dwarfutils: CVE-2024-2002 & mold - guidance?

[Sylvestre Ledru <sylvestre@debian.org>]

Hello folks,

Because it will cause a removal of mold, I had a look to dwarfutils: 
https://salsa.debian.org/pkg-llvm-team/dwarfutils/

Given that dwarfutils hasn't been updated in Debian since Sept 2021, it 
seems that the easier path is to upload a new upstream release in the 
archive which contains the security fixes.


Now, the bad news is that a lot of symbols have been removed:
https://salsa.debian.org/pkg-llvm-team/dwarfutils/-/blob/master/debian/libdwarf1.symbols.amd64?ref_type=heads

(grep for MISSING).

I don't know if they are internal or actually used.


I didn't bump the soname yet.

I see two paths:

* we go the clean way: bump of soname, migration (which should not be 
too complex given that it is a leaf lib)

* we upload the current version. it will work for dwarfdump but might 
break other libs (esp outside of Debian)

Please let me know what you would prefer.

Thanks
Sylvstre