On Mon, Jul 24, 2023 at 12:02:15AM +0100, Simon McVittie wrote: > Source: libopenraw > Version: 0.1.2-0.2 > Severity: wishlist > X-Debbugs-Cc: [email protected] > Control: affects -1 + tumbler-plugins-extra > > While investigating whether libopenraw's dependency on GTK 2 can be > removed (which it can, see #967585), I noticed that the version of > libopenraw in Debian is from 2018 and there have been 12 new upstream > releases since then. > > With this being file parsing code, I'm concerned that this might mean > unfixed security issues (although I don't see any obvious security fixes > in the upstream NEWS). > > tumbler-plugins-extra seems to be the only package in Debian that makes > use of libopenraw (gegl also has a Build-Depends on it, but it seems to > be unused there) so the maintainers of tumbler might be interested in > salvaging libopenraw to have a high-quality version to depend on if its > current Debian maintainer is no longer active?
Hi Simon, thanks for the heads-up. Tumbler is a thumbnailing application used in Xfce so it uses libopenraw just for generating thumbnails for RAW files, not for manipulating them or something. I'm surprised tumbler is the only user, and I'm definitely not keen on adding another package to maintain to our large base. I share your concern about an outdated library parsing complex files. If libopenraw Debian package isn't maintained in practice, maybe it makes sense to drop it completely. For tumbler we can just remove the dependency (and lose the hability to generate thumbnails for them) or maybe investigate a way to uses a different library. Regards, -- Yves-Alexis
