Re: Status of axis in debian

Hi all,

Le 10/07/2024 à 15:52, Santiago Ruano Rincón a écrit :
> (Resending to the correct address list; sorry for the noise)
> 
> El 10/07/24 a las 10:41, Santiago Ruano Rincón escribió:
>> Dear Java packaging team,
>>
>> (Please CC: me when replying, I am not subscribed to the list)
>>
>> According to the apache advisory of CVE-2023-51441, axis 1.x has been
>> EOL'ed upstream:
>>
>> https://lists.apache.org/thread/8nrm5thop8f82pglx4o0jg8wmvy6d9yd
>>
>> According to the comment by grid on #debian-security, I understand it is
>> on life support upstream, and there have been fixes for CVEs the last
>> years, including at least one not-unimportant. However, from the above
>> mentioned advisory, upstream recommends to migrate to a "different SOAP
>> engine, such as Apache Axis 2/Java."
>>
>> On sid, this is the current list of build dependencies of libaxis-java:
>>
>> jalview
>> jets3t
>> jglobus
>> starjava-datanode
>> starjava-dpac
>> starjava-topcat
>> starjava-ttools
>> starjava-vo
>> starjava-votable
>> uimaj
>>
>> So my mail is just to start any discussion to see if it would be
>> appropriate to file bugs on the reverse dependencies, to ask the
>> maintainers if they could study how feasible is to migrate to another
>> SOAP engine.
>>
>> Any thoughts?

Thanks for raising this issue. My first feeling is filing these bug 
reports is sensible, unconditionally.

But also I wonder if we have some reasonable alternative to suggest in 
these bug reports:
- axis2 is unpackaged (could be) and its latest release is 2 years (+ 1 
day) old;
- saaj and jaxws: I can't say if they can provide an alternative to what 
axis does. Perhaps some people there have an opinion?
- Apache CXF, unpackaged as of now but seems to be actively maintained?
- something else?

Do others in the team have some ideas?

>>
>> Cheers,
>>
>>   -- Santiago
> 
> 

Best,

-- 
Pierre

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmaTzsUACgkQYAMWptwn
dHbn9g//Rg3CwbJncoWnGdVXYVMzN3D3dZOlJsiluyKHvF6DE5SSDVAnpj2iQ0iJ
isPQ4w4iGEVGltQj3cbG4fWwhnZ6heVnleLn8zoW60E4i9JcFGXo3MwOiPR8fZMc
LpbqUsHnHp6RoiKP9/YlVavNOIkA5SChl5FPG8vKeSbiOZ+IjZys/YkdlKOIQF2T
pxjW5Xf4NmDwa/Eaf+LzHAM1rlGNfeIA8fdYKjGADqFSgaZiYaM9w20jsxYZs8OU
tzFtuqRHHAjKAgBF6SIqLajN+zqABZvFCFhkWdiRVH+lOx5d1ZxDochpYjLsXoTr
RYZydj+4I8NXEhd+E95xmPxfA/mpoyNMRA6FcrtJ3lzpStHS3jqts8RkfpMihY3R
5mDezlUZIt1ZTSLF8ldBYrGoFLrCgCjiYXxQz0UEY1fGxMaYJU1209nQpSFUQcqg
WLdPEGksCyUMuw96Ul45greVFZegVmHJoVY/0mgrGWjoSzpA8RkyN4n1hntNSL1I
Cu6wylmLoew2OZb+XIfGgD0TIxmCd0PyU4ZEkcZlBmFccv0Gu1nOL3Nh+gqDhFR4
fvS//+fBjlvlcmycC7v7AaU9/1eG4LAMgYYMXvXlmtq+/9coyQK4VV0durgDNWXr
RbZqzOQGgxjD1LSgU7wE+NohIxh+r+zviw4JmifduJ1yUWMrb+c=
=b5JK
-----END PGP SIGNATURE-----