Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-04-14 Thread Julien Cristau
On Sun, Apr 14, 2013 at 18:38:56 +0200, Andreas Metzler wrote: > On 2013-03-31 Julien Cristau wrote: > > On Sun, Mar 31, 2013 at 14:35:56 +0200, Andreas Metzler wrote: > > > Could you please remove gnutls28 3.0.22-3 from *unstable* to make it > > > possible to start testing the transition? > >

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-04-14 Thread Andreas Metzler
On 2013-03-31 Julien Cristau wrote: > On Sun, Mar 31, 2013 at 14:35:56 +0200, Andreas Metzler wrote: > > Could you please remove gnutls28 3.0.22-3 from *unstable* to make it > > possible to start testing the transition? > We don't handle unstable. You'll have to file a bug against > ftp.debian.

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-31 Thread Julien Cristau
On Sun, Mar 31, 2013 at 14:35:56 +0200, Andreas Metzler wrote: > Could you please remove gnutls28 3.0.22-3 from *unstable* to make it > possible to start testing the transition? > We don't handle unstable. You'll have to file a bug against ftp.debian.org for that. Cheers, Julien signature.asc

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-31 Thread Andreas Metzler
On 2013-03-20 Andreas Metzler wrote: > On 2013-03-19 Andreas Metzler wrote: > [...] > > Find attached a proposed patch. Its rather obvious downside is that it > > will break on ports, due to using a negative list ("all except") where > > possible and a positive list else: > [...] > Having slept

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-20 Thread Andreas Metzler
On 2013-03-19 Andreas Metzler wrote: [...] > Find attached a proposed patch. Its rather obvious downside is that it > will break on ports, due to using a negative list ("all except") where > possible and a positive list else: [...] Having slept over it I realize this is no problem at all. - Ports

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-19 Thread Andreas Metzler
On 2013-03-19 Andreas Metzler wrote: > Find attached a proposed patch. diff -Nru gnutls26-2.12.20/debian/changelog gnutls26-2.12.20/debian/changelog --- gnutls26-2.12.20/debian/changelog 2013-02-04 19:44:26.0 +0100 +++ gnutls26-2.12.20/debian/changelog 2013-03-19 19:54:02.0

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-19 Thread Julien Cristau
On Tue, Mar 19, 2013 at 20:06:38 +0100, Andreas Metzler wrote: > Find attached a proposed patch. Forgot the attachment? Cheers, Julien signature.asc Description: Digital signature

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-19 Thread Andreas Metzler
On 2013-03-18 Julien Cristau wrote: > On Sun, Mar 17, 2013 at 19:26:10 +0100, Andreas Metzler wrote: >> On 2013-03-17 Julien Cristau wrote: >>> On Sun, Mar 17, 2013 at 16:00:29 +0100, Andreas Metzler wrote: >> [...] 2. If armel armhf mipsel break due to --disable-largefile stop using --

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-18 Thread Julien Cristau
On Sun, Mar 17, 2013 at 19:26:10 +0100, Andreas Metzler wrote: > On 2013-03-17 Julien Cristau wrote: > > On Sun, Mar 17, 2013 at 16:00:29 +0100, Andreas Metzler wrote: > [...] > > > 2. If armel armhf mipsel break due to --disable-largefile stop using > > > --disable-largefile there and stop provi

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-17 Thread Andreas Metzler
On 2013-03-17 Julien Cristau wrote: > On Sun, Mar 17, 2013 at 16:00:29 +0100, Andreas Metzler wrote: [...] > > 2. If armel armhf mipsel break due to --disable-largefile stop using > > --disable-largefile there and stop providing guile-gnutls on these > > archs. > OK I think I'm confused. How wou

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-17 Thread Julien Cristau
On Sun, Mar 17, 2013 at 16:00:29 +0100, Andreas Metzler wrote: > On 2013-02-23 Julien Cristau wrote: > > The plan seems ok to me in general. > > > On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: > > > > +# workaround for guile testsuite failure. > > > +ifneq (,$(filter $(DEB_BUIL

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-17 Thread Andreas Metzler
On 2013-02-23 Julien Cristau wrote: > The plan seems ok to me in general. > On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: > > +# workaround for guile testsuite failure. > > +ifneq (,$(filter $(DEB_BUILD_ARCH),armel armhf mipsel)) > > + DEB_CONFIGURE_EXTRA_FLAGS += --disable-la

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-09 Thread Andreas Metzler
On 2013-03-02 Andreas Metzler wrote: [...] > However generally speaking I don't think pulling guile-gnutls just to > get rid of --disable-largefile on armel, armhf and mipsel is necessary, > gnutls versions before 2.12.10-1 were built without large file support > even on i386. Adding a (pretty we

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-02 Thread Ludovic Courtès
Hi, Andreas Metzler skribis: > @*Ludovic*: To give you some context, we are planning to pull > gnutls28 from wheezy. If we also stopped shipping guile-gnutls instead > of proving it from gnutls 2.x again we could a) get rid of a package > without reverse dependencies and b) do without building g

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-02 Thread Andreas Metzler
On 2013-03-01 Julien Cristau wrote: > On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: >> Find attached a proposed patch to build both guile-gnutls and >> gnutls-bin from gnutls26 instead of gnutls28 for wheezy. Would this be >> acceptable for an unstable upload targeted for testing?

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-03-01 Thread Julien Cristau
On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: > Find attached a proposed patch to build both guile-gnutls and > gnutls-bin from gnutls26 instead of gnutls28 for wheezy. Would this be > acceptable for an unstable upload targeted for testing? Afterwards > gnutls28 could be pulled fr

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-02-24 Thread Andreas Metzler
On 2013-02-24 Julien Cristau wrote: > On Sat, Feb 23, 2013 at 19:33:14 +0100, Andreas Metzler wrote: >> Judging from the fact that 2.12.20 tarball does not include >> largefile.m4 I guess the configure option is not necessary in 2.12.20. >> - If you prefer to I can try without. > So you're sayi

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-02-24 Thread Julien Cristau
On Sat, Feb 23, 2013 at 19:33:14 +0100, Andreas Metzler wrote: > Judging from the fact that 2.12.20 tarball does not include > largefile.m4 I guess the configure option is not necessary in 2.12.20. > - If you prefer to I can try without. > So you're saying gnutls26 currently is built for 32bit of

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-02-23 Thread Andreas Metzler
On 2013-02-23 Julien Cristau wrote: > The plan seems ok to me in general. > On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: >> +# workaround for guile testsuite failure. >> +ifneq (,$(filter $(DEB_BUILD_ARCH),armel armhf mipsel)) >> +DEB_CONFIGURE_EXTRA_FLAGS += --disable-larg

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-02-23 Thread Julien Cristau
The plan seems ok to me in general. On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: > +# workaround for guile testsuite failure. > +ifneq (,$(filter $(DEB_BUILD_ARCH),armel armhf mipsel)) > + DEB_CONFIGURE_EXTRA_FLAGS += --disable-largefile > +endif > + Disabling lfs because o

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-02-23 Thread Andreas Metzler
On 2013-02-20 Dominique Dumont wrote: > Le dimanche 10 février 2013 16:26:40, Andreas Metzler a écrit : PS: My first idea was to simply pull gnutls28, providing guile-gnutls and gnutls-bin from gnutls26 again. However there is a reverse dependency (pan) on libgnutls28 in testing now

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-02-20 Thread Dominique Dumont
Le dimanche 10 février 2013 16:26:40, Andreas Metzler a écrit : > >> PS: My first idea was to simply pull gnutls28, providing guile-gnutls > >> and gnutls-bin from gnutls26 again. However there is a reverse > >> dependency (pan) on libgnutls28 in testing nowadays. Pan is not > >> distributable curr

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-02-10 Thread Andreas Metzler
On 2013-02-10 Julien Cristau wrote: > On Thu, Feb 7, 2013 at 11:54:52 +0100, Andreas Metzler wrote: > > sadly CVE-2013-0169 also (see 699891) applies to gnutls28. [...] >> PS: My first idea was to simply pull gnutls28, providing guile-gnutls >> and gnutls-bin from gnutls26 again. However there is

Re: Fixing "lucky 13" CVE-2013-0169 in gnutls28

2013-02-10 Thread Julien Cristau
On Thu, Feb 7, 2013 at 11:54:52 +0100, Andreas Metzler wrote: > Hello, > > sadly CVE-2013-0169 also (see 699891) applies to gnutls28. > I have just uploaded gnutls28_3.0.22-3 to unstable, pretty much with > the same set of fixes as gnutls26 2.12.20-4 to unstable. I am not > sure how you would pr