Bug 1449135 - kdelibs3: switch to libidn2
Summary: kdelibs3: switch to libidn2
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: kdelibs3
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Than Ngo
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: fedora28-switch-to-idna2008
TreeView+ depends on / blocked
 
Reported: 2017-05-09 09:31 UTC by Nikos Mavrogiannopoulos
Modified: 2017-06-21 07:27 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-06-21 07:27:22 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Nikos Mavrogiannopoulos 2017-05-09 09:31:43 UTC
Description of problem:
Internationalized domain names exist for quite some time (IDNA2003), although the protocols describing them have evolved in an incompatible way (IDNA2008). These incompatibilities will prevent applications written for IDNA2003 to access certain problematic domain names defined with IDNA2008, e.g., faß.de is translated to domain xn--fa-hia.de with IDNA2008, while in IDNA2003 it is translated to fass.de domain. That not only causes incompatibility problems, but may be used as an attack vector to redirect users to different web sites.

The change is about deprecating libidn, which supports IDNA2003, and switch all applications using libidn, to libidn2 2.0.0, which supports IDNA2008. The switch should be transparent as the libidn2 library is API compatible. See instructions at:
https://libidn.gitlab.io/libidn2/manual/libidn2.html#Converting-from-libidn


This is part of the IDNA2008 change:
https://fedoraproject.org/wiki/Changes/IDNA2008

If upstream is not aware of that change please involve them on the process.

Comment 1 Kevin Kofler 2017-05-09 09:45:41 UTC
Why don't you make idna.h a symlink to or a transitive #include of idn2.h (which is supposed to be a drop-in replacement) instead of forcing us to change every single package using the library?

Comment 2 Nikos Mavrogiannopoulos 2017-05-09 10:46:20 UTC
I was not involved in the original upstream decision to have separate libraries, however there are uncommon but still legitimate reasons to stay with libidn on certain applications (e.g., which require stringprep, or require IDNA2003).

Comment 3 Kevin Kofler 2017-05-09 11:40:27 UTC
The symlink or forwarding header could be shipped by Fedora packaging.

Comment 4 Than Ngo 2017-06-21 07:27:22 UTC
it's fixed in kdelibs3-3.5.10-85.fc27


Note You need to log in before you can comment on or make changes to this bug.