Re: Contacting maintainers about no-dsa

Hi, On 08/03/2019 15:54, Holger Levsen wrote: > On Fri, Mar 08, 2019 at 12:22:40PM +0100, Sylvain Beucler wrote: >> I was about do contact the nettle and gnutls maintainers, but after >> discussing with Emilio on IRC it appears that we do not contact >> maintainers for this anymore. >> >> Should w

Re: Contacting maintainers about no-dsa

On Mon, Mar 11, 2019 at 10:48:24AM +0100, Sylvain Beucler wrote: > A few days passed, I assume we reached consensus :) :) indeed. > I rephrased to explain this is not required. Also added the "no-dsa" > keyword in the previous section and clarified that one can fix a no-dsa > if they want to. ni

Re: Serious regression in systemd 215-17+deb8u10

Thanks for your responses. One of my colleagues has been looking into this trying to get the bottom of it and we do seem to have identified a memory leak which isn't present on stretch. I note the report posted to the list https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924060. Here are what

Re: Serious regression in systemd 215-17+deb8u10

Am 11.03.19 um 15:51 schrieb Dan Poltawski: > Thanks for your responses. One of my colleagues has been looking into this > trying to get the bottom of it and we do seem to have identified a memory > leak which isn't present on stretch. I note the report posted to the list > https://bugs.debian.

sqlalchemy testsuite

Hi, Here are some notes about running the sqlalchemy test suite on jessie. The document leaves a lot of the setup up to the user. I still have some failures with MySQL and Unicode, even when configuring everything in utf8... I'm aggregating test suite notes at https://wiki.debian.org/LTS/TestSuit

Time allocation per CVE

Hi, I spent the day reproducing (unbreaking) the sqlalchemy exploit, figuring out how to run the test suite, attempting a backport of the upstream fix, plus some communication. I did about the same for the gnutls/nettle issue last week (only to conclude with a no-dsa T_T). While I believe those

Re: Serious regression in systemd 215-17+deb8u10

Am 11.03.19 um 19:17 schrieb Markus Koschany: > > Am 11.03.19 um 15:51 schrieb Dan Poltawski: >> Thanks for your responses. One of my colleagues has been looking into this >> trying to get the bottom of it and we do seem to have identified a memory >> leak which isn't present on stretch. I note

Re: rdflib / CVE-2019-7653

Chris Lamb writes: >> > Hmm, I'm still seeing "reversed" bits in the chunk that don't make >> > immediate sense to me. Perhaps we just need a more-detailed changelog >> > entry (rather than an explanation reply on this list) however. (For >> > example "debian/scripts/rdfs2dot"...?) >> >> What pa

Re: ikiwiki / CVE-2019-9187

Brian May writes: > Oh wait, this is a debian native package. Means I will probably have to > patch the files directly, not rely on debian/patches. So was only > working before because I was testing with patches applied. > > Curiously I am getting a test failure when testing without my patches.