How to remove deb-multimedia.org (dmo) repo from LMDE 2

Archived topics about LMDE 1 and LMDE 2
User avatar
Fred Barclay
Level 12
Level 12
Posts: 4185
Joined: Sat Sep 13, 2014 11:12 am
Location: USA primarily

How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by Fred Barclay »

Split from viewtopic.php?f=242&t=226646
LMDE Betsy uses the deb-multimedia repository to add functionality for playing DVDs and multimedia files like .mp3's. While this does make playing these easier, it also can lead to a security risk due to the way that deb-multimedia "epochs" their package versions. This means that security updates provided by the Debian security team that impact software served from deb-multimedia do not make their way into LMDE 2, leaving some software vulnerable to openly-published exploits.

For example, in LMDE 2, VLC is provided from deb-multimedia and is at version 2.2.2. This version of VLC may be vulnerable to some of these exploits, even on Linux:
https://www.videolan.org/security/sa1601.html
https://www.exploit-db.com/exploits/38706/
https://cve.mitre.org/cgi-bin/cvekey.cg ... rd=VLC+2.2

Meanwhile, the Debian Security team has pushed VLC 2.2.4, which fixes these problems, to Debian Stable. However, since LMDE Betsy uses VLC from deb-multimedia, we don't get this update and are left with the vulnerable 2.2.2 version.

This is just one example out of many: on my personal machine, there were 16 separate packages from deb-multimedia that also had unapplied security updates from Debian. Not exactly what I wanted...

With this in mind, I'm providing this guide to removing all deb-multimedia packages, and (if possible) replace them with their Debian Jessie or LMDE Betsy counterparts so that you can get all security updates for them.
Please note that this is one example of the classic "Security or Stability" question. I can't promise that everything will work as you are used to immediately after following this guide; while I've had great results, yours might be a different situation. However, all of this is reversible so long as you follow the instructions carefully. 8)

(Note: for the rest of the guide I will use "deb-multimedia" and "dmo" interchangeably.)

To remove all DMO packages:
1. Disable the deb-multimedia repository. Since it is listed in /etc/apt/sources.list.d/official-package-repositories.list, you cannot simply use the Software Sources tool. Instead, you'll have to open the file with a text editor and comment out the repo.
Cinnamon:

Code: Select all

gksudo gedit /etc/apt/sources.list.d/official-package-repositories.list
MATE:

Code: Select all

gksudo pluma /etc/apt/sources.list.d/official-package-repositories.list
Comment out the deb-multimedia line to look like this: #deb http://www.deb-multimedia.org jessie main non-free.

2. Update apt:

Code: Select all

sudo apt-get update
3. See what you've got installed from dmo.

Code: Select all

dpkg -l | grep dmo
Once you've reviewed the list and made sure it contains all dmo packages and only dmo packages, assign it to a bash variable to save a lot of typing later:

Code: Select all

rmfiles=$(dpkg -l | grep dmo | awk '{print $2}')
Check the contents of $rmfiles and make sure it is correct. (Use echo $rmfiles so check the contents.) Highly recommended: I also copied the list of packages to a text file so that I had a permanent record of what I was removing, in case I needed to reverse myself.

4. Remove the dmo packages. Since apt wants to remove a lot of packages which depend on the dmo packages , some of which will break Mint if removed, use dpkg to force the removal of only the dmo packages.

Code: Select all

sudo dpkg -P --force-depends $rmfiles
5. Update apt:

Code: Select all

sudo apt-get update
You may get this warning:

Code: Select all

/usr/lib/apt/methods/https: error while loading shared libraries: librtmp.so.1: cannot open shared object file: No such file or directory
E: Method https has died unexpectedly!
E: Sub-process https returned an error code (127)
E: Method /usr/lib/apt/methods/https did not start correctly
If so, you probably have an additional repo that automatically redirects to an https site (step 4 temporarily broke apt-transport-https). You'll have to manually comment out the additional repos you've added until sudo apt-get update completes without a hitch.

6. Reinstall the missing dependencies. This will replace all the dmo dependencies removed in step 4 with dependencies from Debian Stable or LMDE Betsy.

Code: Select all

sudo apt-get install -f
After this finishes you can uncomment any addition repos that you commented out in step 5. Don't forget to sudo apt-get update afterwards!

At this point, you should be able to play any media file with VLC, and play .mp3's with the Video player (and probably any other media player in Mint). If you are happy with this, then you can stop here. On the other hand, if you want to be able to play common media files such as .mp4 videos with the Video player in Mint, then go on to step 7:

7. Reinstall all dmo packages that are also in Debian's or Mint's repos. Please note that this will not install any packages that are only in the deb-multimedia repo, such as libwresample; but only packages that were preinstalled in Betsy from deb-multimedia, were removed in step 4, and have equivalents in Debian's or Mint's repos, such as libmp3lame0.

Code: Select all

sudo apt-get install gstreamer1.0-libav libaacs0 libaudclient2 libchromaprint0 libdca0 libfaac0 libgegl-0.2-0 libhal1-flash libmjpegutils-2.1-0 libmp3lame0 libmpeg2encpp-2.1-0 libmplex2-2.1-0 librtmp1 libvamp-hostsdk3 libxvidcore4 libbasicusageenvironment0 libdvbpsi9 libavcodec56 libavfilter5 libavformat56 libavresample2 libavutil54 libbluray1 libebml4 libmatroska6 libswscale3
(Most of these were already reinstalled in step 6, but I'm listing them all for completeness.)

Congratulations! You've removed all DMO packages!

NOTES:
There are some packages in deb-multimedia that are not provided by Debian. I haven't needed 'em yet, and you might not either. If you do, I've got a complete list of these packages and I'll be happy to help you reinstall any of them. Particularly in this case, having a text file containing what you removed, as I recommended in step 3, will be most helpful!
Last edited by LockBot on Wed Dec 28, 2022 7:16 am, edited 3 times in total.
Reason: Topic automatically closed 6 months after creation. New replies are no longer allowed.
Image
"Once you can accept the universe as matter expanding into nothing that is something, wearing stripes with plaid comes easy."
- Albert Einstein
LMDE Enthusiast

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by LMDE Enthusiast »

While I have a bit of research to do on a few packages, for the most part, it appears as though you have helped immensely, Mr. Barclay! Fair dinkum, mate! Thanks.
User avatar
Fred Barclay
Level 12
Level 12
Posts: 4185
Joined: Sat Sep 13, 2014 11:12 am
Location: USA primarily

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by Fred Barclay »

Thanks mate. :) Let me know if I can help in any way.
Image
"Once you can accept the universe as matter expanding into nothing that is something, wearing stripes with plaid comes easy."
- Albert Einstein
ostracized

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by ostracized »

Hey Fred quick q, HEVC/H.265 files work in VLC after removing dmo?
Crewp

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by Crewp »

Thanks Fred, that is an awesome fix.
User avatar
Fred Barclay
Level 12
Level 12
Posts: 4185
Joined: Sat Sep 13, 2014 11:12 am
Location: USA primarily

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by Fred Barclay »

ostracized wrote:Hey Fred quick q, HEVC/H.265 files work in VLC after removing dmo?
I don't know (I don't have any)... if you want to attach a sample one here or PM/email it to me I'll check for you. :)
Image
"Once you can accept the universe as matter expanding into nothing that is something, wearing stripes with plaid comes easy."
- Albert Einstein
ostracized

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by ostracized »

Fred Barclay wrote:
ostracized wrote:Hey Fred quick q, HEVC/H.265 files work in VLC after removing dmo?
I don't know (I don't have any)... if you want to attach a sample one here or PM/email it to me I'll check for you. :)
The 5MB mkv test file on this site seems suitable as it plays on my mate box: http://www.h265files.com/
I've got a few other questions about LMDE and I might convert myself but I'll have to setup dual-booting for testing...I'll make another thread perhaps
User avatar
Fred Barclay
Level 12
Level 12
Posts: 4185
Joined: Sat Sep 13, 2014 11:12 am
Location: USA primarily

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by Fred Barclay »

I could play all of them perfectly but the "5 MB .mkv-File encoded in h265/HEVC" one, and I think that's a limitation of my machine rather than LMDE. It would play in VLC but it pushed my CPU to 100% so it had horrid graphics.

All the other ones (including "101 MB .mkv-File encoded in h265/HEVC") played just fine.
Image
"Once you can accept the universe as matter expanding into nothing that is something, wearing stripes with plaid comes easy."
- Albert Einstein
ostracized

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by ostracized »

Fred Barclay wrote:I could play all of them perfectly but the "5 MB .mkv-File encoded in h265/HEVC" one, and I think that's a limitation of my machine rather than LMDE. It would play in VLC but it pushed my CPU to 100% so it had horrid graphics.

All the other ones (including "101 MB .mkv-File encoded in h265/HEVC") played just fine.
Ok that's good to know, thanks. h.265 is a relatively new encoder that pushes older cpu's to the limit. My dual-core g3258 runs ~45% per video @1080p so I'm happy about it and it only cost me $45 (however it is overclocked to 4.6GHz :D ). And that's with "hardware acceleration" enabled in VLC which (theoretically) has access to an r9-280 gpu through default mesa drivers. The benefit of 265 over 264 is a pretty drastic reduction in file size (without quality reduction)...at the cost of higher cpu usage but "cheaper cpu's" older than ~ivy-bridge are going to have trouble playing the files.
KBD47
Level 7
Level 7
Posts: 1836
Joined: Fri Jul 29, 2011 12:03 am

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by KBD47 »

Much thanks Fred! I appreciate you taking the time to do this!
killer de bug

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by killer de bug »

Fred Barclay wrote:I could play all of them perfectly but the "5 MB .mkv-File encoded in h265/HEVC" one, and I think that's a limitation of my machine rather than LMDE.
Yes. My old dual core can't read this new codec. The CPU is running at 100% on both cores and overheating. :lol:
zorzi

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by zorzi »

Very good tutorial. Many thanks.

But I'm a little doubtful about some packages on my system, like amule or qmc2-mame which don't seem to be in the debian/betsy repos...
zorzi

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by zorzi »

Me again.

I followed the steps successfully but the newly installed packages (from the debian/betsy repos) appear now as "removable" in synaptic and in apt-get upgrade.

That is to say an apt-get autoremove would throw them away....

How to fix that ?

Thanks.
Zill

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by Zill »

zorzi: Not all the dmo packages have equivalents in the Debian repos. However, if you have now removed the dmo repo from your sources.list then it should be possible to replace most of the dmo packages with Debian packages.

In order to check your current repos, please open a terminal, maximize the window and post the full output of the following command:

Code: Select all

inxi -r
Then please advise which specific packages appear now as "removable".
zorzi

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by zorzi »

Hello and thank you for your reply

Code: Select all

nicolas@pc-2008 ~ $ inxi -r
Repos:     Active apt sources in file: /etc/apt/sources.list.d/additional-repositories.list
           deb http://httpredir.debian.org/debian jessie-backports main contrib non-free
           Active apt sources in file: /etc/apt/sources.list.d/official-package-repositories.list
           deb http://mint-mirror.gwendallebihan.net/packages betsy main upstream import
           deb ftp://debian.ens-cachan.fr/debian/ jessie main contrib non-free
           deb ftp://debian.ens-cachan.fr/debian/ jessie-updates main contrib non-free
           deb http://security.debian.org/ jessie/updates main contrib non-free
           deb http://extra.linuxmint.com betsy main
           Active apt sources in file: /etc/apt/sources.list.d/palemoon.list
           deb http://download.opensuse.org/repositories/home:/stevenpusser/Debian_8.0/ /
Here's the list of the packages:

Code: Select all

libcrypto++9 libcrystalhd3:i386 libgles1-mesa libgroupsock1 libid3-3.8.3c2a
  libid3tag0 liblivemedia23 libopencore-amrnb0:i386 libopencore-amrwb0:i386
  libopusfile0 libphonon4 libportmidi0 libpostproc52 libproxy-tools
  libsdl2-ttf-2.0-0 libtag-extras1 libusageenvironment1 libvlc5 libvlccore8
  libvo-aacenc0:i386 libvo-amrwbenc0:i386 libzvbi0:i386 phonon
  phonon-backend-vlc vlc vlc-data vlc-nox vlc-plugin-pulse
I replaced all I needed I think. All of these packages has been freshly installed following Fred's tuto. I just wonder if there's dependancies problem. Shall I mark them as manually installed to avoid accidental deleting ?
User avatar
Fred Barclay
Level 12
Level 12
Posts: 4185
Joined: Sat Sep 13, 2014 11:12 am
Location: USA primarily

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by Fred Barclay »

Hmmm... well, the good news is you've listed them all here so if they were accidentally removed, it should be easy to reinstall all of 'em. :)

I just checked and they're all available in debian's repos. Perhaps reinstalling them would help?

Code: Select all

sudo apt-get update
sudo apt reinstall libcrypto++9 libcrystalhd3:i386 libgles1-mesa libgroupsock1 libid3-3.8.3c2a libid3tag0 liblivemedia23 libopencore-amrnb0:i386 libopencore-amrwb0:i386 libopusfile0 libphonon4 libportmidi0 libpostproc52 libproxy-tools libsdl2-ttf-2.0-0 libtag-extras1 libusageenvironment1 libvlc5 libvlccore8 libvo-aacenc0:i386 libvo-amrwbenc0:i386 libzvbi0:i386 phonon phonon-backend-vlc vlc vlc-data vlc-nox vlc-plugin-pulse
Image
"Once you can accept the universe as matter expanding into nothing that is something, wearing stripes with plaid comes easy."
- Albert Einstein
zorzi

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by zorzi »

Perhaps reinstalling them would help?
Yeah, very good advice, everything seems ok now.

I still have to re-install one or two packages like amule which are only in the dmo repository. I may get a .deb file on the web, or exceptionally pick into the dmo repository, that should be the easiest way.

Thanks.

EDIT: Sorry, I'm wrong. Enabling the dmo repository again may "upgrade" packages from the debian/betsy repos to packages from the dmo again. Well, the better way would be to get some deb files. I'm right ?
Zill

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by Zill »

zorzi: As you have found out, it is not a good idea to restore the dmo repository if you don't want lots of other packages to be "upgraded" to dmo again!

If you really need a specific Debian application that was formerly in a dmo package then I suggest you will need to look at each one individually and ensure that all dependencies are met by current packages in the Debian jessie repos.

In the case of amule, it seems from this (rather old) thread that you may be able to install the Debian wheezy (old stable) package on your jessie (stable) system. http://forums.debian.net/viewtopic.php? ... 58#p553948
Download the wheezy amule-common and amule deb files directly from packages.debian.org and install them in that order with gdebi
Using gdebi, this will first verify that all dependencies are satisfied and, if so, will install the package. However, note that, without an associated repo, the package will be unmaintained and so will not receive any automatic updates, such as the rest of LMDE2 receives.

As a final "sanity check" after installing any packages via gdebi, I suggest running the usual "apt update" and "apt upgrade" commands and make sure you see the usual "four zeros" to confirm that everything is installed correctly:

Code: Select all

0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
zorzi

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by zorzi »

Thanks zill.

Finally, I re-enabled the dmo, just the time to re-install amule amule-common mame qmc2-mame qmc2-data, 5 packages only with no really need for updates in the future as these are only for minor uses.

Then I disabled the dmo repo.

Everything seems to work fine now.

Thanks everyone.
zorzi

Re: How to remove deb-multimedia.org (dmo) repo from LMDE 2

Post by zorzi »

Just to complete this topic, I would tell I've done a little bit of apt-pinning.

This may be a good solution to keep the debian-multimedia repo enabled with no upgrade risks on the Debian/Betsy distributions' packages.

Code: Select all

sudo pluma /etc/apt/preferences.d/dmo


And add these lines in the text file:

Code: Select all

Package: *
Pin: origin http://www.deb-multimedia.org
Pin-Priority: 99
Save the text file. Update your packages.

At last, the dmo stays enabled and upgrade only its own packages.
Locked

Return to “LMDE Archive”