Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Tue, Oct 11, 2005 at 10:01:51AM -0700, Andrew wrote:
> On Tue, Oct 11, 2005 at 06:49:16PM +0200, Ladislav Hagara wrote:
> > >
> > >
> > >>>> Change 67748 by ladislav_hagara@lace-matrix on 2005/10/11 16:29:41
> > >>>>
> > >>>> openssl 0.9.8a integrated to stable-rc 0.3
> > >>>> security fix: http://www.openssl.org/news/secadv_20051011.txt
> > >>>> it should be probably integrated to stable
> > >>>> problem 0.9.7g -> 0.9.8a, users of stable will have to recompile 
> > >>>> all openssl related spells
> > >>>
> > >>> It looks like there is a 0.9.7h to fix this for the 0.9.7 branch,
> > >>> perhaps stable should go to that instead?
> > >>
> > >> Personally I would integrated 0.9.8a to stable.
> > >> Version 0.9.7h only postpone this "Big Recompilation".
> > >> Version 0.9.8 was integrated to test grimoire on 2005/08/31.
> > >>
> > >> It depends on you. Next three days I will be off-line (Hamburg Linux
> > >> Kongress).
> > >
> > > openssl 0.9.8 should wait for up_triggers to be in stable sorcery so the
> > > upgrade is smooth. Integrating it to stable-rc was probably a mistake,
> > > integrating it to stable would aflict all the pain and suffereing that
> > > went along with what happened in test on people expecting stable to
> > > actually be stable. Thats completely against the whole idea of stable.
> > >
> > > Use the 0.9.7 version, and i suggest security team thinks a little more
> > > carefully about quality and using the minimal patchset for fixing issues
> > > in stable. Not imposing a still fairly untested abi update on users.
> > 
> > 
> > 
> > Forwarded to sm-discuss so all developers/users know about openssl 
> > security problem.
> > Devel, test and stable-rc have already 0.9.8a version.
> > Ad stable-rc) I only integrated from 0.9.8 to 0.9.8a.
> > IMHO, "cast --fix" or "sorcery system-update" fixes all openssl related 
> > problems.
> > It depends on you.
> 
> Yes, cleanse --fix (there is not cast --fix) *can* fix the
> problem. However if you review the ML traffic from when 0.9.8 hit test,
> there were a number of unhappy campers. That was why we made up_triggers
> which make the process a lot smoother. That has to get to stable sorcery
> though, and give time for people to update.
> 
> Do you honestly think imposing the none up_trigger upgrades on all stable
> users is a good thing? I sure dont.

I've downgraded stable-rc to 0.9.7h and put the same in stable grimoire.

It will show up in the next stable update (stable-rc still isn't getting 
updates until I know the status of the perhaps lost private key).

Normally, if we didn't have up_triggers support in queue, I would say, 
perhaps, yes, let's upgrade to 0.9.8, but remember ABI changes make 
people not want to update.  0.9.7 being a non-ABI update means more 
people will update it.  I know a lot of people who cherry-pick their 
stable updates (well mostly myself!) on ultra stable systems.  Stable 
grimoire is a lot more stable, but it's not quite ultra stable yet.  

Anybody who wants 0.9.8a instead can use test grimoire for openssl 
temporarily.  Anybody who is going to do that who hasn't already updated 
openssl, please show your hands :).  If I asked that of 0.9.7h instead 
I'd see a lot more hands, I'm sure.

Seth

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgpmb2QqwfASV.pgp
Description: PGP signature