Processed: bookworm-pu: package xsane/0.999-12.1~deb12u1

[Debian Bug Tracking System]

affects -1 + src:xsane

Bug #1083004 [release.debian.org] bookworm-pu: package xsane/0.999-12.1~deb12u1
Added indication that 1083004 affects src:xsane

[Jonathan Wiltshire]

Control: tag -1 moreinfo

As discussed in https://bugs.debian.org/1076101 , package
xsane has a Recommends: firefox | www-browser relationship for
its binary package. As package firefox does not appear in
Debian Stable or Debian Testing, installing xsane will introduce
other packages that provides www-browser virtual package, causing
unexpected consequences.

Is the recommendation firefox, or any browser which complies with
www-browser? It seems odd to recommend any browser and then complain that
it causes unexpected consequences.

The known side effect is that the default
Debian Bookworm LXQt installation introduces package hv3 as
www-browser provider, which is an unmaintained web browser that
is dangerous if provided as default internet browser. Further details
are discussed in the Debian bug report 1076101.

Perhaps some thought should be given to whether hv3 belongs in stable if it
is "dangerous" and unmaintained? I don't see any bug reports against it,
although it's been removed from sid and testing already which is never a
good sign.

I don't really have a good idea what you mean by "dangerous" here.

To avoid further surprises for Debian LXQt users, modifying the
recommendation to Recommends: firefox-esr | firefox | www-browser
is a reasonable mitigation. This change is now present in Debian
Unstable as xsane/0.999-12.1.

As above, I question whether there should be a recommendation on
www-browser at all if that breaks things.


Please remove the moreinfo tag when you respond.

Thanks,

[Debian Bug Tracking System]

Post by Jonathan Wiltshire
tag -1 moreinfo

Bug #1083004 [release.debian.org] bookworm-pu: package xsane/0.999-12.1~deb12u1
Added tag(s) moreinfo.

[Jonathan Wiltshire]

Control: tag -1 confirmed

Please let me know what is your favorable way to proceed. We can alter the
package recommendation for xsane in Stable (but www-browser rec should be kept),
or remove hv3 from Stable, or do both.

Let's go with your proposed change for xsane in any case, and please liaise
with the security team and the maintainer about hv3. If it's agreed that it
should be pulled from stable, open a separate bug in the normal way and I
would not have an issue with removing it.

You can go ahead with xsane whenever you're ready.

Thanks,

[Debian Bug Tracking System]

tags -1 -moreinfo

Bug #1083004 [release.debian.org] bookworm-pu: package xsane/0.999-12.1~deb12u1
Removed tag(s) moreinfo.

[Debian Bug Tracking System]

tag -1 confirmed

Bug #1083004 [release.debian.org] bookworm-pu: package xsane/0.999-12.1~deb12u1
Added tag(s) confirmed.

[Jonathan Wiltshire]

package release.debian.org
tags 1083004 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==============

Package: xsane
Version: 0.999-12.1~deb12u1

Explanation: add Recommends for firefox-esr as well as firefox

[Debian Bug Tracking System]

Your message dated Sat, 11 Jan 2025 11:03:09 +0000
with message-id <E1tWZGn-009jcb-***@coccia.debian.org>
and subject line Close 1083004
has caused the Debian Bug report #1083004,
regarding bookworm-pu: package xsane/0.999-12.1~deb12u1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ***@bugs.debian.org
immediately.)