In noble we only have one version atm:
libheif | 1.17.6-1ubuntu4 | noble/universe | source
To promote src:libheif bin:heif-gdk-pixbuf bin:heif-thumbnailer
bin:libheif-examples bin:libheif-plugin-aomdec bin:libheif-plugin-aomenc
bin:libheif-plugin-libde265 libheif1
Override component to main
Thanks for the updates Lukas
Ok, so the stack around libheif seems to complete just in time.
To summarize the situation:
- MIR-wise all the dependencies are good to go now (libheif 1827442, libde265
2004449, aom 2004442, libyuv 2004516, libwebm 2004523)
- The related FFE (2061090) was granted
-
** Changed in: libheif (Ubuntu)
Status: In Progress => Fix Committed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about this bug go to:
Everything seems to be ready now.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about this bug go to:
The minimal dependency chain seems to be mostly solved, still pending
final ACK from security and/or MIR teams.
* libheif-plugin-dav1d OR libheif-plugin-aomdec
=> bug #2004442 (src:aom) + bug #2004516 (src:libyuv) + bug #2004523
(src:libwebm)
* libheif-plugin-libde265
=> bug #2004449
imagemagick is no longer in main, so this is wontfix.
** Changed in: libde265 (Ubuntu)
Status: Incomplete => Won't Fix
** Changed in: libheif (Ubuntu)
Status: In Progress => Won't Fix
** Changed in: x265 (Ubuntu)
Status: Incomplete => Won't Fix
--
You received this bug
Per comment #1 + #24 libheif is ready - updating the state.
But the dependencies are not yet looked at in depth at all.
We will need to look for it, but first we need to make sure (likely but not
state explicitly yet) that someone wants to look after it.
I assume that foundations will own them,
> @paelzer I updated the 'All open unclaimed MIR bugs' link on the MIR
> wiki page to show both NEW and CONFIRMED bugs, and I think we should be
> sure to include 'CONFIRMED' state bugs in our weekly review, not just
> 'NEW' state bugs.
Yeah I've got a notification about it.
I agree and thank you
It's unclear to me if this ever was approved by the MIR team, possibly
comment 1 was intended to be a MIR team review, but it's not clear if
that was the intention and certainly doesn't have the normal MIR review
details.
Technically after security team review, this should have been changed to
Anything we could do to help move this forward?
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about this bug go to:
I reviewed libheif 1.6.1-1 as checked into focal. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.
libheif is an image codec library necessary for decoding photos from some
newer phones.
- CVE History:
- CVE-2019-11471, our database says still unfixed in
On Wed, Feb 26, 2020 at 04:02:33AM -, Seth Arnold wrote:
> Has it been used and found useful?
Not by me. This was pulled into Ubuntu automatically via Debian.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
I've returned to this package, and I'm seeing enough // TODO markers
that I'm starting to be concerned that this library implements
sufficient functionality to be useful for us. The code that's there
mostly looks good, but there's enough markers for "handle errors" and
"find out .." that I'm
> Is the libheif package still lintian clean?
Looks like that lintian is too old.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about this bug
Thanks Steve, I'm not sure why I thought the dependencies on libx265-179
and libde265-0 were overlooked. Now that I take another look it all
looks pretty normal.
Thanks
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
Seth, I'm not sure how you reached the conclusion that there are "no
install time dependencies declared in the Debian packaging". libheif1-1
in focal depends on both libx265-179 and libde265-0.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to
Has anyone looked to see if x265 and libde265 are also required to be
MIR'd for this package to be useful in its target use? There's no
install time dependencies declared in the Debian packaging but it's hard
for me to imagine why these libraries would be required at build in
order to enable some
Is the libheif package still lintian clean? Using disco's lintian I get
the following:
Output of lintian:
W: libheif source: debhelper-compat-file-is-missing
W: libheif source: package-uses-deprecated-debhelper-compat-version 1
E: libheif source:
I forgot I already passed along the coverity results to the libheif team:
https://github.com/strukturag/libheif/issues/128
Their response is very encouraging.
Thanks
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
Here's the Coverity results on libheif. The first third of the file is
all about example code. It might be nice to get those issues fixed, both
to help bring the overall number of findings closer to zero, but more
importantly to improve the quality of potential copy-and-paste coding.
I haven't
** Tags removed: update-excuse
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about this bug go to:
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: libde265 (Ubuntu)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: x265 (Ubuntu)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: libheif (Ubuntu)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
** No longer affects: imagemagick (Ubuntu)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about this bug go to:
** Changed in: imagemagick (Ubuntu)
Status: Fix Released => Won't Fix
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about this bug go
** Changed in: imagemagick (Ubuntu)
Status: Invalid => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about this bug go to:
Also the Samsung S10 creates HEIF images:
https://r2.community.samsung.com/t5/Galaxy-S/Here-s-how-to-make-Galaxy-S10-camera-photos-take-less-storage/td-p/1304386
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
Apparently this is useful for photos from iPhones.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about this bug go to:
This MIR keeps imagemagick out of the release pocket in the devel
release.
** Also affects: imagemagick (Ubuntu)
Importance: Undecided
Status: New
** Changed in: imagemagick (Ubuntu)
Status: New => Invalid
** Tags added: update-excuse
--
You received this bug notification
It's correct that packages do not have to be in main merely for being
build dependencies. But most libraries that are build dependencies are
linked against during build and become runtime dependencies.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is
Just a question, I thought build-dependencies need not be in main any
more to build packages in main. It was announced some time ago on
ubuntu-devel. Am I wrong?
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
Thanks Joachim, Steve, I've removed the comment in trello saying this is
on hold.
Thanks
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1827442
Title:
[MIR] libheif
To manage notifications about
Joachim, thanks for bringing this to my attention. I've gone ahead and
added libde265-examples to the exclusion list for main, and readded the
libheif build-dep to imagemagick in order to revisit this MIR.
Seth, can this go back in the queue for security team review?
** Also affects: x265
libde265-0 actually pulls in a lot less dependencies:
https://packages.ubuntu.com/bionic/libde265-0
The dependencies on Qt, SDL, swscale are being pulled in by the examples:
https://packages.ubuntu.com/bionic/libde265-examples
libheif only depends on libde265-0 and thus doesn't pull in the whole
Wow, that's a pretty significant chain of deps. Thanks for pruning this
one.
I had started in on libheif but not much beyond inspecting a few
Coverity results. (More in the spirit of learning Coverity than
inspecting libheif, I must be honest.)
I passed along the Coverity results to upstream on
I just noticed via
https://people.canonical.com/~ubuntu-archive/component-mismatches-proposed.svg
that libde265 wants to pull in:
- qtbase-opensource-src (qt4)
- qtchooser
- double-conversion
- qtsvg-opensource-src
- qttranslations-opensource-src
- libsd1.2
- *ffmpeg*
- zeromq3
-
I've had a look, certainly seems fine packaging-wise; but should be
looked at by the Security Team.
** Changed in: libheif (Ubuntu)
Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is
38 matches
Mail list logo
