Bug#404733: Mozilla-based and related packages status

[Steve Langasek]

On Mon, Jan 15, 2007 at 09:18:54PM +0100, Mike Hommey wrote:
> > > - xulrunner has 2 RC bugs that I'll fix this week-end. I don't know if
> > >   #405062 applies to stable libnspr4. Well, it does apply, but I don't
> > >   know if there are other packages that provide setuid or setgid
> > >   programs using it. I'm also going to make quite some modifications to
> > >   the iconv support.

> > Unfortunately this RC bugfix upload was a new upstream version with an
> > extensive diff, and the new version FTBFS on alpha with a timeout where the
> > old version did not.  I'm still in the process of determining if this is a
> > regression in xulrunner, or if it's a regression in the toolchain since the
> > last time xulrunner was built on alpha.

> The codebase is the same as the one for iceape and icedove currently in
> unstable... the only difference is the way it is linked altogether in a
> single big dynamic library instead of a single big binary program.

Yeah, I've done some test builds now of xulrunner on my alpha, and this
isn't a regression in xulrunner; it's either a regression in the toolchain,
or a change in some underlying lib that trips the already known bug in
binutils on alpha causing link times to scale poorly with the number of
symbols.

So the only fix needed here is to raise the timeouts on the buildd for
iceweasel, iceape, icedove, and xulrunner to an obscene number.

> As for #405062, the setgid program from evolution-data-server was
> actually linked against libnspr4 for no reason (the joys of pkg-config
> or libtool, probably), so there was actually no security problem with
> that. Still better to have it fixed, though.

In that case, should the bug actually be downgraded?

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon at debian.org                                   http://www.debian.org/