New upstream for jumpnbump, upcoming release 1.60 and call for help

[Rémi Verschelde]

2017-05-17 12:24 GMT+02:00 Fabian Greffrath <fabian at debian.org>:
> Hi Remi,
>
> Rémi Verschelde wrote:
>> GitLab [1]. Our fork is the most advanced jumpnbump code base, and we
>> intend to become the reference upstream project.
>
> thanks for that, I am looking forward to packaging your new release!

Awesome! It should be ready within a couple days, the last thing I
want to do is to upstream jumpnbump-menu and improve its Makefile to
allow customizing the paths to the binaries and levels for each
distro.

>> existing Debian patches [3], and most were either merged or superseded
>> by our own developments (there are two I plan to review in detail
>
> It would have been nice if you kept attribution to the original patch
> authors at least im the commit messages. (Edit: I have seen that you just
> modified the AUTHORS file, thanks for that!)

Indeed, I would have kept the original author attribution personally,
but those patches had already been merged in 2015 by Côme, and with
git there's no way back :)

>> The last outstanding issue that we want to fix before the 1.60 release
>> is the unsafe handling of temporary files ([4], debian#500611 [5]),
>> which Ansgar patched in 2008. As your patch breaks the Windows
>> support, we can't merge it as is, and so far we don't fully understand
>> the security issues it is addressing, so we would welcome your help to
>> merge a cross-platform fix upstream.
>
> Well, I am not Ansgar, but I 'll try to reply anyway. ;)
>
> The problem is that there is no mkstemp() on Windows; natively, that is, I
> am sure it is available if using MinGW instead of MSVC. If you used
> autoconf you could check for the presence of this function and act
> accordingly, but you don't.
>
> The patch rips out the entire "constant file name" solution for Windows,
> which shouldn't be strictly necessary. I'd suggest to keep filename as a
> char pointer and still keep two routes, one for e.g. "#ifdef _MCS_VER" and
> one for the rest. In the former one let filename =
> strdup("jnb.tmpmusic.mod") and in the second one go the route that has
> been added by the patch. This will play safe on Unix systems and remain
> "unsafe" on Windows.
>
> And you should probably replace unlink() with remove().
>
> Hope that helps!

Thanks a lot for those detailed explanations, I did that and got this
patch: https://gitlab.com/LibreGames/jumpnbump/merge_requests/18

I tested it on Mageia Linux with GCC, and MinGW-w64 for Win32 and
Win64 binaries, all seem to work as expected.
>
> Cheers,
>
> Fabian

Librement,
Rémi