Bug#1057652: libghc-base64-dev: Segfaults on 32-bit architectures

[Trent W. Buck]

On Sat 08 Mar 2025 11:45:13 +0100, Francesco Poli wrote:
> I see that there's an upstream release (version 1.0) that should fix
> the upstream issue (which was re-opened for some perhaps-related
> unaligned read problem on Android, I am not sure whether this second
> perhaps-related problem is a concern for Debian supported architectures
> or not...).
>
> Would packaging version 1.0 fix this Debian bug?

Short version:

  * Commit v0.4.2.3-27-g5e38ef1 allegedly fixes the issue.

  * The last release on github is v0.4.2.3.

  * Hackage has v0.4.2.4 and v1.0, *but*
    I cannot see what git repo those come from!

  * I think Debian should ship 0.4.2.4 (or backport the commit),
    let things migrate, THEN worry about 1.0.


Long version follows.

I am a nosy bystander who just wants gitit ("what if pandoc, but a wiki") in Debian 14 (it's not in Debian 13 due to this bug).
I haven't touched Haskell for over a decade, so I'm working from first principles below.
Apologies if I miss something obvious.

I can see the commit which claims to fix this issue (debian #1057652) here:

    https://github.com/emilypi/base64/issues/56
    -> https://github.com/emilypi/base64/pull/57
    -> https://github.com/emilypi/base64/commit/5e38ef1fa4bdc9841c51be8c91c18e6b6ae0fbd3

The 1.0 package isn't visible here:

    https://github.com/emilypi/base64/releases

But it *is* visible here:

    https://hackage.haskell.org/package/base64

And I can see that *was* the emilypi codebase in an earlier release
(i.e. I'm not looking at the wrong hackage package entirely):

    https://hackage.haskell.org/package/base64-0.4.2.3

If there is a public git repo for the 1.0 codebase,
I cannot work out where it is.
The v1.0 metadata all still points to
https://github.com/emilypi/base64

Based on this file, I think if Debian bumps all the way to 1.0 it'll break apps/libraries expecting 0.4.x.
"many API-related constructs have changed"
"most likely a disruptive change"

    https://hackage.haskell.org/package/base64-1.0/src/MIGRATION-1.0.md

Therefore I think the order of operations should be:

    * find where 0.4.2.4 comes from
    * update debian/watch to that
    * get 0.4.2.4 into forky
    * let pandoc and gitit migrate
    * THEN mess around with 1.0

However I also noticed that pandoc is in Debian 13, so
maybe that had a more-clever solution that gitit can reuse?