Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

On Tue, Oct 11, 2005 at 06:49:16PM +0200, Ladislav Hagara wrote:
> >
> >
> >>>> Change 67748 by ladislav_hagara@lace-matrix on 2005/10/11 16:29:41
> >>>>
> >>>> openssl 0.9.8a integrated to stable-rc 0.3
> >>>> security fix: http://www.openssl.org/news/secadv_20051011.txt
> >>>> it should be probably integrated to stable
> >>>> problem 0.9.7g -> 0.9.8a, users of stable will have to recompile 
> >>>> all openssl related spells
> >>>
> >>> It looks like there is a 0.9.7h to fix this for the 0.9.7 branch,
> >>> perhaps stable should go to that instead?
> >>
> >> Personally I would integrated 0.9.8a to stable.
> >> Version 0.9.7h only postpone this "Big Recompilation".
> >> Version 0.9.8 was integrated to test grimoire on 2005/08/31.
> >>
> >> It depends on you. Next three days I will be off-line (Hamburg Linux
> >> Kongress).
> >
> > openssl 0.9.8 should wait for up_triggers to be in stable sorcery so the
> > upgrade is smooth. Integrating it to stable-rc was probably a mistake,
> > integrating it to stable would aflict all the pain and suffereing that
> > went along with what happened in test on people expecting stable to
> > actually be stable. Thats completely against the whole idea of stable.
> >
> > Use the 0.9.7 version, and i suggest security team thinks a little more
> > carefully about quality and using the minimal patchset for fixing issues
> > in stable. Not imposing a still fairly untested abi update on users.
> 
> 
> 
> Forwarded to sm-discuss so all developers/users know about openssl 
> security problem.
> Devel, test and stable-rc have already 0.9.8a version.
> Ad stable-rc) I only integrated from 0.9.8 to 0.9.8a.
> IMHO, "cast --fix" or "sorcery system-update" fixes all openssl related 
> problems.
> It depends on you.

Yes, cleanse --fix (there is not cast --fix) *can* fix the
problem. However if you review the ML traffic from when 0.9.8 hit test,
there were a number of unhappy campers. That was why we made up_triggers
which make the process a lot smoother. That has to get to stable sorcery
though, and give time for people to update.

Do you honestly think imposing the none up_trigger upgrades on all stable
users is a good thing? I sure dont.

-Andrew

-- 
_________________________________________________________________________
| Andrew D. Stitt  | acedit at armory.com    | astitt at sourcemage.org | 
| irc: afrayedknot | Sorcery Team Lead       |      ftp://t.armory.com/ |
| 1024D/D39B096C   | 76E4 728A 04EE 62B2 A09A 96D7 4D9E 239B D39B 096C  |
-------------------------------------------------------------------------