Re: Bug#976219: zsh uninstallable due to partial oldstable security update

2020-12-02 Thread Anssi Kolehmainen
zsh package has appeared in security.debian.org and now it is installable again. Some timestamps in http://security.debian.org/debian-security/pool/updates/main/z/zsh/ zsh-common_5.3.1-4+deb9u4_all.deb 2020-12-01 04:13 zsh_5.3.1-4+deb9u4.dsc 2020-12-01 03:53 zsh_5.3.1-4+deb9u4_amd

openjdk-8 8u275-b01-1

2020-12-02 Thread Thorsten Glaser
Hi (E)LTS-people, I’ve just uploaded an OpenJDK 8 regression update to sid, sponsored by my employer (as below). (I’m also building locally for buster, wheezy and various *buntu releases, so all possible systems I may encounter are covered, which is why I’m invested.) Would it help if I also prep

Re: openjdk-8 8u275-b01-1

2020-12-02 Thread Emilio Pozuelo Monfort
Hi Thorsten, On 02/12/2020 10:06, Thorsten Glaser wrote: Hi (E)LTS-people, I’ve just uploaded an OpenJDK 8 regression update to sid, sponsored by my employer (as below). (I’m also building locally for buster, wheezy and various *buntu releases, so all possible systems I may encounter are covere

Re: openjdk-8 8u275-b01-1

2020-12-02 Thread Thorsten Glaser
Hi Emilio, > If you can send a debdiff I'd be happy to take a look. the debdiff between sid and stretch would be trivial, just changelog and the regenerated debian/control file (attached). I’m building it at the moment so I can test it first. Do you also need a debdiff against the version curre

Re: openjdk-8 8u275-b01-1

2020-12-02 Thread Emilio Pozuelo Monfort
On 02/12/2020 11:21, Thorsten Glaser wrote: Hi Emilio, If you can send a debdiff I'd be happy to take a look. the debdiff between sid and stretch would be trivial, just changelog and the regenerated debian/control file (attached). I’m building it at the moment so I can test it first. Do you

Re: Bug#976219: zsh uninstallable due to partial oldstable security update

2020-12-02 Thread Markus Koschany
Hello, Am Mittwoch, den 02.12.2020, 11:11 +0200 schrieb Anssi Kolehmainen: > zsh package has appeared in security.debian.org and now it is installable > again. I am glad this problem could be solved hence I am going to close this bug report now. Regards, Markus signature.asc Description: This

Re: openjdk-8 8u275-b01-1

2020-12-02 Thread Thorsten Glaser
On Wed, 2 Dec 2020, Emilio Pozuelo Monfort wrote: > Let me know how those tests go and we can proceed from there. It builds, with the usual “most tests pass”, and the test program I threw at it also works. bye, //mirabilos -- tarent solutions GmbH Rochusstraße 2-4, D-53123 Bonn • http://www.tar

Re: golang-github-dgrijalva-jwt-go / CVE-2020-26160

2020-12-02 Thread Brian May
Salvatore Bonaccorso writes: > Your above tracking of the commits seems correct, which would mean > that the issue was firstly introduced actually in v3.0.0 and given the > code is not found in the buster and stretch version this would not > affect hose versions indeed. Yes, you are right. I mis

reverse build depends on stretch

2020-12-02 Thread Brian May
How do I do this? I am getting defeated at every step: root@740eafbd9794:/build# grep-dctrl -s Package -F Build-Depends,Build-Depends-Indep quilt /var/lib/apt/lists/*Sources grep-dctrl: /var/lib/apt/lists/*Sources: No such file or directory root@740eafbd9794:/build# ls -l /var/lib/apt/lists/ tot

Re: golang-1.7 / CVE-2019-9514 / CVE-2019-9512

2020-12-02 Thread Brian May
Brian May writes: > Anyway, as this was marked as minor for golang-1.7 in Stretch, probably > also should be marked as minor for golang-golang-x-net-dev also... According to https://security-tracker.debian.org/tracker/CVE-2019-9512, golang-golang-x-net-dev is a source package that is vulnerable.

Re: reverse build depends on stretch

2020-12-02 Thread Bob Proulx
Brian May wrote: > root@740eafbd9794:/build# file /var/lib/apt/lists/*Sources.lz4 > /var/lib/apt/lists/proxy.pri:_debian_dists_stretch_main_source_Sources.lz4: > LZ4 compressed data (v1.4+) Hmm... lz4 files. I guess I slept through that transition. However my Sid machine still has Sources