[lubuntu-devel] XScreenSaver has *another* time bomb in it

[Aaron Rainbolt]

On 2/18/24 11:22, Tormod Volden wrote:
> Hi Aaron,
>
> Thanks for your e-mail. First, I am sorry that it took me so long to
> come back to this. I am now packaging the new 6.08 version.
>
> Thanks for the notice about the new "upgrade notices". I have included
> your patch in Debian and adapted it for 6.08 as well. I still have a
> couple of months to patch the old 6.06 version in stable before the
> notice will pop up for the users. And yes, thanks, I appreciate your
> "discreteness", it is better to sort out this without involving Jamie
> any more than necessary.
>
> In 6.08 there is no more the notice in demo-Gtk.c, but the one in
> dialog.c is still there. There is also one in the debug output but I
> am leaving that in place. I am thinking of adding a "do not report
> issues to upstream" message to that one.
>
> I was slacking so long with 6.07 and 6.08 because bookworm was just
> released. But now it is time, and also I remembered there is soon the
> new Ubuntu LTS and various freezes coming up. So we should really try
> to get 6.08 into Ubuntu 24.04. Are you willing to cooperate on this?
Definitely. I have upload access to XScreensaver and am pretty familiar 
with it.
> There is soon the upstream freeze for 24.04 but I guess that is not
> directly relevant since xscreensaver requires merging old Ubuntu
> changes anyway? In any case I will press hard to get 6.08 into testing
> so that it can be merged into Ubuntu soon.
It would be better to get it in before Feature Freeze on February 29, 
however if we miss it, I can file a Feature Freeze Exception. If we're 
close to the freeze, we can probably get it in, since it's a feature 
goal for us to have a recent XScreensaver in our repos, I believe.I'll 
CC in lubuntu-devel so that in the event I'm unable to help with this, 
someone else will be aware and can help pick it up. (I'm pretty sure 
I'll be able to help with this though.)
> Last time I prepared the new merged Ubuntu debdiff myself, for 6.02,
> it took so long before any Ubuntu developers looked at it:
> https://bugs.launchpad.net/bugs/1961634  . So I am not so motivated to
> do it again this way. Are you a Ubuntu developer so you can upload
> such things? Or at least work on the right people to get it done? And
> can you help with a merge freeze exception if something like this is
> needed?
I can help with an exception if needed, and I can even do the merge 
myself if you prefer. I'm happy to review and sponsor a merge for you if 
you want to do it, but I'm fine with saving you the effort and doing the 
merge here.
> I have currently pushed what is a pretty ready 6.08 packaging to
> Salsa. Can you please check it out? If you don't notice any thing
> missing, I will ask my uploader Andrew if he can sponsor it.

Sure, will try to get to that later today.

Thanks for your help with this!Hope you're doing well.

> Best regards,
> Tormod
>
>
> On Thu, Mar 23, 2023 at 4:51 AM Aaron Rainbolt<arraybolt3 at ubuntu.com>  wrote:
>> Heya, thought I should let you know about this since this will probably
>> affect Debian Bookworm eventually.
>>
>> At least in XScreenSaver 6.02, there are a couple of new time-triggered
>> code segments that cause XScreenSaver to display warnings once the
>> version of XScreenSaver in use becomes "very old". I assume this
>> probably affects the newest version of XScreenSaver too, which means
>> that Debian Bookworm will probably start displaying these messages if
>> they aren't patched out before then.
>>
>> The files with the code snippets are driver/demo-Gtk.c and
>> driver/dialog.c. The code snippets (and the patch Ubuntu is now using to
>> disarm them) can be seen in the patch here:
>> http://launchpadlibrarian.net/654675808/xscreensaver_6.02+dfsg1-2ubuntu1_6.02+dfsg1-2ubuntu2.diff.gz
>> It might be worth it to do some searches for any other problematic code,
>> just in case the latest version of XScreenSaver has additional traps in it.
>>
>> Hope this helps! I'm doing this as an email rather than a bug report
>> since I know jwz sometimes sees XScreenSaver bug reports and I'm sure he
>> won't be very happy if/when he learns that the new time bombs have been
>> found and patched out.
>>
>> Best regards,
>>
>> --
>> Aaron Rainbolt
>> Lubuntu Developer
>> https://github.com/ArrayBolt3
>> https://launchpad.net/~arraybolt3
>> @arraybolt3:lubuntu.me on Matrix, arraybolt3 on irc.libera.chat
>>
-- 
Aaron Rainbolt
Lubuntu Developer
Matrix: @arraybolt3:matrix.org
IRC: arraybolt3 on irc.libera.chat
GitHub:https://github.com/ArrayBolt3

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/lubuntu-devel/attachments/20240218/3216e4f7/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x84FC20D468BEFD4D.asc
Type: application/pgp-keys
Size: 3996 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/lubuntu-devel/attachments/20240218/3216e4f7/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/lubuntu-devel/attachments/20240218/3216e4f7/attachment.sig>