Bug#1037206: libappstream-glib8/bullseye: flatpak fails to load current Flathub metadata

[Simon McVittie]

Package: libappstream-glib8
Version: 0.7.18-1
Severity: important
Tags: fixed-upstream bullseye
Control: forwarded -1 https://github.com/flatpak/flatpak/issues/5434
Control: affects -1 + flatpak
Control: fixed -1 0.8.1-1

To reproduce:

$ podman run --rm -it debian:bullseye-slim
# apt update
# apt install flatpak reportbug
# flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
# flatpak search steamlink

Expected result: something similar to the output on unstable:

```
Name Description Application ID Version Branch Remotes
Steam… Stream games from another … …esoftware.SteamLink 1.2.0.241 stable flathub
```

(for more readable results use a wider terminal, but this truncated
version is OK)

Actual result:

```
root@c8b13fe6aeca:/# flatpak search steamlink
F: Failed to parse /var/lib/flatpak/appstream/flathub/x86_64/active/appstream.xml.gz file: Error on line 1960 char 29: <p> already set '
Organic Maps is a free Android & iOS offline maps app for travelers,
tourists, hikers, and cyclists.
It uses crowd-sourced OpenStreetMap data and is developed with love by
' and tried to replace with ' ('
No matches found
```

This is not actually a flatpak bug, it's been diagnosed as happening
because older versions of appstream-glib mis-parse upstream metadata
that contains <em> and <code>.

Targeted fixes for the same upstream release have been proposed in
https://bugs.launchpad.net/ubuntu/+source/appstream-glib/+bug/2023215
and I'm now looking at an equivalent update for bullseye.

Workaround: the version of flatpak in bullseye-backports and bookworm has
switched from appstream-glib to libappstream, which does not have this
problem, even in bullseye. I've confirmed that the bullseye-backports
version ("apt install flatpak/bullseye-backports") works fine with
these steps.

smcv

-- System Information:
Debian Release: 11.7
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-9-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages libappstream-glib8 depends on:
ii libarchive13 3.4.3-2+deb11u1
ii libc6 2.31-13+deb11u6
ii libgdk-pixbuf-2.0-0 2.42.2+dfsg-1+deb11u1
ii libglib2.0-0 2.66.8-1
ii libsoup2.4-1 2.72.0-2
ii libstemmer0d 2.1.0-1
ii libuuid1 2.36.1-8+deb11u1
ii libyaml-0-2 0.2.2-1

libappstream-glib8 recommends no packages.

libappstream-glib8 suggests no packages.

-- no debconf information

[Simon McVittie]

Control: tags 1037206 + patch
Control: tags 1037206 + pending

Here is a proposed fix. I'll open a bullseye-pu bug next.

Corresponding git branch:
https://salsa.debian.org/smcv/appstream-glib/-/tree/debian/bullseye-proposed?ref_type=heads

Diff viewable at:
https://salsa.debian.org/smcv/appstream-glib/-/merge_requests/1
(not a MR against https://salsa.debian.org/pkgutopia-team/appstream-glib
because there isn't a bullseye branch there at the moment).

smcv