Re: Adding packages with vulnerabilities (was Re: [PATCH 1/2] gnu: Add perl-net-psyc. [pcre])

[ng0]

Ludovic Courtès  writes:

> Leo Famulari  skribis:
>
>> On Thu, Sep 29, 2016 at 08:58:29AM +, ng0 wrote:
>>> Leo Famulari  writes:
>>> > On Wed, Sep 21, 2016 at 06:46:31PM +, ng0 wrote:
>>> >> Subject: [PATCH 1/2] gnu: Add psyclpc.
>>> >> 
>>> >> * gnu/packages/psyc.scm (psyclpc): New variable.
>>
>>> >> +(inputs
>>> >> + `(("zlib" ,zlib)
>>> >> +   ("openssl" ,openssl)))
>>> >> +;; pcre is bundled to ensure the version is compatible. XXX: look 
>>> >> into
>>> >> +;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
>>> >> +;; functionality reasons we can not unbundle it now.
>>> >> +;; ("pcre" ,pcre)))
>>> >
>>> > That version of PCRE was released in 2003. We might want to add a
>>> > warning to the package description...
>>> >
>>> > https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre
>>> 
>>> Update on this: the pcre bundling was inherited from ldmud, current
>>> ldmud has unbundled pcre, so we will be able to unbundle pcre.
>>> 
>>> I'd still like to have the patches in their current form and update
>>> psyclpc when the next version without pcre is out.
>>
>> I'd like some more opinions on this. Should we add this package even
>> though we know it contains some security bugs (linked above)?
>
> I don’t think so.
>
> From the comment above, it seems difficult to have this package use a
> current version of PCRE, right?  Then I would suggest discussing it with
> upstream.  After all, they’re developing network-facing software, so
> they’re probably interested in avoiding security issues.
>
> ng0, could you take it with them?
>
> TIA,
> Ludo’.
>

Leo, Ludovic: I really appreciate the review, but please use the more
current thread. I commented that this is the wrong thread and that we
already fixed the pcre, last week. No need to discuss about pcre
anymore.

Thanks
-- 

Re: Adding packages with vulnerabilities (was Re: [PATCH 1/2] gnu: Add perl-net-psyc. [pcre])

[Ludovic Courtès]

Leo Famulari  skribis:

> On Thu, Sep 29, 2016 at 08:58:29AM +, ng0 wrote:
>> Leo Famulari  writes:
>> > On Wed, Sep 21, 2016 at 06:46:31PM +, ng0 wrote:
>> >> Subject: [PATCH 1/2] gnu: Add psyclpc.
>> >> 
>> >> * gnu/packages/psyc.scm (psyclpc): New variable.
>
>> >> +(inputs
>> >> + `(("zlib" ,zlib)
>> >> +   ("openssl" ,openssl)))
>> >> +;; pcre is bundled to ensure the version is compatible. XXX: look 
>> >> into
>> >> +;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
>> >> +;; functionality reasons we can not unbundle it now.
>> >> +;; ("pcre" ,pcre)))
>> >
>> > That version of PCRE was released in 2003. We might want to add a
>> > warning to the package description...
>> >
>> > https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre
>> 
>> Update on this: the pcre bundling was inherited from ldmud, current
>> ldmud has unbundled pcre, so we will be able to unbundle pcre.
>> 
>> I'd still like to have the patches in their current form and update
>> psyclpc when the next version without pcre is out.
>
> I'd like some more opinions on this. Should we add this package even
> though we know it contains some security bugs (linked above)?

I don’t think so.

>From the comment above, it seems difficult to have this package use a
current version of PCRE, right?  Then I would suggest discussing it with
upstream.  After all, they’re developing network-facing software, so
they’re probably interested in avoiding security issues.

ng0, could you take it with them?

TIA,
Ludo’.

Re: Adding packages with vulnerabilities (was Re: [PATCH 1/2] gnu: Add perl-net-psyc. [pcre])

[ng0]

ng0  writes:

> Leo Famulari  writes:
>
>> On Thu, Sep 29, 2016 at 08:58:29AM +, ng0 wrote:
>>> Leo Famulari  writes:
>>> > On Wed, Sep 21, 2016 at 06:46:31PM +, ng0 wrote:
>>> >> Subject: [PATCH 1/2] gnu: Add psyclpc.
>>> >> 
>>> >> * gnu/packages/psyc.scm (psyclpc): New variable.
>>
>>> >> +(inputs
>>> >> + `(("zlib" ,zlib)
>>> >> +   ("openssl" ,openssl)))
>>> >> +;; pcre is bundled to ensure the version is compatible. XXX: look 
>>> >> into
>>> >> +;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
>>> >> +;; functionality reasons we can not unbundle it now.
>>> >> +;; ("pcre" ,pcre)))
>>> >
>>> > That version of PCRE was released in 2003. We might want to add a
>>> > warning to the package description...
>>> >
>>> > https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre
>>> 
>>> Update on this: the pcre bundling was inherited from ldmud, current
>>> ldmud has unbundled pcre, so we will be able to unbundle pcre.
>>> 
>>> I'd still like to have the patches in their current form and update
>>> psyclpc when the next version without pcre is out.
>
> Where do you take this information from? You must have picked the wrong
> thread. We updated psyclpc and I added a version which uses a git commit.

Just to be clear on this, this is the current patch version:
https://lists.gnu.org/archive/html/guix-devel/2016-09/msg02219.html
everything else is outdated.

>> I'd like some more opinions on this. Should we add this package even
>> though we know it contains some security bugs (linked above)?
>>
>
> -- 
>
>

-- 

Re: Adding packages with vulnerabilities (was Re: [PATCH 1/2] gnu: Add perl-net-psyc. [pcre])

[ng0]

Leo Famulari  writes:

> On Thu, Sep 29, 2016 at 08:58:29AM +, ng0 wrote:
>> Leo Famulari  writes:
>> > On Wed, Sep 21, 2016 at 06:46:31PM +, ng0 wrote:
>> >> Subject: [PATCH 1/2] gnu: Add psyclpc.
>> >> 
>> >> * gnu/packages/psyc.scm (psyclpc): New variable.
>
>> >> +(inputs
>> >> + `(("zlib" ,zlib)
>> >> +   ("openssl" ,openssl)))
>> >> +;; pcre is bundled to ensure the version is compatible. XXX: look 
>> >> into
>> >> +;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
>> >> +;; functionality reasons we can not unbundle it now.
>> >> +;; ("pcre" ,pcre)))
>> >
>> > That version of PCRE was released in 2003. We might want to add a
>> > warning to the package description...
>> >
>> > https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre
>> 
>> Update on this: the pcre bundling was inherited from ldmud, current
>> ldmud has unbundled pcre, so we will be able to unbundle pcre.
>> 
>> I'd still like to have the patches in their current form and update
>> psyclpc when the next version without pcre is out.

Where do you take this information from? You must have picked the wrong
thread. We updated psyclpc and I added a version which uses a git commit.

> I'd like some more opinions on this. Should we add this package even
> though we know it contains some security bugs (linked above)?
>

-- 

Adding packages with vulnerabilities (was Re: [PATCH 1/2] gnu: Add perl-net-psyc. [pcre])

[Leo Famulari]

On Thu, Sep 29, 2016 at 08:58:29AM +, ng0 wrote:
> Leo Famulari  writes:
> > On Wed, Sep 21, 2016 at 06:46:31PM +, ng0 wrote:
> >> Subject: [PATCH 1/2] gnu: Add psyclpc.
> >> 
> >> * gnu/packages/psyc.scm (psyclpc): New variable.

> >> +(inputs
> >> + `(("zlib" ,zlib)
> >> +   ("openssl" ,openssl)))
> >> +;; pcre is bundled to ensure the version is compatible. XXX: look into
> >> +;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
> >> +;; functionality reasons we can not unbundle it now.
> >> +;; ("pcre" ,pcre)))
> >
> > That version of PCRE was released in 2003. We might want to add a
> > warning to the package description...
> >
> > https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre
> 
> Update on this: the pcre bundling was inherited from ldmud, current
> ldmud has unbundled pcre, so we will be able to unbundle pcre.
> 
> I'd still like to have the patches in their current form and update
> psyclpc when the next version without pcre is out.

I'd like some more opinions on this. Should we add this package even
though we know it contains some security bugs (linked above)?

Re: [PATCH 1/2] gnu: Add perl-net-psyc. [pcre]

[ng0]

Leo Famulari  writes:

> [ Unknown signature status ]
> On Wed, Sep 21, 2016 at 06:46:31PM +, ng0 wrote:
>> From 74a6c1e552a6ae8f438e91cbe318882401b440f8 Mon Sep 17 00:00:00 2001
>> From: ng0 
>> Date: Wed, 21 Sep 2016 18:08:42 +
>> Subject: [PATCH 1/2] gnu: Add psyclpc.
>> 
>> * gnu/packages/psyc.scm (psyclpc): New variable.
>
>> +(source (origin
>> +  (method url-fetch)
>> +  (uri (list (string-append "http://www.psyced.org/files/";
>> +name "-" version ".tar.xz")
>> + (string-append "http://krosos.sdf.org/static/unix/";
>> +"perlpsyc-" version ".zip")))
>> +  (sha256
>> +   (base32
>> +"0c2afcj8b2yr2vmy9sy0528iqs9sw01j6q35lvxicm42gs7vnik2"
>
> Do both of those URLs provide a file with the same hash?
>
>> +(arguments
>> + `(#:tests? #f ; There are no tests/checks.
>> +   #:configure-flags (list
>> +  "--enable-use-tls=yes"
>> +  "--enable-use-mccp"
>
> The "Mud Client Compression Protocol"?
>
>> +  (string-append "--with-openssl="
>> + (assoc-ref %build-inputs 
>> "openssl"))
>> +  (string-append "--prefix="
>> + (assoc-ref %outputs "out"))
>> +  (string-append "--libdir=" ; "-DMUD_LIB="
>
> What does this commented text mean?
>
>> + (assoc-ref %outputs "out")
>> + "/opt/psyced/world")
>> +  (string-append "--bindir="
>> + (assoc-ref %outputs "out")
>> + "/opt/psyced/bin")
>> +  (string-append "--libexecdir=" ; "-DERQ_DIR="
>
> Same question here.
>
>> +(inputs
>> + `(("zlib" ,zlib)
>> +   ("openssl" ,openssl)))
>> +;; pcre is bundled to ensure the version is compatible. XXX: look into
>> +;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
>> +;; functionality reasons we can not unbundle it now.
>> +;; ("pcre" ,pcre)))
>
> That version of PCRE was released in 2003. We might want to add a
> warning to the package description...
>
> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre

Update on this: the pcre bundling was inherited from ldmud, current
ldmud has unbundled pcre, so we will be able to unbundle pcre.

I'd still like to have the patches in their current form and update
psyclpc when the next version without pcre is out.
-- 
  ng0

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[ng0]

Leo Famulari  writes:

> [ Unknown signature status ]
> On Wed, Sep 21, 2016 at 06:46:31PM +, ng0 wrote:
>> From 74a6c1e552a6ae8f438e91cbe318882401b440f8 Mon Sep 17 00:00:00 2001
>> From: ng0 
>> Date: Wed, 21 Sep 2016 18:08:42 +
>> Subject: [PATCH 1/2] gnu: Add psyclpc.
>> 
>> * gnu/packages/psyc.scm (psyclpc): New variable.
  
^--|
>> +(source (origin 
>>  |
>> +  (method url-fetch)
>>  |
>> +  (uri (list (string-append "http://www.psyced.org/files/";  
>>  |
>> +name "-" version ".tar.xz") 
>>  |
>> + (string-append 
>> "http://krosos.sdf.org/static/unix/"; |
>> +"perlpsyc-" version ".zip")))   
>>  |
>> +  (sha256   
>> ^
>> +   (base32
>> +"0c2afcj8b2yr2vmy9sy0528iqs9sw01j6q35lvxicm42gs7vnik2"
>
> Do both of those URLs provide a file with the same hash?

So there was a classic copy&paste and commit too early mistake Sorry
for the mix up. Mirror will be added back when we still haven't solved
the attacks now. Looks very stable now. I'm preparing new patches.

>> +(arguments
>> + `(#:tests? #f ; There are no tests/checks.
>> +   #:configure-flags (list
>> +  "--enable-use-tls=yes"
>> +  "--enable-use-mccp"
>
> The "Mud Client Compression Protocol"?
>
>> +  (string-append "--with-openssl="
>> + (assoc-ref %build-inputs 
>> "openssl"))
>> +  (string-append "--prefix="
>> + (assoc-ref %outputs "out"))
>> +  (string-append "--libdir=" ; "-DMUD_LIB="
>
> What does this commented text mean?
>
>> + (assoc-ref %outputs "out")
>> + "/opt/psyced/world")
>> +  (string-append "--bindir="
>> + (assoc-ref %outputs "out")
>> + "/opt/psyced/bin")
>> +  (string-append "--libexecdir=" ; "-DERQ_DIR="
>
> Same question here.
>
>> +(inputs
>> + `(("zlib" ,zlib)
>> +   ("openssl" ,openssl)))
>> +;; pcre is bundled to ensure the version is compatible. XXX: look into
>> +;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
>> +;; functionality reasons we can not unbundle it now.
>> +;; ("pcre" ,pcre)))
>
> That version of PCRE was released in 2003. We might want to add a
> warning to the package description...
>
> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre

-- 
  ng0

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[ng0]

Thanks for reviewing,

Leo Famulari  writes:

> [ Unknown signature status ]
> On Wed, Sep 21, 2016 at 06:46:31PM +, ng0 wrote:
>> From 74a6c1e552a6ae8f438e91cbe318882401b440f8 Mon Sep 17 00:00:00 2001
>> From: ng0 
>> Date: Wed, 21 Sep 2016 18:08:42 +
>> Subject: [PATCH 1/2] gnu: Add psyclpc.
>> 
>> * gnu/packages/psyc.scm (psyclpc): New variable.
>
>> +(source (origin
>> +  (method url-fetch)
>> +  (uri (list (string-append "http://www.psyced.org/files/";
>> +name "-" version ".tar.xz")
>> + (string-append "http://krosos.sdf.org/static/unix/";
>> +"perlpsyc-" version ".zip")))
>> +  (sha256
>> +   (base32
>> +"0c2afcj8b2yr2vmy9sy0528iqs9sw01j6q35lvxicm42gs7vnik2"
>
> Do both of those URLs provide a file with the same hash?

They should. But the server of psyced.org recently had to move, like you
already noticed there's a mismatch now everywhere. I'll adjust again,
try tomorrow around 11:59 AM UTC if I don't run into a problem I can't
control. Updated patches will follow before this.

>> +(arguments
>> + `(#:tests? #f ; There are no tests/checks.
>> +   #:configure-flags (list
>> +  "--enable-use-tls=yes"
>> +  "--enable-use-mccp"
>
> The "Mud Client Compression Protocol"?

Probably. For the why/how/what refer to the source and the Gentoo
ebuild. I just do the integration/packaging.

>> +  (string-append "--with-openssl="
>> + (assoc-ref %build-inputs 
>> "openssl"))
>> +  (string-append "--prefix="
>> + (assoc-ref %outputs "out"))
>> +  (string-append "--libdir=" ; "-DMUD_LIB="
>
> What does this commented text mean?

References taken how I translated the buildsystem.

>> + (assoc-ref %outputs "out")
>> + "/opt/psyced/world")
>> +  (string-append "--bindir="
>> + (assoc-ref %outputs "out")
>> + "/opt/psyced/bin")
>> +  (string-append "--libexecdir=" ; "-DERQ_DIR="
>
> Same question here.
>
>> +(inputs
>> + `(("zlib" ,zlib)
>> +   ("openssl" ,openssl)))
>> +;; pcre is bundled to ensure the version is compatible. XXX: look into
>> +;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
>> +;; functionality reasons we can not unbundle it now.
>> +;; ("pcre" ,pcre)))
>
> That version of PCRE was released in 2003. We might want to add a
> warning to the package description...
>
> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre

Let's wait with the commit then, I've asked the people at our side who
are working on the code about a statement as I don't have a full
understanding of psyclpc. I've also pointed out that we (psyc/secushare)
are advised to update pcre (before you've sent this) to fix CVEs.

I have to send a new patchseries anyway, so I can adjust this. If
we'll add a comment, it's useful to point out that this is being fixed.
psyclpc in the wild is not used by anything other than psyced these
days, so I don't know if what's being used by psyclpc is worth to point
out.
-- 
  ng0

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[Leo Famulari]

On Wed, Sep 21, 2016 at 06:46:31PM +, ng0 wrote:
> From 74a6c1e552a6ae8f438e91cbe318882401b440f8 Mon Sep 17 00:00:00 2001
> From: ng0 
> Date: Wed, 21 Sep 2016 18:08:42 +
> Subject: [PATCH 1/2] gnu: Add psyclpc.
> 
> * gnu/packages/psyc.scm (psyclpc): New variable.

> +(source (origin
> +  (method url-fetch)
> +  (uri (list (string-append "http://www.psyced.org/files/";
> +name "-" version ".tar.xz")
> + (string-append "http://krosos.sdf.org/static/unix/";
> +"perlpsyc-" version ".zip")))
> +  (sha256
> +   (base32
> +"0c2afcj8b2yr2vmy9sy0528iqs9sw01j6q35lvxicm42gs7vnik2"

Do both of those URLs provide a file with the same hash?

> +(arguments
> + `(#:tests? #f ; There are no tests/checks.
> +   #:configure-flags (list
> +  "--enable-use-tls=yes"
> +  "--enable-use-mccp"

The "Mud Client Compression Protocol"?

> +  (string-append "--with-openssl="
> + (assoc-ref %build-inputs "openssl"))
> +  (string-append "--prefix="
> + (assoc-ref %outputs "out"))
> +  (string-append "--libdir=" ; "-DMUD_LIB="

What does this commented text mean?

> + (assoc-ref %outputs "out")
> + "/opt/psyced/world")
> +  (string-append "--bindir="
> + (assoc-ref %outputs "out")
> + "/opt/psyced/bin")
> +  (string-append "--libexecdir=" ; "-DERQ_DIR="

Same question here.

> +(inputs
> + `(("zlib" ,zlib)
> +   ("openssl" ,openssl)))
> +;; pcre is bundled to ensure the version is compatible. XXX: look into
> +;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
> +;; functionality reasons we can not unbundle it now.
> +;; ("pcre" ,pcre)))

That version of PCRE was released in 2003. We might want to add a
warning to the package description...

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre


signature.asc
Description: PGP signature

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[Leo Famulari]

On Wed, Sep 21, 2016 at 10:34:15AM +, ng0 wrote:
> From 33d8584709a74e20924743b2606158cacd5ed0c6 Mon Sep 17 00:00:00 2001
> From: ng0 
> Date: Tue, 13 Sep 2016 10:20:31 +
> Subject: [PATCH 1/2] gnu: Add perl-net-psyc.
> 
> * gnu/packages/psyc.scm: New file.
> * gnu/local.mk (GNU_SYSTEM_MODULES): Add it.

The hash is incorrect:

Starting download of 
/gnu/store/7kl9swdb9215lzdg1f7z4y41z4jssb7w-perl-net-psyc-1.1.zip
From http://perl.psyc.eu/perlpsyc-1.1.zip...
 perlpsyc-1.1.zip  174KiB   282KiB/s 00:01 [] 100.0%
output path `/gnu/store/7kl9swdb9215lzdg1f7z4y41z4jssb7w-perl-net-psyc-1.1.zip' 
should have sha256 hash `1lw6807qrbmvzbrjn1rna1dhir2k70xpcjvyjn45y35hav333a42', 
instead has `02isxl14n7jb18s5qr482y5ndj3cy04xw3699wvcxrr98lxj7xim'
@ build-failed 
/gnu/store/6lfrf1q84v86l5bvh1sf9x6zv3k9gv4j-perl-net-psyc-1.1.zip.drv - 1 
output path `/gnu/store/7kl9swdb9215lzdg1f7z4y41z4jssb7w-perl-net-psyc-1.1.zip' 
should have sha256 hash `1lw6807qrbmvzbrjn1rna1dhir2k70xpcjvyjn45y35hav333a42', 
instead has `02isxl14n7jb18s5qr482y5ndj3cy04xw3699wvcxrr98lxj7xim'
cannot build derivation 
`/gnu/store/i4xfmwz4jiqw7jcs2njhgddq4a4l28ws-perl-net-psyc-1.1.tar.xz.drv': 1 
dependencies couldn't be built
cannot build derivation 
`/gnu/store/amg0r4pkn9pky2v931ipd4r2sh66kaj1-perl-net-psyc-1.1.drv': 1 
dependencies couldn't be built
guix build: error: build failed: build of 
`/gnu/store/amg0r4pkn9pky2v931ipd4r2sh66kaj1-perl-net-psyc-1.1.drv' failed


signature.asc
Description: PGP signature

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[ng0]

Patch on top of this, containing psyclpc. The psyced package which
follows as the last one after all of this needs some minor adjustments
and then I need to write a service (and/or guile bindings. Hopefully a
service is enough.).

From 74a6c1e552a6ae8f438e91cbe318882401b440f8 Mon Sep 17 00:00:00 2001
From: ng0 
Date: Wed, 21 Sep 2016 18:08:42 +
Subject: [PATCH 1/2] gnu: Add psyclpc.

* gnu/packages/psyc.scm (psyclpc): New variable.
---
 gnu/packages/psyc.scm | 72 +++
 1 file changed, 72 insertions(+)

diff --git a/gnu/packages/psyc.scm b/gnu/packages/psyc.scm
index 58ce3c6..5a6f1db 100644
--- a/gnu/packages/psyc.scm
+++ b/gnu/packages/psyc.scm
@@ -24,9 +24,16 @@
   #:use-module (guix build-system perl)
   #:use-module (gnu packages)
   #:use-module (gnu packages admin)
+  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages bison)
+  #:use-module (gnu packages compression)
+  #:use-module (gnu packages gettext)
   #:use-module (gnu packages linux)
+  #:use-module (gnu packages man)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages perl)
+  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages tls)
   #:use-module (gnu packages web))
 
 ;; The URL at sdf.org is a mirror, officially known. The host www.psyced.org
@@ -151,3 +158,68 @@ PSYC, useful for all kinds of clients and servers including psyced.")
 (license (list license:agpl3+
;; test/test.c is based on a public-domain test
license:public-domain
+
+(define-public psyclpc
+  (package
+(name "psyclpc")
+(version "20160821")
+(source (origin
+  (method url-fetch)
+  (uri (list (string-append "http://www.psyced.org/files/";
+name "-" version ".tar.xz")
+ (string-append "http://krosos.sdf.org/static/unix/";
+"perlpsyc-" version ".zip")))
+  (sha256
+   (base32
+"0c2afcj8b2yr2vmy9sy0528iqs9sw01j6q35lvxicm42gs7vnik2"
+(build-system gnu-build-system)
+(arguments
+ `(#:tests? #f ; There are no tests/checks.
+   #:configure-flags (list
+  "--enable-use-tls=yes"
+  "--enable-use-mccp"
+  (string-append "--with-openssl="
+ (assoc-ref %build-inputs "openssl"))
+  (string-append "--prefix="
+ (assoc-ref %outputs "out"))
+  (string-append "--libdir=" ; "-DMUD_LIB="
+ (assoc-ref %outputs "out")
+ "/opt/psyced/world")
+  (string-append "--bindir="
+ (assoc-ref %outputs "out")
+ "/opt/psyced/bin")
+  (string-append "--libexecdir=" ; "-DERQ_DIR="
+ (assoc-ref %outputs "out")
+ "/opt/psyced/run"))
+   #:phases
+   (modify-phases %standard-phases
+ (add-before 'configure 'chdir-to-src
+   (lambda _
+ (chdir "src")
+ (setenv "CONFIG_SHELL" (which "sh"))
+ (setenv "SHELL" (which "sh"
+ (replace 'install
+   (lambda _
+ (zero? (system* "make" "install-all")))
+(inputs
+ `(("zlib" ,zlib)
+   ("openssl" ,openssl)))
+;; pcre is bundled to ensure the version is compatible. XXX: look into
+;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
+;; functionality reasons we can not unbundle it now.
+;; ("pcre" ,pcre)))
+(native-inputs
+ `(("pkg-config" ,pkg-config)
+   ("bison" ,bison)
+   ("gnu-gettext" ,gnu-gettext)
+   ("help2man" ,help2man)
+   ("autoconf" ,autoconf)
+   ("automake" ,automake)))
+(home-page "http://lpc.psyc.eu/";)
+(synopsis "psycLPC is a multi-user network server programming language")
+(description
+ "LPC is a bytecode language, invented to specifically implement
+multi user virtual environments on the internet.  This technology is used for
+MUDs and also the psyced implementation of the Protocol for SYnchronous Conferencing (PSYC).  psycLPC is a fork of LDMud with some new features and
+many bug fixes.")
+(license license:gpl2)))
-- 
2.10.0



ng0  writes:

> [ Unknown signature status ]
>
>> I will resend this patch with the fail-safe mirror I just added on
>> sdf.org. This is okay with the others in group and very much welcomed.
>> The shasum file is signed by my rsa opengpg key which is also used by
>> some releases of Gnurl.
>
> Where the group means other developers hacking around psyced.org,
> secushare.org etc.
> I also changed my email address, whic

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[ng0]

> I will resend this patch with the fail-safe mirror I just added on
> sdf.org. This is okay with the others in group and very much welcomed.
> The shasum file is signed by my rsa opengpg key which is also used by
> some releases of Gnurl.

Where the group means other developers hacking around psyced.org,
secushare.org etc.
I also changed my email address, which will make its way into .mailmap
in a commit which happened in the "tinycm" patch series I am working
on.

From 33d8584709a74e20924743b2606158cacd5ed0c6 Mon Sep 17 00:00:00 2001
From: ng0 
Date: Tue, 13 Sep 2016 10:20:31 +
Subject: [PATCH 1/2] gnu: Add perl-net-psyc.

* gnu/packages/psyc.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
---
 gnu/local.mk  |   1 +
 gnu/packages/psyc.scm | 111 ++
 2 files changed, 112 insertions(+)
 create mode 100644 gnu/packages/psyc.scm

diff --git a/gnu/local.mk b/gnu/local.mk
index e2cf40d..2957e16 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -293,6 +293,7 @@ GNU_SYSTEM_MODULES =\
   %D%/packages/pumpio.scm			\
   %D%/packages/pretty-print.scm			\
   %D%/packages/protobuf.scm			\
+  %D%/packages/psyc.scm \
   %D%/packages/pv.scm\
   %D%/packages/python.scm			\
   %D%/packages/qemu.scm\
diff --git a/gnu/packages/psyc.scm b/gnu/packages/psyc.scm
new file mode 100644
index 000..dd8a3eb
--- /dev/null
+++ b/gnu/packages/psyc.scm
@@ -0,0 +1,111 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2016 ng0 
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see .
+
+(define-module (gnu packages psyc)
+  #:use-module (guix download)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages)
+  #:use-module (guix build-system perl)
+  #:use-module (gnu packages)
+  #:use-module (gnu packages ncurses)
+  #:use-module (gnu packages perl)
+  #:use-module (gnu packages web))
+
+;; The URL at sdf.org is a mirror, officially known. The host www.psyced.org
+;; is running on is sometimes (rarely) attacked and this ensure that the files
+;; are available.
+(define-public perl-net-psyc
+  (package
+(name "perl-net-psyc")
+(version "1.1")
+(source
+ (origin
+   (method url-fetch)
+   (uri (list
+ (string-append "http://perl.psyc.eu/";
+"perlpsyc-" version ".zip")
+ (string-append "http://krosos.sdf.org/static/unix/";
+"perlpsyc-" version ".zip")))
+   (file-name (string-append name "-" version ".zip"))
+   (sha256
+(base32
+ "1lw6807qrbmvzbrjn1rna1dhir2k70xpcjvyjn45y35hav333a42"))
+   ;; psycmp3 currently depends on MP3::List and rxaudio (shareware),
+   ;; we can add it back when this is no longer the case.
+   (snippet '(delete-file "contrib/psycmp3"
+(build-system perl-build-system)
+(inputs
+ `(("perl-curses" ,perl-curses)
+   ("perl-io-socket-ssl" ,perl-io-socket-ssl)))
+(arguments
+ `(#:phases
+   (modify-phases %standard-phases
+ (delete 'configure) ; No configure script
+ ;; There is a Makefile, but it does not install everything
+ ;; (leaves out psycion) and says
+ ;; "# Just to give you a rough idea". XXX: Fix it upstream.
+ (replace 'build
+   (lambda _
+ (zero? (system* "make" "manuals"
+ (replace 'install
+   (lambda* (#:key outputs #:allow-other-keys)
+ (let* ((out (assoc-ref outputs "out"))
+(doc (string-append out "/share/doc/perl-net-psyc"))
+(man1 (string-append out "/share/man/man1"))
+(man3 (string-append out "/share/man/man3"))
+(bin (string-append out "/bin"))
+(libpsyc (string-append out "/lib/psyc/ion"))
+(libperl (string-append out "/lib/perl5/site_perl/"
+,(package-version perl
+
+   (copy-recursively "lib/perl5" libperl)
+   (copy-recursively "lib/psycion" libpsyc)
+   (copy-recursively "bin" bin)
+   (install-file "cgi/psycpager" (string-append doc "/cgi"))
+   (copy-recursively "contrib" (string-append doc "/contrib"))
+

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[ng0]

I will resend this patch with the fail-safe mirror I just added on
sdf.org. This is okay with the others in group and very much welcomed.
The shasum file is signed by my rsa opengpg key which is also used by
some releases of Gnurl.

ng0  writes:

> [ Unknown signature status ]
> From 8ff11b44ac9c2f3d9b6cd53497c903135df3f1ff Mon Sep 17 00:00:00 2001
> From: ng0 
> Date: Tue, 13 Sep 2016 10:20:31 +
> Subject: [PATCH 1/2] gnu: Add perl-net-psyc.
>
> * gnu/packages/psyc.scm: New file.
> * gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
> ---
>  gnu/local.mk  |   2 +
>  gnu/packages/psyc.scm | 105 
> ++
>  2 files changed, 107 insertions(+)
>  create mode 100644 gnu/packages/psyc.scm
>
> diff --git a/gnu/local.mk b/gnu/local.mk
> index 5714009..c01f47a 100644
> --- a/gnu/local.mk
> +++ b/gnu/local.mk
> @@ -5,6 +5,7 @@
>  # Copyright © 2013, 2014, 2015, 2016 Mark H Weaver 
>  # Copyright © 2016 Chris Marusich 
>  # Copyright © 2016 Kei Kebreau 
> +# Copyright © 2016 ng0 
>  #
>  # This file is part of GNU Guix.
>  #
> @@ -292,6 +293,7 @@ GNU_SYSTEM_MODULES =  \
>%D%/packages/pumpio.scm\
>%D%/packages/pretty-print.scm  \
>%D%/packages/protobuf.scm  \
> +  %D%/packages/psyc.scm \
>%D%/packages/pv.scm\
>%D%/packages/python.scm\
>%D%/packages/qemu.scm  \
> diff --git a/gnu/packages/psyc.scm b/gnu/packages/psyc.scm
> new file mode 100644
> index 000..ea1b513
> --- /dev/null
> +++ b/gnu/packages/psyc.scm
> @@ -0,0 +1,105 @@
> +;;; GNU Guix --- Functional package management for GNU
> +;;; Copyright © 2016 ng0 
> +;;;
> +;;; This file is part of GNU Guix.
> +;;;
> +;;; GNU Guix is free software; you can redistribute it and/or modify it
> +;;; under the terms of the GNU General Public License as published by
> +;;; the Free Software Foundation; either version 3 of the License, or (at
> +;;; your option) any later version.
> +;;;
> +;;; GNU Guix is distributed in the hope that it will be useful, but
> +;;; WITHOUT ANY WARRANTY; without even the implied warranty of
> +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> +;;; GNU General Public License for more details.
> +;;;
> +;;; You should have received a copy of the GNU General Public License
> +;;; along with GNU Guix.  If not, see .
> +
> +(define-module (gnu packages psyc)
> +  #:use-module (guix download)
> +  #:use-module ((guix licenses) #:prefix license:)
> +  #:use-module (guix packages)
> +  #:use-module (guix build-system perl)
> +  #:use-module (gnu packages)
> +  #:use-module (gnu packages ncurses)
> +  #:use-module (gnu packages perl)
> +  #:use-module (gnu packages web))
> +
> +(define-public perl-net-psyc
> +  (package
> +(name "perl-net-psyc")
> +(version "1.1")
> +(source
> + (origin
> +   (method url-fetch)
> +   (uri (string-append "http://perl.psyc.eu/";
> +   "perlpsyc-" version ".zip"))
> +   (file-name (string-append name "-" version ".zip"))
> +   (sha256
> +(base32
> + "1lw6807qrbmvzbrjn1rna1dhir2k70xpcjvyjn45y35hav333a42"))
> +   ;; psycmp3 currently depends on MP3::List and rxaudio (shareware),
> +   ;; we can add it back when this is no longer the case.
> +   (snippet '(delete-file "contrib/psycmp3"
> +(build-system perl-build-system)
> +(inputs
> + `(("perl-curses" ,perl-curses)
> +   ("perl-io-socket-ssl" ,perl-io-socket-ssl)))
> +(arguments
> + `(#:phases
> +   (modify-phases %standard-phases
> + (delete 'configure) ; No configure script
> + ;; There is a Makefile, but it does not install everything
> + ;; (leaves out psycion) and says
> + ;; "# Just to give you a rough idea". XXX: Fix it upstream.
> + (replace 'build
> +   (lambda _
> + (zero? (system* "make" "manuals"
> + (replace 'install
> +   (lambda* (#:key outputs #:allow-other-keys)
> + (let* ((out (assoc-ref outputs "out"))
> +(doc (string-append out "/share/doc/perl-net-psyc"))
> +(man1 (string-append out "/share/man/man1"))
> +(man3 (string-append out "/share/man/man3"))
> +(bin (string-append out "/bin"))
> +(libpsyc (string-append out "/lib/psyc/ion"))
> +(libperl (string-append out "/lib/perl5/site_perl/"
> +,(package-version perl
> +
> +   (copy-recursively "lib/perl5" libperl)
> +   (copy-recursively "lib/psycion" libpsyc)
> +   (copy-recursively "bin" bin)
> +   (install-file "cgi/psycpager" (string-append doc "/cgi"))
> +   (copy-re

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[ng0]

From 8ff11b44ac9c2f3d9b6cd53497c903135df3f1ff Mon Sep 17 00:00:00 2001
From: ng0 
Date: Tue, 13 Sep 2016 10:20:31 +
Subject: [PATCH 1/2] gnu: Add perl-net-psyc.

* gnu/packages/psyc.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
---
 gnu/local.mk  |   2 +
 gnu/packages/psyc.scm | 105 ++
 2 files changed, 107 insertions(+)
 create mode 100644 gnu/packages/psyc.scm

diff --git a/gnu/local.mk b/gnu/local.mk
index 5714009..c01f47a 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -5,6 +5,7 @@
 # Copyright © 2013, 2014, 2015, 2016 Mark H Weaver 
 # Copyright © 2016 Chris Marusich 
 # Copyright © 2016 Kei Kebreau 
+# Copyright © 2016 ng0 
 #
 # This file is part of GNU Guix.
 #
@@ -292,6 +293,7 @@ GNU_SYSTEM_MODULES =\
   %D%/packages/pumpio.scm			\
   %D%/packages/pretty-print.scm			\
   %D%/packages/protobuf.scm			\
+  %D%/packages/psyc.scm \
   %D%/packages/pv.scm\
   %D%/packages/python.scm			\
   %D%/packages/qemu.scm\
diff --git a/gnu/packages/psyc.scm b/gnu/packages/psyc.scm
new file mode 100644
index 000..ea1b513
--- /dev/null
+++ b/gnu/packages/psyc.scm
@@ -0,0 +1,105 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2016 ng0 
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see .
+
+(define-module (gnu packages psyc)
+  #:use-module (guix download)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages)
+  #:use-module (guix build-system perl)
+  #:use-module (gnu packages)
+  #:use-module (gnu packages ncurses)
+  #:use-module (gnu packages perl)
+  #:use-module (gnu packages web))
+
+(define-public perl-net-psyc
+  (package
+(name "perl-net-psyc")
+(version "1.1")
+(source
+ (origin
+   (method url-fetch)
+   (uri (string-append "http://perl.psyc.eu/";
+   "perlpsyc-" version ".zip"))
+   (file-name (string-append name "-" version ".zip"))
+   (sha256
+(base32
+ "1lw6807qrbmvzbrjn1rna1dhir2k70xpcjvyjn45y35hav333a42"))
+   ;; psycmp3 currently depends on MP3::List and rxaudio (shareware),
+   ;; we can add it back when this is no longer the case.
+   (snippet '(delete-file "contrib/psycmp3"
+(build-system perl-build-system)
+(inputs
+ `(("perl-curses" ,perl-curses)
+   ("perl-io-socket-ssl" ,perl-io-socket-ssl)))
+(arguments
+ `(#:phases
+   (modify-phases %standard-phases
+ (delete 'configure) ; No configure script
+ ;; There is a Makefile, but it does not install everything
+ ;; (leaves out psycion) and says
+ ;; "# Just to give you a rough idea". XXX: Fix it upstream.
+ (replace 'build
+   (lambda _
+ (zero? (system* "make" "manuals"
+ (replace 'install
+   (lambda* (#:key outputs #:allow-other-keys)
+ (let* ((out (assoc-ref outputs "out"))
+(doc (string-append out "/share/doc/perl-net-psyc"))
+(man1 (string-append out "/share/man/man1"))
+(man3 (string-append out "/share/man/man3"))
+(bin (string-append out "/bin"))
+(libpsyc (string-append out "/lib/psyc/ion"))
+(libperl (string-append out "/lib/perl5/site_perl/"
+,(package-version perl
+
+   (copy-recursively "lib/perl5" libperl)
+   (copy-recursively "lib/psycion" libpsyc)
+   (copy-recursively "bin" bin)
+   (install-file "cgi/psycpager" (string-append doc "/cgi"))
+   (copy-recursively "contrib" (string-append doc "/contrib"))
+   (copy-recursively "hooks" (string-append doc "/hooks"))
+   (copy-recursively "sdj" (string-append doc "/sdj"))
+   (install-file "README.txt" doc)
+   (install-file "TODO.txt" doc)
+   (copy-recursively "share/man/man1" man1)
+   (copy-recursively "share/man/man3" man3)
+   #t)))
+ (add-after 'install 'wrap-programs
+   (lambda* (#:key outputs #:allow-other-keys)
+ ;; Make sure all executables in "bin" find the Perl modules
+ ;; provided by this package at runtime.
+ 

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[ng0]

Leo Famulari  writes:

> On Tue, Sep 13, 2016 at 11:32:36AM +, ng0 wrote:
>> * gnu/packages/psyc.scm: New file.
>> * gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
>
> This package looks pretty good to me!
>
>> + (replace 'install
>> +   (lambda* (#:key outputs #:allow-other-keys)
>> + (let* ((out (assoc-ref outputs "out"))
>> +(doc (string-append out "/share/doc/perl-net-psyc"))
>> +(man (string-append out "/share/man"))
>> +(bin (string-append out "/bin"))
>> +(libpsyc (string-append out "/lib/psyc/ion"))
>> +(libperl (string-append out "/lib/perl5/site_perl/"
>> +,(package-version perl
>> +
>> +   (copy-recursively "lib/perl5" libperl)
>> +   (copy-recursively "lib/psycion" libpsyc)
>> +   (copy-recursively "bin" bin)
>> +   (install-file "cgi/psycpager" (string-append doc "/cgi"))
>> +   (copy-recursively "contrib" (string-append doc "/contrib"))
>> +   (copy-recursively "hooks" (string-append doc "/hooks"))
>> +   (copy-recursively "sdj" (string-append doc "/sdj"))
>> +   (install-file "README.txt" doc)
>> +   (install-file "TODO.txt" doc)
>> +   (copy-recursively "share/man/man1" (string-append man 
>> "/man1"))
>> +   (copy-recursively "share/man/man3" (string-append man 
>> "/man3"))
>> +   #t)))
>
> But, there aren't any man pages in the built package.

Oh? Then the change I applied before submitting it broke it. There are
manpages, I just thought I could save a line by using
(let (man (string-append out "/share/man"))
  (copy-recursively "share/man/man1" (string-append man "/man1"))
  (copy-recursively "share/man/man3" (string-append man "/man3"))

and not 

(let (man1 (string-append out "/share/man/man1"))
 (man3 (string-append out "/share/man/man3"))
  (copy-recursively "share/man/man1" man1))
  (copy-recursively "share/man/man3" man3))

>> +(description
>> + "@code{Net::PSYC} with support for TCP, UDP, Event.pm, 
>> @code{IO::Select} and
>> +Gtk2 event loops.  This package includes 12 applications and additional 
>> scripts:
>> +psycion, a @uref{http://about.psyc.eu,PSYC} chat client, remotor, a control 
>> console
>> +for @uref{https://torproject.org,tor} router, and many more.")
>
> Also, I don't know this word "remotor". Is it related to PSYC?

Then I need to restructur my sentence. If you take a look at the website
you will see that it is one of the many applications perlpsyc has.

-- 
  ng0

Re: [PATCH 1/2] gnu: Add perl-net-psyc.

[Leo Famulari]

On Tue, Sep 13, 2016 at 11:32:36AM +, ng0 wrote:
> * gnu/packages/psyc.scm: New file.
> * gnu/local.mk (GNU_SYSTEM_MODULES): Add it.

This package looks pretty good to me!

> + (replace 'install
> +   (lambda* (#:key outputs #:allow-other-keys)
> + (let* ((out (assoc-ref outputs "out"))
> +(doc (string-append out "/share/doc/perl-net-psyc"))
> +(man (string-append out "/share/man"))
> +(bin (string-append out "/bin"))
> +(libpsyc (string-append out "/lib/psyc/ion"))
> +(libperl (string-append out "/lib/perl5/site_perl/"
> +,(package-version perl
> +
> +   (copy-recursively "lib/perl5" libperl)
> +   (copy-recursively "lib/psycion" libpsyc)
> +   (copy-recursively "bin" bin)
> +   (install-file "cgi/psycpager" (string-append doc "/cgi"))
> +   (copy-recursively "contrib" (string-append doc "/contrib"))
> +   (copy-recursively "hooks" (string-append doc "/hooks"))
> +   (copy-recursively "sdj" (string-append doc "/sdj"))
> +   (install-file "README.txt" doc)
> +   (install-file "TODO.txt" doc)
> +   (copy-recursively "share/man/man1" (string-append man 
> "/man1"))
> +   (copy-recursively "share/man/man3" (string-append man 
> "/man3"))
> +   #t)))

But, there aren't any man pages in the built package.

> +(description
> + "@code{Net::PSYC} with support for TCP, UDP, Event.pm, 
> @code{IO::Select} and
> +Gtk2 event loops.  This package includes 12 applications and additional 
> scripts:
> +psycion, a @uref{http://about.psyc.eu,PSYC} chat client, remotor, a control 
> console
> +for @uref{https://torproject.org,tor} router, and many more.")

Also, I don't know this word "remotor". Is it related to PSYC?