Re: Staying on top of Qt security

2016-03-09 Thread Ricardo Wurmus
Andreas Enge writes: > On Sat, Mar 05, 2016 at 10:16:05PM +0100, Ricardo Wurmus wrote: >> We could ask drobilla for a new suil release. I don’t think we should >> package the development version as it’s not clear if dependent >> applications would work with the latest suil. > > Sounds good. Wou

Re: Staying on top of Qt security

2016-03-05 Thread Andreas Enge
On Sat, Mar 05, 2016 at 10:16:05PM +0100, Ricardo Wurmus wrote: > We could ask drobilla for a new suil release. I don’t think we should > package the development version as it’s not clear if dependent > applications would work with the latest suil. Sounds good. Would you like to do it, since you

Re: Staying on top of Qt security

2016-03-05 Thread Ricardo Wurmus
Andreas Enge writes: > On Thu, Feb 25, 2016 at 10:06:42AM +0100, Andreas Enge wrote: >> Probably we can: >> "jalv.qt (...) This is a versionm of Jalv with a GUI implemented in Qt. >> It is mainly for developer testing purposes, for a production ready program >> use jalv.gtk." > > Qt-4 support dr

Re: Staying on top of Qt security

2016-03-05 Thread Andreas Enge
On Thu, Feb 25, 2016 at 10:06:42AM +0100, Andreas Enge wrote: > Probably we can: > "jalv.qt (...) This is a versionm of Jalv with a GUI implemented in Qt. > It is mainly for developer testing purposes, for a production ready program > use jalv.gtk." Qt-4 support dropped in commit 03d55ee. This do

Re: Staying on top of Qt security

2016-02-25 Thread Andreas Enge
On Thu, Feb 25, 2016 at 10:38:32AM +0100, Ricardo Wurmus wrote: > > The suil package itself, however, depends on gtk+-2 _and_ qt-4. > > Do you think we could drop the qt-4 input? > We cannot know what toolkit the GUI of audio plugins will use. Suil > supports the three most popular ones so plugin

Re: Staying on top of Qt security

2016-02-25 Thread Ricardo Wurmus
Andreas Enge writes: > Hello, > > looking at why ardour depends on qt-4, I came across suil: > (description > "Suil is a lightweight C library for loading and wrapping LV2 plugin UIs. > Suil makes it possible to load a UI of a toolkit in a host using another > toolkit. The API is desig

Re: Staying on top of Qt security

2016-02-25 Thread Ricardo Wurmus
Andreas Enge writes: > Probably we can: > "jalv.qt (...) This is a versionm of Jalv with a GUI implemented in Qt. > It is mainly for developer testing purposes, for a production ready program > use jalv.gtk." I agree.

Re: Staying on top of Qt security

2016-02-25 Thread Andreas Enge
Probably we can: "jalv.qt (...) This is a versionm of Jalv with a GUI implemented in Qt. It is mainly for developer testing purposes, for a production ready program use jalv.gtk." Andreas

Re: Staying on top of Qt security

2016-02-25 Thread Andreas Enge
On Thu, Feb 25, 2016 at 09:35:45AM +0100, Andreas Enge wrote: > I find it unlikely that an application would need both of gtk+ and qt. Maybe I am wrong; jalv does depend on both... It creates binaries jalv.gtk and jalv.qt. If nobody uses the qt version, we could remove the input qt-4. Andreas

Re: Staying on top of Qt security

2016-02-25 Thread Andreas Enge
Hello, looking at why ardour depends on qt-4, I came across suil: (description "Suil is a lightweight C library for loading and wrapping LV2 plugin UIs. Suil makes it possible to load a UI of a toolkit in a host using another toolkit. The API is designed such that hosts do not need to ex

Re: Staying on top of Qt security

2016-02-22 Thread Andreas Enge
On Sun, Feb 21, 2016 at 02:28:37AM -0500, Leo Famulari wrote: > QJson is also used by libdbusmenu-qt. The latter is also gone with the KDE 4 module. It had no followers outside of it, but if it turns out to be needed somewhere else, we will have to think again. Andreas

Re: Staying on top of Qt security

2016-02-22 Thread Andreas Enge
On Thu, Feb 18, 2016 at 09:43:49PM +0100, Andreas Enge wrote: > So while we are it it, I suggest to simply remove kde.scm (there is no use > in keeping a lonely oxygen-icons around...). > Also, python2-pyqt has no dependent package. > If there is no outcry, I will remove the above-mentioned package

Re: Staying on top of Qt security

2016-02-22 Thread Leo Famulari
On Mon, Feb 22, 2016 at 08:53:39PM +0100, Andreas Enge wrote: > Sorry, Chris, that I bothered you with the state of pumpa; I was so convinced > that you were the packager that I did not even check! I suppose that I have > read too many of your blog posts to planet gnu; whenever I hear "federation"

Re: Staying on top of Qt security

2016-02-22 Thread Andreas Enge
Sorry, Chris, that I bothered you with the state of pumpa; I was so convinced that you were the packager that I did not even check! I suppose that I have read too many of your blog posts to planet gnu; whenever I hear "federation" or "pumpsomething" now, I think of you. On Sun, Feb 21, 2016 at 09:

Re: Staying on top of Qt security

2016-02-21 Thread Leo Famulari
On Sun, Feb 21, 2016 at 09:42:43AM -0800, Christopher Allan Webber wrote: > Leo Famulari writes: > > > On Sat, Feb 20, 2016 at 10:27:52AM -0800, Christopher Allan Webber wrote: > >> Andreas Enge writes: > >> > >> > On Thu, Feb 18, 2016 at 02:53:40PM -0800, Christopher Allan Webber wrote: > >> >>

Re: Staying on top of Qt security

2016-02-21 Thread Christopher Allan Webber
Leo Famulari writes: > On Sat, Feb 20, 2016 at 10:27:52AM -0800, Christopher Allan Webber wrote: >> Andreas Enge writes: >> >> > On Thu, Feb 18, 2016 at 02:53:40PM -0800, Christopher Allan Webber wrote: >> >> I'm assuming this was directed at me (though I don't work on Pumpa, but >> >> I could as

Re: Staying on top of Qt security

2016-02-20 Thread Leo Famulari
On Sat, Feb 20, 2016 at 10:27:52AM -0800, Christopher Allan Webber wrote: > Andreas Enge writes: > > > On Thu, Feb 18, 2016 at 02:53:40PM -0800, Christopher Allan Webber wrote: > >> I'm assuming this was directed at me (though I don't work on Pumpa, but > >> I could ask the author things... I do *

Re: Staying on top of Qt security

2016-02-20 Thread Efraim Flashner
On Thu, 18 Feb 2016 17:35:29 -0500 Leo Famulari wrote: > On Thu, Feb 18, 2016 at 09:43:49PM +0100, Andreas Enge wrote: > [...] > [...] > [...] > > > $ guix refresh -l qt-4 > > > Building the following 18 packages would ensure 24 dependent packages > > > are rebuil

Re: Staying on top of Qt security

2016-02-20 Thread Christopher Allan Webber
Andreas Enge writes: > On Thu, Feb 18, 2016 at 02:53:40PM -0800, Christopher Allan Webber wrote: >> I'm assuming this was directed at me (though I don't work on Pumpa, but >> I could ask the author things... I do *use* it every day though). What >> am I being asked here... I'm not sure? Whether

Re: Staying on top of Qt security

2016-02-18 Thread Andreas Enge
On Thu, Feb 18, 2016 at 02:53:40PM -0800, Christopher Allan Webber wrote: > I'm assuming this was directed at me (though I don't work on Pumpa, but > I could ask the author things... I do *use* it every day though). What > am I being asked here... I'm not sure? Whether Pumpa could be updated > to

Re: Staying on top of Qt security

2016-02-18 Thread Christopher Allan Webber
Andreas Enge writes: > Chris, what about pumpa? I'm assuming this was directed at me (though I don't work on Pumpa, but I could ask the author things... I do *use* it every day though). What am I being asked here... I'm not sure? Whether Pumpa could be updated to QT 5?

Re: Staying on top of Qt security

2016-02-18 Thread Leo Famulari
On Thu, Feb 18, 2016 at 09:43:49PM +0100, Andreas Enge wrote: > Hi Leo, > > thanks for your initiative! > > On Sun, Feb 14, 2016 at 03:01:43PM -0500, Leo Famulari wrote: > > I think we need a Qt champion(s) for Guix. > > I am not volunteering, mainly because I am not a Qt champion (but I am > in

Re: Staying on top of Qt security

2016-02-18 Thread Andreas Enge
Hi Leo, thanks for your initiative! On Sun, Feb 14, 2016 at 03:01:43PM -0500, Leo Famulari wrote: > I think we need a Qt champion(s) for Guix. I am not volunteering, mainly because I am not a Qt champion (but I am interested in the package). > $ guix refresh -l qt-4 > Bu

Staying on top of Qt security

2016-02-14 Thread Leo Famulari
It's been pointed out in the past that Qt [0] bundles many other softare distributions, making it more difficult to fully apply security updates. One would have to *know* what software was bundled and be sure to update the bundled copy along with the standalone copy. I asked for guidance on #qt [2