Re: Better communication about spectre/meltdown

2018-04-01 Thread Ben Hutchings
On Sun, 2018-04-01 at 20:44 +0200, Florian Weimer wrote: > * Emilio Pozuelo Monfort: > > > Your new GCC builds binaries such as libgcc1 and libstdc++6. That is > > going to affect nearly all the archive at runtime, and I wonder if > > it's the right approach. We introduced GCC 4.8 in wheezy, named

Re: Better communication about spectre/meltdown

2018-04-01 Thread Ben Hutchings
On Sun, 2018-04-01 at 13:37 -0400, Roberto C. Sánchez wrote: > On Sun, Apr 01, 2018 at 05:04:03PM +0200, Emilio Pozuelo Monfort wrote: > > > > Your new GCC builds binaries such as libgcc1 and libstdc++6. That is going > > to > > affect nearly all the archive at runtime, and I wonder if it's the r

Re: Better communication about spectre/meltdown

2018-04-01 Thread Ben Hutchings
On Sun, 2018-04-01 at 07:48 -0400, Roberto C. Sánchez wrote: [...] > That said, I did notice a difference between the built packages on > jessie and wheezy. Specifically, none of the lib64, libn32, > and libx32 packages were built on wheezy. I expected the libx32 > packages to be missing, but I was

Re: Better communication about spectre/meltdown

2018-04-01 Thread Florian Weimer
* Emilio Pozuelo Monfort: > Your new GCC builds binaries such as libgcc1 and libstdc++6. That is > going to affect nearly all the archive at runtime, and I wonder if > it's the right approach. We introduced GCC 4.8 in wheezy, named > gcc-mozilla (a bad name I know) which didn't build these librari

Re: [SECURITY] [DLA 1334-1] mosquitto security update

2018-04-01 Thread Thorsten Alteholz
Hi Ola, On Sun, 1 Apr 2018, Ola Lundqvist wrote: The two CVEs are still reported as unfixed however. I just checked a minute ago. Please check by running the triage script yourself to see it. I did: debian@devel:~/debian-security/security-tracker$ bin/lts-cve-triage.py --skip-dla-needed --ex

Re: Better communication about spectre/meltdown

2018-04-01 Thread Roberto C . Sánchez
On Sun, Apr 01, 2018 at 05:04:03PM +0200, Emilio Pozuelo Monfort wrote: > > Your new GCC builds binaries such as libgcc1 and libstdc++6. That is going to > affect nearly all the archive at runtime, and I wonder if it's the right > approach. We introduced GCC 4.8 in wheezy, named gcc-mozilla (a bad

Re: [SECURITY] [DLA 1334-1] mosquitto security update

2018-04-01 Thread Ola Lundqvist
Hi Thorsten Thank you. I can now see that the package is uploaded properly. Good. The two CVEs are still reported as unfixed however. I just checked a minute ago. Please check by running the triage script yourself to see it. // Ola On 1 April 2018 at 19:32, Thorsten Alteholz wrote: > Hi Ola,

Re: [SECURITY] [DLA 1334-1] mosquitto security update

2018-04-01 Thread Thorsten Alteholz
Hi Ola, On Sun, 1 Apr 2018, Ola Lundqvist wrote: I have not seen an email about that this package has been accepted by the FTP archieve, neither can I find the fixed version in the archives. Can you please check what went wrong? oops, I didn't notice that my internet connection broke during th

Re: Better communication about spectre/meltdown

2018-04-01 Thread Emilio Pozuelo Monfort
On 01/04/18 13:48, Roberto C. Sánchez wrote: > On Tue, Mar 20, 2018 at 12:30:28AM +, Ben Hutchings wrote: >> >> I released Linux 3.2.101 today with a backport of the retpoline >> changes, and have rebased that branch onto it. The new orig tarball is >> at https://people.debian.org/~benh/linux_

Re: Better communication about spectre/meltdown

2018-04-01 Thread Roberto C . Sánchez
On Sun, Apr 01, 2018 at 07:48:55AM -0400, Roberto C. Sánchez wrote: > > At this point I feel like the packages are ready for upload, but it > seems prudent to first wait for confirmation that the kernel build on > wheezy works with this backported gcc. Once I receive that confirmation, > I will pr

Re: Better communication about spectre/meltdown

2018-04-01 Thread Roberto C . Sánchez
On Sun, Apr 01, 2018 at 01:53:44PM +0200, Moritz Muehlenhoff wrote: > On Sun, Apr 01, 2018 at 07:48:55AM -0400, Roberto C. Sánchez wrote: > > Additionally, when I checked the PTS for information on the recent jessie > > upload it > > was a binary upload built for amd64. > > Source uploads to the

Re: Better communication about spectre/meltdown

2018-04-01 Thread Moritz Muehlenhoff
On Sun, Apr 01, 2018 at 07:48:55AM -0400, Roberto C. Sánchez wrote: > Additionally, when I checked the PTS for information on the recent jessie > upload it > was a binary upload built for amd64. Source uploads to the security archive are only possible from stretch onwards. Cheers, Moritz

Re: Better communication about spectre/meltdown

2018-04-01 Thread Roberto C . Sánchez
On Tue, Mar 20, 2018 at 12:30:28AM +, Ben Hutchings wrote: > > I released Linux 3.2.101 today with a backport of the retpoline > changes, and have rebased that branch onto it. The new orig tarball is > at https://people.debian.org/~benh/linux_3.2.101.orig.tar.xz > > I was able to build this

Re: [SECURITY] [DLA 1334-1] mosquitto security update

2018-04-01 Thread Ola Lundqvist
Hi Thorsten I have not seen an email about that this package has been accepted by the FTP archieve, neither can I find the fixed version in the archives. Can you please check what went wrong? In addition I think something have went wrong in the security tracker database because the two CVEs are l