On Sun, May 11, 2014 at 09:38:06AM +0200, Nicolas Cellier wrote:
> 2014-05-11 9:18 GMT+02:00 Nicolas Cellier <
> nicolas.cellier.aka.nice at gmail.com>:
> 
> >
> > 2014-05-11 3:48 GMT+02:00 David T. Lewis <lewis at mail.msen.com>:
> >
> > On Sat, May 10, 2014 at 03:00:41PM -0700, tim Rowledge wrote:
> >> > There?s a related issue that could do with a fix sometime - the jpeg
> >> library we used to make the jepegreadwriteplugin is out of date and Debian
> >> (at least) considers that a security risk and thus they mangle the sources
> >> to not use those file but link to the ?standard? library. Which
> >> unfortunately doesn?t actually work within our plugin!
> >> >
> >> > Leaving aside the sheer rudeness of throwing unapproved ?patches? into
> >> somebody?s code (without ever letting Ian know, for example) and resulting
> >> in a broken function, I imagine that if looked into we would be able to
> >> tweak our plugin code to actually work with the new jpeg library code. This
> >> would be a Good Thing. If anyone knows enough about jpeg library, Debian,
> >> blah blah blah to look into this then it might make a nice project that
> >> would benefit the Raspberry Pi Scratch using world - several tens of
> >> thousands of kids in the UK alone.
> >> >
> >>
> >> This issue is tracked in Mantis 7539: "Plugins should use platform
> >> libraries
> >> where possible. Gentoo removed Squeak for this reason."
> >>
> >>    http://bugs.squeak.org/view.php?id=7539
> >>
> >> It was originally reported based on Gentoo rejecting Squeak, and it
> >> affects Debian
> >> and other Linux distributions that (quite reasonably) expect that
> >> supported
> >> applications should link to current versions of system libraries.
> >>
> >> If anyone is interested in working to improve this, please do. It would
> >> be a great
> >> way for someone to contribute a really useful update to the VM.
> >>
> >> Dave
> >>
> >>
> >>
> > A general idea would be to proceed in two steps:
> > -1) upgrade the library in squeak svn repository, so as to fix the API
> > evolutions mismatch
> > -2) provide a way to link to existing library (via cmake/configure in
> > VMMaker and apt/rpm package dependency at distrib level)
> >
> > Good plan, but what are the starting points?
> > Which library exactly should be used?
> > libjpeg - http://sourceforge.net/projects/libjpeg/ - which is the
> > successor of the library used in squeak is licenced GPL v2, should we taint
> > the whole VM?
> > There is also an opened issue (http://sourceforge.net/p/libjpeg/bugs/5/ -
> > 5 years old!!!) telling it does not compile on win32 (not sure which
> > compiler though, it might be MSVC only), so this might be a hurdle for step
> > 1).
> >
> > So what is the plan in details?
> >
> 
> Maybe http://www.openjpeg.org/ is a better match, BSD license... But it's
> huge.

The Mantis entry has links to the earlier discussions, so there is a good
summary of the issues there. I do not know what the detailed plan should be
but I think that we need two things:

1) Some platforms, probably including some unix platforms, need to use the
old jpeg library code that we keep in platforms/Cross/plugins/JPEGReadWriter2Plugin.
This must continue to work for the platforms that require it.

2) Other platforms, especially Linux distributions, would prefer to link
directly to the jpeg runtime library provided by the operating system.

There should be no GPL issues because linking to a runtime libjpeg is no
different from linking to any other runtime library on Linux.

It may be that the best way to achieve this is to provide different variants
of jpeg plugin in VMMaker. But I have not looked at this in detail, so I
cannot say what is the best approach.

Dave