Sync Pritpal v1.09.71-mtfix23 (src/include/tests/docs only, workflows kept)

.github/workflows/macos-diag.yml

@@ -4,6 +4,8 @@ name: macos-diag
 # per-assertion output and, if they stall, dumps thread stacks.
 on:
   workflow_dispatch:
+  push:
+    branches: [mtfix23-sync]
 
 jobs:
   diag:

.gitleaks.toml

@@ -0,0 +1,4 @@
+title = "OpenADS Gitleaks configuration"
+
+[extend]
+useDefault = true

.gitleaksignore

@@ -0,0 +1,4 @@
+src/session/connection.cpp:generic-api-key:525
+src/session/connection.cpp:generic-api-key:1457
+tests/unit/aes_test.cpp:generic-api-key:41
+third_party/tinyaes/aes.c:generic-api-key:18

CMakeLists.txt

@@ -13,6 +13,14 @@ project(OpenADS
 # a .git tree falls back to ${PROJECT_VERSION} from project() above.
 # The previous hard-coded "1.0.0-rc1" string drifted six releases
 # behind reality and surprised users running rc12.
+# A pipeline that knows the release tag passes it explicitly: the tag
+# is the source of truth for a release build's stamp, not the local
+# clone's git state (shallow/container checkouts may not resolve
+# `git describe` - the glibc231 container leg shipped a plain
+# "1.09.68" banner for exactly that reason).
+if(OPENADS_VERSION_FORCE)
+    set(OPENADS_VERSION_STR "${OPENADS_VERSION_FORCE}")
+else()
 set(OPENADS_VERSION_STR "${PROJECT_VERSION}")
 find_package(Git QUIET)
 if(GIT_FOUND AND EXISTS "${CMAKE_SOURCE_DIR}/.git")
@@ -29,6 +37,7 @@ if(GIT_FOUND AND EXISTS "${CMAKE_SOURCE_DIR}/.git")
         string(REGEX REPLACE "-dirty$" "" OPENADS_VERSION_STR "${OPENADS_VERSION_STR}")
     endif()
 endif()
+endif()
 message(STATUS "OpenADS version: ${OPENADS_VERSION_STR}")
 # Deliver the version through a generated header instead of a global
 # compile definition: a new commit used to change the command line of
@@ -219,9 +228,11 @@ if(OPENADS_WITH_TLS)
     set(MBEDTLS_INSTALL            OFF CACHE BOOL "" FORCE)
     FetchContent_Declare(
         mbedtls
-        GIT_REPOSITORY https://github.com/Mbed-TLS/mbedtls.git
-        GIT_TAG        v3.6.2
-        GIT_SHALLOW    TRUE
+        GIT_REPOSITORY      https://github.com/Mbed-TLS/mbedtls.git
+        GIT_TAG             v3.6.2
+        GIT_SHALLOW         TRUE
+        GIT_SUBMODULES      framework
+        GIT_SUBMODULES_RECURSE TRUE
     )
     FetchContent_MakeAvailable(mbedtls)
     message(STATUS "OpenADS: TLS enabled via vendored mbedtls 3.6.2 (statically linked)")
@@ -246,15 +257,13 @@ if(OPENADS_WITH_HTTP)
     set(JSON_Install    OFF CACHE BOOL "" FORCE)
     FetchContent_Declare(
         cpp_httplib
-        GIT_REPOSITORY https://github.com/yhirose/cpp-httplib.git
-        GIT_TAG        v0.18.5
-        GIT_SHALLOW    TRUE
+        URL      https://github.com/yhirose/cpp-httplib/archive/refs/tags/v0.18.5.tar.gz
+        URL_HASH SHA256=731190e97acd63edce57cc3dacd496f57e7743bfc7933da7137cb3e93ec6c9a0
     )
     FetchContent_Declare(
         nlohmann_json
-        GIT_REPOSITORY https://github.com/nlohmann/json.git
-        GIT_TAG        v3.11.3
-        GIT_SHALLOW    TRUE
+        URL      https://github.com/nlohmann/json/archive/refs/tags/v3.11.3.tar.gz
+        URL_HASH SHA256=0d8ef5af7f9794e3263480193c491549b2ba6cc74bb018906202ada498a79406
     )
     set(JSON_BuildTests OFF CACHE INTERNAL "")
     FetchContent_MakeAvailable(cpp_httplib nlohmann_json)
@@ -278,8 +287,8 @@ if(NOT EXISTS "${_openads_zlib_dir}/zlib.h")
     include(FetchContent)
     FetchContent_Declare(
         zlib_src
-        URL https://github.com/madler/zlib/releases/download/v1.3.1/zlib-1.3.1.tar.gz
-        DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+        URL      https://github.com/madler/zlib/releases/download/v1.3.1/zlib-1.3.1.tar.gz
+        URL_HASH SHA256=9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23
     )
     set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
     set(SKIP_INSTALL_ALL ON CACHE BOOL "" FORCE)
@@ -334,8 +343,8 @@ if(OPENADS_WITH_SQLITE)
             include(FetchContent)
             FetchContent_Declare(
                 sqlite_amalgamation
-                URL https://www.sqlite.org/2024/sqlite-amalgamation-3460100.zip
-                DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+                URL      https://www.sqlite.org/2024/sqlite-amalgamation-3460100.zip
+                URL_HASH SHA256=77823cb110929c2bcb0f5d48e4833b5c59a8a6e40cdea3936b99e199dbbe5784
             )
             FetchContent_MakeAvailable(sqlite_amalgamation)
             set(_openads_sqlite_src "${sqlite_amalgamation_SOURCE_DIR}/sqlite3.c")

README.md

@@ -103,13 +103,13 @@ generated baseline; OpenADS clears every line of the regenerated
 ADS-flavoured baseline. The session that closed the last gap is
 recorded across 28 incremental commits ending at `28be1be`.
 
-**Current release: [v1.8.4](https://github.com/FiveTechSoft/OpenADS/releases/tag/v1.8.4) (2026-07-09).**
-Harbour `rddads` + FiveWin `TDataBase` / `xBrowse` over `tcp://` is
-production-ready: remote scope (`OrdScope`), index navigation, key counts,
-date fields, and field I/O by ordinal all work end-to-end. Full Data
-Dictionary enforcement, Studio web console, SAP DD import, SQL backends
-(PostgreSQL / MariaDB / MSSQL / ODBC / SQLite), and CDX bulk-load index
-build are in production. `openads_serverd` serves the OpenADS wire
+**Current release: [v1.09.68](https://github.com/FiveTechSoft/OpenADS/releases/tag/v1.09.68) (2026-09-20).**
+OpenADS has broad compatibility coverage, but support varies by API and
+backend. Before production deployment, review [`TODO.parity.md`](TODO.parity.md)
+and [`docs/known-issues.md`](docs/known-issues.md), test the exact workload,
+and apply normal database security and backup controls. In particular,
+documented Data Dictionary and access-control parity gaps make untrusted or
+multi-user deployments experimental until those gaps are closed. `openads_serverd` serves the OpenADS wire
 protocol; clients connect with
 `AdsConnect60("tcp://host:port/path.add", ...)` and no application code
 changes. Docs:
@@ -120,9 +120,10 @@ including [migrating from ADS](https://fivetechsoft.github.io/OpenADS/en/migrati
 (CDX rollback / error 7017 caveat). `docs/wire-protocol.md` is the
 formal spec for non-C++ clients (Python, Go, Rust, Harbour AEP).
 
-Cross-platform CI is **green on all three runners**
-(`ubuntu-24.04 / ninja-clang`, `macos-14 / default`,
-`windows-2022 / msvc-x64`).
+Cross-platform CI runs on Ubuntu, macOS, and Windows. Check the current
+[Actions results](https://github.com/FiveTechSoft/OpenADS/actions/workflows/ci.yml)
+before relying on a branch or release; this document does not claim that the
+latest run is green.
 
 Release timeline:
 

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are applied to the latest published release and the default branch. Older releases may not receive fixes.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a vulnerability or suspected credential exposure. Use GitHub's private vulnerability reporting for this repository:
+
+1. Open the repository's **Security** tab.
+2. Select **Advisories** and **Report a vulnerability**.
+3. Include affected versions, reproduction steps, impact, and any suggested mitigation.
+
+If private vulnerability reporting is unavailable, contact a repository maintainer privately and ask for a secure reporting channel. Do not include secrets or exploit details in ordinary email, discussions, issues, pull requests, or chat.
+
+You should receive an acknowledgement within 7 days. A maintainer will coordinate validation, remediation, disclosure, and any CVE request. Please allow time for a fix before public disclosure.
+
+## Credential exposure
+
+Treat a committed credential as compromised even after the file is deleted. Rotate or revoke it first, then remove it from the current tree and purge it from Git history. Avoid copying the credential into issues, pull requests, commit messages, or logs.