debcrafters-packages team mailing list archive

[Alessandro Astone <2122289@xxxxxxxxxxxxxxxxxx>]

We did not run any testing in Ubuntu yet.
Fedora is running it and found some rough edges (which are being fixed, so we could just inherit the fixes).
But yeah I feel like it's late now, let's defer to early RR cycle.

** Changed in: gdk-pixbuf (Ubuntu)
       Status: Incomplete => Deferred

-- 
You received this bug notification because you are a member of
Debcrafters packages, which is subscribed to gdk-pixbuf in Ubuntu.
https://bugs.launchpad.net/bugs/2122289

Title:
  [FFE] switch gdk-pixbuf loaders to wrap glycin

Status in gdk-pixbuf package in Ubuntu:
  Deferred

Bug description:
  The latest version of gdk-pixbuf introduces the option to drop the
  built-in image parsers (cause for many CVEs in the past) in favour of
  delegating the image parsing to glycin
  (https://launchpad.net/ubuntu/+source/glycin). In this case gdk-pixbuf
  acts as an API layer wrapping libglycin: applications will keep using
  the same API/ABIs and automatically benefit from the security advances
  of glycin.

  We would like to adopt this change for the security benefits.
  The i386 build of gdk-pixbuf will be excluded by this change, because Ubuntu does not build glycin for i386.

  The switch should be transparent to the vast majority of applications.
  There is one known incompatibility, which is that glycin does not support the XPM image format which is used by some old software: https://gitlab.gnome.org/GNOME/glycin/-/issues/192

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gdk-pixbuf/+bug/2122289/+subscriptions