glpng patches

[James Le Cuirot]

On Mon, 02 Jun 2014 10:50:55 +0200
Hans de Goede <hdegoede at redhat.com> wrote:

> On 06/02/2014 12:20 AM, James Le Cuirot wrote:
> > 
> > I have a series of patches for glpng, resulting in an eventual bump
> > to version 1.46. This bump is needed as you will see and it's
> > probably about time, seeing as the
> 
> > A few come from Aquaria, most
> > notably the addition of memory reading functions.
> > 
> > The only other game I know of that uses this is Chromium BSU. I've
> > checked that it still builds and works but I've only just discovered
> > that most distros have opted to build it against SDL_image instead.
> > Gentoo still uses glpng but if I'd known that before, I might not
> > have spent so long on this. Oh well. :)
> 
> First if all I appreciate your work on this, and the posting of the
> patches. But what exactly is the purpose of this, a chance to
> comment / review before you do an official 1.46 release ?

Sorry if my intention was not clear. These are based on the repository
at http://repo.or.cz/w/glpng.git and I wish for them to be merged
there. Miriam, I believe you're in charge of it?

> Upstream seems to be dead, there is this page:
> http://www.fifi.org/doc/libglpng-dev/glpng.html

I know this has been reported as upstream in the past but I don't
believe it ever really has been. If you step up a level, you'll see
that it is nothing more than a documentation host.

http://www.fifi.org/doc/

The real upstream was http://www.wyatt100.freeserve.co.uk and that has
long since died. I am submitting the patches to this list on the basis
that it is the current upstream.

> But that has a broken download link. So if you're going to do a new
> release maybe you can register a sourceforge or github proejct for
> it, and put official tarbals up there ?

I have little interest in doing further maintenance going forward. I
think the existing repository serves as an adequate base for the two
games that use it. Once merged, the last commit could be tagged as
v1.46 and gitweb's own ability to provide tarballs should suffice.

I did this work in the process of unbundling libraries from Aquaria so
that it could be packaged for Gentoo. I thought it would be of
immediate benefit to other distributions that package glpng but then I
discovered that they have since removed it.

It wasn't a complete waste of time though as the latest GPL version of
Aquaria bundles a custom copy of glpng that is still vulnerable to
CVE-2010-1519. This is also true of the retail binary version that most
people are using so maybe the other distributions should consider
packaging the GPL version of the game. It has many other improvements
too, including SDL2 support and various bug fixes. I will continue to
work with the current maintainer to make it more distro-friendly.

Maybe Aquaria could be modified to use SDL_image instead but I don't
know how that would impact performance and it's not something I am
willing to put time into. Perhaps False Genesis can comment here.

Regards,
James