osslsigncode: all versions and old releases

2.14 (2026.07.20)
- added comprehensive command documentation in Markdown; man page and HTML
versions are generated when Pandoc is available
- CMake installations now honor standard GNU install directories, include
README and NEWS, and can be uninstalled
- attach-signature now uses digest-only verification instead of full signature
validation; output file is not kept if digest verification fails
- fixed a memory leak when rejecting invalid compressed APPX data

2.13 (2026.02.10)
MULTIPLE SECURITY VULNERABILITIES
This release includes important security fixes. Users are strongly encouraged
to upgrade, as the issues below may be exploitable when processing untrusted
files.
- fixed integer overflows when processing APPX compressed data streams
(by Małgorzata Olszówka)
- fixed double-free vulnerabilities in APPX file processing
(by Małgorzata Olszówka)
- fixed multiple memory corruption issues in PE page hash computation
(by Antoni Klajn (Opera) and Małgorzata Olszówka)

2.12 (2026.02.02)
CRITICAL SECURITY VULNERABILITY
This release fixes a critical memory corruption vulnerability. A malicious
attacker could create a signed file, which, when verified with osslsigncode,
triggers arbitrary code execution. Any previous version of osslsigncode should
be immediately upgraded if the tool is used for verification of untrusted
files.
- fixed a buffer overflow while extracting message digests
(reported and fixed by Antoni Klajn, Opera)