Subject: Bug#932634 marked as pending in lintian

From: Felix Lechner <[email-masked]>
Date: Thu, 13 Jan 2022 19:23:26 +0000

Control: tag -1 pending

Hello,

Bug #932634 in lintian reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/lintian/lintian/-/commit/4c091cd2d2433e434e3b4326e094ed14534cd3cf

------------------------------------------------------------------------
Turn embedded-library into a classification tag. (Closes: #932634)

Linking statically may no longer be a packaging error in 2022. Many ostensibly
modern languages such as Golang, Rust or Haskell link most or all libraries
statically into the binaries they produce.

For some time, I tried to find other identifying characteristics that would
distinguish the C library libyaml, when linked in statically, from binaries in
other statically linked languages.

Vexingly for this purpose, the newer YAML implementations seem to mirror the
strings found in the C version with amazing accuracy. The sole exception was the
string "found a tab character that violate indentation" (missing an S) but it
seemed unwise to rely on a misspelling that might be corrected, even while the
defective string was still present in the latest libyaml version in unstable.

Of course, the security considerations stated in the tag description still
apply, but those issues reach nowadays far beyond static linking. My desperate
searches on codesearch.d.n were furter befuddled by many vendored sources that
should perhaps not be there. [1]

After some reflection, the Security Team likely has to examine all embedded
versions of affected libraries even when the mode of linking is not actionable
by the Debian distributor because a language works that way.

As a compromise, this commit hides the tag from everyday users but keeps the
information accessible via our website's JSON interface [2] for anyone
researching security matters.

Thanks to Helen Koike for bringning the matter to our attention!

[1] For an example, see yaml.v2 here: https://sources.debian.org/src/golang-github-coreos-discovery-etcd-io/2.0.0+git2019.04.19.git.78fb45d3c9-4/Gopkg.lock/#L543-L549
[2] https://lintian.debian.org/query
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/932634