Re: Staying on top of Qt security

[Efraim Flashner <efraim@flashner.co.il>]

[-- Attachment #1: Type: text/plain, Size: 2339 bytes --]

On Thu, 18 Feb 2016 17:35:29 -0500
Leo Famulari <leo@famulari.name> wrote:

> On Thu, Feb 18, 2016 at 09:43:49PM +0100, Andreas Enge wrote:
>  [...]  
>  [...]  
>  [...]  
> > > $ guix refresh -l qt-4                        
> > > Building the following 18 packages would ensure 24 dependent packages
> > > are rebuilt: soprano-2.9.4 python2-pyqt-4.11.4 polkit-qt-1-0.112.0
> > > frescobaldi-2.18.1 keepassx-2.0.2 hydrogen-0.9.5.1 strigi-0.7.8
> > > attica-0.4.2 pumpa-0.9.2 libdbusmenu-qt-0.9.2 phonon-4.8.3
> > > brdf-explorer-17 gpsbabel-1.5.0 librecad-2.0.6-rc
> > > alsa-modular-synth-2.1.2 qtractor-0.7.3 ardour-4.4 jalv-1.4.6  
> > 
> > Some of them have no dependent packages, and I think they are mainly or
> > exclusively used for KDE-4, which I started packaging a while ago (and
> > dropped again when I got my Novena, as it turns out that KDE is too
> > resource demanding). In any case, we would package KDE-5 now, and I would
> > suggest to simply remove these packages. There are traces in git, so if
> > it turns out we will need them in the end, we can still revive them.
> > This concerns:
> > attica soprano strigi polkit-qt automoc4 qjson libdbusmenu-qt
> > So while we are it it, I suggest to simply remove kde.scm (there is no use
> > in keeping a lonely oxygen-icons around...).
> > 
> > Also, python2-pyqt has no dependent package.
> > 
> > I looked at frescobaldi; they claim that a Qt-5 port is on the TODO list
> > for their version 3, but without giving any timings.
> > 
> > If there is no outcry, I will remove the above-mentioned packages/modules.
> > 
> > Could maybe people using the other packages have a look at them?  
> 
> I noticed that Efraim has upgraded a few qt-4 dependencies so that they
> can use qt(-5).
> 

A bunch of the programs that use qt-4 currently use the cmake-build-system,
and it seems that cmake or something else reads Qt > 4.2 and won't accept
qt-5 as an input. Currently CMake is at 3.3.2, I was going to update it to
3.4.3 but 3.5.0 is almost out. It could be that this is what allows those
programs to be switched.


-- 
Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]