A serious bug in gutsy's scim and related packages

[Ming Hua]

[This is a rather long mail about the scim package, the input method for
non-English languages.  It's included in main and (IIRC) installed by
default for installs with East Asian (CJK) language supports.]

Dear Core developers,

Recently a bug [1] was brought to my attention about missing dependency
of the scim package in gutsy, causing crashes.  On closer inspection I
realized the bug is rather serious and potentially affects more than
just scim.  As the Debian maintainer of scim I would like to help fixing
this bug, but as I am rather detached from Ubuntu development these days
I need some help from you as well.

1. https://bugs.launchpad.net/ubuntu/+source/scim/+bug/139249


The problem
-----------

Short version:  An Ubuntu specific patch moved the library
/usr/lib/libscim-gtkutils-1.0.so.8.2.3 and its symlinks from libscim8c2a
package to scim-gtk2-immodule package (both are built from the scim
source package), but didn't change the shlibs handling at all.  As a
consequence the scim package, as well as other packages linked to
libscim-gtkutils-1.0.so.8, are missing the scim-gtk2-immodule
dependency.

Long version:

As the scim source package builds both the application/plugin packages
(scim, scim-modules-socket, scim-gtk2-immodule) and the library package
(libscim8c2a), the debian/rules has the "dpkg-makeshlibs -p libscim8c2a"
and "dpkg-shlibdeps -L libscim8c2a" lines to make sure the shlibs for
the shared libraries are correctly generated, and the ${shlibs:Depends}
for the other packages are correctly calculated.

Libscim8c2a package contains three shared libraries, libscim-1.0,
libscim-x11utils-1.0, and libscim-gtkutils-1.0.  Starting from dapper,
Ubuntu separates libscim-gtkutils-1.0 library files from libscim8c2a
package and puts them into scim-gtk2-immodule package.

Scim-gtk2-immodule package is actually a package for GTK+ IM module
files (the ones in /usr/lib/gtk-2.0/2.10.0/immodules/) and not really
the best place to put library files, and I don't think this move
achieves anything, but that's not the topic of this email.

So the problem is, the Ubuntu patch doesn't properly change debian/rules
to run "dpkg-makeshlibs -p scim-gtk2-immodule" as well or use
"dpkg-shlibdeps -L libscim8c2a -L scim-gtk2-immodule".  So the built
scim package includes binaries linked to libscim-gtkutils-1.0.so.8 but
does not depends on scim-gtk2-immodule.  Also, since scim-gtk2-immodule
doesn't ship a shlibs file, other packages that link to
libscim-gtkutils-1.0.so.8 will have missing dependency as well, for
example, the scim-modules-table package (file
/usr/lib/scim-1.0/1.4.0/SetupUI/table-imengine-setup.so).  The
scim-pinyin package manually adds scim-gtk2-immodule dependency to fix
this problem, but IMNSHO this is the wrong fix.

There are quite a few other packages that link to
libscim-gtkutils-1.0.so.8, many of them in main, but I haven't checked
one by one yet.  The symptom of this bug is mysterious crashes, as most
files linked to libscim-gtkutils-1.0.so.8 are plugin modules and are
dynamically loaded at runtime. 


Proposed solution
-----------------

The quick and dirty way:  Make scim depend on scim-gtk2-immodule.  As
most scim plugin/enhancement packages depend on scim anyway, this will
indirectly solve most (if not all) missing dependency problems.

The proper way:  Modify debian/rules to generate shlibs file for
scim-gtk2-immodule correctly.  Use proper "-L" options in scim package's
debian/rules so that scim picks up the correct dependency.  Rebuild all
packages that build-depend on libscim-dev to make sure they pick up the
correct dependency from shlibs file as well.


My time for Debian/Ubuntu is quite limited these days but I'm willing to
help and preparing patches.  But as I don't run gutsy (I have a pbuilder
sbuild tarball, but that's it), I can't test the patch properly.  Also I
can't upload to main.  So I need people to discuss and decide which way
to fix this, some testers running gutsy to test my patch, and a Core
developer to upload the fixed scim package and other rebuilds.

Thanks,
Ming
2007.09.15
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-devel/attachments/20070915/315e8b04/attachment.pgp