[Pkg-gmagick-im-team] Bug#987504: imagemagick: attempt to perform an operation not allowed by the security policy `EPS'

[Salvatore Bonaccorso]

Hi Adrian,

On Sat, Apr 24, 2021 at 11:20:43PM +0300, Adrian Bunk wrote:
> Package: imagemagick
> Version: 8:6.9.11.60+dfsg-1.2
> Severity: serious
> Tags: ftbfs
> Control: found -1 8:6.9.10.23+dfsg-2.1+deb10u1
> Control: affects -1 src:ftgl src:foxtrotgps src:gri src:kannel src:mlpost src:muttprint src:ns3 src:sctk src:texworks-manual src:therion src:vlfeat src:x4d-icons src:xnee
> 
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/ftgl.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/foxtrotgps.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/gri.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/kannel.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/mlpost.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/muttprint.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/ns3.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/sctk.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/texworks-manual.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/therion.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/vlfeat.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/x4d-icons.html
> https://tests.reproducible-builds.org/debian/rb-pkg/buster/amd64/xnee.html
> 
> ...
> convert-im6.q16: attempt to perform an operation not allowed by the security policy `EPS' @ error/constitute.c/IsCoderAuthorized/408.
> convert-im6.q16: attempt to perform an operation not allowed by the security policy `EPS' @ error/constitute.c/IsCoderAuthorized/408.
> make[3]: *** [Makefile:931: screenshots/map-download.eps] Error 1
> 
> 
> A security change that went just went into imagemagick in unstable,
> but already went into imagemagick in buster last autumn,
> makes around a dozen packages FTBFS in unstable resp. buster.
> 
> Background:
> https://bugs.launchpad.net/ubuntu/+source/kannel/+bug/1838425
> 
> Options are either reverting the imagemagick change or fixing
> the packages that got broken in bullseye and buster.
> 
> Security and release teams are Cc'ed.

No time for a more lenghty reply to this right now, but our point was
exactly to bring the same patch (already applied in the last DSA) as
well in bullseye's version as this was missing and discussed back then
and recently with the maintainer as well.

If this is not the case yet, are bugs filled against those packages
you found to be failing to build now due to this change in stable and
unstable?

Regards,
Salvatore