Re: kernel security upgrades

2005-03-28 Thread Andreas Barth
* Andreas Barth ([EMAIL PROTECTED]) [050328 20:35]: > If I understood the comments in base-installer/kernel/README correct, > only the architectures with shell scripts that use KERNEL_ABI have this > problem? If this is true, we only have it on hppa and s390, and in this > case, I think we should b

Re: kernel security upgrades

2005-03-28 Thread Andreas Barth
* Andreas Barth ([EMAIL PROTECTED]) [050327 20:35]: > Or, the generic solution would be to update update the udeb now in a way > that it always downloads an appropriate meta-package (yes, that would be > quite many meta-packages), so that we can can update the kernel and just > update the meta pack

Re: kernel security upgrades

2005-03-27 Thread Andreas Barth
Hi, just as pre-comment: I know that d-i development is in a quite late phase, and I don't know enough about d-i to know which ideas are easy and which ones are bad - so, my questions are real questions, and please feel free to just cluebat me enough if I'm silly. (And thanks to Frans and the othe

Re: kernel security upgrades

2005-03-26 Thread Frans Pop
On Saturday 26 March 2005 11:45, Andreas Barth wrote: > system 5. remove old udebs: >breaks businesscard cds the hard way, because they want to retrieve >them You are still somewhat confused Businesscard CD can be broken because it downloads the kernel for the new system and version

Re: kernel security upgrades

2005-03-26 Thread Andreas Barth
Hi, one more summarization for me (as one of my mentores told me, in French, there is a proverb that goes "the night is the best advisor", and I had some good ideas this night :). If we do the following, we need to/we break (numbers only for reference): 1. add new normal kernel images: updat

Re: kernel security upgrades

2005-03-25 Thread Andreas Barth
* Martin Schulze ([EMAIL PROTECTED]) [050325 17:50]: > Andreas Barth wrote: > > Ok, summarising this means for me: > > > > If we change the abi for d-i, than a lot of work at a lot of places > > needs to be done. Definitly possible, but not the thing we want to do > > for each security upgrade.

Re: kernel security upgrades

2005-03-25 Thread Martin Schulze
Andreas Barth wrote: > Ok, summarising this means for me: > > If we change the abi for d-i, than a lot of work at a lot of places > needs to be done. Definitly possible, but not the thing we want to do > for each security upgrade. On the other side, as long as we keep the > old kernel around, an

Re: kernel security upgrades

2005-03-25 Thread Andreas Barth
* Joey Hess ([EMAIL PROTECTED]) [050325 17:05]: > Andreas Barth wrote: > > [What changes to d-i need to be done for a security upload?] > Besides building the udebs, if the abi changes we have to update rootskel, > base-installer, and the debian-installer build system. >> [...] > Not quite accura

Re: kernel security upgrades

2005-03-25 Thread Joey Hess
Andreas Barth wrote: > [What changes to d-i need to be done for a security upload?] Besides building the udebs, if the abi changes we have to update rootskel, base-installer, and the debian-installer build system. > The d-i changes are only finalized with the next point release - but well, > that

kernel security upgrades

2005-03-25 Thread Andreas Barth
Hi, this mail consists of two parts: First, I describe my understanding of how any kernel upgrade currently works. Please feel free to cluebat me if I got it wrong. After that, I list some ideas how we can minimize the amount of work for the security team once sarge is hard frozen, and the roun