[Security] advi should build-dep on hardened camlimages

[Brian Thomason]

Binary package hint: advi

The build-dep for camlimages should be tightened in order to receive the fixes made there for some integer overflows.

[Jamie Strandboge (jdstrand)]

I'm confused. Why is this needed? Hardy already has camlimages 1:2.2.0-2ubuntu2.1 so advi should pick this up at runtime, no?

[Brian Thomason (brian-thomason)]

Hi jamie,

I thought the same, but from reading the Debian changelog entry, it seems it may statically link in some bits as they saw fit to release a security update that did nothing more than change the build-deps. If you don't think it needed, that's certainly fine too.

[Jamie Strandboge (jdstrand)]

Since advi is in universe, would you mind researching this more? Perhaps there is a Debian bug on it or you can check the build to see if it is doing as you suggested. It's possible Debian did that as part of their unstable -> testing work.

[Brian Thomason (brian-thomason)]

Appears you are correct - this isn't needed in our repo. Closing it out.