[From nobody Mon Aug 31 21:39:06 2026
Received: (at submit) by bugs.debian.org; 26 Sep 2020 06:34:31 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.2-bugs.debian.org_2005_01_02
 (2018-09-13) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.2 required=4.0 tests=BAYES_00,SPF_HELO_NONE,
 SPF_NONE,TXREP autolearn=ham autolearn_force=no
 version=3.4.2-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 10; hammy, 112; neutral, 36; spammy,
 2. spammytokens:0.866-+--disappointed, 0.857-+--truth
 hammytokens:0.000-+--H*F:U*helmut, 0.000-+--H*F:D*subdivi.de,
 0.000-+--H*RU:sk:helmut@, 0.000-+--H*rp:U*helmut,
 0.000-+--H*rp:D*subdivi.de
Return-path: <helmut@subdivi.de>
Received: from isilmar-4.linta.de ([136.243.71.142]:55374)
 by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.92) (envelope-from <helmut@subdivi.de>) id 1kM3mx-0002WW-08
 for submit@bugs.debian.org; Sat, 26 Sep 2020 06:34:31 +0000
Received: from isilmar-4.linta.de (isilmar.linta [10.0.0.1])
 by isilmar-4.linta.de (Postfix) with ESMTP id 67E9C200DF6
 for <submit@bugs.debian.org>; Sat, 26 Sep 2020 06:34:26 +0000 (UTC)
Date: Sat, 26 Sep 2020 08:26:29 +0200
From: Helmut Grohne <helmut@subdivi.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: mariadb-10.5: unregistered vendor copy of readline
Message-ID: <20200926062629.GA22593@alf.mars>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Reportbug-Version: 7.7.0
Delivered-To: submit@bugs.debian.org

Source: mariadb-10.5
Version: 1:10.3.24-2
Severity: important

Hi Otto,

I'm a bit disappointed. You told me that mariadb would stop using
libreadline-gplv2-dev in >= 10.4. While that's technically correct, it's
not the whole truth. In 10.5, mariadb has a vendor copy of it. Instead
of actually moving to a recent version, mariadb just added an embedded
code copy. The Debian policy discourages such copies. I don't think it
makes sense to reiterate the reasons.

Please figure out whether you can unembed readline. This may be
difficult to do and you may come to the conclusion that doing so is
infeasible. In that case, please register your copy with the security
tracker to enable the security team supporting mariadb.  Refer to
https://wiki.debian.org/EmbeddedCopies for details.

Helmut
]