Help testing emacs-28.3-rc1.tar.gz on MS-Windows

Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Stefan Kangas]

[-- Attachment #1: Type: text/plain, Size: 942 bytes --]

Hi Emacs,

I'm looking for someone to help test that the Emacs 28.3 tarball builds
on MS-Windows.  (I have tested it on GNU/Linux and macOS.)

The tarball is available here:

https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.gz
https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.gz.sig

Check the signature with:

    gpg --verify emacs-28.3-rc1.tar.gz.sig

These are the tarball checksums:

$ sha1sum emacs-28.3-rc1.tar.gz
775cf5d7623fde55a3505abfdba53937dfc5fca1  emacs-28.3-rc1.tar.gz
$ sha256sum emacs-28.3-rc1.tar.gz
4857262fd6165120737a74778d4f02d5282308b076cd4e7edcd8864e6ae0d2a7
emacs-28.3-rc1.tar.gz

Note that we will not have time for a full pretest; the only changes
with regards to Emacs 28.2 are documentation changes, some minor bug
fixes, and four security fixes (including CVE-2022-45939).  So once I
can get confirmation that it builds on MS-Windows, I will make the
release, hopefully already later today.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 519 bytes --]

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[lux]

On Sun, 2023-02-19 at 02:51 -0800, Stefan Kangas wrote:
> Hi Emacs,
> 
> I'm looking for someone to help test that the Emacs 28.3 tarball
> builds
> on MS-Windows.  (I have tested it on GNU/Linux and macOS.)
> 
> The tarball is available here:
> 
> https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.gz
> https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.gz.sig
> 
> Check the signature with:
> 
>     gpg --verify emacs-28.3-rc1.tar.gz.sig
> 
> These are the tarball checksums:
> 
> $ sha1sum emacs-28.3-rc1.tar.gz
> 775cf5d7623fde55a3505abfdba53937dfc5fca1  emacs-28.3-rc1.tar.gz
> $ sha256sum emacs-28.3-rc1.tar.gz
> 4857262fd6165120737a74778d4f02d5282308b076cd4e7edcd8864e6ae0d2a7
> emacs-28.3-rc1.tar.gz
> 
> Note that we will not have time for a full pretest; the only changes
> with regards to Emacs 28.2 are documentation changes, some minor bug
> fixes, and four security fixes (including CVE-2022-45939).  So once I
> can get confirmation that it builds on MS-Windows, I will make the
> release, hopefully already later today.

Stefan, this is a new vulnerability found in orgmode, which also exists
in the built-in orgmode of Emacs 28. Does it need to be fixed together
in 28.3?

https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A@qq.com/T/#t

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Eli Zaretskii]

> From: Stefan Kangas <stefankangas@gmail.com>
> Date: Sun, 19 Feb 2023 02:51:28 -0800
> Cc: lx@shellcodes.org, Troy Hinckley <comms@dabrev.com>
> 
> I'm looking for someone to help test that the Emacs 28.3 tarball builds
> on MS-Windows.  (I have tested it on GNU/Linux and macOS.)

It built fine on my MS-Windows box, thanks.

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Stefan Kangas]

Eli Zaretskii <eliz@gnu.org> writes:

> It built fine on my MS-Windows box, thanks.

Thanks for testing!

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Stefan Kangas]

lux <lx@shellcodes.org> writes:

> Stefan, this is a new vulnerability found in orgmode, which also exists
> in the built-in orgmode of Emacs 28. Does it need to be fixed together
> in 28.3?
>
> https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A@qq.com/T/#t

Thanks for continuing to work on improving Emacs' security.

I don't want to delay Emacs 28.3 any more, and I'm ready to release it
now.  Perhaps it's fine to wait with this fix until Emacs 29.1,
especially seeing that Org Mode can release a new fixed version through
GNU ELPA immediately, and distributions can pick it up from there.
Furthermore, the Emacs 29 pretest will start any day now.

But I'd like to hear what others think.  Is it important to include this
fix in Emacs 28.3?

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[lux]

On Sun, 2023-02-19 at 02:51 -0800, Stefan Kangas wrote:
> Hi Emacs,
> 
> I'm looking for someone to help test that the Emacs 28.3 tarball
> builds
> on MS-Windows.  (I have tested it on GNU/Linux and macOS.)
> 

Builted successfully in MS-Windows 10 + MYSYS MingW.

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Stefan Kangas]

lux <lx@shellcodes.org> writes:

> Builted successfully in MS-Windows 10 + MYSYS MingW.

Thanks for testing!

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[N. Jackson]

At 02:51 -0800 on Sunday 2023-02-19, Stefan Kangas wrote:
>
> Hi Emacs,
>
> I'm looking for someone to help test that the Emacs 28.3 tarball builds
> on MS-Windows.  (I have tested it on GNU/Linux and macOS.)
>
> The tarball is available here:
>
> https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.gz

Hi Stefan,

Should the copyright date not be bumped to 2023?

When I build this tarball I get

  GNU Emacs 28.3 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.24.35, cairo version 1.17.6)
   of 2023-02-19
  Copyright (C) 2022 Free Software Foundation, Inc.

which is last year.

Also the README file (which has the version number for this release,
so presumably it has been modified) still has a 2022 copyright date.

If this is not important, I apologise for the noise.

N.

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Stefan Kangas]

N. Jackson <njackson@posteo.net> writes:

> When I build this tarball I get
>
>   GNU Emacs 28.3 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.24.35, cairo version 1.17.6)
>    of 2023-02-19
>   Copyright (C) 2022 Free Software Foundation, Inc.
>
> which is last year.
>
> Also the README file (which has the version number for this release,
> so presumably it has been modified) still has a 2022 copyright date.

There are a gazillion files where the copyright date is 2022 instead of
2023, and I'd like to avoid going over all of them.  Perhaps we could
change just a few of them, however, if it's important and/or worth
doing.  Eli, WDYT?

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Eli Zaretskii]

> From: Stefan Kangas <stefankangas@gmail.com>
> Date: Sun, 19 Feb 2023 06:06:24 -0800
> Cc: emacs-devel@gnu.org
> 
> N. Jackson <njackson@posteo.net> writes:
> 
> > When I build this tarball I get
> >
> >   GNU Emacs 28.3 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.24.35, cairo version 1.17.6)
> >    of 2023-02-19
> >   Copyright (C) 2022 Free Software Foundation, Inc.
> >
> > which is last year.
> >
> > Also the README file (which has the version number for this release,
> > so presumably it has been modified) still has a 2022 copyright date.
> 
> There are a gazillion files where the copyright date is 2022 instead of
> 2023, and I'd like to avoid going over all of them.  Perhaps we could
> change just a few of them, however, if it's important and/or worth
> doing.  Eli, WDYT?

Unfortunately, I think we must update all of them, for legal reasons.
Let's ask Richard.

Richard, am I right that we must update the copyright years on all of
the files in the Emacs 28.3 tarball, even though it is an emergency
security release?

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Ulrich Mueller]

>>>>> On Sun, 19 Feb 2023, Stefan Kangas wrote:

> The tarball is available here:

> https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.gz
> https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.gz.sig

Any special reason why this is .tar.gz, and not .tar.xz like all other
files in the directory? (I am asking because with .gz it will need an
additional case distinction in the Gentoo ebuild.)

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Ulrich Mueller]

>>>>> On Sun, 19 Feb 2023, Stefan Kangas wrote:

> There are a gazillion files where the copyright date is 2022 instead of
> 2023, and I'd like to avoid going over all of them.  Perhaps we could
> change just a few of them, however, if it's important and/or worth
> doing.  Eli, WDYT?

Also lisp/emacs-lisp/copyright-tests.el fails, presumably it needs an
update of the year.

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Eli Zaretskii]

> From: Ulrich Mueller <ulm@gentoo.org>
> Cc: "N. Jackson" <njackson@posteo.net>,  emacs-devel@gnu.org
> Date: Sun, 19 Feb 2023 16:31:13 +0100
> 
> >>>>> On Sun, 19 Feb 2023, Stefan Kangas wrote:
> 
> > There are a gazillion files where the copyright date is 2022 instead of
> > 2023, and I'd like to avoid going over all of them.  Perhaps we could
> > change just a few of them, however, if it's important and/or worth
> > doing.  Eli, WDYT?
> 
> Also lisp/emacs-lisp/copyright-tests.el fails, presumably it needs an
> update of the year.

Is that really necessary?

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Óscar Fuentes]

Stefan Kangas <stefankangas@gmail.com> writes:

> I'm looking for someone to help test that the Emacs 28.3 tarball builds
> on MS-Windows.  (I have tested it on GNU/Linux and macOS.)

I'll execute the MSYS2/MingGW* packaging later today, stay tuned. That
builds, installs and packages for multiple targets supported by
MSYS2/MinGW (MinGW-w64 32/64 bits, Clang 32/64 bits and UCRT64.)

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[lux]

On Sun, 2023-02-19 at 04:34 -0800, Stefan Kangas wrote:
> lux <lx@shellcodes.org> writes:
> 
> > Stefan, this is a new vulnerability found in orgmode, which also
> > exists
> > in the built-in orgmode of Emacs 28. Does it need to be fixed
> > together
> > in 28.3?
> > 
> > https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A@qq.com/T/#t
> 
> Thanks for continuing to work on improving Emacs' security.
> 
> I don't want to delay Emacs 28.3 any more, and I'm ready to release
> it
> now.  Perhaps it's fine to wait with this fix until Emacs 29.1,
> especially seeing that Org Mode can release a new fixed version
> through
> GNU ELPA immediately, and distributions can pick it up from there.
> Furthermore, the Emacs 29 pretest will start any day now.
> 
> But I'd like to hear what others think.  Is it important to include
> this
> fix in Emacs 28.3?
> 

I reviewed the code of Org Mode, found some new security problems, if
fix these code, may affect the release 23.8, so recommended Org Mode
team to release a new version after.

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Stefan Kangas]

[-- Attachment #1: Type: text/plain, Size: 673 bytes --]

Ulrich Mueller <ulm@gentoo.org> writes:

> Any special reason why this is .tar.gz, and not .tar.xz like all other
> files in the directory? (I am asking because with .gz it will need an
> additional case distinction in the Gentoo ebuild.)

I've uploaded an .tar.xz file now too, for your benefit:

https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.xz
https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.xz.sig

And here are the checksums:

$ sha1sum emacs-28.3-rc1.tar.xz
9d579dfc5e724d3473c52d073953281de4515726  emacs-28.3-rc1.tar.xz
$ sha256sum emacs-28.3-rc1.tar.xz
41c53433c8dc49bd017f421e09c97eda4e046f34967c872bec80b3495dfaa933
emacs-28.3-rc1.tar.xz

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 519 bytes --]

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Stefan Kangas]

Eli Zaretskii <eliz@gnu.org> writes:

> Unfortunately, I think we must update all of them, for legal reasons.
> Let's ask Richard.

OK, let's see what he has to say.  Meanwhile, I've updated the copyright
years, and I'm preparing a new tarball as we speak.

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Óscar Fuentes]

Óscar Fuentes <ofv@wanadoo.es> writes:

> Stefan Kangas <stefankangas@gmail.com> writes:
>
>> I'm looking for someone to help test that the Emacs 28.3 tarball builds
>> on MS-Windows.  (I have tested it on GNU/Linux and macOS.)
>
> I'll execute the MSYS2/MingGW* packaging later today, stay tuned. That
> builds, installs and packages for multiple targets supported by
> MSYS2/MinGW (MinGW-w64 32/64 bits, Clang 32/64 bits and UCRT64.)

Done. No issues.

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Troy Hinckley]

[-- Attachment #1: Type: text/plain, Size: 897 bytes --]

I was able to build this on Ubuntu 18.04 as well. What other testing needs to be done before it can be released?
On Feb 19, 2023 at 9:29 AM -0700, Stefan Kangas <stefankangas@gmail.com>, wrote:
> Ulrich Mueller <ulm@gentoo.org> writes:
>
> > Any special reason why this is .tar.gz, and not .tar.xz like all other
> > files in the directory? (I am asking because with .gz it will need an
> > additional case distinction in the Gentoo ebuild.)
>
> I've uploaded an .tar.xz file now too, for your benefit:
>
> https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.xz
> https://alpha.gnu.org/gnu/emacs/pretest/emacs-28.3-rc1.tar.xz.sig
>
> And here are the checksums:
>
> $ sha1sum emacs-28.3-rc1.tar.xz
> 9d579dfc5e724d3473c52d073953281de4515726 emacs-28.3-rc1.tar.xz
> $ sha256sum emacs-28.3-rc1.tar.xz
> 41c53433c8dc49bd017f421e09c97eda4e046f34967c872bec80b3495dfaa933
> emacs-28.3-rc1.tar.xz

[-- Attachment #2: Type: text/html, Size: 1414 bytes --]

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Yuan Fu]

> On Feb 19, 2023, at 9:11 AM, Stefan Kangas <stefankangas@gmail.com> wrote:
> 
> Eli Zaretskii <eliz@gnu.org> writes:
> 
>> Unfortunately, I think we must update all of them, for legal reasons.
>> Let's ask Richard.
> 
> OK, let's see what he has to say.  Meanwhile, I've updated the copyright
> years, and I'm preparing a new tarball as we speak.
> 

I have excellent news for you: https://hynek.me/til/copyright-years/

Yuan

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Eli Zaretskii]

> From: Yuan Fu <casouri@gmail.com>
> Date: Thu, 2 Mar 2023 22:00:22 -0800
> Cc: Eli Zaretskii <eliz@gnu.org>,
>  Richard Stallman <rms@gnu.org>,
>  njackson@posteo.net,
>  emacs-devel@gnu.org
> 
> > On Feb 19, 2023, at 9:11 AM, Stefan Kangas <stefankangas@gmail.com> wrote:
> > 
> > Eli Zaretskii <eliz@gnu.org> writes:
> > 
> >> Unfortunately, I think we must update all of them, for legal reasons.
> >> Let's ask Richard.
> > 
> > OK, let's see what he has to say.  Meanwhile, I've updated the copyright
> > years, and I'm preparing a new tarball as we speak.
> > 
> 
> I have excellent news for you: https://hynek.me/til/copyright-years/

Richard, can you see if the FSF lawyers agree that there's no longer a
need to add each new year to our Copyright notices?  Another blog
about this is here:

  https://daniel.haxx.se/blog/2023/01/08/copyright-without-years/

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > I have excellent news for you: https://hynek.me/til/copyright-years/

If he is right, that would be a convenience.  But we are following the
advice our lawyers gave.  Hynek is not our lawyer, and I don't know
a reason to have confidence in him.

I would be remiss to take whichwever advice is most convenient for us
just because it is convienient.

But I will ask a lawyer who advises the FSF about this question.

-- 
Dr Richard Stallman (https://stallman.org)
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[H. Dieter Wilhelm]

Óscar Fuentes <ofv@wanadoo.es> writes:

> Óscar Fuentes <ofv@wanadoo.es> writes:
>
>> Stefan Kangas <stefankangas@gmail.com> writes:
>>
>>> I'm looking for someone to help test that the Emacs 28.3 tarball builds
>>> on MS-Windows.  (I have tested it on GNU/Linux and macOS.)
>>
>> I'll execute the MSYS2/MingGW* packaging later today, stay tuned. That
>> builds, installs and packages for multiple targets supported by
>> MSYS2/MinGW (MinGW-w64 32/64 bits, Clang 32/64 bits and UCRT64.)
>
> Done. No issues.

Updated MSYS2 on Win10 and compiled Emacs-28.3 for MinGW64.

        Dieter
-- 
Best wishes
H. Dieter Wilhelm
Zwingenberg, Germany

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Eli Zaretskii]

> From: Richard Stallman <rms@gnu.org>
> Cc: stefankangas@gmail.com, eliz@gnu.org, njackson@posteo.net,
> 	emacs-devel@gnu.org
> Date: Sat, 04 Mar 2023 23:05:01 -0500
> 
>   > I have excellent news for you: https://hynek.me/til/copyright-years/
> 
> If he is right, that would be a convenience.  But we are following the
> advice our lawyers gave.  Hynek is not our lawyer, and I don't know
> a reason to have confidence in him.
> 
> I would be remiss to take whichwever advice is most convenient for us
> just because it is convienient.
> 
> But I will ask a lawyer who advises the FSF about this question.

Any news about this?

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > > I would be remiss to take whichwever advice is most convenient for us
  > > just because it is convienient.
  > > 
  > > But I will ask a lawyer who advises the FSF about this question.

  > Any news about this?

No -- I was busy and let it drop.

But we don't need to recheck the advice we got before.
We wrote down what it was and we can keep following it.

-- 
Dr Richard Stallman (https://stallman.org)
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Eli Zaretskii]

> From: Richard Stallman <rms@gnu.org>
> Cc: casouri@gmail.com, stefankangas@gmail.com, njackson@posteo.net,
> 	emacs-devel@gnu.org
> Date: Mon, 21 Aug 2023 21:06:16 -0400
> 
>   > > I would be remiss to take whichwever advice is most convenient for us
>   > > just because it is convienient.
>   > > 
>   > > But I will ask a lawyer who advises the FSF about this question.
> 
>   > Any news about this?
> 
> No -- I was busy and let it drop.
> 
> But we don't need to recheck the advice we got before.
> We wrote down what it was and we can keep following it.

I don't think I understand: are you saying you have already asked the
lawyers about this and received their answers?  Or that the current
practice is fine and we could keep using it?

If the latter, then while the current situation is definitely not a
catastrophe, if we can avoid updating the copyright years every year,
it would reduce the maintenance burden, the code churn, and the need
to recompile everything once a year (per each branch), altogether
contributing to energy savings and keeping down the emissions, which
is good for the world at large.  So I think it's worth our while to
see if this nuisance can be avoided.

TIA

Re: Help testing emacs-28.3-rc1.tar.gz on MS-Windows

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > I don't think I understand: are you saying you have already asked the
  > lawyers about this and received their answers?

I asked them decades ago, we got answers, and we wrote them down and
followed them.

  >   So I think it's worth our while to
  > see if this nuisance can be avoided.

I'm the one who would have to find a way to ask a lawyer.
It is not so easy now.


-- 
Dr Richard Stallman (https://stallman.org)
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)