Hi, (dropping the ubuntu-release@ from the CC list, as the moderation delay makes having a thread there a bit senseless)
Quoting Robie Basak (2021-11-22 17:59:32) > On Fri, Nov 19, 2021 at 12:54:22PM -0500, Sergio Durigan Junior wrote: > > I'd like to raise something. I apologize for sending this message in > > such short notice. > > > > I am working on net-snmp, squid and a few other packages during this > > transition, and I am feeling concerned with how uncomfortable some of > > our upstreams seem to be regarding their patches to support OpenSSL 3. > > I can mention a few cases here. > > > > net-snmp has a patch to support OpenSSL 3 in theory, but they are still > > discussing a few details here: > > https://github.com/net-snmp/net-snmp/issues/294 . It seems like they > > have sorted out most of the issues so far, which is good, but I'm still > > not 100% confident in backporting their patch yet. > > Just to add to this, when we do have patches ready, what should be our > process to get any security-sensitive backport patches reviewed - in the > cases that we're introducing them ahead of an upstream release - to > avoid inadvertent security regressions? Thanks for voicing this. I'm afraid I personnally cannot answer this question, as I feel I lack the relevant experience. However, a first step could perhaps be to document all those patches on LP, using the existing tag 'transition-openssl3-jj', and notify upstream when we upload unreleased patches, on the relevant PR/MR/thread? (which would mean I probably have a backlog of notifying to do...) Cheers, Simon -- ubuntu-devel mailing list ubuntu-devel@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel