I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Why does a web browser care so much about the particular versions of my multimedia libraries anyway?
On 2018-07-25 11:37, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Configure the packman repository to have a lower priority number than the default, 99, and try again.
On Wed, 25 Jul 2018 13:33:41 +0200 "Carlos E. R." robin.listas@telefonica.net wrote:
On 2018-07-25 11:37, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Configure the packman repository to have a lower priority number than the default, 99, and try again.
It already has.
* Dave Howorth dave@howorth.org.uk [07-25-18 08:19]:
On Wed, 25 Jul 2018 13:33:41 +0200 "Carlos E. R." robin.listas@telefonica.net wrote:
On 2018-07-25 11:37, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Configure the packman repository to have a lower priority number than the default, 99, and try again.
It already has.
then you didn't change the priority until after you had already subject packages.
as root (if not tumbleweed): zypper up -r <name or number of packman repo> --force
if tw: zypper dup -r <name...> --force
On 2018-07-25 14:17, Dave Howorth wrote:
On Wed, 25 Jul 2018 13:33:41 +0200 "Carlos E. R." robin.listas@telefonica.net wrote:
On 2018-07-25 11:37, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Configure the packman repository to have a lower priority number than the default, 99, and try again.
It already has.
Then, packages that are already installed can not change vendor on updates (unless you have allowed vendor change). Only when a new package gets automatically or manually installed there is a choice, a consideration where from to download them. And if packman has a lower number, they should come from there if they exist.
Op woensdag 25 juli 2018 14:23:03 CEST schreef Carlos E. R.:
On 2018-07-25 14:17, Dave Howorth wrote:
On Wed, 25 Jul 2018 13:33:41 +0200
"Carlos E. R." robin.listas@telefonica.net wrote:
On 2018-07-25 11:37, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Configure the packman repository to have a lower priority number than the default, 99, and try again.
It already has.
Then, packages that are already installed can not change vendor on updates (unless you have allowed vendor change). Only when a new package gets automatically or manually installed there is a choice, a consideration where from to download them. And if packman has a lower number, they should come from there if they exist.
I've never used 'priority', rather zypper dup --from [packman-repo-name].
Op woensdag 25 juli 2018 14:23:03 CEST schreef Carlos E. R.:
On 2018-07-25 14:17, Dave Howorth wrote:
On Wed, 25 Jul 2018 13:33:41 +0200
"Carlos E. R." robin.listas@telefonica.net wrote:
On 2018-07-25 11:37, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Configure the packman repository to have a lower priority number than the default, 99, and try again.
It already has.
Then, packages that are already installed can not change vendor on updates (unless you have allowed vendor change). Only when a new package gets automatically or manually installed there is a choice, a consideration where from to download them. And if packman has a lower number, they should come from there if they exist.
Priorities in YaST don't work anymore, as Freek de Kruijf stated some weeks ago.
On Wed, 25 Jul 2018 14:38:05 +0200 Knurpht-openSUSE knurpht@opensuse.org wrote:
Op woensdag 25 juli 2018 14:23:03 CEST schreef Carlos E. R.:
On 2018-07-25 14:17, Dave Howorth wrote:
On Wed, 25 Jul 2018 13:33:41 +0200
"Carlos E. R." robin.listas@telefonica.net wrote:
On 2018-07-25 11:37, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Configure the packman repository to have a lower priority number than the default, 99, and try again.
It already has.
Then, packages that are already installed can not change vendor on updates (unless you have allowed vendor change). Only when a new package gets automatically or manually installed there is a choice, a consideration where from to download them. And if packman has a lower number, they should come from there if they exist.
Priorities in YaST don't work anymore, as Freek de Kruijf stated some weeks ago.
I'm sorry but everybody seems to be missing the point. My question is not about repository priority. It's about what the hell is going on with this update!
I assumed that everybody else would have seen this update and be in a similar position to me. Is this not the case?
Where do people get libav* from? What versions do they have installed? (on Leap 15) What version, from where is the update proposing to you?
On Wednesday, 25 July 2018 22:31:26 ACST Dave Howorth wrote: [...]
I'm sorry but everybody seems to be missing the point. My question is not about repository priority. It's about what the hell is going on with this update!
I assumed that everybody else would have seen this update and be in a similar position to me. Is this not the case?
Where do people get libav* from? What versions do they have installed? (on Leap 15) What version, from where is the update proposing to you?
I always build ffmpeg and its associated libraries from the latest git head (as recommended by the project's developers). I have set it to taboo in Yast (i.e. Don't ever touch it). I usually update it (via a local script) every couple of months (sometimes more often if there is something on the mailing list that jumps out at me).
Op woensdag 25 juli 2018 15:01:26 CEST schreef Dave Howorth:
On Wed, 25 Jul 2018 14:38:05 +0200
Knurpht-openSUSE knurpht@opensuse.org wrote:
Op woensdag 25 juli 2018 14:23:03 CEST schreef Carlos E. R.:
On 2018-07-25 14:17, Dave Howorth wrote:
On Wed, 25 Jul 2018 13:33:41 +0200
"Carlos E. R." robin.listas@telefonica.net wrote:
On 2018-07-25 11:37, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Configure the packman repository to have a lower priority number than the default, 99, and try again.
It already has.
Then, packages that are already installed can not change vendor on updates (unless you have allowed vendor change). Only when a new package gets automatically or manually installed there is a choice, a consideration where from to download them. And if packman has a lower number, they should come from there if they exist.
Priorities in YaST don't work anymore, as Freek de Kruijf stated some weeks ago.
I'm sorry but everybody seems to be missing the point. My question is not about repository priority. It's about what the hell is going on with this update!
I assumed that everybody else would have seen this update and be in a similar position to me. Is this not the case?
Where do people get libav* from? What versions do they have installed? (on Leap 15) What version, from where is the update proposing to you?
I run zypper dup --from Packman_repo --allow-vendor-change This makes sure everything that also lives in Packman is being updated from Packman, And not from the OSS repo. What you see is the result of not doing a vendor switch , hence zypper sees updates from both repos and doesn;t know how to handle that, So it asks the sysadmin
On 2018-07-25 15:01, Dave Howorth wrote:
On Wed, 25 Jul 2018 14:38:05 +0200 Knurpht-openSUSE knurpht@opensuse.org wrote:
Op woensdag 25 juli 2018 14:23:03 CEST schreef Carlos E. R.:
On 2018-07-25 14:17, Dave Howorth wrote:
On Wed, 25 Jul 2018 13:33:41 +0200
"Carlos E. R." robin.listas@telefonica.net wrote:
On 2018-07-25 11:37, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
So I accepted the security update and it said it wants to 'conditionally update' (=install) libavutil56, libavcode58, libswresample3 and libavformat58.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
Configure the packman repository to have a lower priority number than the default, 99, and try again.
It already has.
Then, packages that are already installed can not change vendor on updates (unless you have allowed vendor change). Only when a new package gets automatically or manually installed there is a choice, a consideration where from to download them. And if packman has a lower number, they should come from there if they exist.
Priorities in YaST don't work anymore, as Freek de Kruijf stated some weeks ago.
I'm sorry but everybody seems to be missing the point. My question is not about repository priority. It's about what the hell is going on with this update!
I assumed that everybody else would have seen this update and be in a similar position to me. Is this not the case?
Where do people get libav* from? What versions do they have installed? (on Leap 15) What version, from where is the update proposing to you?
Legolas:~ # zypper patch --dry-run Loading repository data... Reading installed packages... Patch 'openSUSE-2018-758-1' is optional. Use 'zypper in patch:openSUSE-2018-758' to install it, or '--with-optional' to include all optional patches. Resolving package dependencies...
The following 5 items are locked and will not be changed by any action: Available: PackageKit ibus pk-update-icon plymouth Installed: gnome-packagekit
Nothing to do. Legolas:~ #
Let's see the optionals.
Legolas:~ # zypper patch --dry-run --with-optional --details Loading repository data... Reading installed packages... Resolving package dependencies...
The following 5 items are locked and will not be changed by any action: Available: PackageKit ibus pk-update-icon plymouth Installed: gnome-packagekit 3.26.0-lp150.1.9 x86_64 @System openSUSE
The following NEW package is going to be installed: libzimg2 2.7.4-lp150.2.1 x86_64 Main Repository (OSS) openSUSE
The following NEW patch is going to be installed: openSUSE-2018-758 1 noarch Main Update Repository maint-coord@suse.de
The following 9 packages are going to be upgraded: libavcodec57 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libavfilter6 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libavformat57 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libavresample3 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de * libavutil55 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de * libpostproc54 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libsodium23 1.0.16-lp150.2.5 -> 1.0.16-lp150.3.5.1 x86_64 Main Update Repository openSUSE libswresample2 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libswscale4 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de
9 packages to upgrade, 1 new. Overall download size: 6.7 MiB. Already cached: 0 B. After the operation, additional 974.3 KiB will be used. Continue? [y/n/...? shows all options] (y): Legolas:~ #
Or with "update":
Legolas:~ # zypper up --dry-run --details Loading repository data... Reading installed packages...
The following 5 items are locked and will not be changed by any action: Available: PackageKit ibus pk-update-icon plymouth Installed: gnome-packagekit 3.26.0-lp150.1.9 x86_64 @System openSUSE
The following 17 package updates will NOT be installed: gettext-runtime 0.19.8.1-lp150.12.1 x86_64 OBS: Emulators: Wine obs://build.opensuse.org/Emulators gettext-runtime-32bit 0.19.8.1-lp150.12.1 x86_64 OBS: Emulators: Wine obs://build.opensuse.org/Emulators haveged 1.9.2-lp150.134.1 x86_64 OBS: security obs://build.opensuse.org/security keyutils 1.5.10-lp150.59.61 x86_64 OBS: security obs://build.opensuse.org/security libargon2-1 0.0+git20171227.670229c-lp150.19.1 x86_64 OBS: security obs://build.opensuse.org/security libargon2-1-32bit 0.0+git20171227.670229c-lp150.19.1 x86_64 OBS: security obs://build.opensuse.org/security libbsd0 0.9.1-lp150.17.1 x86_64 OBS: security obs://build.opensuse.org/security libcap-ng0 0.7.9-lp150.41.63 x86_64 OBS: security obs://build.opensuse.org/security libhavege1 1.9.2-lp150.134.1 x86_64 OBS: security obs://build.opensuse.org/security libkeyutils1 1.5.10-lp150.59.61 x86_64 OBS: security obs://build.opensuse.org/security libkeyutils1-32bit 1.5.10-lp150.59.61 x86_64 OBS: security obs://build.opensuse.org/security liboauth0 1.0.3-lp150.3.1 x86_64 OBS: security obs://build.opensuse.org/security libpskc0 2.6.2-lp150.16.1 x86_64 OBS: security obs://build.opensuse.org/security libseccomp2 2.3.3-lp150.63.2 x86_64 OBS: security obs://build.opensuse.org/security libseccomp2-32bit 2.3.3-lp150.63.2 x86_64 OBS: security obs://build.opensuse.org/security libstoken1 0.81-lp150.11.1 x86_64 OBS: security obs://build.opensuse.org/security libxine2-pulse 1.2.9-lp150.134.1 x86_64 Ext: Packman http://packman.links2linux.de
The following NEW package is going to be installed: libzimg2 2.7.4-lp150.2.1 x86_64 Main Repository (OSS) openSUSE
The following 10 packages are going to be upgraded: google-chrome-stable 67.0.3396.99-1 -> 68.0.3440.75-1 x86_64 google-chrome Google Inc. libavcodec57 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libavfilter6 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libavformat57 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libavresample3 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de * libavutil55 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de * libpostproc54 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libsodium23 1.0.16-lp150.2.5 -> 1.0.16-lp150.3.5.1 x86_64 Main Update Repository openSUSE libswresample2 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de libswscale4 3.4.2-lp150.3.1 -> 3.4.4-lp150.6.1 x86_64 Ext: Packman http://packman.links2linux.de
10 packages to upgrade, 1 new. Overall download size: 58.5 MiB. Already cached: 0 B. After the operation, additional 5.9 MiB will be used. Continue? [y/n/...? shows all options] (y): Legolas:~ #
In all cases, they come from packman.
On Wed, 25 Jul 2018 18:20:56 +0200 "Carlos E. R." robin.listas@telefonica.net wrote:
In all cases, they come from packman.
It appears you have google-chrome installed, but not chromium?
I wonder how the security updates for google-chrome and chromium compare? Has google-chrome not patched whatever security issue caused the update to ffmpeg4, (and libavformat58) or did they get around it in some other way?
On 2018-07-25 19:06, Dave Howorth wrote:
On Wed, 25 Jul 2018 18:20:56 +0200 "Carlos E. R." robin.listas@telefonica.net wrote:
In all cases, they come from packman.
It appears you have google-chrome installed, but not chromium?
Correct.
I wonder how the security updates for google-chrome and chromium compare? Has google-chrome not patched whatever security issue caused the update to ffmpeg4, (and libavformat58) or did they get around it in some other way?
I think it plays multimedia internally.
Hello Dave,
On 07/25/2018 11:37 AM, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
See https://lists.opensuse.org/opensuse-updates/2018-07/msg00068.html
If you read the summary and description, the update contains a number of Chromium dependencies. If you do not use Chromium, you do not need to install the update, but you can. If you do use the openSUSE Chromium build and decide to install the associated security update released right thereafter, some of the of the ffmpeg dependencies *introduced* by the optional update will be pulled in. This is supposed to happen with a package based distribution with shared library dependency tracking. It is also an enabling feature for your to replace some of the Chromium run-time dependencies with those from Packman.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
The Packman project is expected to provides matching builds in due time.
Why does a web browser care so much about the particular versions of my multimedia libraries anyway?
Because of kitten videos.
Andreas
On Wed, 25 Jul 2018 16:43:02 +0200 Andreas Stieger astieger@suse.de wrote:
Hello Dave,
On 07/25/2018 11:37 AM, Dave Howorth wrote:
I've just got a 'security' update for chromium, together with an 'optional' update. The optional update lists a load of ffmpeg packages which on my system come from packman, not opensuse. So my instinct was to refuse the optional update.
See https://lists.opensuse.org/opensuse-updates/2018-07/msg00068.html
If you read the summary and description, the update contains a number of Chromium dependencies. If you do not use Chromium, you do not need to install the update, but you can. If you do use the openSUSE Chromium build and decide to install the associated security update released right thereafter, some of the of the ffmpeg dependencies *introduced* by the optional update will be pulled in. This is supposed to happen with a package based distribution with shared library dependency tracking. It is also an enabling feature for your to replace some of the Chromium run-time dependencies with those from Packman.
That would mean I have a mixture of libav* components from packman and opensuse. Is that wise? What is supposed to happen here?
The Packman project is expected to provides matching builds in due time.
Why does a web browser care so much about the particular versions of my multimedia libraries anyway?
Because of kitten videos.
Andreas
Thanks Andreas, we're getting closer. But it's not the optional update I'm talking about; I turned that down. It's the updates (actually completely new installs) in the security update. My libav* comes from packman; this update wants to install new libav* files from opensuse. Surely that is going to bork my system?
There are no corresponding files on packman, AFAIK.
Hi Dave,
On 07/25/2018 05:31 PM, Dave Howorth wrote:
But it's not the optional update I'm talking about; I turned that > down. It's the updates (actually completely new installs) in the >
security update. The Chromium update requires libraries that were previously not available. These libraries were also introduced as part of the optional update. So Chromium will pull in the new packages it needs. The remaining parts of the optional update will remain untouched until you choose to install them.
My libav* comes from packman; this update wants to install new libav* > files from opensuse. Surely that is going to bork my system? No,
these are new libraries with separate and different names that can be installed in parallel.
There are no corresponding files on packman, AFAIK.
The will get around to that.
Andreas
On Wed, 25 Jul 2018 17:38:46 +0200 Andreas Stieger astieger@suse.de wrote:
Hi Dave,
On 07/25/2018 05:31 PM, Dave Howorth wrote:
But it's not the optional update I'm talking about; I turned that > down. It's the updates (actually completely new installs) in the >
security update. The Chromium update requires libraries that were previously not available. These libraries were also introduced as part of the optional update. So Chromium will pull in the new packages it needs. The remaining parts of the optional update will remain untouched until you choose to install them.
My libav* comes from packman; this update wants to install new libav* > files from opensuse. Surely that is going to bork my system? No,
these are new libraries with separate and different names that can be installed in parallel.
Hmm, the report on the packman list about what actually happens seems to contradict your optimism. I will continue to hold off on updating chromium until this gets sorted.
There are no corresponding files on packman, AFAIK.
The will get around to that.
Andreas
On Wed, Jul 25, 2018 at 4:43 PM Andreas Stieger astieger@suse.de wrote:
Because of kitten videos.
:):)
-
Andreas Stieger -
Carlos E. R. -
Dave Howorth -
Knurpht-openSUSE -
Patrick Shanahan -
Rodney Baker -
Roger Oberholtzer