Debian Bug report logs - #637488
t1lib: history of security issues, unmaintained upstream, unsupportable

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: submit@bugs.debian.org

Subject: t1lib: many severe security issues, unmaintained upstream, unsupportable

Date: Thu, 11 Aug 2011 19:53:43 -0400

package: t1lib
version: 5.1.2-3
severity: grave
tag: security

Hi, the t1lib package currently has a significant set of security
vulnerabilities [0].  There hasn't been an upstream release in over 3
years, so it seems unmaintained, and thus the issues are unlikely to
be fixed.  Some tools such as xpdf have simply dropped support for
t1lib because of this [1].  I've submitted another bug to the release
team recommending removal of the package [2].  Of course if the issues
are somehow fixed, the package can stay.

Best wishes,
Mike

[0] http://security-tracker.debian.org/tracker/source-package/t1lib
[1] http://www.foolabs.com/xpdf/download.html
[2] http://bugs.debian.org/6370404

Message #10 received at 637488@bugs.debian.org (full text, mbox, reply):

From: Ruben Molina <rmolina@udea.edu.co>

To: Michael Gilbert <michael.s.gilbert@gmail.com>

Cc: 637488@bugs.debian.org

Subject: Re: Bug#637488: t1lib: many severe security issues, unmaintained upstream, unsupportable

Date: Sat, 13 Aug 2011 21:46:18 -0500

[Message part 1 (text/plain, inline)]

El jue, 11-08-2011 a las 19:53 -0400, Michael Gilbert escribió:
> Hi, the t1lib package currently has a significant set of security
> vulnerabilities [0].  There hasn't been an upstream release in over 3
> years, so it seems unmaintained, and thus the issues are unlikely to
> be fixed.  Some tools such as xpdf have simply dropped support for

Hi Michael,

Thanks for pointing this out. I have fully agree with you and I think
this package can be removed once rdepends issues are solved. 
AFAICT, freetype is a suitable alternative.

Thanks,
  Ruben

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 637488@bugs.debian.org (full text, mbox, reply):

From: Arne Wichmann <aw@anhrefn.saar.de>

To: 637488@bugs.debian.org

Subject: Ping - remove t1lib

Date: Sun, 17 Jun 2012 12:14:28 +0200

[Message part 1 (text/plain, inline)]

Just to remember... As far as I can see there are no more rdepends left.
Are there any more reasons not to remove t1lib?

cu

AW
-- 
[...] If you don't want to be restricted, don't agree to it. If you are
coerced, comply as much as you must to protect yourself, just don't support
it. Noone can free you but yourself. (crag, on Debian Planet)
Arne Wichmann (aw@linux.de)

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 637488@bugs.debian.org (full text, mbox, reply):

From: "Adam D. Barratt" <adam@adam-barratt.org.uk>

To: Arne Wichmann <aw@anhrefn.saar.de>, 637488@bugs.debian.org

Subject: Re: Bug#637488: Ping - remove t1lib

Date: Sun, 17 Jun 2012 11:49:17 +0100

On Sun, 2012-06-17 at 12:14 +0200, Arne Wichmann wrote:
> Just to remember... As far as I can see there are no more rdepends left.
> Are there any more reasons not to remove t1lib?

How did you determine that?  Running "dak rm -Rn t1lib" on ftp-master
says:

Checking reverse dependencies...
# Broken Depends:
dvi2ps: dvi2ps [amd64]
evince: libevdocument3-4
grace: grace
gtkmathview: libgtkmathview-bin
             libgtkmathview-dev
             libgtkmathview0c2a
lablgtkmathview: liblablgtkmathview-ocaml
vflib3: vflib3 [amd64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel powerpc s390 s390x sparc]
        vflib3-bin
        vflib3-dev

# Broken Build-Depends:
claws-mail: libt1-dev
evince: libt1-dev
grace: libt1-dev
gtkmathview: libt1-dev (>= 5.1.1-1.1)
swftools: libt1-dev
vflib3: libt1-dev

Dependency problem found.

Regards,

Adam

Message #25 received at 637488@bugs.debian.org (full text, mbox, reply):

From: Arne Wichmann <aw@anhrefn.saar.de>

To: "Adam D. Barratt" <adam@adam-barratt.org.uk>

Cc: 637488@bugs.debian.org

Subject: Re: Bug#637488: Ping - remove t1lib

Date: Sun, 17 Jun 2012 14:41:50 +0200

[Message part 1 (text/plain, inline)]

begin  quotation  from Adam D. Barratt (in <1339930157.7014.2.camel@jacala.jungle.funky-badger.org>):
> On Sun, 2012-06-17 at 12:14 +0200, Arne Wichmann wrote:
> > Just to remember... As far as I can see there are no more rdepends left.
> > Are there any more reasons not to remove t1lib?
> 
> How did you determine that?  Running "dak rm -Rn t1lib" on ftp-master
> says:

It seems I should improve on my tool knowledge.

> Checking reverse dependencies...
> # Broken Depends:
> dvi2ps: dvi2ps [amd64]
> evince: libevdocument3-4
> grace: grace
> gtkmathview: libgtkmathview-bin
>              libgtkmathview-dev
>              libgtkmathview0c2a
> lablgtkmathview: liblablgtkmathview-ocaml
> vflib3: vflib3 [amd64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel powerpc s390 s390x sparc]
>         vflib3-bin
>         vflib3-dev
> 
> # Broken Build-Depends:
> claws-mail: libt1-dev
> evince: libt1-dev
> grace: libt1-dev
> gtkmathview: libt1-dev (>= 5.1.1-1.1)
> swftools: libt1-dev
> vflib3: libt1-dev
> 
> Dependency problem found.

So it is time to file bugs to these respective packages, isn't it?

cu

AW
-- 
[...] If you don't want to be restricted, don't agree to it. If you are
coerced, comply as much as you must to protect yourself, just don't support
it. Noone can free you but yourself. (crag, on Debian Planet)
Arne Wichmann (aw@linux.de)

[signature.asc (application/pgp-signature, inline)]

Message #30 received at 637488@bugs.debian.org (full text, mbox, reply):

From: "Adam D. Barratt" <adam@adam-barratt.org.uk>

To: Arne Wichmann <aw@anhrefn.saar.de>

Cc: 637488@bugs.debian.org

Subject: Re: Bug#637488: Ping - remove t1lib

Date: Sun, 17 Jun 2012 14:20:13 +0100

On Sun, 2012-06-17 at 14:41 +0200, Arne Wichmann wrote:
> begin  quotation  from Adam D. Barratt (in <1339930157.7014.2.camel@jacala.jungle.funky-badger.org>):
> > Checking reverse dependencies...
> > # Broken Depends:
> > dvi2ps: dvi2ps [amd64]
> > evince: libevdocument3-4
> > grace: grace
> > gtkmathview: libgtkmathview-bin
> >              libgtkmathview-dev
> >              libgtkmathview0c2a
> > lablgtkmathview: liblablgtkmathview-ocaml
> > vflib3: vflib3 [amd64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel powerpc s390 s390x sparc]
> >         vflib3-bin
> >         vflib3-dev
> > 
> > # Broken Build-Depends:
> > claws-mail: libt1-dev
> > evince: libt1-dev
> > grace: libt1-dev
> > gtkmathview: libt1-dev (>= 5.1.1-1.1)
> > swftools: libt1-dev
> > vflib3: libt1-dev
> > 
> > Dependency problem found.
> 
> So it is time to file bugs to these respective packages, isn't it?

That time was a few months ago, really.

Regards,

Adam

Message #35 received at 637488@bugs.debian.org (full text, mbox, reply):

From: Tobias Hansen <tobias.han@gmx.de>

To: debian-release@lists.debian.org

Cc: 637488@bugs.debian.org

Subject: What to do about t1lib / RC #637488

Date: Sat, 04 Aug 2012 00:37:23 +0200

Hi,

t1lib has no upstream, but a number of security vulnerabilities and reverse dependencies.

We need to know if #637488 can be ignored for wheezy or if we should go for removal and file bugs against the reverse dependencies.

Best regards,
Tobias Hansen

Message #40 received at 637488@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Tobias Hansen <tobias.han@gmx.de>

Cc: debian-release@lists.debian.org, 637488@bugs.debian.org

Subject: Re: What to do about t1lib / RC #637488

Date: Sat, 4 Aug 2012 16:45:23 +0200

On Sat, Aug 04, 2012 at 12:37:23AM +0200, Tobias Hansen wrote:
> Hi,
> 
> t1lib has no upstream, but a number of security vulnerabilities and reverse dependencies.
> 
> We need to know if #637488 can be ignored for wheezy or if we should go for removal and file bugs against the reverse dependencies.

We fixed up the known security issues in DSAs and while the code base is
admittedly old and crusty, I don't see this issue as pressing that the removal
cannot wait until Jessie.

Cheers,
        Moritz

Message #45 received at 637488@bugs.debian.org (full text, mbox, reply):

From: "Adam D. Barratt" <adam@adam-barratt.org.uk>

To: Moritz Mühlenhoff <jmm@inutil.org>

Cc: Tobias Hansen <tobias.han@gmx.de>, debian-release@lists.debian.org, 637488@bugs.debian.org

Subject: Re: What to do about t1lib / RC #637488

Date: Sat, 04 Aug 2012 16:09:38 +0100

user release.debian.org@packages.debian.org
usertag 637488 + wheezy-can-defer
tag 637488 + wheezy-ignore
thanks

On Sat, 2012-08-04 at 16:45 +0200, Moritz Mühlenhoff wrote:
> On Sat, Aug 04, 2012 at 12:37:23AM +0200, Tobias Hansen wrote:
> > t1lib has no upstream, but a number of security vulnerabilities and reverse dependencies.
> > 
> > We need to know if #637488 can be ignored for wheezy or if we should go for removal and file bugs against the reverse dependencies.

There already are bugs against (at least some of) the reverse
dependencies.  I see Pino just set those as blockers against the RM bug;
thanks!

> We fixed up the known security issues in DSAs and while the code base is
> admittedly old and crusty, I don't see this issue as pressing that the removal
> cannot wait until Jessie.

Looking at the tracker and the upload history - ack; thanks.

Regards,

Adam

Message #56 received at 637488-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 131336-done@bugs.debian.org,637488-done@bugs.debian.org,653635-done@bugs.debian.org,722843-done@bugs.debian.org,700415-done@bugs.debian.org,

Cc: t1lib@packages.debian.org, t1lib@packages.qa.debian.org

Subject: Bug#744881: Removed package(s) from unstable

Date: Fri, 02 May 2014 12:24:10 +0000

Version: 5.1.2-4+rm

Dear submitter,

as the package t1lib has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/744881

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Luca Falavigna (the ftpmaster behind the curtain)

Send a report that this bug log contains spam.