queue_next 316a7653186B6917. The command
	is sent as a remote control command via DACP to the player.
    Please note that, like all other remote control commands, this works for Classic
	AirPlay only.
    Added a long-overdue exit handler to enable Shairport Sync to exit cleanly — that
	is, to attempt to clean everything up, e.g. open files, sockets, devices,
	threads, etc. before exit. If cleanup isn’t finished after one second, exit
	will occur unconditionally.
    The new exit handler is now used for normal exit, abnormal exit after fatal
	errors and for quit requests from the D-Bus and MPRIS interfaces.
Bug Fixes
    Metadata: Restored the previous way of receiving metadata, which was
	inadvertently removed, for better compatibility for older users of metadata.
	A temporary new option in the diagnostics section of the configuration file
	allows you to opt for the newer plist-based metadata, which is considerably
	richer but not yet integrated into the D-Bus or MPRIS interfaces. Thanks to
	Léo for the report.
    Convolution & Loudness: Fixed a number of bugs in the convolution and loudness
	code. The bugs were due to mixing up input and output rates and channel
	counts. If the input and output rates and channel counts were identical, no
	problem. But if rates were different, the wrong finite impulse response
	filter would be loaded. Many thanks to Christopher Wawak for the report and
	follow-up.
    MQTT: Fixed byte order of the track_id published over MQTT.
    Fixed a very low-level mutex-locking error that interfered with debugging.
    Unfixable Error Hang: Fixed a hang when an unfixable error occurred. When an
	unfixable error occurs without an unfixable error handler installed, the
	mutex protecting Shairport Sync’s alsa backend is now unlocked to permit a
	clean exit. Thanks to timg7 for the report.
    Updated audio_sndio.c to remove some harmless compiler warnings.
Deprecations
    The log-to-syslog command line option and the log_output_to setting in the
	diagnostics part of the configuration are obsolete and are now ignored.
Documentation Fix
    Fixed a broken link to CONFIGURATION FLAGS.md from ADVANCED TOPICS. Thanks to
	Adrián Reyes for the PR.
    Updated the BUILD guide to include gcrypt in the list of packages needed when
	building for FreeBSD / AirPlay 2.
Dependabot Updates
    Merged in a number of CI-related Dependabot updates.
5.1
Security Fix
    Fixed Out-Of-Bounds reads and a potential infinite loop in TLV and DMAP parsers.
	Thanks to TristanInSec for two reports and the PR to fix it.
Remote Control is Back for Classic AirPlay!
An error that broke DACP signalling has been fixed. Messages (e.g. “play”, “pause”,
	“next”, etc.) sent to Shairport Sync via the D-Bus, MPRIS or MQTT interfaces
	are now correctly forwarded to the client. This works for classic AirPlay only.
New Metadata Build Configuration flags
    The metadata pipe and multicast interfaces are no longer included automatically
     when metadata support is included in the build configuration. To include them,
     use the respective new configuration flags listed below:
        —with-metadata-pipe
        —with-metadata-multicast
New Features
    AirPlay 2 Password: You can now set a password for AirPlay 2 as well as classic
	AirPlay.
    Until now, you could only set a password on a classic AirPlay service. Now it
	works on AirPlay 2 connections too.
    Up to 31 channels now allowed on the output device.
    The previous limit was eight channels; if you connected to a device with more
	than eight channels, Shairport Sync was unable to use it.
    The AirPlay 2 build can now provide a pure classic AirPlay mode either by request
     or by default under the control of a new optional setting:
        You can ask the AirPlay 2 build of Shairport Sync to provide a purely classic
	 AirPlay service with a setting: --service-type=<type> on the command line,
	 or service_type = "<type>"in the general section of the configuration file.
	 The <type> can be "auto" (default), "classic" or "airplay2".
        If the service type setting is omitted or set to "auto", AirPlay 2 service
	 will be provided if NQPTP is running, and classic AirPlay service will be
	 provided if not.
More…
    Improved stability when switching players.
        When an existing session is interrupted, it is completely terminated before
	 starting the new session.
    Updated Docker base Linux image and FFmpeg libraries
        Alpine 3.23.4 and FFmpeg 8.1.
    Docker image generation for ARM V6 CPUs has been discontinued.
        Docker itself is no longer supported on ARM V6 CPUs.
    Updated sample docker-compose.yml to ask for SYS_NICE capabilities.
    Miscellaneous Bug Fixes
        Fixed incorrect signalling of the DACP port to the DACP monitor. The dapo
	 metadata, giving the DACP port number, is now sent as text, with a token of
	 ”0” when the port becomes inaccessible.
        When an immediate flush is requested, PTP clock information is reset
	 immediately to disable the use an out-of-date clock until play is resumed.
        If a TEARDOWN has a plist with a streams item, the player is stopped. If the
	 plist exists but is empty, the connection is closed immediately rather than
	 waiting for the connection to be closed by the client.
        Set Locales in Test Clients
            This allows the shairport-sync-dbus-test-client and
		shairport-sync-mpris-test-client apps to display non-ASCII characters
		correctly.
        Fix a stack overflow bug on Alpine Linux with log verbosity set to -vvv.
	 Thanks to Arthur Loureiro for the report.
        Display n/a in a statistics readout instead of the value of
	 UINT64_MAX — 18446744073709551615 — if the minimum DAC length is not available.
    User Service Installer Script Update
        Checks are now included for non-root use and for PipeWire or PulseAudio services.
    Dependabot updates.
5.0.4
Bug Fix
Fix a bug that prevents the PulseAudio backend from initialising.
5.0.3
Bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #2183
Fix systemd unit options by @mikelei8291 in #2174
Bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #2187
Improved handling of cancellation of application and of a session.
5.0.2
Enhancement
    When built for AirPlay 2, add pw=true to the Bonjour raop properties if the
	classic AirPlay password is set. This might help with Owntone compatibility.
	Thanks to janui for the suggestion.
Documentation Update
    Fixed dead link to the online man page. Thanks to CornelisJ for the report.
Bug Fix
    Update the D-Bus test client to refer to shairport_sync_get_loudness_enabled
	rather than shairport_sync_get_loudness. Thanks to flatsiedatsie for the bug
	report.
    Defer rather than delete blocks of audio that are too far into the future, and
	also check for a valid clock when checking the timing of blocks. This is to
	attempt to deal with an unexpected situation where the timing of blocks of
	incoming audio seems to suddenly jump into the distant future, as if audio
	from the skipped-over interval has been dropped.
Changes
    Turn off some currently-irrelevant debug messages by setting their level to 4,
	meaning they will never be displayed.
5.0.1
MQTT Enhancement
    A Home-Assistant-specific default_entity_id has been added to the MQTT interface.
	The deprecated object_id term will be removed in a future release. Thanks to
	Markus Reiter for the PR.
Bug Fixes
    The requirement to have the mosquitto service running on the same system if MQTT
	support is included in the build of Shairport Sync has been removed. The
	service does not, in fact, need to be running in every case.
    This reverses a change made in PR at Version 5.0-dev-161. Thanks to David Crook
	for the bug report.
    A number of compilation warnings have been fixed. Thanks to Rudi Heitbaum for the PR.
Build System Updates
    A number of dependabot-signalled build system updates are included.
5.0
New Features
    Multi-Channel and High-Resolution Audio Support
        48,000 frames per second ("48k") operation.
        48k lossless stereo support.
        5.1 and 7.1 surround sound support.
        Multi-channel and multi-rate operation on ALSA, PipeWire, PulseAudio,
	 FreeBSD, stdout and Unix pipe output backends.
    Automatic Audio Format Selection
        Flexible and controllable output format selection.
        Automatic rate, sample format, and channel count selection.
    Full FFmpeg Integration
        Support for transcoding.
        Advanced resampling capabilities.
        New audio format support.
    Enhanced Resampling
        New vernier resampling and interpolation method optimized for low-power CPUs.
        Better performance on resource-constrained devices.
    Convolution and Loudness Enhancements
        Convolution system is now multithreaded and works on stereo and multichannel
	 audio at 48k and 44.1k.
        Multiple impulse response (IR) files can now be provided via
	 convolution_ir_files setting.
        New convolution_thread_pool_size setting for multithreaded processing
	 (defaults to 1).
        Loudness processing now works with stereo and multichannel audio at 48k and
	 44.1k.
        Updated to the most recent HiFi-LoFi FFT convolver.
    MQTT Enhancements
        Added new publish_retain boolean option. When enabled, published MQTT messages
	 have the retain flag set, so the MQTT broker stores the last message per
	 topic and new subscribers receive the most recent value immediately. Thanks
	 to lululombard for PR #2142.
    D-Bus Enhancements
        Added new --dbus_default_message_bus command-line argument (can be system or
	 session) to set the default message bus for both D-Bus native service and
	 MPRIS service. For example: --dbus_default_message_bus=session.
Performance Improvements
    Improved compatibility with AirPlay 2 AutoMix and smart playlists.
    Better operation on low-power devices down to Raspberry Pi B.
    Improved efficiency on embedded systems.
    Enhanced timestamp handling for better synchronization.
    Improved sync error calculation.
    Rebuilt buffered audio processor for cleaner handling of immediate and deferred
	flush requests.
Docker Enhancements
    Reduced Docker image sizes with slimmed-down FFmpeg library.
    Removed dhclient from Docker images for smaller footprint.
Bug Fixes
    Fixed MQTT warning on service startup: Could not establish a mqtt connection. The
	startup script now correctly states that the mosquitto service is required.
	Thanks to Hugo Villeneuve for PR #2137.
    Fixed compatibility with mbedtls library version 3.4+ (present on recent Linux
	versions). Thanks to Christian Beier for finding and fixing the bug.
    Fixed PulseAudio backend so that PA_ERR_NODATA returns "No latency data yet".
	Thanks to Vladimir Shakov for the report and fix.
    Ensured old flush requests are deleted when a new play session starts. Thanks to
	saujanyashah for the report.
    Fixed format warnings on 64-bit and 32-bit systems
    Removed compilation warnings on 32-bit builds
    Improved argument checking for debug(), inform(), warn() and die() functions
    Fixed "daemon" typos throughout codebase. Thanks to Chris Boot for PR #1981.
    Added warning if a convolution impulse response file cannot be read due to bad
	path or permissions
Build System Improvements
    Unified service file with variable substitution for Avahi support, making it
	easier to add future service dependencies. Thanks to Hugo Villeneuve.
    Network interface selection now only considers interfaces that are up, running and
	not loopback interfaces. Thanks to Carl Johnson for the suggestion.
Configuration File Changes and Deprecations
    New settings: convolution_ir_files (replaces convolution_ir_file),
	convolution_enabled (replaces convolution),
	convolution_max_length_in_seconds (replaces convolution_max_length),
	loudness_enabled (replaces loudness).
    New convolution_thread_pool_size setting (defaults to 1).
    Deprecated settings: convolution_ir_file, convolution, convolution_max_length,
	loudness.
    Corresponding D-Bus methods and properties have been updated.
Deprecation Notice
    The Jack Audio and soundio backends are deprecated and will be removed in a future
	release. Consider using the updated PipeWire backend instead.
Documentation Updates
    Updated BUILD.md with latest build instructions.
    Updated AIRPLAY2.md with feature information.
    Enhanced convolution and loudness documentation.
Maintenance
    Fixed FFmpeg deprecation warnings.
    Bumped actions/checkout from 6.0.1 to 6.0.2.
    Bumped docker/login-action from 3.6.0 to 3.7.0.
    Bumped docker/build-push-action from 6.13.0 to 6.15.0.
    Bumped docker/setup-qemu-action from 3.4.0 to 3.6.0.
    Bumped docker/setup-buildx-action from 3.9.0 to 3.10.0.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/shairport-sync | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)