From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: bug#27120: GraphicsMagick bundles libtiff, libpng, zlib, libxml2, and more Date: Sun, 28 May 2017 16:23:21 -0400 Message-ID: <20170528202321.GA31713@jasmine> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="3MwIy2ne0vdjdPXF" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:52143) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dF4jN-0006KB-8B for bug-guix@gnu.org; Sun, 28 May 2017 16:24:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dF4jK-0004OO-3o for bug-guix@gnu.org; Sun, 28 May 2017 16:24:05 -0400 Received: from debbugs.gnu.org ([208.118.235.43]:39417) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dF4jJ-0004OK-W1 for bug-guix@gnu.org; Sun, 28 May 2017 16:24:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1dF4jJ-0000y0-Qq for bug-guix@gnu.org; Sun, 28 May 2017 16:24:01 -0400 Sender: "Debbugs-submit" Resent-Message-ID: Received: from eggs.gnu.org ([2001:4830:134:3::10]:52099) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dF4io-0006JW-Ts for bug-guix@gnu.org; Sun, 28 May 2017 16:23:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dF4il-0004Jl-PE for bug-guix@gnu.org; Sun, 28 May 2017 16:23:30 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:36963) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dF4il-0004Jb-Dd for bug-guix@gnu.org; Sun, 28 May 2017 16:23:27 -0400 Received: from localhost (unknown [172.56.29.144]) by mail.messagingengine.com (Postfix) with ESMTPA id 784E27E545 for ; Sun, 28 May 2017 16:23:26 -0400 (EDT) Content-Disposition: inline List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: 27120@debbugs.gnu.org --3MwIy2ne0vdjdPXF Content-Type: text/plain; charset=us-ascii Content-Disposition: inline GraphicsMagick bundles a large number of 3rd party libraries. We should unbundle and remove the ones that we can. For the rest, we should try patching their vulnerabilities and leaving code comments explaining the situation in the GraphicsMagick package definition. --3MwIy2ne0vdjdPXF Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlkrMbkACgkQJkb6MLrK fwjPjg/9EVn6c6RiS4sWLyE3KEOKZSZx+wlxg6jCshUS7rTUBohjUHFCT3iBgR7F 8a63kYSuciolhdGgoCat7eCo0nOhQUtxO0MwohmrnrRzzswAheIvEN40DRQm+Glo k4KXizuK7S7W8yeOwk/LuupsMdoWwA4BlZbbUwM0tSTEK9nwQ4guiFyiRbZLYrvo h/KBOBQ6/10ZBJCuhm5fmgThVr1ISyLggbrqUPsxsGUxDYdaWuCA5tJBOlTXU+mj 8KUn3JjfoV7LLqKGv9ZXpDievaO+uR+8lyHfdB5PYCXdBlWBCnAYOy2qPaaa9vak fP7N887OfQGoi0mJrCNt4KZ6n3eoC+r2Dlyq9IS9ANu89C8bdDfpqUmV1U9wlwD2 5/ZrPQlTS+uCa28mOnqEBV4D4WpTwkwkayNNsnzgJw/Og+ZYb/bOGl7h3qLB0ybX LgJNchQh56Soivmhu8a1DAJhVTojP2ZcMt+dh54dFkVnuCGjKiTVEm64Qb1Pc9al 6ZkJMQ0Zp/7jA5aBRbUgOs1Zcj78IFhlqyI9QROz3a7RNAQdFcJNyZpla/mUmyIp pYKfWSjlawwFbFf4qcAuh6t5B81OG4KLyRXNt3ph4JovZGWWqF9SXpSrVX3jRfWP UbHKjIwUxM/YZibtPDR2GiR9jUW7rhd2kMtTg4LXSfjVvJYxuto= =bSIk -----END PGP SIGNATURE----- --3MwIy2ne0vdjdPXF--