[Debian-med-packaging] Bug#973612: Bug#973612: I'm afrait I did some kind of sabotage by upgrading civetweb ... [karsten.hilbert at gmx.net: Bug#973612: orthanc: libcivetweb version mismatch]

[Sébastien Jodogne]

Hello,

After some investigation, I think that this issue comes from the fact
that the "libcivetweb1" package (as of version 1.13+dfsg-2) doesn't
contain a symbolic link from "libcivetweb.so.1" to "libcivetweb.so.1.13.0".

Because of this missing symbolic link, Orthanc is linked against one
single version of the civetweb shared library (namely,
"libcivetweb.so.1.13.0"), and this library might be unavailable if an
earlier version of "libcivetweb1" was installed beforehand (in Karsten's
case, "libcivetweb.so.1.11.0"), even if the two versions are binary
compatible.

I feel like this corresponds to the warning
"package-name-doesnt-match-sonames" that was reported by Lintian.

In order to solve this issue, I've just submitted a new release of
civetweb (1.13+dfsg-3) that creates the missing symbolic link
"libcivetweb.so.1" by appropriately setting the SOVERSION in CMake,
which required a patch [1].

When Orthanc will be compiled against this new version of civetweb, it
should hopefully be linked against "libcivetweb.so.1" instead of
"libcivetweb.so.1.13.0", making it compatible with a whole range of
versions of civetweb, and it should thus be possible to upgrade civetweb
without breaking Orthanc. If this is indeed the case, I'll soon be able
to make a new release of Orthanc that fixes this issue.

These thoughts might seem trivial to many of you, but I wanted to share
them if someone else meets a similar problem in another context.

Best Regards,
Sébastien-

[1]
https://salsa.debian.org/med-team/civetweb/-/commit/ccb62139b6139ea6efc2432c12018de6e3c16003


On 3/11/20 14:11, Andreas Tille wrote:
> [including the list again]
> Hi Sébastien,
> 
> On Mon, Nov 02, 2020 at 04:39:31PM +0100, Sébastien Jodogne wrote:
>> To be fair, I am unsure to understand the issue and how to fix it...
>>
>> Should I simply modify the "Build-Depends" of the orthanc package to the
>> fix the version of civetweb to 1.13 (i.e. "libcivetweb-dev (= 1.13)")? Or
>> set "Depends" to "libcivetweb1 = 1.13"?
> 
> I do not think so.  The packaging process will usually set versioned
> depends correctly.  Moreover at least in theory orthanc should work with
> both libcivetweb1 versions (1.12 and 1.13) since the soversion was not
> bumped.  To verify this I added a symbols file to 1.12 first and after
> checking that there are only some new symbols in 1.13 I considered it
> harmless to upload (which was obviously wrong).
>  
>> This sounds very strange to me: I would have expected that, as the orthanc
>> package was built against civetweb 1.13 (which is implied by the fact that
>> ldd on "/usr/sbin/Orthanc" indicates "libcivetweb.so.1.13.0"), its
>> "Depends" should have automatically been set to "libcivetweb1 >= 1.13"
>> (whereas ">= 1.12" is found in the .deb package).
> 
> I confirm that the build really injects libcivetweb1 (>= 1.12).  I need
> to admit that I do not know those internals but I would assume that as
> long as the soversion is unchanged the smallest possible version number
> is used here.  But I'm unsure.  I think if for whatever reason >= 1.13
> is needed than this has to be specified explicitly.  But please note
> that I never faced this before and clarifying this on debian-mentors
> might be advisable.
> 
>> Please could you explain it to me?
> 
> Not better than above, sorry. :-(
> 
> Kind regards
> 
>        Andreas.
>  
>> On Mon, 2 Nov 2020 at 15:36, Andreas Tille <tille at debian.org> wrote:
>>
>>> Hi Sébastien,
>>>
>>> hopefully that can easily be fixed - sorry for the inconvenience
>>>
>>>      Andreas.
>>>