Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] current cvs version broken?

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Woolley <swoolley AT panasas.com>
  • To: David Brown <dmlb2000 AT gmail.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] current cvs version broken?
  • Date: Tue, 14 Mar 2006 10:37:28 -0800

David Brown wrote:
there have been several reports about current cvs version hanging on
checkouts of various stuff, among other nss and nspr which have been
switched to using snapshots instead of direct cvs checkouts because of
that.


I've seen this with the e17 packages and ffmpeg-cvs as well.


Apparently this is not caused by the cvs server as I thought but by our
version of the client. Downgrading to 1.12.12 or to the stable cvs tree
(1.11.21) fixes this.
Since 1.12.13 was a security update from 1.12.12, we can't just
downgrade, so we can either backport the security fixes from 1.12.13 to
1.12.12 (unless those are causing the problem of course ;) or switch our
spell to use the stable cvs tree. Switching to stable is what I would
prefer, but that will remove some features from our cvs version.
What do you think?


What were the security fixes? What are the set of conditions to
exploit the security hole? If they are really obscure we probably
could do a straight downgrade.


The vulns fixed were to use a new (more secure) internal zlib version. If we use the system zlib, we fix the issues and can keep the old version around. I suggest we remove the option to use the internal zlib version in the spell, use the system one, and merely downgrade it.

Seth

- David Brown
_______________________________________________
SM-Discuss mailing list
SM-Discuss AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/sm-discuss


--
Seth Alan Woolley
Software Engineer
Accelerating Time to Results(TM) with Clustered Storage

www.panasas.com
swoolley AT panasas.com
510-608-4382




Archive powered by MHonArc 2.6.24.

Top of Page