diff -Nru shibboleth-sp-3.3.0+dfsg1/adfs/Makefile.in shibboleth-sp-3.4.1+dfsg/adfs/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/adfs/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/adfs/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -311,6 +311,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/apache/Makefile.in shibboleth-sp-3.4.1+dfsg/apache/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/apache/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/apache/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -357,6 +357,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/apache/mod_shib.cpp shibboleth-sp-3.4.1+dfsg/apache/mod_shib.cpp
--- shibboleth-sp-3.3.0+dfsg1/apache/mod_shib.cpp	2021-11-01 17:43:34.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/apache/mod_shib.cpp	2022-07-18 16:24:36.000000000 +0000
@@ -1983,10 +1983,10 @@
     // Initialize runtime components.
 
     ap_log_error(APLOG_MARK, APLOG_INFO|APLOG_NOERRNO, SH_AP_R(s), "child_init: mod_shib initializing in pid (%d)", (int)getpid());
-    ap_log_error(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, SH_AP_R(s), "DEPRECATED: Apache 1.3 module, please upgrade to Apache 2.4+");
 
     // 2.x versions have already initialized the libraries.
 #ifdef SHIB_APACHE_13
+    ap_log_error(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, SH_AP_R(s), "DEPRECATED: Apache 1.3 module, please upgrade to Apache 2.4+");
     if (g_Config) {
         ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, SH_AP_R(s), "child_init: mod_shib already initialized, exiting");
         exit(1);
diff -Nru shibboleth-sp-3.3.0+dfsg1/build-aux/ltmain.sh shibboleth-sp-3.4.1+dfsg/build-aux/ltmain.sh
--- shibboleth-sp-3.3.0+dfsg1/build-aux/ltmain.sh	2021-11-29 13:44:25.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/build-aux/ltmain.sh	2022-10-24 13:49:04.000000000 +0000
@@ -1,12 +1,12 @@
-#! /bin/sh
+#! /usr/bin/env sh
 ## DO NOT EDIT - This file generated from ./build-aux/ltmain.in
-##               by inline-source v2014-01-03.01
+##               by inline-source v2019-02-19.15
 
-# libtool (GNU libtool) 2.4.6
+# libtool (GNU libtool) 2.4.7
 # Provide generalized library-building support services.
 # Written by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996
 
-# Copyright (C) 1996-2015 Free Software Foundation, Inc.
+# Copyright (C) 1996-2019, 2021-2022 Free Software Foundation, Inc.
 # This is free software; see the source for copying conditions.  There is NO
 # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 
@@ -31,8 +31,8 @@
 
 PROGRAM=libtool
 PACKAGE=libtool
-VERSION=2.4.6
-package_revision=2.4.6
+VERSION=2.4.7
+package_revision=2.4.7
 
 
 ## ------ ##
@@ -64,34 +64,25 @@
 # libraries, which are installed to $pkgauxdir.
 
 # Set a version string for this script.
-scriptversion=2015-01-20.17; # UTC
+scriptversion=2019-02-19.15; # UTC
 
 # General shell script boiler plate, and helper functions.
 # Written by Gary V. Vaughan, 2004
 
-# Copyright (C) 2004-2015 Free Software Foundation, Inc.
-# This is free software; see the source for copying conditions.  There is NO
-# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-
-# As a special exception to the GNU General Public License, if you distribute
-# this file as part of a program or library that is built using GNU Libtool,
-# you may include this file under the same distribution terms that you use
-# for the rest of that program.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNES FOR A PARTICULAR PURPOSE. See the GNU
-# General Public License for more details.
-
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
+# This is free software.  There is NO warranty; not even for
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+#
+# Copyright (C) 2004-2019, 2021 Bootstrap Authors
+#
+# This file is dual licensed under the terms of the MIT license
+# <https://opensource.org/license/MIT>, and GPL version 2 or later
+# <http://www.gnu.org/licenses/gpl-2.0.html>.  You must apply one of
+# these licenses when using or redistributing this software or any of
+# the files within it.  See the URLs above, or the file `LICENSE`
+# included in the Bootstrap distribution for the full license texts.
 
-# Please report bugs or propose patches to gary@gnu.org.
+# Please report bugs or propose patches to:
+# <https://github.com/gnulib-modules/bootstrap/issues>
 
 
 ## ------ ##
@@ -139,9 +130,12 @@
 	  _G_safe_locale=\"$_G_var=C; \$_G_safe_locale\"
 	fi"
 done
-
-# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
+# These NLS vars are set unconditionally (bootstrap issue #24).  Unset those
+# in case the environment reset is needed later and the $save_* variant is not
+# defined (see the code above).
+LC_ALL=C
+LANGUAGE=C
+export LANGUAGE LC_ALL
 
 # Make sure IFS has a sensible default
 sp=' '
@@ -159,6 +153,26 @@
 fi
 
 
+# func_unset VAR
+# --------------
+# Portably unset VAR.
+# In some shells, an 'unset VAR' statement leaves a non-zero return
+# status if VAR is already unset, which might be problematic if the
+# statement is used at the end of a function (thus poisoning its return
+# value) or when 'set -e' is active (causing even a spurious abort of
+# the script in this case).
+func_unset ()
+{
+    { eval $1=; (eval unset $1) >/dev/null 2>&1 && eval unset $1 || : ; }
+}
+
+
+# Make sure CDPATH doesn't cause `cd` commands to output the target dir.
+func_unset CDPATH
+
+# Make sure ${,E,F}GREP behave sanely.
+func_unset GREP_OPTIONS
+
 
 ## ------------------------- ##
 ## Locate command utilities. ##
@@ -259,7 +273,7 @@
     rm -f conftest.in conftest.tmp conftest.nl conftest.out
   }
 
-  func_path_progs "sed gsed" func_check_prog_sed $PATH:/usr/xpg4/bin
+  func_path_progs "sed gsed" func_check_prog_sed "$PATH:/usr/xpg4/bin"
   rm -f conftest.sed
   SED=$func_path_progs_result
 }
@@ -295,7 +309,7 @@
     rm -f conftest.in conftest.tmp conftest.nl conftest.out
   }
 
-  func_path_progs "grep ggrep" func_check_prog_grep $PATH:/usr/xpg4/bin
+  func_path_progs "grep ggrep" func_check_prog_grep "$PATH:/usr/xpg4/bin"
   GREP=$func_path_progs_result
 }
 
@@ -360,6 +374,35 @@
   s/\\([^$_G_bs]\\)$_G_bs2$_G_dollar/\\1$_G_bs2$_G_bs$_G_dollar/g
   s/\n//g"
 
+# require_check_ifs_backslash
+# ---------------------------
+# Check if we can use backslash as IFS='\' separator, and set
+# $check_ifs_backshlash_broken to ':' or 'false'.
+require_check_ifs_backslash=func_require_check_ifs_backslash
+func_require_check_ifs_backslash ()
+{
+  _G_save_IFS=$IFS
+  IFS='\'
+  _G_check_ifs_backshlash='a\\b'
+  for _G_i in $_G_check_ifs_backshlash
+  do
+  case $_G_i in
+  a)
+    check_ifs_backshlash_broken=false
+    ;;
+  '')
+    break
+    ;;
+  *)
+    check_ifs_backshlash_broken=:
+    break
+    ;;
+  esac
+  done
+  IFS=$_G_save_IFS
+  require_check_ifs_backslash=:
+}
+
 
 ## ----------------- ##
 ## Global variables. ##
@@ -580,16 +623,16 @@
   {
     $debug_cmd
 
-    func_quote_for_eval "$2"
-    eval "$1+=\\ \$func_quote_for_eval_result"
+    func_quote_arg pretty "$2"
+    eval "$1+=\\ \$func_quote_arg_result"
   }'
 else
   func_append_quoted ()
   {
     $debug_cmd
 
-    func_quote_for_eval "$2"
-    eval "$1=\$$1\\ \$func_quote_for_eval_result"
+    func_quote_arg pretty "$2"
+    eval "$1=\$$1\\ \$func_quote_arg_result"
   }
 fi
 
@@ -1091,85 +1134,203 @@
 }
 
 
-# func_quote_for_eval ARG...
-# --------------------------
-# Aesthetically quote ARGs to be evaled later.
-# This function returns two values:
-#   i) func_quote_for_eval_result
-#      double-quoted, suitable for a subsequent eval
-#  ii) func_quote_for_eval_unquoted_result
-#      has all characters that are still active within double
-#      quotes backslashified.
-func_quote_for_eval ()
+# func_quote_portable EVAL ARG
+# ----------------------------
+# Internal function to portably implement func_quote_arg.  Note that we still
+# keep attention to performance here so we as much as possible try to avoid
+# calling sed binary (so far O(N) complexity as long as func_append is O(1)).
+func_quote_portable ()
 {
     $debug_cmd
 
-    func_quote_for_eval_unquoted_result=
-    func_quote_for_eval_result=
-    while test 0 -lt $#; do
-      case $1 in
-        *[\\\`\"\$]*)
-	  _G_unquoted_arg=`printf '%s\n' "$1" |$SED "$sed_quote_subst"` ;;
-        *)
-          _G_unquoted_arg=$1 ;;
-      esac
-      if test -n "$func_quote_for_eval_unquoted_result"; then
-	func_append func_quote_for_eval_unquoted_result " $_G_unquoted_arg"
-      else
-        func_append func_quote_for_eval_unquoted_result "$_G_unquoted_arg"
+    $require_check_ifs_backslash
+
+    func_quote_portable_result=$2
+
+    # one-time-loop (easy break)
+    while true
+    do
+      if $1; then
+        func_quote_portable_result=`$ECHO "$2" | $SED \
+          -e "$sed_double_quote_subst" -e "$sed_double_backslash"`
+        break
       fi
 
-      case $_G_unquoted_arg in
-        # Double-quote args containing shell metacharacters to delay
-        # word splitting, command substitution and variable expansion
-        # for a subsequent eval.
-        # Many Bourne shells cannot handle close brackets correctly
-        # in scan sets, so we specify it separately.
-        *[\[\~\#\^\&\*\(\)\{\}\|\;\<\>\?\'\ \	]*|*]*|"")
-          _G_quoted_arg=\"$_G_unquoted_arg\"
+      # Quote for eval.
+      case $func_quote_portable_result in
+        *[\\\`\"\$]*)
+          # Fallback to sed for $func_check_bs_ifs_broken=:, or when the string
+          # contains the shell wildcard characters.
+          case $check_ifs_backshlash_broken$func_quote_portable_result in
+            :*|*[\[\*\?]*)
+              func_quote_portable_result=`$ECHO "$func_quote_portable_result" \
+                  | $SED "$sed_quote_subst"`
+              break
+              ;;
+          esac
+
+          func_quote_portable_old_IFS=$IFS
+          for _G_char in '\' '`' '"' '$'
+          do
+            # STATE($1) PREV($2) SEPARATOR($3)
+            set start "" ""
+            func_quote_portable_result=dummy"$_G_char$func_quote_portable_result$_G_char"dummy
+            IFS=$_G_char
+            for _G_part in $func_quote_portable_result
+            do
+              case $1 in
+              quote)
+                func_append func_quote_portable_result "$3$2"
+                set quote "$_G_part" "\\$_G_char"
+                ;;
+              start)
+                set first "" ""
+                func_quote_portable_result=
+                ;;
+              first)
+                set quote "$_G_part" ""
+                ;;
+              esac
+            done
+          done
+          IFS=$func_quote_portable_old_IFS
           ;;
-        *)
-          _G_quoted_arg=$_G_unquoted_arg
-	  ;;
+        *) ;;
       esac
-
-      if test -n "$func_quote_for_eval_result"; then
-	func_append func_quote_for_eval_result " $_G_quoted_arg"
-      else
-        func_append func_quote_for_eval_result "$_G_quoted_arg"
-      fi
-      shift
+      break
     done
+
+    func_quote_portable_unquoted_result=$func_quote_portable_result
+    case $func_quote_portable_result in
+      # double-quote args containing shell metacharacters to delay
+      # word splitting, command substitution and variable expansion
+      # for a subsequent eval.
+      # many bourne shells cannot handle close brackets correctly
+      # in scan sets, so we specify it separately.
+      *[\[\~\#\^\&\*\(\)\{\}\|\;\<\>\?\'\ \	]*|*]*|"")
+        func_quote_portable_result=\"$func_quote_portable_result\"
+        ;;
+    esac
 }
 
 
-# func_quote_for_expand ARG
-# -------------------------
-# Aesthetically quote ARG to be evaled later; same as above,
-# but do not quote variable references.
-func_quote_for_expand ()
-{
-    $debug_cmd
+# func_quotefast_eval ARG
+# -----------------------
+# Quote one ARG (internal).  This is equivalent to 'func_quote_arg eval ARG',
+# but optimized for speed.  Result is stored in $func_quotefast_eval.
+if test xyes = `(x=; printf -v x %q yes; echo x"$x") 2>/dev/null`; then
+  printf -v _GL_test_printf_tilde %q '~'
+  if test '\~' = "$_GL_test_printf_tilde"; then
+    func_quotefast_eval ()
+    {
+      printf -v func_quotefast_eval_result %q "$1"
+    }
+  else
+    # Broken older Bash implementations.  Make those faster too if possible.
+    func_quotefast_eval ()
+    {
+      case $1 in
+        '~'*)
+          func_quote_portable false "$1"
+          func_quotefast_eval_result=$func_quote_portable_result
+          ;;
+        *)
+          printf -v func_quotefast_eval_result %q "$1"
+          ;;
+      esac
+    }
+  fi
+else
+  func_quotefast_eval ()
+  {
+    func_quote_portable false "$1"
+    func_quotefast_eval_result=$func_quote_portable_result
+  }
+fi
 
-    case $1 in
-      *[\\\`\"]*)
-	_G_arg=`$ECHO "$1" | $SED \
-	    -e "$sed_double_quote_subst" -e "$sed_double_backslash"` ;;
-      *)
-        _G_arg=$1 ;;
+
+# func_quote_arg MODEs ARG
+# ------------------------
+# Quote one ARG to be evaled later.  MODEs argument may contain zero or more
+# specifiers listed below separated by ',' character.  This function returns two
+# values:
+#   i) func_quote_arg_result
+#      double-quoted (when needed), suitable for a subsequent eval
+#  ii) func_quote_arg_unquoted_result
+#      has all characters that are still active within double
+#      quotes backslashified.  Available only if 'unquoted' is specified.
+#
+# Available modes:
+# ----------------
+# 'eval' (default)
+#       - escape shell special characters
+# 'expand'
+#       - the same as 'eval';  but do not quote variable references
+# 'pretty'
+#       - request aesthetic output, i.e. '"a b"' instead of 'a\ b'.  This might
+#         be used later in func_quote to get output like: 'echo "a b"' instead
+#         of 'echo a\ b'.  This is slower than default on some shells.
+# 'unquoted'
+#       - produce also $func_quote_arg_unquoted_result which does not contain
+#         wrapping double-quotes.
+#
+# Examples for 'func_quote_arg pretty,unquoted string':
+#
+#   string      | *_result              | *_unquoted_result
+#   ------------+-----------------------+-------------------
+#   "           | \"                    | \"
+#   a b         | "a b"                 | a b
+#   "a b"       | "\"a b\""             | \"a b\"
+#   *           | "*"                   | *
+#   z="${x-$y}" | "z=\"\${x-\$y}\""     | z=\"\${x-\$y}\"
+#
+# Examples for 'func_quote_arg pretty,unquoted,expand string':
+#
+#   string        |   *_result          |  *_unquoted_result
+#   --------------+---------------------+--------------------
+#   z="${x-$y}"   | "z=\"${x-$y}\""     | z=\"${x-$y}\"
+func_quote_arg ()
+{
+    _G_quote_expand=false
+    case ,$1, in
+      *,expand,*)
+        _G_quote_expand=:
+        ;;
     esac
 
-    case $_G_arg in
-      # Double-quote args containing shell metacharacters to delay
-      # word splitting and command substitution for a subsequent eval.
-      # Many Bourne shells cannot handle close brackets correctly
-      # in scan sets, so we specify it separately.
-      *[\[\~\#\^\&\*\(\)\{\}\|\;\<\>\?\'\ \	]*|*]*|"")
-        _G_arg=\"$_G_arg\"
+    case ,$1, in
+      *,pretty,*|*,expand,*|*,unquoted,*)
+        func_quote_portable $_G_quote_expand "$2"
+        func_quote_arg_result=$func_quote_portable_result
+        func_quote_arg_unquoted_result=$func_quote_portable_unquoted_result
+        ;;
+      *)
+        # Faster quote-for-eval for some shells.
+        func_quotefast_eval "$2"
+        func_quote_arg_result=$func_quotefast_eval_result
         ;;
     esac
+}
 
-    func_quote_for_expand_result=$_G_arg
+
+# func_quote MODEs ARGs...
+# ------------------------
+# Quote all ARGs to be evaled later and join them into single command.  See
+# func_quote_arg's description for more info.
+func_quote ()
+{
+    $debug_cmd
+    _G_func_quote_mode=$1 ; shift
+    func_quote_result=
+    while test 0 -lt $#; do
+      func_quote_arg "$_G_func_quote_mode" "$1"
+      if test -n "$func_quote_result"; then
+        func_append func_quote_result " $func_quote_arg_result"
+      else
+        func_append func_quote_result "$func_quote_arg_result"
+      fi
+      shift
+    done
 }
 
 
@@ -1215,8 +1376,8 @@
     _G_cmd=$1
     _G_fail_exp=${2-':'}
 
-    func_quote_for_expand "$_G_cmd"
-    eval "func_notquiet $func_quote_for_expand_result"
+    func_quote_arg pretty,expand "$_G_cmd"
+    eval "func_notquiet $func_quote_arg_result"
 
     $opt_dry_run || {
       eval "$_G_cmd"
@@ -1241,8 +1402,8 @@
     _G_fail_exp=${2-':'}
 
     $opt_quiet || {
-      func_quote_for_expand "$_G_cmd"
-      eval "func_echo $func_quote_for_expand_result"
+      func_quote_arg expand,pretty "$_G_cmd"
+      eval "func_echo $func_quote_arg_result"
     }
 
     $opt_dry_run || {
@@ -1369,30 +1530,26 @@
 # End:
 #! /bin/sh
 
-# Set a version string for this script.
-scriptversion=2014-01-07.03; # UTC
-
 # A portable, pluggable option parser for Bourne shell.
 # Written by Gary V. Vaughan, 2010
 
-# Copyright (C) 2010-2015 Free Software Foundation, Inc.
-# This is free software; see the source for copying conditions.  There is NO
-# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
+# This is free software.  There is NO warranty; not even for
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+#
+# Copyright (C) 2010-2019, 2021 Bootstrap Authors
+#
+# This file is dual licensed under the terms of the MIT license
+# <https://opensource.org/license/MIT>, and GPL version 2 or later
+# <http://www.gnu.org/licenses/gpl-2.0.html>.  You must apply one of
+# these licenses when using or redistributing this software or any of
+# the files within it.  See the URLs above, or the file `LICENSE`
+# included in the Bootstrap distribution for the full license texts.
 
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# Please report bugs or propose patches to:
+# <https://github.com/gnulib-modules/bootstrap/issues>
 
-# Please report bugs or propose patches to gary@gnu.org.
+# Set a version string for this script.
+scriptversion=2019-02-19.15; # UTC
 
 
 ## ------ ##
@@ -1415,7 +1572,7 @@
 #
 # In order for the '--version' option to work, you will need to have a
 # suitably formatted comment like the one at the top of this file
-# starting with '# Written by ' and ending with '# warranty; '.
+# starting with '# Written by ' and ending with '# Copyright'.
 #
 # For '-h' and '--help' to work, you will also need a one line
 # description of your script's purpose in a comment directly above the
@@ -1427,7 +1584,7 @@
 # to display verbose messages only when your user has specified
 # '--verbose'.
 #
-# After sourcing this file, you can plug processing for additional
+# After sourcing this file, you can plug in processing for additional
 # options by amending the variables from the 'Configuration' section
 # below, and following the instructions in the 'Option parsing'
 # section further down.
@@ -1476,8 +1633,8 @@
 ## ------------------------- ##
 
 # This section contains functions for adding, removing, and running hooks
-# to the main code.  A hook is just a named list of of function, that can
-# be run in order later on.
+# in the main code.  A hook is just a list of function names that can be
+# run in order later on.
 
 # func_hookable FUNC_NAME
 # -----------------------
@@ -1510,7 +1667,8 @@
 
 # func_remove_hook FUNC_NAME HOOK_FUNC
 # ------------------------------------
-# Remove HOOK_FUNC from the list of functions called by FUNC_NAME.
+# Remove HOOK_FUNC from the list of hook functions to be called by
+# FUNC_NAME.
 func_remove_hook ()
 {
     $debug_cmd
@@ -1519,10 +1677,28 @@
 }
 
 
+# func_propagate_result FUNC_NAME_A FUNC_NAME_B
+# ---------------------------------------------
+# If the *_result variable of FUNC_NAME_A _is set_, assign its value to
+# *_result variable of FUNC_NAME_B.
+func_propagate_result ()
+{
+    $debug_cmd
+
+    func_propagate_result_result=:
+    if eval "test \"\${${1}_result+set}\" = set"
+    then
+      eval "${2}_result=\$${1}_result"
+    else
+      func_propagate_result_result=false
+    fi
+}
+
+
 # func_run_hooks FUNC_NAME [ARG]...
 # ---------------------------------
 # Run all hook functions registered to FUNC_NAME.
-# It is assumed that the list of hook functions contains nothing more
+# It's assumed that the list of hook functions contains nothing more
 # than a whitespace-delimited list of legal shell function names, and
 # no effort is wasted trying to catch shell meta-characters or preserve
 # whitespace.
@@ -1532,22 +1708,19 @@
 
     case " $hookable_fns " in
       *" $1 "*) ;;
-      *) func_fatal_error "'$1' does not support hook funcions.n" ;;
+      *) func_fatal_error "'$1' does not support hook functions." ;;
     esac
 
     eval _G_hook_fns=\$$1_hooks; shift
 
     for _G_hook in $_G_hook_fns; do
-      eval $_G_hook '"$@"'
-
-      # store returned options list back into positional
-      # parameters for next 'cmd' execution.
-      eval _G_hook_result=\$${_G_hook}_result
-      eval set dummy "$_G_hook_result"; shift
+      func_unset "${_G_hook}_result"
+      eval $_G_hook '${1+"$@"}'
+      func_propagate_result $_G_hook func_run_hooks
+      if $func_propagate_result_result; then
+        eval set dummy "$func_run_hooks_result"; shift
+      fi
     done
-
-    func_quote_for_eval ${1+"$@"}
-    func_run_hooks_result=$func_quote_for_eval_result
 }
 
 
@@ -1557,10 +1730,18 @@
 ## --------------- ##
 
 # In order to add your own option parsing hooks, you must accept the
-# full positional parameter list in your hook function, remove any
-# options that you action, and then pass back the remaining unprocessed
-# options in '<hooked_function_name>_result', escaped suitably for
-# 'eval'.  Like this:
+# full positional parameter list from your hook function.  You may remove
+# or edit any options that you action, and then pass back the remaining
+# unprocessed options in '<hooked_function_name>_result', escaped
+# suitably for 'eval'.
+#
+# The '<hooked_function_name>_result' variable is automatically unset
+# before your hook gets called; for best performance, only set the
+# *_result variable when necessary (i.e. don't call the 'func_quote'
+# function unnecessarily because it can be an expensive operation on some
+# machines).
+#
+# Like this:
 #
 #    my_options_prep ()
 #    {
@@ -1570,9 +1751,8 @@
 #        usage_message=$usage_message'
 #      -s, --silent       don'\''t print informational messages
 #    '
-#
-#        func_quote_for_eval ${1+"$@"}
-#        my_options_prep_result=$func_quote_for_eval_result
+#        # No change in '$@' (ignored completely by this hook).  Leave
+#        # my_options_prep_result variable intact.
 #    }
 #    func_add_hook func_options_prep my_options_prep
 #
@@ -1581,25 +1761,36 @@
 #    {
 #        $debug_cmd
 #
-#        # Note that for efficiency, we parse as many options as we can
+#        args_changed=false
+#
+#        # Note that, for efficiency, we parse as many options as we can
 #        # recognise in a loop before passing the remainder back to the
 #        # caller on the first unrecognised argument we encounter.
 #        while test $# -gt 0; do
 #          opt=$1; shift
 #          case $opt in
-#            --silent|-s) opt_silent=: ;;
+#            --silent|-s) opt_silent=:
+#                         args_changed=:
+#                         ;;
 #            # Separate non-argument short options:
 #            -s*)         func_split_short_opt "$_G_opt"
 #                         set dummy "$func_split_short_opt_name" \
 #                             "-$func_split_short_opt_arg" ${1+"$@"}
 #                         shift
+#                         args_changed=:
 #                         ;;
-#            *)            set dummy "$_G_opt" "$*"; shift; break ;;
+#            *)           # Make sure the first unrecognised option "$_G_opt"
+#                         # is added back to "$@" in case we need it later,
+#                         # if $args_changed was set to 'true'.
+#                         set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
 #          esac
 #        done
 #
-#        func_quote_for_eval ${1+"$@"}
-#        my_silent_option_result=$func_quote_for_eval_result
+#        # Only call 'func_quote' here if we processed at least one argument.
+#        if $args_changed; then
+#          func_quote eval ${1+"$@"}
+#          my_silent_option_result=$func_quote_result
+#        fi
 #    }
 #    func_add_hook func_parse_options my_silent_option
 #
@@ -1610,17 +1801,26 @@
 #
 #        $opt_silent && $opt_verbose && func_fatal_help "\
 #    '--silent' and '--verbose' options are mutually exclusive."
-#
-#        func_quote_for_eval ${1+"$@"}
-#        my_option_validation_result=$func_quote_for_eval_result
 #    }
 #    func_add_hook func_validate_options my_option_validation
 #
-# You'll alse need to manually amend $usage_message to reflect the extra
+# You'll also need to manually amend $usage_message to reflect the extra
 # options you parse.  It's preferable to append if you can, so that
 # multiple option parsing hooks can be added safely.
 
 
+# func_options_finish [ARG]...
+# ----------------------------
+# Finishing the option parse loop (call 'func_options' hooks ATM).
+func_options_finish ()
+{
+    $debug_cmd
+
+    func_run_hooks func_options ${1+"$@"}
+    func_propagate_result func_run_hooks func_options_finish
+}
+
+
 # func_options [ARG]...
 # ---------------------
 # All the functions called inside func_options are hookable. See the
@@ -1630,17 +1830,27 @@
 {
     $debug_cmd
 
-    func_options_prep ${1+"$@"}
-    eval func_parse_options \
-        ${func_options_prep_result+"$func_options_prep_result"}
-    eval func_validate_options \
-        ${func_parse_options_result+"$func_parse_options_result"}
+    _G_options_quoted=false
 
-    eval func_run_hooks func_options \
-        ${func_validate_options_result+"$func_validate_options_result"}
+    for my_func in options_prep parse_options validate_options options_finish
+    do
+      func_unset func_${my_func}_result
+      func_unset func_run_hooks_result
+      eval func_$my_func '${1+"$@"}'
+      func_propagate_result func_$my_func func_options
+      if $func_propagate_result_result; then
+        eval set dummy "$func_options_result"; shift
+        _G_options_quoted=:
+      fi
+    done
 
-    # save modified positional parameters for caller
-    func_options_result=$func_run_hooks_result
+    $_G_options_quoted || {
+      # As we (func_options) are top-level options-parser function and
+      # nobody quoted "$@" for us yet, we need to do it explicitly for
+      # caller.
+      func_quote eval ${1+"$@"}
+      func_options_result=$func_quote_result
+    }
 }
 
 
@@ -1649,9 +1859,8 @@
 # All initialisations required before starting the option parse loop.
 # Note that when calling hook functions, we pass through the list of
 # positional parameters.  If a hook function modifies that list, and
-# needs to propogate that back to rest of this script, then the complete
-# modified list must be put in 'func_run_hooks_result' before
-# returning.
+# needs to propagate that back to rest of this script, then the complete
+# modified list must be put in 'func_run_hooks_result' before returning.
 func_hookable func_options_prep
 func_options_prep ()
 {
@@ -1662,9 +1871,7 @@
     opt_warning_types=
 
     func_run_hooks func_options_prep ${1+"$@"}
-
-    # save modified positional parameters for caller
-    func_options_prep_result=$func_run_hooks_result
+    func_propagate_result func_run_hooks func_options_prep
 }
 
 
@@ -1676,25 +1883,32 @@
 {
     $debug_cmd
 
-    func_parse_options_result=
-
+    _G_parse_options_requote=false
     # this just eases exit handling
     while test $# -gt 0; do
       # Defer to hook functions for initial option parsing, so they
       # get priority in the event of reusing an option name.
       func_run_hooks func_parse_options ${1+"$@"}
-
-      # Adjust func_parse_options positional parameters to match
-      eval set dummy "$func_run_hooks_result"; shift
+      func_propagate_result func_run_hooks func_parse_options
+      if $func_propagate_result_result; then
+        eval set dummy "$func_parse_options_result"; shift
+        # Even though we may have changed "$@", we passed the "$@" array
+        # down into the hook and it quoted it for us (because we are in
+        # this if-branch).  No need to quote it again.
+        _G_parse_options_requote=false
+      fi
 
       # Break out of the loop if we already parsed every option.
       test $# -gt 0 || break
 
+      # We expect that one of the options parsed in this function matches
+      # and thus we remove _G_opt from "$@" and need to re-quote.
+      _G_match_parse_options=:
       _G_opt=$1
       shift
       case $_G_opt in
         --debug|-x)   debug_cmd='set -x'
-                      func_echo "enabling shell trace mode"
+                      func_echo "enabling shell trace mode" >&2
                       $debug_cmd
                       ;;
 
@@ -1704,7 +1918,10 @@
 		      ;;
 
         --warnings|--warning|-W)
-                      test $# = 0 && func_missing_arg $_G_opt && break
+                      if test $# = 0 && func_missing_arg $_G_opt; then
+                        _G_parse_options_requote=:
+                        break
+                      fi
                       case " $warning_categories $1" in
                         *" $1 "*)
                           # trailing space prevents matching last $1 above
@@ -1757,15 +1974,24 @@
                       shift
                       ;;
 
-        --)           break ;;
+        --)           _G_parse_options_requote=: ; break ;;
         -*)           func_fatal_help "unrecognised option: '$_G_opt'" ;;
-        *)            set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
+        *)            set dummy "$_G_opt" ${1+"$@"}; shift
+                      _G_match_parse_options=false
+                      break
+                      ;;
       esac
+
+      if $_G_match_parse_options; then
+        _G_parse_options_requote=:
+      fi
     done
 
-    # save modified positional parameters for caller
-    func_quote_for_eval ${1+"$@"}
-    func_parse_options_result=$func_quote_for_eval_result
+    if $_G_parse_options_requote; then
+      # save modified positional parameters for caller
+      func_quote eval ${1+"$@"}
+      func_parse_options_result=$func_quote_result
+    fi
 }
 
 
@@ -1782,12 +2008,10 @@
     test -n "$opt_warning_types" || opt_warning_types=" $warning_categories"
 
     func_run_hooks func_validate_options ${1+"$@"}
+    func_propagate_result func_run_hooks func_validate_options
 
     # Bail if the options were screwed!
     $exit_cmd $EXIT_FAILURE
-
-    # save modified positional parameters for caller
-    func_validate_options_result=$func_run_hooks_result
 }
 
 
@@ -1843,8 +2067,8 @@
 
 # func_split_equals STRING
 # ------------------------
-# Set func_split_equals_lhs and func_split_equals_rhs shell variables after
-# splitting STRING at the '=' sign.
+# Set func_split_equals_lhs and func_split_equals_rhs shell variables
+# after splitting STRING at the '=' sign.
 test -z "$_G_HAVE_XSI_OPS" \
     && (eval 'x=a/b/c;
       test 5aa/bb/cc = "${#x}${x%%/*}${x%/*}${x#*/}${x##*/}"') 2>/dev/null \
@@ -1859,8 +2083,9 @@
 
       func_split_equals_lhs=${1%%=*}
       func_split_equals_rhs=${1#*=}
-      test "x$func_split_equals_lhs" = "x$1" \
-        && func_split_equals_rhs=
+      if test "x$func_split_equals_lhs" = "x$1"; then
+        func_split_equals_rhs=
+      fi
   }'
 else
   # ...otherwise fall back to using expr, which is often a shell builtin.
@@ -1870,7 +2095,7 @@
 
       func_split_equals_lhs=`expr "x$1" : 'x\([^=]*\)'`
       func_split_equals_rhs=
-      test "x$func_split_equals_lhs" = "x$1" \
+      test "x$func_split_equals_lhs=" = "x$1" \
         || func_split_equals_rhs=`expr "x$1" : 'x[^=]*=\(.*\)$'`
   }
 fi #func_split_equals
@@ -1896,7 +2121,7 @@
   {
       $debug_cmd
 
-      func_split_short_opt_name=`expr "x$1" : 'x-\(.\)'`
+      func_split_short_opt_name=`expr "x$1" : 'x\(-.\)'`
       func_split_short_opt_arg=`expr "x$1" : 'x-.\(.*\)$'`
   }
 fi #func_split_short_opt
@@ -1938,31 +2163,44 @@
 # func_version
 # ------------
 # Echo version message to standard output and exit.
+# The version message is extracted from the calling file's header
+# comments, with leading '# ' stripped:
+#   1. First display the progname and version
+#   2. Followed by the header comment line matching  /^# Written by /
+#   3. Then a blank line followed by the first following line matching
+#      /^# Copyright /
+#   4. Immediately followed by any lines between the previous matches,
+#      except lines preceding the intervening completely blank line.
+# For example, see the header comments of this file.
 func_version ()
 {
     $debug_cmd
 
     printf '%s\n' "$progname $scriptversion"
     $SED -n '
-        /(C)/!b go
-        :more
-        /\./!{
-          N
-          s|\n# | |
-          b more
-        }
-        :go
-        /^# Written by /,/# warranty; / {
-          s|^# ||
-          s|^# *$||
-          s|\((C)\)[ 0-9,-]*[ ,-]\([1-9][0-9]* \)|\1 \2|
-          p
+        /^# Written by /!b
+        s|^# ||; p; n
+
+        :fwd2blnk
+        /./ {
+          n
+          b fwd2blnk
         }
-        /^# Written by / {
-          s|^# ||
-          p
+        p; n
+
+        :holdwrnt
+        s|^# ||
+        s|^# *$||
+        /^Copyright /!{
+          /./H
+          n
+          b holdwrnt
         }
-        /^warranty; /q' < "$progpath"
+
+        s|\((C)\)[ 0-9,-]*[ ,-]\([1-9][0-9]* \)|\1 \2|
+        G
+        s|\(\n\)\n*|\1|g
+        p; q' < "$progpath"
 
     exit $?
 }
@@ -1972,12 +2210,12 @@
 # mode: shell-script
 # sh-indentation: 2
 # eval: (add-hook 'before-save-hook 'time-stamp)
-# time-stamp-pattern: "10/scriptversion=%:y-%02m-%02d.%02H; # UTC"
+# time-stamp-pattern: "30/scriptversion=%:y-%02m-%02d.%02H; # UTC"
 # time-stamp-time-zone: "UTC"
 # End:
 
 # Set a version string.
-scriptversion='(GNU libtool) 2.4.6'
+scriptversion='(GNU libtool) 2.4.7'
 
 
 # func_echo ARG...
@@ -2068,7 +2306,7 @@
        compiler:       $LTCC
        compiler flags: $LTCFLAGS
        linker:         $LD (gnu? $with_gnu_ld)
-       version:        $progname (GNU libtool) 2.4.6
+       version:        $progname (GNU libtool) 2.4.7
        automake:       `($AUTOMAKE --version) 2>/dev/null |$SED 1q`
        autoconf:       `($AUTOCONF --version) 2>/dev/null |$SED 1q`
 
@@ -2124,7 +2362,7 @@
 # a configuration failure hint, and exit.
 func_fatal_configuration ()
 {
-    func__fatal_error ${1+"$@"} \
+    func_fatal_error ${1+"$@"} \
       "See the $PACKAGE documentation for more information." \
       "Fatal configuration error."
 }
@@ -2270,6 +2508,8 @@
     nonopt=
     preserve_args=
 
+    _G_rc_lt_options_prep=:
+
     # Shorthand for --mode=foo, only valid as the first argument
     case $1 in
     clean|clea|cle|cl)
@@ -2293,11 +2533,16 @@
     uninstall|uninstal|uninsta|uninst|unins|unin|uni|un|u)
       shift; set dummy --mode uninstall ${1+"$@"}; shift
       ;;
+    *)
+      _G_rc_lt_options_prep=false
+      ;;
     esac
 
-    # Pass back the list of options.
-    func_quote_for_eval ${1+"$@"}
-    libtool_options_prep_result=$func_quote_for_eval_result
+    if $_G_rc_lt_options_prep; then
+      # Pass back the list of options.
+      func_quote eval ${1+"$@"}
+      libtool_options_prep_result=$func_quote_result
+    fi
 }
 func_add_hook func_options_prep libtool_options_prep
 
@@ -2309,9 +2554,12 @@
 {
     $debug_cmd
 
+    _G_rc_lt_parse_options=false
+
     # Perform our own loop to consume as many options as possible in
     # each iteration.
     while test $# -gt 0; do
+      _G_match_lt_parse_options=:
       _G_opt=$1
       shift
       case $_G_opt in
@@ -2386,15 +2634,20 @@
                         func_append preserve_args " $_G_opt"
                         ;;
 
-	# An option not handled by this hook function:
-        *)		set dummy "$_G_opt" ${1+"$@"};	shift; break  ;;
+        # An option not handled by this hook function:
+        *)              set dummy "$_G_opt" ${1+"$@"} ; shift
+                        _G_match_lt_parse_options=false
+                        break
+                        ;;
       esac
+      $_G_match_lt_parse_options && _G_rc_lt_parse_options=:
     done
 
-
-    # save modified positional parameters for caller
-    func_quote_for_eval ${1+"$@"}
-    libtool_parse_options_result=$func_quote_for_eval_result
+    if $_G_rc_lt_parse_options; then
+      # save modified positional parameters for caller
+      func_quote eval ${1+"$@"}
+      libtool_parse_options_result=$func_quote_result
+    fi
 }
 func_add_hook func_parse_options libtool_parse_options
 
@@ -2451,8 +2704,8 @@
     }
 
     # Pass back the unparsed argument list
-    func_quote_for_eval ${1+"$@"}
-    libtool_validate_options_result=$func_quote_for_eval_result
+    func_quote eval ${1+"$@"}
+    libtool_validate_options_result=$func_quote_result
 }
 func_add_hook func_validate_options libtool_validate_options
 
@@ -3418,8 +3671,8 @@
       esac
     done
 
-    func_quote_for_eval "$libobj"
-    test "X$libobj" != "X$func_quote_for_eval_result" \
+    func_quote_arg pretty "$libobj"
+    test "X$libobj" != "X$func_quote_arg_result" \
       && $ECHO "X$libobj" | $GREP '[]~#^*{};<>?"'"'"'	 &()|`$[]' \
       && func_warning "libobj name '$libobj' may not contain shell special characters."
     func_dirname_and_basename "$obj" "/" ""
@@ -3492,8 +3745,8 @@
 
     func_to_tool_file "$srcfile" func_convert_file_msys_to_w32
     srcfile=$func_to_tool_file_result
-    func_quote_for_eval "$srcfile"
-    qsrcfile=$func_quote_for_eval_result
+    func_quote_arg pretty "$srcfile"
+    qsrcfile=$func_quote_arg_result
 
     # Only build a PIC object if we are building libtool libraries.
     if test yes = "$build_libtool_libs"; then
@@ -3648,7 +3901,8 @@
   -prefer-non-pic   try to build non-PIC objects only
   -shared           do not build a '.o' file suitable for static linking
   -static           only build a '.o' file suitable for static linking
-  -Wc,FLAG          pass FLAG directly to the compiler
+  -Wc,FLAG
+  -Xcompiler FLAG   pass FLAG directly to the compiler
 
 COMPILE-COMMAND is a command to be used in creating a 'standard' object file
 from the given SOURCEFILE.
@@ -3754,6 +4008,8 @@
   -weak LIBNAME     declare that the target provides the LIBNAME interface
   -Wc,FLAG
   -Xcompiler FLAG   pass linker-specific FLAG directly to the compiler
+  -Wa,FLAG
+  -Xassembler FLAG  pass linker-specific FLAG directly to the assembler
   -Wl,FLAG
   -Xlinker FLAG     pass linker-specific FLAG directly to the linker
   -XCClinker FLAG   pass link-specific FLAG to the compiler driver (CC)
@@ -4096,8 +4352,8 @@
        case $nonopt in *shtool*) :;; *) false;; esac
     then
       # Aesthetically quote it.
-      func_quote_for_eval "$nonopt"
-      install_prog="$func_quote_for_eval_result "
+      func_quote_arg pretty "$nonopt"
+      install_prog="$func_quote_arg_result "
       arg=$1
       shift
     else
@@ -4107,8 +4363,8 @@
 
     # The real first argument should be the name of the installation program.
     # Aesthetically quote it.
-    func_quote_for_eval "$arg"
-    func_append install_prog "$func_quote_for_eval_result"
+    func_quote_arg pretty "$arg"
+    func_append install_prog "$func_quote_arg_result"
     install_shared_prog=$install_prog
     case " $install_prog " in
       *[\\\ /]cp\ *) install_cp=: ;;
@@ -4165,12 +4421,12 @@
       esac
 
       # Aesthetically quote the argument.
-      func_quote_for_eval "$arg"
-      func_append install_prog " $func_quote_for_eval_result"
+      func_quote_arg pretty "$arg"
+      func_append install_prog " $func_quote_arg_result"
       if test -n "$arg2"; then
-	func_quote_for_eval "$arg2"
+	func_quote_arg pretty "$arg2"
       fi
-      func_append install_shared_prog " $func_quote_for_eval_result"
+      func_append install_shared_prog " $func_quote_arg_result"
     done
 
     test -z "$install_prog" && \
@@ -4181,8 +4437,8 @@
 
     if test -n "$install_override_mode" && $no_mode; then
       if $install_cp; then :; else
-	func_quote_for_eval "$install_override_mode"
-	func_append install_shared_prog " -m $func_quote_for_eval_result"
+	func_quote_arg pretty "$install_override_mode"
+	func_append install_shared_prog " -m $func_quote_arg_result"
       fi
     fi
 
@@ -4478,8 +4734,8 @@
 	        relink_command=`$ECHO "$relink_command" | $SED 's%@OUTPUT@%'"$outputname"'%g'`
 
 	        $opt_quiet || {
-	          func_quote_for_expand "$relink_command"
-		  eval "func_echo $func_quote_for_expand_result"
+	          func_quote_arg expand,pretty "$relink_command"
+		  eval "func_echo $func_quote_arg_result"
 	        }
 	        if eval "$relink_command"; then :
 	          else
@@ -5258,7 +5514,8 @@
   if test \"\$libtool_execute_magic\" != \"$magic\"; then
     file=\"\$0\""
 
-    qECHO=`$ECHO "$ECHO" | $SED "$sed_quote_subst"`
+    func_quote_arg pretty "$ECHO"
+    qECHO=$func_quote_arg_result
     $ECHO "\
 
 # A function that is used when there is no print builtin or printf.
@@ -5268,7 +5525,7 @@
 \$1
 _LTECHO_EOF'
 }
-    ECHO=\"$qECHO\"
+    ECHO=$qECHO
   fi
 
 # Very basic option parsing. These options are (a) specific to
@@ -6611,9 +6868,9 @@
     while test "$#" -gt 0; do
       arg=$1
       shift
-      func_quote_for_eval "$arg"
-      qarg=$func_quote_for_eval_unquoted_result
-      func_append libtool_args " $func_quote_for_eval_result"
+      func_quote_arg pretty,unquoted "$arg"
+      qarg=$func_quote_arg_unquoted_result
+      func_append libtool_args " $func_quote_arg_result"
 
       # If the previous option needs an argument, assign it.
       if test -n "$prev"; then
@@ -6849,6 +7106,13 @@
 	  prev=
 	  continue
 	  ;;
+	xassembler)
+	  func_append compiler_flags " -Xassembler $qarg"
+	  prev=
+	  func_append compile_command " -Xassembler $qarg"
+	  func_append finalize_command " -Xassembler $qarg"
+	  continue
+	  ;;
 	xcclinker)
 	  func_append linker_flags " $qarg"
 	  func_append compiler_flags " $qarg"
@@ -7019,7 +7283,7 @@
 	    # These systems don't actually have a C library (as such)
 	    test X-lc = "X$arg" && continue
 	    ;;
-	  *-*-openbsd* | *-*-freebsd* | *-*-dragonfly* | *-*-bitrig*)
+	  *-*-openbsd* | *-*-freebsd* | *-*-dragonfly* | *-*-bitrig* | *-*-midnightbsd*)
 	    # Do not include libc due to us having libc/libc_r.
 	    test X-lc = "X$arg" && continue
 	    ;;
@@ -7039,7 +7303,7 @@
 	  esac
 	elif test X-lc_r = "X$arg"; then
 	 case $host in
-	 *-*-openbsd* | *-*-freebsd* | *-*-dragonfly* | *-*-bitrig*)
+	 *-*-openbsd* | *-*-freebsd* | *-*-dragonfly* | *-*-bitrig* | *-*-midnightbsd*)
 	   # Do not include libc_r directly, use -pthread flag.
 	   continue
 	   ;;
@@ -7069,8 +7333,20 @@
 	prev=xcompiler
 	continue
 	;;
-
-      -mt|-mthreads|-kthread|-Kthread|-pthread|-pthreads|--thread-safe \
+     # Solaris ld rejects as of 11.4. Refer to Oracle bug 22985199.
+     -pthread)
+	case $host in
+	  *solaris2*) ;;
+	  *)
+	    case "$new_inherited_linker_flags " in
+	        *" $arg "*) ;;
+	        * ) func_append new_inherited_linker_flags " $arg" ;;
+	    esac
+	  ;;
+	esac
+	continue
+	;;
+      -mt|-mthreads|-kthread|-Kthread|-pthreads|--thread-safe \
       |-threads|-fopenmp|-openmp|-mp|-xopenmp|-omp|-qsmp=*)
 	func_append compiler_flags " $arg"
 	func_append compile_command " $arg"
@@ -7211,9 +7487,9 @@
 	save_ifs=$IFS; IFS=,
 	for flag in $args; do
 	  IFS=$save_ifs
-          func_quote_for_eval "$flag"
-	  func_append arg " $func_quote_for_eval_result"
-	  func_append compiler_flags " $func_quote_for_eval_result"
+          func_quote_arg pretty "$flag"
+	  func_append arg " $func_quote_arg_result"
+	  func_append compiler_flags " $func_quote_arg_result"
 	done
 	IFS=$save_ifs
 	func_stripname ' ' '' "$arg"
@@ -7227,16 +7503,21 @@
 	save_ifs=$IFS; IFS=,
 	for flag in $args; do
 	  IFS=$save_ifs
-          func_quote_for_eval "$flag"
-	  func_append arg " $wl$func_quote_for_eval_result"
-	  func_append compiler_flags " $wl$func_quote_for_eval_result"
-	  func_append linker_flags " $func_quote_for_eval_result"
+          func_quote_arg pretty "$flag"
+	  func_append arg " $wl$func_quote_arg_result"
+	  func_append compiler_flags " $wl$func_quote_arg_result"
+	  func_append linker_flags " $func_quote_arg_result"
 	done
 	IFS=$save_ifs
 	func_stripname ' ' '' "$arg"
 	arg=$func_stripname_result
 	;;
 
+      -Xassembler)
+        prev=xassembler
+        continue
+        ;;
+
       -Xcompiler)
 	prev=xcompiler
 	continue
@@ -7254,8 +7535,8 @@
 
       # -msg_* for osf cc
       -msg_*)
-	func_quote_for_eval "$arg"
-	arg=$func_quote_for_eval_result
+	func_quote_arg pretty "$arg"
+	arg=$func_quote_arg_result
 	;;
 
       # Flags to be passed through unchanged, with rationale:
@@ -7272,14 +7553,17 @@
       # -tp=*                Portland pgcc target processor selection
       # --sysroot=*          for sysroot support
       # -O*, -g*, -flto*, -fwhopr*, -fuse-linker-plugin GCC link-time optimization
+      # -specs=*             GCC specs files
       # -stdlib=*            select c++ std lib with clang
-      # -fsanitize=*         Clang memory and address sanitizer
+      # -fsanitize=*         Clang/GCC memory and address sanitizer
+      # -fuse-ld=*           Linker select flags for GCC
+      # -Wa,*                Pass flags directly to the assembler
       -64|-mips[0-9]|-r[0-9][0-9]*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \
       -t[45]*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*|-tp=*|--sysroot=*| \
       -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*| \
-      -fsanitize=*)
-        func_quote_for_eval "$arg"
-	arg=$func_quote_for_eval_result
+      -specs=*|-fsanitize=*|-fuse-ld=*|-Wa,*)
+        func_quote_arg pretty "$arg"
+	arg=$func_quote_arg_result
         func_append compile_command " $arg"
         func_append finalize_command " $arg"
         func_append compiler_flags " $arg"
@@ -7300,15 +7584,15 @@
 	  continue
         else
 	  # Otherwise treat like 'Some other compiler flag' below
-	  func_quote_for_eval "$arg"
-	  arg=$func_quote_for_eval_result
+	  func_quote_arg pretty "$arg"
+	  arg=$func_quote_arg_result
         fi
 	;;
 
       # Some other compiler flag.
       -* | +*)
-        func_quote_for_eval "$arg"
-	arg=$func_quote_for_eval_result
+        func_quote_arg pretty "$arg"
+	arg=$func_quote_arg_result
 	;;
 
       *.$objext)
@@ -7428,8 +7712,8 @@
       *)
 	# Unknown arguments in both finalize_command and compile_command need
 	# to be aesthetically quoted because they are evaled later.
-	func_quote_for_eval "$arg"
-	arg=$func_quote_for_eval_result
+	func_quote_arg pretty "$arg"
+	arg=$func_quote_arg_result
 	;;
       esac # arg
 
@@ -8634,7 +8918,7 @@
       test CXX = "$tagname" && {
         case $host_os in
         linux*)
-          case `$CC -V 2>&1 | sed 5q` in
+          case `$CC -V 2>&1 | $SED 5q` in
           *Sun\ C*) # Sun C++ 5.9
             func_suncc_cstd_abi
 
@@ -8807,7 +9091,7 @@
 	  #
 	  case $version_type in
 	  # correct linux to gnu/linux during the next big refactor
-	  darwin|freebsd-elf|linux|osf|windows|none)
+	  darwin|freebsd-elf|linux|midnightbsd-elf|osf|windows|none)
 	    func_arith $number_major + $number_minor
 	    current=$func_arith_result
 	    age=$number_minor
@@ -8898,7 +9182,7 @@
 	  versuffix=.$current.$revision
 	  ;;
 
-	freebsd-elf)
+	freebsd-elf | midnightbsd-elf)
 	  func_arith $current - $age
 	  major=.$func_arith_result
 	  versuffix=$major.$age.$revision
@@ -9124,7 +9408,7 @@
 	  *-*-netbsd*)
 	    # Don't link with libc until the a.out ld.so is fixed.
 	    ;;
-	  *-*-openbsd* | *-*-freebsd* | *-*-dragonfly*)
+	  *-*-openbsd* | *-*-freebsd* | *-*-dragonfly* | *-*-midnightbsd*)
 	    # Do not include libc due to us having libc/libc_r.
 	    ;;
 	  *-*-sco3.2v5* | *-*-sco5v6*)
@@ -9935,8 +10219,8 @@
 	    for cmd in $concat_cmds; do
 	      IFS=$save_ifs
 	      $opt_quiet || {
-		  func_quote_for_expand "$cmd"
-		  eval "func_echo $func_quote_for_expand_result"
+		  func_quote_arg expand,pretty "$cmd"
+		  eval "func_echo $func_quote_arg_result"
 	      }
 	      $opt_dry_run || eval "$cmd" || {
 		lt_exit=$?
@@ -10029,8 +10313,8 @@
 	  eval cmd=\"$cmd\"
 	  IFS=$save_ifs
 	  $opt_quiet || {
-	    func_quote_for_expand "$cmd"
-	    eval "func_echo $func_quote_for_expand_result"
+	    func_quote_arg expand,pretty "$cmd"
+	    eval "func_echo $func_quote_arg_result"
 	  }
 	  $opt_dry_run || eval "$cmd" || {
 	    lt_exit=$?
@@ -10504,12 +10788,13 @@
 	  elif eval var_value=\$$var; test -z "$var_value"; then
 	    relink_command="$var=; export $var; $relink_command"
 	  else
-	    func_quote_for_eval "$var_value"
-	    relink_command="$var=$func_quote_for_eval_result; export $var; $relink_command"
+	    func_quote_arg pretty "$var_value"
+	    relink_command="$var=$func_quote_arg_result; export $var; $relink_command"
 	  fi
 	done
-	relink_command="(cd `pwd`; $relink_command)"
-	relink_command=`$ECHO "$relink_command" | $SED "$sed_quote_subst"`
+	func_quote eval cd "`pwd`"
+	func_quote_arg pretty,unquoted "($func_quote_result; $relink_command)"
+	relink_command=$func_quote_arg_unquoted_result
       fi
 
       # Only actually do things if not in dry run mode.
@@ -10749,13 +11034,15 @@
 	elif eval var_value=\$$var; test -z "$var_value"; then
 	  relink_command="$var=; export $var; $relink_command"
 	else
-	  func_quote_for_eval "$var_value"
-	  relink_command="$var=$func_quote_for_eval_result; export $var; $relink_command"
+	  func_quote_arg pretty,unquoted "$var_value"
+	  relink_command="$var=$func_quote_arg_unquoted_result; export $var; $relink_command"
 	fi
       done
       # Quote the link command for shipping.
-      relink_command="(cd `pwd`; $SHELL \"$progpath\" $preserve_args --mode=relink $libtool_args @inst_prefix_dir@)"
-      relink_command=`$ECHO "$relink_command" | $SED "$sed_quote_subst"`
+      func_quote eval cd "`pwd`"
+      relink_command="($func_quote_result; $SHELL \"$progpath\" $preserve_args --mode=relink $libtool_args @inst_prefix_dir@)"
+      func_quote_arg pretty,unquoted "$relink_command"
+      relink_command=$func_quote_arg_unquoted_result
       if test yes = "$hardcode_automatic"; then
 	relink_command=
       fi
diff -Nru shibboleth-sp-3.3.0+dfsg1/configs/Makefile.in shibboleth-sp-3.4.1+dfsg/configs/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/configs/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/configs/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -247,6 +247,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/configure shibboleth-sp-3.4.1+dfsg/configure
--- shibboleth-sp-3.3.0+dfsg1/configure	2021-11-29 13:44:28.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/configure	2023-01-09 21:52:07.000000000 +0000
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for shibboleth 3.3.0.
+# Generated by GNU Autoconf 2.71 for shibboleth 3.4.1.
 #
 # Report bugs to <https://shibboleth.atlassian.net/jira>.
 #
@@ -621,8 +621,8 @@
 # Identity of this package.
 PACKAGE_NAME='shibboleth'
 PACKAGE_TARNAME='shibboleth-sp'
-PACKAGE_VERSION='3.3.0'
-PACKAGE_STRING='shibboleth 3.3.0'
+PACKAGE_VERSION='3.4.1'
+PACKAGE_STRING='shibboleth 3.4.1'
 PACKAGE_BUGREPORT='https://shibboleth.atlassian.net/jira'
 PACKAGE_URL=''
 
@@ -771,6 +771,7 @@
 AR
 DLLTOOL
 OBJDUMP
+FILECMD
 LN_S
 NM
 ac_ct_DUMPBIN
@@ -1570,7 +1571,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures shibboleth 3.3.0 to adapt to many kinds of systems.
+\`configure' configures shibboleth 3.4.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1641,7 +1642,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of shibboleth 3.3.0:";;
+     short | recursive ) echo "Configuration of shibboleth 3.4.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1844,7 +1845,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-shibboleth configure 3.3.0
+shibboleth configure 3.4.1
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2469,7 +2470,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by shibboleth $as_me 3.3.0, which was
+It was created by shibboleth $as_me 3.4.1, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3957,7 +3958,7 @@
 
 # Define the identity of the package.
  PACKAGE='shibboleth-sp'
- VERSION='3.3.0'
+ VERSION='3.4.1'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -7599,8 +7600,8 @@
 
 
 
-macro_version='2.4.6'
-macro_revision='2.4.6'
+macro_version='2.4.7'
+macro_revision='2.4.7'
 
 
 
@@ -8228,13 +8229,13 @@
 	mingw*) lt_bad_file=conftest.nm/nofile ;;
 	*) lt_bad_file=/dev/null ;;
 	esac
-	case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in
+	case `"$tmp_nm" -B $lt_bad_file 2>&1 | $SED '1q'` in
 	*$lt_bad_file* | *'Invalid file or object type'*)
 	  lt_cv_path_NM="$tmp_nm -B"
 	  break 2
 	  ;;
 	*)
-	  case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in
+	  case `"$tmp_nm" -p /dev/null 2>&1 | $SED '1q'` in
 	  */dev/null*)
 	    lt_cv_path_NM="$tmp_nm -p"
 	    break 2
@@ -8372,7 +8373,7 @@
   fi
 fi
 
-    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in
+    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | $SED '1q'` in
     *COFF*)
       DUMPBIN="$DUMPBIN -symbols -headers"
       ;;
@@ -8476,7 +8477,7 @@
     lt_cv_sys_max_cmd_len=8192;
     ;;
 
-  bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*)
+  bitrig* | darwin* | dragonfly* | freebsd* | midnightbsd* | netbsd* | openbsd*)
     # This has been around since 386BSD, at least.  Likely further.
     if test -x /sbin/sysctl; then
       lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax`
@@ -8519,7 +8520,7 @@
   sysv5* | sco5v6* | sysv4.2uw2*)
     kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null`
     if test -n "$kargmax"; then
-      lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[	 ]//'`
+      lt_cv_sys_max_cmd_len=`echo $kargmax | $SED 's/.*[	 ]//'`
     else
       lt_cv_sys_max_cmd_len=32768
     fi
@@ -8725,6 +8726,114 @@
 
 
 if test -n "$ac_tool_prefix"; then
+  # Extract the first word of "${ac_tool_prefix}file", so it can be a program name with args.
+set dummy ${ac_tool_prefix}file; ac_word=$2
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_FILECMD+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if test -n "$FILECMD"; then
+  ac_cv_prog_FILECMD="$FILECMD" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_prog_FILECMD="${ac_tool_prefix}file"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+FILECMD=$ac_cv_prog_FILECMD
+if test -n "$FILECMD"; then
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $FILECMD" >&5
+printf "%s\n" "$FILECMD" >&6; }
+else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+fi
+
+
+fi
+if test -z "$ac_cv_prog_FILECMD"; then
+  ac_ct_FILECMD=$FILECMD
+  # Extract the first word of "file", so it can be a program name with args.
+set dummy file; ac_word=$2
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_FILECMD+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  if test -n "$ac_ct_FILECMD"; then
+  ac_cv_prog_ac_ct_FILECMD="$ac_ct_FILECMD" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  case $as_dir in #(((
+    '') as_dir=./ ;;
+    */) ;;
+    *) as_dir=$as_dir/ ;;
+  esac
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+    ac_cv_prog_ac_ct_FILECMD="file"
+    printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+ac_ct_FILECMD=$ac_cv_prog_ac_ct_FILECMD
+if test -n "$ac_ct_FILECMD"; then
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_FILECMD" >&5
+printf "%s\n" "$ac_ct_FILECMD" >&6; }
+else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+fi
+
+  if test "x$ac_ct_FILECMD" = x; then
+    FILECMD=":"
+  else
+    case $cross_compiling:$ac_tool_warned in
+yes:)
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ac_tool_warned=yes ;;
+esac
+    FILECMD=$ac_ct_FILECMD
+  fi
+else
+  FILECMD="$ac_cv_prog_FILECMD"
+fi
+
+
+
+
+
+
+
+if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}objdump", so it can be a program name with args.
 set dummy ${ac_tool_prefix}objdump; ac_word=$2
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
@@ -8867,7 +8976,7 @@
 
 bsdi[45]*)
   lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (shared object|dynamic lib)'
-  lt_cv_file_magic_cmd='/usr/bin/file -L'
+  lt_cv_file_magic_cmd='$FILECMD -L'
   lt_cv_file_magic_test_file=/shlib/libc.so
   ;;
 
@@ -8901,14 +9010,14 @@
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     case $host_cpu in
     i*86 )
       # Not sure whether the presence of OpenBSD here was a mistake.
       # Let's accept both of them until this is cleared up.
       lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[3-9]86 (compact )?demand paged shared library'
-      lt_cv_file_magic_cmd=/usr/bin/file
+      lt_cv_file_magic_cmd=$FILECMD
       lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
       ;;
     esac
@@ -8922,7 +9031,7 @@
   ;;
 
 hpux10.20* | hpux11*)
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
   case $host_cpu in
   ia64*)
     lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]|ELF-[0-9][0-9]) shared object file - IA64'
@@ -8969,7 +9078,7 @@
 
 newos6*)
   lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (executable|dynamic lib)'
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
   lt_cv_file_magic_test_file=/usr/lib/libnls.so
   ;;
 
@@ -9343,13 +9452,29 @@
 fi
 
 : ${AR=ar}
-: ${AR_FLAGS=cru}
 
 
 
 
 
 
+# Use ARFLAGS variable as AR's operation code to sync the variable naming with
+# Automake.  If both AR_FLAGS and ARFLAGS are specified, AR_FLAGS should have
+# higher priority because thats what people were doing historically (setting
+# ARFLAGS for automake and AR_FLAGS for libtool).  FIXME: Make the AR_FLAGS
+# variable obsoleted/removed.
+
+test ${AR_FLAGS+y} || AR_FLAGS=${ARFLAGS-cr}
+lt_ar_flags=$AR_FLAGS
+
+
+
+
+
+
+# Make AR_FLAGS overridable by 'make ARFLAGS='.  Don't try to run-time override
+# by AR_FLAGS because that was never working and AR_FLAGS is about to die.
+
 
 
 
@@ -9766,7 +9891,7 @@
 
 if test "$lt_cv_nm_interface" = "MS dumpbin"; then
   # Gets list of data symbols to import.
-  lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'"
+  lt_cv_sys_global_symbol_to_import="$SED -n -e 's/^I .* \(.*\)$/\1/p'"
   # Adjust the below global symbol transforms to fixup imported variables.
   lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'"
   lt_c_name_hook=" -e 's/^I .* \(.*\)$/  {\"\1\", (void *) 0},/p'"
@@ -9784,20 +9909,20 @@
 # Transform an extracted symbol line into a proper C declaration.
 # Some systems (esp. on ia64) link data and code symbols differently,
 # so use this general approach.
-lt_cv_sys_global_symbol_to_cdecl="sed -n"\
+lt_cv_sys_global_symbol_to_cdecl="$SED -n"\
 $lt_cdecl_hook\
 " -e 's/^T .* \(.*\)$/extern int \1();/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'"
 
 # Transform an extracted symbol line into symbol name and symbol address
-lt_cv_sys_global_symbol_to_c_name_address="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address="$SED -n"\
 $lt_c_name_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/  {\"\1\", (void *) \&\1},/p'"
 
 # Transform an extracted symbol line into symbol name with lib prefix and
 # symbol address.
-lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="$SED -n"\
 $lt_c_name_lib_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(lib.*\)$/  {\"\1\", (void *) \&\1},/p'"\
@@ -9821,7 +9946,7 @@
   if test "$lt_cv_nm_interface" = "MS dumpbin"; then
     # Fake it for dumpbin and say T for any non-static function,
     # D for any global variable and I for any imported variable.
-    # Also find C++ and __fastcall symbols from MSVC++,
+    # Also find C++ and __fastcall symbols from MSVC++ or ICC,
     # which start with @ or ?.
     lt_cv_sys_global_symbol_pipe="$AWK '"\
 "     {last_section=section; section=\$ 3};"\
@@ -9839,9 +9964,9 @@
 "     s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\
 "     ' prfx=^$ac_symprfx"
   else
-    lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[	 ]\($symcode$symcode*\)[	 ][	 ]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
+    lt_cv_sys_global_symbol_pipe="$SED -n -e 's/^.*[	 ]\($symcode$symcode*\)[	 ][	 ]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
   fi
-  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'"
+  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | $SED '/ __gnu_lto/d'"
 
   # Check to see that the pipe works correctly.
   pipe_works=no
@@ -10044,7 +10169,7 @@
    fi
    ;; #(
  /*)
-   lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"`
+   lt_sysroot=`echo "$with_sysroot" | $SED -e "$sed_quote_subst"`
    ;; #(
  no|'')
    ;; #(
@@ -10169,7 +10294,7 @@
   ac_status=$?
   printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *ELF-32*)
 	HPUX_IA64_MODE=32
 	;;
@@ -10190,7 +10315,7 @@
   printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
     if test yes = "$lt_cv_prog_gnu_ld"; then
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -melf32bsmip"
 	  ;;
@@ -10202,7 +10327,7 @@
 	;;
       esac
     else
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -32"
 	  ;;
@@ -10228,7 +10353,7 @@
   printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
     emul=elf
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *32-bit*)
 	emul="${emul}32"
 	;;
@@ -10236,7 +10361,7 @@
 	emul="${emul}64"
 	;;
     esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *MSB*)
 	emul="${emul}btsmip"
 	;;
@@ -10244,7 +10369,7 @@
 	emul="${emul}ltsmip"
 	;;
     esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *N32*)
 	emul="${emul}n32"
 	;;
@@ -10268,14 +10393,14 @@
   ac_status=$?
   printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
       *32-bit*)
 	case $host in
 	  x86_64-*kfreebsd*-gnu)
 	    LD="${LD-ld} -m elf_i386_fbsd"
 	    ;;
 	  x86_64-*linux*)
-	    case `/usr/bin/file conftest.o` in
+	    case `$FILECMD conftest.o` in
 	      *x86-64*)
 		LD="${LD-ld} -m elf32_x86_64"
 		;;
@@ -10383,7 +10508,7 @@
   ac_status=$?
   printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
   test $ac_status = 0; }; then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
     *64-bit*)
       case $lt_cv_prog_gnu_ld in
       yes*)
@@ -11166,8 +11291,8 @@
 _LT_EOF
       echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&5
       $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&5
-      echo "$AR cru libconftest.a conftest.o" >&5
-      $AR cru libconftest.a conftest.o 2>&5
+      echo "$AR $AR_FLAGS libconftest.a conftest.o" >&5
+      $AR $AR_FLAGS libconftest.a conftest.o 2>&5
       echo "$RANLIB libconftest.a" >&5
       $RANLIB libconftest.a 2>&5
       cat > conftest.c << _LT_EOF
@@ -11196,10 +11321,10 @@
       _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
     darwin*)
       case $MACOSX_DEPLOYMENT_TARGET,$host in
-	10.[012],*|,*powerpc*-darwin[5-8]*)
-	  _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	*)
-	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
+        10.[012],*|,*powerpc*-darwin[5-8]*)
+          _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
+        *)
+          _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
       esac
     ;;
   esac
@@ -11597,8 +11722,8 @@
 ofile=libtool
 can_build_shared=yes
 
-# All known linkers require a '.a' archive for static linking (except MSVC,
-# which needs '.lib').
+# All known linkers require a '.a' archive for static linking (except MSVC and
+# ICC, which need '.lib').
 libext=a
 
 with_gnu_ld=$lt_cv_prog_gnu_ld
@@ -12110,7 +12235,7 @@
 	lt_prog_compiler_static='-qstaticlink'
 	;;
       *)
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [1-7].* | *Sun*Fortran*\ 8.[0-3]*)
 	  # Sun Fortran 8.3 passes all unrecognized flags to the linker
 	  lt_prog_compiler_pic='-KPIC'
@@ -12533,15 +12658,15 @@
 
   case $host_os in
   cygwin* | mingw* | pw32* | cegcc*)
-    # FIXME: the MSVC++ port hasn't been tested in a loooong time
+    # FIXME: the MSVC++ and ICC port hasn't been tested in a loooong time
     # When not using gcc, we currently assume that we are using
-    # Microsoft Visual C++.
+    # Microsoft Visual C++ or Intel C++ Compiler.
     if test yes != "$GCC"; then
       with_gnu_ld=no
     fi
     ;;
   interix*)
-    # we just hope/assume this is gcc and not c89 (= MSVC++)
+    # we just hope/assume this is gcc and not c89 (= MSVC++ or ICC)
     with_gnu_ld=yes
     ;;
   openbsd* | bitrig*)
@@ -12593,7 +12718,7 @@
       whole_archive_flag_spec=
     fi
     supports_anon_versioning=no
-    case `$LD -v | $SED -e 's/(^)\+)\s\+//' 2>&1` in
+    case `$LD -v | $SED -e 's/([^)]\+)\s\+//' 2>&1` in
       *GNU\ gold*) supports_anon_versioning=yes ;;
       *\ [01].* | *\ 2.[0-9].* | *\ 2.10.*) ;; # catch versions < 2.11
       *\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ...
@@ -12705,6 +12830,7 @@
 	emximp -o $lib $output_objdir/$libname.def'
       old_archive_From_new_cmds='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
       enable_shared_with_static_runtimes=yes
+      file_list_spec='@'
       ;;
 
     interix[3-9]*)
@@ -12719,7 +12845,7 @@
       # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
       # time.  Moving up from 0x10000000 also allows more sbrk(2) space.
       archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-      archive_expsym_cmds='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+      archive_expsym_cmds='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
       ;;
 
     gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu)
@@ -12762,7 +12888,7 @@
 	  compiler_needs_object=yes
 	  ;;
 	esac
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ C*)			# Sun C 5.9
 	  whole_archive_flag_spec='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
 	  compiler_needs_object=yes
@@ -12774,7 +12900,7 @@
 
         if test yes = "$supports_anon_versioning"; then
           archive_expsym_cmds='echo "{ global:" > $output_objdir/$libname.ver~
-            cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+            cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
             echo "local: *; };" >> $output_objdir/$libname.ver~
             $CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
         fi
@@ -12790,7 +12916,7 @@
 	  archive_cmds='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib'
 	  if test yes = "$supports_anon_versioning"; then
 	    archive_expsym_cmds='echo "{ global:" > $output_objdir/$libname.ver~
-              cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+              cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
               echo "local: *; };" >> $output_objdir/$libname.ver~
               $LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib'
 	  fi
@@ -12922,7 +13048,7 @@
 	if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
 	  export_symbols_cmds='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && (substr(\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
 	else
-	  export_symbols_cmds='`func_echo_all $NM | $SED -e '\''s/B\([^B]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && (substr(\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+	  export_symbols_cmds='`func_echo_all $NM | $SED -e '\''s/B\([^B]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && (substr(\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
 	fi
 	aix_use_runtimelinking=no
 
@@ -13193,12 +13319,12 @@
 
     cygwin* | mingw* | pw32* | cegcc*)
       # When not using gcc, we currently assume that we are using
-      # Microsoft Visual C++.
+      # Microsoft Visual C++ or Intel C++ Compiler.
       # hardcode_libdir_flag_spec is actually meaningless, as there is
       # no search path for DLLs.
       case $cc_basename in
-      cl*)
-	# Native MSVC
+      cl* | icl*)
+	# Native MSVC or ICC
 	hardcode_libdir_flag_spec=' '
 	allow_undefined_flag=unsupported
 	always_export_symbols=yes
@@ -13239,7 +13365,7 @@
           fi'
 	;;
       *)
-	# Assume MSVC wrapper
+	# Assume MSVC and ICC wrapper
 	hardcode_libdir_flag_spec=' '
 	allow_undefined_flag=unsupported
 	# Tell ltmain to make .lib files, not .a files.
@@ -13280,8 +13406,8 @@
     output_verbose_link_cmd=func_echo_all
     archive_cmds="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
     module_cmds="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
-    archive_expsym_cmds="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
-    module_expsym_cmds="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
+    archive_expsym_cmds="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
+    module_expsym_cmds="$SED -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
 
   else
   ld_shlibs=no
@@ -13315,7 +13441,7 @@
       ;;
 
     # FreeBSD 3 and greater uses gcc -shared to do shared libraries.
-    freebsd* | dragonfly*)
+    freebsd* | dragonfly* | midnightbsd*)
       archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
       hardcode_libdir_flag_spec='-R$libdir'
       hardcode_direct=yes
@@ -13566,6 +13692,7 @@
 	emximp -o $lib $output_objdir/$libname.def'
       old_archive_From_new_cmds='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
       enable_shared_with_static_runtimes=yes
+      file_list_spec='@'
       ;;
 
     osf3*)
@@ -14258,7 +14385,7 @@
     case $host_os in
     cygwin*)
       # Cygwin DLLs use 'cyg' prefix rather than 'lib'
-      soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
+      soname_spec='`echo $libname | $SED -e 's/^lib/cyg/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
 
       sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"
       ;;
@@ -14268,14 +14395,14 @@
       ;;
     pw32*)
       # pw32 DLLs use 'pw' prefix rather than 'lib'
-      library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
+      library_names_spec='`echo $libname | $SED -e 's/^lib/pw/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
       ;;
     esac
     dynamic_linker='Win32 ld.exe'
     ;;
 
-  *,cl*)
-    # Native MSVC
+  *,cl* | *,icl*)
+    # Native MSVC or ICC
     libname_spec='$name'
     soname_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
     library_names_spec='$libname.dll.lib'
@@ -14294,7 +14421,7 @@
       done
       IFS=$lt_save_ifs
       # Convert to MSYS style.
-      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([a-zA-Z]\\):| /\\1|g' -e 's|^ ||'`
+      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's|\\\\|/|g' -e 's| \\([a-zA-Z]\\):| /\\1|g' -e 's|^ ||'`
       ;;
     cygwin*)
       # Convert to unix form, then to dos form, then back to unix form
@@ -14331,7 +14458,7 @@
     ;;
 
   *)
-    # Assume MSVC wrapper
+    # Assume MSVC and ICC wrapper
     library_names_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext $libname.lib'
     dynamic_linker='Win32 ld.exe'
     ;;
@@ -14364,7 +14491,7 @@
   shlibpath_var=LD_LIBRARY_PATH
   ;;
 
-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
   # DragonFly does not have aout.  When/if they implement a new
   # versioning mechanism, adjust this.
   if test -x /usr/bin/objformat; then
@@ -15517,30 +15644,41 @@
 old_striplib=
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether stripping libraries is possible" >&5
 printf %s "checking whether stripping libraries is possible... " >&6; }
-if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
-  test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
-  test -z "$striplib" && striplib="$STRIP --strip-unneeded"
-  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-printf "%s\n" "yes" >&6; }
+if test -z "$STRIP"; then
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 else
-# FIXME - insert some real tests, host_os isn't really good enough
-  case $host_os in
-  darwin*)
-    if test -n "$STRIP"; then
+  if $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
+    old_striplib="$STRIP --strip-debug"
+    striplib="$STRIP --strip-unneeded"
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+  else
+    case $host_os in
+    darwin*)
+      # FIXME - insert some real tests, host_os isn't really good enough
       striplib="$STRIP -x"
       old_striplib="$STRIP -S"
       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 printf "%s\n" "yes" >&6; }
-    else
-      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+      ;;
+    freebsd*)
+      if $STRIP -V 2>&1 | $GREP "elftoolchain" >/dev/null; then
+        old_striplib="$STRIP --strip-debug"
+        striplib="$STRIP --strip-unneeded"
+        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+      else
+        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
 printf "%s\n" "no" >&6; }
-    fi
-    ;;
-  *)
-    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+      fi
+      ;;
+    *)
+      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
 printf "%s\n" "no" >&6; }
-    ;;
-  esac
+      ;;
+    esac
+  fi
 fi
 
 
@@ -16310,8 +16448,8 @@
 
       cygwin* | mingw* | pw32* | cegcc*)
 	case $GXX,$cc_basename in
-	,cl* | no,cl*)
-	  # Native MSVC
+	,cl* | no,cl* | ,icl* | no,icl*)
+	  # Native MSVC or ICC
 	  # hardcode_libdir_flag_spec is actually meaningless, as there is
 	  # no search path for DLLs.
 	  hardcode_libdir_flag_spec_CXX=' '
@@ -16402,11 +16540,11 @@
     output_verbose_link_cmd=func_echo_all
     archive_cmds_CXX="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
     module_cmds_CXX="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
-    archive_expsym_cmds_CXX="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
-    module_expsym_cmds_CXX="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
+    archive_expsym_cmds_CXX="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
+    module_expsym_cmds_CXX="$SED -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
        if test yes != "$lt_cv_apple_cc_single_mod"; then
       archive_cmds_CXX="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil"
-      archive_expsym_cmds_CXX="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
+      archive_expsym_cmds_CXX="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
     fi
 
   else
@@ -16441,6 +16579,7 @@
 	  emximp -o $lib $output_objdir/$libname.def'
 	old_archive_From_new_cmds_CXX='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
 	enable_shared_with_static_runtimes_CXX=yes
+	file_list_spec_CXX='@'
 	;;
 
       dgux*)
@@ -16471,7 +16610,7 @@
         archive_cmds_need_lc_CXX=no
         ;;
 
-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
         # FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF
         # conventions
         ld_shlibs_CXX=yes
@@ -16608,7 +16747,7 @@
 	# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
 	# time.  Moving up from 0x10000000 also allows more sbrk(2) space.
 	archive_cmds_CXX='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-	archive_expsym_cmds_CXX='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+	archive_expsym_cmds_CXX='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
 	;;
       irix5* | irix6*)
         case $cc_basename in
@@ -16748,13 +16887,13 @@
 	    archive_cmds_CXX='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
 	    if test yes = "$supports_anon_versioning"; then
 	      archive_expsym_cmds_CXX='echo "{ global:" > $output_objdir/$libname.ver~
-                cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+                cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
                 echo "local: *; };" >> $output_objdir/$libname.ver~
                 $CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
 	    fi
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      no_undefined_flag_CXX=' -zdefs'
@@ -17411,7 +17550,7 @@
 	    ;;
 	esac
 	;;
-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
 	# FreeBSD uses GNU C++
 	;;
       hpux9* | hpux10* | hpux11*)
@@ -17494,7 +17633,7 @@
 	    lt_prog_compiler_static_CXX='-qstaticlink'
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      lt_prog_compiler_pic_CXX='-KPIC'
@@ -17881,7 +18020,7 @@
     if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
       export_symbols_cmds_CXX='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && (substr(\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
     else
-      export_symbols_cmds_CXX='`func_echo_all $NM | $SED -e '\''s/B\([^B]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && (substr(\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+      export_symbols_cmds_CXX='`func_echo_all $NM | $SED -e '\''s/B\([^B]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && (substr(\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
     fi
     ;;
   pw32*)
@@ -17889,7 +18028,7 @@
     ;;
   cygwin* | mingw* | cegcc*)
     case $cc_basename in
-    cl*)
+    cl* | icl*)
       exclude_expsyms_CXX='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*'
       ;;
     *)
@@ -18237,7 +18376,7 @@
     case $host_os in
     cygwin*)
       # Cygwin DLLs use 'cyg' prefix rather than 'lib'
-      soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
+      soname_spec='`echo $libname | $SED -e 's/^lib/cyg/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
 
       ;;
     mingw* | cegcc*)
@@ -18246,14 +18385,14 @@
       ;;
     pw32*)
       # pw32 DLLs use 'pw' prefix rather than 'lib'
-      library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
+      library_names_spec='`echo $libname | $SED -e 's/^lib/pw/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
       ;;
     esac
     dynamic_linker='Win32 ld.exe'
     ;;
 
-  *,cl*)
-    # Native MSVC
+  *,cl* | *,icl*)
+    # Native MSVC or ICC
     libname_spec='$name'
     soname_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext'
     library_names_spec='$libname.dll.lib'
@@ -18272,7 +18411,7 @@
       done
       IFS=$lt_save_ifs
       # Convert to MSYS style.
-      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([a-zA-Z]\\):| /\\1|g' -e 's|^ ||'`
+      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's|\\\\|/|g' -e 's| \\([a-zA-Z]\\):| /\\1|g' -e 's|^ ||'`
       ;;
     cygwin*)
       # Convert to unix form, then to dos form, then back to unix form
@@ -18309,7 +18448,7 @@
     ;;
 
   *)
-    # Assume MSVC wrapper
+    # Assume MSVC and ICC wrapper
     library_names_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext $libname.lib'
     dynamic_linker='Win32 ld.exe'
     ;;
@@ -18341,7 +18480,7 @@
   shlibpath_var=LD_LIBRARY_PATH
   ;;
 
-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
   # DragonFly does not have aout.  When/if they implement a new
   # versioning mechanism, adjust this.
   if test -x /usr/bin/objformat; then
@@ -25478,7 +25617,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by shibboleth $as_me 3.3.0, which was
+This file was extended by shibboleth $as_me 3.4.1, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -25546,7 +25685,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-shibboleth config.status 3.3.0
+shibboleth config.status 3.4.1
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
@@ -25709,6 +25848,7 @@
 lt_cv_to_tool_file_cmd='`$ECHO "$lt_cv_to_tool_file_cmd" | $SED "$delay_single_quote_subst"`'
 reload_flag='`$ECHO "$reload_flag" | $SED "$delay_single_quote_subst"`'
 reload_cmds='`$ECHO "$reload_cmds" | $SED "$delay_single_quote_subst"`'
+FILECMD='`$ECHO "$FILECMD" | $SED "$delay_single_quote_subst"`'
 OBJDUMP='`$ECHO "$OBJDUMP" | $SED "$delay_single_quote_subst"`'
 deplibs_check_method='`$ECHO "$deplibs_check_method" | $SED "$delay_single_quote_subst"`'
 file_magic_cmd='`$ECHO "$file_magic_cmd" | $SED "$delay_single_quote_subst"`'
@@ -25717,6 +25857,7 @@
 DLLTOOL='`$ECHO "$DLLTOOL" | $SED "$delay_single_quote_subst"`'
 sharedlib_from_linklib_cmd='`$ECHO "$sharedlib_from_linklib_cmd" | $SED "$delay_single_quote_subst"`'
 AR='`$ECHO "$AR" | $SED "$delay_single_quote_subst"`'
+lt_ar_flags='`$ECHO "$lt_ar_flags" | $SED "$delay_single_quote_subst"`'
 AR_FLAGS='`$ECHO "$AR_FLAGS" | $SED "$delay_single_quote_subst"`'
 archiver_list_spec='`$ECHO "$archiver_list_spec" | $SED "$delay_single_quote_subst"`'
 STRIP='`$ECHO "$STRIP" | $SED "$delay_single_quote_subst"`'
@@ -25891,6 +26032,7 @@
 lt_SP2NL \
 lt_NL2SP \
 reload_flag \
+FILECMD \
 OBJDUMP \
 deplibs_check_method \
 file_magic_cmd \
@@ -25899,7 +26041,6 @@
 DLLTOOL \
 sharedlib_from_linklib_cmd \
 AR \
-AR_FLAGS \
 archiver_list_spec \
 STRIP \
 RANLIB \
@@ -26905,6 +27046,9 @@
 # convert \$build files to toolchain format.
 to_tool_file_cmd=$lt_cv_to_tool_file_cmd
 
+# A file(cmd) program that detects file types.
+FILECMD=$lt_FILECMD
+
 # An object symbol dumper.
 OBJDUMP=$lt_OBJDUMP
 
@@ -26929,8 +27073,11 @@
 # The archiver.
 AR=$lt_AR
 
+# Flags to create an archive (by configure).
+lt_ar_flags=$lt_ar_flags
+
 # Flags to create an archive.
-AR_FLAGS=$lt_AR_FLAGS
+AR_FLAGS=\${ARFLAGS-"\$lt_ar_flags"}
 
 # How to feed a file listing to the archiver.
 archiver_list_spec=$lt_archiver_list_spec
@@ -27320,7 +27467,7 @@
   # if finds mixed CR/LF and LF-only lines.  Since sed operates in
   # text mode, it properly converts lines to CR/LF.  This bash problem
   # is reportedly fixed, but why not run on old versions too?
-  sed '$q' "$ltmain" >> "$cfgfile" \
+  $SED '$q' "$ltmain" >> "$cfgfile" \
      || (rm -f "$cfgfile"; exit 1)
 
    mv -f "$cfgfile" "$ofile" ||
diff -Nru shibboleth-sp-3.3.0+dfsg1/configure.ac shibboleth-sp-3.4.1+dfsg/configure.ac
--- shibboleth-sp-3.3.0+dfsg1/configure.ac	2021-10-19 19:04:27.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/configure.ac	2023-01-09 21:44:13.000000000 +0000
@@ -1,5 +1,5 @@
 AC_PREREQ([2.50])
-AC_INIT([shibboleth],[3.3.0],[https://shibboleth.atlassian.net/jira],[shibboleth-sp])
+AC_INIT([shibboleth],[3.4.1],[https://shibboleth.atlassian.net/jira],[shibboleth-sp])
 AC_CONFIG_SRCDIR(shibsp)
 AC_CONFIG_AUX_DIR(build-aux)
 AC_CONFIG_MACRO_DIR(m4)
diff -Nru shibboleth-sp-3.3.0+dfsg1/config_win32.h shibboleth-sp-3.4.1+dfsg/config_win32.h
--- shibboleth-sp-3.3.0+dfsg1/config_win32.h	2021-10-19 19:04:27.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/config_win32.h	2023-01-09 21:44:36.000000000 +0000
@@ -121,13 +121,13 @@
 #define PACKAGE_NAME "shibboleth"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "shibboleth 3.3.0"
+#define PACKAGE_STRING "shibboleth 3.4.1"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "shibboleth-sp"
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "3.3.0"
+#define PACKAGE_VERSION "3.4.1"
 
 /* Define to the necessary symbol if this constant uses a non-standard name on
    your system. */
@@ -140,7 +140,7 @@
 /* #undef TM_IN_SYS_TIME */
 
 /* Version number of package */
-#define VERSION "3.3.0"
+#define VERSION "3.4.1"
 
 /* Define to empty if `const' does not conform to ANSI C. */
 /* #undef const */
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/changelog shibboleth-sp-3.4.1+dfsg/debian/changelog
--- shibboleth-sp-3.3.0+dfsg1/debian/changelog	2021-12-01 20:44:29.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/changelog	2023-01-30 07:04:53.000000000 +0000
@@ -1,3 +1,58 @@
+shibboleth-sp (3.4.1+dfsg-2) unstable; urgency=medium
+
+  * Upload to unstable
+
+ -- Ferenc Wágner <wferi@debian.org>  Mon, 30 Jan 2023 08:04:53 +0100
+
+shibboleth-sp (3.4.1+dfsg-1) experimental; urgency=medium
+
+  [ Ferenc Wágner ]
+  * [119a057] New patch: configure.ac: AC_MSG_ERROR can't be used as value-if-
+    not-found
+  * [59f87e2] Disable building Apache modules for shibsptest.
+    They aren't needed and weren't built beforehand either because the
+    Apache development tools aren't installed in the autopkgtest
+    environment, but our latest patch fixed the configure script to fail
+    in such cases as intended, so we have to be explicit from now on.
+  * [8b58b70] Drop the obsolete lsb-base dependency
+    sysvinit-utils_3.05-1 took over /lib/lsb/init-functions from lsb-base,
+    which became an empty transitional package.  Sysvinit-utils is
+    essential now, so we needn't depend on it explicitly, but if that ever
+    changes (see #851747) the sysvinit-core package will still depend on
+    it, providing the function library to our init script if it has a real
+    chance to execute.  (The compatibility layer of systemd won't try to
+    use the init script, because we provide a native systemd unit.)
+    This change is unsuitable for bullseye backports.
+  * [deee373] Update Standards-Version to 4.6.2 (no changes required)
+  * [d8c04ea] Adapt Lintian overrides to new message format
+  * [f992224] Update copyright of the packaging
+  * [4fffee9] The repack number has always been 1, drop it
+  * [22c7144] New upstream release: 3.4.1
+  * [dc6bbc9] Refresh our patches
+  * [c87bb46] Rename library package for upstream SONAME bump (libshibsp11)
+  * [5a74ac0] Switch to Debhelper compat level 13.
+    Change the name of our file in tmpfiles.d from shibd to
+    shibboleth-sp-utils, because dh_installtmpfiles is not as flexible as
+    dh_installsystemd was on level 12.
+  * [25d661b] libapache2-mod-shib.NEWS was almost five years old, nothing new
+  * [f862571] Add Forwarded: not-needed to some Debian-specific patches.
+    To those which Lintian misidentifies as DEP3 and thus warns about.
+    We use gbp pq, which does not produce DEP3 formatted patch files.
+  * [e2173d1] Update upstream copyrights.
+    Where the license permits via a special exception, change it to that
+    of the main package (Apache-2.0) and collect the additional copyrights
+    in the generic paragraph.
+  * [37ff7c0] Add debian/upstream/metadata
+
+  [ Debian Janitor ]
+  * [0e325fc] Remove constraints unnecessary since buster
+    * Build-Depends: Drop versioned constraint on liblog4shib-dev and
+      libxml-security-c-dev.
+    * Remove 3 maintscript entries from 1 files.
+    Changes-By: deb-scrub-obsolete
+
+ -- Ferenc Wágner <wferi@debian.org>  Sat, 21 Jan 2023 20:33:50 +0100
+
 shibboleth-sp (3.3.0+dfsg1-1) unstable; urgency=medium
 
   * [0ce609d] New upstream release: 3.3.0
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/control shibboleth-sp-3.4.1+dfsg/debian/control
--- shibboleth-sp-3.3.0+dfsg1/debian/control	2021-12-01 20:39:56.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/control	2023-01-22 13:20:06.000000000 +0000
@@ -8,18 +8,17 @@
 Build-Depends:
  apache2-dev,
  cxxtest,
-# we need #887904 fixed, which also forces us to use compat level 12:
- debhelper-compat (= 12),
+ debhelper-compat (= 13),
  dh-apache2,
  libboost-dev,
  libfcgi-dev,
  libkrb5-dev,
- liblog4shib-dev (>= 2~),
+ liblog4shib-dev,
  libmemcached-dev,
  libsaml-dev (>= 3.2~),
  libsystemd-dev [linux-any],
  libxerces-c-dev,
- libxml-security-c-dev (>= 2~),
+ libxml-security-c-dev,
  libxmltooling-dev (>= 3.2~),
  opensaml-schemas (>= 3.2~),
  pkg-config,
@@ -28,7 +27,7 @@
 Build-Depends-Indep:
  doxygen,
  graphviz,
-Standards-Version: 4.6.0
+Standards-Version: 4.6.2
 Rules-Requires-Root: no
 Homepage: https://shibboleth.net/
 Vcs-Git: https://salsa.debian.org/shib-team/shibboleth-sp2.git
@@ -57,7 +56,7 @@
  (web servers providing resources protected by Shibboleth) and the
  supporting shibd daemon.
 
-Package: libshibsp10
+Package: libshibsp11
 Section: libs
 Architecture: any
 Multi-Arch: same
@@ -91,7 +90,7 @@
 Multi-Arch: same
 Depends:
  libsaml-dev (>= 3.2~),
- libshibsp10 (= ${binary:Version}),
+ libshibsp11 (= ${binary:Version}),
  libxerces-c-dev,
  libxmltooling-dev (>= 3.2~),
  ${misc:Depends},
@@ -135,8 +134,6 @@
 Depends:
  adduser,
  libshibsp-plugins (= ${binary:Version}),
-# the init script sources /lib/lsb/init-functions:
- lsb-base,
  ${misc:Depends},
  ${shlibs:Depends},
 Recommends:
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/copyright shibboleth-sp-3.4.1+dfsg/debian/copyright
--- shibboleth-sp-3.3.0+dfsg1/debian/copyright	2021-10-15 19:33:33.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/copyright	2023-01-22 13:20:06.000000000 +0000
@@ -12,8 +12,11 @@
  files not distributed under a DFSG-free license.
 
 Files: *
-Copyright: 2001-2018 University Corporation for Advanced Internet
- Development, Inc. (UCAID)
+Copyright: 2001-2023 University Corporation for Advanced Internet
+    Development, Inc. (UCAID)
+  1992-2022 Free Software Foundation, Inc.
+  2007-2011, 2014 Benoit Sigoure <tsuna@lrde.epita.fr>
+  2010 The Danish CLARIN Consortium
 License: Apache-2.0
 
 Files: schemas/ws-addr.xsd
@@ -21,71 +24,28 @@
 License: W3C-software
 
 Files: */Makefile.in
-Copyright: 2001-2016 University Corporation for Advanced Internet
+Copyright: 2001-2023 University Corporation for Advanced Internet
     Development, Inc. (UCAID)
-  1994-2012 Free Software Foundation, Inc.
+  1994-2021 Free Software Foundation, Inc.
 License: FSF-unlimited
 
 Files: aclocal.m4 m4/ltoptions.m4 m4/ltsugar.m4 m4/ltversion.m4
  m4/lt~obsolete.m4
-Copyright: 1996-2012 Free Software Foundation, Inc.
+Copyright: 1996-2021 Free Software Foundation, Inc.
 License: FSF-unlimited
 
-Files: build-aux/config.guess build-aux/config.sub build-aux/depcomp
- build-aux/missing
-Copyright: 1992-2012 Free Software Foundation, Inc.
-License: GPL-2+ or configure-same-as-package
- This file is free software; you can redistribute it and/or modify it
- under the terms of the GNU General Public License as published by the
- Free Software Foundation; either version 2 of the License, or (at your
- option) any later version.
- .
- This program is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General
- Public License for more details.
- .
- The full text of the GNU General Public License version 2 is available on
- Debian systems in /usr/share/common-licenses/GPL-2.
- .
- As a special exception to the GNU General Public License, if you
- distribute this file as part of a program that contains a configuration
- script generated by Autoconf, you may include it under the same
- distribution terms that you use for the rest of that program.
-
-Files: build-aux/ltmain.sh m4/libtool.m4
-Copyright: 1996-2015 Free Software Foundation, Inc.
-License: GPL-2+ with libtool exception
- GNU Libtool is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
- .
- As a special exception to the GNU General Public License,
- if you distribute this file as part of a program or library that
- is built using GNU Libtool, you may include this file under the
- same distribution terms that you use for the rest of that program.
- .
- GNU Libtool is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- General Public License for more details.
- .
- The full text of the GNU General Public License version 2 is available on
- Debian systems in /usr/share/common-licenses/GPL-2.
-
 Files: build-aux/install-sh
 Copyright: (C) 1994 X Consortium
 License: Expat
 
 Files: configure
-Copyright: 1992-1996, 1998-2012 Free Software Foundation, Inc.
+Copyright: 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, Inc.
 License: FSF-configure-unlimited
  This configure script is free software; the Free Software Foundation
  gives unlimited permission to copy, distribute and modify it.
 
 Files: debian/*
-Copyright: 2008,2016-2018 Ferenc Wágner <wferi@debian.org>
+Copyright: 2008,2016-2023 Ferenc Wágner <wferi@debian.org>
   2008-2013 Russ Allbery <rra@debian.org>
 License: Expat
 
@@ -108,6 +68,7 @@
 Files: m4/ax_pthread.m4
 Copyright: 2008 Steven G. Johnson <stevenj@alum.mit.edu>
   2011 Daniel Richard G. <skunk@iSKUNK.ORG>
+  2019 Marc Stevens <marc.stevens@cwi.nl>
 License: GPL-3+ with autoconf-macro-package exception
  This program is free software: you can redistribute it and/or modify it
  under the terms of the GNU General Public License as published by the
@@ -135,33 +96,6 @@
  modified version of the Autoconf Macro, you may extend this special
  exception to the GPL to apply to your modified version as well.
 
-Files: m4/boost.m4
-Copyright: 2007, 2008, 2009, 2010, 2011
-    Benoit Sigoure <tsuna@lrde.epita.fr>
-License: GPL-3+ with Autoconf exception
- This program is free software: you can redistribute it and/or modify it
- under the terms of the GNU General Public License as published by the
- Free Software Foundation, either version 3 of the License, or (at your
- option) any later version.
- .
- Additional permission under section 7 of the GNU General Public License,
- version 3 ("GPLv3"):
- .
- If you convey this file as part of a work that contains a configuration
- script generated by Autoconf, you may do so under terms of your choice.
- .
- This program is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General
- Public License for more details.
- .
- The full text of the GNU General Public License version 3 is available on
- Debian systems in /usr/share/common-licenses/GPL-3.
-
-Files: shibsp/attribute/Base64AttributeDecoder.cpp
-Copyright: 2010 The Danish CLARIN Consortium
-License: Apache-2.0
-
 License: Apache-2.0
  Licensed to the University Corporation for Advanced Internet Development,
  Inc. (UCAID) under one or more contributor license agreements. See the
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/libapache2-mod-shib2.maintscript shibboleth-sp-3.4.1+dfsg/debian/libapache2-mod-shib2.maintscript
--- shibboleth-sp-3.3.0+dfsg1/debian/libapache2-mod-shib2.maintscript	2021-10-15 19:33:33.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/libapache2-mod-shib2.maintscript	1970-01-01 00:00:00.000000000 +0000
@@ -1,9 +0,0 @@
-# We spell out the package name, because otherwise dpkg-maintscript-helper
-# fills in the architecture-qualified name of the new version
-# (libapache2-mod-shib2:all), breaking its own ownership tests:
-rm_conffile /etc/apache2/mods-available/shib2.load 3.0.2+dfsg1-1~ libapache2-mod-shib2
-
-# We overwrite the conffiles of the new libapache2-mod-shib if these
-# conffiles were modified by the local administrator.
-mv_conffile /etc/apache2/conf-available/shib2.conf /etc/apache2/conf-available/shib.conf 3.0.2+dfsg1-1~ libapache2-mod-shib2
-mv_conffile /etc/logcheck/ignore.d.server/libapache2-mod-shib2 /etc/logcheck/ignore.d.server/libapache2-mod-shib 3.0.2+dfsg1-1~ libapache2-mod-shib2
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/libapache2-mod-shib.lintian-overrides shibboleth-sp-3.4.1+dfsg/debian/libapache2-mod-shib.lintian-overrides
--- shibboleth-sp-3.3.0+dfsg1/debian/libapache2-mod-shib.lintian-overrides	2021-12-01 20:39:56.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/libapache2-mod-shib.lintian-overrides	2023-01-22 13:20:06.000000000 +0000
@@ -1,5 +1,5 @@
 # Finding etc/apache2/conf-available/shib.conf Lintian tags
 # libapache2-mod-shib as a web application package, while it
 # is module package only.
-non-standard-apache2-configuration-name shib.conf != libapache2-mod-shib.conf
-web-application-depends-on-apache2-data-package apache2-bin shib.conf
+non-standard-apache2-configuration-name shib.conf != libapache2-mod-shib.conf [etc/apache2/conf-available/shib.conf]
+web-application-depends-on-apache2-data-package apache2-bin shib.conf [etc/apache2/conf-available/shib.conf]
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/libapache2-mod-shib.NEWS shibboleth-sp-3.4.1+dfsg/debian/libapache2-mod-shib.NEWS
--- shibboleth-sp-3.3.0+dfsg1/debian/libapache2-mod-shib.NEWS	2021-10-15 19:33:33.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/libapache2-mod-shib.NEWS	1970-01-01 00:00:00.000000000 +0000
@@ -1,123 +0,0 @@
-shibboleth-sp (3.0.2+dfsg1-1) experimental; urgency=medium
-
-  With the release of Shibboleth Service Provider 3, the "2" version
-  indicator is dropped from the source and binary package names, from
-  the name of the Apache module file and most importantly, from the
-  module and config name used with a2enmod/a2enconf.
-
-  However, /etc/shibboleth/shibboleth2.xml kept its name, following
-  upstream convention.
-
-  Changes to the old config file /etc/apache2/conf-available/shib2.conf
-  will be preserved and included in the Apache configuration under the
-  new name; they will have to be manually disabled again if not desired.
-
-  From version 3 the upstream default log destination of the Apache
-  module (the "native log") is syslog, not files under the
-  /var/log/shibboleth-www directory.  Syslog was the Debian default
-  before 2.5.5+dfsg1-1, when the package behavior was aligned to
-  upstream.  Following the upstream default, that change is
-  effectively reverted in this package version.
-
- -- Ferenc Wágner <wferi@debian.org>  Fri, 10 Aug 2018 17:05:54 +0200
-
-shibboleth-sp2 (2.6.1+dfsg1-2) unstable; urgency=medium
-
-  Upstream's default Apache configuration is now installed in
-  /etc/apache2/conf-available/shib2.conf. Notably, it allows unrestricted
-  access to the handler location (required for Shibboleth to function)
-  with:
-
-    <Location /Shibboleth.sso>
-      AuthType None
-      Require all granted
-    </Location>
-
-  This configuration also contains ShibCompatValidUser Off (the default
-  setting), which you may want to enable if you use other authentication
-  modules on the same Apache server as Shibboleth.
-
- -- Etienne Dysli Metref <etienne.dysli-metref@switch.ch>  Mon, 27 Nov 2017 08:41:27 +0100
-
-shibboleth-sp2 (2.5.5+dfsg1-1) unstable; urgency=medium
-
-  The Debian specific redirection of logs from the Apache module (native
-  logs) is dropped in this version.  The new upstream location for these
-  logs is /var/log/shibboleth-www.
-
- -- Ferenc Wágner <wferi@niif.hu>  Thu, 21 Jan 2016 01:13:27 +0100
-
-shibboleth-sp2 (2.5.2+dfsg-1) experimental; urgency=low
-
-  Shibboleth has added new Require shib-session and Require shib-user
-  directives, which will replace use of Require valid-user and Require
-  user with Shibboleth authentication.  If you are currently using
-  valid-user or user restrictions with Shibboleth, consider switching to
-  shib-session and shib-user, respectively.
-
-  If you are using both Shibboleth and another authentication method, such
-  as basic auth, on the same Apache server and want to use Require
-  valid-user or Require user with the non-Shibboleth authentication
-  method, you will need to add:
-
-      ShibCompatValidUser On
-
-  to your server or virtual host configuration.
-  
- -- Russ Allbery <rra@debian.org>  Tue, 18 Jun 2013 14:47:40 -0700
-
-shibboleth-sp2 (2.3+dfsg-1) unstable; urgency=high
-
-  As of this release, running shibd as a non-root user is supported and
-  recommended to limit the impact of any potential security issues.  The
-  package will create a dedicated _shibd user on installation for that
-  purpose.
-
-  In order for shibd to run as user _shibd instead of as root, user _shibd
-  must have read access to the private key of the server.  The easiest way
-  is to make the private key, normally /etc/shibboleth/sp-key.pem, owned
-  by root and readable by group _shibd:
-
-      chown root:_shibd /etc/shibboleth/sp-key.pem
-      chmod 640 /etc/shibboleth/sp-key.pem
-
-  The init script attempts to detect, when starting up shibd, whether it
-  can read the private key specified in the configuration and, if not,
-  falls back on running shibd as root, as was done in previous versions of
-  this package.
-
- -- Russ Allbery <rra@debian.org>  Tue, 10 Nov 2009 16:48:03 -0800
-
-shibboleth-sp2 (2.2.1+dfsg-2) unstable; urgency=low
-
-  There are several changes to the configuration syntax and defaults in
-  Shibboleth 2.2, one of which produce deprecation warnings on startup
-  until /etc/shibboleth/shibboleth2.xml is updated.
-
-  The most significant change is that <Rule> tags in the <Policy> element
-  should be changed to <PolicyRule> and a new policy rule added:
-
-      <PolicyRule type="Conditions">
-          <PolicyRule type="Audience"/>
-          <!-- Enable Delegation rule to permit delegated access. -->
-          <!-- <PolicyRule type="Delegation"/> -->
-      </PolicyRule>
-
-  See:
-
-  https://spaces.internet2.edu/display/SHIB2/NativeSPConfigurationChanges
-
-  for all the details and further explanation.
-
- -- Russ Allbery <rra@debian.org>  Tue, 15 Sep 2009 20:44:26 -0700
-
-shibboleth-sp2 (2.0.dfsg1-4) unstable; urgency=low
-
-  With this release, the Apache module configuration fragments in
-  /etc/apache2/mods-available have been renamed to shib2.* from shib.* to
-  avoid conflicts with libapache2-mod-shib.  If you had any customizations
-  in /etc/apache2/mods-available/shib.load, you will need to move them to
-  /etc/apache2/mods-available/shib2.load.
-
- -- Russ Allbery <rra@debian.org>  Tue, 14 Oct 2008 20:52:20 -0700
-
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/libshibsp10.install shibboleth-sp-3.4.1+dfsg/debian/libshibsp10.install
--- shibboleth-sp-3.3.0+dfsg1/debian/libshibsp10.install	2021-10-15 19:33:33.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/libshibsp10.install	1970-01-01 00:00:00.000000000 +0000
@@ -1,2 +0,0 @@
-usr/lib/*/libshibsp.so.*
-usr/lib/*/libshibsp-lite.so.*
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/libshibsp10.lintian-overrides shibboleth-sp-3.4.1+dfsg/debian/libshibsp10.lintian-overrides
--- shibboleth-sp-3.3.0+dfsg1/debian/libshibsp10.lintian-overrides	2021-10-15 19:33:33.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/libshibsp10.lintian-overrides	1970-01-01 00:00:00.000000000 +0000
@@ -1,5 +0,0 @@
-# See https://wiki.debian.org/UsingSymbolsFiles and follow to
-# https://www.eyrie.org/~eagle/journal/2012-02/001.html.
-# In short: symbols files are not worth providing for Shibboleth.
-no-symbols-control-file usr/lib/*/libshibsp.so.*
-no-symbols-control-file usr/lib/*/libshibsp-lite.so.*
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/libshibsp11.install shibboleth-sp-3.4.1+dfsg/debian/libshibsp11.install
--- shibboleth-sp-3.3.0+dfsg1/debian/libshibsp11.install	1970-01-01 00:00:00.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/libshibsp11.install	2023-01-22 13:20:06.000000000 +0000
@@ -0,0 +1,2 @@
+usr/lib/*/libshibsp.so.*
+usr/lib/*/libshibsp-lite.so.*
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/libshibsp11.lintian-overrides shibboleth-sp-3.4.1+dfsg/debian/libshibsp11.lintian-overrides
--- shibboleth-sp-3.3.0+dfsg1/debian/libshibsp11.lintian-overrides	1970-01-01 00:00:00.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/libshibsp11.lintian-overrides	2023-01-22 13:20:06.000000000 +0000
@@ -0,0 +1,5 @@
+# See https://wiki.debian.org/UsingSymbolsFiles and follow to
+# https://www.eyrie.org/~eagle/journal/2012-02/001.html.
+# In short: symbols files are not worth providing for Shibboleth.
+no-symbols-control-file usr/lib/*/libshibsp.so.*
+no-symbols-control-file usr/lib/*/libshibsp-lite.so.*
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/patches/configure.ac-AC_MSG_ERROR-can-t-be-used-as-value-if-not-f.patch shibboleth-sp-3.4.1+dfsg/debian/patches/configure.ac-AC_MSG_ERROR-can-t-be-used-as-value-if-not-f.patch
--- shibboleth-sp-3.3.0+dfsg1/debian/patches/configure.ac-AC_MSG_ERROR-can-t-be-used-as-value-if-not-f.patch	1970-01-01 00:00:00.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/patches/configure.ac-AC_MSG_ERROR-can-t-be-used-as-value-if-not-f.patch	2023-01-22 13:21:55.000000000 +0000
@@ -0,0 +1,41 @@
+From: =?utf-8?q?Ferenc_W=C3=A1gner?= <wferi@debian.org>
+Date: Sat, 21 Jan 2023 12:27:23 +0100
+Subject: configure.ac: AC_MSG_ERROR can't be used as value-if-not-found
+
+Such use inside AC_PATH_PROGS() leads to an obscure error message and
+does not terminate the configure run if hit.  Use an idiomatic
+construct instead and also add quoting at two other places to avoid
+treating textual commas as macro argument separators.
+---
+ configure.ac | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 51bc493..7f1f178 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -337,9 +337,8 @@ if test "$need_default" = "yes"; then
+   Peek(with,apxs22,xs="$peekval")
+   Peek(with,apxs24,xs="$peekval")
+   if test "x$xs" = "x"; then
+-     AC_PATH_PROGS(xs, apxs2 apxs,
+-        AC_MSG_ERROR(No apxs, no Apache found. Try --with-apxs, --with-apxs2, etc.),
+-        [/usr/local/apache2/bin:/usr/local/apache/bin:/usr/sbin:$PATH])
++     AC_PATH_PROGS([xs], [apxs2 apxs],, [/usr/local/apache2/bin:/usr/local/apache/bin:/usr/sbin:$PATH])
++     AS_IF([test "x$xs" = "x"], [AC_MSG_ERROR([No apxs, no Apache found. Try --with-apxs, --with-apxs2, etc.])])
+   fi
+   # ask the daemon for the version and set parameters
+   AC_MSG_CHECKING(default apache version)
+@@ -363,10 +362,10 @@ if test "$need_default" = "yes"; then
+                [with_apxs24]=$xs
+                AC_MSG_RESULT(2.4)
+                ;;
+-       *)      AC_MSG_ERROR(unusable Apache versions: $v. Try setting --with-apxs, --with=apxs2, etc.)
++       *)      AC_MSG_ERROR([unusable Apache versions: $v. Try setting --with-apxs, --with=apxs2, etc.])
+      esac
+   else 
+-     AC_MSG_RESULT(cannot determine Apache version. Try setting --with-apxs, --with-apxs2, etc.)
++     AC_MSG_RESULT([cannot determine Apache version. Try setting --with-apxs, --with-apxs2, etc.])
+   fi
+ fi
+ 
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/patches/Debianize-the-systemd-service-file-of-shibd.patch shibboleth-sp-3.4.1+dfsg/debian/patches/Debianize-the-systemd-service-file-of-shibd.patch
--- shibboleth-sp-3.3.0+dfsg1/debian/patches/Debianize-the-systemd-service-file-of-shibd.patch	2021-12-01 20:41:44.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/patches/Debianize-the-systemd-service-file-of-shibd.patch	2023-01-22 13:20:26.000000000 +0000
@@ -2,6 +2,7 @@
 Date: Sun, 24 Jan 2016 12:41:00 +0100
 Subject: Debianize the systemd service file of shibd
 
+Forwarded: not-needed
 ---
  configs/shibd-systemd.in | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/patches/seckeygen-defaults-for-Debian.patch shibboleth-sp-3.4.1+dfsg/debian/patches/seckeygen-defaults-for-Debian.patch
--- shibboleth-sp-3.3.0+dfsg1/debian/patches/seckeygen-defaults-for-Debian.patch	2021-12-01 20:41:44.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/patches/seckeygen-defaults-for-Debian.patch	2023-01-22 13:20:26.000000000 +0000
@@ -2,6 +2,7 @@
 Date: Sat, 11 Aug 2018 15:04:41 +0200
 Subject: seckeygen defaults for Debian
 
+Forwarded: not-needed
 ---
  configs/seckeygen.sh | 6 ++++++
  1 file changed, 6 insertions(+)
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/patches/series shibboleth-sp-3.4.1+dfsg/debian/patches/series
--- shibboleth-sp-3.3.0+dfsg1/debian/patches/series	2021-12-01 20:41:44.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/patches/series	2023-01-22 13:20:26.000000000 +0000
@@ -3,3 +3,4 @@
 Debianize-the-systemd-service-file-of-shibd.patch
 seckeygen-defaults-for-Debian.patch
 Use-runstatedir-from-future-Autoconf-2.70.patch
+configure.ac-AC_MSG_ERROR-can-t-be-used-as-value-if-not-f.patch
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/patches/Use-runstatedir-from-future-Autoconf-2.70.patch shibboleth-sp-3.4.1+dfsg/debian/patches/Use-runstatedir-from-future-Autoconf-2.70.patch
--- shibboleth-sp-3.3.0+dfsg1/debian/patches/Use-runstatedir-from-future-Autoconf-2.70.patch	2021-12-01 20:41:44.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/patches/Use-runstatedir-from-future-Autoconf-2.70.patch	2023-01-22 13:20:26.000000000 +0000
@@ -37,7 +37,7 @@
  
      # If $DAEMON_USER is set, try to run shibd as that user.  However,
 diff --git a/shibsp/Makefile.am b/shibsp/Makefile.am
-index a45210f..b3c6fa1 100644
+index f16fd1c..d08dc52 100644
 --- a/shibsp/Makefile.am
 +++ b/shibsp/Makefile.am
 @@ -282,7 +282,7 @@ libshibsp_lite_la_LIBADD = \
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/rules shibboleth-sp-3.4.1+dfsg/debian/rules
--- shibboleth-sp-3.3.0+dfsg1/debian/rules	2021-10-15 19:33:33.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/rules	2023-01-22 13:20:06.000000000 +0000
@@ -28,6 +28,7 @@
 
 override_dh_auto_install:
 	NOKEYGEN=1 dh_auto_install
+	find debian/tmp -name "*.la" -delete
 
 docdir = debian/tmp/usr/share/doc/shibboleth-*
 override_dh_install:
@@ -72,10 +73,6 @@
 override_dh_installsystemd:
 	dh_installsystemd --name=shibd
 
-override_dh_missing:
-	find debian/tmp -name "*.la" -delete
-	dh_missing --fail-missing
-
 override_dh_makeshlibs:
 	dh_makeshlibs -Xusr/lib/$(DEB_HOST_MULTIARCH)/shibboleth
 
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/shibboleth-sp-utils.shibd.tmpfile shibboleth-sp-3.4.1+dfsg/debian/shibboleth-sp-utils.shibd.tmpfile
--- shibboleth-sp-3.3.0+dfsg1/debian/shibboleth-sp-utils.shibd.tmpfile	2021-10-15 19:33:33.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/shibboleth-sp-utils.shibd.tmpfile	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-d /run/shibboleth 755 _shibd _shibd
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/shibboleth-sp-utils.tmpfiles shibboleth-sp-3.4.1+dfsg/debian/shibboleth-sp-utils.tmpfiles
--- shibboleth-sp-3.3.0+dfsg1/debian/shibboleth-sp-utils.tmpfiles	1970-01-01 00:00:00.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/shibboleth-sp-utils.tmpfiles	2023-01-22 13:20:06.000000000 +0000
@@ -0,0 +1 @@
+d /run/shibboleth 755 _shibd _shibd
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/tests/shibsptest shibboleth-sp-3.4.1+dfsg/debian/tests/shibsptest
--- shibboleth-sp-3.3.0+dfsg1/debian/tests/shibsptest	2021-10-15 19:33:33.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/tests/shibsptest	2023-01-22 13:20:06.000000000 +0000
@@ -3,7 +3,12 @@
 # Some of the Debian patches touch the build system, so
 autoreconf -f -i
 
-./configure --disable-doxygen-doc
+./configure \
+    --disable-doxygen-doc \
+    --disable-apache-13 \
+    --disable-apache-20 \
+    --disable-apache-22 \
+    --disable-apache-24
 
 # Work around the make dependency:
 touch shibsp/libshibsp.la
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/upstream/metadata shibboleth-sp-3.4.1+dfsg/debian/upstream/metadata
--- shibboleth-sp-3.3.0+dfsg1/debian/upstream/metadata	1970-01-01 00:00:00.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/upstream/metadata	2023-01-22 13:20:06.000000000 +0000
@@ -0,0 +1,4 @@
+---
+Bug-Submit: https://shibboleth.atlassian.net/jira/software/c/projects/SSPCPP/issues/
+Repository: https://git.shibboleth.net/git/cpp-sp.git
+Repository-Browse: https://git.shibboleth.net/view/?p=cpp-sp.git;a=summary
diff -Nru shibboleth-sp-3.3.0+dfsg1/debian/watch shibboleth-sp-3.4.1+dfsg/debian/watch
--- shibboleth-sp-3.3.0+dfsg1/debian/watch	2021-10-15 19:33:33.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/debian/watch	2023-01-22 13:20:06.000000000 +0000
@@ -1,6 +1,6 @@
 version=4
 opts="dversionmangle=s/\+dfsg\d*$//,\
-repacksuffix=+dfsg1,\
+repacksuffix=+dfsg,\
 repack,\
 compression=xz,\
 pgpsigurlmangle=s/$/.asc/" \
diff -Nru shibboleth-sp-3.3.0+dfsg1/doc/Makefile.in shibboleth-sp-3.4.1+dfsg/doc/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/doc/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/doc/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -247,6 +247,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/fastcgi/Makefile.in shibboleth-sp-3.4.1+dfsg/fastcgi/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/fastcgi/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/fastcgi/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -297,6 +297,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/iis7_shib/iis7_shib.rc shibboleth-sp-3.4.1+dfsg/iis7_shib/iis7_shib.rc
--- shibboleth-sp-3.3.0+dfsg1/iis7_shib/iis7_shib.rc	2021-10-05 19:20:47.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/iis7_shib/iis7_shib.rc	2023-01-09 21:48:02.000000000 +0000
@@ -51,8 +51,8 @@
 //
 
 VS_VERSION_INFO VERSIONINFO
-FILEVERSION RC_FILE_VERSION, 3
-PRODUCTVERSION RC_PRODUCT_VERSION, 1
+FILEVERSION RC_FILE_VERSION, 0
+PRODUCTVERSION RC_PRODUCT_VERSION, 0
 FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
diff -Nru shibboleth-sp-3.3.0+dfsg1/m4/libtool.m4 shibboleth-sp-3.4.1+dfsg/m4/libtool.m4
--- shibboleth-sp-3.3.0+dfsg1/m4/libtool.m4	2021-11-29 13:44:25.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/m4/libtool.m4	2022-10-24 13:49:04.000000000 +0000
@@ -1,6 +1,7 @@
 # libtool.m4 - Configure libtool for the host system. -*-Autoconf-*-
 #
-#   Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc.
+#   Copyright (C) 1996-2001, 2003-2019, 2021-2022 Free Software
+#   Foundation, Inc.
 #   Written by Gordon Matzigkeit, 1996
 #
 # This file is free software; the Free Software Foundation gives
@@ -31,7 +32,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 ])
 
-# serial 58 LT_INIT
+# serial 59 LT_INIT
 
 
 # LT_PREREQ(VERSION)
@@ -181,6 +182,7 @@
 m4_require([_LT_CHECK_SHELL_FEATURES])dnl
 m4_require([_LT_PATH_CONVERSION_FUNCTIONS])dnl
 m4_require([_LT_CMD_RELOAD])dnl
+m4_require([_LT_DECL_FILECMD])dnl
 m4_require([_LT_CHECK_MAGIC_METHOD])dnl
 m4_require([_LT_CHECK_SHAREDLIB_FROM_LINKLIB])dnl
 m4_require([_LT_CMD_OLD_ARCHIVE])dnl
@@ -219,8 +221,8 @@
 ofile=libtool
 can_build_shared=yes
 
-# All known linkers require a '.a' archive for static linking (except MSVC,
-# which needs '.lib').
+# All known linkers require a '.a' archive for static linking (except MSVC and
+# ICC, which need '.lib').
 libext=a
 
 with_gnu_ld=$lt_cv_prog_gnu_ld
@@ -778,7 +780,7 @@
   # if finds mixed CR/LF and LF-only lines.  Since sed operates in
   # text mode, it properly converts lines to CR/LF.  This bash problem
   # is reportedly fixed, but why not run on old versions too?
-  sed '$q' "$ltmain" >> "$cfgfile" \
+  $SED '$q' "$ltmain" >> "$cfgfile" \
      || (rm -f "$cfgfile"; exit 1)
 
    mv -f "$cfgfile" "$ofile" ||
@@ -1042,8 +1044,8 @@
 _LT_EOF
       echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
       $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
-      echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
-      $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
+      echo "$AR $AR_FLAGS libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
+      $AR $AR_FLAGS libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
       echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
       $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
       cat > conftest.c << _LT_EOF
@@ -1069,10 +1071,10 @@
       _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
     darwin*)
       case $MACOSX_DEPLOYMENT_TARGET,$host in
-	10.[[012]],*|,*powerpc*-darwin[[5-8]]*)
-	  _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	*)
-	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
+        10.[[012]],*|,*powerpc*-darwin[[5-8]]*)
+          _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
+        *)
+          _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
       esac
     ;;
   esac
@@ -1121,12 +1123,12 @@
     output_verbose_link_cmd=func_echo_all
     _LT_TAGVAR(archive_cmds, $1)="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
     _LT_TAGVAR(module_cmds, $1)="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
-    _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
-    _LT_TAGVAR(module_expsym_cmds, $1)="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
+    _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
+    _LT_TAGVAR(module_expsym_cmds, $1)="$SED -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
     m4_if([$1], [CXX],
 [   if test yes != "$lt_cv_apple_cc_single_mod"; then
       _LT_TAGVAR(archive_cmds, $1)="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil"
-      _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
+      _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
     fi
 ],[])
   else
@@ -1240,7 +1242,8 @@
 # _LT_WITH_SYSROOT
 # ----------------
 AC_DEFUN([_LT_WITH_SYSROOT],
-[AC_MSG_CHECKING([for sysroot])
+[m4_require([_LT_DECL_SED])dnl
+AC_MSG_CHECKING([for sysroot])
 AC_ARG_WITH([sysroot],
 [AS_HELP_STRING([--with-sysroot@<:@=DIR@:>@],
   [Search for dependent libraries within DIR (or the compiler's sysroot
@@ -1257,7 +1260,7 @@
    fi
    ;; #(
  /*)
-   lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"`
+   lt_sysroot=`echo "$with_sysroot" | $SED -e "$sed_quote_subst"`
    ;; #(
  no|'')
    ;; #(
@@ -1287,7 +1290,7 @@
   # options accordingly.
   echo 'int i;' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *ELF-32*)
 	HPUX_IA64_MODE=32
 	;;
@@ -1304,7 +1307,7 @@
   echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
     if test yes = "$lt_cv_prog_gnu_ld"; then
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -melf32bsmip"
 	  ;;
@@ -1316,7 +1319,7 @@
 	;;
       esac
     else
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -32"
 	  ;;
@@ -1338,7 +1341,7 @@
   echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
     emul=elf
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *32-bit*)
 	emul="${emul}32"
 	;;
@@ -1346,7 +1349,7 @@
 	emul="${emul}64"
 	;;
     esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *MSB*)
 	emul="${emul}btsmip"
 	;;
@@ -1354,7 +1357,7 @@
 	emul="${emul}ltsmip"
 	;;
     esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *N32*)
 	emul="${emul}n32"
 	;;
@@ -1374,14 +1377,14 @@
   # not appear in the list.
   echo 'int i;' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
       *32-bit*)
 	case $host in
 	  x86_64-*kfreebsd*-gnu)
 	    LD="${LD-ld} -m elf_i386_fbsd"
 	    ;;
 	  x86_64-*linux*)
-	    case `/usr/bin/file conftest.o` in
+	    case `$FILECMD conftest.o` in
 	      *x86-64*)
 		LD="${LD-ld} -m elf32_x86_64"
 		;;
@@ -1449,7 +1452,7 @@
   # options accordingly.
   echo 'int i;' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
     *64-bit*)
       case $lt_cv_prog_gnu_ld in
       yes*)
@@ -1488,9 +1491,22 @@
 m4_defun([_LT_PROG_AR],
 [AC_CHECK_TOOLS(AR, [ar], false)
 : ${AR=ar}
-: ${AR_FLAGS=cru}
 _LT_DECL([], [AR], [1], [The archiver])
-_LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive])
+
+# Use ARFLAGS variable as AR's operation code to sync the variable naming with
+# Automake.  If both AR_FLAGS and ARFLAGS are specified, AR_FLAGS should have
+# higher priority because thats what people were doing historically (setting
+# ARFLAGS for automake and AR_FLAGS for libtool).  FIXME: Make the AR_FLAGS
+# variable obsoleted/removed.
+
+test ${AR_FLAGS+y} || AR_FLAGS=${ARFLAGS-cr}
+lt_ar_flags=$AR_FLAGS
+_LT_DECL([], [lt_ar_flags], [0], [Flags to create an archive (by configure)])
+
+# Make AR_FLAGS overridable by 'make ARFLAGS='.  Don't try to run-time override
+# by AR_FLAGS because that was never working and AR_FLAGS is about to die.
+_LT_DECL([], [AR_FLAGS], [\@S|@{ARFLAGS-"\@S|@lt_ar_flags"}],
+         [Flags to create an archive])
 
 AC_CACHE_CHECK([for archiver @FILE support], [lt_cv_ar_at_file],
   [lt_cv_ar_at_file=no
@@ -1709,7 +1725,7 @@
     lt_cv_sys_max_cmd_len=8192;
     ;;
 
-  bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*)
+  bitrig* | darwin* | dragonfly* | freebsd* | midnightbsd* | netbsd* | openbsd*)
     # This has been around since 386BSD, at least.  Likely further.
     if test -x /sbin/sysctl; then
       lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax`
@@ -1752,7 +1768,7 @@
   sysv5* | sco5v6* | sysv4.2uw2*)
     kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null`
     if test -n "$kargmax"; then
-      lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[[	 ]]//'`
+      lt_cv_sys_max_cmd_len=`echo $kargmax | $SED 's/.*[[	 ]]//'`
     else
       lt_cv_sys_max_cmd_len=32768
     fi
@@ -2202,26 +2218,35 @@
 striplib=
 old_striplib=
 AC_MSG_CHECKING([whether stripping libraries is possible])
-if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
-  test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
-  test -z "$striplib" && striplib="$STRIP --strip-unneeded"
-  AC_MSG_RESULT([yes])
+if test -z "$STRIP"; then
+  AC_MSG_RESULT([no])
 else
-# FIXME - insert some real tests, host_os isn't really good enough
-  case $host_os in
-  darwin*)
-    if test -n "$STRIP"; then
+  if $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
+    old_striplib="$STRIP --strip-debug"
+    striplib="$STRIP --strip-unneeded"
+    AC_MSG_RESULT([yes])
+  else
+    case $host_os in
+    darwin*)
+      # FIXME - insert some real tests, host_os isn't really good enough
       striplib="$STRIP -x"
       old_striplib="$STRIP -S"
       AC_MSG_RESULT([yes])
-    else
+      ;;
+    freebsd*)
+      if $STRIP -V 2>&1 | $GREP "elftoolchain" >/dev/null; then
+        old_striplib="$STRIP --strip-debug"
+        striplib="$STRIP --strip-unneeded"
+        AC_MSG_RESULT([yes])
+      else
+        AC_MSG_RESULT([no])
+      fi
+      ;;
+    *)
       AC_MSG_RESULT([no])
-    fi
-    ;;
-  *)
-    AC_MSG_RESULT([no])
-    ;;
-  esac
+      ;;
+    esac
+  fi
 fi
 _LT_DECL([], [old_striplib], [1], [Commands to strip libraries])
 _LT_DECL([], [striplib], [1])
@@ -2544,7 +2569,7 @@
     case $host_os in
     cygwin*)
       # Cygwin DLLs use 'cyg' prefix rather than 'lib'
-      soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
+      soname_spec='`echo $libname | $SED -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
 m4_if([$1], [],[
       sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"])
       ;;
@@ -2554,14 +2579,14 @@
       ;;
     pw32*)
       # pw32 DLLs use 'pw' prefix rather than 'lib'
-      library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
+      library_names_spec='`echo $libname | $SED -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
       ;;
     esac
     dynamic_linker='Win32 ld.exe'
     ;;
 
-  *,cl*)
-    # Native MSVC
+  *,cl* | *,icl*)
+    # Native MSVC or ICC
     libname_spec='$name'
     soname_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
     library_names_spec='$libname.dll.lib'
@@ -2580,7 +2605,7 @@
       done
       IFS=$lt_save_ifs
       # Convert to MSYS style.
-      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
+      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
       ;;
     cygwin*)
       # Convert to unix form, then to dos form, then back to unix form
@@ -2617,7 +2642,7 @@
     ;;
 
   *)
-    # Assume MSVC wrapper
+    # Assume MSVC and ICC wrapper
     library_names_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext $libname.lib'
     dynamic_linker='Win32 ld.exe'
     ;;
@@ -2650,7 +2675,7 @@
   shlibpath_var=LD_LIBRARY_PATH
   ;;
 
-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
   # DragonFly does not have aout.  When/if they implement a new
   # versioning mechanism, adjust this.
   if test -x /usr/bin/objformat; then
@@ -3449,7 +3474,7 @@
 
 bsdi[[45]]*)
   lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object|dynamic lib)'
-  lt_cv_file_magic_cmd='/usr/bin/file -L'
+  lt_cv_file_magic_cmd='$FILECMD -L'
   lt_cv_file_magic_test_file=/shlib/libc.so
   ;;
 
@@ -3483,14 +3508,14 @@
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     case $host_cpu in
     i*86 )
       # Not sure whether the presence of OpenBSD here was a mistake.
       # Let's accept both of them until this is cleared up.
       lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library'
-      lt_cv_file_magic_cmd=/usr/bin/file
+      lt_cv_file_magic_cmd=$FILECMD
       lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
       ;;
     esac
@@ -3504,7 +3529,7 @@
   ;;
 
 hpux10.20* | hpux11*)
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
   case $host_cpu in
   ia64*)
     lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]|ELF-[[0-9]][[0-9]]) shared object file - IA64'
@@ -3551,7 +3576,7 @@
 
 newos6*)
   lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (executable|dynamic lib)'
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
   lt_cv_file_magic_test_file=/usr/lib/libnls.so
   ;;
 
@@ -3678,13 +3703,13 @@
 	mingw*) lt_bad_file=conftest.nm/nofile ;;
 	*) lt_bad_file=/dev/null ;;
 	esac
-	case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in
+	case `"$tmp_nm" -B $lt_bad_file 2>&1 | $SED '1q'` in
 	*$lt_bad_file* | *'Invalid file or object type'*)
 	  lt_cv_path_NM="$tmp_nm -B"
 	  break 2
 	  ;;
 	*)
-	  case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in
+	  case `"$tmp_nm" -p /dev/null 2>&1 | $SED '1q'` in
 	  */dev/null*)
 	    lt_cv_path_NM="$tmp_nm -p"
 	    break 2
@@ -3710,7 +3735,7 @@
     # Let the user override the test.
   else
     AC_CHECK_TOOLS(DUMPBIN, [dumpbin "link -dump"], :)
-    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in
+    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | $SED '1q'` in
     *COFF*)
       DUMPBIN="$DUMPBIN -symbols -headers"
       ;;
@@ -3950,7 +3975,7 @@
 
 if test "$lt_cv_nm_interface" = "MS dumpbin"; then
   # Gets list of data symbols to import.
-  lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'"
+  lt_cv_sys_global_symbol_to_import="$SED -n -e 's/^I .* \(.*\)$/\1/p'"
   # Adjust the below global symbol transforms to fixup imported variables.
   lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'"
   lt_c_name_hook=" -e 's/^I .* \(.*\)$/  {\"\1\", (void *) 0},/p'"
@@ -3968,20 +3993,20 @@
 # Transform an extracted symbol line into a proper C declaration.
 # Some systems (esp. on ia64) link data and code symbols differently,
 # so use this general approach.
-lt_cv_sys_global_symbol_to_cdecl="sed -n"\
+lt_cv_sys_global_symbol_to_cdecl="$SED -n"\
 $lt_cdecl_hook\
 " -e 's/^T .* \(.*\)$/extern int \1();/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'"
 
 # Transform an extracted symbol line into symbol name and symbol address
-lt_cv_sys_global_symbol_to_c_name_address="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address="$SED -n"\
 $lt_c_name_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/  {\"\1\", (void *) \&\1},/p'"
 
 # Transform an extracted symbol line into symbol name with lib prefix and
 # symbol address.
-lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="$SED -n"\
 $lt_c_name_lib_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(lib.*\)$/  {\"\1\", (void *) \&\1},/p'"\
@@ -4005,7 +4030,7 @@
   if test "$lt_cv_nm_interface" = "MS dumpbin"; then
     # Fake it for dumpbin and say T for any non-static function,
     # D for any global variable and I for any imported variable.
-    # Also find C++ and __fastcall symbols from MSVC++,
+    # Also find C++ and __fastcall symbols from MSVC++ or ICC,
     # which start with @ or ?.
     lt_cv_sys_global_symbol_pipe="$AWK ['"\
 "     {last_section=section; section=\$ 3};"\
@@ -4023,9 +4048,9 @@
 "     s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\
 "     ' prfx=^$ac_symprfx]"
   else
-    lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[[	 ]]\($symcode$symcode*\)[[	 ]][[	 ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
+    lt_cv_sys_global_symbol_pipe="$SED -n -e 's/^.*[[	 ]]\($symcode$symcode*\)[[	 ]][[	 ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
   fi
-  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'"
+  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | $SED '/ __gnu_lto/d'"
 
   # Check to see that the pipe works correctly.
   pipe_works=no
@@ -4312,7 +4337,7 @@
 	    ;;
 	esac
 	;;
-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
 	# FreeBSD uses GNU C++
 	;;
       hpux9* | hpux10* | hpux11*)
@@ -4395,7 +4420,7 @@
 	    _LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@@ -4731,7 +4756,7 @@
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
 	;;
       *)
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [[1-7]].* | *Sun*Fortran*\ 8.[[0-3]]*)
 	  # Sun Fortran 8.3 passes all unrecognized flags to the linker
 	  _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@@ -4914,7 +4939,7 @@
     if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
       _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
     else
-      _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+      _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
     fi
     ;;
   pw32*)
@@ -4922,7 +4947,7 @@
     ;;
   cygwin* | mingw* | cegcc*)
     case $cc_basename in
-    cl*)
+    cl* | icl*)
       _LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*'
       ;;
     *)
@@ -4979,15 +5004,15 @@
 
   case $host_os in
   cygwin* | mingw* | pw32* | cegcc*)
-    # FIXME: the MSVC++ port hasn't been tested in a loooong time
+    # FIXME: the MSVC++ and ICC port hasn't been tested in a loooong time
     # When not using gcc, we currently assume that we are using
-    # Microsoft Visual C++.
+    # Microsoft Visual C++ or Intel C++ Compiler.
     if test yes != "$GCC"; then
       with_gnu_ld=no
     fi
     ;;
   interix*)
-    # we just hope/assume this is gcc and not c89 (= MSVC++)
+    # we just hope/assume this is gcc and not c89 (= MSVC++ or ICC)
     with_gnu_ld=yes
     ;;
   openbsd* | bitrig*)
@@ -5039,7 +5064,7 @@
       _LT_TAGVAR(whole_archive_flag_spec, $1)=
     fi
     supports_anon_versioning=no
-    case `$LD -v | $SED -e 's/([^)]\+)\s\+//' 2>&1` in
+    case `$LD -v | $SED -e 's/([[^)]]\+)\s\+//' 2>&1` in
       *GNU\ gold*) supports_anon_versioning=yes ;;
       *\ [[01]].* | *\ 2.[[0-9]].* | *\ 2.10.*) ;; # catch versions < 2.11
       *\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ...
@@ -5151,6 +5176,7 @@
 	emximp -o $lib $output_objdir/$libname.def'
       _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
       _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+      _LT_TAGVAR(file_list_spec, $1)='@'
       ;;
 
     interix[[3-9]]*)
@@ -5165,7 +5191,7 @@
       # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
       # time.  Moving up from 0x10000000 also allows more sbrk(2) space.
       _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-      _LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+      _LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
       ;;
 
     gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu)
@@ -5208,7 +5234,7 @@
 	  _LT_TAGVAR(compiler_needs_object, $1)=yes
 	  ;;
 	esac
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ C*)			# Sun C 5.9
 	  _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
 	  _LT_TAGVAR(compiler_needs_object, $1)=yes
@@ -5220,7 +5246,7 @@
 
         if test yes = "$supports_anon_versioning"; then
           _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-            cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+            cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
             echo "local: *; };" >> $output_objdir/$libname.ver~
             $CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
         fi
@@ -5236,7 +5262,7 @@
 	  _LT_TAGVAR(archive_cmds, $1)='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib'
 	  if test yes = "$supports_anon_versioning"; then
 	    _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-              cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+              cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
               echo "local: *; };" >> $output_objdir/$libname.ver~
               $LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib'
 	  fi
@@ -5368,7 +5394,7 @@
 	if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
 	  _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
 	else
-	  _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+	  _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
 	fi
 	aix_use_runtimelinking=no
 
@@ -5551,12 +5577,12 @@
 
     cygwin* | mingw* | pw32* | cegcc*)
       # When not using gcc, we currently assume that we are using
-      # Microsoft Visual C++.
+      # Microsoft Visual C++ or Intel C++ Compiler.
       # hardcode_libdir_flag_spec is actually meaningless, as there is
       # no search path for DLLs.
       case $cc_basename in
-      cl*)
-	# Native MSVC
+      cl* | icl*)
+	# Native MSVC or ICC
 	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
 	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
 	_LT_TAGVAR(always_export_symbols, $1)=yes
@@ -5597,7 +5623,7 @@
           fi'
 	;;
       *)
-	# Assume MSVC wrapper
+	# Assume MSVC and ICC wrapper
 	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
 	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
 	# Tell ltmain to make .lib files, not .a files.
@@ -5645,7 +5671,7 @@
       ;;
 
     # FreeBSD 3 and greater uses gcc -shared to do shared libraries.
-    freebsd* | dragonfly*)
+    freebsd* | dragonfly* | midnightbsd*)
       _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
       _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
       _LT_TAGVAR(hardcode_direct, $1)=yes
@@ -5856,6 +5882,7 @@
 	emximp -o $lib $output_objdir/$libname.def'
       _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
       _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+      _LT_TAGVAR(file_list_spec, $1)='@'
       ;;
 
     osf3*)
@@ -6626,8 +6653,8 @@
 
       cygwin* | mingw* | pw32* | cegcc*)
 	case $GXX,$cc_basename in
-	,cl* | no,cl*)
-	  # Native MSVC
+	,cl* | no,cl* | ,icl* | no,icl*)
+	  # Native MSVC or ICC
 	  # hardcode_libdir_flag_spec is actually meaningless, as there is
 	  # no search path for DLLs.
 	  _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
@@ -6725,6 +6752,7 @@
 	  emximp -o $lib $output_objdir/$libname.def'
 	_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
 	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+	_LT_TAGVAR(file_list_spec, $1)='@'
 	;;
 
       dgux*)
@@ -6755,7 +6783,7 @@
         _LT_TAGVAR(archive_cmds_need_lc, $1)=no
         ;;
 
-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
         # FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF
         # conventions
         _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -6892,7 +6920,7 @@
 	# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
 	# time.  Moving up from 0x10000000 also allows more sbrk(2) space.
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-	_LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+	_LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
 	;;
       irix5* | irix6*)
         case $cc_basename in
@@ -7032,13 +7060,13 @@
 	    _LT_TAGVAR(archive_cmds, $1)='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
 	    if test yes = "$supports_anon_versioning"; then
 	      _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-                cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+                cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
                 echo "local: *; };" >> $output_objdir/$libname.ver~
                 $CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
 	    fi
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      _LT_TAGVAR(no_undefined_flag, $1)=' -zdefs'
@@ -8184,6 +8212,14 @@
 AC_SUBST([DLLTOOL])
 ])
 
+# _LT_DECL_FILECMD
+# ----------------
+# Check for a file(cmd) program that can be used to detect file type and magic
+m4_defun([_LT_DECL_FILECMD],
+[AC_CHECK_TOOL([FILECMD], [file], [:])
+_LT_DECL([], [FILECMD], [1], [A file(cmd) program that detects file types])
+])# _LD_DECL_FILECMD
+
 # _LT_DECL_SED
 # ------------
 # Check for a fully-functional sed program, that truncates
diff -Nru shibboleth-sp-3.3.0+dfsg1/m4/lt~obsolete.m4 shibboleth-sp-3.4.1+dfsg/m4/lt~obsolete.m4
--- shibboleth-sp-3.3.0+dfsg1/m4/lt~obsolete.m4	2021-11-29 13:44:26.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/m4/lt~obsolete.m4	2022-10-24 13:49:04.000000000 +0000
@@ -1,7 +1,7 @@
 # lt~obsolete.m4 -- aclocal satisfying obsolete definitions.    -*-Autoconf-*-
 #
-#   Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software
-#   Foundation, Inc.
+#   Copyright (C) 2004-2005, 2007, 2009, 2011-2019, 2021-2022 Free
+#   Software Foundation, Inc.
 #   Written by Scott James Remnant, 2004.
 #
 # This file is free software; the Free Software Foundation gives
diff -Nru shibboleth-sp-3.3.0+dfsg1/m4/ltoptions.m4 shibboleth-sp-3.4.1+dfsg/m4/ltoptions.m4
--- shibboleth-sp-3.3.0+dfsg1/m4/ltoptions.m4	2021-11-29 13:44:25.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/m4/ltoptions.m4	2022-10-24 13:49:04.000000000 +0000
@@ -1,7 +1,7 @@
 # Helper functions for option handling.                    -*- Autoconf -*-
 #
-#   Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software
-#   Foundation, Inc.
+#   Copyright (C) 2004-2005, 2007-2009, 2011-2019, 2021-2022 Free
+#   Software Foundation, Inc.
 #   Written by Gary V. Vaughan, 2004
 #
 # This file is free software; the Free Software Foundation gives
diff -Nru shibboleth-sp-3.3.0+dfsg1/m4/ltsugar.m4 shibboleth-sp-3.4.1+dfsg/m4/ltsugar.m4
--- shibboleth-sp-3.3.0+dfsg1/m4/ltsugar.m4	2021-11-29 13:44:25.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/m4/ltsugar.m4	2022-10-24 13:49:04.000000000 +0000
@@ -1,6 +1,6 @@
 # ltsugar.m4 -- libtool m4 base layer.                         -*-Autoconf-*-
 #
-# Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software
+# Copyright (C) 2004-2005, 2007-2008, 2011-2019, 2021-2022 Free Software
 # Foundation, Inc.
 # Written by Gary V. Vaughan, 2004
 #
diff -Nru shibboleth-sp-3.3.0+dfsg1/m4/ltversion.m4 shibboleth-sp-3.4.1+dfsg/m4/ltversion.m4
--- shibboleth-sp-3.3.0+dfsg1/m4/ltversion.m4	2021-11-29 13:44:26.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/m4/ltversion.m4	2022-10-24 13:49:04.000000000 +0000
@@ -1,6 +1,7 @@
 # ltversion.m4 -- version numbers			-*- Autoconf -*-
 #
-#   Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc.
+#   Copyright (C) 2004, 2011-2019, 2021-2022 Free Software Foundation,
+#   Inc.
 #   Written by Scott James Remnant, 2004
 #
 # This file is free software; the Free Software Foundation gives
@@ -9,15 +10,15 @@
 
 # @configure_input@
 
-# serial 4179 ltversion.m4
+# serial 4245 ltversion.m4
 # This file is part of GNU Libtool
 
-m4_define([LT_PACKAGE_VERSION], [2.4.6])
-m4_define([LT_PACKAGE_REVISION], [2.4.6])
+m4_define([LT_PACKAGE_VERSION], [2.4.7])
+m4_define([LT_PACKAGE_REVISION], [2.4.7])
 
 AC_DEFUN([LTVERSION_VERSION],
-[macro_version='2.4.6'
-macro_revision='2.4.6'
+[macro_version='2.4.7'
+macro_revision='2.4.7'
 _LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])
 _LT_DECL(, macro_revision, 0)
 ])
diff -Nru shibboleth-sp-3.3.0+dfsg1/Makefile.in shibboleth-sp-3.4.1+dfsg/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -230,7 +230,7 @@
 	$(top_srcdir)/build-aux/install-sh \
 	$(top_srcdir)/build-aux/ltmain.sh \
 	$(top_srcdir)/build-aux/missing build-aux/compile \
-	build-aux/config.guess build-aux/config.sub \
+	build-aux/config.guess build-aux/config.sub build-aux/depcomp \
 	build-aux/install-sh build-aux/ltmain.sh build-aux/missing
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
@@ -365,6 +365,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/memcache-store/Makefile.in shibboleth-sp-3.4.1+dfsg/memcache-store/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/memcache-store/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/memcache-store/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -303,6 +303,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/nsapi_shib/Makefile.in shibboleth-sp-3.4.1+dfsg/nsapi_shib/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/nsapi_shib/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/nsapi_shib/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -306,6 +306,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/odbc-store/Makefile.in shibboleth-sp-3.4.1+dfsg/odbc-store/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/odbc-store/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/odbc-store/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -302,6 +302,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/plugins/Makefile.in shibboleth-sp-3.4.1+dfsg/plugins/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/plugins/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/plugins/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -345,6 +345,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/Projects/vc15/shibsp/shibsp-lite.vcxproj shibboleth-sp-3.4.1+dfsg/Projects/vc15/shibsp/shibsp-lite.vcxproj
--- shibboleth-sp-3.3.0+dfsg1/Projects/vc15/shibsp/shibsp-lite.vcxproj	2021-10-19 19:04:27.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/Projects/vc15/shibsp/shibsp-lite.vcxproj	2022-10-26 15:11:22.000000000 +0000
@@ -92,10 +92,10 @@
     <CodeAnalysisRuleSet Condition="'$(Configuration)|$(Platform)'=='Release|x64'">AllRules.ruleset</CodeAnalysisRuleSet>
     <CodeAnalysisRules Condition="'$(Configuration)|$(Platform)'=='Release|x64'" />
     <CodeAnalysisRuleAssemblies Condition="'$(Configuration)|$(Platform)'=='Release|x64'" />
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">$(ProjectName)3_3</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='Release|x64'">$(ProjectName)3_3</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">$(ProjectName)3_3D</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">$(ProjectName)3_3D</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">$(ProjectName)3_4</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='Release|x64'">$(ProjectName)3_4</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">$(ProjectName)3_4D</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">$(ProjectName)3_4D</TargetName>
   </PropertyGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <ClCompile>
@@ -321,4 +321,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
\ No newline at end of file
+</Project>
diff -Nru shibboleth-sp-3.3.0+dfsg1/Projects/vc15/shibsp/shibsp.vcxproj shibboleth-sp-3.4.1+dfsg/Projects/vc15/shibsp/shibsp.vcxproj
--- shibboleth-sp-3.3.0+dfsg1/Projects/vc15/shibsp/shibsp.vcxproj	2021-10-19 19:04:27.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/Projects/vc15/shibsp/shibsp.vcxproj	2022-10-26 15:11:09.000000000 +0000
@@ -90,10 +90,10 @@
     <CodeAnalysisRuleSet Condition="'$(Configuration)|$(Platform)'=='Release|x64'">AllRules.ruleset</CodeAnalysisRuleSet>
     <CodeAnalysisRules Condition="'$(Configuration)|$(Platform)'=='Release|x64'" />
     <CodeAnalysisRuleAssemblies Condition="'$(Configuration)|$(Platform)'=='Release|x64'" />
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">$(ProjectName)3_3D</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">$(ProjectName)3_3D</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">$(ProjectName)3_3</TargetName>
-    <TargetName Condition="'$(Configuration)|$(Platform)'=='Release|x64'">$(ProjectName)3_3</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">$(ProjectName)3_4D</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">$(ProjectName)3_4D</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">$(ProjectName)3_4</TargetName>
+    <TargetName Condition="'$(Configuration)|$(Platform)'=='Release|x64'">$(ProjectName)3_4</TargetName>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <IntDir>$(SolutionDir)..\..\Build\VC15\$(projectName)\$(Platform)\$(Configuration)\</IntDir>
@@ -389,4 +389,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
\ No newline at end of file
+</Project>
diff -Nru shibboleth-sp-3.3.0+dfsg1/schemas/Makefile.in shibboleth-sp-3.4.1+dfsg/schemas/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/schemas/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/schemas/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -247,6 +247,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/schemas/shibboleth-3.0-native-sp-config.xsd shibboleth-sp-3.4.1+dfsg/schemas/shibboleth-3.0-native-sp-config.xsd
--- shibboleth-sp-3.3.0+dfsg1/schemas/shibboleth-3.0-native-sp-config.xsd	2021-11-01 17:43:34.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/schemas/shibboleth-3.0-native-sp-config.xsd	2022-10-24 13:48:53.000000000 +0000
@@ -9,7 +9,7 @@
 	elementFormDefault="qualified"
 	attributeFormDefault="unqualified"
 	blockDefault="substitution"
-	version="3.2">
+	version="3.4">
 
   <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd" />
   <import namespace="urn:oasis:names:tc:SAML:2.0:assertion" schemaLocation="saml-schema-assertion-2.0.xsd"/>
@@ -877,6 +877,7 @@
               <attribute name="clientPort" type="unsignedInt"/>
               <attribute name="acl" type="conf:listOfStrings"/>
               <attribute name="stackSize" type="unsignedInt"/>
+              <attribute name="retryErrors" type="conf:string"/>
             </complexType>
           </element>
           <element name="Listener" type="conf:PluggableType"/>
diff -Nru shibboleth-sp-3.3.0+dfsg1/selinux/Makefile.in shibboleth-sp-3.4.1+dfsg/selinux/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/selinux/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/selinux/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -247,6 +247,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibboleth.spec shibboleth-sp-3.4.1+dfsg/shibboleth.spec
--- shibboleth-sp-3.3.0+dfsg1/shibboleth.spec	2021-11-29 13:50:23.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibboleth.spec	2023-01-09 21:52:35.000000000 +0000
@@ -1,5 +1,5 @@
 Name:		shibboleth
-Version:	3.3.0
+Version:	3.4.1
 Release:	1
 Summary:	Open source system for attribute-based Web SSO
 Group:		Productivity/Networking/Security
@@ -10,7 +10,7 @@
 BuildRoot:	%{_tmppath}/%{name}-sp-%{version}-root
 Obsoletes:	shibboleth-sp = 2.5.0
 Requires:	openssl
-%if 0%{?rhel} >= 6 || 0%{?amzn} >= 1
+%if 0%{?rhel} >= 6 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 PreReq:		xmltooling-schemas%{?_isa} >= 3.2.0, opensaml-schemas%{?_isa} >= 3.2.0
 %else
 PreReq:		xmltooling-schemas >= 3.2.0, opensaml-schemas >= 3.2.0
@@ -33,7 +33,7 @@
 BuildRequires:	libsaml-devel >= 3.2.0
 %{?_with_log4cpp:BuildRequires: liblog4cpp-devel >= 1.0}
 %{!?_with_log4cpp:BuildRequires: liblog4shib-devel >= 2}
-%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} >= 1
+%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 Requires:	libcurl-openssl%{?_isa} >= 7.21.7
 BuildRequires:	chrpath
 %endif
@@ -50,7 +50,7 @@
 %endif
 %{?_with_memcached:BuildRequires: libmemcached-devel}
 %if "%{_vendor}" == "redhat" || "%{_vendor}" == "amazon"
-%if 0%{?rhel} >= 6 || 0%{?amzn} >= 1
+%if 0%{?rhel} >= 6 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 %{!?_without_builtinapache:BuildRequires: httpd-devel%{?_isa}}
 %else
 %{!?_without_builtinapache:BuildRequires: httpd-devel}
@@ -222,7 +222,7 @@
 Type=notify
 NotifyAccess=main
 User=%{runuser}
-%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} >= 1
+%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 Environment=LD_LIBRARY_PATH=/opt/shibboleth/%{_lib}
 %endif
 ExecStart=%{_sbindir}/shibd -f -F
@@ -251,7 +251,7 @@
 # Wait period (secs) for configuration (and metadata) to load
 SHIBD_WAIT=30
 EOF
-	%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} >= 1
+	%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 		cat >> $SYSCONFIG_SHIBD <<EOF
 
 # Override OS-supplied libcurl
@@ -260,7 +260,7 @@
 	%endif
 fi
 
-%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} >= 1
+%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 	# Strip existing rpath to libcurl.
 	chrpath -d $RPM_BUILD_ROOT%{_sbindir}/shibd
 	chrpath -d $RPM_BUILD_ROOT%{_bindir}/mdquery
@@ -481,6 +481,9 @@
 %doc %{pkgdocdir}/api
 
 %changelog
+* Wed Nov 2 2022 Scott Cantor <cantor.2@osu.edu> - 3.4.0-1
+- Version bump
+
 * Thu Apr 22 2021 Scott Cantor <cantor.2@osu.edu> - 3.2.2-1
 - Fix devel dependency versions
 
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibboleth.spec.in shibboleth-sp-3.4.1+dfsg/shibboleth.spec.in
--- shibboleth-sp-3.3.0+dfsg1/shibboleth.spec.in	2021-10-05 19:20:47.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibboleth.spec.in	2022-11-02 14:52:22.000000000 +0000
@@ -10,7 +10,7 @@
 BuildRoot:	%{_tmppath}/%{name}-sp-%{version}-root
 Obsoletes:	shibboleth-sp = 2.5.0
 Requires:	openssl
-%if 0%{?rhel} >= 6 || 0%{?amzn} >= 1
+%if 0%{?rhel} >= 6 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 PreReq:		xmltooling-schemas%{?_isa} >= 3.2.0, opensaml-schemas%{?_isa} >= 3.2.0
 %else
 PreReq:		xmltooling-schemas >= 3.2.0, opensaml-schemas >= 3.2.0
@@ -33,7 +33,7 @@
 BuildRequires:	libsaml-devel >= 3.2.0
 %{?_with_log4cpp:BuildRequires: liblog4cpp-devel >= 1.0}
 %{!?_with_log4cpp:BuildRequires: liblog4shib-devel >= 2}
-%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} >= 1
+%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 Requires:	libcurl-openssl%{?_isa} >= 7.21.7
 BuildRequires:	chrpath
 %endif
@@ -50,7 +50,7 @@
 %endif
 %{?_with_memcached:BuildRequires: libmemcached-devel}
 %if "%{_vendor}" == "redhat" || "%{_vendor}" == "amazon"
-%if 0%{?rhel} >= 6 || 0%{?amzn} >= 1
+%if 0%{?rhel} >= 6 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 %{!?_without_builtinapache:BuildRequires: httpd-devel%{?_isa}}
 %else
 %{!?_without_builtinapache:BuildRequires: httpd-devel}
@@ -222,7 +222,7 @@
 Type=notify
 NotifyAccess=main
 User=%{runuser}
-%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} >= 1
+%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 Environment=LD_LIBRARY_PATH=/opt/shibboleth/%{_lib}
 %endif
 ExecStart=%{_sbindir}/shibd -f -F
@@ -251,7 +251,7 @@
 # Wait period (secs) for configuration (and metadata) to load
 SHIBD_WAIT=30
 EOF
-	%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} >= 1
+	%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 		cat >> $SYSCONFIG_SHIBD <<EOF
 
 # Override OS-supplied libcurl
@@ -260,7 +260,7 @@
 	%endif
 fi
 
-%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} >= 1
+%if 0%{?rhel} == 6 || 0%{?rhel} == 7 || 0%{?amzn} == 1 || 0%{?amzn} == 2
 	# Strip existing rpath to libcurl.
 	chrpath -d $RPM_BUILD_ROOT%{_sbindir}/shibd
 	chrpath -d $RPM_BUILD_ROOT%{_bindir}/mdquery
@@ -481,6 +481,9 @@
 %doc %{pkgdocdir}/api
 
 %changelog
+* Wed Nov 2 2022 Scott Cantor <cantor.2@osu.edu> - 3.4.0-1
+- Version bump
+
 * Thu Apr 22 2021 Scott Cantor <cantor.2@osu.edu> - 3.2.2-1
 - Fix devel dependency versions
 
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibd/Makefile.in shibboleth-sp-3.4.1+dfsg/shibd/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/shibd/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibd/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -275,6 +275,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp shibboleth-sp-3.4.1+dfsg/shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp
--- shibboleth-sp-3.3.0+dfsg1/shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp	2021-10-05 19:20:47.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/attribute/filtering/impl/AttributeMatchesShibMDScopeFunctor.cpp	2022-10-24 14:11:34.000000000 +0000
@@ -48,7 +48,9 @@
     class SHIBSP_DLLLOCAL AbstractAttributeMatchesShibMDScopeFunctor : public MatchFunctor
     {
     public:
-        bool evaluatePolicyRequirement(const FilteringContext& filterContext) const {
+        AbstractAttributeMatchesShibMDScopeFunctor() : m_log(Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter")) {}
+
+        bool evaluatePolicyRequirement(const FilteringContext&) const {
             throw AttributeFilteringException("Metadata scope matching not usable as a PolicyRequirement.");
         }
 
@@ -58,8 +60,10 @@
                 return false;
 
             const char* s = getStringToMatch(attribute, index);
-            if (!s || !*s)
+            if (!s || !*s) {
+                m_log.warn("attribute (%s) missing scope", attribute.getId());
                 return false;
+            }
             auto_arrayptr<XMLCh> widestr(fromUTF8(s));
 
             const Scope* rule;
@@ -85,6 +89,7 @@
                 }
             }
 
+            m_log.warn("attribute (%s) invalid scope (%s)", attribute.getId(), s);
             return false;
         }
 
@@ -92,6 +97,8 @@
         virtual const char* getStringToMatch(const Attribute& attribute, size_t index) const = 0;
 
     private:
+        Category& m_log;
+
         bool matches(const Scope& rule, auto_arrayptr<XMLCh>& scope) const {
             const XMLCh* val = rule.getValue();
             if (val && *val) {
@@ -129,12 +136,12 @@
         }
     };
 
-    MatchFunctor* SHIBSP_DLLLOCAL AttributeScopeMatchesShibMDScopeFactory(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
+    MatchFunctor* SHIBSP_DLLLOCAL AttributeScopeMatchesShibMDScopeFactory(const pair<const FilterPolicyContext*,const DOMElement*>&, bool)
     {
         return new AttributeScopeMatchesShibMDScopeFunctor();
     }
 
-    MatchFunctor* SHIBSP_DLLLOCAL AttributeValueMatchesShibMDScopeFactory(const pair<const FilterPolicyContext*,const DOMElement*>& p, bool)
+    MatchFunctor* SHIBSP_DLLLOCAL AttributeValueMatchesShibMDScopeFactory(const pair<const FilterPolicyContext*,const DOMElement*>&, bool)
     {
         return new AttributeValueMatchesShibMDScopeFunctor();
     }
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/impl/XMLApplication.cpp shibboleth-sp-3.4.1+dfsg/shibsp/impl/XMLApplication.cpp
--- shibboleth-sp-3.3.0+dfsg1/shibsp/impl/XMLApplication.cpp	2021-11-01 17:43:34.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/impl/XMLApplication.cpp	2023-01-09 22:05:59.000000000 +0000
@@ -175,8 +175,12 @@
                 }
             }
         }
+        else if (base) {
+            m_redirectLimit = REDIRECT_LIMIT_INHERIT;
+        }
         else {
-            m_redirectLimit = base ? REDIRECT_LIMIT_INHERIT : REDIRECT_LIMIT_NONE;
+            m_redirectLimit = REDIRECT_LIMIT_NONE;
+            log.warn("redirectLimit not set, system will operate as an open redirector if not corrected");
         }
 
         // Audit some additional settings for logging purposes.
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/impl/XMLSecurityPolicyProvider.cpp shibboleth-sp-3.4.1+dfsg/shibsp/impl/XMLSecurityPolicyProvider.cpp
--- shibboleth-sp-3.3.0+dfsg1/shibsp/impl/XMLSecurityPolicyProvider.cpp	2021-11-01 17:43:34.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/impl/XMLSecurityPolicyProvider.cpp	2022-10-19 12:16:08.000000000 +0000
@@ -268,7 +268,7 @@
             m_excludeDefaults = false;
         }
         else {
-            const DOMElement* alglist = XMLHelper::getLastChildElement(e, ExcludedAlgorithms);
+            alglist = XMLHelper::getLastChildElement(e, ExcludedAlgorithms);
             if (alglist) {
                 m_excludeDefaults = XMLHelper::getAttrBool(alglist, true, excludeDefaults);
                 if (alglist->hasChildNodes()) {
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/Makefile.am shibboleth-sp-3.4.1+dfsg/shibsp/Makefile.am
--- shibboleth-sp-3.3.0+dfsg1/shibsp/Makefile.am	2021-10-19 19:04:27.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/Makefile.am	2023-01-09 21:45:35.000000000 +0000
@@ -244,7 +244,7 @@
 
 # this is different from the project version
 # http://sources.redhat.com/autobook/autobook/autobook_91.html
-libshibsp_la_LDFLAGS = -version-info 10:3:0
+libshibsp_la_LDFLAGS = -version-info 11:1:0
 libshibsp_la_CXXFLAGS = \
     $(AM_CXXFLAGS) \
     $(BOOST_CPPFLAGS) \
@@ -263,7 +263,7 @@
     $(xerces_LIBS) \
     $(xmlsec_LIBS) \
     $(xmltooling_LIBS)
-libshibsp_lite_la_LDFLAGS = -version-info 10:3:0
+libshibsp_lite_la_LDFLAGS = -version-info 11:1:0
 libshibsp_lite_la_CXXFLAGS = -DSHIBSP_LITE \
     $(AM_CXXFLAGS) \
     $(BOOST_CPPFLAGS) \
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/Makefile.in shibboleth-sp-3.4.1+dfsg/shibsp/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/shibsp/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -694,6 +694,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
@@ -1066,7 +1067,7 @@
 
 # this is different from the project version
 # http://sources.redhat.com/autobook/autobook/autobook_91.html
-libshibsp_la_LDFLAGS = -version-info 10:3:0
+libshibsp_la_LDFLAGS = -version-info 11:1:0
 libshibsp_la_CXXFLAGS = \
     $(AM_CXXFLAGS) \
     $(BOOST_CPPFLAGS) \
@@ -1087,7 +1088,7 @@
     $(xmlsec_LIBS) \
     $(xmltooling_LIBS)
 
-libshibsp_lite_la_LDFLAGS = -version-info 10:3:0
+libshibsp_lite_la_LDFLAGS = -version-info 11:1:0
 libshibsp_lite_la_CXXFLAGS = -DSHIBSP_LITE \
     $(AM_CXXFLAGS) \
     $(BOOST_CPPFLAGS) \
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/metadata/DynamicMetadataProvider.cpp shibboleth-sp-3.4.1+dfsg/shibsp/metadata/DynamicMetadataProvider.cpp
--- shibboleth-sp-3.3.0+dfsg1/shibsp/metadata/DynamicMetadataProvider.cpp	2021-10-05 19:20:47.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/metadata/DynamicMetadataProvider.cpp	2023-01-10 15:31:20.000000000 +0000
@@ -193,6 +193,10 @@
     if (!m_cacheDir.empty()) {
         XMLToolingConfig::getConfig().getPathResolver()->resolve(m_cacheDir, PathResolver::XMLTOOLING_CACHE_FILE);
         m_backgroundInit = XMLHelper::getAttrBool(e, true, backgroundInit);
+        if (m_backgroundInit && SPConfig::getConfig().isEnabled(SPConfig::RequestMapping)) {
+            m_backgroundInit = false;
+            m_log.info("disabling background initialization for configuration test");
+        }
     }
 }
 
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/remoting/impl/SocketListener.cpp shibboleth-sp-3.4.1+dfsg/shibsp/remoting/impl/SocketListener.cpp
--- shibboleth-sp-3.3.0+dfsg1/shibsp/remoting/impl/SocketListener.cpp	2021-10-05 19:20:47.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/remoting/impl/SocketListener.cpp	2023-01-09 21:50:53.000000000 +0000
@@ -34,6 +34,9 @@
 #include <stack>
 #include <sstream>
 #include <boost/lexical_cast.hpp>
+#include <boost/algorithm/string.hpp>
+#include <boost/algorithm/string/classification.hpp>
+#include <boost/algorithm/string/split.hpp>
 #include <xercesc/sax/SAXException.hpp>
 #include <xercesc/util/XMLUniDefs.hpp>
 #include <xercesc/util/OutOfMemoryException.hpp>
@@ -223,6 +226,16 @@
     return true;
 }
 
+void SocketListener::set_retry_errors(const string& retry_errors)
+{
+    const char* error_list = retry_errors.c_str();
+    std::vector<string> string_list;
+    boost::split(string_list, error_list, boost::is_any_of(", \t"), boost::token_compress_on);
+    for (vector<string>::const_iterator i = string_list.begin(); i != string_list.end(); ++i) {
+        m_retry_errors.push_back(atoi(i->c_str()));
+    }
+}
+
 bool SocketListener::run(bool* shutdown)
 {
 #ifdef _DEBUG
@@ -325,31 +338,68 @@
         if (send(sock,(char*)&len,sizeof(len)) != sizeof(len) || send(sock,ostr.c_str(),outlen) != outlen) {
             log_error();
             this->close(sock);
-            if (retry)
+            if (retry) {
                 retry--;
+                log->debug("retrying failed send");
+            }
             else
                 throw ListenerException("Failure sending remoted message ($1).", params(1,in.name()));
         }
         else {
             // SUCCESS.
+            log->debug("send completed, reading response message");
+
+            // Read the message size.
+            int size_read;
+            bool retry_error = false;
+            while ((size_read = recv(sock,(char*)&len,sizeof(len))) != sizeof(len)) {
+                // Apparently this happens when a signal interrupts the blocking call.
+                if (errno == EINTR) continue;
+
+                int native_error;
+                if (size_read == -1) {
+                    log_error("reading size of output message", &native_error);
+                }
+                else {
+                    log->error("error reading size of output message (%d != %d)", size_read, sizeof(len));
+                    native_error = 0;
+                }
+                this->close(sock);
+
+                if (std::find(m_retry_errors.begin(), m_retry_errors.end(), native_error) != m_retry_errors.end()) {
+                    log->debug("recv error %d is retryable", native_error);
+                    if (retry) {
+                        retry_error = true;
+                        retry--;
+                        break;
+                    }
+                    else {
+                        log->debug("not retrying on second failure");
+                    }
+                }
+                else {
+                      log->debug("recv error %d is not retryable", native_error);
+                }
+
+                throw ListenerException("Failure receiving response to remoted message ($1).", params(1,in.name()));
+            }
+
+            // If recv had retryable error restart loop and try again
+            if (retry_error) {
+                log->debug("retrying");
+                retry_error = false;
+                continue;
+            }
+
+            len = ntohl(len);
             retry = -1;
         }
     }
 
-    log->debug("send completed, reading response message");
-
     // Read the message.
-    while (recv(sock,(char*)&len,sizeof(len)) != sizeof(len)) {
-    	if (errno == EINTR) continue;	// Apparently this happens when a signal interrupts the blocking call.
-        log->error("error reading size of output message");
-        this->close(sock);
-        throw ListenerException("Failure receiving response to remoted message ($1).", params(1,in.name()));
-    }
-    len = ntohl(len);
-
     char buf[16384];
-    int size_read;
     stringstream is;
+    int size_read;
     while (len) {
     	size_read = recv(sock, buf, sizeof(buf));
     	if (size_read > 0) {
@@ -362,7 +412,7 @@
     }
 
     if (len) {
-        log->error("error reading output message from socket");
+        log_error("reading output message");
         this->close(sock);
         throw ListenerException("Failure receiving response to remoted message ($1).", params(1,in.name()));
     }
@@ -395,19 +445,27 @@
     return out;
 }
 
-bool SocketListener::log_error(const char* fn) const
+bool SocketListener::log_error(const char* fn, int* native_error) const
 {
     if (!fn)
         fn = "unknown";
 #ifdef WIN32
     int rc=WSAGetLastError();
+#else
+    int rc=errno;
+#endif
+    if (native_error != nullptr)
+        *native_error = rc;
+
+#ifdef WIN32
     if (rc == WSAECONNRESET) {
+#else
+    if (rc == ECONNRESET) {
+#endif
         log->debug("socket connection reset");
         return false;
     }
-#else
-    int rc=errno;
-#endif
+
     const char *msg;
 #ifdef HAVE_STRERROR_R
     char buf[256];
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/remoting/impl/SocketListener.h shibboleth-sp-3.4.1+dfsg/shibsp/remoting/impl/SocketListener.h
--- shibboleth-sp-3.3.0+dfsg1/shibsp/remoting/impl/SocketListener.h	2021-10-05 19:20:47.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/remoting/impl/SocketListener.h	2022-10-24 13:37:53.000000000 +0000
@@ -79,13 +79,16 @@
 
         bool m_catchAll;
     protected:
-        bool log_error(const char* fn=nullptr) const; // for OS-level errors
+        void set_retry_errors(const std::string& retry_errors);
+        bool log_error(const char* fn=nullptr, int* native_error=nullptr) const; // for OS-level errors
         xmltooling::logging::Category* log;
         /// @endcond
 
     private:
+
         boost::scoped_ptr<SocketPool> m_socketpool;
         bool* m_shutdown;
+        std::vector<int> m_retry_errors;
 
         // Manage child threads
         friend class ServerThread;
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/remoting/impl/TCPListener.cpp shibboleth-sp-3.4.1+dfsg/shibsp/remoting/impl/TCPListener.cpp
--- shibboleth-sp-3.3.0+dfsg1/shibsp/remoting/impl/TCPListener.cpp	2021-10-05 19:20:47.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/remoting/impl/TCPListener.cpp	2022-10-24 13:23:24.000000000 +0000
@@ -108,6 +108,7 @@
     static const XMLCh acl[] = UNICODE_LITERAL_3(a,c,l);
     static const XMLCh clientAddress[] = UNICODE_LITERAL_13(c,l,i,e,n,t,A,d,d,r,e,s,s);
     static const XMLCh clientPort[] = UNICODE_LITERAL_10(c,l,i,e,n,t,P,o,r,t);
+    static const XMLCh retryErrors[] = UNICODE_LITERAL_11(r,e,t,r,y,E,r,r,o,r,s);
 };
 
 TCPListener::TCPListener(const DOMElement* e) : SocketListener(e), m_port(0)
@@ -116,6 +117,17 @@
     if (SPConfig::getConfig().isEnabled(SPConfig::InProcess)) {
         m_address = XMLHelper::getAttrString(e, nullptr, clientAddress);
         m_port = XMLHelper::getAttrInt(e, 0, clientPort);
+        string retry_errors = XMLHelper::getAttrString(e, nullptr, retryErrors);
+        if (!retry_errors.empty()) {
+            if (retry_errors.find_first_not_of("0123456789, \t") == std::string::npos) {
+                log->info("retrying on error codes: %s", retry_errors.c_str());
+                set_retry_errors(retry_errors);
+            }
+            else {
+                log->error("invalid characters in retryErrors, skipping");
+            }
+
+        }
     }
 
     // Back-off to address setting, environment, or default.
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/shibsp.rc shibboleth-sp-3.4.1+dfsg/shibsp/shibsp.rc
--- shibboleth-sp-3.3.0+dfsg1/shibsp/shibsp.rc	2021-11-19 14:11:07.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/shibsp.rc	2023-01-09 21:46:07.000000000 +0000
@@ -53,35 +53,35 @@
 #endif
 #ifdef SHIBSP_LITE
 #ifdef _DEBUG
-            VALUE "InternalName", "shibsp-lite3_3D\0"
+            VALUE "InternalName", "shibsp-lite3_4D\0"
 #else
-            VALUE "InternalName", "shibsp-lite3_3\0"
+            VALUE "InternalName", "shibsp-lite3_4\0"
 #endif
 #else
 #ifdef _DEBUG
-            VALUE "InternalName", "shibsp3_3D\0"
+            VALUE "InternalName", "shibsp3_4D\0"
 #else
-            VALUE "InternalName", "shibsp3_3\0"
+            VALUE "InternalName", "shibsp3_4\0"
 #endif
 #endif
-            VALUE "LegalCopyright", "Copyright 2021 Various\0"
+            VALUE "LegalCopyright", "Copyright 2023 Various\0"
             VALUE "LegalTrademarks", "\0"
 #ifdef SHIBSP_LITE
 #ifdef _DEBUG
-            VALUE "OriginalFilename", "shibsp-lite3_3D.dll\0"
+            VALUE "OriginalFilename", "shibsp-lite3_4D.dll\0"
 #else
-            VALUE "OriginalFilename", "shibsp-lite3_3.dll\0"
+            VALUE "OriginalFilename", "shibsp-lite3_4.dll\0"
 #endif
 #else
 #ifdef _DEBUG
-            VALUE "OriginalFilename", "shibsp3_3D.dll\0"
+            VALUE "OriginalFilename", "shibsp3_4D.dll\0"
 #else
-            VALUE "OriginalFilename", "shibsp3_3.dll\0"
+            VALUE "OriginalFilename", "shibsp3_4.dll\0"
 #endif
 #endif
             VALUE "PrivateBuild", "\0"
-            VALUE "ProductName", "Shibboleth 3.3.0\0"
-            VALUE "ProductVersion", "3, 3, 0, 0\0"
+            VALUE "ProductName", "Shibboleth 3.4.1\0"
+            VALUE "ProductVersion", "3, 4, 1, 0\0"
             VALUE "SpecialBuild", "\0"
         END
     END
diff -Nru shibboleth-sp-3.3.0+dfsg1/shibsp/version.h shibboleth-sp-3.4.1+dfsg/shibsp/version.h
--- shibboleth-sp-3.3.0+dfsg1/shibsp/version.h	2021-10-19 19:04:27.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/shibsp/version.h	2023-01-09 21:44:54.000000000 +0000
@@ -43,8 +43,8 @@
  */
 
 #define SHIBSP_VERSION_MAJOR 3
-#define SHIBSP_VERSION_MINOR 3
-#define SHIBSP_VERSION_REVISION 0
+#define SHIBSP_VERSION_MINOR 4
+#define SHIBSP_VERSION_REVISION 1
 
 /** DO NOT MODIFY BELOW THIS LINE */
 
diff -Nru shibboleth-sp-3.3.0+dfsg1/unittests/Makefile.in shibboleth-sp-3.4.1+dfsg/unittests/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/unittests/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/unittests/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -488,6 +488,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@
diff -Nru shibboleth-sp-3.3.0+dfsg1/util/Makefile.in shibboleth-sp-3.4.1+dfsg/util/Makefile.in
--- shibboleth-sp-3.3.0+dfsg1/util/Makefile.in	2021-11-29 13:44:30.000000000 +0000
+++ shibboleth-sp-3.4.1+dfsg/util/Makefile.in	2023-01-09 21:52:08.000000000 +0000
@@ -285,6 +285,7 @@
 FASTCGI_LDFLAGS = @FASTCGI_LDFLAGS@
 FASTCGI_LIBS = @FASTCGI_LIBS@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 GSS_VENDOR = @GSS_VENDOR@
 INSTALL = @INSTALL@