Your message dated Sun, 09 Nov 2008 15:25:34 +0000 with message-id <[EMAIL PROTECTED]> and subject line Bug#502441: fixed in cmake 2.6.2-2 has caused the Debian Bug report #502441, regarding CMake includes static copy of libraries available in Debian to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [EMAIL PROTECTED] immediately.) -- 502441: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502441 Debian Bug Tracking System Contact [EMAIL PROTECTED] with problems
--- Begin Message ---Package: cmake Version: 2.6.0-5 Severity: important Tags: patch security -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi it looks like cmake on Debian does not use system libraries much. Is there any specific reason for this? Currently curl, expat, zlib and xmlrpc libraries are included in CMake sources and they are used instead of system ones. This can lead to problems in case of security problem in one of them. Looking at curl, bundled version is 7.16.1 and it is affected at least by CVE-2007-3564. I did not investigate other embedded libraries... Using --system-libs parameter to bootstrap seems to fix this issue and cmake seems to work fine. In this case you also need to add build depends for used libraries. Hopefully I did not miss any in attached patch. CC to security team as version which includes old curl is already in testing. - -- Michal Čihař | http://cihar.com | http://blog.cihar.com - -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 2.6.25.16-0.1-default (SMP w/2 CPU cores) Locale: LANG=cs_CZ.UTF-8, LC_CTYPE=cs_CZ.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages cmake depends on: ii libc6 2.7-15 GNU C Library: Shared libraries ii libgcc1 1:4.3.2-1 GCC support library ii libidn11 1.10-2.1 GNU libidn library, implementation ii libncurses5 5.6+20081004-1 shared libraries for terminal hand ii libssl0.9.8 0.9.8g-13 SSL shared libraries ii libstdc++6 4.3.2-1 The GNU Standard C++ Library v3 cmake recommends no packages. cmake suggests no packages. - -- no debconf information -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkj3SdcACgkQ3DVS6DbnVgRFBACg6W4oF4uEoYMmnIDrolJnS22z 3YsAoOlvpNHG5Wv16OF1BKkSh9CIHG/L =6LYo -----END PGP SIGNATURE-----diff -u cmake-2.6.2/debian/control cmake-2.6.2/debian/control --- cmake-2.6.2/debian/control +++ cmake-2.6.2/debian/control @@ -4,7 +4,7 @@ Maintainer: A. Maitland Bottoms <[EMAIL PROTECTED]> Uploaders: Pierre Habouzit <[EMAIL PROTECTED]>, Modestas Vainius <[EMAIL PROTECTED]> DM-Upload-Allowed: yes -Build-Depends: debhelper (>= 6.0.7~), libncurses5-dev, tcl8.4, quilt, libcurl4-gnutls-dev +Build-Depends: debhelper (>= 6.0.7~), libncurses5-dev, tcl8.4, quilt, libcurl4-gnutls-dev, libxmlrpc-c3-dev, libexpat1-dev, zlib1g-dev Standards-Version: 3.8.0 Package: cmake diff -u cmake-2.6.2/debian/rules cmake-2.6.2/debian/rules --- cmake-2.6.2/debian/rules +++ cmake-2.6.2/debian/rules @@ -38,7 +38,7 @@ echo CMAKE_CXX_FLAGS:STRING=$(CFLAGS) >> Build/CMakeCache.txt $(if $(USE_DARTP),echo DART_ROOT:PATH=/usr/share/Dart >> Build/CMakeCache.txt) $(if $(USE_DARTP),echo BUILDNAME:STRING=cmake_2.2.3-1_$(DARCH).deb >> Build/CMakeCache.txt) - cd Build && ../bootstrap --prefix=/usr --docdir=/share/doc/cmake --mandir=/share/man + cd Build && ../bootstrap --prefix=/usr --docdir=/share/doc/cmake --mandir=/share/man --system-libs chmod -x ChangeLog.manual chmod -x Modules/*.cmake Modules/*.cmake.in Modules/*.cxx Modules/Platform/* touch $@
--- End Message ---
--- Begin Message ---Source: cmake Source-Version: 2.6.2-2 We believe that the bug you reported is fixed in the latest version of cmake, which is due to be installed in the Debian FTP archive: cmake-curses-gui_2.6.2-2_amd64.deb to pool/main/c/cmake/cmake-curses-gui_2.6.2-2_amd64.deb cmake-data_2.6.2-2_all.deb to pool/main/c/cmake/cmake-data_2.6.2-2_all.deb cmake-qt-gui_2.6.2-2_amd64.deb to pool/main/c/cmake/cmake-qt-gui_2.6.2-2_amd64.deb cmake_2.6.2-2.diff.gz to pool/main/c/cmake/cmake_2.6.2-2.diff.gz cmake_2.6.2-2.dsc to pool/main/c/cmake/cmake_2.6.2-2.dsc cmake_2.6.2-2_amd64.deb to pool/main/c/cmake/cmake_2.6.2-2_amd64.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [EMAIL PROTECTED], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Modestas Vainius <[EMAIL PROTECTED]> (supplier of updated cmake package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [EMAIL PROTECTED]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Sat, 01 Nov 2008 14:07:08 +0200 Source: cmake Binary: cmake cmake-data cmake-curses-gui cmake-qt-gui Architecture: source amd64 all Version: 2.6.2-2 Distribution: experimental Urgency: low Maintainer: A. Maitland Bottoms <[EMAIL PROTECTED]> Changed-By: Modestas Vainius <[EMAIL PROTECTED]> Description: cmake - A cross-platform, open-source make system cmake-curses-gui - Curses based user interface for CMake (ccmake) cmake-data - CMake data files (modules, templates and documentation) cmake-qt-gui - Qt4 based user interface for CMake (cmake-gui) Closes: 481391 482787 487528 500770 502441 Changes: cmake (2.6.2-2) experimental; urgency=low . * Add Vcs fields. * Add patches: - FindQt4_qt4_lupdate_lrelease.diff - prefer lupdate-qt4 to lupdate and lrelease-qt4 to lrelease. This is specific to Debian Qt4. Thanks to Ludovico Cavedon (Closes: #487528). - FindMPEG2_include_FindSDL_fix.diff - fix FindSQL include in the MPEG2 module. Thanks to Leopold Palomo Avellaneda (Closes: #500770). * Try sorting out emacsen mess once again (Closes: #481391): - depend on emacsen-common; - old-prerm will most likely fail spewing emacsen-common error message when upgrading from previous version but this is OK. Add a custom prerm script which recovers from the problem and notifies the user to ignore the error message. * Rewrite cmake cache initialization code. Pass initial cmake flags via file (--init= argument to the bootstrap script). * Make build verbose again. * Prepare for multiple binary packages: switch to install files and to debhelper v7 (due to more convenient install file handling), install everything to debian/tmp initially. * Add new binary packages: - cmake-data - split off data files needed for each cmake flavour to run. Move emacsen stuff in here too; - cmake-curses-gui - splif off ccache here from the cmake package; - cmake-qt-gui - build & install Qt4 based GUI (cmake-gui). Add menu file and manual page (Closes: #482787). Update debian/copyright. * Dynamically link against system libraries available in Debian (Closes: #502441). * Remove left-over debian/doxygen.config. * Rename debian/docs to debian/cmake-data.docs and clean it up. Do not install ChangeLog.txt. It is size and usefulness ratio is too low to justify inclusion in the binary package. Checksums-Sha1: bd306898f5a036c4aabdab33bd24b8d8e56699fe 1332 cmake_2.6.2-2.dsc 4d04eb164527acf62c6989339bf207b22fd4b518 22415 cmake_2.6.2-2.diff.gz 17a73549548abbb671628ebbbe54049970bbd342 3819274 cmake_2.6.2-2_amd64.deb e6d721a598aae9294868d1f647da3f40c2eab44b 1364788 cmake-data_2.6.2-2_all.deb 0d3ff8a671becfcd3e4ba858e0674e19c52f5d4e 1314658 cmake-curses-gui_2.6.2-2_amd64.deb 7d45de114e151bfb800b6010aafe8f7ff7aef4c6 1241960 cmake-qt-gui_2.6.2-2_amd64.deb Checksums-Sha256: d5ba7309711563e5a7e95b2304feb282929e2fe32a18753b05d1c0e0c9ecfa4a 1332 cmake_2.6.2-2.dsc 8d50b34f0174e72b08e33fbb062b3a085b5e05aa4c4d7141ecc96c17abff3c00 22415 cmake_2.6.2-2.diff.gz c8f9d8c324248146729479b2577cac4ae85d73f2aa7a876cfa3c43f0f1ecad5a 3819274 cmake_2.6.2-2_amd64.deb 7fdf972a94d735e904364f0ebd52b48199d40e280bec451537b0c1ad9511e79c 1364788 cmake-data_2.6.2-2_all.deb bb169e01e410e8c6d9fc4f85470346d986805e53637356264ad843818e80a20f 1314658 cmake-curses-gui_2.6.2-2_amd64.deb 1ce37c3c02221a2be5ebb337862d2d50bc6f9ec7792ca1e8226407575dce653b 1241960 cmake-qt-gui_2.6.2-2_amd64.deb Files: 13dbc1981666daab4fe5241ca7879b44 1332 devel optional cmake_2.6.2-2.dsc a2bce566948b7dbd2957f530164cb844 22415 devel optional cmake_2.6.2-2.diff.gz b5a6d0cfb0d6a1aa57b11a6637b796e4 3819274 devel optional cmake_2.6.2-2_amd64.deb ecc19d791c3998bf82bf4e57e9dfcf96 1364788 devel optional cmake-data_2.6.2-2_all.deb 44821368fcd4c13f9ff3b8b0c4ca1b62 1314658 devel optional cmake-curses-gui_2.6.2-2_amd64.deb b28ee6dba6cd362fbf0823c0e3dc355d 1241960 devel optional cmake-qt-gui_2.6.2-2_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkkNzLkACgkQvGr7W6HudhxuEQCgimVTevKOnJwAyJsH4PdnP24s VpkAmgKiFMqlEX2R7ofGXp/L1FgbQJN/ =ph65 -----END PGP SIGNATURE-----
--- End Message ---
