Hi,
On 15/10/2026 04:25, Emmanuel Arias wrote:
On 2026-10-08 14:30, Sylvain Beucler wrote:
On 06/10/2026 21:43, Emmanuel Arias wrote:
I've worked in tiff for bookworm. Please, could you review the patches?
The patches are here:
https://salsa.debian.org/lts-team/packages/tiff/-/tree/debian/bookworm?pow_referer=&ref_type=heads
Please provide a proper debdiff, because reviewing each commit on Salsa is
not practical.
Attaching
CVE-2024-13978: you only added 1 patch out of 2, why is that?
CVE-2026-18495: I don't think we need all the compilation warning fixes,
just those related to the CVE.
Please drop the Bug-Debian-Security and Bug-Freexian-Security which only
repeat default tracker links and aren't informative (in particular the
freexian one while this isn't ELTS).
For Salsa-CI, maybe fix debian/watch or add an allow_failure for
'test-uscan', which makes the CI FAIL, which is confusing.
I'm not sure which of your debdiff or the current salsa Git repo is the
more up-to-date. One has .gitlab-ci.yml, the other has salsa-ci.yml (the
repository should probably be moved salsa-ci.yml, with the LTS CI
template.) In any case, please sync the debdiff you send for review and
the Git repo where you run salsa-ci.
CVE-2026-36849 is marked <ignored> in trixie, maybe check with the security
team and/or maintainer if it's a good idea to fix it.
Contacted, thanks!
(So, who did you contact and how?)
I see that the CVE-2026-36849 patch adds a symbol, maybe that's why it
was marked <ignored>, as it's always a delicate change especially after
the bookworm freeze. It also changes a structure. And it's a large
patch. Did you perform specific testing?
Your symbol update seems to be wrong, you mark version 4.5.0 while this
is something you're adding after the bookworm release, in
4.5.0-6+deb12u5 and not before.
What kind of testing did you do?
We have some notes from the maintainer at
https://lts-team.pages.debian.net/wiki/TestSuites/tiff.html , did you check
them?
There are many reverse dependencies for this package so thorough testing is
needed.
I uploaded it to debusine [0]. But I trying to reproduce the Test
Suites you mentioned.
[0] https://debusine.debian.net/debian/developers/work-request/1426324/
The tiff package doesn't have autopkgtest and is marked as skipped, so
autopkgtest/debusine won't be enough here.
libgd2, an important package, has all its tests failing here, but I
can't find the reference test results for comparison. Did you
investigate what's happening?
Try to reproduce individual issues when there's a reproducer, in
particular for CVE-2026-52490 where you hand-picked the patch chunks;
test if our version fails without the patch and doesn't fail anymore
with the patch.
For now I don't have a lot of confidence in this update, please
address/clarify these points.
Cheers!
Sylvain Beucler
Debian LTS Team
