#33347 - [PATCH 0/4] gnu: teeworlds: Update to 0.7.0 [fixes CVE-2018-18541].

Package	Source(s)		Maintainer(s)
guix-patches		PTS Buildd Popcon

Message #41 received at 33347@debbugs.gnu.org (full text, mbox, reply):

Received: (at 33347) by debbugs.gnu.org; 14 Nov 2018 13:36:55 +0000
From debbugs-submit-bounces@debbugs.gnu.org Wed Nov 14 08:36:55 2018
Received: from localhost ([127.0.0.1]:51088 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1gMvLj-000465-DK
	for submit@debbugs.gnu.org; Wed, 14 Nov 2018 08:36:55 -0500
Received: from mail-pg1-f194.google.com ([209.85.215.194]:35564)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <alexvong1995@gmail.com>) id 1gMvLi-00045t-J7
 for 33347@debbugs.gnu.org; Wed, 14 Nov 2018 08:36:54 -0500
Received: by mail-pg1-f194.google.com with SMTP id 32-v6so7392474pgu.2
 for <33347@debbugs.gnu.org>; Wed, 14 Nov 2018 05:36:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=from:to:cc:cc:subject:references:date:in-reply-to:message-id
 :user-agent:mime-version;
 bh=/dKFC15myPuatk4bhTEsc62U3+UjR9ZJRGJykRWTDrs=;
 b=LYs6Met3xANjkKUayZuBoWAoHWMJD81QiVTfsU+vVowo8mqgERi0HgEVEJl1706zfO
 dot1LGVKkFKxI6ZR1qqSWWFdnJ6rTf3rNLefh5MAiYUBgVAY587Mb5cNyZwNRH3ViFzW
 bQ40Om/L+ZbHqrGzBFnG2dhQF2bihnNBEO7H2OvqtJYyry7em5MADXjK6R0nF0K9eplw
 wvpVg/Yo1EhQcpeoevkNpU/RG9CEIWrf1pkXRzbajJyt36B7Wmi+hhZmjKHsiOnCSab7
 OCBNLJPfxjnaNxQNwxO0Jh1UsEolviBE4FZceNgQ2xoB2gqgiLp6hqAMyIZOaMscAjgR
 +mQA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:from:to:cc:cc:subject:references:date
 :in-reply-to:message-id:user-agent:mime-version;
 bh=/dKFC15myPuatk4bhTEsc62U3+UjR9ZJRGJykRWTDrs=;
 b=jFYLn1PEYZZnWS7eGc9suycxO2t18xCjv+7kXWg90habTQTeWLClrqiAAS+lc73rQ3
 4o18DglmvnM92EcUHv2/uv8sH+iL4fmSd7C6GlFv/Mkfriru3u47ohxWVDqJY9FdPUmp
 7DMlhS9jpT2rmF0wcaSBPe2KCEJSw1Mu5Wfzu0b8EnVc61KeDrP0rkRvt7ql5xVk+/6O
 byoV+NCgsTNZD59e6rKxmFEsuB6PgkBj+vDBb0WIYCX6Ty89kecx0oE+pIU/N8w1LA6g
 rqHXoPxetp7MQVi5R6o1FLu5nN1I859gvF9nx3QJL5gBcv9198V/zndMXG/FqTib/o5R
 Gk5w==
X-Gm-Message-State: AGRZ1gK0rdrDJNtqV894txvg8WcjxudszSVWlBsJL+IlwkM4f6gm8nk6
 ndKQmGjthgXHGWIJ03eKUAE=
X-Google-Smtp-Source: AJdET5fpZ0cny9wXUC3BtDJA5MYJKRXsbj+uNNtQrYZSVJUrculV8EksdDX4Zj/CZRy88RSknuPqKA==
X-Received: by 2002:a62:1c06:: with SMTP id c6mr1951085pfc.157.1542202608616; 
 Wed, 14 Nov 2018 05:36:48 -0800 (PST)
Received: from debian (1-64-83-198.static.netvigator.com. [1.64.83.198])
 by smtp.gmail.com with ESMTPSA id 67-v6sm30390759pfk.134.2018.11.14.05.36.45
 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256);
 Wed, 14 Nov 2018 05:36:47 -0800 (PST)
From: Alex Vong <alexvong1995@gmail.com>
To: Leo Famulari <leo@famulari.name>
Subject: Re: [bug#33347] [PATCH 4/4] gnu: teeworlds: Update to 0.7.0 [fixes
 CVE-2018-18541].
References: <871s7r3095.fsf@gmail.com> <87k1lj1le4.fsf@gmail.com>
 <20181113165310.GC8498@jasmine.lan>
Date: Wed, 14 Nov 2018 21:36:25 +0800
In-Reply-To: <20181113165310.GC8498@jasmine.lan> (Leo Famulari's message of
 "Tue, 13 Nov 2018 11:53:10 -0500")
Message-ID: <8736s33hnq.fsf@gmail.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha256; protocol="application/pgp-signature"
X-Spam-Score: 0.3 (/)
X-Debbugs-Envelope-To: 33347
Cc: 33347@debbugs.gnu.org, alexvong1995@gmail.com
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -0.7 (/)

[Message part 1 (text/plain, inline)]

Leo Famulari <leo@famulari.name> writes:

> On Mon, Nov 12, 2018 at 03:09:39AM +0800, Alex Vong wrote:
>>           (replace 'configure
>>             (lambda* (#:key outputs #:allow-other-keys)
>> +             (define (use-latest-json-parser file)
>> +               (substitute* file
>> +                 (("engine/external/json-parser/json\\.h")
>> +                  "json-parser/json.h")
>> +                 (("json_parse_ex\\(&JsonSettings, pFileData, aError\\);")
>> +                  "json_parse_ex(&JsonSettings,
>> +                                 pFileData,
>> +                                 strlen(pFileData),
>> +                                 aError);")))
>> +
>
> Please add a code comment explaining this.
>
OK

>> -    ;; FIXME: teeworlds bundles the sources of "pnglite", a two-file PNG
>> -    ;; library without a build system.
>
> These sorts of mini-libraries are designed to be copied and pasted into
> host projects rather than packaged on their own. That's why they don't
> include a build system. For example, many cryptographic primitive
> implementations are distributed this way — that's why you never see a
> package for 'SHA256'. Is there a particular reason we should unbundle
> pnglite?

Well, I though we have a policy to remove bundle dependencies in order
to avoid building the same library many times. Do we make exceptions for
shared libraries w/o a build system? (an exception I can think of is
gnulib)

Besides, the FIXME comment seems to suggest future readers to help
remove the bundled pnglite. Debian also removes the bundled pnglite in
teeworlds[0].

Thanks for all the feedback!

[0]: https://packages.debian.org/sid/teeworlds

[signature.asc (application/pgp-signature, inline)]

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 12:23:05 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#33347 [PATCH 0/4] gnu: teeworlds: Update to 0.7.0 [fixes CVE-2018-18541].