On 10.09.2016 14:57 +0200, Mattia Rizzolo wrote:
Dear LTS team, Mateusz:
Hi Mattia!
On Thu, Jun 16, 2016 at 09:12:47AM +0200, Adam Borowski wrote:
On Thu, Jun 16, 2016 at 06:53:49AM +0000, Gianfranco Costamagna wrote:
Hi Adam,
(answering in general, not in this particular situation)
I've reviewed the upload, but I'm not sure if you coordinated it
with the LTS team. I find a contradition:
https://lists.debian.org/debian-lts/2016/06/msg00031.html
says vlc is no longer supported in wheezy, yet in
https://lists.debian.org/debian-lts/2016/06/msg00035.html
the quoted mail sounds as if the upload is expected.
Should I proceed?
I guess not
In general, for security pocket, you need to do:
- check/test the patch
- wait for an ack from security team
- upload (binary-upload, not sure if source only is allowed, but I think not
IIRC) on security-master
e.g.
The docs on the LTS wiki suggest it is, but I asked to confirm.
I think you also need to do the build with -sa, as you need to upload
the full sources to security-master.
I pushed it to the mentors.
BTW according to security tracker wheezy is EOL for that cve, no DSA is
released, so I guess you won't
have the ack
https://security-tracker.debian.org/tracker/CVE-2016-5108
The discussion continued after the EOL was mentioned, and Mateusz was
obviously aware of it, thus I assume the RFS he filed was acked in parts of
the discussion that are missing from list archives.
In any case, the patch is simple and works for me.
(well, since there is a patch and an upload ready they might give an exception,
but I think
asking before is the right way to deal with this bug)
Right... which is exactly what I'm doing right now :)
Wheezy has been handed off from security to the LTS team.
We haven't heard anything on this RFS for nearly 3 months.
Can you see if there is anythin that you'd like. For example, I don't
see a DLA enrty in dla-needed for VLC (nor I'd expect one considering
VLC is not declared as support iirc).
Anyway I suppose that a one-shot update can't really harm anybody.
--
.''`. Mateusz Łukasik
: :' : http://mati75.eu
`. `' Debian Member - mat...@linuxmint.pl
`- GPG: D93B 0C12 C8D0 4D7A AFBC FA27 CCD9 1D61 11A0 6851
