- Boost - lists.boost.org

Invalid sha256 for boost_1_87_0.tar.bz2 archive
by Samuel DEBIONNE 07 Jan '25

07 Jan '25

Dear all, In the conda forge CI (that builds the boost packages), I noticed that some jobs are failing due to a difference between the advertised and computed sha256 checksum. The json file at https://archives.boost.io/release/1.87.0/source/boost_1_87_0.tar.bz2.json has af57be25cb4c4f4b413ed692fe378affb4352ea50fbe294a11ef548f4d527d89 While sha256sum of https://boostorg.jfrog.io/artifactory/main/release/1.87.0/source/boost_1_87… gives 79e6d3f986444e5a80afbeccdaf2d1c1cf964baa8d766d20859d653a16c39848 Has the archive been updated and not the sidecar json file? Thank you, Samuel

2 2

Your Boost Talk at CppCon?
by Vinnie Falco 02 Jan '25

02 Jan '25

Hi everyone. I think it would be nice to have several talks about Boost for the 2025 CppCon program. We need volunteers who are able to attend and give a talk. If you are interested please email me at vinnie.falco(a)gmail.com to indicate your intent and propose a subject for the talk. There are some resources available to help volunteers get their abstract prepared for submission, to improve the quality of the proposal, ensuring a greater likelihood of the talk being accepted. Getting a Boost talk accepted has been hit or miss in recent years and I would like to change that. If we can get enough volunteers involved much earlier in the process (say, this month) then we have time to assemble a strong "Boost track" with high quality abstracts. This can incentivize the conference to make Boost talks an enduring feature of its programs going forward. If you have questions or comments about Boost talks at CppCon or other conferences, a discussion here is also welcomed. Thanks!

1 0

Re: [boost] announcing boost.async
by microcai 01 Jan '25

01 Jan '25

Klemens Morgenstern via Boost <boost(a)lists.boost.org> 于2023年3月17日周五 23:22写道： > Hi, > > I've been working on a C++20 coroutine library, called `async`, > which is meant to be for C++ what asyncio is for python or generic > async/await is for javascript. > It's meant to be a framework for single threaded coroutine applications. > > It provides coroutine types, such as promises, tasks and generators to > generators are useless for real word coroutine usage. > model async operations, > channels for inter-coroutine communication and functions > like select, gather & join to wait or combine multiple awaitables. > > It's asio-based, i.e. uses asio::io_context as its event-loop and can > co_await any asio operation. > > As this is a very complex domain, I really would be happy to have some > users. > This will help me to improve documentation & come up with more > example ideas. > > Docs: https://klemens.dev/async > Repo: https://github.com/klemens-morgenstern/async > > _______________________________________________ > Unsubscribe & other changes: > http://lists.boost.org/mailman/listinfo.cgi/boost >

2 1

[boost.context] questions about Lazy Float Point State Preservation
by microcai 01 Jan '25

01 Jan '25

Does jum_fcontext do lazy state preservation on FPU? most of the time, coroutine is executing async IO code rather than cpu intensive code. Mostly, IO code does not use floating point. but no preserving FPU state is error prone. Does fcontext employ "lazy state preservation on fpu registers"?

1 0

Formal review request for Hash2
by Peter Dimov 23 Dec '24

23 Dec '24

I'd like to request a formal review for the Hash2 library https://github.com/pdimov/hash2 https://pdimov.github.io/hash2/ (by Christian Mazakas and myself.) The library implements an extensible framework for implementing hashing algorithms that can support user-defined types. Its structure is largely based on the paper "Types don’t know #" by Howard Hinnant, Vinnie Falco and John Bytheway. https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2014/n3980.html We're looking for a review manager. Comments and questions are welcome; you don't need to wait for the review.

14 75

[hash2] Review Report
by Matt Borland 21 Dec '24

21 Dec '24

Dear all, Again, thank you to those who participated in the review of `Hash2` by Peter Dimov and Christian Mazakas from 7 to 15 December 2024. Bottom line up front: The library is ACCEPTED. By and large, the discussion around the library was positive, with reviewers appreciating that it implements the "Types don't know #" proposal. I think some discussion was perhaps too narrowly focused on providing hash algorithms, as that is not the over-arching goal of the library. Below is a summary of the main discussion points and recommendations from both reviewers and me. Discussion and Recommendations: 1) Support for `std::span`. Based on the discussion, it seems like the use of `std::span` has moved from theoretical to being quite popular. Adding an API for span would in principle be OK behind the requisite feature test macros, but it will add to the conceptual requirements which I'm not convinced is beneficial. Unless Peter and Christian intend to move to C++20, and they don't, I think it would be unreasonable at this time to require spans behind macros in the implementation to allow warning-free builds with Clang's `-Wunsafe-buffer-usage` and whatever memory safety profiles turn out to be. If this library was targeting C++20, or intended to be certified by a standards organization, this would be an entirely different conversation. 2) C++ language standard requirement. As I kind of expected, there was limited support for keeping the library at C++11. The authors should feel free to use C++14 and drop support for any non-conforming compilers before initial release. 3) Documentation. Peter Turcan provided a great deal of feedback on the documentation which I expect the authors to handle. There were also quite a few calls to re-arrange the documentation to put working examples and pitfalls discussed during review first, and details of concepts later. The single vs. multi-page documentation debate will never have a clear winner, so I defer to doc writer's preference on that one. The authors have a pretty good sense of the edits they need to make, so I won't belabor the point. 4) Security. Secure construction was included in the conditional acceptance criteria of two reviews - for example, default construction and allowing too-short keys in SipHash were considered harmful. There were also concerns that the algorithms provided would be considered cryptographically secure. Since the library does not intend to be a cryptographic provider (as that is not the real point of the library), I think an annotation at the top of the docs stating as much should be added. 5) Relationship to `ContainerHash`. Several reviewers noted that since there is no explicit Hash1, the relationship with `ContainerHash` should be explained. Peter currently maintains `ContainerHash`, so I think it would be useful to add similar documentation there as well. This could help avoid the situation we have now where `MP11` fully replaces the functionality of `MPL`, but that's not obvious to the casual outside observer. 6) The concept of HashAlgorithm. There was much discussion around the concept of HashAlgorithm and how it deviates from existing practice. If Peter and Christian don't want to be the sole providers of hash algorithms for their library, they need to provide: - A way to use existing implementations and/or examples in the documentation (this was part of the acceptance criteria for all but one conditional acceptance). This can be accomplished by adding Guidance and an example of an adapter. - An FAQ section addressing questions like "Why does the library impose additional requirements such as result extension on hash algorithms which go beyond the cryptographic specifications in corresponding RFCs?" Boost.Multiprecision already implements this approach to allow unknown arithmetic backends to be used. Final Verdict: I ACCEPT the library. The library was clearly well designed, and the authors provided clear justification for implementation decisions when questioned (e.g., `tag_invoke` for functions as customization points). Peter and Christian are both responsive enough that I expect they will address the above list without needing the forcing function of a conditional accept followed by a review in the future to ensure completeness. In fact Christian already showed me a draft of an OpenSSL adaptor. If this library was coming from an outsider, my opinion would be different. For transparency the final tally of reviews received was ACCEPT: 9, REJECT: 3, CONDITIONAL ACCEPT: 5. Thanks again to all that participated and congratulations to Peter and Christian. Happy Holidays, Matt

3 2

Query on std::variant support
by Murali Kishore 20 Dec '24

20 Dec '24

Hi, Want to check is std::variant allocating memory from shared memory using boost interprocess allocators. EX: std::variant<int, float> v, w; // Define types A and B that we will store in the variant struct A { int x; A(int val) : x(val) {} }; struct B { std::string str; B(const std::string& s) : str(s) {} }; // Define the variant type using MyVariant = std::variant<A, B>; guide me for the above examples to create custom allocators. -- Regards, Murali Kishore

2 1

Re: [boost] Interest for C++20 modules support of boost officially
by Ruben Perez 19 Dec '24

19 Dec '24

On Thu, 19 Dec 2024, 15:44 John Maddock, <jz.maddock(a)googlemail.com> wrote: > > > If I understood the CMake developers and Chuanqi correctly (please let > > me know if I didn't), you do install a library with the generated > > object files, but you do not install the BMIs, as they're like > > pre-compiled headers. > > > > Let me explain how I understood it with two concrete examples. Take > > Boost.Url as an example of a compiled library, and Boost.Regex as an > > example of a header-only library. > > > > 1. Boost.Url today installs: > > * libboost_url.a, containing function definitions. > > * Headers, containing declarations. > > 2. Boost.Url in the module world would install: > > * libboost_url.a, containing the same function definitions as above. > > * A boost_url.cppm file, akin to what headers are today. > > CMake would build a BMI from this file when a user needs to > > import boost.url. > > In practice, this cppm file will likely be implemented in terms of > the > > header files that we have today. > > 3. Boost.Regex today installs: > > * Headers, containing declarations and definitions. > > 4. Boost.Regex in the module world would install: > > * A libboost_regex.a object, containing module initializers [1]. > > For instance, if you have a singleton defining a Boost.System > > error category, > > initialization code for the singleton would be emitted here. > > From the docs, it seems this object gets created even if no > > initialization code is required. > > * A boost_regex.cppm file, containing the bulk of the library, akin to > > what we provide using headers today. > > > > My intention is doing some testing to see how much trouble would this > > new libboost_regex.a library cause. > > I'm not quite convinced it's that simple, at it's most basic, consider > an inline function that is part of the module interface, if I compile > the module's object library for release, and then do a debug build of > the bmi and my project what happens? Even if clang makes that example > work out in msvc land where almost every option creates binary > compatibility issues, I see users compiling the object library from > source on a per-project basis. > I'd expect the inline function to be part of the BMI (which gets built by the user), and not part of the object file, thus not creating trouble. Of course, I could be wrong, so I'll try it. Regards, Ruben.

1 0

Boost 1.87.0 Release Report
by Vinnie Falco 17 Dec '24

17 Dec '24

We are proud to publish the first Boost Release Report, for 1.87.0. This report is designed to showcase and credit the work of the many volunteers who contribute to the libraries and other things in Boost, published as an official release three times a year. https://downloads.cppalliance.org/reports/boost_1_87_0_release_report.pdf Thanks

4 8

[hash2] Review of Hash2
by Antony Polukhin 16 Dec '24

16 Dec '24

> - What is your evaluation of the design? The design is good, but there is a major issue with security/safety in default constructors of the hash algorithms. ## HashDOS issue The issue is related to HashDOS attacks. The default seed must not be 0. Because with 0 the attacker could easily find strings of the same size that result in the same trailing bits of the hash result. As a result on those strings all the operations with unordered containers degrade to O(N) for each string, giving O(N*N) complexity for a set of strings. The issue affects any parsing where the result is stored into an unordered container: HTTP headers, HTTP cookies, JSON keys, XML... Our in-house experiments show that a single laptop can easily put down a few hundreds of servers just by sending the same precomputed HTTP request. The servers start to use 100% CPU and do not respond to other requests. The problem is so critical, that for some time we write HasDOS tests to make sure that our data structures are not affected: https://github.com/userver-framework/userver/blob/develop/universal/src/htt… With some math knowledge the attack becomes even more simple see https://orlp.net/blog/breaking-hash-functions/ Quick fix for the HashDOS is to generate a random number at the program start use it to initialize all the hashes on construction. Is still leaves a theoretical possibility of attack if there's only one instance of the application or the attacker generates strings set for each instance and sends them in one go. We were not patient enough to generate the exploit, which does not actually mean that it is not possible. A more mature fix is to generate a random seed for each request or container. We were using that approach for quite some time https://github.com/userver-framework/userver/blob/d09b427b42fc80dcd66b8161d… . We also checked some other popular frameworks for the HasDOS issue. Too many of them were affected (we reported to the authors, but not all of them reacted to the problem). All of the above leads to the following conclusion: developers are not aware of that critical issue or do not take the issue seriously. To not provoke vulnerabilities the hashing must be safe by default. ## tag_invoke is dreadful tag_invoke is over complicated. It may make sense if there is a need to specialize the behavior not just for the user defined type, but also to specialize behavior of the user defined type depending on the hashing algorithm and/or flavor. Such functionality does not seem to be required here. So instead of ``` template<class Hash, class Flavor> friend void tag_invoke( boost::hash2::hash_append_tag const&, Hash& h, Flavor const& f, X const& v ) { boost::hash2::hash_append(h, f, v.a); boost::hash2::hash_append(h, f, v.b); } ``` how about using a simpler approach: ``` template<class Visitor> friend constexpr void hash_visit(Visitor visitor, X const& v) { visitor(v.a); visitor(v.b); } ``` where Visitor could be ``` [&h, f](const auto& value) { boost::hash2::hash_append(h, f, value); } ``` ## std::hash and hash_value I'd appreciate functionality to reuse boost::hash2 functionality with std::hash and hash_value. It would be ideal to have something like: ``` template <class T> requires boost::hash2::supports_v<T> struct std::hash { std::size_t operator()(const T& x) const { boost::hash2::default_hasher h{boost::hash2::on_program_start_seed}; boost::hash2::hash_append(h, {}, x); return boost::hash2::get_integral_result<std::size_t>( h.result() ); } } template <class T> requires boost::hash2::supports_v<T> std::size_t hash_value(const T& x) { // put into Boost.Hash return std::hash<T>{}(x); } ``` So that the user just needs to provide boost::hash2 customization for its type, and after that it works with the standard library hashing and old boost hash. > - What is your evaluation of the implementation? Very good. > - What is your evaluation of the documentation? Good. > - What is your evaluation of the potential usefulness of the library? Do you already use it in industry? Not used it. The library is very useful because it researches the constexpr hashing, proposes hash combining and attempts to solve the other std::hash issues. > - Did you try to use the library? With which compiler(s)? Did you have any problems? Not used it. > - How much effort did you put into your evaluation? A quick reading of sources and docs. > - Are you knowledgeable about the problem domain? Yes, but not an expert. > Ensure to explicitly include with your review: ACCEPT, REJECT, or CONDITIONAL ACCEPT (with acceptance conditions). CONDITIONAL ACCEPT. The behavior of the default constructor must be secure. `tag_invoke` seems to be an overkill.

4 5