21.4 (ex 22.0) Release Status / Call for Testers and Volunteers
24 years, 1 month
Stephen J. Turnbull
Stephen J. Turnbull
** STATUS REPORT
The version number of the March 1 release is being demoted from 22.0
to 21.4, due to late delivery of the merge of GTK+ support to the 21.2
code base, and of the Mule on Windows work being done by Ben Wing.
Inclusion of these features wasn't terribly plausible on the tight
schedule we chose, but it was worth a try. Perhaps related to that
impetus, these features are being actively worked on, and are
scheduled for delivery in the release of 22.0 in the third quarter of
2001. This schedule is realistic on current pace.
In the 21.4 tarballs, GTK support is planned for inclusion on an
untested, unsupported experimental basis. Configuration of the
support will default to _off_, in testing as well as in the release.
Mule on Windows is more problematic. A CVS branch will be created in
the near future, and we hope for a merge into the _21.5 development
branch_ by early spring.
The 21.4 release will include the gutters and widgets feature,
allowing embedding of toolkit widgets in frames and buffers. The
basic framework is fairly solid, but 21.4 will include only minimal,
demonstration-level application code.
The other major feature planned for 21.4 is "SUMO in source kit."
This is intended to address the "OK, I've built it, it starts, but it
doesn't _do_ anything" FAQ. Although the package architecture is
sound, it is still difficult to bootstrap. The default tarball will
include the SUMO package tarball, so that the build will install a
full-featured XEmacs environment. Disaggregated source kits will
still be available for those who prefer to choose what they install,
rather than installing everything then removing what's not wanted.
On the Windows platform, this issue seems to have been successfully
addressed via Andy Piper's port of the Cygwin netinstaller.
Other features' development is generally proceeding on schedule, and
assorted bugs and "pessimizations" have been discovered. Many have
been fixed, others are being worked on.
More details, and information on individual features, will be made
available on the Release Status Page:
http://www.xemacs.org/Releases/Public-21.2/
Discussion of release plans, as well as all other issues related to
XEmacs development, is taking place on the developers' mailing list,
xemacs-beta(a)xemacs.org
xemacs-beta is an open mailing list. You can subscribe from the
XEmacs home page, http://www.xemacs.org/, or by sending a request
containing the word `subscribe' (without quotes) in the _body_ of the
message to xemacs-beta-request(a)xemacs.org. List archives are
available at http://list-archives.xemacs.org/xemacs-beta/.
** RELEASE MANAGER
Yes, I've been out of it for a couple of weeks. "Senior panic" is
over (Japanese students graduate in mid-March), so I'll have more time
to devote to things like monitoring comp.emacs.xemacs, and updating
the release pages.
Specifically management-related tasks like this announcement are
lagging schedule by about a week. However, coding and testing are
proceeding on schedule as far as can be known.
** CALL FOR TESTERS
We need beta testers! Only you can tell us if XEmacs builds and works
well on your system, in the configuration you need. We especially
need to test --with-gtk=no builds on systems that don't support GTK+.
The number one testing priority now is building the gtk-xemacs merged
code, _without_ GTK+ support. To include GTK+ support, even on an
experimental basis, in the release tarballs, we must be sure it has no
adverse impact on the supported code. For details on getting,
building, and testing the GTK+ branch and development mainline, see
http://www.xemacs.org/Releases/Public-21.2/tester.html
Testers should subscribe to xemacs-beta, or review the archives
regularly.
** 22.0 RELEASE
A proposal to release the next version of XEmacs, 22.0, planned to
include support for GTK+ and better integration of Mule with the
Windows I18N API, is in the works. The target will be the end of 3rd
Quarter, 2001.
If you have "big things" in mind for XEmacs, why don't you write up a
"feature proposal" and send it my way? It needn't be something you
personally plan to do. Some people implement their wishes (e.g.,
http://www.xemacs.org/ArchitectingXEmacs/, Ben Wing's "Architecting
XEmacs"); others just publish them (for example, Jamie Zawinski's
"XEmacs Wishlist", http://www.jwz.org/doc/xemacs-wishlist.html).
** CALL FOR VOLUNTEERS
We need workers!
* 22.0 Release Manager
The 21.4 Release Manager plans to retire in April. How would _you_
like to be known for releasing the first XEmacs with GTK and Windows
I18N API support? You _know_ you would! Write me, Stephen Turnbull
<stephen(a)xemacs.org>, and we can talk about your qualifications and
the job's responsibilities. Currently active XEmacs developers
preferred, of course, but it's not an absolute requirement. You
mostly just need to be able to say "no". :-) (It does help to have a
track record as a developer. But there are other ways to establish
credibility.)
Appointment subject to approval of the XEmacs Review Board.
* Bug Tracking System
Gunnar Evermann, our BTS maintainer, is doing the best he can. But
after years of neglect of the BTS, he needs help. There are about
1000 entries in the system. If we can get 5 volunteers to just
_classify_ 10 messages, and prioritize maybe one actual bug, per week,
in six months we'll be on top of the problem. You don't need to be
intimately familiar with XEmacs internals, nor even terribly
technical, to do this. The data doesn't get thrown away, so a few
misclassifications won't hurt anywhere near as much as a little bit of
classification will help.
* Documentation
Much effort has been made to improve the documentation, especially by
Adrian Aichner in creation of the Sourceforge project to handle our
web page, and putting together the bits and pieces that are the XEmacs
FAQ list. Our own "sorceror's apprentice", Martin Buchholz, has been
busily sweeping away typographical lint from comments and docstrings
as he cleans up the code.
But there are many places where XEmacs documentation is inaccurate,
incomplete, inaccessible, or simply nonexistent. All of these are
bugs, and we ask you all to report them, and where possible provide
fixes, just as enthusiastically as you report crashes and
functionality bugs.
* General
We always need people to fix bugs and add features. It's not
necessarily technically hard, especially at the Lisp level. And
XEmacs's development process imposes relatively few political
obstacles.
With the addition of GTK+ support in the near future, we will get
libglade support, allowing use of the Glade UI design tool to
prototype Custom interfaces and dialog boxes. If you have GTK+/GNOME
support on your system, you can install Glade and start prototyping
the XEmacs of the future.
--
University of Tsukuba Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
Institute of Policy and Planning Sciences Tel/fax: +81 (298) 53-5091
_________________ _________________ _________________ _________________
What are those straight lines for? "XEmacs rules."
- 1 participants
- 0 comments
Packages and SUMOs Released - Feb, 2001
24 years, 1 month
Steve Youngs
Steve Youngs
Hi Folks.
It's been way too long since the last SUMO release so here it is.
The reason for the long delay... well that's an even longer story.
Suffice to say that I'm a lot poorer, but I've got some shiny new
hardware.
Because of quirks of md5sum, _every_ package has been updated.
So you may just want to grab the SUMOs this time.
Stuff Thats New or Updated:
==========================
BBDB Doc fixes.
Eicq udp2tcp statically linked
Squash a bug that was causing the splash screen in
XEmacs 21.2.x to not display.
Gnus Doc fixes.
Moved rfc2104.el to mail-lib package.
Mailcrypt Now correctly finds needed macros.
Mew Doc fixes, and killed a couple of compiler warnings.
Net-Utils Update emacsbug.el
Supercite Change mailing list address.
Update supercite.el to use functions from mail-extr.
TM Now will only load the Gnus portion if your Gnus
version is < 5.8.0.
VM Sync with VM-6.89
W3 Doc fixes.
Moved base64.el to mail-lib package.
Misc-Games Doc fixes.
Apel Removed emu-mule.el.
Edebug Doc fixes.
Update edebug.el.
Mail-Lib New files - rfc2104.el (from Gnus), base64.el (from W3)
starttls.el
Updated - smtpmail.el, mail-abbrevs.el, sendmail.el,
mail-utils.el, mail-headers.el,
reporter.el
XEmacs-Base Doc fixes.
Updates to - add-log.el, comint.el, case-table.el,
shell.el.
XEmacs-Devel New file - checkdoc.el
Update profile.el.
Lookup Now correctly installs into mule-packages.
SKK Sync with 10.62a
Calc Update calc-alg-2.el.
Edit-Utils Updates to - icomplete.el, man.el, redo.el,
detached-minibuf.el.
Ispell Suppress horizontal scroll bar in choices window.
Speedbar Sync with 0.13.
Text-Modes New file - ansi-color.el.
Updated - htmlize.el, filladapt.el.
Eshell New package!
OS-Utils Update uncompress.el.
Pcomplete New Package!
PS-Print-noMule Update ps-print.el.
CC-Mode Doc fixes.
Debug Doc fixes.
Ediff Lots of updates, see ediff's ChangeLog for details.
Idlwave Sync with 4.7.
Prog-Modes Update make-mode.el.
Sync sql.el with 1.4.25.
Semantic Sync with 1.3.2.
Auctex Doc fixes.
Viper See viper's ChangeLog for details.
Install Instructions:
====================
SUMO:
----
Simply unpack them into /usr/local/lib/xemacs/
Individual Packages:
-------------------
Using XEmacs 21.1.x
Options -> Manage Packages -> Add Download Site -> pick site
Options -> Manage Packages -> List & Install
Choose packages to install.
Packages -> Add Required (sometimes vc-cc shows up at this
step, it shouldn't so only install it if you use
clearcase)
Packages -> Install/Remove Selected
Restart XEmacs.
Using XEmacs 21.2.x
Tools -> Packages -> Add Download Site -> pick site
Tools -> Packages -> List & Install
The rest as per XEmacs 21.1.x
--
|---<Steve Youngs>---------------<GnuPG KeyID: 9E7E2820>---|
| XEmacs - It's not just an editor. |
| It's a way of life. |
|------------------------------------<youngs(a)xemacs.org>---|
- 1 participants
- 0 comments
Remote vulnerability in gnuserv/XEmacs
24 years, 1 month
Jan Vroonhof
Jan Vroonhof
SUMMARY
All currently available versions of gnuserv for unix prior to 3.12 are
vulnerable to remote exploit due to a buffer overflow and weak
security. Gnuserv is a remote control facility for Emacsen. Gnuserv
ships with XEmacs but is also available stand-alone from various
sources for use with GNU Emacs.
VULNERABILITY
An attacker can excute remote commands with the uid of the user that
is running gnuserv.
DISCOVERER AND ACKNOWLEDGEMENTS
This problem was discovered by Klaus Frank
<klausf(a)i3.informatik.rwth-aachen.de>. Klaus provided a fix as
well. Many thanks to Klaus for bringing this to attention of the
XEmacs and gnuserv maintainers.
I also with to thank Vince Shelton and Martin Schwenke for putting
fixed releases of XEmacs and gnuserv on the net quickly.
DETAIL
gnuserv/gnuclient is a pair of utility programs used to
sent commands to an already running Emacs process. gnuserv
is the helper binary used by the running Emacs to listen
for commands. It must be started explicitly using the gnuserv-start
command.[1]
gnuserv can use several different communication mechanisms, one of
them being a tcp port. This can be switched off at compile time, but
defaults to on. If enabled gnuserv binds to a user specified TCP port,
with the default being (21490 + uid). Note that (if enabled) gnuserv
_always_ listens for TCP connections, even if one of the other
mechanisms is normally used by the user.
Connections on the gnuserv port are authenticated either against a
list of trusted hosts or using a MIT-MAGIC-COOKIE based system.
(MIT-MAGIC_COOKIE authentication can be switched of, but again is the
default.)
The problem lies in the fact that the gnuserv program trusts the
remote sides specification for the lenght of the cookie without
any sanity checking. This allows the attacker to
1. Overflow the buffer used to hold a copy of the cookie.
2. Force the comparison of the cookies to be restricted to
a prefix of a length chosen by him, e.g. 1 byte, making
bruteforcing the authentication trivial.
Both problems are sufficient to give any attacker easy access
to running arbitrary commands under the uid of the user running
gnuserv.
VULNERABLE VERSIONS
Unfortunately gnuserv has rather a complicated history:
gnuserv was origionally written by Andy Norman (ange). The problematic
Xauth based authentication was later added by somebody else. As ange
effectively stopped maintaining his version (gnuserv-2.1alpha.tar.gz)
various people have put up their own modified copies. That includes
among others the version shipped with XEmacs and fgnuserv by Noah
Friedman, which is an easier to compile stand-alone version.
After a recent rewrite we made the XEmacs version the official
verion[2], and bumped the version number to the 3.x range. Martin
Schwenke has made a backport of this version for use with Emacs
using fgnuserv's build mecahnism.
All of the above versions should be assumbed vulnerable, including
those shipped with XEmacs 21.1.x for x < 14. As a test run
strings gnuserv | grep "gnuserv version"
If this gives either nothing or a version below 3.12, then you are
vulnerable.
NOT VULNERABLE
There is a seperate fork for gnuserv on windows for use with NTEmacs.
This is not vulnerable as it uses a completely different communication
channel. This is, however, unconfirmed.
FIXED VERSION
A fix by Klaus Frank is in gnuserv 3.12.
If you are using XEmacs we suggest upgrading to XEmacs 21.1.14
that contains this version (or 21.2.35 if you are running betas).
This version can be had from
http://www.xemacs.org/Releases/21.1.14.html
or mirrors.
If you are using a standalone gnuserv with GNU Emacs on unix we
suggest getting Martin Schwenkes fixed version from
http://www.linuxcare.com.au/people/martins/hacks/emacs/src/gnuserv-3.12.1...
REFERENCES
This is the vulnerability indicated in Mandrake Advisory MDKSA-2001:019
Jan Vroonhof <jan(a)xemacs.org>
Gnuserv feel-responsible-for-person
Footnotes:
[1] However I have seen many icons for XEmacs in UI's start
"xemacs -f gnuserv" so it is not always obvious to the
user he is running gnuserv.
[2] With permission form Andy Norman
- 2 participants
- 1 comments