Your message dated Sat, 14 Dec 2019 10:16:55 +0100
with message-id <[email protected]>
and subject line Re: Bug#919295: kmk_gmake is an embedded copy of make-dfsg
has caused the Debian Bug report #919295,
regarding kmk_gmake is an embedded copy of make-dfsg
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
919295: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919295
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: kbuild
Version: 1:0.1.9998svn3293+dfsg-2
Severity: important
Tags: security
kbuild contains an embedded copy of GNU make. It is shipped as
kmk_gmake. Please consider removing the embedded copy. Presently, it
uses GNU make 4.2.1, which is the same version as make-dfsg, so this
might be a convenience copy.
Failing that, please register your copy writh the security tracker.
Refer to https://wiki.debian.org/EmbeddedCodeCopies for instructions on
how to do that. Given that make has previously received CVEs, getting
rid of the copy is strongly preferred.
Helmut
--- End Message ---
--- Begin Message ---
Hello,
On Thu, 17 Jan 2019 08:53:28 +0000 (UTC) Gianfranco Costamagna
<[email protected]> wrote:
> control: tags -1 help
> Removing it is not a simple operation, I'll add it to the security tracker
> for now.
> G.
>
> Il lunedì 14 gennaio 2019, 20:06:17 CET, Helmut Grohne
> <[email protected]> ha scritto:
>
> Package: kbuild
> Version: 1:0.1.9998svn3293+dfsg-2
> Severity: important
> Tags: security
>
> kbuild contains an embedded copy of GNU make. It is shipped as
> kmk_gmake. Please consider removing the embedded copy. Presently, it
> uses GNU make 4.2.1, which is the same version as make-dfsg, so this
> might be a convenience copy.
>
> Failing that, please register your copy writh the security tracker.
> Refer to https://wiki.debian.org/EmbeddedCodeCopies for instructions on
> how to do that. Given that make has previously received CVEs, getting
> rid of the copy is strongly preferred.
>
After a deeper analysis, while it is true that they share part of the code (so
adding it to tracker is fine),
the sources are *needed* to build kmk, because make-dfsg is not exporting its
internal functionalities into a library.
But TBH, I'm really not sure having a libmake-dfsg would help at all (it would
involve quite big changes in kbuild for no real gain)
Feel free to open a bug against libmake to exporting their functions as API
G.
--- End Message ---
