Issue #6616: Group Info and Link Info are labeled Optional, but
new-style group creation always writes both, and the C library errors
reading a new-style group missing either one.
- Group Info / Link Info Status: Optional -> Required for "new style"
groups; may not be repeated (matches existing Symbol Table wording
for old-style groups).
- Documents the decoder's fallback values (8, 6) for Link Phase
Change: Maximum Compact/Minimum Dense Value when absent.
Issue #6610: the Enumeration datatype's Names field claimed member
names are ASCII, though the reference implementation doesn't enforce
encoding; and the Compound datatype's Name field description was
copy-pasted from the Opaque datatype section.
- Compound Datatype Name field (Versions 1, 2, 3): describes the
member name instead of the opaque-type description.
- Enumeration Datatype Names field (Versions 1/2, 3): drops the ASCII
claim; documents the actual constraint (no NUL byte within the
name) and that other encodings, such as UTF-8, aren't rejected.
Added 3 new functions to support this: H5TSset_internal_threads(), H5Pset_io_threads(), and H5Pget_io_threads().
This feature internally parallelizes read operations on chunked datasets. H5TSset_internal_threads() is used to enable the feature globally, while H5Pset_io_threads() can be used to disable the feature on a per-operation basis. These functions are only available when the library is configured with HDF5_ENABLE_CONCURRENCY=ON. When performing an internally threaded read, the library will concurrently read from disk, unfilter, and scatter to memory all chunks in a read operation on a chunked dataset. Currently each of these sub-operations is serialized (protected by a mutex), so there is not yet likely to be any performance improvement.
* Document the Metadata Cache Image block and header message
Adds docs/doxygen/dox/H5.format.4.0.dox coverage for:
- Level 1J: the Metadata Cache Image Block (subsec_fmt4_infra_mdci)
- IV.A.3.y: the Metadata Cache Image header message (0x0018)
- TOC/cross-reference entries and the superblock-extension list entry for both
Also clarifies the 'Size of Header Message #n Data' field description
for v1 and v2 object header messages to note it includes flags/reserved
(v1) or flags/creation-order (v2) fields, not just type and length.
* Address review feedback on MDCI message docs
- Clarify that the Metadata Cache Image message and its image block
are only removed/reclaimed on the next file open when the file is
opened for read/write access; read-only opens leave them unchanged.
- Fix a malformed table row (missing closing </td>) in the Status
field of the IV.A.3.y message table.
Generate the Doxygen tag file inside the html output directory
(hdf5lib_docs/html/hdf5.tag) instead of at the build root. The S3
documentation publishing (daily "latest", release zip, and
publish-release) all derive from the docs-doxygen artifact, which is
uploaded from the build-tree html directory. Placing the tag file there
makes it flow to every destination, e.g.
https://support.hdfgroup.org/documentation/hdf5/latest/hdf5.tag
Since the tag file now lives inside html/, the existing DIRECTORY install
already installs it to ${HDF5_INSTALL_DOC_DIR}/html/hdf5.tag, so the
redundant standalone install(FILES ...) is removed (it would otherwise
reference a file that no longer exists at the build root).
The previous `lib/cmake/hdf5-config.cmake` isn't in CMake's find_package
search path since CMake expects that to be a common path with each
package having it's own subdirectory. This changes it to
`lib/cmake/hdf5/hdf5-config.cmake` so the config is now found when the
install prefix is in `CMAKE_PREFIX_PATH`.
This also sets `HDF5_USE_GNU_DIRS=ON` by default for non-Windows builds.
Fixes#6137
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
- The layout of the shared message encoding was actually decribed at the beginning of the section IV.A.2.
For clarification, the section was split into two with one section purely for the shared message encoding
and another section for the catalog of message types.
- Cross-linked shareable messages to the shared message encoding section.
- Misc. cleanup
* Fix for issue #6430: add decription for H5Tencode/H5Tdecode to Appendix.
* Fix for issue #6392:
The fix addressed part 1 of the issue.
No change is needed for part 2 of the issue: verify that the info is already there in the Driver Info Message.
* Fix for issue #6360
* Fix for issue #6416 in section III.I. Disk Format: Level 1I - Shared Object Header Message Table.
---------
Co-authored-by: Matt L <124107509+mattjala@users.noreply.github.com>
* Fix for issue #6430: add decription for H5Tencode/H5Tdecode to Appendix.
* Fix for issue #6392:
The fix addressed part 1 of the issue.
No change is needed for part 2 of the issue: verify that the info is already there in the Driver Info Message.
* Fix for issue #6360
---------
Co-authored-by: Matt L <124107509+mattjala@users.noreply.github.com>
* Fix for issue #6430: add decription for H5Tencode/H5Tdecode to Appendix.
* Fix for issue #6392:
The fix addressed part 1 of the issue.
No change is needed for part 2 of the issue: verify that the info is already there in the Driver Info Message.
* Fixes for issues: #6448, #6449, #6444
* Fix for issue #6443.
* Fix for issue #6365.
* Fix spelling error.
* Modifications based on PR review comments.
* Correct spelling error.
* Replaced 3 duplicate field descriptions with cross-reference to the version 3 layout message.
* Refactor the description for the layout message regarding the dimension related fields.
---------
Co-authored-by: H. Joe Lee <hyoklee@hdfgroup.org>
* cmake: improve HDF5_BUILD_PARALLEL_TOOLS documentation and MFU error message
The option description for HDF5_BUILD_PARALLEL_TOOLS was too terse to be
useful — it did not mention the required MFU, CIRCLE, or DTCMP external
libraries, nor that HDF5_ENABLE_PARALLEL must also be ON. Expand it with
the dependency list and a link to the mpiFileUtils project.
- CMakeBuildOptions.cmake: rephrase HDF5_BUILD_PARALLEL_TOOLS description
to "Build MPI-enabled HDF5 tools" (shorter, forward-compatible)
feat: add optional digital signature verification for HDF5 filter plugins
Introduce an opt-in plugin signing and verification system that allows
HDF5 deployments to require cryptographically signed filter plugins before
loading them. Disabled by default (HDF5_REQUIRE_SIGNED_PLUGINS=OFF).
New tool: h5sign
- Signs plugin shared libraries by appending an RSA signature and a
14-byte footer (algo_id | sig_len | 8-byte magic | format_ver) to the
binary without modifying the original content.
- Supports SHA-512 (default), SHA-256, SHA-384, and their PSS variants
(-a/--algorithm flag).
- Detects already-signed plugins; --force strips the old signature and
re-signs.
- Security hardened: keeps the file descriptor open through hashing and
appending (no TOCTOU window), enforces a 2048-bit minimum RSA key size,
rolls back partial writes on failure, and rejects paths that are not
regular files.
Verification (H5PLsig.c)
- At plugin load time, reads the footer, validates the magic and format
version, then checks the RSA signature against all public keys found in
the KeyStore directory.
- File is hashed once; per-key verification operates on the pre-computed
digest (no redundant I/O for multi-key keystores).
- Plugins whose signature hash appears in revoked_signatures.txt are
rejected regardless of key validity.
- Runtime debug output via HDF5_DEBUG=pl.
KeyStore management
- Trusted public keys are PEM files in a directory specified by
HDF5_PLUGIN_KEYSTORE_DIR (build time) or HDF5_PLUGIN_KEYSTORE (env var).
- HDF5_LOCK_PLUGIN_KEYSTORE cmake option disables the env-var override for
security-hardened deployments.
Test infrastructure
- h5signverifytest: positive, negative, tamper, re-sign, and revocation
test cases.
- CTest fixture-based dependency graph (FIXTURES_SETUP/FIXTURES_REQUIRED)
replaces fragile DEPENDS chains so tests remain correct under -R filtering.
- Dedicated signed-plugins.yml CI workflow; full test suite scoped to
H5SIGN and H5PLUGIN-signature tests to avoid unrelated flaky failures.
- Cross-platform: Linux, macOS, and Windows (MSVC-compatible, BIO-based
OpenSSL I/O, HDsleep/HDsetenv portability wrappers).
Documentation: docs/PLUGIN_SIGNATURE_README.md covers usage, footer
format, revocation file format, FAQ, and troubleshooting.
Co-authored-by: Glenn Song <gsong@hdfgroup.org>
Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
* Replace link in Glossary.dox with added Chessboard.svg file.
* Exclude checking links on server "web.cels.anl.gov" that rejects
automated link checker.
The value for File_with_compression.h5 should read `345 seconds`
instead of `0.37 seconds`.
Co-authored-by: Kazuyoshi Furutaka (work) <furutaka.kazuyoshi@jaea.go.jp>
* Consolidate documentation under doc/ directory
Move user-facing guides from release_docs/ and doxygen/ into a single
doc/ root. release_docs/ now holds only release artifacts (changelogs,
history, release process, maintainer info).
- git mv release_docs/INSTALL*.md, USING_*.md, README_HPC.md,
BuildSystemNotes.md, AutotoolsToCMakeOptions.md,
HDF5_Library_2.0.0_Migration_Guide.md → doc/
- git mv doxygen/ → doc/doxygen/
- Update CMakeLists.txt: HDF5_DOXYGEN_DIR and add_subdirectory path
- Update CMakeInstallation.cmake: all install paths for moved files
- Update bin/make_vers: hardcoded doxygen/ path substitution
- Update doc/doxygen/CMakeLists.txt: EXAMPLES_DIRECTORY and comments
- Update README.md, CONTRIBUTING.md, SECURITY.md, config/README.md,
release_docs/RELEASE_PROCESS.md: links to moved files
- Update doxygen .dox files: release_docs/ URLs for moved guides
- Rewrite release_docs/README.md for narrowed scope
* Add HDF5_DOCS_DIR variable for doc/ root path
Introduce HDF5_DOCS_DIR = \${HDF5_SOURCE_DIR}/doc so that
CMakeInstallation.cmake and future callers reference the doc/
directory symbolically rather than by hardcoded path.
HDF5_DOXYGEN_DIR is now derived from HDF5_DOCS_DIR.
vchoi-hdfgroup
Neil Fortner
jhendersonHDF
bmribler
Mark Kittisopikul
Chuck AtkinsandLarry Knox
Scot Breitenfeld
Kazuyoshi FurutakaandKazuyoshi Furutaka
Orion Poplawski