Skip to Content.
Sympa Menu

sm-users - [SM-Users] zlib security update recompiles X, etc, some needed, some not.

sm-users AT lists.ibiblio.org

Subject: Sourcemage Users List

List archive

Chronological Thread  
  • From: Seth Woolley <seth AT tautology.org>
  • To: sm-users AT lists.ibiblio.org, "" <sm-discuss AT lists.ibiblio.org>, "" <sm-grimoire AT lists.ibiblio.org>
  • Subject: [SM-Users] zlib security update recompiles X, etc, some needed, some not.
  • Date: Wed, 19 Mar 2003 15:58:26 -0800 (PST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Please note that I added a patch to the zlib spell for a security update.
If you are updating, note that it will try to recompile the xfree86 spell
because of an on_cast zlib clause in xfree86.

I'm not even sure this is necessary, because I couldn't find any
references to zlib in the compile log except that it installed headers
for zlib into its install directory. This would mean that it must
symbolically link to it, if it links to it at all (ldd on X didn't reveal
that X was linked to X).

This notice is not related to the "recompile affected spells now" dialog
which is separate to the trigger system in sorcery. Please say "yes" to
that, as it supposedly finds statically-linked binaries. It appears to do
its job better than the triggers, so I'd urge the spell maintainers of
spells that have on_cast zlib triggers and are symbolically-linked to zlib
to consider removing them (openssh, gd (might have been my fault), for
example) if they can determine that they aren't used statically to save
people's time.

To get around this, just say no to the triggers of spells that you feel
like checking later. But do not just say no to all the triggers. The
zlib script may be imperfect and I have no way of knowing if all the
triggers are not needed and the zlib search script is perfect. The
maintainer of the spell may know better than the script, or it may be
located where the script does not look. To be on the safe side, let it
recompile all the spells anyways ;).

If you have any questions, talk about this in sm-grimoire (where I added
Reply-to and Mail-Followup-to headers ;). I and the people more expert
than I can answer on that list :).

Seth
Security Team Leader

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+eQQl7fQ833vqzH0RApsMAKCtGAkiiaZzLsWiPAH3AIh+QipDJwCfZTXb
5AmaM9win4Vkj4fN5bdkAsE=
=aYmc
-----END PGP SIGNATURE-----



  • [SM-Users] zlib security update recompiles X, etc, some needed, some not., Seth Woolley, 03/19/2003

Archive powered by MHonArc 2.6.24.

Top of Page