[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#491378: Several issues regarding linking, orphaned, behind upstream, low popcon -> IMHO not suitable for release

Package: linm
Severity: serious

While looking at this package to do a QA upload I noticed several
possible issues:

 - GPLed, yet links against OpenSSL. While the only code that uses
   OpenSSL is licensed under a less restrictive license and on itself
   is proably ok to be linked with it, in the end all is meshed together
   in one library.
 - Said code is a copy of libssh2, so it probably should be using the
   seperate version in the archive instead.
 - Said code is also not mentioned in debian/copyright at all.
 - Parts of this package consist of static libraries that e.g.
   link parts of OpenSSL in. This is probably a bad idea from
   a security point of view.

Together with the facts that this package is orphaned, laggs several
version behind upstream, and has really low popcon numbers I think
it would be better to keep it out of lenny for now and remove it
soon unless someone wants to clean it up.

	Frank Lichtenheld

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.25-2-686 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Reply to: