Re: Syncing Ghostscript with Ubuntu
Quoting Till Kamppeter (2020-02-07 22:14:56) > On 07/02/2020 21:45, Jonas Smedegaard wrote: > > Also, I just now notice that you did not file this as a bugreport. > > Please use the bugtracker in the future, as that helps track isses > > most efficiently. > > As you are not accepting my little change anyway, do I really need to > post a bug report about that? No no - sorry that was unclear: I just mean for future reference. :-) > But thanks for the info anyway. You're welcome! - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: signature
Re: Syncing Ghostscript with Ubuntu
On 07/02/2020 21:45, Jonas Smedegaard wrote: My suspect is now that Debian compiles with -O2 by default, Ubuntu with -O3, meaning that the problem will not occur on Debian. Ah, I understand it now: Debian indeed compiles with -O2 by default. OK, then I know what's on, as I thought. So I would be grateful if you could adopt the exception rule, simply for smooth syncing. I will not maintain packaging code purely for working around deviations in derivatives of Debian. Sorry, I understand that it would simplify your work, but I will not be burdenened by derived work not passed upstream to Debian. Also, I just now notice that you did not file this as a bugreport. Please use the bugtracker in the future, as that helps track isses most efficiently. As you are not accepting my little change anyway, do I really need to post a bug report about that? But thanks for the info anyway. Till
Re: Syncing Ghostscript with Ubuntu
Quoting Till Kamppeter (2020-02-07 20:11:37) > On 07/02/2020 20:02, Jonas Smedegaard wrote: > > > > Are you sure the issue with ppc64 still apply? I ask because > > apparently it builds fine on Debian: > > https://buildd.debian.org/status/package.php?p=ghostscript > > > > For me it actually happened that gcc got stuck on one file when > running with -O3 on ppc64el. See the linked bug report. Therefore I > checked and found out that Ubuntu's Ghostscript package had the > exception rule. > > My suspect is now that Debian compiles with -O2 by default, Ubuntu > with -O3, meaning that the problem will not occur on Debian. Ah, I understand it now: Debian indeed compiles with -O2 by default. > So I would be grateful if you could adopt the exception rule, simply > for smooth syncing. I will not maintain packaging code purely for working around deviations in derivatives of Debian. Sorry, I understand that it would simplify your work, but I will not be burdenened by derived work not passed upstream to Debian. Also, I just now notice that you did not file this as a bugreport. Please use the bugtracker in the future, as that helps track isses most efficiently. Kind regards, - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: signature
Re: Syncing Ghostscript with Ubuntu
Hi Till, Quoting Till Kamppeter (2020-02-07 19:49:40) > I am syncing most printing-related packages between Debian and Ubuntu > to reduce packaging work. [ details snipped] > Now, 9 years after this MIR got posted and 7 years after my first > comment (when I looked into syncing Ghostscript for the first time) > finally theupstream developers fulfilled our security requirements and > the MIR passed, libopenjpeg2 moved into Main and I was able to sync > Ghostscript. > > So now we have 9.50~dfsg-5 in Ubuntu. I am happy for you that your delta has been reduced. > But unfortunately, I overlooked another Ubuntu delta. The Ubuntu > Ghostscript has some extra lines in debian/rules to make Ghostscript > build with -O2 instead of -O3 on ppc64el as (at least on Ubuntu) gcc > gets stuck on one file: Are you sure the issue with ppc64 still apply? I ask because apparently it builds fine on Debian: https://buildd.debian.org/status/package.php?p=ghostscript - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: signature
Re: Syncing Ghostscript with Ubuntu
On 07/02/2020 20:02, Jonas Smedegaard wrote: Are you sure the issue with ppc64 still apply? I ask because apparently it builds fine on Debian: https://buildd.debian.org/status/package.php?p=ghostscript For me it actually happened that gcc got stuck on one file when running with -O3 on ppc64el. See the linked bug report. Therefore I checked and found out that Ubuntu's Ghostscript package had the exception rule. My suspect is now that Debian compiles with -O2 by default, Ubuntu with -O3, meaning that the problem will not occur on Debian. So I would be grateful if you could adopt the exception rule, simply for smooth syncing. In case under Debian ghostscript actually builds with -O3 on ppc64el, please add to the "if" something so that the rule is only applied on Ubuntu. Can perhaps also be gcc version: -- till@till-x1yoga:~/ubuntu/ghostscript/focal$ gcc --version gcc (Ubuntu 9.2.1-28ubuntu1) 9.2.1 20200203 Copyright (C) 2019 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. till@till-x1yoga:~/ubuntu/ghostscript/focal$ -- Thanks in advance Till
Re: Syncing Ghostscript with Ubuntu
Here is the debdiff: http://launchpadlibrarian.net/463993648/ghostscript_9.50~dfsg-5_9.50~dfsg-5ubuntu1.diff.gz And it actually built on ppc64el. Till On 07/02/2020 19:49, Till Kamppeter wrote: Hi, I am syncing most printing-related packages between Debian and Ubuntu to reduce packaging work. One of the packages I was not able to sync was Ghostscript, as openjpeg2 did not pass the Ubuntu security requirements: https://bugs.launchpad.net/bugs/711061 In Ubuntu the packages are in two repositories, Main and Universe, where Main is covered by commercial support for appropriate customers, Universe not, and so it must be possible to install a system of only packages from Main. This means that a package in Main cannot depend on a package in Universe. Main also has much higher security requirements than Universe. A new package gets into Universe and for getting it into Main you have to post a "Main Inclusion Request" (MIR), telling whether the package is well maintained upstream, has security-relevant features like SUID executables, has CVEs and whether they got fixed in a timely manner, ... Above-mentioned bug report is such a MIR, for libopenjpeg2, one of the dependencies of the Debian package of Ghostscript. In Ubuntu Ghostscript is in Main, therefore I can only let it depend on libopenjpeg2 if libopenjpeg2 also had been in Main, which was not the case. Therefore I had to keep a Ubuntu delta, letting the Ubuntu package use the libopenjpeg2 which the Ghostscript upstream maintainers included with Ghostscript, which is massaged by the professional programmers of Artifex and so provides the required security. Now, 9 years after this MIR got posted and 7 years after my first comment (when I looked into syncing Ghostscript for the first time) finally theupstream developers fulfilled our security requirements and the MIR passed, libopenjpeg2 moved into Main and I was able to sync Ghostscript. So now we have 9.50~dfsg-5 in Ubuntu. But unfortunately, I overlooked another Ubuntu delta. The Ubuntu Ghostscript has some extra lines in debian/rules to make Ghostscript build with -O2 instead of -O3 on ppc64el as (at least on Ubuntu) gcc gets stuck on one file: -- DEB_HOST_ARCH ?= $(shell dpkg-architecture -qDEB_HOST_ARCH) ifneq (,$(filter $(DEB_HOST_ARCH),ppc64el)) export DEB_CFLAGS_MAINT_STRIP=-O3 export DEB_CFLAGS_MAINT_PREPEND=-O2 endif -- See https://bugs.launchpad.net/ubuntu/+source/ghostscript/+bug/1862053 Could you add this change to the Debian package, so that I can really sync Ghostscript? Thanks in advance Till
Syncing Ghostscript with Ubuntu
Hi, I am syncing most printing-related packages between Debian and Ubuntu to reduce packaging work. One of the packages I was not able to sync was Ghostscript, as openjpeg2 did not pass the Ubuntu security requirements: https://bugs.launchpad.net/bugs/711061 In Ubuntu the packages are in two repositories, Main and Universe, where Main is covered by commercial support for appropriate customers, Universe not, and so it must be possible to install a system of only packages from Main. This means that a package in Main cannot depend on a package in Universe. Main also has much higher security requirements than Universe. A new package gets into Universe and for getting it into Main you have to post a "Main Inclusion Request" (MIR), telling whether the package is well maintained upstream, has security-relevant features like SUID executables, has CVEs and whether they got fixed in a timely manner, ... Above-mentioned bug report is such a MIR, for libopenjpeg2, one of the dependencies of the Debian package of Ghostscript. In Ubuntu Ghostscript is in Main, therefore I can only let it depend on libopenjpeg2 if libopenjpeg2 also had been in Main, which was not the case. Therefore I had to keep a Ubuntu delta, letting the Ubuntu package use the libopenjpeg2 which the Ghostscript upstream maintainers included with Ghostscript, which is massaged by the professional programmers of Artifex and so provides the required security. Now, 9 years after this MIR got posted and 7 years after my first comment (when I looked into syncing Ghostscript for the first time) finally theupstream developers fulfilled our security requirements and the MIR passed, libopenjpeg2 moved into Main and I was able to sync Ghostscript. So now we have 9.50~dfsg-5 in Ubuntu. But unfortunately, I overlooked another Ubuntu delta. The Ubuntu Ghostscript has some extra lines in debian/rules to make Ghostscript build with -O2 instead of -O3 on ppc64el as (at least on Ubuntu) gcc gets stuck on one file: -- DEB_HOST_ARCH ?= $(shell dpkg-architecture -qDEB_HOST_ARCH) ifneq (,$(filter $(DEB_HOST_ARCH),ppc64el)) export DEB_CFLAGS_MAINT_STRIP=-O3 export DEB_CFLAGS_MAINT_PREPEND=-O2 endif -- See https://bugs.launchpad.net/ubuntu/+source/ghostscript/+bug/1862053 Could you add this change to the Debian package, so that I can really sync Ghostscript? Thanks in advance Till
