#3150: ghostscript-9.00
--------------------------------------+-------------------------------------
Reporter: k...@… | Owner: k...@…
Type: task | Status: assigned
Priority: normal | Milestone: 6.7
Component: BOOK | Version: SVN
Severity: normal | Keywords:
--------------------------------------+-------------------------------------
Comment(by k...@…):
Hmm, I really hate trac for this, I'm almost ready to say "let's take this
on list". But meanwhile, here's what I had ready to add when you updated
the ticket under me:
Replying to [comment:21 ra...@…]:
> Update: Not sure where you stand Ken, but I have this so far:
[snipped a bit]
> {{{
> ./configure --prefix=/usr \
> --without-omni \
> --with-system-libtiff \
> --enable-dynamic
> }}}
Without omni is now the default. Fedora have omni depending on libxml2,
I see no reason to enable it.
>
> 4) Run this sed:
> {{{
> sed -i -e 's|SHARE_FT=0|SHARE_FT=1|' \
> -e 's|SHARE_LCMS=0|SHARE_LCMS=1|' \
> -e 's|ZSRCDIR=src|ZSRCDIR=zlib|' \
> -e 's|LCMSSRCDIR=lcms|LCMSSRCDIR=/usr|' \
> Makefile
> }}}
The seds are useful, but need to be separated. I also need to check how
to add EXPAT to the seds. The reason for separating them is that only
zlib is guaranteed to be in a current LFS build. Also, although a fresh
BLFS build will (eventually) pick up current versions, we're still on
freetype-2.3 and people often spend several weeks (and sometimes months)
going through BLFS, so we can't guarantee that installed versions are new
enough. We also need to document the included versions as the minimum
system versions required (i.e. if your version is older, use the (patched
- see below) version in here if you don't upgrade the system version.
>
> 5) Copy these files from a zlib-1.2.5 source tree into a directory
"zlib": adler32.c compress.c crc32.c crc32.h deflate.c deflate.h trees.c
trees.h zutil.c zutil.h
>
> I made a patch that does #5.
>
That will be useful, but probably deserves a note for anyone using an
older version of LFS. Or maybe 1.2.5 was itself a vulnerability fix ?
Will need to check that.
[...]
> That leaves expat, ijs, icc (http://www.argyllcms.com/index.html) that
can be built into shared libs (expat already is). I wonder; however, how
much modification the Ghostscript devs do to the Jasper library? See:
http://svn.ghostscript.com/
I haven't yet refreshed my memory about jasper (one of the things I
advocated for the book which I've now dropped from my own builds as
circumstances have changed). I think they're just updating their branch
for known vulnerabilities, but I need to check.
If icc is from argyllcms, I think BLFS users are unlikely to build it at
the moment, nor to have access to calibration hardware, so I'm not very
fussed about it. I've seen developments in colour calibration, so that
will no doubt change in the future.
As I noted yesterday, now that ghostscript is all reunited and developed
at ghostscript.com, ijs is a part of it, it isn't separate.
So, there is a lot more here than I expected (always the way in BLFS), and
I've got a lot more to do before I'm certain. But for the moment my plan
is: to fix any vulnerabilities or similar in both gs and the included
libs, then build and use that version with system zlib. Probably not much
more than a cups test page, a text page, and a photo, so by no means
exhaustive. Then repeat with the system versions of (updated and fixed)
freetype, expat, and lcms on one of my boxes. Don't hold your breathe!
I've also got at least one other thing within this to look at, and no
doubt others will suggest themselves as I get further in. Except that
gs-8.71 doesn't work for me, I would have relinquished this ticket, it's
far too much pain ;-)
Since you're still working on this, I'll just add that the as-it-ships
vulneable version is working fine for me - the issues are just fixing
vulnerabilities, and not forcing our readers to have dependencies they
don't need.
--
Ticket URL: <http://wiki.linuxfromscratch.org/blfs/ticket/3150#comment:26>
BLFS Trac <http://wiki.linuxfromscratch.org/blfs>
Beyond Linux From Scratch
--
http://linuxfromscratch.org/mailman/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page
