Control: forwarded -1 https://gitlab.com/Seeker4/OSCAR-code/-/work_items/360
On Tuesday, 27 October 2026, Helmut Grohne wrote: > oscar builds a vendor copy of botan. This is problematic on several > levels. The Debian policy discourages embedded code copies and this > makes it a normal bug. A vulnerability in botan (which is a crypto > library after all) has to be fixed several times. Worse, one has to > figure out which packages include such a copy. Therefore, we keep a > record at > https://salsa.debian.org/security-tracker-team/security-tracker/-/blob/master/data/embedded-code-copies. > Notably, oscar is not listed here. The botan version included in oscar > is very old. It is very likely affected by a number of vulnerabilities > fixed in newer versions, see > https://security-tracker.debian.org/tracker/source-package/botan. Thank you for the heads up. I noticed that botan has been removed from the archive and is only available on stable, so it seems like replacing it with the system copy isn't feasible for unstable. I've just filed an upstream issue letting them know about the situation with botan; let's see how it goes. > Beyond this, I attempted to cross build oscar and found that when > building it for s390x, it would fail with "error: writing 1 byte into a > region of size 0 [-Werror=stringop-overflow=]". This likely is due to > compiling with -Werror and gcc-16 having gained precision in warnings > (or false positives). I cannot reproduce this on amd64. Do you want to file another bug for this? > This bug report is about the unregistered and vulnerable vendor copy. > Please decide whether oscar has a good reason to vendor botan. If it > does, register your vendor copy with the security tracker and fix all > vulnerabilities (e.g. by updating the copy) and close this bug. If it > does not, please reuse the system copy. I believe the reason for OSCAR to vendor botan is the fact that botan isn't available in Debian unstable/testing anymore. I will wait for upstream's reply to the issue before I decide what to do here. Thanks again, -- Sergio GPG key ID: 237A 54B1 0287 28BF 00EF 31F4 D0EB 7628 65FC 5E36 Please send encrypted e-mail if possible https://sergiodj.net/
signature.asc
Description: PGP signature
