[security fix] ghostscript rebased to 9-20 for all releases

[David Kaspar [Dee'Kej]]

Hello folks,

ghostscript package has been rebased to version 9.20 across all current Fedora releases. I
am very well aware that we shouldn't do rebases for current releases, to avoid
stability problems. However, I have decided for this step in order to fix 4 CVEs that
arrived yesterday for ghostscript (3 of them with security impact=high).

Backporting the security fixes from upstream across 4 versions of ghostscript could
increase the possibility the fixes wouldn't be backported correctly, and it would be
most likely much more time consuming. (I'm in time constraints ATM).

I have discussed the rebase with upstream - THERE SHOULD BE NO API/ABI CHANGES between
versions 9.16 ->> 9.20. Another notes for Fedora maintainers:
* ghostscript sub-package structure remained same
* 'ijs-config' custom tool from upstream has been removed (by upstream),
'pkg-config' is used by default now instead [1]
* more info in release notes [2][3][4]

Right now, I think only packages that depend on ghostscript-devel subpackage *might* be
affected by this change. List of those packages:
>  ariamaestosa
>  ImageMagick
>  wfdb 
I think we can all agree that it's better to have some (not-critical) functionality
broken for few days than vulnerable Fedora. :) I will be contacting maintainers of those
packages and ask them to rebuild their package, to make sure everything will be working as
it should.

Thank you for your understanding!

Best regards,

Dee'Kej
----------
[1] http://git.ghostscript.com/?p=ghostpdl.git;h=0c176a91d53c85cda
[2] https://bodhi.fedoraproject.org/updates/ghostscript-9.20-2.fc25
[3] https://bodhi.fedoraproject.org/updates/ghostscript-9.20-2.fc24
[4] https://bodhi.fedoraproject.org/updates/ghostscript-9.20-2.fc23

[Solomon Peachy]

On Fri, Oct 07, 2016 at 03:14:57PM -0000, David Kaspar wrote:
>  Right now, I think only packages that depend on ghostscript-devel
> subpackage *might* be affected by this change. List of those packages:
>  > ariamaestosa
>  > ImageMagick
>  > wfdb 
Add gutenprint to that list.  I don't expect the existing package will 
malfunction in any way with the ghostscript bump, but it's not 
rebuildable without ijs-config.  There's an already-upstreamed patch 
that switches over to using pkg-config:

https://sourceforge.net/p/gimp-print/source/ci/233a909a77dd4c18d359bf32cd...

(For the life of me I can't figure out how to get sourceforge to display 
 a raw diff.  I can supply one out of my local repo if need be..)

 - Solomon
-- 
Solomon Peachy        		       pizza at shaftnet dot org
Delray Beach, FL                          ^^ (email/xmpp) ^^
Quidquid latine dictum sit, altum viditur.

[David Kaspar [Dee'Kej]]

Thank you, Solomon for that info,

actually gutenprint maintainer is my colleague, but he is sick today. I'm
adding him into CC, so he's aware of it when he returns. ;)

2 Zdenek: Please, look at the whole thread here -
https://lists.fedoraproject.org/archives/list/[e-mail].o...
- we have discussed a little on Thursday, so you should know what's going
on. :)

Best regards,

David Kaspar [Dee'Kej]
*Associate Software Engineer*
*Brno, Czech Republic*

RED HAT | TRIED. TESTED. TRUSTED.
Every airline in the Fortune 500 relies on Red Hat.
Find out why at Trusted | Red Hat <http://www.redhat.com/en/about/trusted>;.

On Fri, Oct 7, 2016 at 5:28 PM, Solomon Peachy <pizza(a)shaftnet.org&gt; wrote:

>  On Fri, Oct 07, 2016 at 03:14:57PM -0000, David Kaspar wrote:
>  > Right now, I think only packages that depend on ghostscript-devel
>  subpackage *might* be affected by this change. List of those packages:
>  > > ariamaestosa
>  > > ImageMagick
>  > > wfdb
>
>  Add gutenprint to that list.  I don't expect the existing package will
>  malfunction in any way with the ghostscript bump, but it's not
>  rebuildable without ijs-config.  There's an already-upstreamed patch
>  that switches over to using pkg-config:
>
>  https://sourceforge.net/p/gimp-print/source/ci/
>  233a909a77dd4c18d359bf32cd8ef99ed1b7b459/
>
>  (For the life of me I can't figure out how to get sourceforge to display
>   a raw diff.  I can supply one out of my local repo if need be..)
>
>   - Solomon
>  --
>  Solomon Peachy                         pizza at shaftnet dot org
>  Delray Beach, FL                          ^^ (email/xmpp) ^^
>  Quidquid latine dictum sit, altum viditur.
>
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>
>