Bug#550441: advi: statically links to camlimages

[Stéphane Glondu <steph@glondu.net>]

Michael S Gilbert a écrit :
> advi statically links to camlimages, which makes security updates very
> complicated.  please update advi to dynamically link to camlimages.
> thanks.

Unfortunately, this is not possible without making significant changes
to advi (and/or OCaml itself). Almost all programs written in OCaml
suffer from this limitation. I had already asked to have advi be
recompiled with the new camlimages, but the request got lost somehow
(maybe Mehdi can give more information on this).

There is no shared library support in OCaml. Upstream is hostile to this
[1], so if some support would be added, it would be Debian-specific and
make the whole OCaml stack of Debian diverge from everywhere else (we
don't really want that). There is however dynamic linking (à la dlopen).

[1] http://article.gmane.org/gmane.comp.lang.caml.inria/23778

Note that even there was shared library support in OCaml, that wouldn't
automatically make security updates easier because of the checks OCaml
performs at link time, and it would be very unwise to disable these
checks. In other words, an updated library can require recompilation of
all reverse dependencies anyway.


Cheers,

-- 
Stéphane