Re: Staying on top of Qt security

[Christopher Allan Webber <cwebber@dustycloud.org>]

Leo Famulari writes:

> On Sat, Feb 20, 2016 at 10:27:52AM -0800, Christopher Allan Webber wrote:
>> Andreas Enge writes:
>> 
>> > On Thu, Feb 18, 2016 at 02:53:40PM -0800, Christopher Allan Webber wrote:
>> >> I'm assuming this was directed at me (though I don't work on Pumpa, but
>> >> I could ask the author things... I do *use* it every day though).  What
>> >> am I being asked here... I'm not sure?  Whether Pumpa could be updated
>> >> to QT 5?
>> >
>> > I think so :-)
>> >
>> > The alternative question would have been whether we could remove it,
>> > but I already knew the answer...
>> >
>> > Andreas
>> 
>> From Sazius:
>> 
>>   Hi! Pumpa already works with Qt 5, I'm running it on Qt 5.3.2 in Debian
>>   jessie myself. If you have any problems (e.g. with a newer version of
>>   Qt) I would consider it a bug and try to fix it :-)
>> 
>> So it looks like we just need to update the pacakge?
>
> The blocker is the Pumpa dependency QJson, which has a hard dependency
> on Qt-4. QJson is also used by libdbusmenu-qt.
>
> Apparently QJson's master branch has supported Qt-5 for some time, so I
> asked the maintainers if that is true, and if they plan to issue a new
> release [0]. We could try packaging from git.
>
> [0]
> https://github.com/flavio/qjson/issues/49

Sounds good.  If they don't make a new release, I think packaging from
git is the best option.