[FFe] Include amsn package back in Ubuntu distribution

Bug #1001958 reported by Pander
26
This bug affects 3 people
Affects Status Importance Assigned to Milestone
amsn (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Feature Freeze Exception Justification
======================================
amsn was already in Ubuntu but was dropped because it wasn't maintained and had unpatched security vulnerabilities. amsn is now back in Debian and the security bug has been fixed. It was waiting in Debian's new queue since June I believe.

==========
Please include amsn package again back in Ubuntu distribution.

If needed, also upgrade to latest stable version, see http://www.amsn-project.net/linux-downloads.php

Related branches

CVE References

Aditya V (kroq-gar78)
tags: added: precise quantal
Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

In order to have amsn in precise and quantal you need to ask for inclusion in debian first.

After a sync can be made from debian to ubuntu.

Amsn has been removed since some CVE [1] weren't fixed and it was lack of upstream support for this.

This week I've read on the amsn offical mailing list [2] that those CVE and other bugs are been fixed upstream.

So I personally think that debian should reconsider packaging it and ubuntu syncing it.

In the meanwhile you can install it from my ppa [3], but I have to say I really don't know the status of the fixes in my ppa, since it is a sync from oneiric and build for precise with no modifications at all.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=557754
[2] http://sourceforge.net/mailarchive/forum.php?thread_name=CAO3MEfCKyEDFo%2BFuwkFepb2akUgMKVdvmNU9UsF%2B6kUdV0zxnw%40mail.gmail.com&forum_name=amsn-devel
[3] https://code.launchpad.net/~costamagnagianfranco/+archive/amsn

Changed in amsn (Ubuntu):
status: New → Confirmed
Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

@Pander @Guybrush88
do you want to report in on debian?

Revision history for this message
Pander (pander) wrote :

I'm not an active reporting in Debian. Seems you know your way around over there much better. Would you report it please?

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

@Pander already done, please look at [1] message #58 and #63

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=557754

Revision history for this message
Pander (pander) wrote :

Would anyone with package experience be so nice to please create a PPA for precice and quantal since this MSN client offers more video and sound support as for example pidgin or empathy.

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

Hi Pander, in the meanwhile you can use amsn from my ppa [1].

I have packaged the version shipped with oneiric for precise too (quantal ftbfs), but version 0.98.4 is the version with known CVEs, so use it carefully and with no warranty

[1] https://code.launchpad.net/~costamagnagianfranco/+archive/amsn

Revision history for this message
Pander (pander) wrote :

Thanks but when I download them manually and install them I get the following error:

# dpkg -i amsn-data_0.98.4-0~40~precise1_all.deb amsn_0.98.4-0~40~precise1_amd64.deb
(Reading database ... 205122 files and directories currently installed.)
Preparing to replace amsn-data 0.98.4-0~40~precise1 (using amsn-data_0.98.4-0~40~precise1_all.deb) ...
Unpacking replacement amsn-data ...
Preparing to replace amsn 0.98.4-0~40~precise1 (using amsn_0.98.4-0~40~precise1_amd64.deb) ...
Unpacking replacement amsn ...
Setting up amsn-data (0.98.4-0~40~precise1) ...
dpkg: dependency problems prevent configuration of amsn:
 amsn depends on libgstfarsight0.10-0 (>= 0.0.3); however:
  Package libgstfarsight0.10-0 is not installed.
 amsn depends on libjpeg62 (>= 6b1); however:
  Package libjpeg62 is not installed.
 amsn depends on tcl-tls; however:
  Package tcl-tls is not installed.
 amsn depends on libsnack2-alsa | libsnack2; however:
  Package libsnack2-alsa is not installed.
  Package libsnack2 is not installed.
dpkg: error processing amsn (--install):
 dependency problems - leaving unconfigured
Processing triggers for man-db ...
Processing triggers for bamfdaemon ...
Rebuilding /usr/share/applications/bamf.index...
Processing triggers for desktop-file-utils ...
Processing triggers for gnome-menus ...
Processing triggers for menu ...
Errors were encountered while processing:
 amsn
# dpkg -l|grep amsn
iU amsn 0.98.4-0~40~precise1 An MSN messenger written in Tcl
ii amsn-data 0.98.4-0~40~precise1 Data files for aMSN

How can this be fixed?

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

You are right, I'm sorry, I didn't package the external dependencies removed by ubuntu MOTUs.

I'll try to fix soon.

BTW don't download manually the package, install it with
 sudo apt-add-repository ppa:costamagnagianfranco/amsn
 sudo apt-get update
 sudo apt-get install amsn

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

ok the i386 build should be already ok, the amd64 will be ok in a few hours
https://code.launchpad.net/~costamagnagianfranco/+recipe/farsight2-daily

please check again when the build will be finished and report.

Thanks

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

Ok amsn should be available and working.
I have to say that this version is buggy and has known CVEs.

I'll try to update amsn to the latest version, but I really don't know when I'll have time.

Sorry for that

Revision history for this message
Pander (pander) wrote :

md64:

The following packages have unmet dependencies:
 amsn : Depends: libgstfarsight0.10-0 (>= 0.0.3) but it is not going to be installed

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

sudo apt-get install libgstfarsight0.10-0

Revision history for this message
Pander (pander) wrote :

Thanks, that works.

Revision history for this message
Pander (pander) wrote :

Although it has an undesirable side effect, piding gets deinstalled. When reinstalling:

# apt-get install pidgin
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  amsn-data libjpeg62 libsnack2-alsa tcl-tls
Use 'apt-get autoremove' to remove them.
The following extra packages will be installed:
  libfarstream-0.1-0 libpurple0 pidgin-libnotify
The following packages will be REMOVED:
  amsn libgstfarsight0.10-0
The following NEW packages will be installed:
  libfarstream-0.1-0 libpurple0 pidgin pidgin-libnotify
0 upgraded, 4 newly installed, 2 to remove and 7 not upgraded.
Need to get 2,731 kB of archives.
After this operation, 6,131 kB of additional disk space will be used.
Do you want to continue [Y/n]?

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

Package: libfarstream-0.1-0
Priority: optional
Section: libs
Installed-Size: 698
Maintainer: Ubuntu Developers <email address hidden>
Original-Maintainer: Debian Telepathy maintainers <email address hidden>
Architecture: amd64
Source: farstream
Version: 0.1.2-0ubuntu1
Replaces: libgstfarsight0.10-0
Depends: libc6 (>= 2.14), libglib2.0-0 (>= 2.31.2), libgstreamer-plugins-base0.10-0 (>= 0.10.33), libgstreamer0.10-0 (>= 0.10.33), libnice10 (>= 0.1.0), gstreamer0.10-plugins-base (>= 0.10.33), gstreamer0.10-plugins-good (>= 0.10.29), gstreamer0.10-nice (>= 0.1.0)
Pre-Depends: multiarch-support
Conflicts: libgstfarsight0.10-0

seems to be libgstfarsight has been replaced to libgstfastream, so you cannot use them both

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

I'm trying to make amsn use libfarstream instead of libgstfarsight but it's almost impossible, because amsn is highly dependent from gstfarsight

Revision history for this message
kakaroto (kakaroto) wrote :

@LocutusOfBorg:
The libgstfarsight dependency has been removed from amsn 0.98.9. It is not being used currently so you can remove the dependency safely. Please refer to the debian package.
Thanks!

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

I could not find any amsn 0.98.9 in debian...

Only 0.98.4
 http://packages.debian.org/search?keywords=amsn&searchon=names&suite=all&section=all

Revision history for this message
kakaroto (kakaroto) wrote :

Ah sorry, I thought it was already accepted, it's in progress now. You can find it in the pipeline here :
https://ftp-master.debian.org/new/amsn_0.98.9-1.html

Revision history for this message
kakaroto (kakaroto) wrote :

By the way, here is the debian directory for the amsn 0.98.9 package : http://amsn-project.net/~vivia/amsn-debian.tar.bz2
I hope this is helpful.

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

Amsn 0.98.9-1 is now available in my ppa for quantal and precise as well, thanks Vivia and Kakaroto.
https://code.launchpad.net/~costamagnagianfranco/+archive/amsn

Revision history for this message
Pander (pander) wrote :

Yes, amsn and pidgin can coexist peacefully again.

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

Of course, there is no dependency anymore :)
---
Ubuntu Bug Squad volunteer triager
http://wiki.ubuntu.com/BugSquad

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

Hi members of ubuntu sponsors team.

Recently amsn has been included into debian unstable again (will be available in a few hours)
https://launchpad.net/debian/+source/amsn/+publishinghistory
http://packages.debian.org/source/unstable/amsn

please consider include it back in ubuntu too

I think there is no changes for ubuntu, just those lines

amsn (0.98.4-0ubuntu2) oneiric; urgency=low

  * Add 09_fix_ftbfs_videodev2.dpatch based on patch from Loïc Gomez
    resolving FTBFS due to changed kernel header filename. Thanks,
    Loïc! (LP: #749181)

 -- Daniel T Chen <email address hidden> Sat, 27 Aug 2011 16:14:27 -0400

amsn (0.98.4-0ubuntu1) natty; urgency=low

  * New upstream release
  * Tarball repacked according to debian/README.source
  * debian/patches/07_infoaudacious.dpatch: dropped, applied upstream
  * debian/patches/08_offline_message_issue.dpatch: dropped, applied upstream
  * This upload also closes the following bugs:
    - LP: #667570
    - LP: #689767

 -- Lorenzo De Liso <email address hidden> Tue, 04 Jan 2011 20:00:50 +0100

amsn (0.98.3-5ubuntu1) natty; urgency=low

  * Merge from debian unstable, remaining changes:
    - add 08_use_aplay_for_sound.dpatch patch by Festor Wailon Dacoba to use
      aplay to play sounds
    - debian/control:
      + modify iceweasel to firefox | abrowser in amsn Suggests field
      + add xdg-utils and gstreamer0.10-nice to amsn Depends field
      + modify sox to alsa-utils in amsn Suggests field as we are now using
        aplay

 -- Lorenzo De Liso <email address hidden> Tue, 04 Jan 2011 19:30:53 +0100

---
Ubuntu Bug Squad volunteer triager
http://wiki.ubuntu.com/BugSquad

Jeremy Bicha (jbicha)
summary: - Include amsn package back in Ubuntu distribution
+ [FFe] Include amsn package back in Ubuntu distribution
Revision history for this message
Jeremy Bicha (jbicha) wrote :

Here's the remaining diff against Debian's amsn.

Revision history for this message
Jeremy Bicha (jbicha) wrote :
Revision history for this message
Jeremy Bicha (jbicha) wrote :
description: updated
Revision history for this message
Scott Kitterman (kitterman) wrote :

FFe approved. Ping me when this is in New and I'll review it.

Changed in amsn (Ubuntu):
status: Confirmed → Triaged
status: Triaged → New
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package amsn - 0.98.9-1ubuntu1

---------------
amsn (0.98.9-1ubuntu1) quantal; urgency=low

  * Sync with Debian. (LP: #1001958) Remaining changes:
  * debian/control:
    - Build-depend on libfarstream-0.1-dev
    - Depend on libfarstream-0.1-0 and xdg-utils
  * debian/patches/08_use_aplay_for_sound.patch:
    - Use aplay from alsa-utils instead of play from sox for sounds

amsn (0.98.9-1) unstable; urgency=low

  * Updated to new 0.98.9 version:
    + Rewritten P2P stack, fixing CVE-2006-0138 among other bugs
    + Fixed compilation against libpng 1.5
    + Fixed problem running libng under latest tcl/tk (made webcam not work)
    + Upstream moved .so files out of /usr/share
  * Added self as maintainer
  * Refactored and cleaned up the package

amsn (0.98.4-4) unstable; urgency=low

  * aMSN should compile now in hurd-i386. In this revision patch
    07_fix_ftbfs4hurd.patch has been created. Thanks to Svante Signell for
    providing it. (Closes: #636213)
  * debian/control:
    + Build-Depends on libjpeg-dev instead of libjpeg62-dev. (Closes: #633435)

amsn (0.98.4-3) unstable; urgency=low

  * Switch to dpkg-source 3.0 (quilt) format.
  * Bump Standards-Version to 3.9.2. No changes were needed.
  * Support for Video4Linux version has been dropped in the Linux kernel. This
    caused a FTBFS because linux/videodev.h is not provided anymore.
   (Closes: #621955)

amsn (0.98.4-2) unstable; urgency=low

  * Uploading to unstable.

amsn (0.98.4-1) experimental; urgency=low

  * New upstream release. (Closes: #606988)
 -- Jeremy Bicha <email address hidden> Wed, 10 Oct 2012 23:39:21 -0400

Changed in amsn (Ubuntu):
status: New → Fix Released
Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :
Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

At the moment only amd64 and i386 are in new...
Should I ping when every build is in new?

Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

@Scott every amsn build is waiting in queue.

@Jeremy and others
I recently talked with Vivia (the debian mantainer). And she said (sorry for quoting a private mail)

> * debian/control:
> - Build-depend on libfarstream-0.1-dev
> - Depend on libfarstream-0.1-0 and xdg-utils

There is no point in having farstream in aMSN 0.98.9. Due to a
protocol change in the servers, it can't do anything useful with
farstream anymore (unless heavily hacked, but those who want to do it
should know how to recompile it). Indeed, I removed all
farstream/gstreamer dependencies.

> * debian/patches/08_use_aplay_for_sound.patch:
> - Use aplay from alsa-utils instead of play from sox for sounds

Ideally it should probably use snack instead. Thank you for pointing
this one out to me, I'll consider the best solution and fix it in
future package versions and maybe upstream too.

So, I personally think would be better to drop the debian/control delta and drop the aplay patch in a future release
---
Ubuntu Bug Squad volunteer triager
http://wiki.ubuntu.com/BugSquad

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Bug watches keep track of this bug in other bug trackers.