Merge branch 'refs/heads/t/invalid-ids'

A single patch that was in misc for a while, and two follow up fixups
that were detected after the branch was merged into next.

* refs/heads/t/invalid-ids (cooking for two weeks):
  Makefile: Don't compile with -Wformat-signedness unconditionally.
  aft.c: Use correct format string for error output.
  touch: Refuse to set an invalid image or lyrics ID.

diff --cc NEWS.md
index a7af771744e91e3654bd216b217f40a56eae11ea,71eb6cb26d3a333f8840f78848ad74986f689754..3d00528d123929d78d4895a5a57fd748c085cdad
--- 1/NEWS.md
--- 2/NEWS.md
+++ b/NEWS.md
@@@ -1,23 -1,6 +1,24 @@@
  NEWS
  ====
  
 +------------------------------------------
 +0.5.7 (to be announced) "semantic density"
 +------------------------------------------
 +- Speedup of the base64 decoder.
 +- One of the two source browsers has been removed from the web pages.
 +  The doxygen API reference still contains an HTML version of each
 +  source file.
 +- Two race conditions in para_server have been fixed.
 +- ls -p is now deprecated in favor of -F or -b. See the help text of
 +  the ls command for details.
 +- The openssl code has been adjusted to work also with openssl-1.1.
 +- The wma decoder and audio format handler now correctly decodes
 +  files with unusual block sizes.
 +- We now compile with -Wformat-signedness if possible.
++- The touch command now refuses to set an invalid image or lyrics ID.
 +
 +Download: [tarball](./releases/paraslash-git.tar.bz2)
 +
  ---------------------------------------
  0.5.6 (2016-07-10) "cascading gradient"
  ---------------------------------------
@@@ -42,6 -25,6 +43,7 @@@ not mentioned here have accumulated an
  - para_gui no longer reports 100% playing time at the stream start.
  - Opus cleanups.
  
++Downloads:
  [tarball](./releases/paraslash-0.5.6.tar.bz2),
  [signature](./releases/paraslash-0.5.6.tar.bz2.asc)
  

diff --cc aft.c
Simple merge

diff --cc blob.c
Simple merge