Bug#289164: marked as done (kdelibs-bin: Please relax dependency on perl-suid)
Your message dated Sun, 16 Jan 2005 17:02:25 -0500
with message-id <E1CqITZ-0000AG-00@newraff.debian.org>
and subject line Bug#289164: fixed in kdelibs 4:3.3.2-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 7 Jan 2005 16:15:02 +0000
>From steve@lobefin.net Fri Jan 07 08:15:02 2005
Return-path: <steve@lobefin.net>
Received: from mail.lobefin.net [216.158.52.98] (Debian-exim)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CmwlS-0005kx-00; Fri, 07 Jan 2005 08:15:02 -0800
Received: from lobefin.net ([216.158.52.108] helo=busybox)
by mail.lobefin.net with asmtp (TLS-1.0:RSA_ARCFOUR_SHA:16)
(Exim 4.34)
id 1CmwlQ-00079k-PK; Fri, 07 Jan 2005 11:15:00 -0500
Received: from steve by busybox with local (Exim 4.34)
id 1CmwlQ-0002y1-1m; Fri, 07 Jan 2005 11:15:00 -0500
Date: Fri, 7 Jan 2005 11:15:00 -0500
From: Stephen Gran <sgran@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: kdelibs-bin: Please relax dependency on perl-suid
Message-ID: <[🔎] 20050107161500.GA11391@busybox.lobefin.net>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="x+6KMIRAuhnl3hBn"
Content-Disposition: inline
X-Reportbug-Version: 3.5
X-Editor: VIM - Vi IMproved 6.3
X-OS: Linux busybox 2.6.7-1-686 i686
X-Uptime: 1:12
X-Latin: Hodie septimo Idus Ianuarias MMDCCLVIII ab urbe condita est
X-Date: Today is Boomtime, the 7th day of Chaos in the YOLD 3171
X-DDate: Only 2431234 Shopping Days Left Before X-Day. Or not.
X-Motto: debian/rules
User-Agent: Mutt/1.5.6+20040907i
X-Authenticated-Sender: steve
X-Scanned-By: ClamAV at mail.lobefin.net
Delivered-To: submit@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--x+6KMIRAuhnl3hBn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Package: kdelibs-bin
Version: 4:3.3.1-4
Severity: wishlist
Hello,
I just noticed that I cannot get rid of perl-suid on my machine, and I
would quite like to. It has a poor track record WRT security, and I
don't fully trust everyone with access to the machine.
It appears that only 2 scripts in kdelibs-bin are suid perl scripts, and
they are not 'essential' parts of the package, at least IMHO. Would it
be possible to relax the Depends: to a Recommends: ? Installing from
aptitude or one of the other frontends wil still pull in Recommends,
allowing the package to work, but would me allow me to uninstall
perl-suid and still keep KDE.
Thanks for considering,
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.7-1-686
Locale: LANG=3DC, LC_CTYPE=3DC (charmap=3DISO-8859-1) (ignored: LC_ALL set =
to en_US.ISO-8859-1)
Versions of packages kdelibs-bin depends on:
ii kdelibs4 4:3.3.1-4 KDE core libraries
ii libart-2.0-2 2.3.16-6 Library of functions for 2D gr=
aphi
ii libbz2-1.0 1.0.2-2 high-quality block-sorting fil=
e co
ii libc6 2.3.2.ds1-20 GNU C Library: Shared librarie=
s an
ii libcupsys2-gnutls10 1.1.23-1 Common UNIX Printing System(tm=
) -=20
ii libfam0c102 2.7.0-6 client library to control the =
FAM=20
ii libfontconfig1 2.2.3-4 generic font configuration lib=
rary
ii libgcc1 1:3.4.3-6 GCC support library
ii libice6 4.3.0.dfsg.1-10 Inter-Client Exchange library
ii libidn11 0.5.2-3 GNU libidn library, implementa=
tion
ii libpng12-0 1.2.8rel-1 PNG library - runtime
ii libqt3c102-mt 3:3.3.3-7 Qt GUI Library (Threaded runti=
me v
ii libsm6 4.3.0.dfsg.1-10 X Window System Session Manage=
ment
ii libstdc++5 1:3.3.5-5 The GNU Standard C++ Library v3
ii libx11-6 4.3.0.dfsg.1-10 X Window System protocol clien=
t li
ii libxext6 4.3.0.dfsg.1-10 X Window System miscellaneous =
exte
ii libxft2 2.1.2-6 FreeType-based font drawing li=
brar
ii libxml2 2.6.11-5 GNOME XML library
ii libxrender1 0.8.3-7 X Rendering Extension client l=
ibra
ii libxslt1.1 1.1.8-5 XSLT processing library - runt=
ime=20
ii menu-xdg 0.2 freedesktop.org menu compliant=
win
ii netpbm 2:10.0-8 Graphics conversion tools
ii perl-suid 5.8.4-5 Runs setuid Perl scripts
ii python 2.3.4-5 An interactive high-level obje=
ct-o
ii xlibs 4.3.0.dfsg.1-10 X Keyboard Extension (XKB) con=
figu
ii zlib1g 1:1.2.2-4 compression library - runtime
-- no debconf information
--=20
-----------------------------------------------------------------
| ,''`. Stephen Gran |
| : :' : sgran@debian.org |
| `. `' Debian user, admin, and developer |
| `- http://www.debian.org |
-----------------------------------------------------------------
--x+6KMIRAuhnl3hBn
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFB3rWDSYIMHOpZA44RAlehAJ0VkkZ8RRN4lEUaEPzg44Xgf3iaZQCgoXxL
8DBnt1ecqQVfGzq9ADMdC5o=
=ALSI
-----END PGP SIGNATURE-----
--x+6KMIRAuhnl3hBn--
---------------------------------------
Received: (at 289164-close) by bugs.debian.org; 16 Jan 2005 22:05:45 +0000
>From katie@ftp-master.debian.org Sun Jan 16 14:05:45 2005
Return-path: <katie@ftp-master.debian.org>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CqIWm-0007bz-00; Sun, 16 Jan 2005 14:05:44 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1CqITZ-0000AG-00; Sun, 16 Jan 2005 17:02:25 -0500
From: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
To: 289164-close@bugs.debian.org
X-Katie: $Revision: 1.55 $
Subject: Bug#289164: fixed in kdelibs 4:3.3.2-1
Message-Id: <E1CqITZ-0000AG-00@newraff.debian.org>
Sender: Archive Administrator <katie@ftp-master.debian.org>
Date: Sun, 16 Jan 2005 17:02:25 -0500
Delivered-To: 289164-close@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 8
Source: kdelibs
Source-Version: 4:3.3.2-1
We believe that the bug you reported is fixed in the latest version of
kdelibs, which is due to be installed in the Debian FTP archive:
kdelibs-bin_3.3.2-1_i386.deb
to pool/main/k/kdelibs/kdelibs-bin_3.3.2-1_i386.deb
kdelibs-data_3.3.2-1_all.deb
to pool/main/k/kdelibs/kdelibs-data_3.3.2-1_all.deb
kdelibs4-dev_3.3.2-1_i386.deb
to pool/main/k/kdelibs/kdelibs4-dev_3.3.2-1_i386.deb
kdelibs4-doc_3.3.2-1_all.deb
to pool/main/k/kdelibs/kdelibs4-doc_3.3.2-1_all.deb
kdelibs4_3.3.2-1_i386.deb
to pool/main/k/kdelibs/kdelibs4_3.3.2-1_i386.deb
kdelibs_3.3.2-1.diff.gz
to pool/main/k/kdelibs/kdelibs_3.3.2-1.diff.gz
kdelibs_3.3.2-1.dsc
to pool/main/k/kdelibs/kdelibs_3.3.2-1.dsc
kdelibs_3.3.2-1_all.deb
to pool/main/k/kdelibs/kdelibs_3.3.2-1_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 289164@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org> (supplier of updated kdelibs package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sun, 16 Jan 2005 20:48:01 +0100
Source: kdelibs
Binary: kdelibs4 kdelibs-bin kdelibs kdelibs4-doc kdelibs-data kdelibs4-dev
Architecture: source i386 all
Version: 4:3.3.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Description:
kdelibs - KDE core libraries metapackage
kdelibs-bin - KDE core binaries
kdelibs-data - KDE core shared data
kdelibs4 - KDE core libraries
kdelibs4-dev - KDE core libraries (development files)
kdelibs4-doc - KDE core library documentation
Closes: 263430 285128 286521 287097 287201 287566 288653 289164 290190 290191
Changes:
kdelibs (4:3.3.2-1) unstable; urgency=medium
.
+++ Changes by Adeodato Simó:
.
* Uploading to unstable. This new upstream version fixes CAN-2004-1145,
"Konqueror Java Vulnerability", and thus closes: #286521. Urgency set
to medium for this reason (the package has been in experimental for some
time, and has been checked to work properly with the rest of 3.3.1
packages).
.
* debian/control:
- make kdelibs-data replace kjscmd (<< 4:3.3.0), which was missed in the
3.3.1-1 upload and completely forgotten since then. (Closes: #288653)
.
* debian/kdelibs-data.install: the files added in the previous upload were
checked not to exist in oo.o-mimelnk in sid, but sadly they exist in the
version in sarge. Reverted them for now, will be re-added when OpenOffice
1.1.3 enters sarge (with the proper Conflicts: entry). (Closes: #287097)
.
List of files:
- usr/share/mimelnk/application/vnd.sun.xml.calc.template.desktop
- usr/share/mimelnk/application/vnd.sun.xml.draw.template.desktop
- usr/share/mimelnk/application/vnd.sun.xml.impress.template.desktop
- usr/share/mimelnk/application/vnd.sun.xml.writer.template.desktop
.
+++ Changes by Christopher Martin:
.
* KDE_3_3_BRANCH update. Pulls in the fix for CAN-2004-1165, the FTP command
injection bug. (Closes: #285128, #287201)
.
* Add patch to change the group set by KDE CUPS configurator to Debian's
default, lpadmin, rather than sys. (Closes: #263430)
.
* Add kaccel hack that works around a Konqueror crash with Russian keyboards.
(Closes: #287566)
.
* Change debian/copyright file to refer to licenses, instead of copyright,
when discussing KDE's licenses. (Closes: #290191, #290190)
.
* Change dependency on perl-suid to perl, and add Recommends: perl-suid.
The lack of perl-suid should only cause problems for some users using
NFS or SMB shares. (Closes: #289164)
Files:
5a5b291bbb6afb99219a8eb20d367587 1302 libs optional kdelibs_3.3.2-1.dsc
77e5cafe54180b108026cf769f0881d4 249693 libs optional kdelibs_3.3.2-1.diff.gz
3e52b23a11b1f2525227b7b92557c528 853130 libs optional kdelibs-bin_3.3.2-1_i386.deb
57a32d66d0b83303f5c2df8ad4282045 8185634 libs optional kdelibs4_3.3.2-1_i386.deb
e16a623a61e3e782d6156c862b6f9ca5 1230822 libdevel optional kdelibs4-dev_3.3.2-1_i386.deb
7254ee7da031de021e093ee53e909f97 18232 kde optional kdelibs_3.3.2-1_all.deb
05de696544e6470efe771d1a9e09f342 7082858 libs optional kdelibs-data_3.3.2-1_all.deb
87121b89ce0b5c7e1aa7bc386498f735 11530760 doc optional kdelibs4-doc_3.3.2-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: Signed by Isaac Clerencia <isaac@warp.es>
iD8DBQFB6uEzQET2GFTmct4RAsBzAJ9vxU5BEvEIF/9roHrIGcq7C107LgCfZv02
73cZKZqziTtyQgYhlWRhZT0=
=Pz0s
-----END PGP SIGNATURE-----
Reply to: