[MIR] exfat-utils and fuse-exfat

Bug #1649537 reported by Jeremy Bicha on 2016-12-13
50
This bug affects 16 people
Affects Status Importance Assigned to Milestone
exfat-utils (Ubuntu)
Undecided
Ubuntu Security Team
fuse-exfat (Ubuntu)
Undecided
Unassigned

Bug Description

Availability
============
Synced with Debian and it's intended for this to stay in sync. Built for all supported architectures.

Rationale
=========
udisks2 (2.1.7-3) unstable; urgency=medium

  * Promote exfat-utils from Suggests to Recommends. The exFAT file system is
    more widely used these days so we want to have support installed by
    default. (Closes: #812467)

exFAT is commonly used on larger USB drives or SD cards; in many cases pre-formatted that way from the manufacturer

Security
========
One open security issue for Ubuntu 14.04:
https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8026.html

https://security-tracker.debian.org/tracker/source-package/exfat-utils
https://security-tracker.debian.org/tracker/source-package/fuse-exfat

Quality assurance
=================
- Please subscribe Ubuntu Desktop Bugs to this package.

https://bugs.launchpad.net/ubuntu/+source/exfat-utils
https://bugs.launchpad.net/ubuntu/+source/fuse-exfat
https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=exfat-utils
https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=fuse-exfat
https://github.com/relan/exfat/issues

(Fairly low number of bugs except for 24 open against Ubuntu's fuse-exfat

No upstream tests, no autopkgtest

Dependencies
============
check-mir reports all other dependencies are in main

Standards compliance
====================
3.9.8

Maintenance
===========
- Actively developed upstream
https://github.com/relan/exfat/releases
https://github.com/relan/exfat/commits/master

- Packages seems to be well-maintained in Debian. dh compat 9. short "dh7" rules. Not team maintained.

Background information
======================

Jeremy Bicha (jbicha) on 2016-12-13
Changed in fuse-exfat (Ubuntu):
status: New → Incomplete
Jeremy Bicha (jbicha) on 2016-12-13
description: updated
Changed in fuse-exfat (Ubuntu):
status: Incomplete → New
Changed in exfat-utils (Ubuntu):
status: Incomplete → New
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in exfat-utils (Ubuntu):
status: New → Confirmed
Changed in fuse-exfat (Ubuntu):
status: New → Confirmed
Michael Terry (mterry) on 2016-12-15
Changed in exfat-utils (Ubuntu):
assignee: nobody → Ubuntu Security Team (ubuntu-security)
Jeremy Bicha (jbicha) wrote :

Because this was not processed yet and zesty will be released soon, I have dropped udisks2's Recommends on exfat-utils to a Suggests.

https://launchpad.net/ubuntu/+source/udisks2/2.1.8-1ubuntu1

Sebastien Bacher (seb128) wrote :

The exfat filesystem is under Microsoft patents and they don't allow free use, see https://www.microsoft.com/en-us/legal/intellectualproperty/mtl/exfat-licensing.aspx

It means it's likely not installable by default in Ubuntu so unsure there is a point trying to get it in promoted...

Matthias Klose (doko) wrote :

based on the last comment, closing this as won't fix.

Changed in exfat-utils (Ubuntu):
status: Confirmed → Won't Fix
Changed in fuse-exfat (Ubuntu):
status: Confirmed → Won't Fix

The Microsoft page referenced explicitly says:

It is important to note that open source and other publicly available implementations of exFAT do not include a patent license from Microsoft. A license is required in order to implement exFAT and use it in a product or device.

Please re-open and fix.

Colin Watson (cjwatson) wrote :

@valorie-zimmerman: That seems to say that the FUSE exFAT implementation doesn't *include* a patent license, but that it would nevertheless *require* one in order to incorporate it into a product. As such it seems unsafe to include it in Ubuntu. You're quoting it as if it contradicts this, which I don't see that it does, but maybe I'm missing something; could you please elaborate on what you think Ubuntu can fix here?

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers