From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Help needed with security updates for Qt Date: Tue, 16 Jun 2015 10:20:48 -0400 Message-ID: <87mvzzg2f3.fsf@netris.org> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55640) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z4rjb-0006gm-9J for guix-devel@gnu.org; Tue, 16 Jun 2015 10:21:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z4rjY-0002fG-Fw for guix-devel@gnu.org; Tue, 16 Jun 2015 10:21:03 -0400 Received: from world.peace.net ([50.252.239.5]:33209) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z4rjY-0002ek-Ao for guix-devel@gnu.org; Tue, 16 Jun 2015 10:21:00 -0400 List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Andreas Enge Cc: guix-devel@gnu.org Hi, Qt includes bundled copies of a *lot* of stuff. Among other things, it bundles Chromium, which also bundles a lot of stuff. Someone who cares about Qt needs to be on top of security updates for the things it bundles. Better yet, we should try to get it to use our system copies of libraries whenever possible. I'm aware of security updates for Chromium since the versions of Qt in Guix were released. There are probably many others as well. If we make a separate Chromium package, then beware that there will probably be FSDG issues that need to be addressed, e.g. offering to install non-free software like flash, video codecs or plugins. It may be that we need to address these issues even if we don't make a separate Chromium package, depending on how Qt uses it. There's also stuff like this: "chromium: unconditionally downloads binary blob" https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 It's a big hairy mess, and to be honest I don't want to touch Qt with a ten foot pole. Someone who cares about Qt needs to get on top of this. Any takers? Mark