Re: Xulrunner - intent to remove from Fedora 24

2016-01-28 Thread Martin Stransky
On 01/28/2016 08:52 PM, Samuel Sieb wrote: On 01/27/2016 10:17 PM, Ben Rosser wrote: It's been a while since I've used it, but chatzilla appears to still under active development here: https://hg.mozilla.org/chatzilla/shortlog. Yes, it is still somewhat active. I am one of the upstream develo

Re: Bodhi error: security updates stuck with no way to request stable

2016-01-28 Thread Jamie Nguyen
On 29/01/16 07:24, Adam Williamson wrote: > I think it was a releng snafu. From #fedora-releng today: > > masta / lmacken: tons of ejected from push messages. Perhaps because > you did one and another one right away or something? > nirik: yeah, most likely > * lmacken should have suggested doin

Re: Gnome keyring security in Fedora

2016-01-28 Thread Samuel Sieb
On 01/28/2016 11:25 PM, Adam Williamson wrote: On Thu, 2016-01-28 at 13:47 -0700, Chris Murphy wrote: On Thu, Jan 28, 2016 at 12:34 PM, Samuel Sieb wrote: On 01/28/2016 11:30 AM, Chris Murphy wrote: server, all without a password. No lock screen after wake from suspend. And no timeout or exp

ppisar pushed to perl-IO-Interactive (master). "License clarification added"

2016-01-28 Thread notifications
From a18c7cb676f820cc0d0cc4e9a2250547ddd8504c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Fri, 29 Jan 2016 08:30:41 +0100 Subject: License clarification added --- license_clarification| 86 perl-IO-Interactive.spec

Re: Gnome keyring security in Fedora

2016-01-28 Thread Adam Williamson
On Thu, 2016-01-28 at 13:47 -0700, Chris Murphy wrote: > On Thu, Jan 28, 2016 at 12:34 PM, Samuel Sieb wrote: > > On 01/28/2016 11:30 AM, Chris Murphy wrote: > > > > > > server, all without a password. No lock screen after wake from > > > suspend. And no timeout or expiration for the ssh key. > >

Re: Bodhi error: security updates stuck with no way to request stable

2016-01-28 Thread Adam Williamson
On Fri, 2016-01-29 at 06:48 +, Jamie Nguyen wrote: > Hi, > > This update for 3 Nginx CVEs was auto-submitted to stable yesterday: > >   https://bodhi.fedoraproject.org/updates/FEDORA-2016-fd3428577d > > I got this error message: > >   nginx-1.8.1-1.fc23 ejected from the push because 'Reques

Bodhi error: security updates stuck with no way to request stable

2016-01-28 Thread Jamie Nguyen
Hi, This update for 3 Nginx CVEs was auto-submitted to stable yesterday: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fd3428577d I got this error message: nginx-1.8.1-1.fc23 ejected from the push because 'Request --RAW HTML NOT ALLOWED-- inconsistent with mash request --RAW HTML NOT

Re: [design-suite] Broken packages

2016-01-28 Thread Luya Tshimbalanga
Thanks Rex. Luya -- devel mailing list devel@lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: Gnome always broken in Rawhide

2016-01-28 Thread Jared K. Smith
On Fri, Jan 22, 2016 at 6:37 AM, Vít Ondruch wrote: > am not even mentioning that gnome-shell now consumer like 18% of my > CPU, probably due to the constant spamming of my journal: > > Jan 22 10:29:26 localhost org.gnome.Shell.desktop[2270]: > (gnome-shell:2270): Gdk-WARNING **: gdk-frame-clock:

Re: Gnome keyring security in Fedora

2016-01-28 Thread Chris Murphy
On Thu, Jan 28, 2016 at 12:42 PM, Michael Catanzaro wrote: > On Thu, 2016-01-28 at 12:30 -0700, Chris Murphy wrote: >> I don't trust any of the web browser implementations right now. >> >> The private keys need to be locked (e.g. ssh-add -D) upon either a >> suspend/hibernate, or the screen lock t

Re: Gnome keyring security in Fedora

2016-01-28 Thread Chris Murphy
On Thu, Jan 28, 2016 at 12:34 PM, Samuel Sieb wrote: > On 01/28/2016 11:30 AM, Chris Murphy wrote: >> >> server, all without a password. No lock screen after wake from >> suspend. And no timeout or expiration for the ssh key. >> > You must have something misconfigured or what desktop environment a

Re: Gnome keyring security in Fedora

2016-01-28 Thread Christopher
On Thu, Jan 28, 2016 at 2:37 PM Michael Catanzaro wrote: > On Thu, 2016-01-28 at 18:43 +, Christopher wrote: > > I can't be the only one interested in finding out how to secure these > > things in Fedora. > > Any application running as your user can read anything from your > keyring (provided

Re: Self-Reintroduction: DJ Delorie

2016-01-28 Thread Neal Gompa
On Thu, Jan 28, 2016 at 3:00 PM, DJ Delorie wrote: > >> Hey D.J.! > > And not to point you out, but I should have clarified this... my first > name really is DJ - it's not Dj or D.J. or DeeJay or any other > variation (although my account names are always lower case dj). Yes, > I have legal proof

Re: Gnome keyring security in Fedora

2016-01-28 Thread Michael Catanzaro
On Thu, 2016-01-28 at 14:50 -0500, Josh Boyer wrote: > Why doesn't it work in Fedora? No clue. It's been broken for as long as I remember. Michael -- devel mailing list devel@lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: Request for advice: Major version update of Nginx on EL5/6/7

2016-01-28 Thread Jamie Nguyen
On 28/01/16 19:00, Kevin Fenzi wrote: > Well, this kind of question would probibly be better on the epel-devel > list Ah, I forgot about epel-devel. > And you can ask for an exception. This would entail pushing the new > version to testing and leaving it there a while, mailing epel-announce > to

Re: Self-Reintroduction: DJ Delorie

2016-01-28 Thread DJ Delorie
> Hey D.J.! And not to point you out, but I should have clarified this... my first name really is DJ - it's not Dj or D.J. or DeeJay or any other variation (although my account names are always lower case dj). Yes, I have legal proof of this, and no, I won't share it ;-) DJ -- devel mailing lis

Re: Self-Reintroduction: DJ Delorie

2016-01-28 Thread Fernando Nasser
DJ is being modest, this is a small sample of his contributions. On 2016-01-28 2:42 PM, DJ Delorie wrote: I've been around for a while, but as I'm taking on a new role inside Red Hat, I'll be showing up in different places here and upstream, so I figured I'd refresh everyone's memory as well as

Re: Xulrunner - intent to remove from Fedora 24

2016-01-28 Thread Samuel Sieb
On 01/27/2016 10:17 PM, Ben Rosser wrote: It's been a while since I've used it, but chatzilla appears to still under active development here: https://hg.mozilla.org/chatzilla/shortlog. Yes, it is still somewhat active. I am one of the upstream developers. However, the package appears to be f

Re: Gnome keyring security in Fedora

2016-01-28 Thread Josh Boyer
On Thu, Jan 28, 2016 at 2:36 PM, Michael Catanzaro wrote: > On Thu, 2016-01-28 at 18:43 +, Christopher wrote: >> I can't be the only one interested in finding out how to secure these >> things in Fedora. > > Any application running as your user can read anything from your > keyring (provided i

Re: Self-Reintroduction: DJ Delorie

2016-01-28 Thread Neal Gompa
On Thu, Jan 28, 2016 at 2:42 PM, DJ Delorie wrote: > > I've been around for a while, but as I'm taking on a new role inside > Red Hat, I'll be showing up in different places here and upstream, so > I figured I'd refresh everyone's memory as well as announce the change :-) > > For those who don't k

Self-Reintroduction: DJ Delorie

2016-01-28 Thread DJ Delorie
I've been around for a while, but as I'm taking on a new role inside Red Hat, I'll be showing up in different places here and upstream, so I figured I'd refresh everyone's memory as well as announce the change :-) For those who don't know me, I'm the creator of the DJGPP project, a senior enginee

Re: Gnome keyring security in Fedora

2016-01-28 Thread Michael Catanzaro
On Thu, 2016-01-28 at 12:30 -0700, Chris Murphy wrote: > I don't trust any of the web browser implementations right now. > > The private keys need to be locked (e.g. ssh-add -D) upon either a > suspend/hibernate, or the screen lock timer being reached. > > Maybe I'm missing something, but at the

Re: Gnome keyring security in Fedora

2016-01-28 Thread Michael Catanzaro
On Thu, 2016-01-28 at 18:43 +, Christopher wrote: > I can't be the only one interested in finding out how to secure these > things in Fedora. Any application running as your user can read anything from your keyring (provided it is unlocked). This is not problematic because we don't have any ap

Re: Request for advice: Major version update of Nginx on EL5/6/7

2016-01-28 Thread Gerald B. Cox
On Thu, Jan 28, 2016 at 11:08 AM, Adam Williamson < adamw...@fedoraproject.org> wrote: > I think it would be absolutely a > better policy to give maintainers freedom to bump to a new release > series when the current release series becomes unmaintained upstream, > with some guidelines and pointers

Re: Gnome keyring security in Fedora

2016-01-28 Thread Samuel Sieb
On 01/28/2016 11:30 AM, Chris Murphy wrote: server, all without a password. No lock screen after wake from suspend. And no timeout or expiration for the ssh key. You must have something misconfigured or what desktop environment are you using? My laptop is always locked after suspend. There's

Re: Gnome keyring security in Fedora

2016-01-28 Thread Chris Murphy
On Thu, Jan 28, 2016 at 11:43 AM, Christopher wrote: > To be honest, I thought there'd be more interest in this topic by now, > considering Gnome Keyring stores so many things now in the Logon keyring by > default: > Bugzilla credentials for ABRT, > Chrome sync'd passwords, > Firefox site p

Re: Gnome keyring security in Fedora

2016-01-28 Thread Christopher
On Thu, Jan 28, 2016 at 2:06 PM Kevin Fenzi wrote: > On Thu, 28 Jan 2016 18:43:09 + > Christopher wrote: > > ...snip... > > > I can't be the only one interested in finding out how to secure these > > things in Fedora. > > No, but it could be no one who knows is on this list or has seen your

Re: Request for advice: Major version update of Nginx on EL5/6/7

2016-01-28 Thread Kevin Fenzi
On Thu, 28 Jan 2016 11:08:45 -0800 Adam Williamson wrote: > > Well, this kind of question would probibly be better on the > > epel-devel list, but otherwise:  > > > > https://fedoraproject.org/wiki/EPEL_Updates_Policy > > > > And you can ask for an exception. This would entail pushing the new >

Re: Request for advice: Major version update of Nginx on EL5/6/7

2016-01-28 Thread Adam Williamson
On Thu, 2016-01-28 at 12:00 -0700, Kevin Fenzi wrote: > On Thu, 28 Jan 2016 10:03:08 + > Jamie Nguyen wrote: > > > Hi, > > > > Distributions like RHEL and Debian have a very strict update policy > > (for good reason). People expect stability and don't want surprises. > > > > When CVEs arise

Re: Gnome keyring security in Fedora

2016-01-28 Thread Kevin Fenzi
On Thu, 28 Jan 2016 18:43:09 + Christopher wrote: ...snip... > I can't be the only one interested in finding out how to secure these > things in Fedora. No, but it could be no one who knows is on this list or has seen your post. Perhaps try reposting to https://mail.gnome.org/archives/gno

Re: Request for advice: Major version update of Nginx on EL5/6/7

2016-01-28 Thread Kevin Fenzi
On Thu, 28 Jan 2016 10:03:08 + Jamie Nguyen wrote: > Hi, > > Distributions like RHEL and Debian have a very strict update policy > (for good reason). People expect stability and don't want surprises. > > When CVEs arise, patches can often be backported. Nginx 1.8.1 recently > fixed three CV

Re: Gnome keyring security in Fedora

2016-01-28 Thread Christopher
On Thu, Jan 21, 2016 at 3:38 PM Christopher wrote: > I've been thinking about Gnome keyring a lot lately, and I have concerns > about security, and I don't know if this is a Gnome keyring problem, or a > problem affecting Fedora specifically. > > In short, it doesn't look like Gnome keyring has t

Re: Request for advice: Major version update of Nginx on EL5/6/7

2016-01-28 Thread Gerald B. Cox
On Thu, Jan 28, 2016 at 8:46 AM, Jamie Nguyen wrote: > There isn't any way to ensure users read upgrade notes, except between > new versions of Fedora/RHEL (as major changes would be expected). This > will inevitably bite someone when their Nginx configuration isn't valid > after the update, whic

Re: Fedora Rawhide 20160128 compose check report

2016-01-28 Thread Adam Williamson
On Thu, 2016-01-28 at 17:18 +, Fedora compose checker wrote: > Missing expected images: > > Cloud disk raw i386 > Cloud_atomic disk raw x86_64 > Generic boot x86_64 > Workstation live x86_64 > Kde disk raw armhfp > Cloud disk raw x86_64 > Kde live x86_64 > > No images in this compose but not

Re: F24 System Wide Change: LiveUserCreator as Primary Downloadable

2016-01-28 Thread Jiri Eischmann
Josh Boyer píše v St 27. 01. 2016 v 08:43 -0500: > On Wed, Jan 27, 2016 at 8:40 AM, Martin Bříza > wrote: > > On Wed, 27 Jan 2016 14:35:56 +0100, Josh Boyer > ct.org> > > wrote: > > > > > On Wed, Jan 27, 2016 at 8:30 AM, Jan Kurik > > > wrote: > > > > > > > > The correct name for this Change i

Fedora Rawhide 20160128 compose check report

2016-01-28 Thread Fedora compose checker
Missing expected images: Cloud disk raw i386 Cloud_atomic disk raw x86_64 Generic boot x86_64 Workstation live x86_64 Kde disk raw armhfp Cloud disk raw x86_64 Kde live x86_64 No images in this compose but not Rawhide 20160127 Images in Rawhide 20160127 but not this: Cloud disk raw i386 Design_

Re: Request for advice: Major version update of Nginx on EL5/6/7

2016-01-28 Thread Jamie Nguyen
On 28/01/16 10:10, Neal Gompa wrote: > I personally think you should. EPEL isn't supposed to unreasonably > hold back when even the upstream project no longer maintains that > version. As long as all consumers of the nginx package are > appropriately updated (if necessary) and the transition notes

perl-Test-Memory-Cycle license change

2016-01-28 Thread Petr Šabata
FYI, perl-Test-Memory-Cycle's license was changed from `the same as Perl' to `Artistic 2.0' in 1.06. Coming to a Rawhide near you. P signature.asc Description: PGP signature -- devel mailing list devel@lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.

Re: Needless use of %defattr (in 4464 packages)

2016-01-28 Thread Josh Boyer
On Thu, Jan 28, 2016 at 2:59 AM, Pierre-Yves Chibon wrote: > On Thu, Jan 28, 2016 at 05:32:50AM +0100, Ralf Corsepius wrote: >> On 01/27/2016 01:22 PM, Pierre-Yves Chibon wrote: >> >On Wed, Jan 27, 2016 at 12:51:03PM +0100, Ralf Corsepius wrote: >> >>On 01/27/2016 11:32 AM, Dominik 'Rathann' Mierz

dialog soname bump

2016-01-28 Thread Miroslav Lichvar
The dialog package was updated to 1.3 in rawhide, which changed the soname of the library to libdialog.so.13. Nothing else beside dialog seems to be using the library or buildrequire the devel subpackage, so no rebuilds should be needed and I'm not really sure why I'm sending this email. -- Miros

Re: Request for advice: Major version update of Nginx on EL5/6/7

2016-01-28 Thread Neal Gompa
On Thu, Jan 28, 2016 at 5:03 AM, Jamie Nguyen wrote: > Hi, > > Distributions like RHEL and Debian have a very strict update policy (for > good reason). People expect stability and don't want surprises. > > When CVEs arise, patches can often be backported. Nginx 1.8.1 recently > fixed three CVEs an

perl-IO-Interactive license change

2016-01-28 Thread Petr Pisar
IO-Interactive-1.021 churned license statements with ambiguous resolution, thus I changed license tag for perl-IO-Interactive-1.021-1.fc24 from (GPL+ or Artistic) to ((GPL+ or Artistic) and (Artistic 2.0)) until upstream clarifies its intention. -- Petr -- devel mailing list devel@lists.fedoraproj

Request for advice: Major version update of Nginx on EL5/6/7

2016-01-28 Thread Jamie Nguyen
Hi, Distributions like RHEL and Debian have a very strict update policy (for good reason). People expect stability and don't want surprises. When CVEs arise, patches can often be backported. Nginx 1.8.1 recently fixed three CVEs and I've backported to Nginx 1.6.x on EL7. Unfortunately, Nginx 1.0

Re: Orphaned packages looking for new point of contact

2016-01-28 Thread Jan Synacek
Kevin Fenzi writes: > ... > purple-plugin_pack -- A set of plugins for libpurple, pidgin, and finch ( > master f23 f22 ) Taken. -- Jan Synacek Software Engineer, Red Hat signature.asc Description: PGP signature -- devel mailing list devel@lists.fedoraproject.org http://lists.fedoraproject.o

REMINDER: Changes submission deadline for Fedora 24 the next Tuesday

2016-01-28 Thread Jan Kurik
Hi everyone! Fedora 24 Changes submission deadline [1] is planned on the next Tuesday on 2016-Feb-02. We are also going to start mass rebuild at the same date. Alpha release is currently planned on March, the 22nd. Please, submit your System Wide Changes by this deadline. As the deadline mainly a

Re: Heads up: LLVM repackaging in F24

2016-01-28 Thread Hans de Goede
Hi, On 28-01-16 09:36, Hans de Goede wrote: Hi, On 27-01-16 19:22, Adam Jackson wrote: On Wed, 2016-01-27 at 11:25 -0500, Neal Gompa wrote: Aren't clang, lldb, and compiler-rt still part of the main LLVM package sources, though? It would make sense to continue building them as part of the LL

Re: Heads up: LLVM repackaging in F24

2016-01-28 Thread Hans de Goede
Hi, On 27-01-16 19:22, Adam Jackson wrote: On Wed, 2016-01-27 at 11:25 -0500, Neal Gompa wrote: Aren't clang, lldb, and compiler-rt still part of the main LLVM package sources, though? It would make sense to continue building them as part of the LLVM package since they ship together. They're