Re: Request to backport fix for CVE-2022-45939 to Emacs 28

[Jim Porter]

On 2/16/2023 12:02 PM, Eli Zaretskii wrote:
> > From: Richard Stallman <rms@gnu.org>
> > Cc: eliz@gnu.org, emacs-devel@gnu.org
> > Date: Thu, 16 Feb 2023 12:50:08 -0500
> >
> > What makes it a ontrivial job to release one?  Is it because there
> > other fixes have been committed to the Emacs 28 branch since the last
> > release?  Would including them in a release call for some additioal
> > work?
>
> The whole process takes a non-trivial amount of work.  It is described
> in make-tarball.txt.  If someone wants to do it, they are welcome.

Would it help to turn make-tarball.txt into an executable script? 
Looking through the document, I believe most of it could be automated. 
Even if we only automated the easiest parts, that would still cut down 
on the amount of manual effort required.

Eventually, we could even use EMBA to produce these tarballs if we can 
get the script to the point where it requires no human intervention. 
Then (assuming permissions are set up properly and some various other 
handwaving), all a maintainer would have to do to publish a new Emacs 
release would be to tag a revision and push the tag to Savannah.

If there's interest in any of this, I'm happy to help work on it.