On 26.09.2014 23:28, Andreas Barth wrote:
* Andreas Cadhalpun (andreas.cadhalpun@googlemail.com) [140926 23:24]:On 26.09.2014 22:55, Moritz Muehlenhoff wrote:On Fri, Sep 26, 2014 at 10:56:08PM +0200, Cyril Brulebois wrote:[ Not speaking for any team. ] Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> (2014-09-26):FFmpeg was recently accepted into the Debian archive by the FTP team. We plan to upload it to unstable soon, so that it can be part of Jessie. If you have any concerns about this, now would be a good time to start discussing them in order to find a solution for Jessie.I think those concerns have been raised already, with the bottom line roughly being: it's either libav or ffmpeg, not both?Indeed.And why?In my opinion upstreams' security support for FFmpeg is better than that of most other packages in Debian. Security updates are a simple matter of packaging a new point release from upstream. The work for the security team would be limited to reviewing the upstream changes and sending out a DSA. Additionally the security of FFmpeg has improved quite a bit so that nowadays there a far fewer CVEs for it than e.g. for MySQL.That sounds like we should drop libav and release with ffmpeg.
That would only be my second choice.
Is this also the opinion of the libav maintainers?
I'm not exactly sure what you mean, but I don't think the Libav maintainers are in favor of dropping Libav from Debian. If you want to know for sure, I suggest asking Reinhard Tartler, who is the main Libav packager.
Or is there a strong reason why this is not possible?
The upcoming freeze might be. Best regards, Andreas