Re: Future of MariaDB in stretch-lts (was: Re: CVE-2020-15180: MariaDB)

2020-11-13 Thread Otto Kekäläinen
> But what would be the point? You'd end up with a less-tested version > of 10.3 compared to regular buster and if people need to move from > 10.1 to 10.3, they can just as well upgrade to Buster. > > So, advise people to upgrade for anyone running the -server packages and > keep the client-side to

Re: Future of MariaDB in stretch-lts (was: Re: CVE-2020-15180: MariaDB)

2020-11-13 Thread Holger Levsen
On Fri, Nov 13, 2020 at 09:24:48PM +0200, Otto Kekäläinen wrote: > > But what would be the point? You'd end up with a less-tested version > > of 10.3 compared to regular buster and if people need to move from > > 10.1 to 10.3, they can just as well upgrade to Buster. > > > > So, advise people to up

Re: Future of MariaDB in stretch-lts (was: Re: CVE-2020-15180: MariaDB)

2020-11-10 Thread Moritz Mühlenhoff
On Tue, Nov 10, 2020 at 07:56:30PM +0200, Otto Kekäläinen wrote: > Hello! > > > >> During the 10.5 packaging cycle I have tested building backports for > > >> every commit (see e.g. > > >> https://salsa.debian.org/mariadb-team/mariadb-10.5/-/pipelines/191851). > > >> The galera-4 dependency is alr

Re: Future of MariaDB in stretch-lts (was: Re: CVE-2020-15180: MariaDB)

2020-11-10 Thread Otto Kekäläinen
Hello! > >> During the 10.5 packaging cycle I have tested building backports for > >> every commit (see e.g. > >> https://salsa.debian.org/mariadb-team/mariadb-10.5/-/pipelines/191851). > >> The galera-4 dependency is already available in > >> stretch-backports-sloppy. If you are interested in bac

Re: Future of MariaDB in stretch-lts (was: Re: CVE-2020-15180: MariaDB)

2020-11-05 Thread Otto Kekäläinen
On Tue, 3 Nov 2020 at 21:02, Holger Levsen wrote: .. > > What options do we have anyway? Does the LTS team think they should be > > responsible for providing security updates beyond what upstreams do? > > yes, that's what we often do. Not even MariaDB devs always manage to correctly take patches

Re: Future of MariaDB in stretch-lts (was: Re: CVE-2020-15180: MariaDB)

2020-11-05 Thread Emilio Pozuelo Monfort
On 03/11/2020 20:02, Holger Levsen wrote: Hi Otto, On Mon, Nov 02, 2020 at 09:15:32PM +0200, Otto Kekäläinen wrote: I don't have any particular plans. I'll keep updating the package for as long as upstream provides updates. For 10.1 the updates are indeed officially over now: https://mariadb.or

Re: Future of MariaDB in stretch-lts (was: Re: CVE-2020-15180: MariaDB)

2020-11-03 Thread Holger Levsen
Hi Otto, On Mon, Nov 02, 2020 at 09:15:32PM +0200, Otto Kekäläinen wrote: > I don't have any particular plans. I'll keep updating the package for > as long as upstream provides updates. For 10.1 the updates are indeed > officially over now: https://mariadb.org/about/#maintenance-policy > > What o

Re: Future of MariaDB in stretch-lts (was: Re: CVE-2020-15180: MariaDB)

2020-11-02 Thread Otto Kekäläinen
Hello! I don't have any particular plans. I'll keep updating the package for as long as upstream provides updates. For 10.1 the updates are indeed officially over now: https://mariadb.org/about/#maintenance-policy What options do we have anyway? Does the LTS team think they should be responsible

Future of MariaDB in stretch-lts (was: Re: CVE-2020-15180: MariaDB)

2020-11-02 Thread Adam D. Barratt
Hi, On Wed, 2020-10-21 at 11:27 +0300, Otto Kekäläinen wrote: > I just realized Emilio represents the LTS team and he already took > care of this. On a related note, according to https://mariadb.com/kb/en/mariadb-server/ , support for MariaDB 10.1 ended in October. Assuming that's still accurat

CVE-2020-15180: MariaDB

2020-10-21 Thread Otto Kekäläinen
Hello Debian LTS team! Regarding CVE-2020-15180 I have prepared updates for Ubuntu Trusty (5.5), Ubuntu Bionic (10.1), Focal (10.3), Groovy (10.3) and Debian Stretch (10.1), Buster (10.3) and Sid (10.5). The Debian and Ubuntu security teams have already processed these and DSA and USN are in the

Re: CVE-2020-15180: MariaDB

2020-10-21 Thread Otto Kekäläinen
Hello! I just realized Emilio represents the LTS team and he already took care of this. ke 21. lokak. 2020 klo 11.25 Otto Kekäläinen (o...@debian.org) kirjoitti: > > Hello Debian LTS team! > > Regarding CVE-2020-15180 I have prepared updates for Ubuntu Trusty > (5.5), Ubuntu Bionic (10.1), Focal