From 8d7dcb550a9c3412e21da7a64b4c4b0119ec735e Mon Sep 17 00:00:00 2001
From: Evgeny Poberezkin <2769109+epoberezkin@users.noreply.github.com>
Date: Mon, 15 Jan 2024 10:46:13 +0000
Subject: [PATCH 1/5] core: update simplexmq, optimize batching, remove builder
 (#3685)

* core: update simplexmq (optimize batching, remove builder)

* do not use builder to batch

* refactor
---
 cabal.project                      |  2 +-
 scripts/nix/sha256map.nix          |  2 +-
 src/Simplex/Chat.hs                | 16 +++++------
 src/Simplex/Chat/Messages.hs       |  7 ++---
 src/Simplex/Chat/Messages/Batch.hs | 43 ++++++++++++++----------------
 src/Simplex/Chat/Protocol.hs       | 12 ++++-----
 tests/MessageBatching.hs           | 16 +++++------
 tests/ProtocolTests.hs             |  3 +--
 8 files changed, 45 insertions(+), 56 deletions(-)

diff --git a/cabal.project b/cabal.project
index 7f4db12bb..80d7abe08 100644
--- a/cabal.project
+++ b/cabal.project
@@ -14,7 +14,7 @@ constraints: zip +disable-bzip2 +disable-zstd
 source-repository-package
     type: git
     location: https://github.com/simplex-chat/simplexmq.git
-    tag: ad8cd1d5154617663065652b45c784ad5a0a584d
+    tag: aee90884175a3092828be1f0be2fc702c69bc101
 
 source-repository-package
     type: git
diff --git a/scripts/nix/sha256map.nix b/scripts/nix/sha256map.nix
index 6a6e4ec11..dc3a7e293 100644
--- a/scripts/nix/sha256map.nix
+++ b/scripts/nix/sha256map.nix
@@ -1,5 +1,5 @@
 {
-  "https://github.com/simplex-chat/simplexmq.git"."ad8cd1d5154617663065652b45c784ad5a0a584d" = "19sinz1gynab776x8h9va7r6ifm9pmgzljsbc7z5cbkcnjl5sfh3";
+  "https://github.com/simplex-chat/simplexmq.git"."aee90884175a3092828be1f0be2fc702c69bc101" = "0ca5xzcpria481jhl9nlazvjljg3wwfkzzd2x6h4lxql2wbdnlx6";
   "https://github.com/simplex-chat/hs-socks.git"."a30cc7a79a08d8108316094f8f2f82a0c5e1ac51" = "0yasvnr7g91k76mjkamvzab2kvlb1g5pspjyjn2fr6v83swjhj38";
   "https://github.com/simplex-chat/direct-sqlcipher.git"."f814ee68b16a9447fbb467ccc8f29bdd3546bfd9" = "1ql13f4kfwkbaq7nygkxgw84213i0zm7c1a8hwvramayxl38dq5d";
   "https://github.com/simplex-chat/sqlcipher-simple.git"."a46bd361a19376c5211f1058908fc0ae6bf42446" = "1z0r78d8f0812kxbgsm735qf6xx8lvaz27k1a0b4a2m0sshpd5gl";
diff --git a/src/Simplex/Chat.hs b/src/Simplex/Chat.hs
index 3d25ba7cf..820b88fda 100644
--- a/src/Simplex/Chat.hs
+++ b/src/Simplex/Chat.hs
@@ -29,7 +29,6 @@ import Data.Bifunctor (bimap, first)
 import Data.ByteArray (ScrubbedBytes)
 import qualified Data.ByteArray as BA
 import qualified Data.ByteString.Base64 as B64
-import Data.ByteString.Builder (toLazyByteString)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
@@ -5656,8 +5655,7 @@ sendGroupMemberMessages user conn@Connection {connId} events groupId = do
       processBatch batch `catchChatError` (toView . CRChatError (Just user))
   where
     processBatch :: MsgBatch -> m ()
-    processBatch (MsgBatch builder sndMsgs) = do
-      let batchBody = LB.toStrict $ toLazyByteString builder
+    processBatch (MsgBatch batchBody sndMsgs) = do
       agentMsgId <- withAgent $ \a -> sendMessage a (aConnId conn) MsgFlags {notification = True} batchBody
       let sndMsgDelivery = SndMsgDelivery {connId, agentMsgId}
       void . withStoreBatch' $ \db -> map (\SndMessage {msgId} -> createSndMsgDelivery db sndMsgDelivery msgId) sndMsgs
@@ -5677,28 +5675,28 @@ directMessage chatMsgEvent = do
   chatVRange <- chatVersionRange
   let r = encodeChatMessage ChatMessage {chatVRange, msgId = Nothing, chatMsgEvent}
   case r of
-    ECMEncoded encodedBody -> pure . LB.toStrict $ encodedBody
+    ECMEncoded encodedBody -> pure encodedBody
     ECMLarge -> throwChatError $ CEException "large message"
 
-deliverMessage :: ChatMonad m => Connection -> CMEventTag e -> LazyMsgBody -> MessageId -> m Int64
+deliverMessage :: ChatMonad m => Connection -> CMEventTag e -> MsgBody -> MessageId -> m Int64
 deliverMessage conn cmEventTag msgBody msgId = do
   let msgFlags = MsgFlags {notification = hasNotification cmEventTag}
   deliverMessage' conn msgFlags msgBody msgId
 
-deliverMessage' :: ChatMonad m => Connection -> MsgFlags -> LazyMsgBody -> MessageId -> m Int64
+deliverMessage' :: ChatMonad m => Connection -> MsgFlags -> MsgBody -> MessageId -> m Int64
 deliverMessage' conn msgFlags msgBody msgId =
   deliverMessages [(conn, msgFlags, msgBody, msgId)] >>= \case
     [r] -> liftEither r
     rs -> throwChatError $ CEInternalError $ "deliverMessage: expected 1 result, got " <> show (length rs)
 
-deliverMessages :: ChatMonad' m => [(Connection, MsgFlags, LazyMsgBody, MessageId)] -> m [Either ChatError Int64]
+deliverMessages :: ChatMonad' m => [(Connection, MsgFlags, MsgBody, MessageId)] -> m [Either ChatError Int64]
 deliverMessages msgReqs = do
   sent <- zipWith prepareBatch msgReqs <$> withAgent' (`sendMessages` aReqs)
   withStoreBatch $ \db -> map (bindRight $ createDelivery db) sent
   where
-    aReqs = map (\(conn, msgFlags, msgBody, _msgId) -> (aConnId conn, msgFlags, LB.toStrict msgBody)) msgReqs
+    aReqs = map (\(conn, msgFlags, msgBody, _msgId) -> (aConnId conn, msgFlags, msgBody)) msgReqs
     prepareBatch req = bimap (`ChatErrorAgent` Nothing) (req,)
-    createDelivery :: DB.Connection -> ((Connection, MsgFlags, LazyMsgBody, MessageId), AgentMsgId) -> IO (Either ChatError Int64)
+    createDelivery :: DB.Connection -> ((Connection, MsgFlags, MsgBody, MessageId), AgentMsgId) -> IO (Either ChatError Int64)
     createDelivery db ((Connection {connId}, _, _, msgId), agentMsgId) =
       Right <$> createSndMsgDelivery db (SndMsgDelivery {connId, agentMsgId}) msgId
 
diff --git a/src/Simplex/Chat/Messages.hs b/src/Simplex/Chat/Messages.hs
index 74b41dc9f..993cc1eea 100644
--- a/src/Simplex/Chat/Messages.hs
+++ b/src/Simplex/Chat/Messages.hs
@@ -22,7 +22,6 @@ import qualified Data.Aeson.Encoding as JE
 import qualified Data.Aeson.TH as JQ
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import qualified Data.ByteString.Base64 as B64
-import qualified Data.ByteString.Lazy as L
 import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Char (isSpace)
 import Data.Int (Int64)
@@ -764,12 +763,10 @@ checkChatType x = case testEquality (chatTypeI @c) (chatTypeI @c') of
   Just Refl -> Right x
   Nothing -> Left "bad chat type"
 
-type LazyMsgBody = L.ByteString
-
 data SndMessage = SndMessage
   { msgId :: MessageId,
     sharedMsgId :: SharedMsgId,
-    msgBody :: LazyMsgBody
+    msgBody :: MsgBody
   }
   deriving (Show)
 
@@ -791,7 +788,7 @@ data RcvMessage = RcvMessage
 data PendingGroupMessage = PendingGroupMessage
   { msgId :: MessageId,
     cmEventTag :: ACMEventTag,
-    msgBody :: LazyMsgBody,
+    msgBody :: MsgBody,
     introId_ :: Maybe Int64
   }
 
diff --git a/src/Simplex/Chat/Messages/Batch.hs b/src/Simplex/Chat/Messages/Batch.hs
index 8b06873a3..dc2c9c386 100644
--- a/src/Simplex/Chat/Messages/Batch.hs
+++ b/src/Simplex/Chat/Messages/Batch.hs
@@ -1,6 +1,7 @@
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
+{-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 
 module Simplex.Chat.Messages.Batch
@@ -9,33 +10,29 @@ module Simplex.Chat.Messages.Batch
   )
 where
 
-import Data.ByteString.Builder (Builder, charUtf8, lazyByteString)
-import qualified Data.ByteString.Lazy as LB
-import Data.Int (Int64)
+import Data.ByteString.Char8 (ByteString)
+import qualified Data.ByteString.Char8 as B
 import Simplex.Chat.Controller (ChatError (..), ChatErrorType (..))
 import Simplex.Chat.Messages
 
-data MsgBatch = MsgBatch Builder [SndMessage]
+data MsgBatch = MsgBatch ByteString [SndMessage]
   deriving (Show)
 
--- | Batches [SndMessage] into batches of ByteString builders in form of JSON arrays.
+-- | Batches [SndMessage] into batches of ByteStrings in form of JSON arrays.
 -- Does not check if the resulting batch is a valid JSON.
 -- If a single element is passed, it is returned as is (a JSON string).
 -- If an element exceeds maxLen, it is returned as ChatError.
-batchMessages :: Int64 -> [SndMessage] -> [Either ChatError MsgBatch]
-batchMessages maxLen msgs =
-  let (batches, batch, _, n) = foldr addToBatch ([], [], 0, 0) msgs
-   in if n == 0 then batches else msgBatch batch : batches
+batchMessages :: Int -> [SndMessage] -> [Either ChatError MsgBatch]
+batchMessages maxLen = addBatch . foldr addToBatch ([], [], 0, 0)
   where
     msgBatch batch = Right (MsgBatch (encodeMessages batch) batch)
-    addToBatch :: SndMessage -> ([Either ChatError MsgBatch], [SndMessage], Int64, Int) -> ([Either ChatError MsgBatch], [SndMessage], Int64, Int)
-    addToBatch msg@SndMessage {msgBody} (batches, batch, len, n)
+    addToBatch :: SndMessage -> ([Either ChatError MsgBatch], [SndMessage], Int, Int) -> ([Either ChatError MsgBatch], [SndMessage], Int, Int)
+    addToBatch msg@SndMessage {msgBody} acc@(batches, batch, len, n)
       | batchLen <= maxLen = (batches, msg : batch, len', n + 1)
-      | msgLen <= maxLen = (batches', [msg], msgLen, 1)
-      | otherwise = (errLarge msg : (if n == 0 then batches else batches'), [], 0, 0)
+      | msgLen <= maxLen = (addBatch acc, [msg], msgLen, 1)
+      | otherwise = (errLarge msg : addBatch acc, [], 0, 0)
       where
-        msgLen = LB.length msgBody
-        batches' = msgBatch batch : batches
+        msgLen = B.length msgBody
         len'
           | n == 0 = msgLen
           | otherwise = msgLen + len + 1 -- 1 accounts for comma
@@ -43,11 +40,11 @@ batchMessages maxLen msgs =
           | n == 0 = len'
           | otherwise = len' + 2 -- 2 accounts for opening and closing brackets
         errLarge SndMessage {msgId} = Left $ ChatError $ CEInternalError ("large message " <> show msgId)
-
-encodeMessages :: [SndMessage] -> Builder
-encodeMessages = \case
-  [] -> mempty
-  [msg] -> encodeMsg msg
-  (msg : msgs) -> charUtf8 '[' <> encodeMsg msg <> mconcat [charUtf8 ',' <> encodeMsg msg' | msg' <- msgs] <> charUtf8 ']'
-  where
-    encodeMsg SndMessage {msgBody} = lazyByteString msgBody
+    addBatch :: ([Either ChatError MsgBatch], [SndMessage], Int, Int) -> [Either ChatError MsgBatch]
+    addBatch (batches, batch, _, n) = if n == 0 then batches else msgBatch batch : batches
+    encodeMessages :: [SndMessage] -> ByteString
+    encodeMessages = \case
+      [] -> mempty
+      [msg] -> body msg
+      msgs -> B.concat ["[", B.intercalate "," (map body msgs), "]"]
+    body SndMessage {msgBody} = msgBody
diff --git a/src/Simplex/Chat/Protocol.hs b/src/Simplex/Chat/Protocol.hs
index a0df9f986..2aa360b4b 100644
--- a/src/Simplex/Chat/Protocol.hs
+++ b/src/Simplex/Chat/Protocol.hs
@@ -29,9 +29,7 @@ import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import Data.ByteString.Internal (c2w, w2c)
-import qualified Data.ByteString.Lazy as L
 import qualified Data.ByteString.Lazy.Char8 as LB
-import Data.Int (Int64)
 import Data.Maybe (fromMaybe)
 import Data.String
 import Data.Text (Text)
@@ -491,20 +489,20 @@ $(JQ.deriveJSON defaultJSON ''QuotedMsg)
 
 -- this limit reserves space for metadata in forwarded messages
 -- 15780 (limit used for fileChunkSize) - 161 (x.grp.msg.forward overhead) = 15619, round to 15610
-maxChatMsgSize :: Int64
+maxChatMsgSize :: Int
 maxChatMsgSize = 15610
 
-data EncodedChatMessage = ECMEncoded L.ByteString | ECMLarge
+data EncodedChatMessage = ECMEncoded ByteString | ECMLarge
 
 encodeChatMessage :: MsgEncodingI e => ChatMessage e -> EncodedChatMessage
 encodeChatMessage msg = do
   case chatToAppMessage msg of
     AMJson m -> do
-      let body = J.encode m
-      if LB.length body > maxChatMsgSize
+      let body = LB.toStrict $ J.encode m
+      if B.length body > maxChatMsgSize
         then ECMLarge
         else ECMEncoded body
-    AMBinary m -> ECMEncoded . LB.fromStrict $ strEncode m
+    AMBinary m -> ECMEncoded $ strEncode m
 
 parseChatMessages :: ByteString -> [Either String AChatMessage]
 parseChatMessages "" = [Left "empty string"]
diff --git a/tests/MessageBatching.hs b/tests/MessageBatching.hs
index 809a4e3bd..1a9d96871 100644
--- a/tests/MessageBatching.hs
+++ b/tests/MessageBatching.hs
@@ -7,8 +7,8 @@
 module MessageBatching (batchingTests) where
 
 import Crypto.Number.Serialize (os2ip)
-import Data.ByteString.Builder (toLazyByteString)
-import qualified Data.ByteString.Lazy as LB
+import Data.ByteString (ByteString)
+import qualified Data.ByteString as B
 import Data.Either (partitionEithers)
 import Data.Int (Int64)
 import Data.String (IsString (..))
@@ -26,7 +26,7 @@ batchingTests = describe "message batching tests" $ do
   it "image x.msg.new and x.msg.file.descr should fit into single batch" testImageFitsSingleBatch
 
 instance IsString SndMessage where
-  fromString s = SndMessage {msgId, sharedMsgId = SharedMsgId "", msgBody = LB.fromStrict s'}
+  fromString s = SndMessage {msgId, sharedMsgId = SharedMsgId "", msgBody = s'}
     where
       s' = encodeUtf8 $ T.pack s
       msgId = fromInteger $ os2ip s'
@@ -94,14 +94,14 @@ testImageFitsSingleBatch = do
   -- 261_120 bytes (MAX_IMAGE_SIZE in UI), rounded up, example was 743
   let descrRoundedSize = 800
 
-  let xMsgNewStr = LB.replicate xMsgNewRoundedSize 1
-      descrStr = LB.replicate descrRoundedSize 2
+  let xMsgNewStr = B.replicate xMsgNewRoundedSize 1
+      descrStr = B.replicate descrRoundedSize 2
       msg s = SndMessage {msgId = 0, sharedMsgId = SharedMsgId "", msgBody = s}
       batched = "[" <> xMsgNewStr <> "," <> descrStr <> "]"
 
   runBatcherTest' maxChatMsgSize [msg xMsgNewStr, msg descrStr] [] [batched]
 
-runBatcherTest :: Int64 -> [SndMessage] -> [ChatError] -> [LB.ByteString] -> Spec
+runBatcherTest :: Int -> [SndMessage] -> [ChatError] -> [ByteString] -> Spec
 runBatcherTest maxLen msgs expectedErrors expectedBatches =
   it
     ( (show (map (\SndMessage {msgBody} -> msgBody) msgs) <> ", limit " <> show maxLen <> ": should return ")
@@ -110,10 +110,10 @@ runBatcherTest maxLen msgs expectedErrors expectedBatches =
     )
     (runBatcherTest' maxLen msgs expectedErrors expectedBatches)
 
-runBatcherTest' :: Int64 -> [SndMessage] -> [ChatError] -> [LB.ByteString] -> IO ()
+runBatcherTest' :: Int -> [SndMessage] -> [ChatError] -> [ByteString] -> IO ()
 runBatcherTest' maxLen msgs expectedErrors expectedBatches = do
   let (errors, batches) = partitionEithers $ batchMessages maxLen msgs
-      batchedStrs = map (\(MsgBatch builder _) -> toLazyByteString builder) batches
+      batchedStrs = map (\(MsgBatch batchBody _) -> batchBody) batches
   testErrors errors `shouldBe` testErrors expectedErrors
   batchedStrs `shouldBe` expectedBatches
   where
diff --git a/tests/ProtocolTests.hs b/tests/ProtocolTests.hs
index 23fbce249..f848aed6b 100644
--- a/tests/ProtocolTests.hs
+++ b/tests/ProtocolTests.hs
@@ -7,7 +7,6 @@ module ProtocolTests where
 
 import qualified Data.Aeson as J
 import Data.ByteString.Char8 (ByteString)
-import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Time.Clock.System (SystemTime (..), systemToUTCTime)
 import Simplex.Chat.Protocol
 import Simplex.Chat.Types
@@ -74,7 +73,7 @@ s ##== msg = do
   let r = encodeChatMessage msg
   case r of
     ECMEncoded encodedBody ->
-      J.eitherDecodeStrict' (LB.toStrict encodedBody)
+      J.eitherDecodeStrict' encodedBody
         `shouldBe` (J.eitherDecodeStrict' s :: Either String J.Value)
     ECMLarge -> expectationFailure $ "large message"
 

From 300223b32e65b66d4d8bd876c1dff54d5d4ef45c Mon Sep 17 00:00:00 2001
From: Evgeny Poberezkin <2769109+epoberezkin@users.noreply.github.com>
Date: Tue, 16 Jan 2024 23:42:29 +0000
Subject: [PATCH 2/5] core: update simplexmq 5.5.0.6 (fix race conditions)
 (#3691)

* core: update simplexmq (fix race conditions)

* simplexmq 5.5.0.6
---
 cabal.project             | 2 +-
 scripts/nix/sha256map.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cabal.project b/cabal.project
index 80d7abe08..9ff33c301 100644
--- a/cabal.project
+++ b/cabal.project
@@ -14,7 +14,7 @@ constraints: zip +disable-bzip2 +disable-zstd
 source-repository-package
     type: git
     location: https://github.com/simplex-chat/simplexmq.git
-    tag: aee90884175a3092828be1f0be2fc702c69bc101
+    tag: f6ed4640d407f8879273d104a3e69069806dcb7c
 
 source-repository-package
     type: git
diff --git a/scripts/nix/sha256map.nix b/scripts/nix/sha256map.nix
index dc3a7e293..e87143582 100644
--- a/scripts/nix/sha256map.nix
+++ b/scripts/nix/sha256map.nix
@@ -1,5 +1,5 @@
 {
-  "https://github.com/simplex-chat/simplexmq.git"."aee90884175a3092828be1f0be2fc702c69bc101" = "0ca5xzcpria481jhl9nlazvjljg3wwfkzzd2x6h4lxql2wbdnlx6";
+  "https://github.com/simplex-chat/simplexmq.git"."f6ed4640d407f8879273d104a3e69069806dcb7c" = "072rakv697f85i8ldjl7bj7jc7vfmzphasx2i4ynwgz3kksydfp5";
   "https://github.com/simplex-chat/hs-socks.git"."a30cc7a79a08d8108316094f8f2f82a0c5e1ac51" = "0yasvnr7g91k76mjkamvzab2kvlb1g5pspjyjn2fr6v83swjhj38";
   "https://github.com/simplex-chat/direct-sqlcipher.git"."f814ee68b16a9447fbb467ccc8f29bdd3546bfd9" = "1ql13f4kfwkbaq7nygkxgw84213i0zm7c1a8hwvramayxl38dq5d";
   "https://github.com/simplex-chat/sqlcipher-simple.git"."a46bd361a19376c5211f1058908fc0ae6bf42446" = "1z0r78d8f0812kxbgsm735qf6xx8lvaz27k1a0b4a2m0sshpd5gl";

From c25e9e3b72b8931cafce263c29e8cef9a6e9b786 Mon Sep 17 00:00:00 2001
From: Evgeny Poberezkin <2769109+epoberezkin@users.noreply.github.com>
Date: Wed, 17 Jan 2024 15:23:43 +0000
Subject: [PATCH 3/5] scripts: curl/wget security (#3693)

---
 scripts/android/download-libs.sh           |  4 ++--
 scripts/desktop/build-lib-mac.sh           |  2 +-
 scripts/desktop/make-appimage-linux.sh     |  2 +-
 scripts/desktop/prepare-openssl-windows.sh |  2 +-
 scripts/desktop/prepare-vlc-linux.sh       | 10 +++++-----
 scripts/desktop/prepare-vlc-mac.sh         |  2 +-
 scripts/desktop/prepare-vlc-windows.sh     |  2 +-
 scripts/ios/download-libs.sh               |  2 +-
 8 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/scripts/android/download-libs.sh b/scripts/android/download-libs.sh
index 4702f0360..5b9e1036f 100755
--- a/scripts/android/download-libs.sh
+++ b/scripts/android/download-libs.sh
@@ -37,12 +37,12 @@ for ((i = 0 ; i < ${#arches[@]}; i++)); do
 
     mkdir -p "$output_dir" 2> /dev/null
 
-    curl --location -o libsupport.zip $job_repo/$arch-android:lib:support.x86_64-linux/latest/download/1 && \
+    curl --tlsv1.2 --location -o libsupport.zip $job_repo/$arch-android:lib:support.x86_64-linux/latest/download/1 && \
     unzip -o libsupport.zip && \
     mv libsupport.so "$output_dir" && \
     rm libsupport.zip
 
-    curl --location -o libsimplex.zip "$job_repo"/"$arch"-android:lib:simplex-chat.x86_64-linux/latest/download/1 && \
+    curl --tlsv1.2 --location -o libsimplex.zip "$job_repo"/"$arch"-android:lib:simplex-chat.x86_64-linux/latest/download/1 && \
     unzip -o libsimplex.zip && \
     mv libsimplex.so "$output_dir" && \
     rm libsimplex.zip
diff --git a/scripts/desktop/build-lib-mac.sh b/scripts/desktop/build-lib-mac.sh
index 1a4deced4..55e5ca6f3 100755
--- a/scripts/desktop/build-lib-mac.sh
+++ b/scripts/desktop/build-lib-mac.sh
@@ -32,7 +32,7 @@ mkdir deps 2> /dev/null || true
   cp /tmp/libffi-3.4.4/*-apple-darwin*/.libs/libffi.dylib $BUILD/deps || \
     ( \
     cd /tmp && \
-    curl "https://gitlab.haskell.org/ghc/libffi-tarballs/-/raw/libffi-3.4.4/libffi-3.4.4.tar.gz?inline=false" -o libffi.tar.gz && \
+    curl --tlsv1.2 "https://gitlab.haskell.org/ghc/libffi-tarballs/-/raw/libffi-3.4.4/libffi-3.4.4.tar.gz?inline=false" -o libffi.tar.gz && \
     tar -xzvf libffi.tar.gz && \
     cd "libffi-3.4.4" && \
     ./configure && \
diff --git a/scripts/desktop/make-appimage-linux.sh b/scripts/desktop/make-appimage-linux.sh
index 9cd6f525f..3bbdd65b4 100755
--- a/scripts/desktop/make-appimage-linux.sh
+++ b/scripts/desktop/make-appimage-linux.sh
@@ -37,7 +37,7 @@ cp *imple*.desktop usr/share/applications/
 cp $multiplatform_dir/desktop/src/jvmMain/resources/distribute/*.appdata.xml usr/share/metainfo
 
 if [ ! -f ../appimagetool-x86_64.AppImage ]; then
-    wget https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage -O ../appimagetool-x86_64.AppImage
+    wget --secure-protocol=TLSv1_3 https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage -O ../appimagetool-x86_64.AppImage
     chmod +x ../appimagetool-x86_64.AppImage
 fi
 ../appimagetool-x86_64.AppImage .
diff --git a/scripts/desktop/prepare-openssl-windows.sh b/scripts/desktop/prepare-openssl-windows.sh
index 79822d3ff..942646853 100644
--- a/scripts/desktop/prepare-openssl-windows.sh
+++ b/scripts/desktop/prepare-openssl-windows.sh
@@ -12,7 +12,7 @@ cd $root_dir
 if [ ! -f dist-newstyle/openssl-1.1.1w/libcrypto-1_1-x64.dll ]; then
     mkdir dist-newstyle 2>/dev/null || true
     cd dist-newstyle
-    curl https://www.openssl.org/source/openssl-1.1.1w.tar.gz -o openssl.tar.gz
+    curl --tlsv1.2 https://www.openssl.org/source/openssl-1.1.1w.tar.gz -o openssl.tar.gz
     $WINDIR\\System32\\tar.exe -xvzf openssl.tar.gz
     cd openssl-1.1.1w
     ./Configure mingw64
diff --git a/scripts/desktop/prepare-vlc-linux.sh b/scripts/desktop/prepare-vlc-linux.sh
index a76486150..dae1c9255 100755
--- a/scripts/desktop/prepare-vlc-linux.sh
+++ b/scripts/desktop/prepare-vlc-linux.sh
@@ -14,7 +14,7 @@ mkdir $vlc_dir || exit 0
 cd /tmp
 mkdir tmp 2>/dev/null || true
 cd tmp
-curl https://github.com/cmatomic/VLCplayer-AppImage/releases/download/3.0.11.1/VLC_media_player-3.0.11.1-x86_64.AppImage -L -o appimage
+curl --tlsv1.2 https://github.com/cmatomic/VLCplayer-AppImage/releases/download/3.0.11.1/VLC_media_player-3.0.11.1-x86_64.AppImage -L -o appimage
 chmod +x appimage
 ./appimage --appimage-extract
 cp -r squashfs-root/usr/lib/* $vlc_dir
@@ -28,7 +28,7 @@ cd /tmp
 (
 mkdir tmp
 cd tmp
-curl http://archive.ubuntu.com/ubuntu/pool/universe/v/vlc/libvlc5_3.0.9.2-1_amd64.deb -o libvlc
+curl --tlsv1.2 https://archive.ubuntu.com/ubuntu/pool/universe/v/vlc/libvlc5_3.0.9.2-1_amd64.deb -o libvlc
 ar p libvlc data.tar.xz > data.tar.xz
 tar -xvf data.tar.xz
 mv usr/lib/x86_64-linux-gnu/libvlc.so{.5,}
@@ -40,7 +40,7 @@ rm -rf tmp
 (
 mkdir tmp
 cd tmp
-curl http://archive.ubuntu.com/ubuntu/pool/universe/v/vlc/libvlccore9_3.0.9.2-1_amd64.deb -o libvlccore
+curl --tlsv1.2 https://archive.ubuntu.com/ubuntu/pool/universe/v/vlc/libvlccore9_3.0.9.2-1_amd64.deb -o libvlccore
 ar p libvlccore data.tar.xz > data.tar.xz
 tar -xvf data.tar.xz
 cp usr/lib/x86_64-linux-gnu/libvlccore.so* $vlc_dir
@@ -51,7 +51,7 @@ rm -rf tmp
 (
 mkdir tmp
 cd tmp
-curl http://mirrors.edge.kernel.org/ubuntu/pool/universe/v/vlc/vlc-plugin-base_3.0.9.2-1_amd64.deb -o plugins
+curl --tlsv1.2 https://mirrors.edge.kernel.org/ubuntu/pool/universe/v/vlc/vlc-plugin-base_3.0.9.2-1_amd64.deb -o plugins
 ar p plugins data.tar.xz > data.tar.xz
 tar -xvf data.tar.xz
 find usr/lib/x86_64-linux-gnu/vlc/plugins/ -name "lib*.so*" -exec patchelf --set-rpath '$ORIGIN/../../' {} \;
@@ -63,7 +63,7 @@ rm -rf tmp
 (
 mkdir tmp
 cd tmp
-curl http://archive.ubuntu.com/ubuntu/pool/main/libi/libidn/libidn11_1.33-2.2ubuntu2_amd64.deb -o idn
+curl --tlsv1.2 https://archive.ubuntu.com/ubuntu/pool/main/libi/libidn/libidn11_1.33-2.2ubuntu2_amd64.deb -o idn
 ar p idn data.tar.xz > data.tar.xz
 tar -xvf data.tar.xz
 cp lib/x86_64-linux-gnu/lib* $vlc_dir
diff --git a/scripts/desktop/prepare-vlc-mac.sh b/scripts/desktop/prepare-vlc-mac.sh
index 25ec1365f..288b5a1a7 100755
--- a/scripts/desktop/prepare-vlc-mac.sh
+++ b/scripts/desktop/prepare-vlc-mac.sh
@@ -23,7 +23,7 @@ mkdir -p $vlc_dir/vlc || exit 0
 cd /tmp
 mkdir tmp 2>/dev/null || true
 cd tmp
-curl https://github.com/simplex-chat/vlc/releases/download/v$vlc_version/vlc-macos-$ARCH.zip -L -o vlc
+curl --tlsv1.2 https://github.com/simplex-chat/vlc/releases/download/v$vlc_version/vlc-macos-$ARCH.zip -L -o vlc
 unzip -oqq vlc
 install_name_tool -add_rpath "@loader_path/VLC.app/Contents/MacOS/lib" vlc-cache-gen
 cd VLC.app/Contents/MacOS/lib
diff --git a/scripts/desktop/prepare-vlc-windows.sh b/scripts/desktop/prepare-vlc-windows.sh
index 680fa7b80..7d2a71a95 100644
--- a/scripts/desktop/prepare-vlc-windows.sh
+++ b/scripts/desktop/prepare-vlc-windows.sh
@@ -13,7 +13,7 @@ mkdir -p $vlc_dir/vlc || exit 0
 cd /tmp
 mkdir tmp 2>/dev/null || true
 cd tmp
-curl https://irltoolkit.mm.fcix.net/videolan-ftp/vlc/3.0.18/win64/vlc-3.0.18-win64.zip -L -o vlc
+curl --tlsv1.2 https://irltoolkit.mm.fcix.net/videolan-ftp/vlc/3.0.18/win64/vlc-3.0.18-win64.zip -L -o vlc
 $WINDIR\\System32\\tar.exe -xf vlc
 cd vlc-*
 # Setting the same date as the date that will be on the file after extraction from JAR to make VLC cache checker happy
diff --git a/scripts/ios/download-libs.sh b/scripts/ios/download-libs.sh
index 9d7e38887..d0a3c9c62 100755
--- a/scripts/ios/download-libs.sh
+++ b/scripts/ios/download-libs.sh
@@ -35,7 +35,7 @@ for ((i = 0 ; i < ${#arches[@]}; i++)); do
     output_arch="${output_arches[$i]}"
     output_dir="$HOME/Downloads"
 
-    curl --location -o "$output_dir"/pkg-ios-"$arch"-swift-json.zip "$job_repo"/"$arch"-darwin-ios:lib:simplex-chat."$arch"-darwin/latest/download/1 && \
+    curl --tlsv1.2 --location -o "$output_dir"/pkg-ios-"$arch"-swift-json.zip "$job_repo"/"$arch"-darwin-ios:lib:simplex-chat."$arch"-darwin/latest/download/1 && \
     unzip -o "$output_dir"/pkg-ios-"$output_arch"-swift-json.zip -d ~/Downloads/pkg-ios-"$output_arch"-swift-json
 done
 sh "$root_dir"/scripts/ios/prepare-x86_64.sh

From 1eb1ed92f7d9d6ea4e3a79739acb9d8de795cd1c Mon Sep 17 00:00:00 2001
From: Evgeny Poberezkin <2769109+epoberezkin@users.noreply.github.com>
Date: Wed, 17 Jan 2024 19:27:07 +0000
Subject: [PATCH 4/5] ci: disable *-armv7a tags

---
 .github/workflows/build.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index afdb9bea1..92a975bc9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -9,6 +9,7 @@ on:
     tags:
       - "v*"
       - "!*-fdroid"
+      - "!*-armv7a"
   pull_request:
 
 jobs:

From 5236e0f2016a0dd4b9412a868a3d2609a2175ea9 Mon Sep 17 00:00:00 2001
From: Evgeny Poberezkin <evgeny@poberezkin.com>
Date: Thu, 18 Jan 2024 20:56:45 +0000
Subject: [PATCH 5/5] core: 5.4.4.0

---
 package.yaml       | 2 +-
 simplex-chat.cabal | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.yaml b/package.yaml
index 55de68492..675e62eb4 100644
--- a/package.yaml
+++ b/package.yaml
@@ -1,5 +1,5 @@
 name: simplex-chat
-version: 5.4.3.0
+version: 5.4.4.0
 #synopsis:
 #description:
 homepage: https://github.com/simplex-chat/simplex-chat#readme
diff --git a/simplex-chat.cabal b/simplex-chat.cabal
index 192905b2c..ddac01df0 100644
--- a/simplex-chat.cabal
+++ b/simplex-chat.cabal
@@ -5,7 +5,7 @@ cabal-version: 1.12
 -- see: https://github.com/sol/hpack
 
 name:           simplex-chat
-version:        5.4.3.0
+version:        5.4.4.0
 category:       Web, System, Services, Cryptography
 homepage:       https://github.com/simplex-chat/simplex-chat#readme
 author:         simplex.chat