=========================================
PLOP and PLOP DS 5.3 (September 06, 2018)
=========================================

- 2018-06-09 (bug #6225)
  Eliminated many Java 10 warnings when generating Javadoc HTML documentation.

- 2018-08-27 (feature #2138)
  Updated to OpenSSL 1.1.0h.

- 2018-08-27 (feature #2350)
  Updated to libcurl 7.59.0.

- 2018-08-27 (feature #2388)
  Dropped the .NET 2.0 binding.

- 2018-08-24 (bug #6215)
  PLOP_open_document_callback() did not work correctly with large files >2GB
  on Windows and z/OS. Fixing this required a small change in the interface.
  
- 2018-07-27 (bug #6196)
  PLOP could generate invalid PDF/A-1 or PDF/X-1/2/3 files containig
  compressed object streams under the following circumstances:

  - The input conforms to PDF/A-1 or PDF/X-1/2/3.
  - The option sacrifice=pdfa resp. sacrifice=pdfx matching the input was
    specified.
  - Optimization or use of compressed object streams was turned on.
  
  Another minor problem was fixed that non-PDF/A output could contain
  unnecessary empty <stEvt:parameters> elements in XMP.

- 2018-07-26 (bug #6200)
  When multiple private keys where found with engine=pkcs#11, an incorrect
  error message was produced ("Error in PKCS#11 operation ('No private key
  found')"). This problem was introduced in PLOP DS 5.2p5.
  
- 2018-07-24 (feature #2352)
  The pCOS interface now grants access to form fields in restricted mode,
  i.e. pCOS paths starting with one of the following strings:
  fields[], pages[]/fields[], signaturefields[]

- 2018-07-20 (bug #6192)
  When signing in a multi-threaded application with engine=pkcs#11 PLOP DS
  could fail with the error message "Error in PKCS#11 operation (couldn't log
  in (C_Login: CKR_USER_ALREADY_LOGGED_IN))".

- 2018-06-18 (bug #6149)
  PLOP DS could not use PKCS#12 files with a correctly encoded password if
  the password contained non-ASCII characters. The fix includes a
  compatibility mode that allows to open broken PKCS#12 files created with
  OpenSSL 1.0.2 and earlier if the password contains non-ASCII characters.

======================================
PLOP and PLOP DS 5.2p5 (July 11, 2018)
======================================

- 2018-07-11 (feature #2368)
  Implemented support for creating PKCS#11 signatures where the signer's
  certificate is not stored on the token, but is provided separately via
  the new suboption "signercert". The private key on the token can be selected
  with the new suboption "id".

- 2018-06-28 (feature #2322)
  Added support for Perl 5.28 (not yet available for Windows).

- 2018-06-25 (feature #2374)
  No longer emit document info for PDF 2.0 output by default. Document info
  can be forced for PDF 2.0 with the new option "emitdocinfo".

- 2018-06-25 (feature #2363)
  Added the pCOS command-line tool to the PLOP packages.

- 2018-06-25 (feature #2360)
  Implemented pCOS interface 12 with support for identifying upcoming new
  PDF standards.

- 2018-06-19 (feature #2365)
  Removed the Visual Basic samples from the PLOP packages.

- 2018-06-11 (feature #2358)
  Implemented the quoting mechanism specified in XMP for custom document
  info containing characters which are not allowed in XML names. This way
  the current naming restriction on custom keys for the "docinfo" option could
  be lifted.

- 2018-06-07 (bug #4768)
  The keywords "embeddedfile" and "field" for option "--extended" were
  not included in the usage message of the pCOS command line tool.

- 2018-05-30 (bug #6164)
  Fixed build errors that occurred when compiling PLOP source code packages
  with a C89 compiler on HP Itanium.

=====================================
PLOP and PLOP DS 5.2p4 (May 15, 2018)
=====================================

- 2018-05-15 (feature #2353)
  The options "password" and "passwordfile" of PLOP_prepare_signature() for
  supplying certificate passwords did not correctly handle Unicode passwords. 

- 2018-05-15 (bug #6153)
  The "filenamehandling" option was not correctly applied for a LANG setting
  different from C. As a result, file names containing characters outside
  the ASCII/EBCDIC were not handled correctly. This problem affected only
  platforms without native support for Unicode filenames and non-Unicode aware
  language bindings such as C.

- 2018-05-11 (bug #6150)
  The PLOP smoketest did not call PLOP_add_recipient().
  
- 2018-05-03 (bug #6143)
  On z/OS a crash occurred through heap corruption if option
  "filenamehandling" was set to the default "honorlang" and if one of
  the environment variables "LANG", "LC_ALL" or "LC_CTYPE" contained an
  encoding specification that caused a filename conversion with iconv, e.g.
  "LC_ALL=en_US.IBM-1047".
  
- 2018-05-03 (bug #6130)
  There was no PLOP-only source package available.
  
- 2018-04-19 (bug #6130)
  Improved build instructions for EBCDIC builds and added an option to the
  OpenSSL Configure script for creating a "noieee" build on z/OS. 
  
- 2018-04-19 (bug #6129)
  The macOS version number of the macOS build system was removed from the
  xmpMM:History property in the XMP metadata and the name of the signing
  application that can be retrieved via "Advanced Signature Properties".
  Depending on the macOS build platform this string could also be
  "Mac OS X-unknown 64".
  
- 2018-04-11 (bug #6098)
  HTTPS connections failed on z/OS if the server certificate contains
  the "subjectAltName" extension.
  
- 2018-04-11 (bug #6124)
  SSE2 extensions in source builds are now disabled by default.
  
- 2018-04-04 (bug #6112)
  PLOP DS failed to add OCSP responses collected during the call
  to PLOP_create_document() to the Document Security Store if no OCSP
  responses and no CRLs were collected during the call to
  PLOP_prepare_signature(), e.g. if only a document time-stamp was
  created. This caused non-LTV capable output.
  
- 2018-03-15 (bug #6095)
  Addressing digital IDs resp. certificates in the Windows certificate
  store in functions PLOP_prepare_signature(), PLOP_open_document() and
  PLOP_add_recipient() did not work if the subject or the store name
  contained non-ASCII characters.
  
=======================================
PLOP and PLOP DS 5.2p3 (March 08, 2018)
=======================================

- 2018-03-08 (bug #6047)
  The PLOP Python binding for Python 3.5/3.6 did not work on Windows 10
  64-bit. 
  
- 2018-03-08 (bug #6080)
  The PLOP 5.2p2 Windows packages did not include the PHP modules.
   
- 2018-03-08 (bug #6083)
  PHP 7.2 on Windows could not load the PLOP PHP module because the module
  was compiled with a wrong version of Visual Studio.
  
- 2018-03-08 (bug #6087)
  Added support for Ruby 2.5.

- 2018-02-16 (bug #6062)
  After the fix for bug #6041 PLOP missed some optimization opportunities
  that could lead to significantly larger PDF output when redundant PDF
  objects were present in the PDF input. Now optimization of redundant
  PDF objects is again as effective as before the fix for bug 6041.

- 2018-02-16 (bug #6063)
  A memory leak could occur when a parsing error was triggered by damaged
  PDF while creating optimized PDF output.
  
- 2018-01-24 (bug #6041)
  When optimizing PLOP could incorrectly replace one PDF object with another
  when both PDF objects referenced the same set of indirect objects, but
  with different permutations, and when the PDF objects were otherwise
  identical.
  
- 2018-01-09 (bug #6030)
  PLOP_pcos_get_string() incorrectly failed with the error message "Invalid
  UTF-16 string" if the PDF string to be retrieved was UTF-16 encoded and
  contained UTF-16 surrogate values.
  
- 2017-12-20 (feature #2297)
  Switched the build for the .NET DLL from Visual Studio 2010 runtime
  libraries to Visual Studio 2015.


==========================================
PLOP and PLOP DS 5.2p2 (December 13, 2017)
==========================================

- 2017-12-11 (bug #6021)
  Documented the scenarios under which Acrobat displays the warning
  "Annotation modified" for valid signatures, and how it can be avoided
  when producing the PDF input files for PLOP with PDFlib.
   
- 2017-12-11 (bug #6020)
  When the return code of PLOP_prepare_signature() was ignored in case
  of an error, and if PLOP_create_document() was called afterwards
  nevertheless, the following assertion was triggered in
  PLOP_create_document():
   
  [1926] PLOP_create_document: Internal error: assertion failed in file
  'pl_plop.c', line 4282
  
  Now a proper error message is returned in this situation from
  PLOP_create_document():
  
  PLOP_prepare_signature() was not completed successfully before calling
  PLOP_create_document()

- 2017-11-27 (feature #2207)
  Added support for EMSA-PSS encoding for RSA signatures with engine=pkcs#11.

- 2017-11-14 (bug #6002)
  The macOS PLOP Framework project file contained a typo that prevented a
  successful build with XCode 9.x.
  
- 2017-10-23 (bug #5938)
  The PLOP Java samples all used "System.err.println(e.getMessage());"
  in the catch clause for non-PLOP exceptions. This resulted in only the
  "detail message string" of the exception to be printed without any context.
  Now all Java samples use "System.err.println(e);", which prints a short
  description of the exception that includes the class name of the exception
  and the detail message string.

- 2017-10-23 (bug #5938)
  PKCS#11 and MSCAPI code could accidentally be suppressed when
  generating PLOP DS source code packages.

- 2017-10-16 (bug #5960)
  Since PLOP 5.1 the file "PDFlibDemoCA_G2.crl" was accidentaly delivered
  in DER format, which made it impossible to use the CRL file together
  with the demo certificates to create PDF files with LTV signatures.
  Now the file is again delivered in PEM format.
  
- 2017-10-16 (bug #5961)
  Using option "sigtype" without actually specifying the "digitalid"
  option resulted in the unexpected error message "Error reading digital
  ID 'NULL' ('?')". Now option "sigtype" is ignored and a warning is
  emitted if option "digitalid" is not supplied.
  
- 2017-10-16 (bug #5991)
  Reject invalid JPEG-compressed data that could be used to trigger a
  data leak in the original libjpeg version 6b. PLOP was actually not
  affected by the data leak because in all PDFlib products all memory
  dynamically allocated by libjpeg is explicitly initialized to zero.

- 2017-10-10 (bug #5927)
  For damaged PDF documents the pCOS API could return inconsistent results
  when PDF page objects affected by the damage were accessed repeatedly.
  
- 2017-09-12 (bug #5968)
  Implemented workaround for documents with broken /Encrypt dictionaries
  where the /CFM value is inconsistent with the values for the /V and /R
  entries.
  
- 2017-08-18 (bug #5949)
  PLOP could crash when a document had an inconsistent /Encrypt dictionary
  that caused the execution of AES-128 code with an AES-256 key.
  
- 2017-08-09 (bug #5917)
  It was undefined how entries in the document information dictionary are
  handled when option "xmppolicy=remove" is specified for
  PLOP_open_document(). Now XMP and document info entries in the input
  document are ignored. New XMP will be created, and internal document info
  entries are synchronized to the output document info.
  
- 2017-07-06 (feature #2215)
  Added build support for Visual Studio 2017.


======================================
PLOP and PLOP DS 5.2p1 (July 05, 2017)
======================================

- 2017-07-05 (feature #2264)
  Refined the logic for enumerating signature-enabled certificates via
  PKCS#11. PLOP DS now automatically discards all certificates which are
  unsuitable for digital signature according to the keyusage flags instead
  of requiring the user to provide suitable filtering options.

- 2017-06-21 (bug #5867)
  It was not possible to build ICU from source on IBM i5 systems.
  
- 2017-06-21 (bug #5880)
  For source builds support was added to build PLOP on AIX 6 and AIX 7.
 
- 2017-06-21 (bug #5885)
  With the PHP 7 PLOP wrapper a problem was introduced that when extending
  the PLOP class it was not possible to access any members of the extended
  class.
  
- 2017-06-07 (bug #5882)
  Improved the build process for AIX 6 and 7 and enhanced the code for
  dynamically loading PLOP in applications to also support AIX. 

- 2017-03-28 (feature #2227)
  Added support for Ruby 2.4.

- 2017-03-16 (bug #5827)
  Ignore null values when recursively copying dictionary entries.
 
- 2017-03-16 (bug #5826)
  Invalid or null document info entries could result in invalid output.

- 2017-03-16 (bug #5825)
  Signing with update=false could result in invalid output if the document
  info dictionary contained indirect objects and XMP metadata was present.


========================================
PLOP and PLOP DS 5.2 (February 23, 2017)
========================================

Several enhancements for digital signatures and certificate security
including the following:

- Support EMSA-PSS encoding scheme for RSA signatures

- Support OAEP for RSA certificate security

- Reject input documents with certification signatures and permissions=nochanges
  unless the "sacrifice" option has been supplied to avoid breaking
  existing certification signature
  
- No longer require "conformance=extended" for NIST-15 elliptic curves
  other than P-256/P-384/P-521 since these are supposed to be supported in
  Acrobat.

- 2017-02-23 (bug #5798, feature #2212)
  Increased the default value of "timestampsize" to accommodate changes
  implemented in the configuration of a commonly used TSA.


==========================================
PLOP and PLOP DS 5.1p4 (February 06, 2017)
==========================================

- 2017-01-30 (bug #5776)
  PLOP DS could crash when the "digitalid" option contained the suboption
  "filename" with a reference to a PVF file.

- 2017-01-30 (bug #5777)
  Improved an error message in case the application called PLOP_get_buffer()
  after PLOP_close_document().

- 2017-01-30 (feature #2202)
  Included the source module of the Java wrapper in the JAR package to
  make parameter names and deprecation info available in Eclipse and other
  IDEs without further configuration.

- 2017-01-20 (bug #5756)
  Windows: avoid crash when a memory-mapped network file becomes unavailable.

- 2017-01-12 (bug #5746)
  Enhancements in the encryptdl sample and the build process for dynamically
  loading PLOP from C and C++ applications.

- 2016-12-23 (bug #5739)
  Invalid XMP without any namespace URI could result in output XMP where
  a <rdf:Description> container was missing.

- 2016-11-30 (bug #5703)
  The .NET binding could not be built from source with Visual Studio 2015
  due to an incorrect linker option.

- 2016-11-29 (bug #5719)
  Added a heuristic for malformed xref sections which don't take the
  first entry (start of the free list) into account, i.e. counting from 1
  instead of from 0. Such a heuristic has already been present, but it
  didn't work for documents containing update sections (see also bug #5162).

- 2016-11-28 (bug #5717)
  XMP extension schema checking for PDF/A: custom value types were not
  honored if used in the definition of fields for another custom type.

- 2016-11-25 (bug #5720)
  Compressed XRef entries with a byte length larger than 5 (middle value in
  the /W array) were not accepted. Such large entries are never required,
  but some PDF producers emit them nevertheless even for small files.

- 2016-10-25 (bug #5689)
  PHP 7 could crash when application code extended the PLOP class.

- 2016-10-04 (bug #5671)
  The transparency group of a page used for visualizing a digital signature
  was not copied to the signed output document. Now the original transparency
  group is copied, but unfortunately Acrobat DC does not make use of groups
  in a Form XObject used as annotation appearance.


===========================================
PLOP and PLOP DS 5.1p3 (September 27, 2016)
===========================================

- 2016-09-27 (feature #2141)
  Added support for the "sticky" suboption of the "digitalid" option of
  PLOP_prepare_signature() as a workaround for problems with repeatedly
  loading/unloading the PKCS#11 DLL.

- 2016-09-22 (feature #2013)
  Added support for zSeries with USS.
  
- 2016-09-16 (bug #5565)
  Added a compile-time check to ensure the proper OpenSSL version.

- 2016-09-16 (bug #5626)
  Certificate security with an elliptic curve recipient: include random
  user keying material (ukm) in the SharedInfo structure per recommendation
  in RFC 5753.

- 2016-09-16 (bug #5625)
  Certificate security with an elliptic curve recipient: the algorithm
  identifier for the AES key wrap function incorrectly contained a NULL
  parameter in violation of RFC 3565.


===========================================
PLOP and PLOP DS 5.1p2 (September 15, 2016)
===========================================

- 2016-09-15 (bug #5598)
  Added support for Perl 5.24.

- 2016-09-13 (bug #5631)
  The PHP7 wrapper did not call PLOP_delete() in the destructor. As a result
  PKCS#11 sessions could remain open (workaround: call PLOP_prepare_signature()
  with "signature=false").

- 2016-08-21 (bug #5634)
  The PLOP command-line tool incorrectly didn't reject the option
  "--permissions keep" in combination with "--recipient".

- 2016-07-29 (bug #5627)
  PDF_add_recipient() now also accepts recipient certificates with the
  keyAgreement bit in the key usage extension.

- 2016-07-04 (bug #5602)
  Certificate security with an elliptic curve recipient: use SHA-256 instead
  of SHA-512 in the key derivation function because this is the only required
  KDF per RFC 5753 and indeed MSCAPI doesn't support SHA-512. As a result of
  the latter restriction documents encrypted with PLOP and engine=builtin
  couldn't be decrypted with PLOP and engine=mscapi, but only with
  engine=builtin.

- 2016-06-25 (bug #5588)
  The pCOS pseudo object "pages[]/colorspaces[]/iccprofileid" was rejected with
  an exception although it should be accepted.

- 2016-06-09 (bug #5569)
  Made the source code compatible with C++11 syntax requirements as enforced
  by Visual Studio 2015 in C++ mode.

- 2016-06-08 (bug #5570)
  Several documentation files were missing from the source code packages.

- 2016-06-07 (bug #5547)
  The pCOS pseudo object "linearized" incorrectly returned false/0 for
  linearized PDF documents > 2GB. Note that ISO 32000-1 doesn't clearly
  state that such files are actually legal.
  PLOP now emits a warning when linearizing files > 2GB since Acrobat
  doesn't flag such documents as linearized.


======================================
PLOP and PLOP DS 5.1p1 (June 03, 2016)
======================================

- 2016-06-02 (bug #5567)
  Loading a certificate via the "rootcertfile" or "rootcertdir" option could
  trigger an exception
  "Internal error: assertion failed in file 'ds_dss.c', line 251"
  (bug introduced in PLOP DS 5.0p6).

- 2016-06-02 (bug #5561)
  Building the 64-bit Windows version from source code resulted in unresolved
  externals due to a packaging problem.

- 2016-06-01 (bug #5557)
  The binary for PHP 7 on Windows 64-bit was missing from the packages.

- 2016-06-01 (bug #5555)
  The PLOP/PLOP DS command-line tool as well as the COM and .NET wrappers
  were missing from the source code packages.

- 2016-05-20 (bug #5549)
  The universal pCOS pseudo object "pcosinterface" returned 10 instead of the
  current pCOS interface version 11.


===================================
PLOP and PLOP DS 5.1 (May 13, 2016)
===================================

Several new features; see whatsnew.txt and the PLOP manual for an overview.

- 2016-05-12 (bug #5541)
  When signing with update=false or encrypting PLOP failed to detect existing
  signatures if the signature field was not the first field. As a result the
  signature was lost even without sacrifice={signatures}. 

- 2016-05-12 (bug #5538)
  Signing documents with non-signature form fields and NeedAppearances=true
  must be rejected, but were accepted instead. Some form fields are not
  visible in the signed output.

- 2016-04-26 (feature #2049)
  Changed the default of the "copy" option of PLOP_create_pvf() from "false"
  to "true" for all language bindings except C/C++. This avoids possible
  problems in situations where the client doesn't have full control over
  memory allocation and freeing, especially with garbage collection where
  the language no longer sees any reference to the data.

- 2016-02-29 (spin-off of feature #2071; bug introduced with the fix for
  bug #4924 in PLOP 5.0p3)
  PLOP incorrectly issued the message "PDF file 'protected.pdf' has no pages"
  if an encrypted file was opened without providing the proper master password,
  i.e. in restricted pCOS mode.

- 2016-02-23 (bug #4974)
  When creating multiple output documents from the same input document,
  document info entries for one output document incorrectly persisted to the
  next output document.

- 2016-02-18 (bug #5461)
  Optimization: PLOP now remembers validated time-stamp signer certificates
  and avoids redundant OCSP requests. This has the following effects if
  both time-stamped signatures and document time-stamps are involved:
  - reduced number of OCSP requests
  - smaller DSS size
  - one less incremental update for adding a TSA OCSP response

- 2016-01-27 (feature #2052)
  Added support for PHP 7 on Windows 64-bit.

- 2016-01-25 (feature #1937)
  Emit the "ESIC" entry in the Extensions dictionary per ETSI EN 319 142-1.

- 2016-01-21 (feature #2031)
  Re-introduced the keyword "signatures" for the "sacrifice" option which is
  needed to control preservation or deletion of existing signatures in non-
  signature mode.

- 2015-11-16 (feature #2039)
  Implemented the additional IpCOS interface in the Java binding which offers
  all core pCOS API functions plus various support functions for error handling,
  PVF handling etc. This interface facilitates demonstration of pCOS features
  in the pCOS Cookbook regardless of which product is used.

- 2015-12-08 (bug #5416)
  The PLOP class could not be extended in the PHP 7 binding due to a
  combination of an incorrect flag in the language wrapper and modified
  behavior in PHP 7.


==========================================
PLOP and PLOP DS 5.0p6 (November 30, 2015)
==========================================

- 2015-11-30 (bug #5386)
  The "serial" suboption of the "digitalid" option for engine=pkcs#11 now
  allows the serial number to be encoded in raw format of the token instead
  of the specified DER encoding to match the behavior of several tokens.

- 2015-11-30 (bug #5228/REOPENED)
  Refined the time-related aspects of OCSP response validation since the
  previously implemented checks were too strict. If nextUpdate is not present
  thisUpdate is allowed to be up to two hours old.

- 2015-11-24 (bug #5404)
  Optimized signature-related output as follows:
  - Certificates which don't belong to the chain of the signing certificate
    (e.g. an OCSP responder certificate) are no longer stored in the PKCS#7
    object, but only in the DSS.
  - Certificates which are already contained in the PKCS#7 object are no
    longer stored in the DSS, e.g. a common root for an OCSP responder and
    the signing certificate.
  In a typical scenario both optimizations together result in a file size
  reduction of ca. 4KB.   

- 2015-11-20 (bug #5401)
  Modified verification of an OCSP response as follows:
  - Even with validation=formal full validation was attempted.
  - The OCSP responder's certificate chain was regarded as trusted even in
    the absence of trusted root certificates.
  - In another situation OCSP responses could not be verified even in the
    presence of a trusted root certificate.

- 2015-11-16 (bug #5385)
  Error messages were lost in the COM and .NET language bindings.

- 2015-11-11 (bug #5351)
  The installer did not correctly register the COM DLL in some situations.

- 2015-10-14 (feature #1903)
  Added support for PHP 7.

- 2015-10-14 (bug #5338)
  The OS X framework could be broken in some packages.


===========================================
PLOP and PLOP DS 5.0p5 (September 01, 2015)
===========================================

- 2015-08-25 (bug #5306)
  The HelloSignServlet.java and SignServlet.java samples didn't work because
  they have not been adjusted to the new PLOP DS 5 signature API.

- 2015-08-25 (bug #5309)
  Fixed incorrect treatment of empty file names in PLOP_create_document():
  - Internal encodings which may be required for file name conversion were
    not included in the PLOP build.
  - The Java wrapper passed a random value for the file name length to the
    kernel if filename was NULL.
  - The kernel incorrectly attempted to convert empty file names. 

- 2015-07-30 (bug #5307)
  Fixed a memory leak in the Java binding in the convert_to_unicode() and
  create_pvf() methods.

- 2015-07-22 (bug #5256)
  Input PDF with invalid document info entries of wrong type were rejected
  with the message "Name object expected". Most importantly, OS X creates
  the entry /AAPL:Keywords[] which does not conform to ISO 32000-1. Now
  such info entries are silently ignored.
 

======================================
PLOP and PLOP DS 5.0p4 (July 01, 2015)
======================================

- 2015-07-01 (bug #5243)
  The PLOP command-line tool could not be used on OS X 10.6 systems due to
  a build problem ("Illegal instruction"). 

- 2015-06-24 (bug #5155)
  The 64-bit binary was missing from the Python 2.x package for OS X.

- 2015-06-22 (bug #5228)
  OCSP responses are rejected if the entry "thisUpdate" differs from the local
  time (signing time) by more than five minutes.

- 2015-06-18 (bug #5235)
  The "subject" suboption of the "digitalid" option of PLOP_prepare_signature()
  converted non-ASCII characters incorrectly. As a result, the digital id
  couldn't be located.

- 2015-06-05 (bug #5160)
  Removing XMP metadata with xmppolicy=remove now implies
  sacrifice={pdfa pdfua pdfvt pdfx}. Previously the output alleged to conform
  to the standard which was found in the XMP, but actually PLOP can no longer
  ensure standard conformance (especially regarding PDF/A extension schema
  descriptions).

- 2015-05-22 (bug #5215)
  Added detailed timing information to the log file to allow tracking of
  access to external resources, especially network-based items (OCS, CRL)
  and particularly PKCS#11 activities.

- 2015-05-18 (bug #5190)
  Perl binding: changed the order of cleanup operations to avoid the message
  "Library context pointer 0x0 is invalid ***" on stdout in rare situations
  related to the order in which the Perl operator calls destructors. The
  problem happened only very close to the end of the process.

- 2015-05-12 (feature #1934)
  Embed SigningCertificateV2 according to ESS as signed attribute also for
  sigtype=cms (in addition to sigtype=cades), i.e. for all author and approval
  signatures. 

- 2015-05-12 (bug #5195)
  Added support for Visual Studio 2013 (VS12) and 2015 (VS14) to the build
  system.

- 2015-05-08 (bug #5193)
  All suboptions of the "ocsp" and "crl" signature options except "url" and
  "httpauthentication" are now applied to OCSP/CRL requests for other
  certificates than the signing certificate. This benefits PKIs which require
  credenticals for subordinate OCS or CRL requests.

- 2015-05-08 (bug #5194)
  PLOP_prepare_signature() did not correctly ignore additional parameters
  in the HTTP Content-Type Header Field. For example, retrieving a CRL
  could fail with an error of the form
  "Unexpected content type 'application/pkix-crl;charset=ISO-8859-1' in reply
  to CRL request to URL '...' (expected content type 'application/pkix-crl')".
  Also, the type and subtype fields are now compared in a case insensitive
  manner as mandated by RFC 2045.

- 2015-05-08 (bug #5191)
  PLOP_prepare_signature() returned 0 instead of 1 in case of success in all
  language bindings except PHP. This affected only clients which didn't
  check for the error return value -1, but instead tested the success value.

- 2015-04-16 (bug #5162)
  Certain xref problems in the input document were silently repaired without
  triggering repair mode. Since the original problems persist, but can no
  longer be fixed after signing by update such input documents are now
  rejected when opening the document with "repair=none", or are rejected
  upon signing. As a result, such documents no longer cause problems if
  multiple signatures are applied. However, they can no longer be signed in
  update mode.


=======================================
PLOP and PLOP DS 5.0p3 (April 01, 2015)
=======================================

- 2015-04-01 (feature #1913)
  Added a binding for Python 3.3 and above on OS X.

- 2015-03-27 (bug #5139)
  Fixed a crash in PLOP_delete() caused by a memory violation in the PKCS#11
  cleanup code which hit only in Visual Studio 2012 builds, especially PHP 5.5.
 
- 2015-03-27 (bug #5144)
  The multisign samples for C, C++, ASP.NET and C# were missing an option
  list parameter in the second call to PLOP_create_document() (only relevant
  in the PKCS#11 case).

- 2015-03-18 (bug #5132)
  C++ binding: the "issuer" and "subject" suboptions of the "digitalid"
  option with engine=pkcs#11 incorrectly rejected valid query strings with
  "Bad syntax of certificate subject ('subject does not start with '/'')".

- 2015-03-18 (bug #5133)
  PLOP_prepare_signature() now always releases a PKCS#11 session which may
  be open, even for signature=false. This facilitates the implementation of
  multi-threaded signing applications.

- 2015-03-17 (bug #5127)
  Extraneous xmpMM:History properties were emitted if multiple output
  documents were created in memory and the contents fetched with
  PLOP_get_buffer().

- 2015-03-09 (bug #4924)
  Reject invalid documents without any page.

- 2015-03-07 (bug #5116)
  Debug builds for Windows crashed upon startup. Since PDFlib GmbH does
  not deliver such binaries the problem affects only source code customers
  with a custom build procedure.

- 2015-03-03 (bug #5048)
  Added support for Android systems with API 8 (Froyo) or above.

- 2015-02-17 (bug #5071)
  The sample signature visualization file signing_man.pdf was missing in
  the packages.


==========================================
PLOP and PLOP DS 5.0p2 (February 02, 2015)
==========================================

- 2015-02-02 (bug #5058)
  On Linux (especially with PHP) loading PLOP could fail due to an undefined
  symbol "plopds_pdf_Curl_HMAC_final".

- 2015-01-29 (bug #5013)
  Avoid the system function clock_gettime() in the AIX build in order
  to make the AIX binaries compatible with PASE on i5 systems.

- 2015-01-23 (bug #5050)
  Required certificates were not included in the DSS. This could result in
  validation failures if the option dss=true or sigtype=cades was set.

- 2015-01-23 (bug #5045)
  Added support for indirect CRLs, i.e. CRLs which are not issued by the CA
  which issued the certificate for which the revocation status is tested.

- 2015-01-19 (bug #5012)
  Prepared a package for iOS.

- 2015-01-19 (bug #5040)
  Fixed a problem with creating the front page in evaluation mode.

- 2015-01-14 (bug #5033)
  The names of existing signature fields were not handled correctly in
  Unicode-based language bindings. As a result, two signature fields with
  the same name could be created, which means that the newly created
  signature did not show up in Acrobat.


=========================================
PLOP and PLOP DS 5.0p1 (January 07, 2015)
=========================================

- 2015-01-07 (feature #1876)
  Added support for Ruby 2.2.

- 2015-01-07 (bug #4999)
  Updated the pCOS Path Reference since a section was missing due to a
  production problem.

- 2014-12-17 (bug #5008)
  For engine=pkcs#11 the token login is delayed until after the target
  certificate has been found. This avoids the need for entering the PIN
  already during the search process. If the target certificate is not found,
  no login is required.
  
- 2014-12-17 (bug #5010)
  Fixed a preprocessing problem with the source code packages.

- 2014-12-15 (feature #1865)
  Attempt to parse CRLs as PEM if DER decoding failed. This is required as
  workaround for some PKIs which (in violation of RFC 5280) deliver PEM-
  formatted CRLs.

- 2014-12-15 (bug #5000)
  The validation checks were incomplete for engine=pkcs#11. As a result,
  signatures could succeed with validate=full or ltv=full even if no
  usable revocation information could be obtained.

- 2014-12-12 (bug #4997)
  Signing with visualization in update mode without any license key produced
  the signature on the page after the target page if it existed, or
  triggered an error message "Invalid page number ... in 'field' option" if
  the target page was the last page.
  As a side effect time-stamp signatures are now always associated with the
  first page of the document (or the second if a demo front page is inserted)
  instead of the page which holds the visual signature.
  
- 2014-12-05 (bug #4989)
  The PKCS#11 engine didn't correctly unlock a mutex in the case that the
  PKCS#11 library didn't use the native OS locking functions. Since most
  PKCS#11 libraries use native OS functions for locking this should rarely
  affect applications; if so, the suboption "threadsafe=false" of the
  "digitalid" option can be used as a workaround.


========================================
PLOP and PLOP DS 5.0 (December 04, 2014)
========================================

Many new features including significant updates to the digital signature
machinery; see PLOP/PLOP DS manual for details.
