| 1 |
On Tue, 2011-10-11 at 23:10 -0700, Zac Medico wrote: |
| 2 |
> On 10/11/2011 10:59 PM, Graham Murray wrote: |
| 3 |
> > Zac Medico <zmedico@g.o> writes: |
| 4 |
> > |
| 5 |
> >> On 10/11/2011 10:28 PM, Mike Gilbert wrote: |
| 6 |
> >>> Francisco raised a possibly valid point in his original message: though |
| 7 |
> >>> packages may not be currently used for anything, but they could contain |
| 8 |
> >>> un-patched security flaws. |
| 9 |
> >> |
| 10 |
> >> If they contain something that's accessed at runtime, then they should |
| 11 |
> >> be in RDEPEND or PDEPEND, no exceptions. |
| 12 |
> > |
| 13 |
> > But is it not possible that the flaw in the build-time dependency causes |
| 14 |
> > an insecurity to be built into the dependent package and that both have |
| 15 |
> > to be rebuilt as part of the security fix? |
| 16 |
> |
| 17 |
> For statically linked libraries, yes. However, --with-bdeps=y alone |
| 18 |
> won't help you with that. You'll also have to enable |
| 19 |
> --rebuild-if-new-rev=y in order to automatically rebuild the reverse |
| 20 |
> dependencies of the statically-linked library. |
| 21 |
|
| 22 |
And also for source code generators such as flex, bison, autoconf, |
| 23 |
cmake, et cætera |
| 24 |
|
| 25 |
-- |
| 26 |
Stelian Ionescu a.k.a. fe[nl]ix |
| 27 |
Quidquid latine dictum sit, altum videtur |
| 28 |
http://common-lisp.net/project/iolib/ |
Archives