Secure testing team - Aug 2009 - Proposed additions to embedded-code-copies

Hello,

Here''s a list of embedded code copies that I''m aware of, but
which are
not currently listed in the embedded-code-copies file:

* pdf2djvu embeds a small (40 lines or so) excerpt from poppler: the 
SplashOutputDev::convertPath() method.

* mercurial embeds a module from python-urlgrabber (see #531062).

* python-mechanize embeds an old version (2.1.1) of 
python-beautifulsoup.

* atheme-services, libbsd-arc4random-perl, isakmpd embed parts of 
* libbsd.

You may consider adding these entries.

-- 
Jakub Wilk

On Sat, Aug 08, 2009 at 12:38:21PM +0200, Jakub Wilk
wrote:
> Hello,
> 
> Here''s a list of embedded code copies that I''m aware of,
but which
> are not currently listed in the embedded-code-copies file:
> 
> * pdf2djvu embeds a small (40 lines or so) excerpt from poppler: the
> SplashOutputDev::convertPath() method.
> 
> * mercurial embeds a module from python-urlgrabber (see #531062).
> 
> * python-mechanize embeds an old version (2.1.1) of
> python-beautifulsoup.
> 
> * atheme-services, libbsd-arc4random-perl, isakmpd embed parts of *
> libbsd.
> 
> You may consider adding these entries.
Thanks! Commited (w/o the pdf2djvu buglet, which looks harmless to me).

Did you spot these by hand/knowing about them or do have an automated
script, which found them?

Cheers,
        Moritz

[Please keep me on Cc, I''m not subscribed.]

* Moritz Muehlenhoff <jmm at inutil.org>, 2009-08-08,
13:50:
>> Here''s a list of embedded code copies that I''m aware
of, but which
>> are not currently listed in the embedded-code-copies file:
>>
>> * pdf2djvu embeds a small (40 lines or so) excerpt from poppler: the
>> SplashOutputDev::convertPath() method.
>>
>> * mercurial embeds a module from python-urlgrabber (see #531062).
>>
>> * python-mechanize embeds an old version (2.1.1) of
>> python-beautifulsoup.
>>
>> * atheme-services, libbsd-arc4random-perl, isakmpd embed parts of *
>> libbsd.
>>
>> You may consider adding these entries.
>
>Thanks! Commited (w/o the pdf2djvu buglet, which looks harmless to me).
Looks harmless to me, too. (I''m the upstream of pdf2djvu.)
>Did you spot these by hand/knowing about them or do have an automated
>script, which found them?
I found instances of embedding libbsd by searching for arc4random.c in 
the Debian source code search engine[1] and manually filtering out 
unrelated files.

As for the other ones, I spotted them while reading/fixing their code.

[1] http://walrus.rave.org/source/

-- 
Jakub Wilk

Hello,

Here''s another handful of embedded copies:

* hg-git embeds dulwich (see #541996).

* hugin and enblend-enfuse embed libvigraimpex.

-- 
Jakub Wilk"

On Mon, Aug 17, 2009 at 12:16:07PM +0200, Jakub Wilk
wrote:
> Hello,
> 
> Here''s another handful of embedded copies:
> 
> * hg-git embeds dulwich (see #541996).
> 
> * hugin and enblend-enfuse embed libvigraimpex.
Thanks, added to SVN.

Cheers,
        Moritz

* Moritz Muehlenhoff <jmm at inutil.org>, 2009-08-17,
20:25:
>> Here''s another handful of embedded copies:
>>
>> * hg-git embeds dulwich (see #541996).
>>
>> * hugin and enblend-enfuse embed libvigraimpex.
>
>Thanks, added to SVN.
I cannot see enbled-enfuse on the list...

Anyway, I filed bugs against hugin (#542259) and enblend-enfuse 
(#542258).

-- 
Jakub Wilk