[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Building a program with the library shipped in Debian, not in orig.tar.gz



Hello,

On Wed, 27 Sep 2006, Charles Plessy wrote:
> Le Wed, Sep 27, 2006 at 11:10:34AM +0100, Jon Dowland a écrit :
> > At 1158313616 past the epoch, Charles Plessy wrote:
> > > EMBOSS is shipped and built with its own copy of libpcre.
> > > As a result, the EMBOSS Debian package contains some files
> > > wich are also in the libpcre Debian package, and they
> > > conflict together.
> > 
> 
> Other distributions, such as RHEL, FreeBSD, Gentoo, and Fink all manage
> to distribute EMBOSS, so I wonder if the problem my inexperience rather
> than EMBOSS itself...

I had a similar issue with building pngcrush and libpng.

If you build using the upstream's copy of libpcre which is included
with the code, then the security team will raise the following
question: "Who is responsible for fixing the security issues that
arise in the libpcre library as they apply to your package?"

This is forever a problem with forked code. If there is a security
bug in one version the security team will be forced to examine its
implications in all other forks. 

For this reason the Debian version of "pngcrush" is built using the
Debian "libpng". This is something that is deprecated by the upstream
author but he has been kind enough to facilitate it anyhow.

The Debian version of "optipng" is done differently. It includes a
separate library of png functions which are only for its own use.
Hence it does not depend on Debian's libpng at all.

Hope this experience will help you to solve your problem.

Regards,

Kapil.
--

Attachment: signature.asc
Description: Digital signature


Reply to: