Control: retitle -1 RFS: netcode/1.4.3+ds-1 [ITP] -- secure client/server connections over UDP Control: tags -1 -moreinfo
Hi Simon, Following up on your review — apologies for the slow turnaround. All points addressed, and this one has a reason beyond housekeeping to refresh: a security fix. - New upstream release 1.4.3. netcode 1.4.0 fixed AEAD nonce reuse when a server is restarted in-process (the global packet sequence was seeded only on create, so a restarted server re-encrypted global packets at already-used sequence numbers under the same key; netcode uses the packet sequence as the AEAD nonce). No CVE — the GitHub advisory is GHSA-3x95-24j9-7448. The version your review looked at, 1.3.5, predates the fix, so the refreshed upload is the one that should reach the archive. - Vcs-* now points at salsa, live and current: https://salsa.debian.org/gafferongames/netcode - ${misc:Depends} dropped (debhelper-compat 14). - watch file is version=5. One W-severity lintian tag remains on the two repacked packages (debian-watch-not-mangling-version) — the watch file does carry an explicit dversionmangle stripping +ds, so I believe the tag is spurious here, but I mention it so it does not surprise you. - Beyond the build/link test, the package now has a functional autopkgtest exercising address parsing and connect-token generation — deliberately nothing that binds a port. Verified by injecting defects; it failed on both. - The mentors upload is refreshed to netcode/1.4.3+ds-1. Thanks again — ready for another look. Glenn
