Trying to upgrade pidgin to version 2.6.2:

# apt-get -t testing --no-install-recommends install pidgin
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
  gstreamer0.10-nice gstreamer0.10-plugins-bad gstreamer0.10-plugins-base
  gstreamer0.10-plugins-good libavc1394-0 libcdaudio1 libdc1394-22 libexempi3
  libfftw3-3 libgmyth0 libgssdp-1.0-1 libgstfarsight0.10-0 libgupnp-1.0-2
  libgupnp-igd-1.0-2 libiec61883-0 libiptcdata0 libnice0 libofa0 libopenspc0
  libproxy0 libpurple0 libsoundtouch1c2 libsoup-gnome2.4-1 libtheora0
  libvisual-0.4-0 libwildmidi0 pidgin-data
Suggested packages:
  libfftw3-dev evolution-data-server
Recommended packages:
  gvfs gstreamer0.10-x libvisual-0.4-plugins freepats
The following NEW packages will be installed:
  gstreamer0.10-nice gstreamer0.10-plugins-bad gstreamer0.10-plugins-base
  gstreamer0.10-plugins-good libavc1394-0 libcdaudio1 libdc1394-22 libexempi3
  libfftw3-3 libgmyth0 libgssdp-1.0-1 libgstfarsight0.10-0 libgupnp-1.0-2
  libgupnp-igd-1.0-2 libiec61883-0 libiptcdata0 libnice0 libofa0 libopenspc0
  libproxy0 libsoundtouch1c2 libsoup-gnome2.4-1 libvisual-0.4-0 libwildmidi0
The following packages will be upgraded:
  libpurple0 libtheora0 pidgin pidgin-data
4 upgraded, 24 newly installed, 0 to remove and 659 not upgraded.
Need to get 16.4MB of archives.
After this operation, 19.2MB of additional disk space will be used.

Would it be possible to reduce the dependencies? If the gstreamer stuff is
required by some plugin, for example, could it be packaged separately?

tags 550891 +wontfix
thanks

Unfortunately it's either all or nothing with gstreamer and purple,
given that the voice & video support was not made as a plugin.

Hi,
would it be an option to forward this upstream instead of
tagging it wontfix? I find the rationale behind this request
pretty understandable. I don't want this as well and I guess
quite some other users feel the same.

Cheers
Nico

forcemerge 550891 550918
thanks

The finch package does not depend directly on any X packages. It
depends on gstreamer for VoIP support, which is linked into the main
finch binary. To remove that dependency, gstreamer support would have
to be removed entirely from both finch and libpurple, and I am not
thrilled with the idea of having two separate libpurple packages.
There is a bug open upstream to try to rectify the situation, but I
expect it won't go anywhere unless someone else writes a patch.

In the effort to reduce the pidgin dependencies, I wrote a patch to
dynamically load libfarstream only if it is installed. I never coded
with GObjects and so only during the testing to finish the patch I
realized that there is no need to modify the code. Only the package
dependencies should be reworked. In fact libpurple depends on
libfarstream (855kB), that depends on the gstreamer plugins (65,5MB),
but they are dynamically loaded only if installed[1] and they are needed
only to make voice and video calls with Gtalk (only voice with finch).

I patched the libfarsteram package and tested it with pidgin on a Gtalk
account. No crash or errors reported and the voice/video calls menu
entries are disabled but visible. The farstream transmitters plugins
are loaded dynamically too, so there is no need to install gssdp,
gupnp, nice and soup libraries if they are not used.

I also patched the pidgin package to remove the gconf dependency, as it
is needed only with Gnome (that installs it) to get the automatic
configuration[2] for audio, video and url-handlers. Also the finch
package uses gconf for audio configuration, while the libpurple package
uses gconf for the proxy one. Finally finch does not require
pidgin-data (25,7MB), but it is used only if installed for sounds,
translations and the /etc/purple/prefs.xml file (that should go instead
in the libpurple package).

The patch attached should fix the bug, reducing by 2/3 the disk space
requirements for pidgin (36,9MB / 10 packages instead of 102,4MB / 78
packages) and by 9/10 for finch (9,1MB / 8 packages instead of
100,3MB / 77 packages). The depends fields are replaced with recommends
or suggests for the optional packages, conforming to the policy manual
rule 7.2. No breakage is excepted because since the 0.7.17 version of
Apt, the recommended packages are installed by default.

There are other packages that depend on libfarstream and that may need
to add the gstreamer plugins in the dependency fields (like empathy and
gajim) according to the changes, but I will provide patches later.

All the patches applies on the wheezy version, but the jessie packages
are affected too.

ciao

References:
1. http://lists.freedesktop.org/archives/farstream-devel/2012-April/000015.html
2. https://developer.pidgin.im/ticket/11191

Patches:
1. nogst: to be applied to the wheezy debian packages i386
2. backend_module: not useful, but included as reference (ver. 2.10.7)

Thanks for the patch. For the patch to the libpurple source, can you try
to get it merged with pidgin upstream? I don't really trust myself to
maintain a far-reaching patch that I didn't write, since I am not an
expert on the upstream source.
As far as the patch to Debian control files, unfortunately I can't use
that as-is because it will only apply to the auto-generated version,
which will change with any new build. Can you create a patch that I can
apply against the full extracted debian source (e.g. apt-get source
pidgin), and create a separate bug for farstream? Ideally it will obtain
the correct dependency versions automatically (probably via
debian/rules) instead of hardcoding them in the control file.

- Ari

The patch on the libpurple source code is not useful, because it does
not add any real functionality that is not already present, as the
gstreamer/farstream libraries do the dynamic loading work of their
plugins. So there is no need to patch the code. I have included it only
as a reference and an alternative way to circumvent the problem in the
future.

Please to correct me, but I think I should not create a separate
bug for farstream, as this bug report describes the problem found in
the farstream package, that affects the pidgin package (and others), but
it is not a bug of pidgin itself. It should be reassigned and the
previous mail was CC'ed to the farstream maintainers for that reason.

The patch to the pidgin/finch debian packages only adds descriptions
for the optional packages and refine some other dependency like gconf,
pidgin-data and the gstreamer-plugins missed.

I would make the patches against the full debian source, but actually I
do not exactly understand how, as for example gconf is not mentioned in
the depends field of the control file. It will take to me some day to
learn the debian helper architecture, meanwhile I wanted to write here
my findings.

I need to do further testing to know exactly which gstreamer-plugins
are required to make voice/video calls or simply to play sounds. In
fact, according to the specifications, gstreamer-plugins-bad is needed
to make a video call on Gtalk, but I have no hardware or counterpart to
test it at the moment. Also gstreamer-nice may be needed but missed in
my patch and gstreamer-plugins-good should be required not only to make
voice calls, but also to decode the .wav files of pidgin-data. Finally,
the position of /etc/purple/prefs.xml in the pidgin-data package is
correct, I was in error.

The patch provided in my previous mail can anyway be applied to do
some testing and to fix the bug for the users that read this bug log
and cannot wait. It can be applied with these commands for every
debian package modified (libfarstream, pidgin, finch):

$ dpkg-deb -R libfarstream-0.1-0_0.1.2-1_i386.deb libfarstream
$ cd libfarstream
$ patch -p1 < ../nogst.patch
$ rm DEBIAN/control.*
$ cd ..
$ dpkg-deb -b libfarstream libfarstream-0.1-0_0.1.2-1+nogst_i386.deb
$ sudo dpkg -i libfarstream-0.1-0_0.1.2-1+nogst_i386.deb

Sorry for my bad english if I was unclear, I should write more code and
less english :)

ciao!

Please reconsider this request.

Installing an instant messaging app should not quietly pull in
gstreamer1.0-plugins-bad

  GStreamer Bad Plug-ins is a set of plug-ins that aren't up to par
  compared to the rest. They might be close to being good quality, but
  they're missing something - be it a good code review, some
  documentation, a set of tests, a real live maintainer, or some actual
  wide use.

This increases the attack surface of the entire system, for
functionality which is probably not even being used.

https://scarybeastsecurity.blogspot.cz/2016/11/0day-exploit-compromising-linux-desktop.html

Note that the description for pidgin does not even mention video or
audio chat capability. If nothing else, it would be reasonable to have
one package for text-only pidgin built without farstream/gstreamer and a
separate package (with more discussion of the implications) that enables
that functionality and pulls in the dependency tail--so users can make
an informed decision about what they want to do.

Mike Stone