[Debian-med-packaging] Bug#1130465: Bug#1134597: Please hint orthanc/1.12.11+dfsg-3 migration (force-badtest orthanc-wsi/3.3+dfsg-2)

[Sébastien Jodogne]

Hi,

> Unfortunately I can't really tell you what the exact solution should be 
> because I don't know how boost and orthanc work together. To avoid 
> breakage the expectations of orthanc on boost should be reflected in the 
> Depends. Maybe people better in figuring out library relations can jump 
> in? To avoid the issue in bug 1130465 I think a reasonable upper limit 
> is needed, to avoid the migration issue you're having now, you need a 
> better lower limit. How to pick/generate that, I don't know.

Orthanc is known to be compatible with Boost 1.69.0 (this is verified on 
our upstream integration servers), so I don't think #1130465 is a 
source-level problem because of an incompatible version of Boost, but 
rather a (maybe transient?) issue specific to Debian packaging.

As a consequence, until people familiar with library relations can 
investigate #1130465, I have just published a new version of orthanc 
(1.12.11+dfsg-4) with the minimum version dependency on Boost removed:

https://salsa.debian.org/med-team/orthanc/-/commit/4c9d89fe36d8354ae3b7b5d84068f5134dd3a0bf

I hope this will quickly put a version of Orthanc free of CVEs into testing.

Kind Regards,
Sébastien-