abydos

[Magnus Bergman <magnus.bergman@snisurset.net>]

Hello

I'm hoping to get my library abydos[1] into Debian. It's an image viewing
library build ontop of cairo graphics with a focus on an easy to use API and
a rich set of features related to viewing images (scalable graphics,
animation, multiple pages, aspect ratio correction etc). It was initially
created to be a modern replacement for gdk-pixbuf.

It's not yet feature complete, but already usable for the majority of use
cases. The only distribution currently including it is Mageia. It's also
in a third party Gentoo repo.

I have no experiance building Debian packages and this is probably not the
easiest package to start with. It has a lot of dependencies for the various
plugins (while the main library only depend on cairo and optionally libwebp
for the ability of writing WebP animations). So one big question is how to
divide it up into separate packages.

I've been told it's really bad from a security perspective for the library
to be able to read this many different file formats (about 150 depending how
you count) since most of the code is basically one huge attack surface.
So I guess it makes sence to distinguish betweeen more and less trusted
plugins. Does Debian perhaps have some policy related to this issue?

Another issue is that some dependencies are not available (or not working
correctly) on some architectures.

Anyway, could someone please help me proceed?


http://snisurset.net/code/abydos/