Re: [OE-core] [PATCH 6/7] webkitgtk: update to 2.10.7
On 02/24/2016 07:19 PM, akuster808 wrote: Many vulnerability notifications will make the same statements. Updating a package that other packages depend on can cause a cascading set of failures. Now you have a bigger set of problems to contend with. I don't think the possibility of failures is a bigger problem than the certainty of having to backport a huge number of CVE fixes within a codebase that you don't understand. Many of those are not a matter of cherry-picking the right patch; they require actual webkit expertise, because the code has changed too much in the meantime. Also, each webkit build takes hours, which slows things down even more. Do you have the resources for all of that? From the commercial side you just can't move your install base to the latest package versions for every security issue. The Yocto maintenance policy operates very close to this too. I think you need to make an exception for webkit, and explain this to your customers. Alex -- ___ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core
Re: [OE-core] [PATCH 6/7] webkitgtk: update to 2.10.7
On 02/24/2016 03:55 AM, Alexander Kanavin wrote: > On 02/16/2016 05:55 PM, akuster808 wrote: > >>> Yes, which means that jethro (which has 2.8.5) needs the same update. >> >> there is a bug open for that 8877. there are a huge number of CVE's that >> need fixing. > > I wrote a comment in that bug, but I think it bears repeating here: > > Please read this, it's a bit long, but worth it: > > https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/ > > Summary: the upstream will not backport CVE fixes, and they will not be > making point releases in old branches with any kind of lifecycle > guarantee. Providing ongoing updates to the latest stable release of > webkit is the only way to stay secure. > Many vulnerability notifications will make the same statements. Updating a package that other packages depend on can cause a cascading set of failures. Now you have a bigger set of problems to contend with. > So I believe that you indeed have to update webkit to 2.10.7, or > whatever is the latest stable release, and keep doing this for as long > as a yocto release needs to be supported. >From the commercial side you just can't move your install base to the latest package versions for every security issue. The Yocto maintenance policy operates very close to this too. Yeah, Backporting fixes to stable branches is a lot of work once it moves away from a simple cherry-pick from master. regards, - armin > > Regards, > Alex > -- ___ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core
Re: [OE-core] [PATCH 6/7] webkitgtk: update to 2.10.7
On 02/16/2016 05:55 PM, akuster808 wrote: Yes, which means that jethro (which has 2.8.5) needs the same update. there is a bug open for that 8877. there are a huge number of CVE's that need fixing. I wrote a comment in that bug, but I think it bears repeating here: Please read this, it's a bit long, but worth it: https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/ Summary: the upstream will not backport CVE fixes, and they will not be making point releases in old branches with any kind of lifecycle guarantee. Providing ongoing updates to the latest stable release of webkit is the only way to stay secure. So I believe that you indeed have to update webkit to 2.10.7, or whatever is the latest stable release, and keep doing this for as long as a yocto release needs to be supported. Regards, Alex -- ___ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core
Re: [OE-core] [PATCH 6/7] webkitgtk: update to 2.10.7
On 02/16/2016 06:34 AM, Alexander Kanavin wrote: > On 02/11/2016 09:08 PM, akuster808 wrote: >> this update includes: >> >> >> CVE-2015-7096 >> Versions affected: WebKitGTK+ before 2.10.5. >> >> CVE-2015-7098 >> Versions affected: WebKitGTK+ before 2.10.5. >> >> >> http://webkitgtk.org/security.html > > Yes, which means that jethro (which has 2.8.5) needs the same update. there is a bug open for that 8877. there are a huge number of CVE's that need fixing. - armin > > Generally, this manual check for vulnerabilities is error-prone and > doesn't scale. We really should automate cve checks (using > cve-check-tool or something similar) when doing package builds, I'll try > to look if it's feasible. There's been an open bug for a long time: > > https://bugzilla.yoctoproject.org/show_bug.cgi?id=7515 > > > Alex -- ___ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core
Re: [OE-core] [PATCH 6/7] webkitgtk: update to 2.10.7
On 02/11/2016 09:08 PM, akuster808 wrote: this update includes: CVE-2015-7096 Versions affected: WebKitGTK+ before 2.10.5. CVE-2015-7098 Versions affected: WebKitGTK+ before 2.10.5. http://webkitgtk.org/security.html Yes, which means that jethro (which has 2.8.5) needs the same update. Generally, this manual check for vulnerabilities is error-prone and doesn't scale. We really should automate cve checks (using cve-check-tool or something similar) when doing package builds, I'll try to look if it's feasible. There's been an open bug for a long time: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7515 Alex -- ___ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core
Re: [OE-core] [PATCH 6/7] webkitgtk: update to 2.10.7
this update includes:
CVE-2015-7096
Versions affected: WebKitGTK+ before 2.10.5.
CVE-2015-7098
Versions affected: WebKitGTK+ before 2.10.5.
http://webkitgtk.org/security.html
On 02/10/2016 04:42 AM, Alexander Kanavin wrote:
> Signed-off-by: Alexander Kanavin
> ---
> meta/recipes-sato/webkit/{webkitgtk_2.10.5.bb => webkitgtk_2.10.7.bb} | 4
> ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> rename meta/recipes-sato/webkit/{webkitgtk_2.10.5.bb => webkitgtk_2.10.7.bb}
> (96%)
>
> diff --git a/meta/recipes-sato/webkit/webkitgtk_2.10.5.bb
> b/meta/recipes-sato/webkit/webkitgtk_2.10.7.bb
> similarity index 96%
> rename from meta/recipes-sato/webkit/webkitgtk_2.10.5.bb
> rename to meta/recipes-sato/webkit/webkitgtk_2.10.7.bb
> index fba3108..8812967 100644
> --- a/meta/recipes-sato/webkit/webkitgtk_2.10.5.bb
> +++ b/meta/recipes-sato/webkit/webkitgtk_2.10.7.bb
> @@ -16,8 +16,8 @@ SRC_URI = "\
>file://0001-Enable-backtrace-on-linux-when-using-glibc.patch \
>file://0001-Fix-build-with-non-glibc-libraries-on-linux.patch \
>"
> -SRC_URI[md5sum] = "bb3bd727960630bb4cbaddf8b1632d18"
> -SRC_URI[sha256sum] =
> "785d5e98eaf07be15fb8891b7d5b13a2df7072c609b3ee631ca07d5dea1d79fa"
> +SRC_URI[md5sum] = "84832b9d8329413b4f1d87df5f7e8efe"
> +SRC_URI[sha256sum] =
> "990d62c82ed6dede31a6ff0a82d847f16b812842ff3e1093d17113627652864e"
>
> inherit cmake lib_package pkgconfig perlnative pythonnative
> distro_features_check upstream-version-is-even
>
>
--
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core
[OE-core] [PATCH 6/7] webkitgtk: update to 2.10.7
Signed-off-by: Alexander Kanavin
---
meta/recipes-sato/webkit/{webkitgtk_2.10.5.bb => webkitgtk_2.10.7.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-sato/webkit/{webkitgtk_2.10.5.bb => webkitgtk_2.10.7.bb}
(96%)
diff --git a/meta/recipes-sato/webkit/webkitgtk_2.10.5.bb
b/meta/recipes-sato/webkit/webkitgtk_2.10.7.bb
similarity index 96%
rename from meta/recipes-sato/webkit/webkitgtk_2.10.5.bb
rename to meta/recipes-sato/webkit/webkitgtk_2.10.7.bb
index fba3108..8812967 100644
--- a/meta/recipes-sato/webkit/webkitgtk_2.10.5.bb
+++ b/meta/recipes-sato/webkit/webkitgtk_2.10.7.bb
@@ -16,8 +16,8 @@ SRC_URI = "\
file://0001-Enable-backtrace-on-linux-when-using-glibc.patch \
file://0001-Fix-build-with-non-glibc-libraries-on-linux.patch \
"
-SRC_URI[md5sum] = "bb3bd727960630bb4cbaddf8b1632d18"
-SRC_URI[sha256sum] =
"785d5e98eaf07be15fb8891b7d5b13a2df7072c609b3ee631ca07d5dea1d79fa"
+SRC_URI[md5sum] = "84832b9d8329413b4f1d87df5f7e8efe"
+SRC_URI[sha256sum] =
"990d62c82ed6dede31a6ff0a82d847f16b812842ff3e1093d17113627652864e"
inherit cmake lib_package pkgconfig perlnative pythonnative
distro_features_check upstream-version-is-even
--
2.7.0
--
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core
