[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Reducing the attack surface caused by Berkeley DB...



On Fri, Jan 26, 2018 at 11:49:41PM +0100, Lionel Debroux wrote:
> > Anyway, the only util in apt-utils making use of libdb is
> > apt-ftparchive which a) isn't used much in Debian – but by some
> > derivatives¹ and b) can operate without the backing of a db, but you
> > don't want to run a large archive without it.
>
> Could that program conceivably be split to another package ?

Not really. apt-utils includes three tools: apt-extracttemplates,
apt-ftparchive and apt-sortpkgs. The later two should be together and
the first one shouldn't even exist… it exists only temporary as
a stopgap as long as there is no dpkg tool (which would be the more
natural place for extracting files from a deb file)[0] for this task.
In other words: We realized only later that its existence is permantent,
like with all good temporary solutions.

Splitting packages now means that the split will reach effect at most in
bullseye… (buster needs at least a recommends for upgraders, likely
depends as there are tools like local-apt-repository depending on
apt-utils to get apt-ftparchive) that might be a bit too far off for
your case, especially as we haven't really gained anything by it. We
just (literally) moved the problem.

(The other aspects I will hopefully answer with another mail in the
gsoc/outreach subthread)


Best regards

David Kalnischkies

[0] https://wiki.debian.org/Teams/Dpkg/RoadMap

Attachment: signature.asc
Description: PGP signature


Reply to: