diff -pruN 2.12.0.10-1/debian/README.Debian 2.12.0.10-2/debian/README.Debian --- 2.12.0.10-1/debian/README.Debian 2014-10-01 19:58:21.000000000 +0000 +++ 2.12.0.10-2/debian/README.Debian 2025-08-05 10:13:35.000000000 +0000 @@ -12,7 +12,7 @@ Notes from the TinyMUX INSTALL file: - cd to the game directory. 'cd ../game' - Make your configuration file, as described in docs/CONFIGURATION - - Type './Startmux'. TinyMUX 2.10 automatically creates a minimal + - Type './Startmux'. TinyMUX 2.12 automatically creates a minimal DB if one does not exist in the game/data directory. - Log into the game as player wizard 'connect wizard potrzebie', and shut it down again. @@ -20,7 +20,7 @@ Notes from the TinyMUX INSTALL file: - Edit the .txt files in game/text to your liking. In particular connect.txt and motd.txt. -- Start up TinyMUX 2.10 by running './Startmux' again. +- Start up TinyMUX 2.12 by running './Startmux' again. - @ccreate a channel named 'Public', and a channel named 'Guests' from within the MUX. Created players will automatically be joined to @@ -74,5 +74,5 @@ or upgrade.] accordingly, BEFORE you restart the game, or else ALL @mail older than the default value of 14 days will be deleted. -- Start TinyMUX 2.10 by running './Startmux'. +- Start TinyMUX 2.12 by running './Startmux'. diff -pruN 2.12.0.10-1/debian/README.source 2.12.0.10-2/debian/README.source --- 2.12.0.10-1/debian/README.source 1970-01-01 00:00:00.000000000 +0000 +++ 2.12.0.10-2/debian/README.source 2025-08-05 11:36:25.000000000 +0000 @@ -0,0 +1,12 @@ +TinyMUX 2.12 embeds a modified copy of PCRE3 in its source tree (src/pcre.*). + +This embedded copy includes a patch to support timeouts on user-supplied regular expressions. +The patch was created to prevent potential ReDoS (regular expression denial of service) +attacks in the game server, especially since anonymous users can supply arbitrary patterns. + +Upstream PCRE did not accept this patch, and maintaining it across releases became +increasingly fragile. As a result, TinyMUX 2.13 and later have removed the embedded PCRE +code and now use libpcre2-dev (dynamic linking). + +This packaging retains the embedded PCRE only to faithfully represent upstream version 2.12. +This is a legacy behavior and will not continue in future Debian uploads. diff -pruN 2.12.0.10-1/debian/changelog 2.12.0.10-2/debian/changelog --- 2.12.0.10-1/debian/changelog 2022-07-25 01:27:02.000000000 +0000 +++ 2.12.0.10-2/debian/changelog 2025-08-06 18:32:00.000000000 +0000 @@ -1,3 +1,24 @@ +tinymux (2.12.0.10-2) unstable; urgency=medium + + * Add explicit Build-Depends on libcrypt-dev. + This package uses crypt functionality via crypt.h and -lcrypt, + but previously relied on a transitive dependency through libc6-dev. + That dependency is being dropped from the build-essential set in the + forky cycle. This change ensures continued successful builds. + (Closes: #1107061) + * Added debian/README.source to document embedded PCRE3 copy in 2.12 series. + * Bumped Standards-Version to 4.7.2. No changes needed. + * Switched to debhelper-compat 13. + * Removed unintended executable permissions on static game data files + under /usr/share/tinymux/game. These files are not scripts or binaries. + * Add Lintian overrides: + - modules are plugins without direct libc usage (sample.so, sqlslave.so, sum.so) + - embedded PCRE3 in 2.12 documented in debian/README.source + - runtime text assets under /usr/share/tinymux/game/text/* + * Ensure module link steps include LDFLAGS (hardening). + + -- Stephen Dennis Wed, 06 Aug 2025 12:32:00 -0600 + tinymux (2.12.0.10-1) unstable; urgency=medium * New upstream release @@ -120,4 +141,3 @@ tinymux (2.3.3.22-1) unstable; urgency=l * Initial Release. (closes: #281283) -- Ervin Hearn III Mon, 25 Oct 2004 19:14:38 -0400 - diff -pruN 2.12.0.10-1/debian/compat 2.12.0.10-2/debian/compat --- 2.12.0.10-1/debian/compat 2017-08-14 19:59:37.000000000 +0000 +++ 2.12.0.10-2/debian/compat 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ -10 diff -pruN 2.12.0.10-1/debian/control 2.12.0.10-2/debian/control --- 2.12.0.10-1/debian/control 2022-07-25 01:27:02.000000000 +0000 +++ 2.12.0.10-2/debian/control 2025-08-05 16:00:23.000000000 +0000 @@ -2,8 +2,8 @@ Source: tinymux Section: games Priority: optional Maintainer: Stephen Dennis -Build-Depends: debhelper (>= 10.7.2) -Standards-Version: 4.6.1 +Build-Depends: debhelper-compat (= 13), libcrypt-dev +Standards-Version: 4.7.2 Vcs-Git: https://github.com/brazilofmux/tinymux.git Vcs-Browser: https://github.com/brazilofmux/tinymux Homepage: http://www.tinymux.org/ diff -pruN 2.12.0.10-1/debian/copyright 2.12.0.10-2/debian/copyright --- 2.12.0.10-1/debian/copyright 2022-07-25 01:27:02.000000000 +0000 +++ 2.12.0.10-2/debian/copyright 2025-08-05 11:37:49.000000000 +0000 @@ -22,6 +22,7 @@ License: Artistic-1.0 and TinyMUD-revise Files: src/pcre.* Copyright: 1997-2006, University of Cambridge License: BSD-3-clause +Comment: Upstream PCRE source, modified for regex timeout. Removed in 2.13. Files: debian/* Copyright: 2017, Stephen Dennis diff -pruN 2.12.0.10-1/debian/patches/ldflags.diff 2.12.0.10-2/debian/patches/ldflags.diff --- 2.12.0.10-1/debian/patches/ldflags.diff 1970-01-01 00:00:00.000000000 +0000 +++ 2.12.0.10-2/debian/patches/ldflags.diff 2025-08-06 18:32:00.000000000 +0000 @@ -0,0 +1,37 @@ +Index: tinymux-2.12.0.10/src/modules/Makefile.in +=================================================================== +--- tinymux-2.12.0.10.orig/src/modules/Makefile.in ++++ tinymux-2.12.0.10/src/modules/Makefile.in +@@ -6,27 +6,27 @@ all: funcs.so sample.so sum.so sqlproxy. + + funcs.so: funcs.cpp funcs.h ../autoconf.h ../config.h ../libmux.h ../modules.h + ( if [ -f funcs.so ]; then mv -f funcs.so funcs.so~ ; fi ) +- $(CXX) @DYNAMICLIB_CXXFLAGS@ -o funcs.so funcs.cpp -L.. @MUX_LIBS@ ++ $(CXX) $(LDFLAGS) @DYNAMICLIB_CXXFLAGS@ -o funcs.so funcs.cpp -L.. @MUX_LIBS@ + ( if [ -f funcs.so ]; then cd ../../game/bin ; rm -f funcs.so ; ln -s ../../src/modules/funcs.so funcs.so ; fi ) + + sample.so: sample.cpp sample.h ../autoconf.h ../config.h ../libmux.h ../modules.h + ( if [ -f sample.so ]; then mv -f sample.so sample.so~ ; fi ) +- $(CXX) @DYNAMICLIB_CXXFLAGS@ -o sample.so sample.cpp -L.. @MUX_LIBS@ ++ $(CXX) $(LDFLAGS) @DYNAMICLIB_CXXFLAGS@ -o sample.so sample.cpp -L.. @MUX_LIBS@ + ( if [ -f sample.so ]; then cd ../../game/bin ; rm -f sample.so ; ln -s ../../src/modules/sample.so sample.so ; fi ) + + sum.so: sum.cpp sum.h ../autoconf.h ../config.h ../libmux.h ../modules.h + ( if [ -f sum.so ]; then mv -f sum.so sum.so~ ; fi ) +- $(CXX) @DYNAMICLIB_CXXFLAGS@ -o sum.so sum.cpp -L.. @MUX_LIBS@ ++ $(CXX) $(LDFLAGS) @DYNAMICLIB_CXXFLAGS@ -o sum.so sum.cpp -L.. @MUX_LIBS@ + ( if [ -f sum.so ]; then cd ../../game/bin ; rm -f sum.so ; ln -s ../../src/modules/sum.so sum.so ; fi ) + + sqlproxy.so: sqlproxy.cpp sql.h ../autoconf.h ../config.h ../libmux.h ../modules.h + ( if [ -f sqlproxy.so ]; then mv -f sqlproxy.so sqlproxy.so~ ; fi ) +- $(CXX) @DYNAMICLIB_CXXFLAGS@ -o sqlproxy.so sqlproxy.cpp -L.. @MUX_LIBS@ ++ $(CXX) $(LDFLAGS) @DYNAMICLIB_CXXFLAGS@ -o sqlproxy.so sqlproxy.cpp -L.. @MUX_LIBS@ + ( if [ -f sqlproxy.so ]; then cd ../../game/bin ; rm -f sqlproxy.so ; ln -s ../../src/modules/sqlproxy.so sqlproxy.so ; fi ) + + sqlslave.so: sqlslave.cpp sql.h ../autoconf.h ../config.h ../libmux.h ../modules.h + ( if [ -f sqlslave.so ]; then mv -f sqlslave.so sqlslave.so~ ; fi ) +- $(CXX) @DYNAMICLIB_CXXFLAGS@ @SQL_INCLUDE@ -o sqlslave.so sqlslave.cpp -L.. @SQL_LIBPATH@ @MUX_LIBS@ @SQL_LIBS@ ++ $(CXX) $(LDFLAGS) @DYNAMICLIB_CXXFLAGS@ @SQL_INCLUDE@ -o sqlslave.so sqlslave.cpp -L.. @SQL_LIBPATH@ @MUX_LIBS@ @SQL_LIBS@ + ( if [ -f sqlslave.so ]; then cd ../../game/bin ; rm -f sqlslave.so ; ln -s ../../src/modules/sqlslave.so sqlslave.so ; fi ) + + depend: $(ALLSRC) ../unsplit diff -pruN 2.12.0.10-1/debian/patches/series 2.12.0.10-2/debian/patches/series --- 2.12.0.10-1/debian/patches/series 2022-07-25 01:27:02.000000000 +0000 +++ 2.12.0.10-2/debian/patches/series 2025-08-06 18:32:00.000000000 +0000 @@ -1,2 +1,3 @@ 866945.diff libmux.diff +ldflags.diff diff -pruN 2.12.0.10-1/debian/rules 2.12.0.10-2/debian/rules --- 2.12.0.10-1/debian/rules 2022-07-25 01:27:02.000000000 +0000 +++ 2.12.0.10-2/debian/rules 2025-08-06 18:32:00.000000000 +0000 @@ -15,7 +15,10 @@ override_dh_auto_build: override_dh_fixperms: dh_fixperms - chmod a-x $(CURDIR)/debian/tinymux/usr/share/tinymux/game/netmux.conf + chmod a-x $(CURDIR)/debian/tinymux/usr/share/tinymux/game/text/*.txt + chmod a-x $(CURDIR)/debian/tinymux/usr/share/tinymux/game/*.conf + chmod a-x $(CURDIR)/debian/tinymux/usr/share/tinymux/game/mux.config + chmod a-x $(CURDIR)/debian/tinymux/usr/share/tinymux/game/data/netmux.db override_dh_auto_clean: dh_auto_clean --sourcedirectory=src/tools diff -pruN 2.12.0.10-1/debian/tinymux.lintian-overrides 2.12.0.10-2/debian/tinymux.lintian-overrides --- 2.12.0.10-1/debian/tinymux.lintian-overrides 1970-01-01 00:00:00.000000000 +0000 +++ 2.12.0.10-2/debian/tinymux.lintian-overrides 2025-08-06 18:32:00.000000000 +0000 @@ -0,0 +1,11 @@ +# Modules are freestanding and do not use libc symbols themselves; linking +# against libc would be misleading and is dropped by --as-needed anyway. +tinymux: library-not-linked-against-libc [usr/lib/tinymux/game/bin/sample.so] +tinymux: library-not-linked-against-libc [usr/lib/tinymux/game/bin/sqlslave.so] +tinymux: library-not-linked-against-libc [usr/lib/tinymux/game/bin/sum.so] + +# PCRE3 is intentionally embedded in 2.12; documented in debian/README.source. +tinymux: embedded-library pcre3 [usr/lib/tinymux/game/bin/netmux] + +# In-game text are runtime assets, not documentation. +tinymux: package-contains-documentation-outside-usr-share-doc [usr/share/tinymux/game/text/*]