[Bug 582189] Re: MIR: libisoburn needed for new grub2

[Colin Watson]

** Description changed:

- libisoburn will be needed for new versions of grub2 in maverick:
- specifically, grub-mkrescue calls xorriso now.  I'm filing this as a
- placeholder MIR, though haven't yet done the work required to fill out
- the details.
+ libisoburn is needed for new versions of grub2 in maverick:
+ specifically, grub-mkrescue calls xorriso now.  This was done because
+ genisoimage wasn't able to do some of the complicated things GRUB wants
+ to do in order to generate hybrid images bootable as both CD-ROMs and
+ USB simultaneously.  GRUB previously had an embedded and modified copy
+ of mkisofs in it, but this was obviously suboptimal; it now depends on
+ xorriso instead of embedding that code.
+ 
+ This also pulls in libburn and libisofs.  I've taken the liberty of just
+ adding tasks to this MIR bug for those, since they all come from the
+ same upstream project (http://libburnia-project.org/).  It's worth
+ noting that brasero in Debian is also configured to depend on libburn
+ and libisofs, so we may want to sync up with this too; this is part of a
+ project to gradually supersede cdrtools/cdrkit in general.
+ 
+ libisoburn is in universe, and I've tested that the xorriso binary
+ package it produces in maverick works well out of the box with grub-
+ mkrescue, without the need for any extra configuration work.
+ 
+ I found no security advisories for any of the keywords libisoburn,
+ xorriso, libburn, or libburnia, and there don't seem to be any
+ particularly security-sensitive components (set-id, daemons, etc.).  Of
+ course, xorriso will often be processing untrusted data in the form of
+ CD image contents.
+ 
+ To my eye all three packages look quite well-constructed and well-
+ maintained.  libisoburn has no bugs in Debian; libisofs has one wishlist
+ bug in Debian; libburn has two important bugs in Debian, which don't
+ seem particularly relevant to GRUB's use case at least.  None of them
+ have any Ubuntu bugs other than this one.  I think that for the most
+ part we can probably just keep these packages synced from Debian rather
+ than needing to invest much maintenance effort ourselves.

** Also affects: libisofs (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: libburn (Ubuntu)
   Importance: Undecided
       Status: New

** Summary changed:

- MIR: libisoburn needed for new grub2
+ MIR: libisoburn, libisofs, libburn

-- 
MIR: libisoburn, libisofs, libburn
https://bugs.launchpad.net/bugs/582189
You received this bug notification because you are a member of Ubuntu
Burning Team, which is subscribed to libburn in ubuntu.