Bug#1008495: transition: tinyobjloader

[Sebastian Ramacher <sramacher@debian.org>]

Control: tags -1 confirmed

Hi Timo

On 2022-03-27 19:27:22 +0200, Timo Röhling wrote:
> Package: release.debian.org
> Severity: normal
> User: release.debian.org@packages.debian.org
> Usertags: transition
> 
> Dear release team,
> 
> I'd like to transition tinyobjloader for its new soname. Technically,
> this is a simple transition, the reverse dependencies build fine.
> However, the transition is unusual as it is not an official release, so
> allow me to explain my reasons.
> 
> The initial upload was with 2.0.0~rc5 around April 2020, because it was
> required by Open3D at that time. Upstream assured me that a final 2.0
> release would be happening in early 2021. Some development occurred
> (which broke ABI backwards compatibility) and some bugs were fixed,
> among them CVE-2020-28589; however, the final release never
> materialized. Now, almost two years later, I find myself with an
> "in-between" ABI version that is no longer .so.1 but likely not
> .so.2 yet (the TODO still includes some "API polishing").
> 
> It is impossible to predict when upstream will find the time to finish
> the 2.0 release, and I would like to have the bugfixes in Debian at some
> point. Given that this is only a minor package with few reverse depends,
> I felt it was fine to have this "in-between" transition now and the
> proper one with .so.2 whenever the final release happens. Let me know
> what you think.

Sorry, this transition was completely missed. Please go ahead.

Cheers
-- 
Sebastian Ramacher