Re: [Kicad-developers] Potrace update (AGAIN)

[Wayne Stambaugh]

I would prefer to use the system potrace rather than having to update
the potrace source embedded in the kicad source.  As for the outdated
version on msys2, I just submitted a pull request to update the potrace
package to version 1.15.  My only concern about doing this is how well
cmake find potrace (if there is one) works.  There always seems to be
issues with the cmake find dependency code on msys2 which requires us to
resolve.

On 11/27/2017 4:15 AM, Simon Wells wrote:
> And yet the files are also being modified unnecessarily making more
> effort when there is an update available,
> The potrace library is not large and so seems pointless to bundle the
> code with the source tree.
> 
> If the potrace library is out of date with the distributions that can be
> expressed to the distributions esspecially since its been security
> updates and I am not familiar with a distribution that is currently
> supported by the distromaker to not get security updates
> 
>> On 27/11/2017, at 9:37 PM, jp charras > > wrote:
>>
>> Le 27/11/2017 à 09:00, Maciej Sumiński a écrit :
>>> I wonder why do we even keep potrace in the source tree. It is available
>>> in mingw, brew and major Linux distributions, so it does not need to be
>>> build manually.
>>>
>>> Regards,
>>> Orson
>>
>> We need only potrace library source files (only 200Kbytes).
>> They are not a lot ( 20 / 30 files).
>>
>> Using potrace lib coming with distros is obviously an option, but it
>> does not fix what is asked:
>> potrace update ( and it creates one more (minor) dependency for
>> compiling ).
>>
>> For instance
>> We are using currently potrace 1.13
>>
>> potrace 1.15 fixes a few issues of potrace 1.13,  but on mingw the
>> currently potrace version is 1.13
>>
>>>
>>> On 11/27/2017 03:58 AM, Simon Wells wrote:
 U I *think* its jp who does the potrace stuff but there has been
 another security update for pot race, while I realise we are in a
 freeze I think that security updates should probably be included.

 "This release consists of bugfixes and minor portability
 improvements. Some potential buffer overflows and arithmetic
 overflows were fixed, including CVE-2017-12067. A bug triggered by
 very large bitmaps has been fixed. A new configuration option
 --enable-local-getopt was added. Thanks to Agostino Sarubbo, Daniel
 Macks, and Michael Voříšek for reporting bugs and suggesting
 improvements.”

 Simon
>>
>>
>> -- 
>> Jean-Pierre CHARRAS
>>
>> ___
>> Mailing list: https://launchpad.net/~kicad-developers
>> Post to : kicad-developers@lists.launchpad.net
>> 
>> Unsubscribe : https://launchpad.net/~kicad-developers
>> More help   : https://help.launchpad.net/ListHelp
> 
> 
> 
> ___
> Mailing list: https://launchpad.net/~kicad-developers
> Post to : kicad-developers@lists.launchpad.net
> Unsubscribe : https://launchpad.net/~kicad-developers
> More help   : https://help.launchpad.net/ListHelp
> 

___
Mailing list: https://launchpad.net/~kicad-developers
Post to : kicad-developers@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kicad-developers
More help   : https://help.launchpad.net/ListHelp

Re: [Kicad-developers] Potrace update (AGAIN)

[Kevin Cozens]

On 2017-11-27 03:00 AM, Maciej Sumiński wrote:

I wonder why do we even keep potrace in the source tree.


It would be better to use an external library instead of having the potrace 
source files in the KiCad tree. That eliminates the need to keep an eye out 
for changes in the upstream potrace files and then apply the changes to the 
copy of the files in KiCad.


--
Cheers!

Kevin.

http://www.ve3syb.ca/   |"Nerds make the shiny things that distract
Owner of Elecraft K2 #2172  | the mouth-breathers, and that's why we're
| powerful!"
#include  | --Chris Hardwick

___
Mailing list: https://launchpad.net/~kicad-developers
Post to : kicad-developers@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kicad-developers
More help   : https://help.launchpad.net/ListHelp

Re: [Kicad-developers] Potrace update (AGAIN)

[jp charras]

I updated potrace to latest version 1.15


-- 
Jean-Pierre CHARRAS

___
Mailing list: https://launchpad.net/~kicad-developers
Post to : kicad-developers@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kicad-developers
More help   : https://help.launchpad.net/ListHelp

Re: [Kicad-developers] Potrace update (AGAIN)

[Simon Wells]

And yet the files are also being modified unnecessarily making more effort when 
there is an update available,
The potrace library is not large and so seems pointless to bundle the code with 
the source tree.

If the potrace library is out of date with the distributions that can be 
expressed to the distributions esspecially since its been security updates and 
I am not familiar with a distribution that is currently supported by the 
distromaker to not get security updates

> On 27/11/2017, at 9:37 PM, jp charras  wrote:
> 
> Le 27/11/2017 à 09:00, Maciej Sumiński a écrit :
>> I wonder why do we even keep potrace in the source tree. It is available
>> in mingw, brew and major Linux distributions, so it does not need to be
>> build manually.
>> 
>> Regards,
>> Orson
> 
> We need only potrace library source files (only 200Kbytes).
> They are not a lot ( 20 / 30 files).
> 
> Using potrace lib coming with distros is obviously an option, but it does not 
> fix what is asked:
> potrace update ( and it creates one more (minor) dependency for compiling ).
> 
> For instance
> We are using currently potrace 1.13
> 
> potrace 1.15 fixes a few issues of potrace 1.13,  but on mingw the currently 
> potrace version is 1.13
> 
>> 
>> On 11/27/2017 03:58 AM, Simon Wells wrote:
>>> U I *think* its jp who does the potrace stuff but there has been 
>>> another security update for pot race, while I realise we are in a freeze I 
>>> think that security updates should probably be included.
>>> 
>>> "This release consists of bugfixes and minor portability improvements. Some 
>>> potential buffer overflows and arithmetic overflows were fixed, including 
>>> CVE-2017-12067. A bug triggered by very large bitmaps has been fixed. A new 
>>> configuration option --enable-local-getopt was added. Thanks to Agostino 
>>> Sarubbo, Daniel Macks, and Michael Voříšek for reporting bugs and 
>>> suggesting improvements.”
>>> 
>>> Simon
> 
> 
> -- 
> Jean-Pierre CHARRAS
> 
> ___
> Mailing list: https://launchpad.net/~kicad-developers 
> 
> Post to : kicad-developers@lists.launchpad.net 
> 
> Unsubscribe : https://launchpad.net/~kicad-developers 
> 
> More help   : https://help.launchpad.net/ListHelp 
> 
___
Mailing list: https://launchpad.net/~kicad-developers
Post to : kicad-developers@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kicad-developers
More help   : https://help.launchpad.net/ListHelp

Re: [Kicad-developers] Potrace update (AGAIN)

[jp charras]

Le 27/11/2017 à 09:00, Maciej Sumiński a écrit :
> I wonder why do we even keep potrace in the source tree. It is available
> in mingw, brew and major Linux distributions, so it does not need to be
> build manually.
> 
> Regards,
> Orson

We need only potrace library source files (only 200Kbytes).
They are not a lot ( 20 / 30 files).

Using potrace lib coming with distros is obviously an option, but it does not 
fix what is asked:
potrace update ( and it creates one more (minor) dependency for compiling ).

For instance
We are using currently potrace 1.13

potrace 1.15 fixes a few issues of potrace 1.13,  but on mingw the currently 
potrace version is 1.13

> 
> On 11/27/2017 03:58 AM, Simon Wells wrote:
>> U I *think* its jp who does the potrace stuff but there has been another 
>> security update for pot race, while I realise we are in a freeze I think 
>> that security updates should probably be included.
>>
>> "This release consists of bugfixes and minor portability improvements. Some 
>> potential buffer overflows and arithmetic overflows were fixed, including 
>> CVE-2017-12067. A bug triggered by very large bitmaps has been fixed. A new 
>> configuration option --enable-local-getopt was added. Thanks to Agostino 
>> Sarubbo, Daniel Macks, and Michael Voříšek for reporting bugs and 
>> suggesting improvements.”
>>
>> Simon


-- 
Jean-Pierre CHARRAS

___
Mailing list: https://launchpad.net/~kicad-developers
Post to : kicad-developers@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kicad-developers
More help   : https://help.launchpad.net/ListHelp

Re: [Kicad-developers] Potrace update (AGAIN)

[Maciej Sumiński]

I wonder why do we even keep potrace in the source tree. It is available
in mingw, brew and major Linux distributions, so it does not need to be
build manually.

Regards,
Orson

On 11/27/2017 03:58 AM, Simon Wells wrote:
> U I *think* its jp who does the potrace stuff but there has been another 
> security update for pot race, while I realise we are in a freeze I think that 
> security updates should probably be included.
> 
> "This release consists of bugfixes and minor portability improvements. Some 
> potential buffer overflows and arithmetic overflows were fixed, including 
> CVE-2017-12067. A bug triggered by very large bitmaps has been fixed. A new 
> configuration option --enable-local-getopt was added. Thanks to Agostino 
> Sarubbo, Daniel Macks, and Michael Voříšek for reporting bugs and 
> suggesting improvements.”
> 
> Simon



signature.asc
Description: OpenPGP digital signature
___
Mailing list: https://launchpad.net/~kicad-developers
Post to : kicad-developers@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kicad-developers
More help   : https://help.launchpad.net/ListHelp

[Kicad-developers] Potrace update (AGAIN)

[Simon Wells]

U I *think* its jp who does the potrace stuff but there has been another 
security update for pot race, while I realise we are in a freeze I think that 
security updates should probably be included.

"This release consists of bugfixes and minor portability improvements. Some 
potential buffer overflows and arithmetic overflows were fixed, including 
CVE-2017-12067. A bug triggered by very large bitmaps has been fixed. A new 
configuration option --enable-local-getopt was added. Thanks to Agostino 
Sarubbo, Daniel Macks, and Michael Voříšek for reporting bugs and suggesting 
improvements.”

Simon___
Mailing list: https://launchpad.net/~kicad-developers
Post to : kicad-developers@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kicad-developers
More help   : https://help.launchpad.net/ListHelp

[Kicad-developers] potrace

[Simon Wells]

kicad seems to have a copy of the potrace code in the tree.
potrace_version.h claims this is version 1.12

the potrace website shows this changelog for 1.13 which was released on
22/10

Some critical bugs in the processing of BMP files were fixed. These bugs
allowed the program to be crashed, or potentially to be abused in other
ways, by feeding it specially crafted BMP files. Thanks to Tomasz Buchert
and Agostino Sarubbo for reporting these bugs. Portability was improved for
C99 and for MSVC++. Thanks to Peter Breitenlohner, Nelson Beebe, and Martin
Gieseking for reporting portability issues.


Is there any reason we have a copy of the code in the tree and are not just
making this a another dependency?

There are binaries for win/lin/osx on the potrace website and it is also
available in brew on osx
___
Mailing list: https://launchpad.net/~kicad-developers
Post to : kicad-developers@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kicad-developers
More help   : https://help.launchpad.net/ListHelp