[Monotone-devel] [Fwd: Re: Bug#318509: monotone statically links to libsqlite3]

[Tomas Fasth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello monotone developers

My fellow Debian developer Elrond had a suggestion regarding the
sqlite code modification that is part of the monotone source
distribution.

Elrond wrote:
> On Tue, Jul 19, 2005 at 12:13:05AM +0200, Tomas Fasth wrote:
> [...]
>
>>I want monotone to use the shared libraries of sqlite, popt, lua,
>>etc as distributed with Debian.
>
>
> Good!
>
> Until then, I'd suggest, you let the security team know,
> that your package has local versions due to above mentioned
> reasoning. So they can decide, what to do, if and when
> those packages have issues.

Quick note: This is an example of what a package maintainer have to
deal with when upstream is linking an application against their own
versions of libraries which are also available as shared objects in
the same distribution.

> Some time after filing the bug, I finally found out some
> details of the local changes, and I have some possible
> ideas to get them done in other ways:
>
> * sqlite: As I understand, there's only an addition.
>   - It might be put in an extra .c, so that it's only used in
>     monotone.
>   - The code using it might be rewritten to use a loop with
>     sqlite3_prepare
>     (It's not faster than sqlite3_exec, as that uses the
>      former.)

Is Elrond's suggestion an acceptable solution?

> Of course, the sqlite changes should be proposed to
> upstream for inclusion.
>
>
>>But it is not currently possible
>>according to upstream. I should have mentioned this in more detail
>>in the changelog, so thanks for pointing this out.
>
>
> Yep, that would have been helpful.
>
> Maybe better put this into a README.Debian or TODO.Debian.
>
> (while there: /usr/share/doc/monotone/README currently does
> not give any vital information to the user, really)
>
>
>     Elrond

- --
Tomas Fasth <address@hidden>
GnuPG KeyId: 0x9FE8D504
Fingerprint: DC7B 9453 7F26 1BF9 6B21 9F90 C187 7355 9FE8 D504
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFC5hY6wYdzVZ/o1QQRAn8vAJ9Pc5YuQH7e1lYa001X0+qTnrTGqgCeLFTI
dIsrDj6VbD0pfRru/wb5r7s=
=L8Es
-----END PGP SIGNATURE-----