Bug 1069669 - gimp maintenance update removing gimp-help-browser cannot be installed non-interactively
Summary: gimp maintenance update removing gimp-help-browser cannot be installed non-in...
Status: RESOLVED DUPLICATE of bug 1071466
: 1069673 (view as bug list)
Alias: None
Product: openSUSE Distribution
Classification: openSUSE
Component: GNOME (show other bugs)
Version: Leap 42.3
Hardware: Other Other
: P5 - None : Major (vote)
Target Milestone: ---
Assignee: Federico Mena Quintero
QA Contact: Mr Maintenance
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2016-10222 871792 CVE-2013-2875 CVE-2014-1384 CVE-2014-4452 CVE-2014-4459 CVE-2014-4462 CVE-2015-1083 CVE-2017-7006
  Show dependency treegraph
 
Reported: 2017-11-23 21:28 UTC by Andreas Stieger
Modified: 2017-12-06 21:57 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2017-11-23 21:28:49 UTC
A SLE maintenance update for SUSE:SLE-12-SP2:Update/gimp was released that removed the gimp-help-browser subpackage:
https://build.opensuse.org/package/rdiff/SUSE:SLE-12-SP2:Update/gimp?linkrev=base&rev=2

This was intentional so as to remove the webkit dependency:

> - Don't build with webkit1, as it is no longer maintained and has
>   plenty of security bugs.  This disables the GIMP's built-in help
>   browser; it will use an external browser when configured this way.

As fare as I see, the gimp-help-browser binary package is not shipped on any SLE distribution, so the vulnerabilities never affected SLE. It is also why this did not fail any test for the below. The subpackage is however shipped on openSUSE Leap 42.2 and 42.3, where this breaks non-interactive patch installation.

$ zypper in -t patch 7514
[...]
Problem: gimp-2.8.18-6.2.x86_64 obsoletes gimp-help-browser provided by gimp-help-browser-2.8.18-4.4.x86_64
 Solution 1: replacement of gimp-help-browser-2.8.18-4.4.x86_64 with gimp-2.8.18-6.2.x86_64
 Solution 2: do not install patch:7514-1.noarch

Quoting from the spec:

Recommends:     %{name}-help-browser
Obsoletes:      gimp-help-browser
%package help-browser
[...]

(only the files section was actually removed)

This bugs tracks the issue in openSUSE where installing the patch does not work with the given package.
This is currently in https://build.opensuse.org/project/show/openSUSE:Maintenance:7514
Comment 1 Andreas Stieger 2017-11-24 06:01:12 UTC
*** Bug 1069673 has been marked as a duplicate of this bug. ***
Comment 3 Andreas Stieger 2017-11-28 08:37:20 UTC
Just a reminder that this fix is incomplete...
Comment 4 Andreas Stieger 2017-12-05 15:49:11 UTC
Another reminder that the gimp fix is incomplete.

Stopping in openSUSE maintenance queue.
Added this bug to the pending update list for SLE.

QAM: This issue does not affect SLE. However please ping maintenance@opensuse.org to maintenance the next build.
Comment 5 Andreas Stieger 2017-12-06 15:16:14 UTC
Will be solved in libzypp

*** This bug has been marked as a duplicate of bug 1071466 ***
Comment 6 Tony Mechelynck 2017-12-06 16:18:21 UTC
There has just been an update for gimp by a reissue of openSUSE Leap 42.3 Update-Test patch 7514 (cf. bug 1069673 and this bug's comment #0); it installed with no need for manual conflict resolution.

My libzypp is presently at version 16.17.4-15.1 and bug 1071466 is not yet RESOLVED FIXED. I guess this means that the symptom has been worked around for gimp (this bug) but that the underlying zypper issue is not yet cured (to avoid future recidivism). Of course I might have guessed wrong: I don't know what would have happened today if I hadn't installed previously the earlier version of the same patch.
Comment 7 Andreas Stieger 2017-12-06 21:28:50 UTC
I think you may have removed gimp-help-browser in the meantime. The issue remains, the resolution will be done via libzypp, which needs to be released prior to the gimp maintenance update.
Comment 8 Tony Mechelynck 2017-12-06 21:57:26 UTC
(In reply to Andreas Stieger from comment #7)
> I think you may have removed gimp-help-browser in the meantime. The issue
> remains, the resolution will be done via libzypp, which needs to be released
> prior to the gimp maintenance update.

Yeah, that is what happened, see near the end of bug 1069673 comment #0:

The following package is going to be REMOVED:
  gimp-help-browser