[Pkg-javascript-devel] V8 depends from outdated and unmaintained libv8 with security issues

[Jérémy Lal]

Le ven. 8 févr. 2019 à 10:31, Jeroen Ooms <jeroen at berkeley.edu> a écrit :

> On Fri, Feb 8, 2019 at 9:44 AM Jérémy Lal <kapouer at melix.org> wrote:
> >
> >
> >
> > Le ven. 8 févr. 2019 à 07:36, Jeroen Ooms <jeroen at berkeley.edu> a écrit
> :
> >>
> >> For those following this discussion: there is now a version of
> >> r-cran-v8 that uses libnode-dev in sid. Is there anything we need to
> >> do to get r-cran-v8 back in buster?
> >>
> >
> > Hi Jeroen,
> >
> > your work made me realize the debian nodejs source package might just
> need
> > to provide a libv8-dev package with headers in /usr/include/v8 and a
> pkgconfig
> > file that tell to use -lnode ?
> > Would that be all ?
>
> That would be absolutely fantastic, yes.  Also a symlink from
> libv8.so-> libnode.so woulde be handy, because libv8 doesn't use
> pkg-config anywhere else so most bindings just test for linking with
> -lv8.
>

Ok then no pkgconfig and a symlink instead.
I suppose i need to ask a removal of libv8 from unstable (it's removed from
testing) to
be able to "take" libv8-dev. Or maybe declare a libv8-in-nodejs-dev package
?
In any case i don't know if i should make a libv8-xx package (which would
basically be
symlinks to libnode).
Any advice is welcome...

Jérémy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20190208/4059b3d8/attachment.html>