Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/08/11 22:45, Matt Turner wrote:
> On Sat, Oct 8, 2011 at 10:20 AM, Markos Chandras
> <hwoarang@g.o> wrote:
>> On 10/08/2011 02:19 PM, Matt Turner wrote:
>>> On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen
>>> <ssuominen@g.o> wrote:
>>>> # Samuli Suominen <ssuominen@g.o> (08 Oct 2011) #
>>>> Fails to compile against system libpng15, bug 356127 #
>>>> Removal in 14 days
>>>
>>> 14 days?
>>>
>>>> media-gfx/pngcrush
>>>
>> We can't really wait forever for slacking maintainers to fix
>> their packages. amd64 is almost ready to have libpng-1.5 stable
>> in the very near future
>
> Two things:
>
> 1) I'm *really* tired of the usage of the word "slacking" on this
> mailing list. If you or someone else wants to pay me to work on
> Gentoo, *then* you can tell me that I'm slacking. Otherwise, I'm a
> volunteer working on things that interest me in my free time. I
> truly do have more important things to do than to figure out how to
> port pngcrush to libpng1.5. Namely, graduate school and midterm
> exams.

The bug is open since February (9 months). If you can't handle a bug
in 9 months then maybe you should consider stepping down as a
maintainer. Handling does not necessarily mean fixing. Masking could
be an acceptable solution as well. The fact that nobody pays us does
not mean that we can use that as an excuse for lower the QA barrier of
portage tree. If only I got a $1 everytime I hear this "excuse"...

>
> 2) What exactly is it that you want me to do here? Upstream is
> aware of the problem, and seems to be working on it as there are
> comments about libpng15 in pngcrush.c. Hanno kindly stepped in and
> made pngcrush use a bundled libpng14 (and at the same time bundled
> zlib, which has now been fixed), which you promptly masked. I'm not
> sure if the problem is bundled libs in general or specifically
> zlib, but we *know* it's distasteful. It's not like that's a
> preferred or permanent solution. Do you find that somehow more
> distasteful than removing a piece of software from from portage
> that's been in the tree since 2002?
>

First of all, pay some attention and ready the masking message. It
says "Waiting for upstream to fix it". It says nothing about removal.
Hanno did two commits
1) use bundled zlib and libpng14. Doh this is not a fix. It is barely
a workaround. What if a vulnerability is discovered in the bundled
version of libpng in the next months? Will upstream fix it? Highly
unlikely since they don't seem able to keep up with libpng releases.

2) Next commit, unbundle zlib, use bundled libpng. Say problem as before.

So until you or upstream or someone else comes up with a proper fix
this will remain masked. If you still disagree feel free to talk to QA.

Finally, yes I know that we have plenty of bundled libs around but
this is not an excuse. Sometimes we cannot avoid that but in this case
it makes perfect sense to mask it and proceed with libpng15
stabilization or whatever. Moreover pngcrush has no rdeps so no other
packages affect by this change. We have the same problem with optipng
but we can't mask it because there are reverse dependencies that will
be affected.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOkPu7AAoJEPqDWhW0r/LC5OoP/iqw4tdzp/0blCmvKWqLXt9R
DD1EwrBp0o/cvG7RtwMkezW+IDWkBhmQLwXLxSh2pYtSgBzKs6F9FmyI3xkRO6Ba
1dKunJQaqvWDOrfXjvtZZ8FewovFbefxvekZeOh+6FSXXra3JG2sV0aM5JXuM5Xs
fN5DiGNXwzQV8p3XnG2mNldGzwN+Q3w3uWHkAW/ogxC3R7hluieL7P+UVYF2arCJ
v5JXFBoGmHrTvDh4jG10/vunCV0bhK+diXTLA+L4W3nqdcohvNeaulnSXc+v5Q0W
NS1KPTMtWqbuucWU87z189PH2otCrRBC+YTt7Vr/h8lSMfTWQxYQP2bOIUceh8Ru
SG12y6kfU+NPNZxIH5AeO+yeLapQyVDOQBXqbAW2R4+u3H9XNbFxi9aoKhthLBF5
akXcAO/SVji5reDtoMcvsBCgQeqO3eYjagyr8OfLA8Cfh0SqVRbZ9fx79RKSY0fz
uROKXqcEqcD2o4egc0VXDYGtlPm1xZaTwZzLRG3ZKX5DB+p/Smi/fw4SaK9OY+Si
3my9tTT/3jilhQupDytcRbkDV77yleyRy/1eQCxsm/nOoGLTsvXf7bjLS+sscdDU
HUX9+uD2SQFnUxSPyK0axk4FkXXqPteTGKoSNSG5udIBkUg++K8dKHX0pd8Frq6W
wkkFI+lm4pPABkES2Px+
=5dMm
-----END PGP SIGNATURE-----