Bug#548885: iaxmodem: contains embedded code copies of liabiax and spandsp

[Julien BLACHE]

Faidon Liambotis <paravoid at debian.org> wrote:

Hi,

>> The security team is fully aware of that and there is a very good
>> rational behind this. Closing the bug.
> I'm not aware of them and I'm kind of curious :-)
> Could you share them with us?

libiax:
 - libiax in Debian is the pristine upstream version released by Digium
 - it's unmaintained
 - it's wayyyy behind
 - it's not used by anybody inside or outside of Debian
 - it's basically documenting the protocol (though it's becoming outdated)
 - we should RM it anyway, it's halfway done
 - everybody's rolling its own, there are like 4 or 5 diverging
   versions in the wild
 - no, don't even think of merging everything back into one version,
   it's been tried, repeatedly, over the years and failed every single
   time

spandsp:
 - iaxmodem needs more from spandsp than the public API can give it
 - it doesn't fit into spandsp's API nicely
 - there are hotfixes intended for fax use only
 - spandsp in iaxmodem has been tested and verified to work 100%
 - testing iaxmodem takes days, heaps of crappy hardware and hundreds
   of MB of fax captures
 - iaxmodem's and spandsp's authors know each other well and work
   together, what's added to spandsp in iaxmodem eventually makes its
   way into spandsp, though not all of it yet
 - iaxmodem should be able to use upstream spandsp at some point in
   the future, but that's long term

JB.

-- 
 Julien BLACHE <jblache at debian.org>  |  Debian, because code matters more 
 Debian & GNU/Linux Developer        |       <http://www.debian.org>
 Public key available on <http://www.jblache.org> - KeyID: F5D6 5169 
 GPG Fingerprint : 935A 79F1 C8B3 3521 FD62 7CC7 CD61 4FD7 F5D6 5169