Re: fixing in oldstable before unstable (was Re: Wheezy update of tre?)

2016-10-21 Thread Ola Lundqvist
Hi That is a good practice, yes. // Ola On 21 October 2016 at 01:43, Holger Levsen wrote: > On Thu, Oct 20, 2016 at 11:21:14PM +0200, Bálint Réczey wrote: > > I think it would be a good approach to file bugs against unstable, offer > > help in updating the version and if we don't get a respons

Re: graphicsmagick security update

2016-10-21 Thread Brian May
Luciano Bello writes: > On Wednesday 19 October 2016 09.07.42 László Böszörményi wrote: >> In short, I didn't have enough time and information of the individual >> fixes. Yesterday fixed other three vulnerabilities for Sid, will apply >> those to Jessie as well. > > Hi Laszlo (and Brian) >Bri

Wheezy update of dwarfutils?

2016-10-21 Thread Chris Lamb
Hello dear maintainer(s), the Debian LTS team would like to fix the security issues which are currently open in the Wheezy version of dwarfutils: https://security-tracker.debian.org/tracker/source-package/dwarfutils Note that these appear to be a new round of issues not covered by the recent DLA

Re: fixing in oldstable before unstable (was Re: Wheezy update of tre?)

2016-10-21 Thread Guido Günther
Hi Holger, On Thu, Oct 20, 2016 at 11:43:06PM +, Holger Levsen wrote: > On Thu, Oct 20, 2016 at 11:21:14PM +0200, Bálint Réczey wrote: > > I think it would be a good approach to file bugs against unstable, offer > > help in updating the version and if we don't get a response NMU the > > affecte

Re: fixing in oldstable before unstable (was Re: Wheezy update of tre?)

2016-10-21 Thread Chris Lamb
Guido Günther wrote: > > or at least amend LTS-policies to always file a bug if one fixes a bug > > in LTS which is still open in sid. > > I think the later part is already LTS policy since at latest > Debconf 16. It's up to us to handle things like that. Let's make this more concrete. Do we hav

Re: fixing in oldstable before unstable (was Re: Wheezy update of tre?)

2016-10-21 Thread Guido Günther
On Fri, Oct 21, 2016 at 11:14:24AM +0100, Chris Lamb wrote: > Guido Günther wrote: > > > > or at least amend LTS-policies to always file a bug if one fixes a bug > > > in LTS which is still open in sid. > > > > I think the later part is already LTS policy since at latest > > Debconf 16. It's up t

Re: fixing in oldstable before unstable (was Re: Wheezy update of tre?)

2016-10-21 Thread Ola Lundqvist
Hi Do we really want LTS mailinglist filled with a lot of unstable bug updates? I think we should file a bug with unstable version number, but write that the origin is that it was found in wheezy. Is that the same as "found" follow up? The other alternative is that we file the bug with wheezy ver

Re: fixing in oldstable before unstable (was Re: Wheezy update of tre?)

2016-10-21 Thread Chris Lamb
Guido Günther wrote: > I'd just use bin/report-vuln ? … one of these days I'm going to look at everything in bin/* and actually remember what it does :) (Yay, for saving myself writing such a thing!) > I'd say unstable and then "found". How come, out of interest? AIUI the tradeoff here is that

openjdk-7 CVEs

2016-10-21 Thread Guido Günther
Hi, openjdk-7 is unclaimed in dla-needed.txt but I wonder if you guys have already a plans for fixing these. Cherry-picking patches or waiting for a new Iced Tea release? Since Wheezy and Jessie currently ship the same version I could prepare the update. Cheers, -- Guido

Re: fixing in oldstable before unstable (was Re: Wheezy update of tre?)

2016-10-21 Thread Jonas Meurer
Am 20.10.2016 um 18:31 schrieb Markus Koschany: > On 20.10.2016 17:15, Holger Levsen wrote: >> On Thu, Oct 20, 2016 at 04:52:07PM +0200, Markus Koschany wrote: >>> Fixing bugs in unstable or any other suite in Debian is not a part of >>> Wheezy LTS. >> >> Of course it's more work and of course it

Re: openjdk-7 CVEs

2016-10-21 Thread Roberto C . Sánchez
On Fri, Oct 21, 2016 at 02:54:18PM +0200, Guido Günther wrote: > Hi, > openjdk-7 is unclaimed in dla-needed.txt but I wonder if you guys have > already a plans for fixing these. Cherry-picking patches or waiting for > a new Iced Tea release? Since Wheezy and Jessie currently ship the same > version

Re: openjdk-7 CVEs

2016-10-21 Thread Markus Koschany
On 21.10.2016 14:54, Guido Günther wrote: > Hi, > openjdk-7 is unclaimed in dla-needed.txt but I wonder if you guys have > already a plans for fixing these. Cherry-picking patches or waiting for > a new Iced Tea release? Since Wheezy and Jessie currently ship the same > version I could prepare the

Re: fixing in oldstable before unstable (was Re: Wheezy update of tre?)

2016-10-21 Thread Markus Koschany
On 21.10.2016 14:57, Jonas Meurer wrote: > Am 20.10.2016 um 18:31 schrieb Markus Koschany: >> On 20.10.2016 17:15, Holger Levsen wrote: [...] >>> But if it's not been done, the fix might get lost and your work was void. >> >> Why would the work get lost? The patch for Wheezy won't vanish and a fix

Re: openjdk-7 CVEs

2016-10-21 Thread Guido Günther
On Fri, Oct 21, 2016 at 03:02:26PM +0200, Markus Koschany wrote: > On 21.10.2016 14:54, Guido Günther wrote: > > Hi, > > openjdk-7 is unclaimed in dla-needed.txt but I wonder if you guys have > > already a plans for fixing these. Cherry-picking patches or waiting for > > a new Iced Tea release? Sin

Re: openjdk-7 CVEs

2016-10-21 Thread Markus Koschany
On 21.10.2016 15:07, Guido Günther wrote: > On Fri, Oct 21, 2016 at 03:02:26PM +0200, Markus Koschany wrote: >> On 21.10.2016 14:54, Guido Günther wrote: >>> Hi, >>> openjdk-7 is unclaimed in dla-needed.txt but I wonder if you guys have >>> already a plans for fixing these. Cherry-picking patches o

Re: Call for advice and testing of nss (and nspr) and intention to upload correction

2016-10-21 Thread Ola Lundqvist
Hi Guido Thanks a lot for the information. I'll enable this and will also run abi-compliance check tool. Is it this [1] one you have used? [1] https://lvc.github.io/abi-compliance-checker/ Best regards // Ola On 20 October 2016 at 23:48, Guido Günther wrote: > Hi Ola, > On Thu, Oct 20, 2016

Re: Call for advice and testing of nss (and nspr) and intention to upload correction

2016-10-21 Thread Guido Günther
On Fri, Oct 21, 2016 at 11:16:54PM +0200, Ola Lundqvist wrote: > Hi Guido > > Thanks a lot for the information. I'll enable this and will also run > abi-compliance check tool. > Is it this [1] one you have used? > > [1] https://lvc.github.io/abi-compliance-checker/ IIRC I've used the abi-complia