pkgbuild update and cve patch

4 files changed, 93 insertions, 43 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 3b973eb724be..a34d5e61ea18 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,5 +1,5 @@
 pkgbase = wesnoth-1.12
-	pkgdesc = Turn-based strategy game on a fantasy world (legacy version)
+	pkgdesc = Turn-based strategy game on a fantasy world (oldstable)
 	pkgver = 1.12.6
 	pkgrel = 11
 	url = https://www.wesnoth.org
@@ -29,12 +29,14 @@ pkgbase = wesnoth-1.12
 	source = wesnothd-1.12.service
 	source = wesnoth-1.12.appdata.xml
 	source = wesnoth-boost.patch::https://github.com/wesnoth/wesnoth/commit/789588d11e3512b3494b4aeac11b44f1c38ad86d.patch
+	source = wesnoth-cve.patch::https://github.com/wesnoth/wesnoth/commit/e764257c3e91dfe7d26da2287b57b01158d213c0.patch
 	sha256sums = a50f384cead15f68f31cfa1a311e76a12098428702cb674d3521eb169eb92e4e
 	sha256sums = f765499315d6650fe91424c0818cc57fc9fd06108c29e78c2db987c148dbf877
 	sha256sums = 4d11e481ad8610bb2ad65290d2b3d1bf2d058485deaa9016325499b113e0f89f
-	sha256sums = 852fbdf8f4d2d366083136d241809b87880beb74d44465c03713c3ca900a0a78
-	sha256sums = d3f031c70e59ac544712c45e6fd9be7cd79f481aad38977e7a129e1bede54840
+	sha256sums = bbc1a80412d3e880d695cf0e818969da90c578501b455d0a6a81a45568cd8231
+	sha256sums = e5b0bd418e97d5f8cfc9392045dc749941c71e9cf805ef6f343c318022088384
 	sha256sums = 74bfc9187b3cdd1744477ca509344a516a94c9992a4c6273ed8a9f370d96600a
+	sha256sums = be21d7fd38b18238edeb38c52206a4d9a26ec09fe0d1a7333785df63023707a6
 
 pkgname = wesnoth-1.12
 
diff --git a/PKGBUILD b/PKGBUILD
index fe72e9cb034a..ce3a3d53741a 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,36 +1,49 @@
-# Maintainer Severin Glöckner <severin dot gloeckner at stud dot htwk minus leipzig dot de>
+# Maintainer Severin Glöckner <severin.gloeckner@stud-htwk.leipzig.de>
+
+# This script contains as well instructions for other Linux systems.
+# Have a look what is done in the function(){…} below.
+
+# On other systems, ignore the used variables like $pkgdir, $srcdir or $startdir
+# (there $pkgdir would be the same as an undefined variable (empty),
+#  and $srcdir as well as $stardir would be the place where you have your files)
 
-_suffix=-1.12
 pkgname=wesnoth-1.12
 pkgver=1.12.6
 pkgrel=11
-pkgdesc="Turn-based strategy game on a fantasy world (legacy version)"
+pkgdesc="Turn-based strategy game on a fantasy world (oldstable)"
 arch=('i686' 'x86_64')
 url="https://www.wesnoth.org"
 license=('GPL')
-depends=('sdl' 'sdl_image' 'sdl_mixer' 'sdl_ttf' 'sdl_net' 'boost-libs' 'bzip2' 'zlib' 'libvorbis' 'pango' 'cairo' 'fontconfig' 'dbus' 'fribidi' 'readline')
-makedepends=('boost' 'gettext' 'cmake')
+depends=('sdl' 'sdl_image' 'sdl_mixer' 'sdl_ttf' 'sdl_net' 'boost-libs' 'bzip2' 'zlib' 'libvorbis' 'pango' 'cairo' 'fontconfig' 'dbus' 'fribidi')
+makedepends=('boost' 'cmake')
+# package names on Debian / Ubuntu / Mint:
+# libsdl1.2-dev libsdl-image1.2-dev libsdl-mixer1.2-dev libsdl-ttf2.0-dev libsdl-net1.2-dev libboost-filesystem-dev libboost-locale-dev libboost-iostreams-dev libboost-regex-dev libboost-serialization-dev libasio-dev libboost-program-options-dev libboost-system-dev zlib1g-dev libpango1.0-dev libcairo2-dev  libvorbis-dev libfontconfig1-dev libdbus-1-dev libfribidi-dev gettext-base cmake make pkgconf gcc g++ git
 options=('!emptydirs')
-source=("https://downloads.sourceforge.net/sourceforge/wesnoth/wesnoth-$pkgver.tar.bz2"
-        "wesnoth$_suffix.desktop"
-        "wesnothd$_suffix.tmpfiles.conf"
-        "wesnothd$_suffix.service"
-        "wesnoth$_suffix.appdata.xml"
-        "wesnoth-boost.patch::https://github.com/wesnoth/wesnoth/commit/789588d11e3512b3494b4aeac11b44f1c38ad86d.patch")
+source=("https://downloads.sourceforge.net/sourceforge/wesnoth/wesnoth-1.12.6.tar.bz2"
+        "wesnoth-1.12.desktop"
+        "wesnothd-1.12.tmpfiles.conf"
+        "wesnothd-1.12.service"
+        "wesnoth-1.12.appdata.xml"
+        "wesnoth-boost.patch::https://github.com/wesnoth/wesnoth/commit/789588d11e3512b3494b4aeac11b44f1c38ad86d.patch"
+        "wesnoth-cve.patch::https://github.com/wesnoth/wesnoth/commit/e764257c3e91dfe7d26da2287b57b01158d213c0.patch")
+# Not finding some files? https://aur.archlinux.org/packages/wesnoth-1.12
+# Rest assured, they are optional. Things like a launcher for your convenience…
 
 sha256sums=('a50f384cead15f68f31cfa1a311e76a12098428702cb674d3521eb169eb92e4e'
             'f765499315d6650fe91424c0818cc57fc9fd06108c29e78c2db987c148dbf877'
             '4d11e481ad8610bb2ad65290d2b3d1bf2d058485deaa9016325499b113e0f89f'
-            'ccbfcf1516d45ce29e2416a138c0fb3ae71ab479ecb5f6f5e343d009dc933288'
-            'd3f031c70e59ac544712c45e6fd9be7cd79f481aad38977e7a129e1bede54840'
-            '74bfc9187b3cdd1744477ca509344a516a94c9992a4c6273ed8a9f370d96600a')
+            'bbc1a80412d3e880d695cf0e818969da90c578501b455d0a6a81a45568cd8231'
+            'e5b0bd418e97d5f8cfc9392045dc749941c71e9cf805ef6f343c318022088384'
+            '74bfc9187b3cdd1744477ca509344a516a94c9992a4c6273ed8a9f370d96600a'
+            'be21d7fd38b18238edeb38c52206a4d9a26ec09fe0d1a7333785df63023707a6')
 
 PKGEXT='.pkg.tar'
 
 prepare() {
-  cd wesnoth-$pkgver
+  cd wesnoth-1.12
 
   patch -Np1 < ${srcdir}/wesnoth-boost.patch
+  patch -Np1 < ${srcdir}/wesnoth-cve.patch
 }
 
 build() {
@@ -42,8 +55,13 @@ build() {
   export CFLAGS="$CFLAGS -w"
   export CXXFLAGS="$CXXFLAGS -w"
 
+  # It's a convention to use /usr/local when installing by hand, it allows you
+  # to keep easier track of what was installed.
+  # Feel free to replace ALL occurences of /usr with /usr/local in the commands
+  # below, and edit the start command in the file wesnothd-1.12.service.
+
   rm -rf build && mkdir build && cd build
-  cmake ../wesnoth-$pkgver \
+  cmake ../wesnoth-1.12 \
       -DCMAKE_INSTALL_PREFIX=/usr \
       -DBINARY_SUFFIX=-1.12 \
       -DDATADIRNAME=wesnoth-1.12 \
@@ -57,32 +75,44 @@ build() {
   make -j 4
 }
 
+# The commands below have to be run with root privileges.
+# E.g. by prefixing them with "sudo ".
 package() {
   cd build
 
+  # On Debian / Ubuntu / Mint / Fedora / Suse, just "make install"
   make DESTDIR="$pkgdir" install
 
-  # add suffix to manpages
-  cd "$pkgdir/usr/share/man"
-  for filename in man6/wesnoth.6 */man6/wesnoth.6 man6/wesnothd.6 */man6/wesnothd.6
+  # On Debian / Ubuntu / Mint / Fedora, the above command may fail, in case you
+  # have another wesnoth version installed, because they use the same file name
+  # for the manpages.
+  # If that happens, temporarily uninstall the other wesnoth package, then re-run
+  # the above command, and thereafter use the below command to rename the files.
+
+  # add suffix to manpages (.6 is the file extension)
+  for filename in "$pkgdir"/usr/share/man/{,*/}man6/wesnoth{,d}.6
     do
       mv "$filename" $(dirname $filename)/$(basename $filename .6)-1.12.6
   done
 
-  # better use the tools from the newest version of wesnoth
-  rm -r "$pkgdir/usr/share/wesnoth$_suffix/data/tools"
+  # better use the patched tools from the newest version of wesnoth
+  rm -r "$pkgdir/usr/share/wesnoth-1.12/data/tools"
 
   # these translation files are not needed
-  find "$pkgdir/usr/share/wesnoth$_suffix/translations" -name wesnoth-manpages.mo -delete
-  find "$pkgdir/usr/share/wesnoth$_suffix/translations" -name wesnoth-manual.mo -delete
+  find "$pkgdir/usr/share/wesnoth-1.12/translations" -name wesnoth-manpages.mo -delete
+  find "$pkgdir/usr/share/wesnoth-1.12/translations" -name wesnoth-manual.mo -delete
 
   # placing relevant packaging files (launcher, icons, systemd and appdata files)
-  install -D -m644 "$srcdir/wesnoth$_suffix.desktop" "$pkgdir/usr/share/applications/wesnoth$_suffix.desktop"
-  install -D -m644 "$srcdir/wesnoth-$pkgver/images/game-icon.png" "$pkgdir/usr/share/icons/hicolor/64x64/apps/$pkgname-icon.png"
-  install -D -m644 "$srcdir/wesnoth-$pkgver/data/core/images/wesnoth-icon.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/$pkgname-icon.png"
+  install -D -m644 "$srcdir/wesnoth-1.12.desktop" "$pkgdir/usr/share/applications/wesnoth-1.12.desktop"
+  install -D -m644 "$srcdir/wesnoth-1.12/images/game-icon.png" "$pkgdir/usr/share/icons/hicolor/64x64/apps/wesnoth-1.12-icon.png"
+  install -D -m644 "$srcdir/wesnoth-1.12/data/core/images/wesnoth-icon.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/wesnoth-1.12-icon.png"
+
+  install -D -m644 "$srcdir/wesnoth-1.12.appdata.xml" "$pkgdir/usr/share/metainfo/wesnoth-1.12.appdata.xml"
 
-  install -D -m644 "$srcdir/wesnothd$_suffix.tmpfiles.conf" "$pkgdir/usr/lib/tmpfiles.d/wesnothd$_suffix.conf"
-  install -D -m644 "$srcdir/wesnothd$_suffix.service" "$pkgdir/usr/lib/systemd/system/wesnothd$_suffix.service"
+  # On other Linux systems, use /etc istead of /usr/lib for these two files
+  install -D -m644 "$srcdir/wesnothd-1.12.tmpfiles.conf" "$pkgdir/usr/lib/tmpfiles.d/wesnothd-1.12.conf"
+  install -D -m644 "$srcdir/wesnothd-1.12.service" "$pkgdir/usr/lib/systemd/system/wesnothd-1.12.service"
 
-  install -D -m644 "$srcdir/wesnoth$_suffix.appdata.xml" "$pkgdir/usr/share/metainfo/wesnoth$_suffix.appdata.xml"
+  # All done, but it doesn't show up? Try that:
+  # update-desktop-database
 }
diff --git a/wesnoth-1.12.appdata.xml b/wesnoth-1.12.appdata.xml
index 53e8c835f0b9..cb7900e55937 100644
--- a/wesnoth-1.12.appdata.xml
+++ b/wesnoth-1.12.appdata.xml
@@ -89,7 +89,6 @@
   <url type="bugtracker">https://bugs.wesnoth.org</url>
   <project_group>Wesnoth</project_group>
   <developer_name>The Battle for Wesnoth Project</developer_name>
-  <translation>wesnoth</translation>
   <kudos>
     <kudo>HiDpiIcon</kudo>
     <!-- ModernToolkit is for v1.14.x only -->
diff --git a/wesnothd-1.12.service b/wesnothd-1.12.service
index 101dd6ab92f0..dc7b0880fce4 100644
--- a/wesnothd-1.12.service
+++ b/wesnothd-1.12.service
@@ -3,26 +3,44 @@ Description=Wesnoth-1.12 Server Daemon
 Documentation=https://www.wesnoth.org/wiki/ServerAdministration
 Documentation=man:wesnothd-1.12(6)
 After=network.target
-# They use by default the same port
-Conflicts=wesnothd.service wesnothd-1.6.service wesnothd-1.8.service wesnothd-1.10.service wesnothd-1.14.service wesnothd-devel.service wesnothd-git.service
+# They use by default the same port. You can change ith with the -p option.
+Conflicts=wesnothd.service wesnothd-1.0.service wesnothd-1.2.service wesnothd-1.4.service wesnothd-1.6.service wesnothd-1.8.service wesnothd-1.10.service wesnothd-1.14.service wesnothd-devel.service wesnothd-git.service
 
 [Service]
+# If wesnothd is started from within the game it runs under a different user.
+# Deleting the pipe resets owner, group and mode.
+ExecStopPre=/bin/rm -f /run/wesnothd-1.12/socket
+
 ExecStart=/usr/bin/wesnothd-1.12 -t 2 -T 5
-# you can use -c to specify the same configuration file
-# which is used when starting wensothd from the wesnoth UI
-# (and make sure wesnothd has the required access permissions)
+# You can use -c to specify a same configuration file
+# (and make sure wesnothd has the required access permissions).
 
 SyslogIdentifier=Wesnothd-1.12
 User=nobody
-Group=nobody
-ExecStopPost=/usr/bin/rm -f /run/wesnothd-1.12/socket
+Group=users
+
+# Remove remaining administration pipe:
+ExecStopPost=/bin/rm -f /run/wesnothd-1.12/socket
 
-# Additional security-related features
-ProtectSystem=yes
+# Additional security-related features:
 PrivateTmp=yes
 PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+# When specifying with the -c option a file in the home directory,
+# set ProtectHome=read-only and whitelist the directory or file with
+# ReadWritePaths.
+ReadWritePaths=/run/wesnothd-1.12
+InaccessiblePaths=/usr/include
+InaccessiblePaths=/usr/src
+InaccessiblePaths=/boot
+InaccessiblePaths=/media
+InaccessiblePaths=/mnt
+InaccessiblePaths=/srv
+InaccessiblePaths=/opt
+InaccessiblePaths=/var
 NoNewPrivileges=yes
-RestrictAddressFamilies=AF_INET
+RestrictAddressFamilies=AF_INET AF_UNIX
 RestrictRealtime=yes
 MemoryDenyWriteExecute=yes
 SystemCallArchitectures=native
@@ -30,6 +48,7 @@ ProtectControlGroups=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 RestrictNamespaces=yes
+LockPersonality=yes
 
 [Install]
 WantedBy=multi-user.target