Re: be careful with Replaces, please

1997-12-04 Thread Brian White
Nope, didn't seem to be flagged for install on my end. I would have suggested keeping the same name and conflicting with the versions of dump and quota that would have depended on the libraries. OK. I think I'll change the name back to e2fsprogs, and just make it conflict with old

Re: be careful with Replaces, please

1997-12-03 Thread Yann Dirson
Scott Ellis writes: Nope, didn't seem to be flagged for install on my end. I would have suggested keeping the same name and conflicting with the versions of dump and quota that would have depended on the libraries. OK. I think I'll change the name back to e2fsprogs, and just make it

Re: be careful with Replaces, please

1997-12-02 Thread Yann Dirson
Scott K. Ellis writes: BTW, is there a particular reason that e2fsprogs got renamed to e2fsprogsg? This seems to be the biggest chance to completely screw over someone's system in all of Debian now. Yes: e2fsprogs used to contain shared libs, on which dump and quota depend. Thus, e2fsprogs

Re: be careful with Replaces, please

1997-12-02 Thread David Gaudine
On Tue, 2 Dec 1997, Yann Dirson wrote: Yes: e2fsprogs used to contain shared libs, on which dump and quota depend. Thus, e2fsprogs was assumed to be a package with libc5 libs, and I could not keep the name, without breaking dump and quota on a hamm upgrade. I thought that, e2fsprogsg

Re: be careful with Replaces, please

1997-12-02 Thread David Gaudine
On Tue, 2 Dec 1997, David Gaudine wrote: for at least a year. After installing e2fsprogsg, I'm left with the following Available Required packages; the very existence of this section makes me nervous. I should add that I'm assuming that this is a transitional thing (that's why it's called

Re: be careful with Replaces, please

1997-12-02 Thread James Troup
Yann Dirson [EMAIL PROTECTED] writes: BTW, is there a particular reason that e2fsprogs got renamed to e2fsprogsg? This seems to be the biggest chance to completely screw over someone's system in all of Debian now. Yes: e2fsprogs used to contain shared libs, on which dump and quota

Re: be careful with Replaces, please

1997-12-02 Thread Scott Ellis
On Tue, 2 Dec 1997, Yann Dirson wrote: Scott K. Ellis writes: BTW, is there a particular reason that e2fsprogs got renamed to e2fsprogsg? This seems to be the biggest chance to completely screw over someone's system in all of Debian now. Yes: e2fsprogs used to contain shared libs,

Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Brandon Mitchell
Greg Stark writes: We've got be be a little more careful with the Replaces header. I just installed the libc6 version of comerr, and dpkg helpfully deinstalled e2fsprogs. I can see a security problem with this. Lets jump ahead several months when we have deity working. A user

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Raul Miller
Brandon Mitchell [EMAIL PROTECTED] wrote: I can see a security problem with this. Absolutely: pre/post inst/rm scripts run as root, this is the security problem to dwarf all other security problems. Our defense is a wide audience. The more people we have looking at the system, the better

Re: be careful with Replaces, please

1997-12-01 Thread David Gaudine
On 30 Nov 1997, Greg Stark wrote: I know i should install a new e2fsprogs, obviously. I was just suggesting we should find some way to avoid the default action being to deinstall packages that aren't really being completely replaced. I'm not sure what better to do though. In this

Re: be careful with Replaces, please

1997-12-01 Thread Fabrizio Polacco
Yann Dirson wrote: Greg Stark writes: We've got be be a little more careful with the Replaces header. I just installed the libc6 version of comerr, and dpkg helpfully deinstalled e2fsprogs. That's perfectly normal if you previously had e2fsprogs = 1.10-6, which does contain

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Behan Webster
Brandon Mitchell wrote: I can see a security problem with this. Lets jump ahead several months when we have deity working. A user points deity to several sites, some providing a bunch of debs that they have created but don't want to be part of the main distribution. Now they upload a new

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Christian Schwarz
On Sun, 30 Nov 1997, Brandon Mitchell wrote: I'd also be interested in some kind of verification, so I can accept all packages put together by some maintainer, and the maintainers on the debian keyring, but no one else. I had exactly the same idea in the previous KDE/virtual package

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Marcelo E. Magallon
On Mon, 1 Dec 1997, Christian Schwarz wrote: The default keyring would probably be the developers keyring. The sysadmin could then add new keys of persons/organziations which he/she trusts to that keyring. Comments? Err... yes. Am I the only one seeing a bit of a problem here? (Or am I

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Fabrizio Polacco
Christian Schwarz wrote: I suggest that we add a new control field to our packages called Origin: (or similar). This could either be set to SPI or Debian, for example. Then, all Debian packages should be signed with some PGP key (either only one key for the whole system or by the

Re: Future security problem (was Re: be careful with Replaces, please)

1997-12-01 Thread Brandon Mitchell
On Mon, 1 Dec 1997, Marcelo E. Magallon wrote: Am I the only one seeing a bit of a problem here? (Or am I missing something I should know?) That is, PGP is non-US. To be able to put PGP in the main distribution, the master FTP site has to be moved off the US. I don't have a problem with

Re: be careful with Replaces, please

1997-11-30 Thread Yann Dirson
Greg Stark writes: We've got be be a little more careful with the Replaces header. I just installed the libc6 version of comerr, and dpkg helpfully deinstalled e2fsprogs. That's perfectly normal if you previously had e2fsprogs = 1.10-6, which does contain libcom_err ! You should

Re: be careful with Replaces, please

1997-11-30 Thread David Gaudine
On Sun, 30 Nov 1997, Yann Dirson wrote: Greg Stark writes: We've got be be a little more careful with the Replaces header. I just installed the libc6 version of comerr, and dpkg helpfully deinstalled e2fsprogs. That's perfectly normal if you previously had e2fsprogs = 1.10-6,

Re: be careful with Replaces, please

1997-11-30 Thread Raul Miller
It occurs to me that one avenue for a safe upgrade to hamm might be a jumbo-package. This would basically be a hand crafted .deb that contained (and provides) all the relevant sensitive packages. The downside is that this approach is laborious to implement. The upside is that this

Re: be careful with Replaces, please

1997-11-30 Thread Scott K. Ellis
On Sun, 30 Nov 1997, Yann Dirson wrote: Greg Stark writes: We've got be be a little more careful with the Replaces header. I just installed the libc6 version of comerr, and dpkg helpfully deinstalled e2fsprogs. That's perfectly normal if you previously had e2fsprogs = 1.10-6,

Re: be careful with Replaces, please

1997-11-30 Thread David Gaudine
On Sun, 30 Nov 1997, Scott K. Ellis wrote: BTW, is there a particular reason that e2fsprogs got renamed to e2fsprogsg? This seems to be the biggest chance to completely screw over someone's system in all of Debian now. It wasn't just renamed, it was split into e2fsprogsg and e2fslibsg.

Re: be careful with Replaces, please

1997-11-30 Thread David Gaudine
On Sun, 30 Nov 1997, David Gaudine wrote: It wasn't just renamed, it was split into e2fsprogsg and e2fslibsg. I meant to add I think. The above is what I see from the descriptions that dselect shows me. dselect also lists the old package as required base, which was a bit unnerving when I

Re: be careful with Replaces, please

1997-11-30 Thread Greg Stark
Yann Dirson [EMAIL PROTECTED] writes: Greg Stark writes: We've got be be a little more careful with the Replaces header. I just installed the libc6 version of comerr, and dpkg helpfully deinstalled e2fsprogs. That's perfectly normal if you previously had e2fsprogs = 1.10-6, which