imagemagick is incorrectly set as a dependency - it should be recommended/a suggestion

tagged hplip because hplip is pulling in imagemagick as a dependency (?) - apologies if its not hplip but its cups instead.

Status changed to 'Confirmed' because the bug affects multiple users.

cups-filters (1.8.3-2ubuntu3) in Xenial has a new dependency on imagemagick (>= 6.4~). This is a change from Wily and earlier releases.

It looks like this was introduced upstream in cups-filters (1.4.0-1). Here is what the changelog says:

cups-filters (1.4.0-1) unstable; urgency=medium

[...]

  * Added dependencies on imagemagick (>= 6.4~), liblouisutdml-bin, and
    poppler-utils to cups-filters, as they are needed to convert images, text,
    and PDF to Braille, added antiword and docx2txt to Suggests: as they allow
    converting Word files to Braille

 -- Didier Raboud <email address hidden> Tue, 15 Dec 2015 11:04:23 +0100

Please change imagemagic to recommended or suggested dependency as are liblouisutdml-bin, antiwordm nd docx2txt

WHY?
Because imagemagic has tons of exploits
https://people.canonical.com/~ubuntu-security/cve/pkg/imagemagick.html

It should be HIGH priority!

Version number of dependency should be removed as well (IM 7.x came out in 2011!) as this prevents the replacement of IM with GM via graphicsmagick-imagemagick-compat

I attempted to submit a bug for that, but launchpad timed out and lost my essay-sized report :|

It may not be appropriate for this to be changed upstream, as Debian has different support timelines than Ubuntu.

TL;DR replace "imagemagick (>= 6.4~)" with "imagemagick"

To clarify the above, graphicsmagick-imagemagick-compat specifies "Provides: imagemagick" but Provides are ignored by dependency resolution when version numbers are specified.

From the debian policy document:

'If a relationship field has a version number attached, only real packages will be considered to see whether the relationship is satisfied (or the prohibition violated, for a conflict or breakage). In other words, if a version number is specified, this is a request to ignore all Provides for that package name and consider only real packages. The package manager will assume that a package providing that virtual package is not of the "right" version. A Provides field may not contain version numbers, and the version number of the concrete package which provides a particular virtual package will not be considered when considering a dependency on or conflict with the virtual package name.'

... one last clarification as well! If you're not familiar, graphicsmagick-imagemagick-compat provides a DROP-IN replacement for imagemagick, so it should be a safe change!

Moved imagemagick from Depends: to Recommends: and removed the version requirement in the Debian repository of cups-filters. So the fix will appear in one of the next Ubuntu packages of cups-filters.

This bug was fixed in the package cups-filters - 1.14.0-2

---------------
cups-filters (1.14.0-2) unstable; urgency=low

  * Migrate 1.14.0 to unstable

  [ Till Kamppeter ]
  * Moved dependency on ImageMagick to Recommends: and removed the
    version requirements, so that also graphicsmagick-imagemagick-compat
    can be used (LP: #1562560, Closes: #823110)

 -- Didier Raboud <email address hidden> Sun, 18 Jun 2017 16:56:02 +0200