Re: PNG crush NMU
Kapil Hari Paranjape <kapil@imsc.res.in> writes:
> I've prepared an NMU of pngcrush that applies currently available
> patches and closes the RC bugs on it. The files are under
> http://www.imsc.res.in/~kapil/debian/pngcrush/
> Since I am not a DD I request one of the QA team who *are* to please
> sponsor the upload. Before you do however, please note that I have not
> received an OK from the maintainer for the patch applied.
> Sepcifically, this patched version does not make use of zlib1g and
> libpng as packaged with Debian and uses upstream's versions of these
> libraries statically compiled in. This seems to be the only way
> currently of avoiding the bugs that have crept in which result from an
> incompatibility between upstream's use of the libraries and current
> development of those libraries.
Ugh, that's not a very good solution. That means that the next time
there's a security hole in zlib or libpng, which hasn't been uncommon, it
may also affect pngcrush and someone has to remember to update it as well.
This makes life much harder for the security team.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: