Arch Linux User Repository

The split is to avoid the tk dependency in the CLI package. That and others may just want the data.

I think I'll leave it as it is for now as it should just work.

Given that an isolated wordnet package hasn't existed for years, it could probably be dropped entirely.

Another approach is to merge wordnet-common into wordnet-cli, and make wordnet-tk depend on it.

Or recombine all the packages. I don't really see any point having them split. The bulk of the data is in wordnet-common. The tk and cli packages are only a couple hundred KB. A couple other packages depend on wordnet-common, but could just as easily depend on wordnet.

You're right about the conflicts, but I don't think I can reasonably add "provides" to wordnet-common as it doesn't provide what the old wordnet package provided. I've left off provides entirely for now.

The conflicts with wordnet should be removed from wordnet-tk and wordnet-cli because it prevents them from being installed at the same time. Some users may want to install both gui and cli.

The provides/conflicts can be put in wordnet-common.

@Stebalien

The Debian "orig" is a mixture of several upstreams (most of which are probably internal to Debian), plus apparently some modification.

The following patches do nevertheless apply:

• 20_doc_man_wninput.patch
• 20_include_wn.h.patch
• 20_src_stubs_c.patch
• 20_src_wnb.patch
• 40_doc_man_fix_names.patch
• 41_doc_man_fix_names.patch
• 50_CVE-2008-2149_buffer_overflows.patch
• 51_overflows_memcpy.patch
• 51_overflows.patch
• 52_wordnet3.0_lib_search_c_memory_patch
• 60_gcc-4.6.patch

I assume the Guix patches are equivalent to:

• 50_CVE-2008-2149_buffer_overflows.patch
• 51_overflows_memcpy.patch
• 51_overflows.patch

I suggest applying further:

• bugs:
  • 52_wordnet3.0_lib_search_c_memory_patch
  • 60_gcc-4.6.patch
    • possibly followed by "sed -Ei 's/\<puts(([^ ,)]*))/fputs(\1, stdout)/' src/wn.c"
• man pages:
  • 20_doc_man_wninput.patch
  • 40_doc_man_fix_names.patch
  • 41_doc_man_fix_names.patch

@respiranto

Thanks for digging into that!

I've applied the patches from Guix. Unfortunately, I couldn't get the Debian ones to apply (not sure what "orig" is supposed to mean, but it definitely doesn't mean "original source" in this case).

Most patches are rather small.

I have read through all but the following (large ones):

• 51_overflows_memcpy
• 52_wordnet3.0_lib_search_c_memory_patch

The others I deem fine.

Possibly relevant patches:

• security:

  • 50_CVE-2008-2149_buffer_overflows.patch
  • 51_overflows_memcpy.patch (large patch, by oCert)
  • 51_overflows.patch
  • 60_gcc-4.6.patch
    • incorrectly replaces printf(.) by puts(.) (newline added)

• possibly security:

  • 52_wordnet3.0_lib_search_c_memory_patch

• other bugs in code:

  • 30_src_grind.patch
    • the summary is wrong, this does fix two bugs

• bugs in the data:

  • 20_adj.all_fix.patch
  • 20_verb.social_fix.patch

• man pages:

  • 20_doc_man_wninput.patch - man page section names
  • 40_doc_man_fix_names.patch - man page NAMEs
  • 41_doc_man_fix_names.patch - man page formatting

• other (likely unneeded):

  • 01_tcltk8.6.patch
    • i.a., adds -DUSE_INTERP_RESULT to Makefile.am
  • 20_include_wn.h.patch
  • 90_prevent_parallel_build.patch
    • @Stebalien Did you do something to make your PKGBUILD work with `-jN', N > 1?
    • Does not affect Makefile.am.

@respiranto any specific patches? Debian has a pretty terrible track record. They tend to:

1. Run a bunch of static analyzers.
2. Apply any suggested fixes without thinking.

(introducing security vulnerabilities in the process)

The few patches I sampled were things like "make this thing const".

I'd like to suggest using some of the patches provided by Debian [0], some of which address security issues. See also the dict-wn PKGBUILD [1] (which I just adapted to use the Debian patches).

[0] https://packages.debian.org/sid/wordnet

[1] https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=dict-wn