Debian Bug report logs - #639565
liboauth-dev: please make loose libcurl dependency

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: KURASHIKI Satoru <lurdan@gmail.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: liboauth-dev: please make loose libcurl dependency

Date: Sun, 28 Aug 2011 17:59:46 +0900

Package: liboauth-dev
Version: 0.9.4-2
Severity: normal

hi,

Because of Depends: libcurl4-gnutls-dev, liboauth-dev conflicts with
libcurl4-nss-dev.

How about Depends: libcurl4-dev (or libcurl-dev) instead?

regards,

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.0.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=ja_JP.UTF-8, LC_CTYPE=ja_JP.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages liboauth-dev depends on:
ii  libcurl4-gnutls-dev           7.21.7-1   Development files and documentatio
ii  liboauth0                     0.9.4-2    C library for implementing OAuth 1

liboauth-dev recommends no packages.

liboauth-dev suggests no packages.

-- no debconf information

Message #12 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Satoru KURASHIKI <lurdan@gmail.com>

To: 639565@bugs.debian.org

Subject: Re: liboauth-dev: please make loose libcurl dependency

Date: Tue, 27 Sep 2011 12:27:42 +0900

hi,

On Sun, Aug 28, 2011 at 5:59 PM, KURASHIKI Satoru <lurdan@gmail.com> wrote:
> Package: liboauth-dev
> Version: 0.9.4-2
> Severity: normal

> Because of Depends: libcurl4-gnutls-dev, liboauth-dev conflicts with
> libcurl4-nss-dev.

This bug was already fixed in ubuntu as follows:

http://launchpadlibrarian.net/77039053/liboauth_0.9.4-2_0.9.4-2ubuntu1.diff.gz

Please update also in debian.

regards,
-- 
KURASHIKI Satoru

Message #19 received at 639565-close@bugs.debian.org (full text, mbox, reply):

From: Sjoerd Simons <sjoerd@debian.org>

To: 639565-close@bugs.debian.org

Subject: Bug#639565: fixed in liboauth 0.9.4-3

Date: Sat, 05 Nov 2011 12:03:43 +0000

Source: liboauth
Source-Version: 0.9.4-3

We believe that the bug you reported is fixed in the latest version of
liboauth, which is due to be installed in the Debian FTP archive:

liboauth-dev_0.9.4-3_amd64.deb
  to main/libo/liboauth/liboauth-dev_0.9.4-3_amd64.deb
liboauth0_0.9.4-3_amd64.deb
  to main/libo/liboauth/liboauth0_0.9.4-3_amd64.deb
liboauth_0.9.4-3.debian.tar.gz
  to main/libo/liboauth/liboauth_0.9.4-3.debian.tar.gz
liboauth_0.9.4-3.dsc
  to main/libo/liboauth/liboauth_0.9.4-3.dsc



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 639565@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sjoerd Simons <sjoerd@debian.org> (supplier of updated liboauth package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sat, 05 Nov 2011 11:31:14 +0000
Source: liboauth
Binary: liboauth-dev liboauth0
Architecture: source amd64
Version: 0.9.4-3
Distribution: unstable
Urgency: low
Maintainer: Bilal Akhtar <bilalakhtar@ubuntu.com>
Changed-By: Sjoerd Simons <sjoerd@debian.org>
Description: 
 liboauth-dev - C library for implementing OAuth 1.0 (development files)
 liboauth0  - C library for implementing OAuth 1.0
Closes: 639565 646485
Changes: 
 liboauth (0.9.4-3) unstable; urgency=low
 .
   * Sync from Ubuntu:
     [ Mathieu Trudel-Lapierre ]
       * debian/control: liboauth-dev really needs libcurl4-nss-dev, not
         libcurl4-gnutls-dev (nss is required in the .pc file)
         (closes: #646485, #639565)
   [ Sjoerd Simons ]
   * collab-main team update
   * debian/control: Swith build-depend to libcurl4-nss-dev from
     libcurl4-gnutls-dev. oauth itself uses nss for SSL
Checksums-Sha1: 
 dbc542c5babc3ae3680a40bc508993748cc1a7f2 1326 liboauth_0.9.4-3.dsc
 2fa57f4ccfc2f8ccc50e9105d3ffa94b44d4f64b 3897 liboauth_0.9.4-3.debian.tar.gz
 519175f421d964b6471a07ae269214bac57871df 37236 liboauth-dev_0.9.4-3_amd64.deb
 1f08a4ce56e31f5bb2ab4735eeef2c74bb17f987 19830 liboauth0_0.9.4-3_amd64.deb
Checksums-Sha256: 
 1276c8fecc141c3feb6fa4e390b8bc22a836fe1d1724998719de33adcce5604b 1326 liboauth_0.9.4-3.dsc
 cd52b34dabb1f1e40cc2b4650306db4524884236350a321115e548f8ae017f58 3897 liboauth_0.9.4-3.debian.tar.gz
 49fd1f87d322896ea41285abb42523ac429f0259b0d1c140d04020f4424217f7 37236 liboauth-dev_0.9.4-3_amd64.deb
 5f3b0931ee91f8d03b6d52f406372a79efd65d0d027b110bbb302687d05da8ec 19830 liboauth0_0.9.4-3_amd64.deb
Files: 
 d5cc3c8718ef7189e5a6f838e73b8c42 1326 libs optional liboauth_0.9.4-3.dsc
 3aaca153748388b7dde1d34a83644879 3897 libs optional liboauth_0.9.4-3.debian.tar.gz
 fd362be84b861ad3facce00ac9884344 37236 libdevel optional liboauth-dev_0.9.4-3_amd64.deb
 0bdbc153ab90d4494979d17222c60de4 19830 libs optional liboauth0_0.9.4-3_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk61IRQACgkQgTd+SodosdL23wCfeRWPows+/TeXYSATniIrkYGD
EsAAn00IvVJMMdQOMus83rSe3ztBMyLj
=sbLI
-----END PGP SIGNATURE-----

Message #34 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Tsukasa Hamano <hamano.t@gmail.com>

To: 639565@bugs.debian.org

Date: Sat, 21 Jul 2012 03:38:22 +0900

Hi,

The SSL library is used two usage in liboauth.

* for HTTPS communication by libcurl
* for OAuth hash/signature

They are fully independent usage.
Now, The package is using NSS for hash/signature due to --enable-nss
was specified. However we do not need to specifiy libcurl ssl backend.

Therefore, We should specify to liboauth-dev:
Depends: libcurl4-dev libnss3-dev

-- 
Tsukasa Hamano

Message #39 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: Tsukasa Hamano <hamano.t@gmail.com>, 639565@bugs.debian.org

Cc: 650138@bugs.debian.org, Vincent Lefevre <vincent@vinc17.net>

Subject: Re: Bug#639565:

Date: Sat, 28 Jul 2012 19:28:40 +0200

[Message part 1 (text/plain, inline)]

On Sat, 21 Jul 2012 03:38:22 +0900, Tsukasa Hamano wrote:

> The SSL library is used two usage in liboauth.
> 
> * for HTTPS communication by libcurl
> * for OAuth hash/signature
> 
> They are fully independent usage.
> Now, The package is using NSS for hash/signature due to --enable-nss
> was specified. However we do not need to specifiy libcurl ssl backend.
> 
> Therefore, We should specify to liboauth-dev:
> Depends: libcurl4-dev libnss3-dev

libcurl4-dev is a virtual package, so we need a real one too.

What I've tried now is:

#v+
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control   2011-11-05 12:41:07.000000000 +0100
+++ liboauth-0.9.4/debian/control   2012-07-28 19:14:03.000000000 +0200
@@ -2,7 +2,7 @@
 Priority: optional
 Maintainer: Bilal Akhtar <bilalakhtar@ubuntu.com>
 Build-Depends: debhelper (>= 8.1.3),
-               libcurl4-nss-dev,
+               libcurl4-gnutls-dev | libcurl4-dev,
                libnss3-dev,
                libtool,
                locales-all | language-pack-en,
@@ -16,7 +16,7 @@
 Package: liboauth-dev
 Section: libdevel
 Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}
 Description: C library for implementing OAuth 1.0 (development files)
  liboauth is a collection of C functions implementing the
  OAuth Core 1.0 standard API. liboauth provides basic functions to escape
#v-

which has a very interesting effect:
The runtime dependencies for liboauth0 change from
    Depends: libc6 (>= 2.4), libcurl3-nss (>= 7.16.2-1), libnss3-1d (>= 3.12.0~1.9b1)
to
    Depends: libc6 (>= 2.4), libcurl3-gnutls (>= 7.16.2), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.0~1.9b1)

and with the rebuilt library installed, the bug in #650138 is gone!


Cheers,
gregor
 
-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: David Bowie: Ground Control to Major Tom

[signature.asc (application/pgp-signature, inline)]

Message #46 received at 639565@bugs.debian.org (full text, mbox, reply):

From: HAMANO Tsukasa <hamano@cuspy.org>

To: 639565@bugs.debian.org

Subject: Re: Bug#639565:

Date: Wed, 01 Aug 2012 14:48:36 +0900

[Message part 1 (text/plain, inline)]

Hi,

Thanks for your response.

At Sat, 28 Jul 2012 19:28:40 +0200,
gregor herrmann <gregoa@debian.org> wrote:
>
> libcurl4-dev is a virtual package, so we need a real one too.
>

Why do we need to specify a real package?
Please tell me why we can't specify virtual package.

> What I've tried now is:
>
> -Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
> +Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}
(snip)

> which has a very interesting effect:
> The runtime dependencies for liboauth0 change from
>     Depends: libc6 (>= 2.4), libcurl3-nss (>= 7.16.2-1), libnss3-1d (>= 3.12.0~1.9b1)
> to
>     Depends: libc6 (>= 2.4), libcurl3-gnutls (>= 7.16.2), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.0~1.9b1)
>
This issue is not resolved.
The depends is force developper to link with gnutls.
I think that we don't need to specify a ssl library package.

Thank you.

> and with the rebuilt library installed, the bug in #650138 is gone!
>
>
> Cheers,
> gregor
>
> --
>  .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
>  : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
>  `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
>    `-   NP: David Bowie: Ground Control to Major Tom

--
HAMANO Tsukasa <hamano@cuspy.org>

[Message part 2 (application/pgp-signature, inline)]

Message #51 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Tsukasa Hamano <hamano.t@gmail.com>

To: gregor herrmann <gregoa@debian.org>

Cc: 639565@bugs.debian.org, 650138@bugs.debian.org, Vincent Lefevre <vincent@vinc17.net>

Subject: Re: Bug#639565:

Date: Wed, 1 Aug 2012 14:56:29 +0900

Hi,

Thanks for your response.

2012/7/29 gregor herrmann <gregoa@debian.org>:
> On Sat, 21 Jul 2012 03:38:22 +0900, Tsukasa Hamano wrote:
>
> libcurl4-dev is a virtual package, so we need a real one too.
>
Why do we need to specify a real package?
Please tell me why we can't specify virtual package.

> What I've tried now is:
>
> -Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
> +Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}

(snip)

> which has a very interesting effect:
> The runtime dependencies for liboauth0 change from
>     Depends: libc6 (>= 2.4), libcurl3-nss (>= 7.16.2-1), libnss3-1d (>= 3.12.0~1.9b1)
> to
>     Depends: libc6 (>= 2.4), libcurl3-gnutls (>= 7.16.2), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.0~1.9b1)
>

This issue is not resolved.
The depends is force developper to link with gnutls.
I think that we don't need to specify a ssl library package.

Thank you.

> and with the rebuilt library installed, the bug in #650138 is gone!
>
>
> Cheers,
> gregor
>
> --
>  .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
>  : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
>  `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
>    `-   NP: David Bowie: Ground Control to Major Tom


-- 
Tsukasa Hamano

Message #56 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: Tsukasa Hamano <hamano.t@gmail.com>

Cc: 639565@bugs.debian.org, 650138@bugs.debian.org, Vincent Lefevre <vincent@vinc17.net>

Subject: Re: Bug#639565:

Date: Wed, 1 Aug 2012 08:31:37 +0200

On Wed, 01 Aug 2012 14:56:29 +0900, Tsukasa Hamano wrote:

> > libcurl4-dev is a virtual package, so we need a real one too.
> Why do we need to specify a real package?
> Please tell me why we can't specify virtual package.

Cf. the description of the lintian warning:

http://lintian.debian.org/tags/virtual-package-depends-without-real-package-depends.html
 
> > which has a very interesting effect:
> > The runtime dependencies for liboauth0 change from
> >     Depends: libc6 (>= 2.4), libcurl3-nss (>= 7.16.2-1), libnss3-1d (>= 3.12.0~1.9b1)
> > to
> >     Depends: libc6 (>= 2.4), libcurl3-gnutls (>= 7.16.2), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.0~1.9b1)
> This issue is not resolved.
> The depends is force developper to link with gnutls.
> I think that we don't need to specify a ssl library package.

I _guess_ (haven't tried yet) that whatever of the curl-ssl libraries
is used at build time will show up in Depends ...
 
> > and with the rebuilt library installed, the bug in #650138 is gone!

And that's _my_ main concern :)


Cheers,
gregor
 
-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   Kirk to Enterprise -- beam down yeoman Rand and a six-pack. 

Message #61 received at 639565@bugs.debian.org (full text, mbox, reply):

From: HAMANO Tsukasa <hamano@cuspy.org>

To: gregor herrmann <gregoa@debian.org>

Cc: Tsukasa Hamano <hamano.t@gmail.com>, 639565@bugs.debian.org, 650138@bugs.debian.org, Vincent Lefevre <vincent@vinc17.net>

Subject: Re: Bug#639565:

Date: Wed, 01 Aug 2012 18:13:25 +0900

[Message part 1 (text/plain, inline)]

Hi,

At Wed, 1 Aug 2012 08:31:37 +0200,
gregor herrmann <gregoa@debian.org> wrote:
>
> Cf. the description of the lintian warning:
>
> http://lintian.debian.org/tags/virtual-package-depends-without-real-package-depends.html
>
Ok, I understood your change(libcurl4-gnutls-dev | libcurl4-dev) is proper.

But I think strange runtime depends.

> > > which has a very interesting effect:
> > > The runtime dependencies for liboauth0 change from
> > >     Depends: libc6 (>= 2.4), libcurl3-nss (>= 7.16.2-1), libnss3-1d (>= 3.12.0~1.9b1)
> > > to
> > >     Depends: libc6 (>= 2.4), libcurl3-gnutls (>= 7.16.2), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.0~1.9b1)

Probably, It would be better the runtime dependency is libcurl3 |
libcurl3-nss | libcurl3-gnutls.
Well, It would not be such a critical issue, due to they are able to
exist together.

Thank you.

--
HAMANO Tsukasa <hamano@cuspy.org>

[Message part 2 (application/pgp-signature, inline)]

Message #66 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: HAMANO Tsukasa <hamano@cuspy.org>, 639565@bugs.debian.org

Cc: Tsukasa Hamano <hamano.t@gmail.com>, 650138@bugs.debian.org, Vincent Lefevre <vincent@vinc17.net>

Subject: Re: Bug#639565:

Date: Wed, 1 Aug 2012 11:30:45 +0200

On Wed, 01 Aug 2012 18:13:25 +0900, HAMANO Tsukasa wrote:

> > > > which has a very interesting effect:
> > > > The runtime dependencies for liboauth0 change from
> > > >     Depends: libc6 (>= 2.4), libcurl3-nss (>= 7.16.2-1), libnss3-1d (>= 3.12.0~1.9b1)
> > > > to
> > > >     Depends: libc6 (>= 2.4), libcurl3-gnutls (>= 7.16.2), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.0~1.9b1)
> Probably, It would be better the runtime dependency is libcurl3 |
> libcurl3-nss | libcurl3-gnutls.

I see your point but
1) this dependency is calculated automatically from
   ${shlibs:Depends}, to add the alternatives would prbably need some
   ugly hack
2) I'm not sure if bilding against on one and then depending on a
   different version works?
3) the dependency on libcurl3-gnutls actually fixes #650138   

> Well, It would not be such a critical issue, due to they are able to
> exist together.

And that's for liboauth0.

For liboauth-dev, my patch specifies
"Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ..."
which should be enough to solve the issue you were raising here,
right?

Cheers,
gregor

-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   Warp 7 -- It's a law we can live with. 

Message #71 received at 639565@bugs.debian.org (full text, mbox, reply):

From: HAMANO Tsukasa <hamano.t@gmail.com>

To: gregor herrmann <gregoa@debian.org>

Cc: 639565@bugs.debian.org, Tsukasa Hamano <hamano.t@gmail.com>, 650138@bugs.debian.org, Vincent Lefevre <vincent@vinc17.net>

Subject: Re: Bug#639565:

Date: Thu, 02 Aug 2012 12:03:34 +0900

[Message part 1 (text/plain, inline)]

At Wed, 1 Aug 2012 11:30:45 +0200,
gregor herrmann <gregoa@debian.org> wrote:
>
> On Wed, 01 Aug 2012 18:13:25 +0900, HAMANO Tsukasa wrote:
>
> > > > > which has a very interesting effect:
> > > > > The runtime dependencies for liboauth0 change from
> > > > >     Depends: libc6 (>= 2.4), libcurl3-nss (>= 7.16.2-1), libnss3-1d (>= 3.12.0~1.9b1)
> > > > > to
> > > > >     Depends: libc6 (>= 2.4), libcurl3-gnutls (>= 7.16.2), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.0~1.9b1)
> > Probably, It would be better the runtime dependency is libcurl3 |
> > libcurl3-nss | libcurl3-gnutls.
>
> I see your point but
> 1) this dependency is calculated automatically from
>    ${shlibs:Depends}, to add the alternatives would prbably need some
>    ugly hack
hmm,

> 2) I'm not sure if bilding against on one and then depending on a
>    different version works?

No problem, liboauth is not use directly SSL interface. We can switch
them when linking application with liboauth.

> 3) the dependency on libcurl3-gnutls actually fixes #650138
>
> > Well, It would not be such a critical issue, due to they are able to
> > exist together.
>
> And that's for liboauth0.
>
> For liboauth-dev, my patch specifies
> "Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ..."
> which should be enough to solve the issue you were raising here,
> right?
>

Yes, liboauth-dev's issue was solved. liboauth0 dependency is a little
strange, but I'm ok to closing the bug.
Thanks very much!

--
HAMANO Tsukasa <hamano.t@gmail.com>

[Message part 2 (application/pgp-signature, inline)]

Message #76 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: HAMANO Tsukasa <hamano.t@gmail.com>

Cc: 639565@bugs.debian.org, 650138@bugs.debian.org, Vincent Lefevre <vincent@vinc17.net>

Subject: Re: Bug#639565:

Date: Thu, 2 Aug 2012 08:12:21 +0200

On Thu, 02 Aug 2012 12:03:34 +0900, HAMANO Tsukasa wrote:

> > 2) I'm not sure if bilding against on one and then depending on a
> >    different version works?
> No problem, liboauth is not use directly SSL interface. We can switch
> them when linking application with liboauth.

Ok.
 
> > For liboauth-dev, my patch specifies
> > "Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ..."
> > which should be enough to solve the issue you were raising here,
> > right?
> Yes, liboauth-dev's issue was solved. liboauth0 dependency is a little
> strange, but I'm ok to closing the bug.
> Thanks very much!

Well, it's not solved yet, since the fixed package only existed in
some temporary directory on my laptop :)


Cheers,
gregor

-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   "Rome wasn't burned in a day. " 

Message #81 received at 639565@bugs.debian.org (full text, mbox, reply):

From: HAMANO Tsukasa <hamano@cuspy.org>

To: gregor herrmann <gregoa@debian.org>

Cc: 639565@bugs.debian.org, 650138@bugs.debian.org, Vincent Lefevre <vincent@vinc17.net>

Subject: Re: Bug#639565:

Date: Sun, 19 Aug 2012 05:04:21 +0900

[Message part 1 (text/plain, inline)]

Hi,

I think, This is best solution.

Build-Depends: libcurl4-gnutls-dev
(It can be a any real package.)

liboauth-dev's Depends: liboauth0 (= ${binary:Version}), ${misc:Depends}, libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev

liboauth0's Depends: ${misc:Depends}, ${shlibs:Depends}, libcurl3 | libcurl3-gnutls | libcurl3-nss

As we know, This isn't enough due to ${shlibs:Depends} is include
libcurl3-gnutls then remove another libcurl 'or' conditions.

Please apply the patch:

--- liboauth-0.9.4.orig/src/Makefile.am
+++ liboauth-0.9.4/src/Makefile.am
@@ -4,5 +4,5 @@ include_HEADERS = oauth.h

 liboauth_la_SOURCES=oauth.c config.h hash.c xmalloc.c xmalloc.h oauth_http.c
 liboauth_la_LDFLAGS=@LIBOAUTH_LDFLAGS@ -version-info @VERSION_INFO@
-liboauth_la_LIBADD=@HASH_LIBS@ @CURL_LIBS@
+liboauth_la_LIBADD=@HASH_LIBS@
 liboauth_la_CFLAGS=@LIBOAUTH_CFLAGS@ @HASH_CFLAGS@ @CURL_CFLAGS@

Actually, we do not need to link shared library to shared library.
We'll get liboauth0 package that Depends: libcurl3 | libcurl3-gnutls | libcurl3-nss

Thank you.

At Thu, 2 Aug 2012 08:12:21 +0200,
gregor herrmann <gregoa@debian.org> wrote:
>
> On Thu, 02 Aug 2012 12:03:34 +0900, HAMANO Tsukasa wrote:
>
> > > 2) I'm not sure if bilding against on one and then depending on a
> > >    different version works?
> > No problem, liboauth is not use directly SSL interface. We can switch
> > them when linking application with liboauth.
>
> Ok.
>
> > > For liboauth-dev, my patch specifies
> > > "Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ..."
> > > which should be enough to solve the issue you were raising here,
> > > right?
> > Yes, liboauth-dev's issue was solved. liboauth0 dependency is a little
> > strange, but I'm ok to closing the bug.
> > Thanks very much!
>
> Well, it's not solved yet, since the fixed package only existed in
> some temporary directory on my laptop :)
>
>
> Cheers,
> gregor
>
> --
>  .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
>  : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
>  `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
>    `-   "Rome wasn't burned in a day. "
>

--
HAMANO Tsukasa <hamano@cuspy.org>

[Message part 2 (application/pgp-signature, inline)]

Message #86 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: HAMANO Tsukasa <hamano@cuspy.org>, 639565@bugs.debian.org

Cc: Alessandro Ghedini <ghedo@debian.org>

Subject: Re: Bug#639565:

Date: Sun, 16 Sep 2012 16:17:36 +0200

[Message part 1 (text/plain, inline)]

On Sun, 19 Aug 2012 05:04:21 +0900, HAMANO Tsukasa wrote:

> I think, This is best solution.
> 
> Build-Depends: libcurl4-gnutls-dev
> (It can be a any real package.)

Or leave it as-is.
 
> liboauth-dev's Depends: liboauth0 (= ${binary:Version}), ${misc:Depends}, libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev
> 
> liboauth0's Depends: ${misc:Depends}, ${shlibs:Depends}, libcurl3 | libcurl3-gnutls | libcurl3-nss
> 
> As we know, This isn't enough due to ${shlibs:Depends} is include
> libcurl3-gnutls then remove another libcurl 'or' conditions.
> 
> Please apply the patch:
> 
> --- liboauth-0.9.4.orig/src/Makefile.am
> +++ liboauth-0.9.4/src/Makefile.am
> @@ -4,5 +4,5 @@ include_HEADERS = oauth.h
> 
>  liboauth_la_SOURCES=oauth.c config.h hash.c xmalloc.c xmalloc.h oauth_http.c
>  liboauth_la_LDFLAGS=@LIBOAUTH_LDFLAGS@ -version-info @VERSION_INFO@
> -liboauth_la_LIBADD=@HASH_LIBS@ @CURL_LIBS@
> +liboauth_la_LIBADD=@HASH_LIBS@
>  liboauth_la_CFLAGS=@LIBOAUTH_CFLAGS@ @HASH_CFLAGS@ @CURL_CFLAGS@
> 
> Actually, we do not need to link shared library to shared library.
> We'll get liboauth0 package that Depends: libcurl3 | libcurl3-gnutls | libcurl3-nss

This is not enough, we either need to re-run automake or apply the
same patch to src/Makefile.in.

When I extend the patch I indeed get the expected Depends for
liboauth0 [0]. But also:

dpkg-shlibdeps: warning: symbol curl_slist_free_all used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
dpkg-shlibdeps: warning: symbol curl_slist_append used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
dpkg-shlibdeps: warning: symbol curl_easy_cleanup used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
dpkg-shlibdeps: warning: symbol curl_easy_init used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
dpkg-shlibdeps: warning: symbol curl_easy_setopt used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
dpkg-shlibdeps: warning: symbol curl_easy_perform used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries

So not linking to any curl lib doesn't look right ...
 
Cheers,
gregor, attaching the "current" patch and cc'ing the curl maintainer

[0]
 Depends: libc6 (>= 2.4), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.0~1.9b1), libcurl3-gnutls | libcurl3-nss | libcurl3

-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Spider Murphy Gang: Ich Schau' Dich An (Peep Peep)

[639565.diff (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #91 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Alessandro Ghedini <ghedo@debian.org>

To: gregor herrmann <gregoa@debian.org>

Cc: HAMANO Tsukasa <hamano@cuspy.org>, 639565@bugs.debian.org

Subject: Re: Bug#639565:

Date: Sun, 16 Sep 2012 19:41:58 +0200

[Message part 1 (text/plain, inline)]

On Sun, Sep 16, 2012 at 04:17:36PM +0200, gregor herrmann wrote:
> When I extend the patch I indeed get the expected Depends for
> liboauth0 [0]. But also:
> 
> dpkg-shlibdeps: warning: symbol curl_slist_free_all used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> dpkg-shlibdeps: warning: symbol curl_slist_append used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> dpkg-shlibdeps: warning: symbol curl_easy_cleanup used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> dpkg-shlibdeps: warning: symbol curl_easy_init used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> dpkg-shlibdeps: warning: symbol curl_easy_setopt used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> dpkg-shlibdeps: warning: symbol curl_easy_perform used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> 
> So not linking to any curl lib doesn't look right ...

That could be done, as long as all the applications linking directly or
indirectly to liboauth link to a suitable libcurl too (i.e. leaving all the
libcurl symbols unresolved in liboauth). AFAICT this is currently not enforced
since e.g. oauth.pc only lists libcurl as Requires.private.

Directly depending on libcurl3* packages is of no use: either the application
links to a libcurl flavour, in which case it would already Depends on a suitable
libcurl3 package, or it doesn't and it wouldn't pick up the library even if
installed (unless forcibly loaded e.g. via LD_LOAD_LIBRARY, but that's not a
real solution).

Also note that libcurl3* libraries are not interchangeable, since they have
different SONAMEs and symbols versioning (i.e. once you link against one of
them at compile time, you have to use the same to resolve libcurl symbols at
load time).

Cheers

-- 
perl -E '$_=q;$/= @{[@_]};and s;\S+;<inidehG ordnasselA>;eg;say~~reverse'

[signature.asc (application/pgp-signature, inline)]

Message #96 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Alessandro Ghedini <ghedo@debian.org>

To: gregor herrmann <gregoa@debian.org>

Cc: HAMANO Tsukasa <hamano@cuspy.org>, 639565@bugs.debian.org

Subject: Re: Bug#639565:

Date: Sun, 16 Sep 2012 20:19:56 +0200

[Message part 1 (text/plain, inline)]

On Sun, Sep 16, 2012 at 07:41:57PM +0200, Alessandro Ghedini wrote:
> On Sun, Sep 16, 2012 at 04:17:36PM +0200, gregor herrmann wrote:
> > When I extend the patch I indeed get the expected Depends for
> > liboauth0 [0]. But also:
> > 
> > dpkg-shlibdeps: warning: symbol curl_slist_free_all used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> > dpkg-shlibdeps: warning: symbol curl_slist_append used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> > dpkg-shlibdeps: warning: symbol curl_easy_cleanup used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> > dpkg-shlibdeps: warning: symbol curl_easy_init used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> > dpkg-shlibdeps: warning: symbol curl_easy_setopt used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> > dpkg-shlibdeps: warning: symbol curl_easy_perform used by debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of the libraries
> > 
> > So not linking to any curl lib doesn't look right ...
> 
> That could be done, as long as all the applications linking directly or
> indirectly to liboauth link to a suitable libcurl too (i.e. leaving all the
> libcurl symbols unresolved in liboauth). AFAICT this is currently not enforced
> since e.g. oauth.pc only lists libcurl as Requires.private.
> 
> Directly depending on libcurl3* packages is of no use: either the application
> links to a libcurl flavour, in which case it would already Depends on a suitable
> libcurl3 package, or it doesn't and it wouldn't pick up the library even if
> installed (unless forcibly loaded e.g. via LD_LOAD_LIBRARY, but that's not a
> real solution).
> 
> Also note that libcurl3* libraries are not interchangeable, since they have
> different SONAMEs and symbols versioning (i.e. once you link against one of
> them at compile time, you have to use the same to resolve libcurl symbols at
> load time).

To wrap this up: having "Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, ..."
in liboauth-dev IMO is the simplest and most effective solution to the problem
exposed (libcurl4*-dev conflicts).

Cheers

-- 
perl -E '$_=q;$/= @{[@_]};and s;\S+;<inidehG ordnasselA>;eg;say~~reverse'

[signature.asc (application/pgp-signature, inline)]

Message #101 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: Alessandro Ghedini <ghedo@debian.org>, 639565@bugs.debian.org

Cc: HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Mon, 17 Sep 2012 17:30:44 +0200

[Message part 1 (text/plain, inline)]

On Sun, 16 Sep 2012 20:19:56 +0200, Alessandro Ghedini wrote:

Ciao Alessandro,

thanks alot for taking the time to shed some light here!

> > > So not linking to any curl lib doesn't look right ...
> > That could be done, as long as all the applications linking directly or
> > indirectly to liboauth link to a suitable libcurl too (i.e. leaving all the
> > libcurl symbols unresolved in liboauth). AFAICT this is currently not enforced
> > since e.g. oauth.pc only lists libcurl as Requires.private.

Ok.

> > Directly depending on libcurl3* packages is of no use: either the application
> > links to a libcurl flavour, in which case it would already Depends on a suitable
> > libcurl3 package, or it doesn't and it wouldn't pick up the library even if
> > installed 

Makes sense ... But liboauth does link (and therefore depend on) one
of the curl libs, unless forced to do otherwise.

> > Also note that libcurl3* libraries are not interchangeable, since they have
> > different SONAMEs and symbols versioning (i.e. once you link against one of
> > them at compile time, you have to use the same to resolve libcurl symbols at
> > load time).

Ack.
 
> To wrap this up: having "Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, ..."
> in liboauth-dev IMO is the simplest and most effective solution to the problem
> exposed (libcurl4*-dev conflicts).

If I'm understanding KURASHIKI Satoru and HAMANO Tsukasa correctly,
they are also not happy about the dependency of liboauth0 on one of
the curl libs. - Not sure about the background here.

What I've done now, since I'm more interested in #650138 actually :)

- Rebuild libouth whith only this change:

diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control   2011-11-05 12:41:07.000000000 +0100
+++ liboauth-0.9.4/debian/control   2012-09-17 17:00:50.000000000 +0200
@@ -16,7 +16,7 @@
 Package: liboauth-dev
 Section: libdevel
 Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}
 Description: C library for implementing OAuth 1.0 (development files)
  liboauth is a collection of C functions implementing the


This leads to:

liboauth-dev_0.9.4-3.1_amd64.deb
 Depends: liboauth0 (= 0.9.4-3.1), libcurl4-nss-dev | libcurl4-dev, libnss3-dev
liboauth0_0.9.4-3.1_amd64.deb
 Depends: libc6 (>= 2.4), libcurl3-nss (>= 7.23.1), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.0~1.9b1)

and

% ldd /usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 | grep curl
    libcurl-nss.so.4 => /usr/lib/x86_64-linux-gnu/libcurl-nss.so.4 (0x00007f9e8d2e8000)

- Install liboauth0. Result: bti still fails as in #650138.

- Rebuild bti (with libcurl4-gnutls-dev insted of libcurl4-nss-dev.

Results:

bti_032-2_amd64.deb
 Depends: libc6 (>= 2.3), libcurl3-gnutls (>= 7.16.2), liboauth0 (>= 0.9.1), libpcre3 (>= 8.10), libxml2 (>= 2.7.4)

% ldd /usr/bin/bti | grep curl
    libcurl-gnutls.so.4 => /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4 (0x00007f8a757df000)
    libcurl-nss.so.4 => /usr/lib/x86_64-linux-gnu/libcurl-nss.so.4 (0x00007f8a729ed000)

- Install rebuilt bti. Sill fails.


My "experiment" from late July still works:

Rebuilding liboauth with libcurl4-gnutls-dev instead of -nss- works
with the "old" bti (and also with a rebuilt one).


No sure what to make of this -- I'm confused :)


Cheers,
gregor


-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Cat Stevens: Sweet Jamaica

[signature.asc (application/pgp-signature, inline)]

Message #106 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Alessandro Ghedini <ghedo@debian.org>

To: gregor herrmann <gregoa@debian.org>

Cc: 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Mon, 17 Sep 2012 19:19:57 +0200

[Message part 1 (text/plain, inline)]

On Mon, Sep 17, 2012 at 05:30:44PM +0200, gregor herrmann wrote:
> On Sun, 16 Sep 2012 20:19:56 +0200, Alessandro Ghedini wrote:
> 
> Ciao Alessandro,
> 
> thanks alot for taking the time to shed some light here!

No problem

> > > Directly depending on libcurl3* packages is of no use: either the application
> > > links to a libcurl flavour, in which case it would already Depends on a suitable
> > > libcurl3 package, or it doesn't and it wouldn't pick up the library even if
> > > installed 
> 
> Makes sense ... But liboauth does link (and therefore depend on) one
> of the curl libs, unless forced to do otherwise.

My comment was about the "do not build-depends on libcurl4*-dev and manually
depend on a libcurl3*" solution exposed above, which wouldn't work.

> What I've done now, since I'm more interested in #650138 actually :)

I think I see the problem: the NSS libcurl flavour needs a proper NSS
certificate database (just like any other application using NSS, e.g. chromium
and firefox generate their own databases), otherwise the SSL/TLS support is
mostly broken (i.e. the certificate checks always fail, see #655628).

Now I'm not really into OAuth nor Twitter-like things, but I guess that Twitter
and Identi.ca provide an HTTPS end-point for their OAuth APIs... HTTPS requires
SSL/TLS certificate checking by default... I guess you see where this is going.

I think liboauth use of NSS does not involve certificate checking but libcurl's,
unless otherwise told, does. But they are independent.

From liboauth 0.9.4-3 changelog:

  * Sync from Ubuntu:
     [ Mathieu Trudel-Lapierre ]
       * debian/control: liboauth-dev really needs libcurl4-nss-dev, not
         libcurl4-gnutls-dev (nss is required in the .pc file)
         (closes: #646485, #639565)
   [ Sjoerd Simons ]
   * collab-main team update
   * debian/control: Swith build-depend to libcurl4-nss-dev from
     libcurl4-gnutls-dev. oauth itself uses nss for SSL

That probably explains why liboauth and in turn bti stopped working from that
version.

So, to recap, IMO liboauth and bti (well, I'm not really sure about bti... but
that doesn't hurt) should build-depend on libcurl4-gnutls-dev, which would fix
#650138, and liboauth-dev should depend on libcurl4-gnutls-dev | libcurl4-dev,
which would fix #639565 (as exposed in the submission email).

libcurl3* runtime independence is not possible unless leaving libcurl's symbols
unresolved (as explained a few emails ago). But I don't quite see why one would
want the independence in the first place. To quote Tsukasa Hamano: "The depends
is force developper to link with gnutls", I'm not quite sure what he meant, but
the developer (using liboauth) is not forced to link againt anything, liboauth
is, but it doesn't affect the developer using it. And when using a static liboauth
(i.e. what the Requires.private in oauth.pc and the liboauth-dev Depends are
for) one can choose any libcurl. If really needed, one can rebuild liboauth from
source, in which case "libcurl4-gnutls-dev | libcurl4-dev" in its build-depend
would help.

Cheers

-- 
perl -E '$_=q;$/= @{[@_]};and s;\S+;<inidehG ordnasselA>;eg;say~~reverse'

[signature.asc (application/pgp-signature, inline)]

Message #111 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: Alessandro Ghedini <ghedo@debian.org>

Cc: 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Mon, 17 Sep 2012 19:49:43 +0200

[Message part 1 (text/plain, inline)]

Control: severity 650138 serious
Control: retitle 650138 liboauth0: doesn't work with NSS libcurl flavour
Control: tag 650138 + patch
Control: tag 639565 + patch

On Mon, 17 Sep 2012 19:19:57 +0200, Alessandro Ghedini wrote:

> > thanks alot for taking the time to shed some light here!
> No problem

Thanks again :)
 
> > Makes sense ... But liboauth does link (and therefore depend on) one
> > of the curl libs, unless forced to do otherwise.
> My comment was about the "do not build-depends on libcurl4*-dev and manually
> depend on a libcurl3*" solution exposed above, which wouldn't work.

Right.
 
> > What I've done now, since I'm more interested in #650138 actually :)
> I think I see the problem: the NSS libcurl flavour needs a proper NSS
> certificate database (just like any other application using NSS, e.g. chromium
> and firefox generate their own databases), otherwise the SSL/TLS support is
> mostly broken (i.e. the certificate checks always fail, see #655628).

Ah!
 
> Now I'm not really into OAuth nor Twitter-like things, but I guess that Twitter
> and Identi.ca provide an HTTPS end-point for their OAuth APIs... HTTPS requires
> SSL/TLS certificate checking by default... I guess you see where this is going.

Yup, currently an strace shows something about a missing end-point
before the error message.
 
> I think liboauth use of NSS does not involve certificate checking but libcurl's,
> unless otherwise told, does. But they are independent.

Ack, that was also my interpretation, and fits with Tsukasa Hamano's
message (#34) in this (#639565) bug report log.
 
> From liboauth 0.9.4-3 changelog:
> 
>   * Sync from Ubuntu:
>      [ Mathieu Trudel-Lapierre ]
>        * debian/control: liboauth-dev really needs libcurl4-nss-dev, not
>          libcurl4-gnutls-dev (nss is required in the .pc file)
>          (closes: #646485, #639565)
>    [ Sjoerd Simons ]
>    * collab-main team update
>    * debian/control: Swith build-depend to libcurl4-nss-dev from
>      libcurl4-gnutls-dev. oauth itself uses nss for SSL
> 
> That probably explains why liboauth and in turn bti stopped working from that
> version.

So this should be libcurl4-*-dev (and not -nss-) for the HTTPS
communication, and libnss3-dev for the OAuth hash things, right? (And
the fix for #646485 would have been to just add libnss3-dev, and not
to switch the curl flavour.)
 
> So, to recap, IMO liboauth and bti (well, I'm not really sure about bti... but
> that doesn't hurt) should build-depend on libcurl4-gnutls-dev, which would fix
> #650138, and liboauth-dev should depend on libcurl4-gnutls-dev | libcurl4-dev,
> which would fix #639565 (as exposed in the submission email).

Perfect!

(And since bti works as-is with a rebuilt liboauth0, I guess I leave
the change in the build-dep for after-wheezy.)
 
> libcurl3* runtime independence is not possible unless leaving libcurl's symbols
> unresolved (as explained a few emails ago). But I don't quite see why one would
> want the independence in the first place. To quote Tsukasa Hamano: "The depends
> is force developper to link with gnutls", I'm not quite sure what he meant, but
> the developer (using liboauth) is not forced to link againt anything, liboauth
> is, but it doesn't affect the developer using it. And when using a static liboauth
> (i.e. what the Requires.private in oauth.pc and the liboauth-dev Depends are
> for) one can choose any libcurl. If really needed, one can rebuild liboauth from
> source, in which case "libcurl4-gnutls-dev | libcurl4-dev" in its build-depend
> would help.

Makes sense, and fits my experiments :)


So this should fix both bugs:

#v+
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control   2011-11-05 12:41:07.000000000 +0100
+++ liboauth-0.9.4/debian/control   2012-09-17 19:31:21.000000000 +0200
@@ -2,7 +2,7 @@
 Priority: optional
 Maintainer: Bilal Akhtar <bilalakhtar@ubuntu.com>
 Build-Depends: debhelper (>= 8.1.3),
-               libcurl4-nss-dev,
+               libcurl4-gnutls-dev | libcurl4-dev,
                libnss3-dev,
                libtool,
                locales-all | language-pack-en,
@@ -16,7 +16,7 @@
 Package: liboauth-dev
 Section: libdevel
 Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}
 Description: C library for implementing OAuth 1.0 (development files)
  liboauth is a collection of C functions implementing the
  OAuth Core 1.0 standard API. liboauth provides basic functions to escape
#v-


Thanks again,
gregor

 
-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Dire Straits: Single Handed Sailor

[signature.asc (application/pgp-signature, inline)]

Message #118 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Alessandro Ghedini <ghedo@debian.org>

To: gregor herrmann <gregoa@debian.org>

Cc: 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Mon, 17 Sep 2012 22:27:24 +0200

[Message part 1 (text/plain, inline)]

On Mon, Sep 17, 2012 at 07:49:43PM +0200, gregor herrmann wrote:
> > From liboauth 0.9.4-3 changelog:
> > 
> >   * Sync from Ubuntu:
> >      [ Mathieu Trudel-Lapierre ]
> >        * debian/control: liboauth-dev really needs libcurl4-nss-dev, not
> >          libcurl4-gnutls-dev (nss is required in the .pc file)
> >          (closes: #646485, #639565)
> >    [ Sjoerd Simons ]
> >    * collab-main team update
> >    * debian/control: Swith build-depend to libcurl4-nss-dev from
> >      libcurl4-gnutls-dev. oauth itself uses nss for SSL
> > 
> > That probably explains why liboauth and in turn bti stopped working from that
> > version.
> 
> So this should be libcurl4-*-dev (and not -nss-) for the HTTPS
> communication, and libnss3-dev for the OAuth hash things, right? (And
> the fix for #646485 would have been to just add libnss3-dev, and not
> to switch the curl flavour.)

Yep. Note that -openssl- is not really a good choice either because of the
possible OpenSSL licensing issues, which makes -gnutls- pretty much the only
choice.

Cheers

-- 
perl -E '$_=q;$/= @{[@_]};and s;\S+;<inidehG ordnasselA>;eg;say~~reverse'

[signature.asc (application/pgp-signature, inline)]

Message #123 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: Alessandro Ghedini <ghedo@debian.org>

Cc: 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Mon, 17 Sep 2012 23:22:31 +0200

[Message part 1 (text/plain, inline)]

On Mon, 17 Sep 2012 22:27:24 +0200, Alessandro Ghedini wrote:

> > So this should be libcurl4-*-dev (and not -nss-) for the HTTPS
> > communication, and libnss3-dev for the OAuth hash things, right? (And
> > the fix for #646485 would have been to just add libnss3-dev, and not
> > to switch the curl flavour.)
> Yep. Note that -openssl- is not really a good choice either because of the
> possible OpenSSL licensing issues, which makes -gnutls- pretty much the only
> choice.

Right, that's why I've choosen, as you proposed, "libcurl4-gnutls-dev
| libcurl4-dev", i.e. the only sane default and the option for users
to do something else :)

Cheers,
gregor
 
-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Hans Theessink/Peter Ratzenbeck: If I Only Knew Her

[signature.asc (application/pgp-signature, inline)]

Message #128 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: Alessandro Ghedini <ghedo@debian.org>

Cc: 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>, KURASHIKI Satoru <lurdan@gmail.com>

Subject: Re: Bug#639565:

Date: Tue, 18 Sep 2012 17:43:59 +0200

[Message part 1 (text/plain, inline)]

On Mon, 17 Sep 2012 19:49:43 +0200, gregor herrmann wrote:

> > So, to recap, IMO liboauth and bti (well, I'm not really sure about bti... but
> > that doesn't hurt) should build-depend on libcurl4-gnutls-dev, which would fix
> > #650138, and liboauth-dev should depend on libcurl4-gnutls-dev | libcurl4-dev,
> > which would fix #639565 (as exposed in the submission email).
> 
> Perfect!
> 
> (And since bti works as-is with a rebuilt liboauth0, I guess I leave
> the change in the build-dep for after-wheezy.)
>  
> > libcurl3* runtime independence is not possible unless leaving libcurl's symbols
> > unresolved (as explained a few emails ago). But I don't quite see why one would
> > want the independence in the first place. To quote Tsukasa Hamano: "The depends
> > is force developper to link with gnutls", I'm not quite sure what he meant, but
> > the developer (using liboauth) is not forced to link againt anything, liboauth
> > is, but it doesn't affect the developer using it. And when using a static liboauth
> > (i.e. what the Requires.private in oauth.pc and the liboauth-dev Depends are
> > for) one can choose any libcurl. If really needed, one can rebuild liboauth from
> > source, in which case "libcurl4-gnutls-dev | libcurl4-dev" in its build-depend
> > would help.
> 
> Makes sense, and fits my experiments :)
> 
> 
> So this should fix both bugs:
> 
> #v+
> diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
> --- liboauth-0.9.4/debian/control   2011-11-05 12:41:07.000000000 +0100
> +++ liboauth-0.9.4/debian/control   2012-09-17 19:31:21.000000000 +0200
> @@ -2,7 +2,7 @@
>  Priority: optional
>  Maintainer: Bilal Akhtar <bilalakhtar@ubuntu.com>
>  Build-Depends: debhelper (>= 8.1.3),
> -               libcurl4-nss-dev,
> +               libcurl4-gnutls-dev | libcurl4-dev,
>                 libnss3-dev,
>                 libtool,
>                 locales-all | language-pack-en,
> @@ -16,7 +16,7 @@
>  Package: liboauth-dev
>  Section: libdevel
>  Architecture: any
> -Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
> +Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}
>  Description: C library for implementing OAuth 1.0 (development files)
>   liboauth is a collection of C functions implementing the
>   OAuth Core 1.0 standard API. liboauth provides basic functions to escape
> #v-

And then we have some reverse (build) deps:

% reverse-depends liboauth0
Reverse-Depends
===============
* bti
* evolution-data-server
* gnome-documents
* goldencheetah [amd64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips mipsel powerpc s390x sparc]
* libgdata13
* liboauth-dev

% reverse-depends -b liboauth-dev
Reverse-Build-Depends
=====================
* bti
* evolution-data-server
* gnome-documents
* goldencheetah
* libgdata

Luckily goldencheetah is the only one with a build and runtime
dependency on both libaouth* and libcurl*, so the others should be
unaffected.

goldencheetah has:

Build-Depends: .. liboauth-dev, libcurl4-nss-dev ..
Depends: .. libcurl3-nss (>= 7.23.1), liboauth0 (>= 0.9.1)

(So the same as bti, and the maintainer is the original reporter for
#639565 :))

Cc'ing KURASHIKI Satoru <lurdan@gmail.com> to check if the change in
liboauth might affect goldencheetah.

Cheers,
gregor
 
-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Trenquillo feat. Raiz DJ: Fuerza

[signature.asc (application/pgp-signature, inline)]

Message #133 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Satoru KURASHIKI <lurdan@gmail.com>

To: gregor herrmann <gregoa@debian.org>

Cc: Alessandro Ghedini <ghedo@debian.org>, 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Thu, 20 Sep 2012 00:17:53 +0900

hi,

On Wed, Sep 19, 2012 at 12:43 AM, gregor herrmann <gregoa@debian.org> wrote:
>> So this should fix both bugs:
>>
>> #v+
>> diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
>> --- liboauth-0.9.4/debian/control   2011-11-05 12:41:07.000000000 +0100
>> +++ liboauth-0.9.4/debian/control   2012-09-17 19:31:21.000000000 +0200
>> @@ -2,7 +2,7 @@
>>  Priority: optional
>>  Maintainer: Bilal Akhtar <bilalakhtar@ubuntu.com>
>>  Build-Depends: debhelper (>= 8.1.3),
>> -               libcurl4-nss-dev,
>> +               libcurl4-gnutls-dev | libcurl4-dev,
>>                 libnss3-dev,
>>                 libtool,
>>                 locales-all | language-pack-en,
>> @@ -16,7 +16,7 @@
>>  Package: liboauth-dev
>>  Section: libdevel
>>  Architecture: any
>> -Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
>> +Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}
>>  Description: C library for implementing OAuth 1.0 (development files)
>>   liboauth is a collection of C functions implementing the
>>   OAuth Core 1.0 standard API. liboauth provides basic functions to escape
>> #v-

Acked, I will check whether changes above affects gondencheetah('s
twitter submit feature).
Please wait for a few days.

> goldencheetah has:
>
> Build-Depends: .. liboauth-dev, libcurl4-nss-dev ..
> Depends: .. libcurl3-nss (>= 7.23.1), liboauth0 (>= 0.9.1)
>
> (So the same as bti, and the maintainer is the original reporter for
> #639565 :))
>
> Cc'ing KURASHIKI Satoru <lurdan@gmail.com> to check if the change in
> liboauth might affect goldencheetah.

regards,
-- 
KURASHIKI Satoru

Message #138 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: Satoru KURASHIKI <lurdan@gmail.com>

Cc: Alessandro Ghedini <ghedo@debian.org>, 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Wed, 19 Sep 2012 17:25:35 +0200

[Message part 1 (text/plain, inline)]

On Thu, 20 Sep 2012 00:17:53 +0900, Satoru KURASHIKI wrote:

> >> #v+
> >> diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
> >> --- liboauth-0.9.4/debian/control   2011-11-05 12:41:07.000000000 +0100
> >> +++ liboauth-0.9.4/debian/control   2012-09-17 19:31:21.000000000 +0200
> >> @@ -2,7 +2,7 @@
> >>  Priority: optional
> >>  Maintainer: Bilal Akhtar <bilalakhtar@ubuntu.com>
> >>  Build-Depends: debhelper (>= 8.1.3),
> >> -               libcurl4-nss-dev,
> >> +               libcurl4-gnutls-dev | libcurl4-dev,
> >>                 libnss3-dev,
> >>                 libtool,
> >>                 locales-all | language-pack-en,
> >> @@ -16,7 +16,7 @@
> >>  Package: liboauth-dev
> >>  Section: libdevel
> >>  Architecture: any
> >> -Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
> >> +Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}
> >>  Description: C library for implementing OAuth 1.0 (development files)
> >>   liboauth is a collection of C functions implementing the
> >>   OAuth Core 1.0 standard API. liboauth provides basic functions to escape
> >> #v-
> 
> Acked, I will check whether changes above affects gondencheetah('s
> twitter submit feature).
> Please wait for a few days.

Sure, thanks in advance!
 
Cheers,
gregor
 
-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Bob Dylan: I Shall Be Free

[signature.asc (application/pgp-signature, inline)]

Message #143 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Satoru KURASHIKI <lurdan@gmail.com>

To: gregor herrmann <gregoa@debian.org>

Cc: Alessandro Ghedini <ghedo@debian.org>, 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Thu, 20 Sep 2012 08:58:17 +0900

hi,

On Thu, Sep 20, 2012 at 12:25 AM, gregor herrmann <gregoa@debian.org> wrote:
>> Acked, I will check whether changes above affects gondencheetah('s
>> twitter submit feature).

I've tried to build liboauth and goldencheetah locally with that changes.
Its twitter posting works fine, so new liboauth might not affect.

regards,
-- 
KURASHIKI Satoru

Message #148 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: Satoru KURASHIKI <lurdan@gmail.com>

Cc: Alessandro Ghedini <ghedo@debian.org>, 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Thu, 20 Sep 2012 20:35:57 +0200

[Message part 1 (text/plain, inline)]

On Thu, 20 Sep 2012 08:58:17 +0900, Satoru KURASHIKI wrote:

> >> Acked, I will check whether changes above affects gondencheetah('s
> >> twitter submit feature).
> I've tried to build liboauth and goldencheetah locally with that changes.
> Its twitter posting works fine, so new liboauth might not affect.

Thanks a lot!

Just to be sure: you have rebuilt both liboauth and goldencheetah,
right?
Does goldencheetah still work if only liboauth is rebuilt and
goldencheetah is unchanged (i.e. the version in the archive now)?

Cheers,
gregor
 
-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Ludwig Hirsch: Der Wolf

[signature.asc (application/pgp-signature, inline)]

Message #153 received at 639565@bugs.debian.org (full text, mbox, reply):

From: Satoru KURASHIKI <lurdan@gmail.com>

To: gregor herrmann <gregoa@debian.org>

Cc: Alessandro Ghedini <ghedo@debian.org>, 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Fri, 21 Sep 2012 20:28:03 +0900

hi,

On Fri, Sep 21, 2012 at 3:35 AM, gregor herrmann <gregoa@debian.org> wrote:
> Just to be sure: you have rebuilt both liboauth and goldencheetah,
> right?

Yes, that was right.

> Does goldencheetah still work if only liboauth is rebuilt and
> goldencheetah is unchanged (i.e. the version in the archive now)?

So, I've tested this also, and it works fine :-)

 - goldencheetah can build if liboauth gets update
 - goldencheetah can run with updated liboauth, without rebuilding for it

regards,
-- 
KURASHIKI Satoru

Message #158 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: 639565@bugs.debian.org, 650138@bugs.debian.org

Subject: liboauth: diff for NMU version 0.9.4-3.1

Date: Fri, 21 Sep 2012 14:27:54 +0200

[Message part 1 (text/plain, inline)]

tags 639565 + pending
tags 650138 + pending
thanks

Dear maintainer,

I've prepared an NMU for liboauth (versioned as 0.9.4-3.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.

Regards.

-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Sophie Hunger: Breaking the Waves

[liboauth-0.9.4-3.1-nmu.diff (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #163 received at 639565@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: Satoru KURASHIKI <lurdan@gmail.com>

Cc: Alessandro Ghedini <ghedo@debian.org>, 639565@bugs.debian.org, 650138@bugs.debian.org, HAMANO Tsukasa <hamano@cuspy.org>

Subject: Re: Bug#639565:

Date: Fri, 21 Sep 2012 14:28:14 +0200

[Message part 1 (text/plain, inline)]

On Fri, 21 Sep 2012 20:28:03 +0900, Satoru KURASHIKI wrote:

> > Does goldencheetah still work if only liboauth is rebuilt and
> > goldencheetah is unchanged (i.e. the version in the archive now)?
> So, I've tested this also, and it works fine :-)
>  - goldencheetah can build if liboauth gets update
>  - goldencheetah can run with updated liboauth, without rebuilding for it

Thank you very much for these tests!

I've now uploaded liboauth to DELAYED/2 with this changes.


Cheers,
gregor
 
-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Supertramp: And The Light

[signature.asc (application/pgp-signature, inline)]

Message #170 received at 639565-close@bugs.debian.org (full text, mbox, reply):

From: gregor herrmann <gregoa@debian.org>

To: 639565-close@bugs.debian.org

Subject: Bug#639565: fixed in liboauth 0.9.4-3.1

Date: Sun, 23 Sep 2012 12:47:53 +0000

Source: liboauth
Source-Version: 0.9.4-3.1

We believe that the bug you reported is fixed in the latest version of
liboauth, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 639565@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated liboauth package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 21 Sep 2012 14:19:45 +0200
Source: liboauth
Binary: liboauth-dev liboauth0
Architecture: source amd64
Version: 0.9.4-3.1
Distribution: unstable
Urgency: low
Maintainer: Bilal Akhtar <bilalakhtar@ubuntu.com>
Changed-By: gregor herrmann <gregoa@debian.org>
Description: 
 liboauth-dev - C library for implementing OAuth 1.0 (development files)
 liboauth0  - C library for implementing OAuth 1.0
Closes: 639565 650138
Changes: 
 liboauth (0.9.4-3.1) unstable; urgency=low
 .
   * Non-maintainer upload.
   * Fix "please make loose libcurl dependency":
     change liboauth-dev's Depends to "libcurl4-gnutls-dev | libcurl4-dev,
     libnss3-dev" (instead of "libcurl4-nss-dev")
     (Closes: #639565)
   * Fix "liboauth0: doesn't work with NSS libcurl flavour":
     build-depend on "libcurl4-gnutls-dev | libcurl4-dev" (instead of
     "libcurl4-nss-dev")
     (Closes: #650138)
   * Thanks to HAMANO Tsukasa and Alessandro Ghedini for accompanying me
     through this maze, and to Satoru KURASHIKI for additional tests.
Checksums-Sha1: 
 74b3c36b939deed2a581a857866a928e8ecb7292 1992 liboauth_0.9.4-3.1.dsc
 cc216078b3e14c8e21c96d8c0c53fe80e15451a1 4148 liboauth_0.9.4-3.1.debian.tar.gz
 8738f7a6559ebdbb6075860573e779ade7217060 37248 liboauth-dev_0.9.4-3.1_amd64.deb
 2185e492e75ea196f193387262c86abbb6396d5b 20288 liboauth0_0.9.4-3.1_amd64.deb
Checksums-Sha256: 
 d13cfb9e02a8d7edcd24109d3ce6359ecfd059dad9fe66a608fe5c08a4a28bf6 1992 liboauth_0.9.4-3.1.dsc
 11bacca489f6f2702da093b2d58e1ac86ccbc1a42e3ab2d52fa536283bec7d55 4148 liboauth_0.9.4-3.1.debian.tar.gz
 e38d0360582a86f6756a0eb6a0d482aea1ff6e7ea587e5204f3078097e0e5421 37248 liboauth-dev_0.9.4-3.1_amd64.deb
 8bccdaede2d399d1572df8f971a0f96148ac46ef2daeaa75b3dbd4686c4bd318 20288 liboauth0_0.9.4-3.1_amd64.deb
Files: 
 eb538dba3bcd9b23f4796daa46731049 1992 libs optional liboauth_0.9.4-3.1.dsc
 9b3eeebc0eaf3b9b97ec5904d56f8f22 4148 libs optional liboauth_0.9.4-3.1.debian.tar.gz
 6f2ef061b1d8ff17dca3421b2b582f40 37248 libdevel optional liboauth-dev_0.9.4-3.1_amd64.deb
 1560780190558b24cb59187a2ca83fde 20288 libs optional liboauth0_0.9.4-3.1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCAAGBQJQXFzJAAoJELs6aAGGSaoGpjIQALpQLF12rZN8l7L1q9jqhxTj
c01ECdk5Pk0tI8MvUnBuMCrm2BTnzSe8ZMjz8/cfkBMDWVdxX+c3NdLXF2v7zudS
SLjaHjmUHz7GVIcNuvyLflc7FXJm29Tb5yIOlerSfHU2U7G07rMHW3WusuyGgATw
i58AoKO/EVz2mWOmQqElhPSIubSOGE+p42FIRDWMp+nG9sXIO5k2uOzXferLDBo9
gzp+9R/g4AP5r4LuYYVzHxdM+112s+6qo4VvR5iEE1+/ZjfzHH8kjG+tadH2hXLq
CnOHmhZaW0w7sQz74LSp2pzW4qvHWSSQBdW/WxJv+i7znmm5Kv76dGwYLMHFctdL
Npi9ULh5hsM4ZKgbyVZ9vSLh+01xxPWGXfB9rWEHv2sJ5L1ngo1fIkKTf0hBrdp2
h4+lnp2Q+zltRcVoUbMT5Bp4PMiqJ/yjDq7em4QkHf8NehlizIRVd679ir8uAFPw
A6lQ2vFNCCsyaqKBDiibDJtzOdfSM63eYYOc6hNdjHY2HxMZrorILUV2kKNXsILF
FnkD6wp4QNqchzKsxKIOQ/aSiKQNjIRZv/uJJFD5Ke9pE0BkGNC9kY0Z/hrcVMV9
m0rcLdk+yzhb1Sb7N+HpMHtRe1ddxG7erMMrQ9h/b9hR94RsVcS96tBrWMptYjgV
h7uFEzfhRNxPWKZslJmy
=iU5C
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.