Hello Harri,
Am 30.11.24 um 07:57 schrieb Harri Suutari:
Thanks for the info, Carsten
OK, it is normal to meet end of life with security updates. I think it
has not yet been reported on the Debian security announce mailing list
that support for 32-bit has been dropped. On Tue, 5 Nov 2024 it was only
mentioned that "This version is not yet available for the i386
architecture." (https://lists.debian.org/debian-security-announce/2024/
msg00217.html).
yes, there was no announcement about any dropped support. This is
intended as obviously only on bookworm we have a linking issue while
building the packages on other releases is working and we need and want
to fix this.
Observed that quickly looking at https://security-tracker.debian.org/
tracker/source-package/thunderbird would indicate that all is good for
Thunderbird in Bookworm, but if you go deeper (https://security-
tracker.debian.org/tracker/CVE-2024-11699) you can see the actual
version in the i386 is vulnerable.
Sure, it's logical that this version is vulnerable in bookworm as it's
simply not yet available in a recent enough version.
For me it was easy to upgrade to the patched 64-bit version:
(1:128.5.0esr-1~deb12u1)
# apt install thunderbird:amd64
Nitpicking, technically you have now Thunderbird for one of your
configured architectures updated, this is happen "only" for the
additional architecture on your system, not the main default architecture.
For some reason the language package is not compatible:
# apt install thunderbird-l10n-fi
You are requesting to install this package for your main default system,
this is still i386.
And on this architecture the needed version is not available. Thus you
see the message after the command was called.
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:
The following packages have unmet dependencies:
thunderbird-l10n-fi : Depends: thunderbird (<
1:128.5.0esr-1~deb12u1.1~) but it is not going to be installed
Depends: thunderbird (>= 1:128.5.0esr-1~deb12u1)
but it is not going to be installed
E: Unable to correct problems, you have held broken packages.
This is a somehow good example that adding more architectures to the
system can not solve all problems.
Your system is clearly able to run amd64, you should hardly consider to
switch to be fully safe for the future.
More and more packages will not become available for i386 in the future.
At the moment there isn't a debian-installer build anymore and some more
basic components aren't available too.
We've looked yesterday into the build logs on i386 again and hopefully
did found the root for the failure on bookworm systems.
There should be fixed and updated versions soon available. But please
don't expect a fix in the next days, maybe starting with 128.6.0.
--
Regards
Carsten
