#1062105 android-libart: identified for time_t transition but no ABI in shlibs

Package:
android-libart
Source:
android-libart
Description:
Android Runtime
Submitter:
Steve Langasek
Date:
2024-05-08 12:21:05 UTC
Severity:
normal
#1062105#5
Date:
2024-01-31 11:24:32 UTC
From:
To:
Hi Jochen,

Analysis of the archive for the 64-bit time_t transition[0][1] identifies
android-libart as an affected package, on the basis that the headers could
not be compiled and analyzed out of the box using abi-compliance-checker[2],
so we have to assume it's affected.

However, android-libart's shlibs file declares a dependency on a library
package name that contains no ABI information:

$ cat DEBIAN/shlibs
libart 0 android-libart (>= 14.0.0+r15)
libdexfile_external 0 android-libart (>= 14.0.0+r15)
libdexfile_support 0 android-libart (>= 14.0.0+r15)
libsigchain 0 android-libart (>= 14.0.0+r15)
$

It is therefore not obvious that we should rename the package to
'android-libartt64' as part of this transition.

Looking at the archive, there are packages that depend on this library,
dexlist and dexdump.  Despite being built from the same source package, they
do not have a strict versioned dependency on android-libart but instead use
the shlibs.

Since there is no self-evident thing to do with the library package name
here, we will not be handling this package as part of the mass NMUs.
Instead I am filing a serious bug because partial upgrades from bookworm to
trixie on 32-bit architectures (upgrading android-libart without also
upgrading dex*) will result in ABI skew and may result in broken behavior.

Thanks,

#1062105#10
Date:
2024-05-08 12:09:35 UTC
From:
To:
control: severity -1 normal

Thanks for reporting!  In the Android Tools case, the shared libs and packages
that use them are packaged together, often from the same source package, so I
can't see why we'd need special versions of it. And when we need to, we can use
strictly versioned depends, so it should be fine. I'm going to set the bug to
normal for now.