Bug#690849: downgrade fontconfig-config dependencies on fonts to Recommends:
Ivan Shmakov
ivan at siamics.net
Sat Jun 13 18:05:43 BST 2020
>>>>> On 2012-11-11 03:30:58 +0700, Ivan Shmakov wrote:
[…]
> It took longer than I expected, but I can confirm that neither
> extract(1), nor pdftotext(1) (both depending on libpoppler19 and thus
> fontconfig-config) require fonts to operate. (I presume that GNUnet
> “non-GUI” processes don't use fonts, either.)
FTR, I believe that GNUnet documentation at one point explicitly
recommended that separate binary packages are provided by
distributions, so that, for instance, the core server(s) would
/not/ depend on libextract (and thus libpoppler and libfontconfig.)
So far this recommendation isn’t implemented in Debian.
[…]
> To stress it out: due to the libpoppler19 ← libfontconfig1
> dependency, the latter may become a requirement on systems deployed
> to deal with PDF files (as in: search engine indexing.) Given that
> such a system may itself reside on a “virtual”, resource-limited
> (as in: a couple of GiB's of filesystem space) server, it may be
> entirely reasonable to try to save every MiB of the available FS space.
> That being said, ttf-bitstream-vera takes less than a MiB (as per
> Installed-Size:), so this issue could certainly be deferred until
> Wheezy is released. (And then perhaps the considerations above would
> no longer be of much importance.)
These days, my primary concern is the amount of code installed
on my systems, as that contributes heavily to their respective
‘attack surfaces’. With ttf-bitstream-vera being a pure data
package, which apparently knew no security issues (and none I’d
personally expect), I have no qualms about having it installed
on those of my systems where more comprehensive font packages
aren’t needed.
As such, and unless some further work is planned on this issue,
I suggest it be tagged wontfix.
--
FSF associate member #7257 http://am-1.org/~ivan/
More information about the Pkg-freedesktop-maintainers
mailing list