Bug#574798: libminizip as part of zlib distribution

[Schrober]

Hi,

it seems that many tools started to use the core of minizip as part of their
source code. This is quite problematic for distributions since they have to
manually fix those files in case of an (security) bug. Therefore, it seems to
be better to provide a library which can be linked by all programs which need
it.

There are distributions like Gentoo and Fedora which already started to
provide such a library called libminizip [1]. Other distributions like Debian
are currently waiting for actions by upstream before starting to use
libminizip[2]. Gentoo also changed some macros which conflict with other
programs [3] in zconf.h. This made nearly everything fail which included files
from minizip and made it necessary to fix everything by hand.

Some known programs which are known to have minizip included (there are more,
but it is impossible to make a complete list and so I just mention some
prominent ones):

* cegui
* chromium
* gdal
* googleearth (ok, it will not happen that they use the distribution version)
* kicad
* mupen64plus
* R
* psi
* virtuoso
* vlc

Would it be possible to include the patch from Gentoo or a similar one with
the next distribution of zlib?

Thanks

[1] https://bugs.gentoo.org/383351
[2] http://bugs.debian.org/574798
[3] https://bugs.gentoo.org/383179

[Schrober]

On Wednesday 19 October 2011 18:13:42 Jonathan Nieder wrote:
> Hi,

>
> Schrober wrote:
> > it seems that many tools started to use the core of minizip as part of
> > their source code. This is quite problematic for distributions since
> > they have to manually fix those files in case of an (security) bug.
> > Therefore, it seems to be better to provide a library which can be
> > linked by all programs which need it.
>

> [...]

>
> > Would it be possible to include the patch from Gentoo or a similar one
> > with the next distribution of zlib?
>

> Your patch looks good to me. However, it would be the first use of Autoconf
> in zlib/contrib, so maybe there would be interest in a patch to make it a
> little lower-tech (see "Why don't you use GNU autoconf or libtool or ...?"
> in the FAQ) on top of that.

But under "I'm having a problem with the zip functions in zlib, can you help?"
and "The match.asm code in contrib is under the GNU General Public License.
Since it's part of zlib, doesn't that mean that all of zlib falls under the
GNU GPL?" it is clearly stated that the stuff in contrib is measured
differently. And the library stuff is horrible without a build system (please
look at the zlib Makefile/configure stuff to define horrible).

Thanks,
Franz



--
To UNSUBSCRIBE, email to debian-bugs-...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org