glpng patches

[Hans de Goede]

Hi,

On 06/02/2014 10:18 PM, James Le Cuirot wrote:
> On Mon, 02 Jun 2014 10:50:55 +0200
> Hans de Goede <hdegoede at redhat.com> wrote:
> 
>> On 06/02/2014 12:20 AM, James Le Cuirot wrote:
>>>
>>> I have a series of patches for glpng, resulting in an eventual bump
>>> to version 1.46. This bump is needed as you will see and it's
>>> probably about time, seeing as the
>>
>>> A few come from Aquaria, most
>>> notably the addition of memory reading functions.
>>>
>>> The only other game I know of that uses this is Chromium BSU. I've
>>> checked that it still builds and works but I've only just discovered
>>> that most distros have opted to build it against SDL_image instead.
>>> Gentoo still uses glpng but if I'd known that before, I might not
>>> have spent so long on this. Oh well. :)
>>
>> First if all I appreciate your work on this, and the posting of the
>> patches. But what exactly is the purpose of this, a chance to
>> comment / review before you do an official 1.46 release ?
> 
> Sorry if my intention was not clear. These are based on the repository
> at http://repo.or.cz/w/glpng.git and I wish for them to be merged
> there. Miriam, I believe you're in charge of it?

Ok.

>> Upstream seems to be dead, there is this page:
>> http://www.fifi.org/doc/libglpng-dev/glpng.html
> 
> I know this has been reported as upstream in the past but I don't
> believe it ever really has been. If you step up a level, you'll see
> that it is nothing more than a documentation host.
> 
> http://www.fifi.org/doc/
> 
> The real upstream was http://www.wyatt100.freeserve.co.uk and that has
> long since died. I am submitting the patches to this list on the basis
> that it is the current upstream.
> 
>> But that has a broken download link. So if you're going to do a new
>> release maybe you can register a sourceforge or github proejct for
>> it, and put official tarbals up there ?
> 
> I have little interest in doing further maintenance going forward. I
> think the existing repository serves as an adequate base for the two
> games that use it. Once merged, the last commit could be tagged as
> v1.46 and gitweb's own ability to provide tarballs should suffice.

Ok, that works for me.

> I did this work in the process of unbundling libraries from Aquaria so
> that it could be packaged for Gentoo. I thought it would be of
> immediate benefit to other distributions that package glpng but then I
> discovered that they have since removed it.
> 
> It wasn't a complete waste of time though as the latest GPL version of
> Aquaria bundles a custom copy of glpng that is still vulnerable to
> CVE-2010-1519. This is also true of the retail binary version that most
> people are using so maybe the other distributions should consider
> packaging the GPL version of the game. It has many other improvements
> too, including SDL2 support and various bug fixes. I will continue to
> work with the current maintainer to make it more distro-friendly.
> 
> Maybe Aquaria could be modified to use SDL_image instead but I don't
> know how that would impact performance and it's not something I am
> willing to put time into. Perhaps False Genesis can comment here.

Thanks for your work on getting the Aquaria sources in good shape!

Regards,

Hans