[Plplot-general] Announcing a new, experimental test PLplot tarball especially for testing on cygwin and macosx systems

[Alan W. I. <ir...@be...>]

OK, here is the long awaited _experimental_ PLplot test tarball for cygwin and
macosx systems.

what: plplot-5.2.1.cvs.20030921.tar.gz and plplot.md5sum (a gpg-signed file
containing the md5sum for the tarball).

where: the usual test tarball site;
http://people.debian.org/~rafael/plplot.html.  Thanks, Rafael, for producing
this.

This tarball is based on today's PLplot snapshot which contains some changes
(in particular a C++ API change and also a large extension of that API plus
a whole set of the standard examples written in C++ that use all the updates
to that API) since the 5.2.1 release. The tarball has been built with the
latest autotools available on Debian unstable. These include a libtool cvs
snapshot taken slightly after the release of libtool-1.5. Our previous
release 5.2.1 tarball, plplot-5.2.1.tar.gz, was built with libtool-1.4.3
which had well-known problems for macosx and cygwin platforms.  PLplot users
on those platforms confirm there are many problems with PLplot-5.2.1, but we
are hoping that a PLplot tarball generated with libtool-1.5 will fix those
problems.

Thus, we suggest it might be worthwhile (but see CAVEATS below) to test out
this experimental tarball on cygwin and macosx systems to see what PLplot
problems (if any) there are on those systems now with a PLplot tarball built
with libtool-1.5.  Also, you might want to try out this experimental tarball
if you would like to take advantage of the greatly improved (but changed!,
see the examples in examples/c++ ) C++ API for PLplot (put together by
Andrew Ross).

CAVEATS:

This is an _experimental_ tarball so use with some caution.  I have done my
usual tests on the two platforms available to me (Debian stable and RedHat
7.3), but that is just a start and we need lots more testing for a variety
of configurations and platforms before we can even think of calling this
version of the PLplot code non-experimental.

Also, there are some security concerns because this tarball is built with
libtool-1.5, and there is long-drawn out uncertainty whether malicious code
has been inserted into it by the GNU cracker that owned the GNU ftp server
for many months before that crack was discovered last month.  Because of
this problem, GNU have rightly withdrawn all their ~500 newer source
tarballs and are in the process of testing each one for malignant code
before re-releasing the tarball (currently at the rate of about 1 per day).
So far for the many older tarballs (which were easy to test because GNU had
access to untainted sources) there were absolutely no problems and they were
able to restore them with confidence. However, libtool-1.5 is one of the
newer tarballs which have not yet been restored. Nevertheless, the Debian
libtool packager, James Remnant is adamant (see his public remarks at
response to my concerns at
http://www.mail-archive.com/deb...@li.../msg10149.html)
that he has tracked every change in cvs for a long time since well before
the cracker rooted the GNU ftp server, and therefore no malicious code can
possibly be in the Debian unstable libtool-1.5 package.  My own judgement
call is I trust what he says because he stated it so strongly and publically
on the Debian security list so that is good enough for me, and I am
obviously willing to try this tarball on the machines accessible to me as a
result. But you will have to make your own judgement call based on your
reading of that thread (or wait many months to get access to a libtool-1.5
tarball that GNU will officially vouch for and an official release of PLplot
from us based on that).  I am sorry for this security cloud that continues
to hang over one of the more important free software development tools, but
all I can do about it is to keep you honestly informed, and agitate with the
libtool developers to verify their version 1.5 tarball so that GNU will
officially release it again.  However, so far the libtool developers see no
urgency in doing this boring task.  Thus, Rafael and I decided to use the
Debian unstable libtool-1.5 workaround which is vouched for by James Remnant
to generate this experimental PLplot tarball, but it is definitely a "use at
your own risk" situation.

If you do try this experimental PLplot tarball, please send your reports both
positive and negative to plplot_devel.  We especially need to know the
details of your platform, and if the report is negative the complete output
of the ./configure; make; and make install commands.

BTW, for my tests of this tarball I took defaults for the ./configure
options except for --prefix.

Alan
__________________________
Alan W. Irwin
email: ir...@be...
phone: 250-727-2902

Astronomical research affiliation with Department of Physics and Astronomy,
University of Victoria (astrowww.phys.uvic.ca).

Programming affiliations with the PLplot scientific plotting software
package (plplot.org), the Yorick front-end to PLplot (yplot.sf.net), the
Loads of Linux Links project (loll.sf.net), and the Linux Brochure Project
(lbproject.sf.net).
__________________________

Linux-powered Science
__________________________