Hi Otto,

I'm a bit disappointed. You told me that mariadb would stop using
libreadline-gplv2-dev in >= 10.4. While that's technically correct, it's
not the whole truth. In 10.5, mariadb has a vendor copy of it. Instead
of actually moving to a recent version, mariadb just added an embedded
code copy. The Debian policy discourages such copies. I don't think it
makes sense to reiterate the reasons.

Please figure out whether you can unembed readline. This may be
difficult to do and you may come to the conclusion that doing so is
infeasible. In that case, please register your copy with the security
tracker to enable the security team supporting mariadb.  Refer to
https://wiki.debian.org/EmbeddedCopies for details.

Helmut

Hello!

There is indeed in the sources extra/readline/.

Looking at upstream commit logs it has been there at least since 2014
(and traces of the same are in Oracle mysql sources too). This is not
something new that has been introduced in 10.5, but rather very old
legacy.

The cmake/readline.cmake file should ensure the system libedit is
always used in Debian.

I will experiment by removing the whole extra/readline/ from the
Debian sources and then file an issue about it upstream.

Hi Otto,

I stand corrected! I only managed to get into this situation by failing
to provide all relevant build-depends. My fault. It really does build
using the system libedit by default as can be seen from the buildd logs.

The only thing that you might want to consider changing is making it
harder to accidentally use the bundled readline.
prefer libedit when libedit is available.

I've attemped adding a "rm -Rf extra/readline" to override_dh_auto_clean
and that seems to just work. When you build a source package after
performing a binary package build you get a pile of warnings abouts
deleted files being ignored as a difference, but I'm used to that from
other packages already. Does that work for you?

Given the above, I see basically two options for moving forward:
 a) Close the bug with no action (as indeed the embedded copy is
    unused).
 b) Delete it during clean.

I'm happy with either choice.

Helmut

Hello!

I've experimented with trying to filter out extra upstream source
directories we don't like automatically in the git-buildpackage step
with filters in
https://salsa.debian.org/mariadb-team/mariadb-10.5/-/commit/f4214a4bee3f4f35ae31746c542cf54bfc9536f7

This would help fix both
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971005 and
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971367

Unfortunately the filter stanzas don't seem to have any effect then
the gbp import is running.

Noting this now down in the issues and will later return to debug why
git-buildpackage does not abide to the filter stanzas.

Dear submitter,

as the package mariadb-10.5 has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/1004944

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

MR https://salsa.debian.org/mariadb-team/mariadb-server/-/merge_requests/101
would potentially close this issue.