Dear Maintainer,

Your package embed a copy of yajl.

Could you:
- compile against the packaged yajl package
- remove by repacking the embded code copy in order to avoid accidental
compilation of the embed code copy

Thanks

Rouca

Hi,

I agree with un-embedding.

I spent some time trying, but did not find an unintrusive way to do so.
Adding OP_SYS_INCLUDES passes the compilation:

override_dh_auto_build:
         make LINKER_USE_RPATH=NO OP_SYS_INCLUDES=-I/usr/include/yajl

But I could not make the linker use the yajl library, arriving at the
following failure:

/usr/bin/g++ -o yajl_test
-L/home/merkys/epics-base-7.0.3.1/lib/linux-x86_64           -rdynamic 
-m64         yajl_test.o    -lCom
/usr/bin/ld: yajl_test.o: in function `main':
yajl_test.c:(.text.startup+0x62): undefined reference to `yajl_alloc'
/usr/bin/ld: yajl_test.c:(.text.startup+0xde): undefined reference to
`yajl_parse'
/usr/bin/ld: yajl_test.c:(.text.startup+0x119): undefined reference to
`yajl_complete_parse'
/usr/bin/ld: yajl_test.c:(.text.startup+0x129): undefined reference to
`yajl_free'
/usr/bin/ld: yajl_test.c:(.text.startup+0x212): undefined reference to
`yajl_config'
/usr/bin/ld: yajl_test.c:(.text.startup+0x26b): undefined reference to
`yajl_config'
/usr/bin/ld: yajl_test.c:(.text.startup+0x31b): undefined reference to
`yajl_config'
/usr/bin/ld: yajl_test.c:(.text.startup+0x343): undefined reference to
`yajl_config'
/usr/bin/ld: yajl_test.c:(.text.startup+0x374): undefined reference to
`yajl_get_error'
/usr/bin/ld: yajl_test.c:(.text.startup+0x39d): undefined reference to
`yajl_free_error'
/usr/bin/ld: yajl_test.c:(.text.startup+0x3fd): undefined reference to
`yajl_free'
collect2: error: ld returned 1 exit status
This should be doable when the build succeeds.

Best,
Andrius

following a different path...,

I added this in the rules file

Hi,

This is much better than my previous method, thanks!

It is worth checking whether these extra symbols are added locally, or
is this unmodified upstream source of yajl, but just a different version.

This is a solution, yes. But I would like to explore other options first.

Thanks a lot,
Andrius

Here the diff between the epics version (debian patch unapplyed) and the current 2.1.0 version of yajl (debian patch unapplyed).

not that simple...

Hi,

It seems EPICS authors have forked yajl and implemented JSON5 support
there. As a result, the code diverged quite much. I see no easy way to
resolve this now, alas.

Andrius

Here the upstream point of view about the CVE.

https://github.com/epics-base/epics-base/issues/405

check with the security team, if their analyse is ok ?

Fred