Hi,
You're mixing regression fixes and new security fixes. So this makes it
a new update really, not a regression update. Do we need to fix
GHSA-gf4g-95wj-4q4r right now, it's assessed "Low" by upstream?
The changelog is confusing. It only references "DLA-4662-1" and then:
- it compares the DLA with Debian version numbers (deb12u1) -> just
compare version numbers;
- it mentions several independent fixes related to different CVEs under
the same first bullet point -> make 2 bullet points.
Generally please structure the changelog starting with what
vulnerability ID you're addressing, a CVE or GHSA shouldn't be lost in
the middle of a bullet-point, and fixed CVEs mentioned clearly.
The fixes are named after the patch title rather than the related CVE
which is harder to make sense of and review.
I don't really understand what regressed and what didn't. Apparently the
fix for CVE-2026-47770 triggered the regression in trixie which prompted
this similar update here in bookworm. But IIUC bookworm didn't regress
actually. Yet CVE-2026-47770 still introduced another issue, which
itself was already fixed in the trixie initial update (not regression),
but not in bookworm where we missed it (?). Did I get that right?
I don't really like referencing "1.7.1-6+deb13u3"/trixie as a patch source:
For fix-abort-on-string-repeat-overflow.patch the original patch is
inspired by upstream, but tries a different approach to avoid
introducing a symbol (maybe we could have just made that symbol private
somehow, but anyway that's how it was fixed in trixie).
Update are independent, please copy over the rationale about why we're
shipping an original patch (we normally only ship upstream-vetted ones).
You may also want to include some of your call for review e-mail's info.
If something needs to be explained in the review e-mail, we may need to
include it in the related patch notes too.
For fix-invalid-jv-propagation.patch it seems Aron went to a full
original patch for bridging upstream fixes with old versions logic. I
understand this is a pre-requisite to some other patches in trixie, and
apparently here it's the (bookworm-specific) regression fix for
CVE-2026-47770. I don't really like this kind of approach (normally we
pick a series of upstream pre-reqs if necessary, not bring our own)
though maybe it was necessary here, I'm lacking time to dig further.
Overall this is a confusing debdiff to review, so its auditability
should be improved.
Cheers!
Sylvain Beucler
Debian LTS Team
