[Tcsh] globbing problem in 6.21

Thu May 16 19:33:21 UTC 2024

It *looks* like Ubuntu is getting their tcsh package from Debian.  The
Debian packagers are actively maintaining the source package, but they
have rules about version upgrades within Debian releases, which do not
necessarily line up well with tcsh versioning.  I guess Ubuntu has
similar rules.

At https://deb.tcsh.org/ we also offer 6.24.12 for all of the Debian
and Ubuntu release versions, but for amd64 and arm64 only.  If someone
teaches me to cross-compile for more architectures, I can most likely
accommodate that.

Similarly, if someone teaches me to build RPM packages (must be inside
containers, and preferably also cross-compiling various architectures),
I can most likely provide a repo.  I'm thinking this should target just
Enterprise Linux, but I'm open to ideas.

I already maintain the pkgsrc package as well as the nixpkgs package.
The quarterly pkgsrc releases typically have the most recent tcsh at the
time of branching.  I'm yet to learn what would need to be done *if*
there really was a need to pull up a new version to a NixOS release.
However, NixOS releases typically have the most recent tcsh at the time
of branching as well.

I don't know why Ubuntu oracular is behind Debian sid, but other than
that I'm guessing the version that lands in a release is just a question
of what is in the repo at the time of branching the release.

Based on https://packages.debian.org/search?keywords=tcsh&searchon=names&exact=1&suite=all&section=all

  Debian sid			6.24.12-1
  Debian 13 (testing)		6.24.12-1
  Debian 12			6.24.07-1
  Debian 11			6.21.00-1.1
  Debian 10			6.20.00-7+b1

Based on https://packages.ubuntu.com/search?keywords=tcsh&searchon=names&exact=1&suite=all&section=all

  Ubuntu oracular		6.24.10-4build1
  Ubuntu 24.04 LTS		6.24.10-4build1
  Ubuntu 23.10			6.24.10-2
  Ubuntu 22.04 LTS		6.21.00-1.1
  Ubuntu 20.04 LTS		6.21.00-1

For a really long list: https://repology.org/project/tcsh/versions

I think the best avenue for getting an up-to-date version of tcsh on
your favorite operating system is to contact the maintainers of the
package on that OS to request updates as an end-user of their product.

Admittedly https://bugs.launchpad.net/ubuntu/+source/tcsh/+bug/1862333
shows that this does not necessarily work, but I have no idea why.  It
should not just be rules about version upgrades: they could still apply
the patch linked in that bug report.  Alas, I don't think my time would
be well spent trying to shepherd that, as I'm not an Ubuntu user.  The
tcsh repo provides binary packages for Ubuntu merely because it was
trivial to do that in addition to Debian.

Kind regards,
+ Kimmo

On Thu, May 16, 2024 at 03:54:32PM +0200, Michal Szymanski wrote:
> Sadly, after two years, Ubuntu 22.04 still has 6.21. I wonder how many
> important files have been removed accidentally due to that bug.
> 
> regards, Michal
> 
> On Tue, May 03, 2022 at 09:33:02AM -0600, Nelson H. F. Beebe wrote:
> > As of updates this morning (3-May-2022), Ubuntu 22.04 still has the
> > old 6.21 version of tcsh with the file globbing error.  The same is
> > true for Debian 12 (bookworm/sid), and for other distributions based
> > on Ubuntu, such as Lite 6.0 and Mint 20.3,
> > 
> > On recent Red Hat-based versions, I find these tcsh versions:
> > 
> > 	CentOS 7		6.18.01
> > 	CentOS 8		6.20.00
> > 	CentOS 9		6.22.03
> > 	Oracle 8		6.20.00
> > 	AlmaLinux 8.5		6.20.00
> > 	AlmaLinux 9.0		6.22.03
> > 	EuroLinux 9.0		6.22.03
> > 	Navy Linux 8.4		6.20.00
> > 	Rocky Linux 8.5		6.20.09
> > 	Springdale 8.5		6.20.00
> > 	Virtuozzo Linux 8	6.20.00
> > 
> > On openSUSE, I find
> > 
> > 	openSUSE 15.2		6.20.00
> > 	openSUSE 15.4		6.20.00
> > 	openSUSE Tumbleweed	6.24.00		[rolling release]
> > 		
> > The new Slackware 15 release has 6.23.02.
> > 
> > The file globbing error in 6.21 could reasonably be viewed as a
> > security risk.
> > 
> > Is there a chance that leading tcsh team members could, perhaps
> > collectively, ask the Debian, Ubuntu, and other major Linux
> > distribution package teams to please update their tcsh to its latest
> > release?
> > 
> > -------------------------------------------------------------------------------
> > - Nelson H. F. Beebe                    Tel: +1 801 581 5254                  -
> > - University of Utah                                                          -
> > - Department of Mathematics, 110 LCB    Internet e-mail: beebe at math.utah.edu  -
> > - 155 S 1400 E RM 233                       beebe at acm.org  beebe at computer.org -
> > - Salt Lake City, UT 84112-0090, USA    URL: http://www.math.utah.edu/~beebe/ -
> > -------------------------------------------------------------------------------
> > -- 
> > Tcsh mailing list
> > Tcsh at astron.com
> > https://mailman.astron.com/mailman/listinfo/tcsh
> 
> -- 
>   Michal Szymanski (msz at astrouw dot edu dot pl)
>   Warsaw University Observatory, Warszawa, POLAND
> -- 
> Tcsh mailing list
> Tcsh at astron.com
> https://mailman.astron.com/mailman/listinfo/tcsh