1

I am trying to install radare2 package. I have downloaded the .deb file from https://packages.debian.org/jessie/amd64/multiarch-support/download, and install it via apt: $sudo apt install -f ./libradare2-0.9.6_0.9.6-3.1+deb8u1_amd64.deb, but then:

 libradare2-0.9.6 : Depends: libradare2-common (>= 0.9.6-3.1+deb8u1) but it is not installable
E: Unable to correct problems, you have held broken packages.

So I did:

 $sudo apt install --fix-broken

but to no avail. So if there are dependencies, the package depends on, but apt cannot install them, what next? Should I have another source in source.list? my is :

deb http://deb.debian.org/debian/ buster main non-free contrib
deb-src http://deb.debian.org/debian/ buster main non-free contrib

deb http://security.debian.org/debian-security buster/updates main contrib non-free
deb-src http://security.debian.org/debian-security buster/updates main contrib non-free

# buster-updates, previously known as 'volatile'
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free

none of them has that package?

Improve this question
2
  • 1
    Why do you need libradare2? I ask this because the radare2 packages contain and actively exploit a known major Security Violation and in turn should not be used until Upstream acknowledges and stops exploiting this issue.
    – Thomas Ward
    Jun 4, 2020 at 0:16
  • Also, if you need radare2 packages you need to download them manually from Unstable. They will not migrate to Testing or new releases anymore because Upstream actively is suggesting their userbase find and design exploits to make the Debian versions vulnerable. So if you need radare2 you'll have to manually download the packages from Unstable per my answer.
    – Thomas Ward
    Jun 4, 2020 at 0:46

2 Answers 2

Reset to default
3

When you look specifically at radare2 packages, you are attemtping to install a single package and NOT its dependencies with the method you're using. This will cause issues because you're trying two things:

  1. You are trying to install a package manually that is NOT in your configured repositories for Buster, and

  2. You are not going to be able to get the dependencies properly in Buster because the package does not exist in Buster due to a bug that is policy breaking introduced. Which is why it has not been in the repositories since earlier versions due to a grave-severity security issue that has NOT been fixed and is actively being exploited by upstream

There has been zero response to inquiries with the maintainer or Upstream developers on this security issue outlined in Debian Security Bug #950372 and as such due to the upstream actively exploiting this bug, all versions of the radare2 packages have been removed from Debian, except for oldoldstable (which you should not be using).

If you really need the radare libraries and packages, you should consider downloading the source from upstream and compiling it, because the Debian packages require a newer libc6 than you will have in Debian Buster (in unstable).

At the time of this post, the version of the radare2 source package and its built binaries is 4.3.1+dfsg-1 (4.3.1 upstream). The Debian Package Tracker page for the radare2 source package that builds these binary packages you are trying to install will list current version numbers as well as the currently built binary versions in Unstable. However, this requires a newer version of the C libraries than Buster has, so you're better off installing this manually and manually compiling it from upstream source.

Under no circumstances should you use the older 0.9.6 variants of the package as they have gaping security holes (36 of them!) and you may be making your system vulnerable to attack if you use the older library versions as the upstream software developers actively have 'exploit bounties' out there egging people on to actively find and exploit the older software versions! (And to that end it has been decided by the Debian team and others that it is no longer suitable for stable Debian releases anymore, all's detailed in the earlier linked bugs)

Improve this answer
6
  • 1
    @A.B edited and rewritten to exclude the download instructions given this - with the recommendation to download and compile themselves from upstream. Because at this point that's really what they'll need to do since the package was removed and upstream actively exploits the older versions
    – Thomas Ward
    Jun 4, 2020 at 1:21
  • or I can still git cloned it from their repo and use install.sh to compile its all c source (libraries), which they recommend from theit README. But I wanted to install it as a debian package, not cloned it from github
    – Herdsman
    Jun 4, 2020 at 9:04
  • Anyway, for future downloading, If I download manually via dpkg, and met unistallable librearies, but they exist on some on upstream (that is - debian has not remove it from its source), then how to resolve that in general? How can apt find and download dependencies, that are unistallable?
    – Herdsman
    Jun 4, 2020 at 9:10
  • also, as downloaded and compiled from github, I need to have the folder with all scripts in one directory, otherwise it won't work. I cannot move the initial folder or make it hiddne, that is frustrated
    – Herdsman
    Jun 4, 2020 at 9:21
  • 1
    @Herdsman wiki.debian.org/SimpleBackportCreation. Pay attention to "Once you have downloaded the source, remove the sid entries from your apt sources"
    – A.B
    Jun 4, 2020 at 9:51
-1

libradare2-common can be downloaded from https://packages.debian.org/en/jessie/all/libradare2-common/download but there are instructions on that page about how to get the repository active on your system.

Improve this answer
2
  • thats where I tried to download
    – Herdsman
    Jun 3, 2020 at 21:22
  • You should not download the Jessie variants of the package. See my answer as it details some of the security concerns in it.
    – Thomas Ward
    Jun 4, 2020 at 0:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .