[00:01] http://www.mozillazine.org/talkback.html?article=26135 [00:03] wtf ... http://paste.ubuntu.com/99899/ [00:04] "stray ‘\305’ in program" ? [00:04] you edited that? [00:05] no [00:05] i hope its not hardware [00:06] scary ... seemed to work on second attempt :( [00:06] my memory is dying ... sigh [00:07] i really feel bad now :/ [00:08] what do you have in dist/include/nspr/prio.h:301 ? [00:09] nothing unusual [00:09] how can i make vi show all whitespace codes? [00:09] /home/asac/mozilla/security/1.8.1/mozilla/nsprpub/pr/include/prio.h: ASCII C program text [00:09] typedef enum PRDescType [00:09] { PR_DESC_FILE = 1, PR_DESC_SOCKET_TCP = 2, PR_DESC_SOCKET_UDP = 3, PR_DESC_LAYERED = 4, PR_DESC_PIPE = 5 [00:09] } PRDescType; [00:09] PR_DESC_SOCKET_TCP = 2 is in that line [00:10] cat -tven prio.h | grep 301 [00:10] so its really memory :( [00:10] cat -tven /home/asac/mozilla/security/1.8.1/mozilla/nsprpub/pr/include/prio.h | grep 301 301 PR_DESC_SOCKET_TCP = 2,$ [00:10] http://paste.ubuntu.com/99903/ [00:11] nada [00:11] i hope its a memory corruption in gcc or some other bug there [00:11] and not my poor system :/ [00:11] https://edge.launchpad.net/+builds/berkelium [00:11] boom [00:12] *** TEST-UNEXPECTED-FAIL | ../../../_tests/xpcshell-simple/test_uriloader_exthandler/unit/test_handlerService.js | true == false [00:12] seems still active ;) [00:12] yeah [00:12] probably your issue again? [00:12] wasnt that the one with the setpref for external handler? [00:13] i don't remember [00:14] JS frame :: ../../../_tests/xpcshell-simple/test_uriloader_exthandler/unit/test_handlerService.js :: run_test :: line 155 [00:15] grr, i should not tar a bunch of symlinks to ../../../../blabla :( [00:15] yeah i think thats it [00:16] 1.8.1 browser build working :) [00:16] finally [00:16] lets see if make check works [00:17] hangs in netwerk ... of coures [00:17] http://paste.ubuntu.com/99909/ [00:18] https://bugzilla.mozilla.org/show_bug.cgi?id=444440#c31 [00:18] Mozilla bug 444440 in File Handling "Unexpected application launched when $HOME/.mailcap contains an entry for the handled mime type" [Normal,Assigned] [00:20] yeah still broken [00:23] @time [00:23] Current time in Etc/UTC: January 05 2009, 00:25:57 - Next meeting: EMEA Membership in 19 hours 34 minutes [00:25] Membership? [02:24] <[reed]> asac / fta: patches accepted! [02:25] on mailcap? [02:59] <[reed]> asac: on anything [02:59] <[reed]> :) [03:18] mozilla bug 461277 [03:18] ^^ [03:18] Mozilla bug 461277 in Embedding: GTK Widget "use G_TYPE instead of deprecated GTK_ macros in gtkmozembed.h" [Normal,New] http://bugzilla.mozilla.org/show_bug.cgi?id=461277 [03:18] not sure if superreview means that its ready [03:19] then approval would make sense [03:25] <[reed]> you don't need approval to land on mozilla-central [03:25] <[reed]> sr is enough... bsmedberg owns embedding [05:28] asac: heads up: jaunty's flashplugin-nonfree for amd64 users causes the same nondeterministic inaudible audio observed in hardy. this is due to ia32-libs and lib32asound2-plugins conflicting. [05:29] so since ia32-libs is a dependency of nspluginwrapper on amd64, lib32asound2-plugins cannot be installed on Ubuntu, so pulseaudio and all audio apps using it need to be restarted after Flash attempts to grab the sound device. [05:32] to resolve this issue, two things need to be done: 1) pulseaudio needs to build 32-bit libs for amd64 (similar to what alsa-lib and alsa-plugins do) so that lib32asound2-plugins can be built correctly, and afterward, 2) ia32-libs needs to be updated not to ship libasound2-plugins and instead depend on lib32asound2-plugins. [07:42] fta asac: the thunderbird tarballs I get with "get-orig-source" have an empty mozilla/mozilla dir, is that intended? [07:48] asac: i am also happy to start testing, in case you got the packages ;) [08:52] white, obviously not [08:53] fta: well, i was just wondering, whether you hit the same problem ;) [09:55] crimsun: thanks for the heads up [10:41] white: finally preparing the tarballs now [10:42] xul + sm + tbird + ffox (for 1.8.0 branch) [10:42] asac: ok, if you don't mind I'll start with icedove :) [10:42] asac: maybe Moritz will take other ice* as well [10:43] white: ok. let me prepare the tbird tarball next then (currently tarring up sm) [10:43] nice, newer nss fails to build on i386 with: error: implicit declaration of function ‘putenv’ [10:43] white: what is "newer"? [10:44] asac: 3.12.1-1 [10:44] we are at 3.12.2~rc1 [10:44] asac: the tarball i was getting with get-orig-source has an empty mozilla/mozilla dir btw :/ [10:45] asac: knewer as in debian new ;) [10:45] hehe [10:45] white: which package? icedove 1.5? [10:45] s/knewer/newer/ [10:45] asac: i am still working on an icedove for experimental [10:46] ah [10:46] white: you need mozilla-devscripts [10:46] installed [10:46] to produce orig [10:46] i have it [10:46] interesting [10:46] it downloads a nice thunderbird orig.tar.gz [10:46] ah ... so the icedovisation fails [10:46] hmm [10:47] for testing here, i used another tarball with all the stuff self packed and then I get the build problem, where PK11_GetAllSlotsForCert is not declared [10:47] white: take a look at the latest tbird 3 packaging branch ... i think fta moved logic from m-devscripts to the packages ... maybe thats the reason [10:49] white: there is a bug in nss version checking code in debian/rules [10:49] a)USE_SYSTEM_NSS := $(shell pkg-config --exists 'nspr >= 3.12'; a=$$?; if test $$a != 1; then echo 1; fi) [10:49] -> that should be nss >= 3.12.1 or something i guess [10:50] at least it should fall back to "in-source nss" if the version is not high enough [10:50] if 3.12 is too low for a lower bound we should fix it [10:50] let me check [10:51] asac: 3.12.0 is too low as it doesn't declare PK11_GetAllSlotsForCert [10:51] so we need 3.12.1 [10:54] so debian didnt care to fix nss on i386? [10:54] strange [10:54] 3.12.1-1: alpha amd64 arm armel hppa ia64 kfreebsd-amd64 m68k mips mipsel powerpc s390 sparc [10:54] 3.12.0-5: hurd-i386 i386 kfreebsd-i386 [10:55] i've emailed Mike about it [10:55] there are different ways to fix it i guess [10:55] i think we need a serious bug ;) [10:55] nothing filed as it seems [10:55] put the declaration of putenv everywhere, set defines or maybe compile without -Werror [10:55] all are ugly ways :) [10:55] I'll file one [10:55] package 3.12.2~rc1 ;) [10:56] thats what is currently used for ffox 3 anyway [10:56] asac: Hi [10:56] asac: do you mind if I try to build it for experimental and maybe upload later today? [10:57] asac: newer nss that is [10:57] white: give it a try. you cannot use ubuntu package unfortunately. we have reverted the soname patch from debian ... mike would hate us if we upload that to debian ;) [10:57] white: yeah. just try the new tarball with debian packaging [10:57] ok, I'll give it a try [10:58] white: take our orig i would suggest [10:58] seems like upstream doesnt release .1, .2 etc. [10:58] will do [11:02] asac: The tar in tar trick you told me yesterday. Someone commented on why I had done it. [11:04] wikz: your package doesnt ship debian/ dir in diff.gz [11:04] thats the current major issue ;) [11:04] you punched that in orig as it seems (i didnt look, but since its not in diff.gz and you say it builds I guess it is) [11:04] yeah [11:04] so where did I goof it up? [11:05] wikz: you tarred up everything [11:05] asac: true [11:05] wikz: the orig.tar.gz must only include tar.bz2 [11:05] ok ok [11:05] so just create a tar.gz archive with .bz2 in it [11:05] yes [11:06] I included the entire spicebird-0.7 [11:06] tar cvzf spicebird_0.7.orig.tar.gz spicebird-0.7/*.tar.bz2 [11:06] for instance [11:06] asac: so how come you guys have a different .orig.tar.gz which doesn't include any bz2 from mozilla. do you repack it [11:07] wikz: don't understand the question ;) [11:08] if you ask why we pack tarball on our own: answer is simply that mozilal doesnt release frequently enough. also we have to strip no free/binary stuff from it [11:08] asac: that explains it [11:08] wikz: you should remove binary only stuff too [11:09] look at the "remove.binonly.sh" in mozilla-devscripts [11:09] asac: ok will do that [11:10] white: http://people.ubuntu.com/~asac/mozilla-security/1.8.1.19/icedove-1.5.0.13+1.5.0.15b+prepatch080614i.tar.bz2 [11:10] its based on http://people.ubuntu.com/~asac/mozilla-security/1.8.1.19/moz_1.8.0.15prepatches080614i.tar.gz [11:11] asac: also I am putting all my files in /usr/lib like fta did but I think debian says that images and resources should be in usr/share. should I change the .install files? [11:12] who is debian? [11:12] e.g. who speaks for them? [11:13] if its "just" lintian feel free to ignore that complained [11:14] asac: yes lintian does for my binary packages [11:16] thats not a problem imo ... some might disagree, but well :) [11:28] asac: ok , so if I just pack tarball like you guys do can I get rid of the watch file? [11:29] and remove all the binary stuff. we don't have any non free stuff [11:31] wikz: you have a bunch of binary stuff in your tarball i guess [11:32] loads of them :) [11:33] then yes. you just need to remove binary only stuff [11:33] (binary stuff if sources are there is ok - though not encouraged) [11:35] how about if I will ask upstream to maintain a debian only source tarball so I can use a watch file too :) [11:35] asac: do you guys have a description base for the mozilla advisories somewhere? [11:35] asac: or did Moritz always search by himself through the mozilla pages? [11:37] wikz: would work [11:37] white: usually i put that info in the changelog [11:38] in previous times i sent the advisory infos to the list and mike ... but since nobody cared for quite some time i stopped dong that [11:38] white: http://www.ubuntu.com/usn/usn-690-3 [11:39] asac: yeah, Moritz complained during the last sec meeting that too few of us did any work on mozilla, thus I'm trying to take at least icedove in this round :) [11:39] those are the issues fixed in the 1.8.0 patchset [11:39] there are no "mailnews" only advisories this time [11:39] but you should also add the MFSAs ... look at the previous changelogs [11:39] to get the mapping look at the icedove changelog in unstable [11:39] will do, thanks for the pointer [11:39] that should be a superset of what is fixed in 1.8.0 [11:40] e.g. take icedove 2.0.0.19 changelog ... filter it by the CVEs from above [11:40] hmm [11:40] for 2.0.0.18 we need to go through them individually [11:40] (this release contains .18 + .19 unfortunately) [11:41] white: the starting point is usually: http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.html [11:41] i'll see that i get through them, would be great, if you could give the final version a glance though :) [11:42] white: i will for sure [11:43] white: out of the 2.0.0.18 items listed on that page, mfsa2008-52 doesnt apply for 1.8 branches [11:44] sorry ... the javascript part doesnt apply [11:44] e.g. CVE-2008-5018 is ffox 2 only (e.g. not 1.5) [11:44] but CVE-2008-5017 is valid (also 2008-52) [11:48] white: everything else in the 2.0.0.18 section of current sid icedove applies [11:48] for 2.0.0.19 part use the CVEs in the usn above to filter stuff [11:49] oh mfsa2008-48 doesnt apply either [11:49] so CVE-2008-5018 (mfsa2008-52 part 1) and mfsa2008-48 are not in 1.8.0 branches [11:49] thanks ;) [11:49] asac: you cause me a headache ;) [11:54] white: heh ; [11:54] i will give it to you in a few [11:54] white: in debian/rules you need to update TBIRD_BZ2_ARCHIVE=thunderbird_1.5.0.15pre080614i-source.tar.bz2 [11:55] that line [11:55] to refer to the proper tar.bz2 that is in archive/ [11:55] done already :) [11:56] i am test building (started 30 min ago i think) [11:56] cool [11:57] white: http://paste.ubuntu.com/100263/ [11:58] i added "not affected" to those entries from icedove that are not affected [11:58] i removed CVE 5510 as its not yet fixed on 1.8.0 (patch is a bit more complicated there) ... in case you want to add that to CVE tracker [11:58] http://paste.ubuntu.com/100265/ [11:58] annotated with proper upstream version [12:00] asac: btw would you generally be interested in using the security tracker as the source for security overviews? (public issues only of course) [12:06] asac: older stuff like http://www.mozilla.org/security/announce/2008/mfsa2008-37.html aka CVE-2008-0016 is also fixed in this round? (It was marked as fixed for 2.0.0.17-1) [12:11] btw Mike mailed me and would rather like to fix the nss FTBFS, so i guess no new experimental version :/ [13:07] yeah was expected. not sure why he doesnt like the current nss release though ;) [13:09] white: look at the bugs referenced in mfsa [13:09] http://www.mozilla.org/security/announce/2008/mfsa2008-37.html [13:09] those have approval1.8.0.next ... which means that i landed them in distro patchset [13:10] white: do you have a bugzilla account? [13:18] nope :/ [13:20] asac: good news, icedove builds on etch :) [13:27] white: yay ;) [13:27] does it work? [13:27] also test enigmail ;) [13:28] basic testing would be: imap with ssl/tls, pop with ssl/tls; dragging messages around, checking that all preferences tabs are functional (e.g. not broken); testing a langpack; testing enigmail (sign/enc); testing sending mail through SMTP and SMTP/SSL [13:29] also maybe blog subscription/rss [13:29] but well ;) [13:30] i'm still busy with the advisory, but i'll get to it :) [13:30] http://people.ubuntu.com/~asac/mozilla-security/1.8.1.19/seamonkey_1.5.0.15pre080614i-source.tar.bz2 [13:30] asac: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4070 [13:30] if you are brave you would also look at that ... seamonkey doesnt have embedded tarball [13:31] you can just use that and after that run ./debian/rules source (which will do the iceapisation :)) [13:31] white: again, look at the bug ;) [13:31] also you can see if the patch is in the "patches" directory of the tarball [13:32] it always starts with the bugnumber ;) [13:32] in this case its in the patchset ... yes. [13:32] asac: approval1.8.0.next+ [13:32] mozilla$ ls patches/425152_attachment_334030.patch [13:32] patches/425152_attachment_334030.patch [13:33] (just to clarify: i am happy to dig up everything for you ;) ... just want to teach you how you can find info on your own) [13:34] its http://www.mozilla.org/security/announce/2008/mfsa2008-46.html ... which has https://bugzilla.mozilla.org/show_bug.cgi?id=425152 [13:34] Mozilla bug 425152 in Security "heap overflow when canceling usenet message in nsNNTPProtocol::DoCancel()" [Normal,Resolved: fixed] [13:34] 13:00 < white> asac: btw would you generally be interested in using the security tracker as the source for security overviews? (public issues only of course) [13:34] don't worry, it's good to go through it with you and it helps me a lot. I'll get familiar with the stuff, sometimes i just need a little longer :) [13:34] what do you mean by that exatly ;) [13:35] white: you should really get a bugzilla account ;) ... in future you probably want to be able to see embargoed bugs and i can CC you if you have an account ;) [13:35] not really urgent for this round ... but ;) [13:36] asac: i mean that if you want i could give you access to the tracker and you could track issues there as well, if it helps you (it would of course help us heaps ;) ) [13:38] i will think about it ... what features does it provide? just adding info where what is fixed? [13:38] or can i also add comments (like this is MFSA-2008-XX - javascript part) [13:38] ? [13:38] you can also add NOTEs or TODOs [13:38] it could even be extended to track ubuntu versions [13:38] but that might be a different topic [13:38] i think we have our own tracker here ;) [13:39] (which i dont use ... just push that documentation stuff to sec team) [13:39] i will ask them ... maybe there already is a sync or something? [13:39] jdstrand: ?? [13:39] ^^ [13:40] jdstrand: white is from debian security team ... white: jdstrand is ubuntu security team ;) [13:40] asac: i've discussed the tracker issue with kees. It seems that ubuntu wants to keep their own tracker [13:41] asac: however, it would be great for us to have you using our tracker for mozilla stuff and maybe it can be useful for you in several ways [13:41] yeah most likely launchpad [13:43] white: i would definitly be willing to try that. however, i am really bad at remembering to document stuff ... so better dont rely on me - but i think as soon as i am not alone anymore this tracker thing will just resolve [13:43] asac: what's the best way to find information about issues like http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4068, where there is no bugnumber :/ [13:43] white: if there is a mfsa link then you are lucky [13:43] click on that [13:43] and there you will find the bug [13:44] no bug there [13:44] white: if there is not an mfsa link then its either unfixed or (usually) mitre was on crack and assigned stuff to non-issues [13:44] white: https://bugzilla.mozilla.org/buglist.cgi?bug_id=380994,394075,416318 [13:44] white: there is the link [13:44] asac: there is a mfa link [13:44] its on http://www.mozilla.org/security/announce/2008/mfsa2008-44.html [13:44] ah damn [13:44] above the CVE links [13:44] its just a "multi" bug CVE [13:44] nevermind :) [13:45] white: if you cannot see any of those then its embargoed and i would have to CC you [13:45] but all seem to be opened up [13:45] i'm just checking whether they are fixed or not [13:45] white: yeah ... look in patches/series [13:46] if they are not in there look in bug ... as if they dont apply i usually comment on that in the bug [13:46] asac: only one of the bugnnumbers is mentioned there [13:46] white: yeah. look at the bugs in bugzilla ... the one bug has all the patches [13:46] ah ok [13:46] the other is just testcase/documentation bugs [13:47] its frequent that there are a bunch of bugs (even with patches) and then one wrap up bug which contains the accumulated branch patches [13:47] (sorry, to throw all this at you ... its quite a lot of implicit knowledge there ... feel free to ask if you are uncertain :)) [13:49] no problem, i might have to do something else for a while now, but will try to send the advisory draft to you tonight and test the packages [13:50] white: sure [13:50] thanks so much [14:13] asac: do you know where the "compare" target comes from? icedove-3.0 fails to build for me, because the rule doesn't exist [14:13] i am curious what it does or did [14:17] white: mozilla-devscripts [14:17] white: which version are you using? [14:19] 0.12 [14:19] can i live without the target? [14:20] white: is there no /usr/share/mozilla-devscripts/compare.mk ? [14:20] yes there is [14:21] maybe it's not included for some reason [14:21] nah it's not included [14:21] -include /usr/share/mozilla-devscripts/$(DEB_MOZ_APPLICATION).mk [14:21] my DEB_MOZ_APPLICATION is icedove-3.0 [14:22] bummer [14:22] white: you probably know how to fix that ;) [14:22] we should talk with fta bout that [14:22] asac: i just wanted to remark it :) [14:23] valid [14:24] i think debhelper should get the ability to use debian/control.SOURCEPACKAGE name in preference to debian/control [14:24] in that way we could more easily maintain both in one tree [14:24] assuming that i hate templates for control ;) [14:39] white: i think i refer to the patchset in changelog usually ... the one used for this is: http://people.ubuntu.com/~asac/mozilla-security/1.8.1.19/moz_1.8.0.15prepatches080614i.tar.gz [14:40] maybe also give the tarball location [14:49] white: now i remember why iceape is soooo outdated in etch. its glandium kept calendar, so one cannot even use the upstream tarball directly [14:49] damn [14:49] thats really bad [14:59] asac: you have mail [14:59] i'll be relocating home soon, later i'll produce a nice changelog entry, rebuild and start testing [14:59] please check the draft i sent to you :) [15:01] white: thanks. try to keep the current changelog form if possible ;) [15:03] asac: ignore the formatting issues in the draft, i'll fix them up later, just tell me, if you are satisfied with the rest :) [15:07] white: s/Iceweasel/Icedove/ [15:08] white: did you do the CVE list like i said? [15:08] or are you also naming stuff that is fixed in sid? [15:08] asac: i went through the list from http://security-tracker.debian.net/tracker/status/release/stable [15:09] asac: and i added the MFSAs [15:09] (not all apply in both places) [15:09] asac: well they should apply for etch and all are fixed in sid (it doesn't matter, if some were fixed earlier) [15:10] or am i missing something? [15:11] white: have oyu checked whether those CVEs have been named in the changelog before? [15:11] i think most of them are already mentioned [15:11] so they are not fixed in this upload, but in the ones before [15:12] hmm [15:12] ok [15:13] so 2.0.0.17 never made it to security hmm [15:13] i was quite sure i uploaded that [15:13] but well ... maybe i just did xulrunner considering hits higher impact [15:14] hmm [15:15] i think there is one MFSA missing [15:16] white: * MFSA 2008-59 aka CVE-2008-4582 - Script access to .documentURI and [15:16] .textContent in mail [15:17] that one is also fixed everywhere else ... (its probably not in the tracker because the upstream MFSA doesnt provide the CVE) [15:17] well ... everywhere where the 1.8.1.18 backports have been released to [15:29] asac: have to relocate now, will answer later [16:48] asac: does CVE-2008-4582 affect icedove? I though it's only for the browsers [16:48] asac: apart from that one, any other points? [16:48] i'll write the changelog now [17:02] white: is the patch in there? [17:02] white: it doesnt apply to 1.8.0 branches [17:02] https://bugzilla.mozilla.org/show_bug.cgi?id=455311#c78 [17:03] Mozilla bug 455311 in Networking: File "[FIX]mid-autumn festival vulnerability" [Normal,Resolved: fixed] [17:03] but maybe i took https://bugzilla.mozilla.org/show_bug.cgi?id=455311#c80 anyway [17:03] in case some embedders use .desktop files [17:11] hold on, i am just finishing the changelog [17:16] yeah [17:16] i am still here ;) [17:17] iceape killed me again ... calendar/ has binary files, so no luck with diff ;) [17:17] so now uue tarball ;) [17:18] asac: does that look ok to you? http://paste.debian.net/25288/ [17:18] asac: i am a bit unsure about http://www.mozilla.org/security/announce/2008/mfsa2008-61.html aka CVE-2008-5503 [17:18] i'll check whether there is a patch in the tarball [17:19] white: please point to the tarball/patchset download source [17:19] i think i did that in previous uploads? [17:19] like: [17:19] * backports for thunderbird 2.0.0.17 stability/security update [17:20] i have in dapper: [17:20] * RELEASE security/stability backports for tbird 1.5 as of 2.0.0.19 [17:20] (USN-701-2) [17:20] - http://people.ubuntu.com/~asac/mozilla-security/1.8.1.19/moz_1.8.0.15prepatches080614i.tar.gz [17:20] white: btw, the upload we are looking at is 2.0.0.17 + 18 + 19 [17:21] also mention the tarball maybe: http://people.ubuntu.com/~asac/mozilla-security/1.8.1.19/icedove-1.5.0.13+1.5.0.15b+prepatch080614i.tar.bz2 [17:21] it's quite a nice number of issues :) [17:21] ok, step by step [17:21] white: look at the patches/series file ;) [17:21] so i have the *backports ... lines [17:21] those are all issues we backported since 1.5 went eol [17:21] those commented out are alreawdy committed [17:23] asac: then you want me to add three tarball lines pointing to patchsets? [17:24] white: no ... just to the .19 patchset + tar.bz2 [17:24] they contain the rest [17:26] can you quickly post the URLs plz? [17:33] patchset: calendar-1.0.9.tar.bz2.uue [17:33] tarball: http://people.ubuntu.com/~asac/mozilla-security/1.8.1.19/icedove-1.5.0.13+1.5.0.15b+prepatch080614i.tar.bz2 [17:33] patchset: http://people.ubuntu.com/~asac/mozilla-security/1.8.1.19/moz_1.8.0.15prepatches080614i.tar.gz [17:36] asac: what's calendar-1.0.9.tar.bz2.uue [17:38] white: thats a paste error ;) [17:38] :) [17:38] i am trying to push calendar parts to iceape diff.gz [17:38] so we can use tarballs again [17:38] ok anything else or can i start a nice build in cowbuilder? [17:38] mike apparently shuffled the upstream tarballs without a repro instruction ;) [17:39] white: yes, why do you say "non-maintainer upload"? [17:39] imo its not really unusual that security team does security uploads for packages they dont maintain ;) [17:39] asac: common practise by most sec members [17:40] asac: i don't really maintain many packages anymore and do more uploads of packages i don't maintain ;) [17:40] yeah ... but isnt really informative ;) [17:40] why would anybody want to know that its a NMU? [17:40] it informs that it is a sec upload [17:40] if that info is good to have it shouldnt have the "top" place ;) [17:40] and performed by someone from the sec team (although that doesn't mean much) [17:40] white: thats already said by the other line [17:41] since it's common practise I'd prefer to keep it [17:41] i dont mind ,) [17:41] :) [17:42] oh [17:42] # [17:42] * MFSA 2008-67 aka CVE-2008-5510 - Escaped null characters ignored by CSS [17:42] # [17:42] i think thats the one that isnt fixed [17:42] hmm, it was marked as fixed in - icedove 2.0.0.19-1 [17:42] yeah [17:42] in our tracker, which doesn't have to mean anything :) [17:42] its low severity and patch was too intrusive to take in this round [17:43] ok, i'll take it out then [17:43]