Re: Security update process without CVEs

2014-01-24 Thread drago01
On Fri, Jan 24, 2014 at 1:25 PM, Kevin Kofler wrote: > We need direct stable pushes back! No. -- devel mailing list devel@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Security update process without CVEs

2014-01-24 Thread Kevin Kofler
Christopher Meng wrote: > Which poor sod will be the victim in 7 days at least before pushing to > stable? ;) > > Then comes another question, does security updates need to be treat as > special? It's just an original update with a tag "security alert", but > users still need to wait 7 days unless

Re: Security update process without CVEs

2014-01-23 Thread Adam Williamson
On Thu, 2014-01-23 at 22:53 -0600, Dennis Gilmore wrote: > El Thu, 23 Jan 2014 14:51:51 -0800 > Adam Williamson escribió: > > On Tue, 2014-01-21 at 14:32 -0700, Kevin Fenzi wrote: > > > On Tue, 21 Jan 2014 16:26:19 -0500 > > > Dan Scott wrote: > > > > > > > Hi: > > > > > > > > A few hours ago I

Re: Security update process without CVEs

2014-01-23 Thread Dennis Gilmore
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 El Thu, 23 Jan 2014 14:51:51 -0800 Adam Williamson escribió: > On Tue, 2014-01-21 at 14:32 -0700, Kevin Fenzi wrote: > > On Tue, 21 Jan 2014 16:26:19 -0500 > > Dan Scott wrote: > > > > > Hi: > > > > > > A few hours ago I submitted requests to push

Re: Security update process without CVEs

2014-01-23 Thread Christopher Meng
On Fri, Jan 24, 2014 at 11:15 AM, Adam Williamson wrote: > It's not 7 days at least. It's 0 days at least. It's 7 days at least *if > you get no positive karma*. Yes, but nearly 90% of these security updates receive no karma feedback still, they lack tests. -- devel mailing list devel@lists.fed

Re: Security update process without CVEs

2014-01-23 Thread Adam Williamson
On Fri, 2014-01-24 at 11:11 +0800, Christopher Meng wrote: > Which poor sod will be the victim in 7 days at least before pushing to > stable? ;) It's not 7 days at least. It's 0 days at least. It's 7 days at least *if you get no positive karma*. -- Adam Williamson Fedora QA Community Monkey IRC:

Re: Security update process without CVEs

2014-01-23 Thread Christopher Meng
Which poor sod will be the victim in 7 days at least before pushing to stable? ;) Then comes another question, does security updates need to be treat as special? It's just an original update with a tag "security alert", but users still need to wait 7 days unless they enable updates-testing. -- de

Re: Security update process without CVEs

2014-01-23 Thread Adam Williamson
On Tue, 2014-01-21 at 14:32 -0700, Kevin Fenzi wrote: > On Tue, 21 Jan 2014 16:26:19 -0500 > Dan Scott wrote: > > > Hi: > > > > A few hours ago I submitted requests to push perl-MARC-XML directly to > > stable (by filling out the "fedpkg update" request with type=security > > and request=stable)

Re: Security update process without CVEs

2014-01-21 Thread Kevin Fenzi
On Tue, 21 Jan 2014 17:38:54 -0500 Dan Scott wrote: > Okay, then I'll remove the conflicting information from > http://fedoraproject.org/wiki/Package_update_HOWTO that says: "If you > feel that community testing is unnecessary for your update, you can > choose to push it straight to the stable fe

Re: Security update process without CVEs

2014-01-21 Thread Dan Scott
On Tue, Jan 21, 2014 at 4:32 PM, Kevin Fenzi wrote: > On Tue, 21 Jan 2014 16:26:19 -0500 > Dan Scott wrote: > >> Hi: >> >> A few hours ago I submitted requests to push perl-MARC-XML directly to >> stable (by filling out the "fedpkg update" request with type=security >> and request=stable) > > You

Re: Security update process without CVEs

2014-01-21 Thread Dan Scott
Eric: On Tue, Jan 21, 2014 at 4:31 PM, Eric H. Christensen wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > On Tue, Jan 21, 2014 at 04:26:19PM -0500, Dan Scott wrote: >> I tried following >> https://fedoraproject.org/wiki/Security_Tracking_Bugs?rd=Security/TrackingBugs >> but it app

Re: Security update process without CVEs

2014-01-21 Thread Eric H. Christensen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, Jan 21, 2014 at 04:31:10PM -0500, Eric H. Christensen wrote: > On Tue, Jan 21, 2014 at 04:26:19PM -0500, Dan Scott wrote: > > I tried following > > https://fedoraproject.org/wiki/Security_Tracking_Bugs?rd=Security/TrackingBugs > > but it appe

Re: Security update process without CVEs

2014-01-21 Thread Kevin Fenzi
On Tue, 21 Jan 2014 16:26:19 -0500 Dan Scott wrote: > Hi: > > A few hours ago I submitted requests to push perl-MARC-XML directly to > stable (by filling out the "fedpkg update" request with type=security > and request=stable) You cannot push any update directly to stable. Security updates ha

Re: Security update process without CVEs

2014-01-21 Thread Eric H. Christensen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Tue, Jan 21, 2014 at 04:26:19PM -0500, Dan Scott wrote: > I tried following > https://fedoraproject.org/wiki/Security_Tracking_Bugs?rd=Security/TrackingBugs > but it appears to depend on waiting on a CVE, which upstream did not > yet have... but u

Security update process without CVEs

2014-01-21 Thread Dan Scott
Hi: A few hours ago I submitted requests to push perl-MARC-XML directly to stable (by filling out the "fedpkg update" request with type=security and request=stable) I tried following https://fedoraproject.org/wiki/Security_Tracking_Bugs?rd=Security/TrackingBugs but it appears to depend on waiting