Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-04-14 Thread Andreas Metzler
On 2013-03-31 Julien Cristau jcris...@debian.org wrote: On Sun, Mar 31, 2013 at 14:35:56 +0200, Andreas Metzler wrote: Could you please remove gnutls28 3.0.22-3 from *unstable* to make it possible to start testing the transition? We don't handle unstable. You'll have to file a bug against

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-04-14 Thread Julien Cristau
On Sun, Apr 14, 2013 at 18:38:56 +0200, Andreas Metzler wrote: On 2013-03-31 Julien Cristau jcris...@debian.org wrote: On Sun, Mar 31, 2013 at 14:35:56 +0200, Andreas Metzler wrote: Could you please remove gnutls28 3.0.22-3 from *unstable* to make it possible to start testing the

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-31 Thread Andreas Metzler
On 2013-03-20 Andreas Metzler ametz...@downhill.at.eu.org wrote: On 2013-03-19 Andreas Metzler ametz...@downhill.at.eu.org wrote: [...] Find attached a proposed patch. Its rather obvious downside is that it will break on ports, due to using a negative list (all except) where possible and a

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-31 Thread Julien Cristau
On Sun, Mar 31, 2013 at 14:35:56 +0200, Andreas Metzler wrote: Could you please remove gnutls28 3.0.22-3 from *unstable* to make it possible to start testing the transition? We don't handle unstable. You'll have to file a bug against ftp.debian.org for that. Cheers, Julien signature.asc

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-20 Thread Andreas Metzler
On 2013-03-19 Andreas Metzler ametz...@downhill.at.eu.org wrote: [...] Find attached a proposed patch. Its rather obvious downside is that it will break on ports, due to using a negative list (all except) where possible and a positive list else: [...] Having slept over it I realize this is no

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-19 Thread Andreas Metzler
On 2013-03-18 Julien Cristau jcris...@debian.org wrote: On Sun, Mar 17, 2013 at 19:26:10 +0100, Andreas Metzler wrote: On 2013-03-17 Julien Cristau jcris...@debian.org wrote: On Sun, Mar 17, 2013 at 16:00:29 +0100, Andreas Metzler wrote: [...] 2. If armel armhf mipsel break due to

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-19 Thread Julien Cristau
On Tue, Mar 19, 2013 at 20:06:38 +0100, Andreas Metzler wrote: Find attached a proposed patch. Forgot the attachment? Cheers, Julien signature.asc Description: Digital signature

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-19 Thread Andreas Metzler
On 2013-03-19 Andreas Metzler ametz...@downhill.at.eu.org wrote: Find attached a proposed patch. diff -Nru gnutls26-2.12.20/debian/changelog gnutls26-2.12.20/debian/changelog --- gnutls26-2.12.20/debian/changelog 2013-02-04 19:44:26.0 +0100 +++ gnutls26-2.12.20/debian/changelog

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-18 Thread Julien Cristau
On Sun, Mar 17, 2013 at 19:26:10 +0100, Andreas Metzler wrote: On 2013-03-17 Julien Cristau jcris...@debian.org wrote: On Sun, Mar 17, 2013 at 16:00:29 +0100, Andreas Metzler wrote: [...] 2. If armel armhf mipsel break due to --disable-largefile stop using --disable-largefile there and

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-17 Thread Andreas Metzler
On 2013-02-23 Julien Cristau jcris...@debian.org wrote: The plan seems ok to me in general. On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: +# workaround for guile testsuite failure. +ifneq (,$(filter $(DEB_BUILD_ARCH),armel armhf mipsel)) + DEB_CONFIGURE_EXTRA_FLAGS +=

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-17 Thread Julien Cristau
On Sun, Mar 17, 2013 at 16:00:29 +0100, Andreas Metzler wrote: On 2013-02-23 Julien Cristau jcris...@debian.org wrote: The plan seems ok to me in general. On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: +# workaround for guile testsuite failure. +ifneq (,$(filter

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-17 Thread Andreas Metzler
On 2013-03-17 Julien Cristau jcris...@debian.org wrote: On Sun, Mar 17, 2013 at 16:00:29 +0100, Andreas Metzler wrote: [...] 2. If armel armhf mipsel break due to --disable-largefile stop using --disable-largefile there and stop providing guile-gnutls on these archs. OK I think I'm

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-09 Thread Andreas Metzler
On 2013-03-02 Andreas Metzler ametz...@downhill.at.eu.org wrote: [...] However generally speaking I don't think pulling guile-gnutls just to get rid of --disable-largefile on armel, armhf and mipsel is necessary, gnutls versions before 2.12.10-1 were built without large file support even on

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-02 Thread Andreas Metzler
On 2013-03-01 Julien Cristau jcris...@debian.org wrote: On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: Find attached a proposed patch to build both guile-gnutls and gnutls-bin from gnutls26 instead of gnutls28 for wheezy. Would this be acceptable for an unstable upload targeted

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-02 Thread Ludovic Courtès
Hi, Andreas Metzler ametz...@downhill.at.eu.org skribis: @*Ludovic*: To give you some context, we are planning to pull gnutls28 from wheezy. If we also stopped shipping guile-gnutls instead of proving it from gnutls 2.x again we could a) get rid of a package without reverse dependencies and

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-03-01 Thread Julien Cristau
On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: Find attached a proposed patch to build both guile-gnutls and gnutls-bin from gnutls26 instead of gnutls28 for wheezy. Would this be acceptable for an unstable upload targeted for testing? Afterwards gnutls28 could be pulled from

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-02-24 Thread Julien Cristau
On Sat, Feb 23, 2013 at 19:33:14 +0100, Andreas Metzler wrote: Judging from the fact that 2.12.20 tarball does not include largefile.m4 I guess the configure option is not necessary in 2.12.20. - If you prefer to I can try without. So you're saying gnutls26 currently is built for 32bit

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-02-24 Thread Andreas Metzler
On 2013-02-24 Julien Cristau jcris...@debian.org wrote: On Sat, Feb 23, 2013 at 19:33:14 +0100, Andreas Metzler wrote: Judging from the fact that 2.12.20 tarball does not include largefile.m4 I guess the configure option is not necessary in 2.12.20. - If you prefer to I can try without. So

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-02-23 Thread Andreas Metzler
On 2013-02-20 Dominique Dumont d...@debian.org wrote: Le dimanche 10 février 2013 16:26:40, Andreas Metzler a écrit : PS: My first idea was to simply pull gnutls28, providing guile-gnutls and gnutls-bin from gnutls26 again. However there is a reverse dependency (pan) on libgnutls28 in testing

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-02-23 Thread Julien Cristau
The plan seems ok to me in general. On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: +# workaround for guile testsuite failure. +ifneq (,$(filter $(DEB_BUILD_ARCH),armel armhf mipsel)) + DEB_CONFIGURE_EXTRA_FLAGS += --disable-largefile +endif + Disabling lfs because of

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-02-23 Thread Andreas Metzler
On 2013-02-23 Julien Cristau jcris...@debian.org wrote: The plan seems ok to me in general. On Sat, Feb 23, 2013 at 18:37:12 +0100, Andreas Metzler wrote: +# workaround for guile testsuite failure. +ifneq (,$(filter $(DEB_BUILD_ARCH),armel armhf mipsel)) +DEB_CONFIGURE_EXTRA_FLAGS +=

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-02-20 Thread Dominique Dumont
Le dimanche 10 février 2013 16:26:40, Andreas Metzler a écrit : PS: My first idea was to simply pull gnutls28, providing guile-gnutls and gnutls-bin from gnutls26 again. However there is a reverse dependency (pan) on libgnutls28 in testing nowadays. Pan is not distributable currently

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-02-10 Thread Julien Cristau
On Thu, Feb 7, 2013 at 11:54:52 +0100, Andreas Metzler wrote: Hello, sadly CVE-2013-0169 also (see 699891) applies to gnutls28. I have just uploaded gnutls28_3.0.22-3 to unstable, pretty much with the same set of fixes as gnutls26 2.12.20-4 to unstable. I am not sure how you would prefer

Re: Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-02-10 Thread Andreas Metzler
On 2013-02-10 Julien Cristau jcris...@debian.org wrote: On Thu, Feb 7, 2013 at 11:54:52 +0100, Andreas Metzler wrote: sadly CVE-2013-0169 also (see 699891) applies to gnutls28. [...] PS: My first idea was to simply pull gnutls28, providing guile-gnutls and gnutls-bin from gnutls26 again.

Fixing lucky 13 CVE-2013-0169 in gnutls28

2013-02-07 Thread Andreas Metzler
Hello, sadly CVE-2013-0169 also (see 699891) applies to gnutls28. I have just uploaded gnutls28_3.0.22-3 to unstable, pretty much with the same set of fixes as gnutls26 2.12.20-4 to unstable. I am not sure how you would prefer to have this fixed in testing. Could 3.0.22-3 propagate to testing?