Re: be careful with Replaces, please

1997-12-04 Thread Brian White
> > Nope, didn't seem to be flagged for install on my end. I would have > > suggested keeping the same name and conflicting with the versions of dump > > and quota that would have depended on the libraries. > > OK. I think I'll change the name back to "e2fsprogs", and just make it > conflict w

Re: be careful with Replaces, please

1997-12-03 Thread Yann Dirson
Scott Ellis writes: > Nope, didn't seem to be flagged for install on my end. I would have > suggested keeping the same name and conflicting with the versions of dump > and quota that would have depended on the libraries. OK. I think I'll change the name back to "e2fsprogs", and just make it co

Re: be careful with Replaces, please

1997-12-02 Thread Scott Ellis
On Tue, 2 Dec 1997, Yann Dirson wrote: > Scott K. Ellis writes: > > BTW, is there a particular reason that e2fsprogs got renamed to > > e2fsprogsg? This seems to be the biggest chance to completely screw over > > someone's system in all of Debian now. > > Yes: e2fsprogs used to contain shared

Re: be careful with Replaces, please

1997-12-02 Thread James Troup
Yann Dirson <[EMAIL PROTECTED]> writes: > > BTW, is there a particular reason that e2fsprogs got renamed to > > e2fsprogsg? This seems to be the biggest chance to completely > > screw over someone's system in all of Debian now. > > Yes: e2fsprogs used to contain shared libs, on which dump and qu

Re: be careful with Replaces, please

1997-12-02 Thread David Gaudine
On Tue, 2 Dec 1997, David Gaudine wrote: > for at least a year. After installing e2fsprogsg, I'm left with the > following "Available Required packages"; the very existence of this > section makes me nervous. I should add that I'm assuming that this is a transitional thing (that's why it's cal

Re: be careful with Replaces, please

1997-12-02 Thread David Gaudine
On Tue, 2 Dec 1997, Yann Dirson wrote: > Yes: e2fsprogs used to contain shared libs, on which dump and quota > depend. Thus, e2fsprogs was assumed to be a package with libc5 libs, > and I could not keep the name, without breaking dump and quota on a > hamm upgrade. > > I thought that, e2fsprogs

Re: be careful with Replaces, please

1997-12-02 Thread Yann Dirson
Scott K. Ellis writes: > BTW, is there a particular reason that e2fsprogs got renamed to > e2fsprogsg? This seems to be the biggest chance to completely screw over > someone's system in all of Debian now. Yes: e2fsprogs used to contain shared libs, on which dump and quota depend. Thus, e2fspro

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Brandon Mitchell
On Mon, 1 Dec 1997, Marcelo E. Magallon wrote: > Am I the only one seeing a bit of a problem here? (Or am I missing > something I should know?) That is, PGP is non-US. To be able to put PGP > in the main distribution, the master FTP site has to be moved off the US. > I don't have a problem with t

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Fabrizio Polacco
Christian Schwarz wrote: > > I suggest that we add a new control field to our packages called > "Origin:" (or similar). This could either be set to "SPI" or > "Debian", for example. Then, all Debian packages should be signed > with some PGP key (either only one key for the whole system or by > the

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Marcelo E. Magallon
On Mon, 1 Dec 1997, Christian Schwarz wrote: > The default keyring would probably be the developers keyring. The > sysadmin could then add new keys of persons/organziations which he/she > trusts to that keyring. > Comments? Err... yes. Am I the only one seeing a bit of a problem here? (Or am I

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Christian Schwarz
On Sun, 30 Nov 1997, Brandon Mitchell wrote: > I'd also be interested in some kind of verification, so I can accept all > packages put together by some maintainer, and the maintainers on the > debian keyring, but no one else. I had exactly the same idea in the previous KDE/virtual package discus

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Behan Webster
Brandon Mitchell wrote: > > I can see a security problem with this. Lets jump ahead several months > when we have deity working. A user points deity to several sites, some > providing a bunch of debs that they have created but don't want to be part > of the main distribution. Now they upload a

Re: be careful with Replaces, please

1997-12-01 Thread Fabrizio Polacco
Yann Dirson wrote: > > Greg Stark writes: > > > > We've got be be a little more careful with the Replaces header. > > I just installed the libc6 version of comerr, and dpkg helpfully > > deinstalled e2fsprogs. > > That's perfectly normal if you previously had e2fsprogs <= 1.10-6, > which does

Re: be careful with Replaces, please

1997-12-01 Thread David Gaudine
On 30 Nov 1997, Greg Stark wrote: > I know i should install a new e2fsprogs, obviously. I was just suggesting we > should find some way to avoid the default action being to deinstall packages > that aren't really being completely replaced. I'm not sure what better to do > though. In this partic

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Raul Miller
Brandon Mitchell <[EMAIL PROTECTED]> wrote: > I can see a security problem with this. Absolutely: pre/post inst/rm scripts run as root, this is the security problem to dwarf all other security problems. Our defense is a wide audience. The more people we have looking at the system, the better

Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Brandon Mitchell
> > Greg Stark writes: > > > We've got be be a little more careful with the Replaces header. I just > > > installed the libc6 version of comerr, and dpkg helpfully deinstalled > > > e2fsprogs. I can see a security problem with this. Lets jump ahead several months when we have deity working.

Re: be careful with Replaces, please

1997-11-30 Thread Greg Stark
Yann Dirson <[EMAIL PROTECTED]> writes: > Greg Stark writes: > > We've got be be a little more careful with the Replaces header. I just > > installed the libc6 version of comerr, and dpkg helpfully deinstalled > > e2fsprogs. > > That's perfectly normal if you previously had e2fsprogs <= 1.10-

Re: be careful with Replaces, please

1997-11-30 Thread David Gaudine
On Sun, 30 Nov 1997, David Gaudine wrote: > It wasn't just renamed, it was split into e2fsprogsg and e2fslibsg. I meant to add "I think". The above is what I see from the descriptions that dselect shows me. dselect also lists the old package as "required base", which was a bit unnerving when

Re: be careful with Replaces, please

1997-11-30 Thread David Gaudine
On Sun, 30 Nov 1997, Scott K. Ellis wrote: > BTW, is there a particular reason that e2fsprogs got renamed to > e2fsprogsg? This seems to be the biggest chance to completely screw over > someone's system in all of Debian now. It wasn't just renamed, it was split into e2fsprogsg and e2fslibsg. (

Re: be careful with Replaces, please

1997-11-30 Thread Scott K. Ellis
On Sun, 30 Nov 1997, Yann Dirson wrote: > Greg Stark writes: > > > > We've got be be a little more careful with the Replaces header. I just > > installed the libc6 version of comerr, and dpkg helpfully deinstalled > > e2fsprogs. > > That's perfectly normal if you previously had e2fsprogs <=

Re: be careful with Replaces, please

1997-11-30 Thread Raul Miller
It occurs to me that one avenue for a safe upgrade to hamm might be a jumbo-package. This would basically be a hand crafted .deb that contained (and provides) all the relevant sensitive packages. The downside is that this approach is laborious to implement. The upside is that this approa

Re: be careful with Replaces, please

1997-11-30 Thread David Gaudine
On Sun, 30 Nov 1997, Yann Dirson wrote: > Greg Stark writes: > > > > We've got be be a little more careful with the Replaces header. I just > > installed the libc6 version of comerr, and dpkg helpfully deinstalled > > e2fsprogs. > > That's perfectly normal if you previously had e2fsprogs

Re: be careful with Replaces, please

1997-11-30 Thread Yann Dirson
Greg Stark writes: > > We've got be be a little more careful with the Replaces header. I just > installed the libc6 version of comerr, and dpkg helpfully deinstalled > e2fsprogs. That's perfectly normal if you previously had e2fsprogs <= 1.10-6, which does contain libcom_err ! You should pr