NVIM v0.3.6

FIXES:
4553fc5e6c #10082 vim-patch:8.1.1365: :source should check sandbox

OTHER:
877d539904 #10027 genappimage.sh: migrate to linuxdeploy

CMakeLists.txt

@@ -112,7 +112,7 @@ set_property(CACHE CMAKE_BUILD_TYPE PROPERTY
 # version string, else they are combined with the result of `git describe`.
 set(NVIM_VERSION_MAJOR 0)
 set(NVIM_VERSION_MINOR 3)
-set(NVIM_VERSION_PATCH 5)
+set(NVIM_VERSION_PATCH 6)
 set(NVIM_VERSION_PRERELEASE "") # for package maintainers
 
 # API level

scripts/genappimage.sh

@@ -37,29 +37,24 @@ VERSION=$("$ROOT_DIR"/build/bin/nvim --version | head -n 1 | grep -o 'v.*')
 
 cd "$APP_BUILD_DIR"
 
-curl -Lo "$APP_BUILD_DIR"/appimage_functions.sh https://github.com/AppImage/AppImages/raw/master/functions.sh
-. ./appimage_functions.sh
+# Only downloads linuxdeploy if the remote file is different from local
+if [ -e "$APP_BUILD_DIR"/linuxdeploy-x86_64.AppImage ]; then
+  curl -Lo "$APP_BUILD_DIR"/linuxdeploy-x86_64.AppImage \
+    -z "$APP_BUILD_DIR"/linuxdeploy-x86_64.AppImage \
+    https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage  
+else
+  curl -Lo "$APP_BUILD_DIR"/linuxdeploy-x86_64.AppImage \
+    https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
+fi
 
-# Copy desktop and icon file to AppDir for AppRun to pick them up.
-# get_apprun
-# get_desktop
-cp "$ROOT_DIR/runtime/nvim.desktop" "$APP_DIR/"
-cp "$ROOT_DIR/runtime/nvim.png" "$APP_DIR/"
+chmod +x "$APP_BUILD_DIR"/linuxdeploy-x86_64.AppImage
+
+# metainfo is not packaged automatically by linuxdeploy
 mkdir "$APP_DIR/usr/share/metainfo/"
 cp "$ROOT_DIR/runtime/nvim.appdata.xml" "$APP_DIR/usr/share/metainfo/"
 
 cd "$APP_DIR"
 
-# copy dependencies
-copy_deps
-# Move the libraries to usr/bin
-move_lib
-
-# Delete stuff that should not go into the AppImage.
-# Delete dangerous libraries; see
-# https://github.com/AppImage/AppImages/blob/master/excludelist
-delete_blacklisted
-
 ########################################################################
 # AppDir complete. Now package it as an AppImage.
 ########################################################################
@@ -78,21 +73,24 @@ chmod 755 AppRun
 
 cd "$APP_BUILD_DIR" # Get out of AppImage directory.
 
+# Set the name of the file generated by appimage
+export OUTPUT=nvim.appimage
+
+# If it's a release generate the zsync file
+if [ -n "$TAG" ]; then
+  export UPDATE_INFORMATION="gh-releases-zsync|neovim|neovim|$TAG|nvim.appimage.zsync"
+fi
+
 # Generate AppImage.
 #   - Expects: $ARCH, $APP, $VERSION env vars
 #   - Expects: ./$APP.AppDir/ directory
-#   - Produces: ../out/$APP-$VERSION.glibc$GLIBC_NEEDED-$ARCH.AppImage
-if [ -n "$TAG" ]; then
-  generate_type2_appimage -u "gh-releases-zsync|neovim|neovim|$TAG|nvim.appimage.zsync"
-else
-  generate_type2_appimage
-fi
+#   - Produces: ./nvim.appimage
+./linuxdeploy-x86_64.AppImage --appdir $APP.AppDir -d $ROOT_DIR/runtime/nvim.desktop -i \
+"$ROOT_DIR/runtime/nvim.png" --output appimage
 
 # Moving the final executable to a different folder so it isn't in the
 # way for a subsequent build.
 
-mv "$ROOT_DIR"/out/*.AppImage* "$ROOT_DIR"/build/bin
-# Remove the (now empty) folder the AppImage was built in
-rmdir "$ROOT_DIR"/out
+mv "$ROOT_DIR"/build/nvim.appimage* "$ROOT_DIR"/build/bin
 
 echo 'genappimage.sh: finished'

scripts/release.sh

@@ -15,10 +15,6 @@
 #     - Tag the commit.
 #   Create the "version bump" commit:
 #     - CMakeLists.txt: Set NVIM_VERSION_PRERELEASE to "-dev"
-#
-# Manual steps:
-#   - CMakeLists.txt: Bump NVIM_VERSION_* as appropriate.
-#   - git push --follow-tags
 
 set -e
 set -u
@@ -95,5 +91,9 @@ _do_bump_commit
 echo "
 Next steps:
     - Double-check NVIM_VERSION_* in CMakeLists.txt
-    - git push --follow-tags
-    - update website: index.html"
+    - Push the tag:
+        git push --follow-tags
+    - Update the 'stable' tag:
+        git push --force upstream HEAD^:refs/tags/stable
+        git fetch --tags
+    - Update website: index.html"

src/nvim/getchar.c

@@ -1244,6 +1244,13 @@ openscript (
     EMSG(_(e_nesting));
     return;
   }
+
+  // Disallow sourcing a file in the sandbox, the commands would be executed
+  // later, possibly outside of the sandbox.
+  if (check_secure()) {
+    return;
+  }
+
   if (ignore_script)
     /* Not reading from script, also don't open one.  Warning message? */
     return;