Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel > #87611

Re: Q: Debian position on bundled libraries

Show all headers | View raw

On Thu, Aug 23, 2018 at 12:59 PM, Alec Leamas wrote:

> Here is some libraries to unbundle; this could certainly could be done,
> However, the core issue is a few libraries which cannot realistically be
> unbundled. One example is mygdal, a heavily patched subset of the gdal
> package.

gdal has had one security issue in the past and I wouldn't be
surprised if it had one in the future, since it is basically a
collection of file format parsers. As such I am not sure using a fork
of it is a good idea. It would be best to work with both upstreams to
resolve the delta.

https://security-tracker.debian.org/tracker/source-package/gdal

> So, before proceeding with this work I'd like to know how to handle a
> situation like this. Under what conditions (if any) is bundling actually OK?

Personally, I don't think it is ever acceptable.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

Back to linux.debian.devel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Q: Debian position on bundled libraries Alec Leamas <leamas.alec@gmail.com> - 2018-08-23 07:10 +0200
  Re: Q: Debian position on bundled libraries Pierre-Elliott Bécue <becue@crans.org> - 2018-08-23 08:40 +0200
    Re: Q: Debian position on bundled libraries Paul Wise <pabs@debian.org> - 2018-08-23 09:30 +0200
    Re: Q: Debian position on bundled libraries Alec Leamas <leamas.alec@gmail.com> - 2018-08-23 09:40 +0200
      Re: Q: Debian position on bundled libraries Pierre-Elliott Bécue <becue@crans.org> - 2018-08-23 09:50 +0200
  Re: Q: Debian position on bundled libraries Paul Wise <pabs@debian.org> - 2018-08-23 09:30 +0200
    Re: Q: Debian position on bundled libraries Alec Leamas <leamas.alec@gmail.com> - 2018-08-23 10:00 +0200
      Re: Q: Debian position on bundled libraries Paul Wise <pabs@debian.org> - 2018-08-23 12:10 +0200
        Re: Q: Debian position on bundled libraries Alec Leamas <leamas.alec@gmail.com> - 2018-08-23 12:30 +0200
          Bug#907051: Say much more about vendoring of libraries Sean Whitton <spwhitton@spwhitton.name> - 2018-08-23 15:20 +0200

csiph-web