[Git][lintian/lintian][master] Turn embedded-library into a classification tag. (Closes: #932634)

["Felix Lechner (@lechner)" <gitlab@salsa.debian.org>]

Title: GitLab

Felix Lechner pushed to branch master at lintian / lintian

Commits:

• 4c091cd2
  by Felix Lechner at 2022-01-13T10:47:57-08:00

  Turn embedded-library into a classification tag. (Closes: #932634)
  
  Linking statically may no longer be a packaging error in 2022. Many ostensibly
  modern languages such as Golang, Rust or Haskell link most or all libraries
  statically into the binaries they produce.
  
  For some time, I tried to find other identifying characteristics that would
  distinguish the C library libyaml, when linked in statically, from binaries in
  other statically linked languages.
  
  Vexingly for this purpose, the newer YAML implementations seem to mirror the
  strings found in the C version with amazing accuracy. The sole exception was the
  string "found a tab character that violate indentation" (missing an S) but it
  seemed unwise to rely on a misspelling that might be corrected, even while the
  defective string was still present in the latest libyaml version in unstable.
  
  Of course, the security considerations stated in the tag description still
  apply, but those issues reach nowadays far beyond static linking. My desperate
  searches on codesearch.d.n were furter befuddled by many vendored sources that
  should perhaps not be there. [1]
  
  After some reflection, the Security Team likely has to examine all embedded
  versions of affected libraries even when the mode of linking is not actionable
  by the Debian distributor because a language works that way.
  
  As a compromise, this commit hides the tag from everyday users but keeps the
  information accessible via our website's JSON interface [2] for anyone
  researching security matters.
  
  Thanks to Helen Koike for bringning the matter to our attention!
  
  [1] For an example, see yaml.v2 here: https://sources.debian.org/src/golang-github-coreos-discovery-etcd-io/2.0.0+git2019.04.19.git.78fb45d3c9-4/Gopkg.lock/#L543-L549
  [2] https://lintian.debian.org/query
  

1 changed file:

• tags/e/embedded-library.tag

Changes:

tags/e/embedded-library.tag

---

1	1	Tag: embedded-library
2		-Severity: error
	2	+Severity: classification
3	3	Check: libraries/embedded
4	4	Explanation: The given ELF object appears to have been statically linked to
5	5	a library. Doing this is strongly discouraged due to the extra work
...	...	@@ -9,4 +9,5 @@ Explanation: The given ELF object appears to have been statically linked to
9	9	If the package uses a modified version of the given library it is highly
10	10	recommended to coordinate with the library's maintainer to include the
11	11	changes on the system version of the library.
12		-See-Also: debian-policy 4.13
	12	+See-Also:
	13	+ debian-policy 4.13

—
View it on GitLab.
You're receiving this email because of your account on salsa.debian.org. If you'd like to receive fewer emails, you can adjust your notification settings.