[tex-k] Updates to dviljk, dviljk goes to CTAN

[Joachim Schrod]

Hi, [I think, mainly for the mailing list archive:]

An update to dviljk has been commited to TeX-Live's Subversion
repository. This update fixes several security vulnerabilities (buffer
overflows and tempfile race condition). Details are found in TL's
mailing list archive.

The update continues the already existing trend that dviljk can not be
compiled any more outside the texk build environment. I.e., there were
already kpathsea-related code pieces that were not made conditional by
#ifdef, and I added more of them. Compiling outside a kpathsea
environment now stumbles over #error that explains what is missing. 
Frankly, I don't think that anyone today cares for a
non-kpathsea-version of this driver -- and if he or she really wants
it, she should put in the work to supply the missing code.

dviljk is a fork of dvi2xx (it contains code beyond kpathsea that is
not in the original driver, namely a psfile special), and dvi2xx is
not maintained any more since 1995. I know the original author, Gustaf
Neumann, and he's not active in the TeX community any more since many
years. I.e., there does not exist an upstream version of this driver;
dviljk *is* upstream.

We discussed that in the CTAN team, where we want to hold the
canonical version of used DVI drivers in ctan:/dviware/. Since dviljk
is the only PCL DVI driver that is effectivly in use today, we decided
that dviljk is now the canonical version. There was also unanimous
agreement in the CTAN team that the dependency on the texk build
environment is not relevant for our archival purpose -- we hold many
things that can't be compiled out of the box.

To achieve that, there will be ctan:/dviware/dviljk/ which will
effectively be the version from TL's SVN trunk, updated nightly. It
will have an (also automatically) updated README file that will
explain how to get the compile environment. Namely, check out TL's SVN
Build/source/ tree and use that. (Currently, that's just true on
DANTE's host; when the update has settled, we activate syncing to the
other CTAN nodes.)

dvi2xx will probably be moved to obsolete, FYI.

I'd like to mention that we can use this automatic process for other
DVI drivers too, when upstream versions get unmaintained. (There is
currently the discussion about dvidvi's maintenance state in the TL
mailing list.)

Best,
	Joachim

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Joachim Schrod				Email: jschrod at acm.org
Roedermark, Germany