wgrant

I eagerly await your alleged root exploit.

=> not an archive problem

And that is clearly the case here.

If libgutenprint-dev creates a binary dependency that doesn't provide the files that applications linked against it need, then that's not an archive problem.

(or photoprint is doing something strange)

Nothing broader than that.

Which is purely libgutenprint's problem

It's the job of my package's to declare the correct dependencies, so the archive can know in a language- and build system-agnostic manner whether the dependencies are satisfiable.

If I write a new language with a new library system and get it into Ubuntu, it's not the job of the Ubuntu archive to understand my new language's dependency system and work out when the package will no longer work

This is probably a bug in libgutenprint

The problem here is that, due to a package bug, the dependencies are still satisfiable

That's triggered semi-automatically when dependencies break

Sure, rebuilding the package will fix it.

@AbrahamVanHelpsing If you're trying to find a way to prove that this is a build system bug, you're going to be trying for a while. I suggest you start treating it as a package bug so it can actually get fixed.

Another way?

It?

If you think it's related then I suggest you give up now :)

It's entirely unrelated to this bug, except that it happens to also involved dynamic shared libraries.

If you're running a binary as root with an untrusted LD_LIBRARY_PATH then you have bigger problems.

Um

That's completely unrelated.

...

Why do you think it is a Launchpad or archive infrastructure bug, when multiple Ubuntu developers and a Launchpad developer have categorically told you that it is not?

no question

It is a package bug. There is question about it.

Exploitable?

There is no problem with the build system! There is a problem with one of those two packages.

Because it was added to precise about 3 hours after oneiric was released, at the same moment libgutenprint was added to precise.

@Mechanicalsnail If it runs on oneiric then it ran on precise when it was added to precise.

@Mechanicalsnail It presumably worked when it was initially built, then libgutenprint changed and broke it.

I say this with both my Ubuntu developer and Launchpad developer hats on.

No. It is purely, 100%, a bug in photoprint or the library that it incorrectly depends on

@AbrahamVanHelpsing It's not Launchpad's job to trigger rebuilds in cases of broken dependencies anyway; it's a separate part of the Ubuntu archive management infrastructure. But even then it's not a bug there, since that infrastructure relies on package dependencies rather than knowing how to manual check relationships for every one of the dozens of language-specific library formats.

@AbrahamVanHelpsing Why do you think it's a Launchpad bug? The package's dependencies are wrong -- they don't provide the files that it depends on. The fact that a rebuild fixes it doesn't make it not a package bug if the package's dependencies don't tell the packaging infrastructure that it needs a rebuild.