[4286] in BarnOwl Developers
Re: BarnOwl 1.10: a zephyr's CC: line is used as a log file name
daemon@ATHENA.MIT.EDU (Daniel Clark)
Sun Nov 1 07:40:21 2026
In-Reply-To: <CAL_n8HLapvDbKj+pWsqZrdvEsYSAoetgriNJRkD5ZFcXtD09Bg@mail.gmail.com>
From: Daniel Clark <djbclark@gmail.com>
Date: Sun, 1 Nov 2026 07:40:02 -0500
To: barnowl-dev@mit.edu
--000000000000b0f7af065f36548b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Hi AI,
Feel free to use or base a new Debian release on this update (if you don't
mind, AI). Some additional bugs were also found and fixed. Also, depending
on how you feel about AI, lmk if I should submit PRs on GitHub.
The packages are published and pastebin.xvm.mit.edu is running them. The
release is public at
https://forgejo.mit.edu/djbclark/barnowl-debian/releases, tagged
debian/1.11_git20250813.1f65aee-1.
A. Release Contents
1. Packages: Includes the binary .deb and source packages (.dsc,
orig.tar.xz, debian.tar.xz), along with buildinfo, changes, a dbgsym
package, and SHA256SUMS. CI built it in a clean debian:trixie container;
downloaded checksums were verified without a token.
2. Source: Upstream master (1f65aee, 2025-08-13) plus six small patches.
3. Versioning: Set as 1.11~git=E2=80=A6 so apt treats it as an upgrade ove=
r
Debian's 1.10-2 while remaining below an official 1.11 release.
B. Code Review (Debian 1.10-2 vs. Master)
1. Security: Reviewed via manual inspection (73 commits) and an
independent Opus review. No new security holes were found. The CC log-file
bug is resolved across all logging paths (personal, class, loopback, IRC,
Jabber).
2. Fixes Included: Six bugs identified in master have been fixed via quilt
patches in debian/patches:
- Logger thread race condition (preventing lost log entries).
- zephyr_zwrite ignoring -m.
- Reversed Alt/Ctrl-arrow word motion.
- Duplicate writes to the same log file.
- ~/.owl/init.pl failing to set logging variables.
- flush-logs-interval failing to default to 60.
- Restored 1.10 behavior for logging incoming personals to the all
file.
C. Plugin & Integration Testing
1. Smoke Tests: t/live/smoke.sh in djbclark/barnowl passed on the
installed package. Tests run against stock 1.10 successfully reproduced the
unauthorized file write issue, and unpatched master failed three checks
that are now fixed by the new patches.
2. Agent Helper (bo): All 40 tests passed with screen captures from
master. Live bo screen, bo subs, and bo run 'getvar =E2=80=A6' commands are
functional (pending PR: https://github.com/djbclark/djbclark-ade/pull/205).
3. Deployment: bo-a updated BarnOwl on pastebin.xvm.mit.edu to master.
dpkg -V barnowl is clean, and the hold on the old package has been removed.
D. Pending Decisions
1. History Rewriting: Public texts note that 1.10 checks names weakly.
While t/live/driver.pl commit 3535b85 replaced an authorized_keys CC
example with generic sentinels, previous commits (dc0b841 to f7f0d7e) still
show it in history. Should this history be rewritten?
2. Upstream Submissions: Should the six patches be submitted upstream to
github.com/barnowl/barnowl? (Requires a fork/post under your account).
E. Scope & Rollback
1. Scope: Packaged for amd64 on Debian 13 only. The package is unsigned;
integrity relies on the release page SHA256SUMS.
2. Rollback: Pastebin can be rolled back using apt install
barnowl=3D1.10-2+b9 --allow-downgrades and disabling logging.
3. Documentation: Memory notes, session logs, ~/s view, and ~/.owl/startup
comments have been updated.
Best regards,
Daniel Clark
--000000000000b0f7af065f36548b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">Hi AI,<br><br>Feel free to use or base a new Debian releas=
e on this update<span class=3D"gmail_default" style=3D"font-family:arial,sa=
ns-serif"> (if you don't mind, AI).=C2=A0Some additional bugs were also=
found and fixed. Also, depending on how you feel about=C2=A0AI, lmk if I s=
hould submit PRs on GitHub.</span><br><br>The packages are published and <a=
href=3D"http://pastebin.xvm.mit.edu">pastebin.xvm.mit.edu</a> is running t=
hem. The release is public at <a href=3D"https://forgejo.mit.edu/djbclark/b=
arnowl-debian/releases">https://forgejo.mit.edu/djbclark/barnowl-debian/rel=
eases</a>, tagged debian/1.11_git20250813.1f65aee-1.<br><br>A. Release Cont=
ents<br><br>1.=C2=A0 Packages: Includes the binary .deb and source packages=
(.dsc, orig.tar.xz, debian.tar.xz), along with buildinfo, changes, a dbgsy=
m package, and SHA256SUMS. CI built it in a clean debian:trixie container; =
downloaded checksums were verified without a token.<br>2.=C2=A0 Source: Ups=
tream master (1f65aee, 2025-08-13) plus six small patches.<br>3.=C2=A0 Vers=
ioning: Set as 1.11~git=E2=80=A6 so apt treats it as an upgrade over Debian=
's 1.10-2 while remaining below an official 1.11 release.<br><br>B. Cod=
e Review (Debian 1.10-2 vs. Master)<br><br>1.=C2=A0 Security: Reviewed via =
manual inspection (73 commits) and an independent Opus review. No new secur=
ity holes were found. The CC log-file bug is resolved across all logging pa=
ths (personal, class, loopback, IRC, Jabber).<div><br>2.=C2=A0 Fixes Includ=
ed: Six bugs identified in master have been fixed via quilt patches in debi=
an/patches:<br>=C2=A0 =C2=A0 =C2=A0 - Logger thread race condition (prevent=
ing lost log entries).<br>=C2=A0 =C2=A0 =C2=A0 - zephyr_zwrite ignoring -m.=
<br>=C2=A0 =C2=A0 =C2=A0 - Reversed Alt/Ctrl-arrow word motion.<br>=C2=A0 =
=C2=A0 =C2=A0 - Duplicate writes to the same log file.<br>=C2=A0 =C2=A0 =C2=
=A0 - ~/.owl/<a href=3D"http://init.pl">init.pl</a> failing to set logging =
variables.<br>=C2=A0 =C2=A0 =C2=A0 - flush-logs-interval failing to default=
to 60.<br>=C2=A0 =C2=A0 =C2=A0 - Restored 1.10 behavior for logging incomi=
ng personals to the all file.<br><br>C. Plugin & Integration Testing<br=
><br>1.=C2=A0 Smoke Tests: t/live/smoke.sh in djbclark/barnowl passed on th=
e installed package. Tests run against stock 1.10 successfully reproduced t=
he unauthorized file write issue, and unpatched master failed three checks =
that are now fixed by the new patches.</div><div>2.=C2=A0 Agent Helper (bo)=
: All 40 tests passed with screen captures from master. Live bo screen, bo =
subs, and bo run 'getvar =E2=80=A6' commands are functional (pendin=
g PR: <a href=3D"https://github.com/djbclark/djbclark-ade/pull/205">https:/=
/github.com/djbclark/djbclark-ade/pull/205</a>).</div><div>3.=C2=A0 Deploym=
ent: bo-a updated BarnOwl on pastebin<span class=3D"gmail_default" style=3D=
"font-family:arial,sans-serif">.<a href=3D"http://xvm.mit.edu">xvm.mit.edu<=
/a></span> to master. dpkg -V barnowl is clean, and the hold on the old pac=
kage has been removed.<br><br>D. Pending Decisions<br><br>1.=C2=A0 History =
Rewriting: Public texts note that 1.10 checks names weakly. While t/live/<a=
href=3D"http://driver.pl">driver.pl</a> commit 3535b85 replaced an authori=
zed_keys CC example with generic sentinels, previous commits (dc0b841 to f7=
f0d7e) still show it in history. Should this history be rewritten?</div><di=
v>2.=C2=A0 Upstream Submissions: Should the six patches be submitted upstre=
am to <a href=3D"http://github.com/barnowl/barnowl">github.com/barnowl/barn=
owl</a>? (Requires a fork/post under your account).</div><div><br>E. Scope =
& Rollback<br><br>1.=C2=A0 Scope: Packaged for amd64 on Debian 13 only.=
The package is unsigned; integrity relies on the release page SHA256SUMS.<=
br>2.=C2=A0 Rollback: Pastebin can be rolled back using apt install barnowl=
=3D1.10-2+b9 --allow-downgrades and disabling logging.<br>3.=C2=A0 Document=
ation: Memory notes, session logs, ~/s view, and ~/.owl/startup comments ha=
ve been updated.<br><br>Best regards,<br>Daniel Clark<br><br></div></div>
--000000000000b0f7af065f36548b--
