- Boost - lists.boost.org

Docs in release tarballs
by Ruben Perez 07 Jun '24

07 Jun '24

Hi all, For someone that hasn't been that long involved in Boost, it feels strange to distribute the documentation in the same release tarball as the code, specially considering the usual complains about "Boost size". I'm sure there are reasons behind it, and I'd like to learn about them. This is a candid question, out of being a newbie here. Thanks, Ruben

8 14

Re: [boost] Boost Downloads
by Tim Haines 06 Jun '24

06 Jun '24

> Summary: > > Boost downloads will be hosted at a new location, with the URL format > https://archives.boost.io/release/1.85.0/source/boost_1_85_0.tar.gz > > Details: > > During the last couple of years the Boost downloads have been hosted on > JFrog Artifactory, and before that on Bintray. JFrog has been very generous > in providing the bandwidth and hosting services. > > Recently, bandwidth increased into the 150TB/month range. JFrog requested > the download be moved behind a CDN, or migrated to another service entirely. > > At the C++ Alliance, we have set up load balanced AWS EC2 instances, and > configured a Fastly CDN, on the domain archives.boost.io. Fastly offered a > discounted bulk rate based on the large amount of traffic. > > The boost.org website now shows links to the new CDN. > > If you are using any automated scripts that point to jfrog.io, the existing > JFrog links will continue to function until December 2024. > > > - Sam Darwin I maintain the Boost spack package[1]. The versions currently available there go back to 1.39.0. However, the versions available on archives.boost.io only go back to 1.63.0. Are the older versions going to be available there or will they remain on the sourceforge hosting? Thanks. - Tim [1] https://github.com/spack/spack/blob/develop/var/spack/repos/builtin/package… P.S. I am terribly sorry if this messes up the thread. I get my messages in digest form and could not for the life of me figure out how to reply to your email directly to the list.

2 1

[JSON] Detect duplicate keys
by abbott＠dima.unige.it 04 Jun '24

04 Jun '24

Hi, Feature request: I would like the JSON parse to inform me that duplicate keys were encountered. I believe they are currently silently handled (with a last-one-wins strategy). Thanks, John Abbott

4 3

Mailman3
by Sam Darwin 04 Jun '24

04 Jun '24

Hi, Since the current Boost webserver and mailing list are quite out-of-date, it makes sense to consider the upgrade path. Mailman3 is a complete rewrite of the mailing list software. It's designed with multiple components: hyperkitty archives, postorius, and mailman-core. Dev instances have been installed. If you have any curiosity about testing mailman3 using your local email client, or sending feedback about the mailman3 experience, you can subscribe at https://lists.preview.boost.org. Send/receive emails. If you notice problems using mailman3, open an Issue at the Github repository cppalliance/boost-mailman. Now is the best time to discover issues, rather than after deployment. Lists at https://lists.preview.boost.org won't be maintained permanently. Any emails or accounts there will eventually be deleted. It's only a staging type environment. Working with the web developers we are planning to modify the appearance of the front-end UI, adding css styles, links to the boost website, and so on. Keep an eye on the test lists for updates. In the future when "going live", the idea will be to schedule (extended) planned downtime, and have a new server fully replace "lists.boost.org". Which specific boost mailing lists should be kept? It would be easier to avoid migrating all lists, if some of them are not active. Best Regards, Sam Darwin C++ Alliance

1 0

Decimal Floating Point Library Beta
by Matt Borland 31 May '24

31 May '24

Hello, For the past year Chris Kormanyos and I have been working on a new library to implement IEEE 754 decimal floating point types. We are pleased to announce the library is now in beta, and can be found at: https://github.com/cppalliance/decimal, and the documentation is at: https://cppalliance.org/decimal/decimal.html First, what are Decimal Floating Point Numbers? They are floating point numbers where the significand is stored in base-10 (decimal) instead of base-2 (binary). This means that numbers can be represented exactly avoiding cases such as the famous 0.1 + 0.2 != 0.3: https://0.30000000000000004.com. The library provides types decimal32, decimal64, and decimal128 as specified in IEEE 754 and STL-like functionality. The library is header-only, has no dependencies, and only requires C++14. It provides most of the STL functionality that you are familiar with such as <cmath>, <cstdlib>, <charconv>, etc. We are proceeding as a beta right now rather than pursuing complete boost review as we are missing STL features such as C++17 special math, and believe we can continue to increase performance. We do intend to go through the review process at a later time. Please give the library a go, and let us know how we can make it better. We look forward to any and all feedback. If you use the Cpplang slack channel I am active (from the Central European Time zone) on both #boost and #boost-decimal. On a personal note as of today I have also moved from being employed half-time to full-time with the C++ Alliance. This affords me a greater opportunity to develop and maintain new and existing Boost libraries. Matt Borland —- C++ Alliance Staff Engineer

9 19

NVCC and Unit Test Framework.
by Allen Sanderson 29 May '24

29 May '24

Hello, I am trying to sort out an odd crash on exit while using NVCC (via Kokkos-CUDA) and the Boost Unit Test Framework. Here my are data points: Kokkos-CUDA with the Boost test tool infrastructure - Crash Kokkos-HIP with the Boost test tool infrastructure - works Kokkos-Serial with the Boost test tool infrastructure - works Pure CUDA with the Boost test tool infrastructure - works Serial with the Boost test tool infrastructure - works Kokkos-CUDA alone (e.g. normal application) - works For the first case I have three scenarios (only used to high the Kokkos usage - the code does not crash in Kokkos::initialize), two of which crash: if(true) Kokkos::initialize(argc,argv); crash in CUDA - SEGFAULTif(false) Kokkos::initialize(argc,argv); crash in elsewhere - Subprocess aborted#if 0 Kokkos::initialize() #endif No crash For the first scenario the call stack is the following: #0 0x00001555521b5d9a in ?? () from ./cuda/12.2.0/lib64/libcudart.so.12 #1 0x00001555521b8c14 in ?? () from ./cuda/12.2.0/lib64/libcudart.so.12 #2 0x000015555219d882 in ?? () from ./cuda/12.2.0/lib64/libcudart.so.12 #3 0x00001555521a072b in ?? () from ./cuda/12.2.0/lib64/libcudart.so.12 #4 0x000015554b3b5797 in __cxa_finalize () from /lib64/libc.so.6 #5 0x0000155551301a87 in __do_global_dtors_aux () from build_kokkos_cuda/library/Operators/libOperators-g.so.5.5.0 #6 0x00007fffffffad10 in ?? () #7 0x000015555532dcee in _dl_fini () at dl-fini.c:141 For second, the call stack is quite deep after the call to __cxa_finalize () otherwise the first four (4-7) are the same. At this point the only culprit I can perhaps point at is nvcc I know at that previous versions of Boost and nvcc did not get along. And such, wondering if the usage is a corner case because I know of another project that is successfully using all three Boost, Kokkos, and CUDA. I am using Boost 1.85, Kokkos 4.3, and CUDA 12.2. Any insight or thoughts ? Our unit test work with Kokkos-HIP so able to validate results. Allen Sanderson SCI Institute University of Utah

1 0

[release] Boost 1.85.0
by Marshall Clow 28 May '24

28 May '24

Release 1.85.0 of the Boost C++ Libraries is now available. These open-source libraries work well with the C++ Standard Library, and are usable across a broad spectrum of applications. The Boost license encourages both commercial and non-commercial use. This release contains two new libraries: * Boost.Charconv: A high quality implementation of <charconv> in C++11, from Matt Borland. * Boost.Scope: A collection of scope guard utilities and a unique_resource wrapper, from Andrey Semashev. The release also contains numerous enhancements and bug fixes for existing libraries. For details, including download links, see <http://www.boost.org/users/news/version_1.85.0> You can also download directly from: <https://boostorg.jfrog.io/artifactory/main/release/1.85.0/> To install this release on your system, see <http://www.boost.org/doc/libs/release/more/getting_started/index.html> Thanks to everyone who participated in this release. -- The Boost Release Team Marshall Clow, Glen Fernandes

6 25

OSTIF Boost security audit report
by Andrey Semashev 24 May '24

24 May '24

Hi, Recently, a security audit of several Boost libraries has been conducted. The audited Boost version was 1.83.0. The report is now published here: https://ostif.org/boost-audit-complete/ https://ostif.org/wp-content/uploads/2024/05/OSTIF-Boost-Report-PT-v1.4.pdf In short, the following libraries were audited: - Boost.Beast (1 medium issue) - Boost.DLL (1 informational issue) - Boost.Date_Time - Boost.Filesystem - Boost.GIL - Boost.Graph (1 low and 1 informational issues) - Boost.JSON - Boost.Program_Options - Boost.Regex (3 low issues) - Boost.String_Algo - Boost.URL - Boost.UUID No critical or high severity issues were identified. Of the 7 identified issues, 4 are marked as closed, meaning the issues are fixed. The remaining 3 are open and listed in Boost.Beast (medium), Boost.DLL (informational) and Boost.Graph (informational). During audit, several fuzzing harnesses were developed and added to OSS-Fuzz: https://github.com/google/oss-fuzz/tree/master/projects/boost In the report, there were also a few general recommendations given to improve project security: - Monitor OSS-Fuzz Reports - Implement a Vulnerability Disclosure Process - Implement Supply-Chain Attack Countermeasures - Improve the Documentation with Security Mechanisms and Assumptions - Avoid the Abuse of Asserts Also, one general recommendation to Boost users: - Perform Strict Input Validation You can find more details in the report. I'd like to emphasize the "Implement Supply-Chain Attack Countermeasures" part, which basically comes down to signing git tags and release tarballs. I think, our release process is indeed not very reliable, let's say, which showed during the past few releases: - there was instance when different tarballs for the same RC were generated from different git revisions - git tags for the release were missing or pointing to a wrong git commit Also, release tarballs on GitHub don't have hashsums or signatures attached. https://github.com/boostorg/boost/issues/838 For tarballs on jfrog, thankfully, there are hashsums published in the release notes. Perhaps, we could also publish .sig files for all tarballs, and also publish the public key to verify the signature on the website. Also, under "Implement a Vulnerability Disclosure Process" it is suggested to use GitHub Security Advisories[1] as the mechanism for reporting security issues. I've never used this tool, but perhaps it is worth enabling for boostorg on GitHub. Emailing library maintainers privately might not be a very reliable mechanism for such reports, given that maintainers may become inactive. [1]: https://docs.github.com/en/code-security/security-advisories/working-with-r…

5 10

Boost/CMake
by Robert Ramey 23 May '24

23 May '24

Anyone have first hand experience building/testing a boost library/application with CMake? I've found the github project for boost/Cmake. Can anyone point me to more useful information? Robert Ramey

15 41

Re: [boost] modern logic classes
by g.peterhoff＠t-online.de 18 May '24

18 May '24

> At this point I'd like to know if it's possible to thread mathematically the N-bool problem and create a library for generic multidimensional bool that works with templates allowing to determine N at compile time. Because in the future we should have a 8-bool implementation, and so on... Theoretically, it would (probably) be possible to provide N-valued logics. But that is beyond my knowledge. bool3/bool4(Belnap) are still manageable. For N-valued logics N>4, mathematicians would have to be consulted (as I said: I am not one). If you are asking about such things, perhaps temporal logics could also be provided https://en.wikipedia.org/wiki/Temporal_logic. But that's where I completely drop out.

1 0