Re: golang-go.crypto / CVE-2019-11841

2020-10-08 Thread Brian May
Emilio Pozuelo Monfort writes: > That go be a simplification. However there's a chance one of those golang- > packages also has a bin package with a real binary, and then that may need to > be > rebuilt as well. > > Also, not all packages with compiled binaries necessarily need a rebuild. > E

Re: [security tracker role] Processing a16b55300564d69f4c3d37a0c84cc41bf9b5638b failed

2020-10-08 Thread Emilio Pozuelo Monfort
On 08/10/2020 09:52, Emilio Pozuelo Monfort wrote: On 08/10/2020 01:50, Brian May wrote: I have no idea what is wrong here, or why it is fixated on a commit that is 2 commits behind master... There's some corruption on the git checkout on soriano. I'm looking at it. Should be fixed now.

Re: golang-go.crypto / CVE-2019-11841

2020-10-08 Thread Emilio Pozuelo Monfort
On 08/10/2020 10:30, Brian May wrote: Emilio Pozuelo Monfort writes: Note that many of those are golang modules which only ship go code on the -dev package, and thus don't need a rebuild. OTOH, compiled binaries may need a rebuild if they use the affected code (directly or indirectly). How d

Re: golang-go.crypto / CVE-2019-11841

2020-10-08 Thread Brian May
Emilio Pozuelo Monfort writes: > Note that many of those are golang modules which only ship go code on the > -dev > package, and thus don't need a rebuild. OTOH, compiled binaries may need a > rebuild if they use the affected code (directly or indirectly). How do I tell which ones need rebuil

Re: golang-go.crypto / CVE-2019-11841

2020-10-08 Thread Emilio Pozuelo Monfort
On 08/10/2020 10:08, Brian May wrote: Emilio Pozuelo Monfort writes: Have you checked if any rdeps need to be rebuilt? No. I imagine there might be some. How do I check? I can't remember right now how to check reverse build depends. root@andromeda:/# grep-dctrl -FBuild-Depends 'golang-gol

Re: golang-go.crypto / CVE-2019-11841

2020-10-08 Thread Utkarsh Gupta
Hi, On Thu, Oct 8, 2020 at 1:38 PM Brian May wrote: > No. I imagine there might be some. How do I check? I can't remember > right now how to check reverse build depends. reverse-depends $binary reverse-depends -b $binary - u

Re: golang-go.crypto / CVE-2019-11841

2020-10-08 Thread Brian May
Emilio Pozuelo Monfort writes: > Have you checked if any rdeps need to be rebuilt? No. I imagine there might be some. How do I check? I can't remember right now how to check reverse build depends. -- Brian May

Re: [security tracker role] Processing a16b55300564d69f4c3d37a0c84cc41bf9b5638b failed

2020-10-08 Thread Emilio Pozuelo Monfort
On 08/10/2020 01:50, Brian May wrote: I have no idea what is wrong here, or why it is fixated on a commit that is 2 commits behind master... There's some corruption on the git checkout on soriano. I'm looking at it. Emilio

Re: golang-go.crypto / CVE-2019-11841

2020-10-08 Thread Emilio Pozuelo Monfort
Hi, On 06/10/2020 23:42, Brian May wrote: Utkarsh Gupta writes: Ah, great. It'd nice to include this then! :) Done. See attached patch. I had to apply it manually, because patch was misapplying one of the hunks in the wrong place. There were several hunks that apply to SKEd25519 public key