Security updates for bundled copies of libraries in Qt

[Mark H Weaver]

Andreas Enge <address@hidden> writes:
> In any case, feel free to implement a more modular qt, for me
> this is not a priority.

Fair enough, but consider this: IMO, the most severe problem with using
bundled copies of libraries has to do with security updates.  We have
yet to develop a security policy, but in my opinion we should not allow
software with known security flaws to remain in Guix for more than a
short time.  Either someone must take responsibility for applying
security fixes to a given package, or else that package should be
removed.  Does that make sense?

I've been doing my best to apply security fixes to Guix in a timely
fashion -- which turns out to be a big job and I could use more help --
but I'm *not* willing to do the duplicated work of applying the same
fixes to the bundled copies of libraries in Qt.  If our Qt packages are
going to use bundled copies of libraries, then someone needs to take
responsibility for applying security updates to those copies.

Any takers?

In the meantime, I honestly have no idea what security holes exist in
our Qt packages, so I've purged all software that depends on Qt from my
system.

      Mark