Dear mentors,

I am looking for a sponsor for my package "netcode":

 * Package name     : netcode
   Version          : 1.3.5+ds-1
   Upstream contact : Glenn Fiedler <glenn@mas-bandwidth.com>
 * URL              : https://github.com/mas-bandwidth/netcode
 * License          : BSD-3-Clause
   Section          : libdevel

To access further information about this package, please visit:

https://mentors.debian.net/package/netcode/

Changes for the initial release:

  netcode (1.3.5+ds-1) unstable; urgency=medium
  .
    * Initial release. (Closes: #1141998)

This package is one of four from the yojimbo game-networking stack
(serialize, reliable, netcode, yojimbo), of which I am the upstream
author. serialize, reliable and netcode are mutually independent;
yojimbo build-depends on all three and follows once they are accepted.
I would be glad to have the set sponsored together.

Regards,
Glenn Fiedler

Hello,

Thank you for your work on this package. For this and the other two, the main blockers are the Vcs-* fields. Please create an account on salsa.debian.org to track your packaging separately. Homepage correctly points to upstream, but Vcs-* needs to point to the packaging repository.

Specific notes for this package:
- ${misc:Depends} is no longer necessary with debhelper-compat 14.
- Please upgrade the watch file to version 5.

Please remove the moreinfo tag once you're ready for another review. Feel free to CC me, if I'm available I can take another look.

Best regards,
Simon Quigley
tsimonq2@debian.org

Hi Simon,

As in the serialize bug: I'm Rowan, an AI collaborator at Mas Bandwidth, working with Glenn Fiedler (the maintainer) on these packages; he asked me to handle this correspondence directly and is CC'd.

Following up on your review, with our apologies for the slow turnaround. All points addressed, and this one has a reason beyond housekeeping to refresh: a security fix.

- New upstream release 1.4.3. netcode 1.4.0 fixed AEAD nonce reuse when a server is restarted in-process (the global packet sequence was seeded only on create, so a restarted server re-encrypted global packets at already-used sequence numbers under the same key; netcode uses the packet sequence as the AEAD nonce). No CVE; the GitHub advisory is GHSA-3x95-24j9-7448. The version your review looked at, 1.3.5, predates the fix, so the refreshed upload is the one that should reach the archive.
- Vcs-* now points at salsa, live and current: https://salsa.debian.org/gafferongames/netcode
- ${misc:Depends} dropped (debhelper-compat 14).
- watch file is version=5, with an explicit dversionmangle stripping the +ds suffix. One heads-up on the current lintian report: it now shows W: debhelper-but-no-misc-depends, which fires precisely because ${misc:Depends} was dropped per your review — mentioned so it does not surprise you.
- Beyond the build/link test, the package now has a functional autopkgtest exercising address parsing and connect-token generation, deliberately nothing that binds a port. Verified by injecting defects; it failed on both.
- The mentors upload is netcode/1.4.3+ds-1.

Thanks again — ready for another look.

Rowan
rowan@mas-bandwidth.com (AI collaborator, Mas Bandwidth, for Glenn Fiedler)

Hi Simon,

Following up on your review — apologies for the slow turnaround. All
points addressed, and this one has a reason beyond housekeeping to
refresh: a security fix.

- New upstream release 1.4.3. netcode 1.4.0 fixed AEAD nonce reuse when a
  server is restarted in-process (the global packet sequence was seeded
  only on create, so a restarted server re-encrypted global packets at
  already-used sequence numbers under the same key; netcode uses the
  packet sequence as the AEAD nonce). No CVE — the GitHub advisory is
  GHSA-3x95-24j9-7448. The version your review looked at, 1.3.5, predates
  the fix, so the refreshed upload is the one that should reach the
  archive.
- Vcs-* now points at salsa, live and current:
https://salsa.debian.org/gafferongames/netcode
- ${misc:Depends} dropped (debhelper-compat 14).
- watch file is version=5. One W-severity lintian tag remains on the two
  repacked packages (debian-watch-not-mangling-version) — the watch file
  does carry an explicit dversionmangle stripping +ds, so I believe the
  tag is spurious here, but I mention it so it does not surprise you.
- Beyond the build/link test, the package now has a functional autopkgtest
  exercising address parsing and connect-token generation — deliberately
  nothing that binds a port. Verified by injecting defects; it failed on
  both.
- The mentors upload is refreshed to netcode/1.4.3+ds-1.

Thanks again — ready for another look.

Glenn