Monthly Archives: August 2016

MKVToolNix v9.4.0 released

Time for the next release of MKVToolNix. This time it’s really just polishing of existing functionality.

Dear package maintainers: I have to say again that MKVToolNix v9.3.1 and later requires the recently released libEBML v1.3.4 and libMatroska v1.4.5. Even though both libraries are API and ABI compatible with their prior releases this only means that a program compiled against an older version of the library will still work when run against a newer version of the library.

However, MKVToolNix v9.3.1 and newer use features newly introduced in libMatroska v1.4.4. This means that you cannot compile MKVToolNix v1.4.5 and try to run it against v1.4.4 — that’ll fail with symbol lookup errors from ld.

I’ve received multiple reports of MKVToolNix v9.3.x packages that could be installed with libMatroska v1.4.4. This won’t work. Please make the dependency on v1.4.5+ explicit. Thanks.

You can download the source code or one of the binaries. The Windows and Mac OS binaries are available. Most of the Linux binaries are still being built and will be available in a couple of hours.

Here’s the full ChangeLog since the previous release:

  • 2016-08-22 Moritz Bunkus <moritz@bunkus.org>
    • Released v9.4.0 "Knurl".
  • 2016-08-16 Moritz Bunkus <moritz@bunkus.org>
    • mkvpropedit: bug fix: mkvpropedit will no longer say that it’s writing the changes if only attachment changes are specified and none of the specified attachments can be found.
  • 2016-08-11 Moritz Bunkus <moritz@bunkus.org>
    • MKVToolNix GUI: chapter editor bug fix: overly long chapter names don’t cause the GUI’s window to become overly wide anymore. Fixes #1760.
  • 2016-08-10 Moritz Bunkus <moritz@bunkus.org>
    • mkvmerge: DTS bug fix: if present mkvmerge will use an XLL extension’s sample rate information as the sample rate to put into the track headers. Fixes #1762.
  • 2016-08-06 Moritz Bunkus <moritz@bunkus.org>
    • mkvmerge: new feature: added support for reading Apple ProRes video from MOV/MP4 files. Patch by Chao Chen (see AUTHORS).
  • 2016-08-02 Moritz Bunkus <moritz@bunkus.org>
    • mkvmerge: bug fix: when appending files mkvmerge wasn’t starting clusters on video key frame anymore for the first and all following appended files. Fixes #1757.
  • 2016-07-31 Moritz Bunkus <moritz@bunkus.org>
    • MKVToolNix GUI: merge tool enhancement: when adding attachments the GUI will check if there are attachments or attached files with the same name as the file to add. If so the GUI will tell the user and ask for confirmation.
  • 2016-07-30 Moritz Bunkus <moritz@bunkus.org>
    • mkvmerge: enhancement: mkvmerge now accepts file names in square brackets for appending files, e.g. "mvkmerge -o out.mkv [ in1.avi in2.avi in3.avi ]" instead of "mkvmerge -o out.mkv in1.avi + in2.avi + in3.avi".
  • 2016-07-29 Moritz Bunkus <moritz@bunkus.org>
    • mkvmerge: bug fix: VP8 in Ogg: fixed dropping the first frame and the timestamp calculation. Fixes #1754.
    • mkvmerge: bug fix: mkvmerge does no longer emit a warning if no comment header packet is found when reading tracks from Ogg/OGM files. See #1754.
  • 2016-07-19 Moritz Bunkus <moritz@bunkus.org>
    • MKVToolNix GUI: merge tool enhancement: the "select a play list to add" dialog does now contain a column with the number of chapters for each play list found.
    • MKVToolNix GUI: job queue enhancement: dragging & dropping a valid .mtxcfg file (either a full job file or one containing only merge settings without the job properties) onto the job queue window will import the dropped .mtxcfg job into the job queue. Rest of the implementation of #1714.
  • 2016-07-18 Moritz Bunkus <moritz@bunkus.org>
    • MKVToolNix GUI: merge tool enhancement: dragging & dropping a job queue .mtxcfg file onto the merge tool or using one as a command line parameter to the mkvtoolnix-gui executable will import the .mtxcfg job into the job queue. Part of the implementation of #1714.
  • 2016-07-15 Moritz Bunkus <moritz@bunkus.org>
    • MKVToolNix GUI: merge tool bug fix: the automatic adjustments to the output file name based on the track types selected for muxing and the mechanism for keeping output file names unique had been broken since release v9.3.0. Fixes #1743.
    • MKVToolNix GUI: merge tool enhancement: toggling the WebM mode check box will update the output file name’s extension automatically.

Have fun :)

MKVToolNix not affected by FossHub breach

Last week FossHub was breached by attackers from the group PeggleCrew. As I’m using FossHub as the primary mean of distributing Windows and MacOS binaries for MKVToolNix, users have asked me whether MKVToolNix or my other servers have been compromised, too.

To the best of my knowledge the answer is: no.

I base this on several facts:

  • Last week the FossHub administrators sent an quick announcement to the developers hosting their software on FossHub on the day the breach was discovered. In it the admins were very open and honest about how they’d been breached, what the attackers had had access to, and what had been modified. While they did have access to the MKVToolNix binaries, those binaries were not modified.
  • Several reports about the incident that have been release since by various media do not list MKVToolNix either.
  • The group’s Twitter account didn’t list MKVToolNix as a modified program.
  • To date I haven’t received a single report by a user about a MKVToolNix binary that was acting suspiciously or that was detected by anti virus tools as dangerous.

Another thing the attackers did have access to was the account database used for the developer section of the site. That database includes the passwords, and they’ve allegedly not been salted. This, however, doesn’t pose a problem for me either:

  • I’m using random, long passwords for such sites. Therefore it’s irrelevant whether or not the passwords have been salted as rainbow attacks (the use of pre-computed tables containing the cleartext passwords and their hashed checksums) aren’t effective against randomly generated passwords.
  • Even more important is that I don’t re-use passwords on other sites. So even if someone was able to determine the cleartext version of my FossHub password, it wouldn’t do them any good as it cannot be used to gain entry to any other service I’m using.

There are two things Windows users can do to verify that the binaries they’ve downloaded from FossHub are clean. The first is to verify its SHA-1 and SHA-512 checksums. I provide both checksums on my own server, and they’re always linked to from the download page: SHA1 checksums for 9.3.1, SHA512 checksums. Checksums for other versions can be queried by replacing the version number 9.3.1 in the URL with the one you’re interested in.

The second thing is to check that the executables (both the installer’s executable as well as the ones for the actual tools) are signed by the right certificate. I’m using a certificate signed by StartSSL (StartCom) (“CN = StartCom Class 2 Object CA, OU = StartCom Certification Authority, O = StartCom Ltd., C = IL”). My current certificate’s serial number is ‎5a:d8:f8:75:9a:c3:46:ae:8b:ec:99:15:eb:b5:5d:04 and its SHA1 fingerprint is 48:13:1B:5D:41:63:12:07:D2:86:20:6C:28:F3:78:C8:06:6F:34:AA, though those two values are subject to change when the certificate will be renewed in 2018.