Bug#900819: gimp: Dependency on liblcms2-2 needs tightening

[Michael Deegan]

Package: gimp
Version: 2.10.2-1
Severity: minor

Hello,

Gimp 2.10's versioned dependency on liblcms2-2 probably needs to be ">= 2.9"
instead of ">= 2.7", as otherwise people cherry-picking from unstable may
see:

Liblcms2 version mismatch!

GIMP was compiled against LittleCMS version 2.9, but the
LittleCMS version found at runtime is only 2.8.

Somehow you or your software packager managed
to install a LittleCMS that is older than what GIMP was
built against.

Please make sure that the installed LittleCMS version
is at least 2.9 and that headers and library match.

Thanks!

-MD

-- System Information:
Debian Release: 9.4
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'oldstable-updates'), (500, 'stable'), (500, 'oldstable'), (480, 'testing'), (470, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-6-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_AU.utf8, LC_CTYPE=en_AU.utf8 (charmap=UTF-8), LANGUAGE=en_AU:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages gimp depends on:
ii gimp-data 2.10.2-1
ii libaa1 1.4p5-44+b1
ii libbabl-0.1-0 0.1.50-1
ii libbz2-1.0 1.0.6-8.1
ii libc6 2.27-3
ii libcairo2 1.14.8-1
ii libfontconfig1 2.13.0-5
ii libfreetype6 2.6.3-3.2
ii libgcc1 1:6.3.0-18+deb9u1
ii libgdk-pixbuf2.0-0 2.36.5-2+deb9u2
ii libgegl-0.4-0 0.4.2-1
ii libgexiv2-2 0.10.8-1
ii libgimp2.0 2.10.2-1
ii libglib2.0-0 2.56.1-2
ii libgs9 9.20~dfsg-3.2+deb9u1
ii libgtk2.0-0 2.24.32-1
ii libgudev-1.0-0 230-3
ii libharfbuzz0b 1.4.2-1
ii libheif1 1.2.0-1
ii libilmbase23 2.2.1-2
ii libjpeg62-turbo 1:1.5.1-2
ii liblcms2-2 2.8-4
ii liblzma5 5.2.2-1.2+b1
ii libmng1 1.0.10+dfsg-3.1+b5
ii libmypaint-1.3-0 1.3.0-2
ii libopenexr23 2.2.1-4
ii libopenjp2-7 2.1.2-1.1+deb9u2
ii libpango-1.0-0 1.40.5-1
ii libpangocairo-1.0-0 1.40.5-1
ii libpangoft2-1.0-0 1.40.5-1
ii libpng16-16 1.6.28-1
ii libpoppler-glib8 0.48.0-2+deb9u2
ii librsvg2-2 2.40.16-1+b1
ii libstdc++6 8.1.0-3
ii libtiff5 4.0.8-2+deb9u2
ii libwebp6 0.5.2-1
ii libwebpdemux2 0.5.2-1
ii libwebpmux3 0.6.1-2
ii libwmf0.2-7 0.2.8.4-10.6
ii libx11-6 2:1.6.4-3
ii libxcursor1 1:1.1.14-1+deb9u1
ii libxext6 2:1.3.3-1+b2
ii libxfixes3 1:5.0.3-1
ii libxmu6 2:1.1.2-2
ii libxpm4 1:3.5.12-1
ii xdg-utils 1.1.1-1+deb9u1
ii zlib1g 1:1.2.8.dfsg-5

Versions of packages gimp recommends:
ii ghostscript 9.20~dfsg-3.2+deb9u1

Versions of packages gimp suggests:
ii gimp-data-extras 1:2.0.2-1
ii gimp-help-en [gimp-help] 2.8.2-0.1
pn gimp-python <none>
ii gvfs-backends 1.30.4-1
ii libasound2 1.1.3-5

-- no debconf information

[Andreas Henriksson]

Hello Michael Deegan,

Thanks for your bug report.

On Tue, Jun 05, 2018 at 08:40:22PM +0800, Michael Deegan wrote:
> Package: gimp
> Version: 2.10.2-1
> Severity: minor
>
> Hello,
>
> Gimp 2.10's versioned dependency on liblcms2-2 probably needs to be ">= 2.9"
> instead of ">= 2.7", as otherwise people cherry-picking from unstable may
> see:

[...]

Recent Gimp needs >= 2.8 and that is specified in the build-dependencies
of gimp already. Unfortunately liblcms2 lacks the
"Build-Depends-Package: liblcms2-dev" meta-header in
debian/liblcms2-2.symbols which means the build-time dependency isn't
reflected in the runtime dependency. (See man deb-symbols)

Regards,
Andreas Henriksson

PS. While this might seem as a minor bug, severity is specified by
policy and this is actually a 'serious' bug (and thus Release Critical).
OTOH I think it's best fixed in liblcms2 instead of gimp....

[Michael Biebl]

Hi Andreas

Am 05.06.2018 um 23:18 schrieb Andreas Henriksson:
> @@ -1,3 +1,4 @@
> +Build-Depends-Package: liblcms2-dev
> liblcms2.so.2 liblcms2-2 #MINVER#

Hm, this doesn't look correct.
The Build-Depends-Package line should have a preceeding * and should
come as second line, like this:

liblcms2.so.2 liblcms2-2 #MINVER#
* Build-Depends-Package: liblcms2-dev


--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[Thomas Weber]

Hi guys,

thanks for informing me of this problem and for the patch. I uploaded
lcms2 2.9-2 with the fix, but I did not close the current bug report - I
assume that gimp will need at least another rebuild to pick up the
stricter dependency.

Thomas

[Michael Biebl]

Am 11.06.2018 um 16:22 schrieb Thomas Weber:
> Hi guys,
>
> thanks for informing me of this problem and for the patch. I uploaded
> lcms2 2.9-2 with the fix,

Thanks!

but I did not close the current bug report - I
> assume that gimp will need at least another rebuild to pick up the
> stricter dependency.

Correct, the gimp package will need a rebuild to pick up the tighter
dependency.

[Philipp Marek]

With running (mostly) stable (did a "dist-upgrade -t stable" a few days
ago), the command

  $ apt-get install gimp -t testing
  ...
  Holen:1 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libbabl-0.1-0 amd64 0.1.56-1 [261 kB]
  Holen:2 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libraw19 amd64 0.19.0-3 [292 kB]
  Holen:3 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libgegl-common all 0.4.8-1 [1.147 kB]
  Holen:4 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libgegl-0.4-0 amd64 0.4.8-1+b1 [1.509 kB]
  Holen:5 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libgexiv2-2 amd64 0.10.8-1 [48,2 kB]
  Holen:6 http://cdn-fastly.deb.debian.org/debian testing/main amd64
gtk2-engines-pixbuf amd64 2.24.32-3 [60,3 kB]
  Holen:7 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libgtk2.0-bin amd64 2.24.32-3 [48,5 kB]
  Holen:8 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libgail-common amd64 2.24.32-3 [156 kB]
  Holen:9 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libgail18 amd64 2.24.32-3 [55,5 kB]
  Holen:10 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libgtk2.0-0 amd64 2.24.32-3 [1.809 kB]
  Holen:11 http://cdn-fastly.deb.debian.org/debian testing/main amd64
gimp amd64 2.10.6-2 [6.303 kB]
  Holen:12 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libgimp2.0 amd64 2.10.6-2 [3.128 kB]
  Holen:13 http://cdn-fastly.deb.debian.org/debian testing/main amd64
gimp-data all 2.10.6-2 [16,1 MB]
  Holen:14 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libheif1 amd64 1.3.2-1 [126 kB]
  Holen:15 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libmypaint-common all 1.3.0-2 [80,1 kB]
  Holen:16 http://cdn-fastly.deb.debian.org/debian testing/main amd64
libmypaint-1.3-0 amd64 1.3.0-2 [31,7 kB]

isn't enough: starting gimp gives

  Liblcms2 version mismatch!

  GIMP was compiled against LittleCMS version 2.9, but the
  LittleCMS version found at runtime is only 2.8.

so the dependencies need some more tightening.

[Jeremy Bicha]

Control: reopen -1
Control: forcemerge -1 906731

Well a simple rebuild didn't work. I'm not sure what more we should be
doing here. It feels clumsy if we need to bump the version of
liblcms2-dev that gimp Build-Depends on every time there we do a gimp
upload after a new lcms2 version in Debian.

Thanks,
Jeremy Bicha

[Mike Mestnik]

I think this is a bug in dpkg-shlibdeps, I would just add the Depends by hand after ${shlibs:Depends}...  and ask those folks what the issue could be. 

[Michael Deegan]

Package: gimp
Version: 2.10.22-3
Followup-For: Bug #900819

Hello, I can confirm that the issue still exists (being part way through
gradually upgrading my machine from buster to bullseye).

However, it's more confusing now! The message from Gimp:

Liblcms2 version mismatch!

GIMP was compiled against LittleCMS version 2.2, but the
LittleCMS version found at runtime is only 2.9.

Somehow you or your software packager managed
to install a LittleCMS that is older than what GIMP was
built against.

Please make sure that the installed LittleCMS version

is at least 2.2 and that headers and library match.

By my understanding, 2.9 *is* a version number later than 2.2. :P

My uneducated guess is that something plucked "2.2" from somewhere, where
there should have been a *checks apt-cache policy* "2.12".

-- System Information:
Debian Release: 10.9
APT prefers testing-debug
APT policy: (500, 'testing-debug'), (500, 'stable-updates'), (500, 'stable-debug'), (500, 'proposed-updates-debug'), (500, 'oldstable-updates'), (500, 'stable'), (500, 'oldstable'), (480, 'testing'), (470, 'unstable'), (1, 'experimental')

Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-5-amd64 (SMP w/4 CPU cores)

Locale: LANG=en_AU.utf8, LC_CTYPE=en_AU.utf8 (charmap=UTF-8), LANGUAGE=en_AU:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

LSM: AppArmor: enabled

Versions of packages gimp depends on:

ii gimp-data 2.10.22-3
ii graphviz 2.40.1-6
ii libaa1 1.4p5-46
ii libbabl-0.1-0 1:0.1.82-1
ii libbz2-1.0 1.0.6-9.2~deb10u1
ii libc6 2.31-10
ii libcairo2 1.16.0-4+deb10u1
ii libfontconfig1 2.13.1-2
ii libfreetype6 2.10.4+dfsg-1
ii libgcc-s1 10.2.1-6
ii libgdk-pixbuf-2.0-0 2.42.2+dfsg-1
ii libgegl-0.4-0 1:0.4.26-2
ii libgexiv2-2 0.10.9-1
ii libgimp2.0 2.10.22-3
ii libglib2.0-0 2.66.8-1
ii libgs9 9.27~dfsg-2+deb10u4
ii libgtk2.0-0 2.24.32-3
ii libgudev-1.0-0 232-2
ii libharfbuzz0b 2.3.1-1
ii libheif1 1.11.0-1
ii libilmbase25 2.5.4-1
ii libjpeg62-turbo 1:1.5.2-2+deb10u1
ii libjson-glib-1.0-0 1.6.2-1
ii liblcms2-2 2.9-3
ii liblzma5 5.2.4-1
ii libmng1 1.0.10+dfsg-3.1+b5
ii libmypaint-1.5-1 1.6.0-2
ii libopenexr25 2.5.4-1
ii libopenjp2-7 2.3.0-2+deb10u2
ii libpango-1.0-0 1.42.4-8~deb10u1
ii libpangocairo-1.0-0 1.42.4-8~deb10u1
ii libpangoft2-1.0-0 1.42.4-8~deb10u1
ii libpng16-16 1.6.36-6
ii libpoppler-glib8 20.09.0-3.1
ii librsvg2-2 2.44.10-2.1
ii libstdc++6 10.2.1-6
ii libtiff5 4.1.0+git191117-2~deb10u2
ii libwebp6 0.6.1-2
ii libwebpdemux2 0.6.1-2
ii libwebpmux3 0.6.1-2+b1
ii libwmf0.2-7 0.2.8.4-14
ii libx11-6 2:1.7.0-2
ii libxcursor1 1:1.1.15-2
ii libxext6 2:1.3.3-1.1
ii libxfixes3 1:5.0.3-1
ii libxmu6 2:1.1.2-2+b3
ii libxpm4 1:3.5.12-1
ii xdg-utils 1.1.3-1+deb10u1
ii zlib1g 1:1.2.11.dfsg-1

Versions of packages gimp recommends:

ii ghostscript 9.27~dfsg-2+deb10u4

Versions of packages gimp suggests:
ii gimp-data-extras 1:2.0.2-1

ii gimp-help-en [gimp-help] 2.8.2-1
ii gvfs-backends 1.38.1-5
ii libasound2 1.1.8-1

-- no debconf information

[Simon McVittie]

On Sat, 03 Apr 2021 at 17:06:49 +0800, Michael Deegan wrote:
> Hello, I can confirm that the issue still exists (being part way through
> gradually upgrading my machine from buster to bullseye).

I would recommend trying to do the majority of the buster -> bullseye
upgrade in one go.

If you upgrade individual packages from buster to bullseye, that is
something that is *meant* to work, but realistically, there will be a bug
somewhere: there's an extremely large number of possible partial upgrades,
and Debian maintainers cannot test more than a tiny fraction of them. The
combination of packages on your system during a partial upgrade is likely
to be something unique to your system that nobody else has ever tested.

> Liblcms2 version mismatch!
>
> GIMP was compiled against LittleCMS version 2.2, but the
> LittleCMS version found at runtime is only 2.9.

...

> My uneducated guess is that something plucked "2.2" from somewhere, where
> there should have been a *checks apt-cache policy* "2.12".

Looks like GIMP is parsing the LCMS_VERSION incorrectly when generating
this error message, based on an assumption that the minor version is a
single decimal digit: it says 2.2, but it really means 2.12. The version
number that it is actually comparing before generating the error message
is 209x < 2120 (meaning 2.9.x < 2.12.0), which makes more sense.

The gimp packaging should either generate tighter dependencies at
compile-time, or patch out these checks as redundant with the dependency
system.

smcv