| lubot | <Yesenia Sandoval> Fwd from Top: https://t.me/joinchat/AAAAAFIaauLQ-cq1MEwj-w | 01:17 |
|---|---|---|
| lubot | <teward001> *drops a grenade* | 18:27 |
| lubot | <teward001> The_LoudSpeaker I'd have to review the package first and get an idea for how maintainable it is, etc. One of the things we're working on behind the scenes is that there's a dedicated developer willing to maintain the software | 18:27 |
| lubot | <teward001> even while in backports (you can't just backport and forget, security concerns and what not) | 18:28 |
| lubot | <teward001> but the process hasn't been finalized yet | 18:28 |
| lubot | <teward001> and right now backports are selectively approved/handled | 18:28 |
| The_LoudSpeaker | so you are saying you can look into the package and approve it? | 18:29 |
| lubot | <teward001> i can look into the package | 18:30 |
| lubot | <teward001> but then I have to talk to Laney about it | 18:30 |
| lubot | <teward001> *and* it needs someone with upload privs to be willing to maintain it | 18:30 |
| lubot | <teward001> long term and provide security updates, etc. backporting where needed | 18:30 |
| lubot | <teward001> backports isn't going to be as simple as 'oh ok we can backport it' anymore in the future :P | 18:30 |
| The_LoudSpeaker | also, its in universe rn so it will stay in universe itself? or migrate into backports? | 18:30 |
| The_LoudSpeaker | you don't have the upload rights? | 18:30 |
| The_LoudSpeaker | also, you can look at the source via a apt source micro on focal or groovy. focal has 2.0.1 and groovy has 2.0.6 afaik. | 18:32 |
| The_LoudSpeaker | need to get 2.0.6 in focal | 18:32 |
| lubot | <teward001> oh i have upload rights the question is "do I really want to maintain this going forward" | 18:32 |
| lubot | <teward001> as i just said | 18:32 |
| lubot | <teward001> backports is no longer an "upload and forget" | 18:32 |
| lubot | <teward001> whoever wants it in backports (i.e. me, etc.) needs to be willing to maintain the package, patches, etc. going forward. it ALSO needs to build with minimal changes. | 18:33 |
| lubot | <teward001> and right now backports is pretty stagnant/dead right now | 18:33 |
| The_LoudSpeaker | yeah for the same reason I asked if it really needs to go to backports? | 18:33 |
| The_LoudSpeaker | its already in universe repos of focal | 18:33 |
| lubot | <teward001> > micro maintained | 18:34 |
| lubot | <teward001> what exactly is 'micro maintained' lol | 18:34 |
| The_LoudSpeaker | what I mean is can someone update micro which right now is sitting in focal-universe to the latest version thats present in groovy-universe ? | 18:36 |
| The_LoudSpeaker | it was " a package named micro, maintained in debian by a friend" not "micro maintained". wouldn't make sense. | 18:37 |
| lubot | <teward001> yeah well you weren't clear ;P | 18:37 |
| The_LoudSpeaker | well you haven't provided me my coffee yet. maybe that's why. | 18:38 |
| lubot | <teward001> the source package is named 'micro' yes? | 18:38 |
| The_LoudSpeaker | yes! | 18:38 |
| lubot | <teward001> NACK | 18:38 |
| lubot | <teward001> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964271 | 18:38 |
| The_LoudSpeaker | its a text editor. | 18:38 |
| lubot | <teward001> autoremoval on the 17th | 18:39 |
| lubot | <teward001> unless your friend and the Debian Go Packaging Team are willing to *fix* this grave RC bug | 18:39 |
| lubot | <teward001> i'm not backporting it | 18:39 |
| lubot | <teward001> hell I'll even request it's removal from Ubuntu if the issue is grave enough :P | 18:39 |
| lubot | <teward001> (welcome to the security centric mindset I have) | 18:39 |
| The_LoudSpeaker | okay. I will let them know about this RC bug. | 18:40 |
| lubot | <teward001> if they read the package tracker like I do | 18:41 |
| lubot | <teward001> they'd already know it | 18:41 |
| lubot | <teward001> tell em to read https://tracker.debian.org/pkg/micro regularly | 18:41 |
| lubot | <teward001> I do this with ALL my packages I maintain in Debian | 18:41 |
| The_LoudSpeaker | noted. | 18:41 |
| lubot | <teward001> should point out that notice has been on the tracker since the 7th of July | 18:41 |
| lubot | <teward001> and it's a month since then | 18:41 |
| lubot | <teward001> soooooooooooooooooooooooooooo | 18:41 |
| The_LoudSpeaker | yeah yeah I got it. | 18:42 |
| lubot | <teward001> the issue is also in a go-dependent package so | 18:42 |
| lubot | <teward001> the dep on golang-x-text is the problem since that has the grave RC bug | 18:42 |
| lubot | <teward001> if you can't work with the package without golang-x-text and the Debian Go Package Team and Upstream don't fix the CVE then the package gets removed from testing | 18:43 |
| The_LoudSpeaker | I think you should join us in #debian-golang on oftc and remind them. | 18:44 |
| lubot | <teward001> not my job to look after packages I don't have a vested interest in :P | 18:45 |
| lubot | <teward001> YOU however can make that notice yourself | 18:45 |
| lubot | <teward001> that said | 18:45 |
| lubot | <teward001> they may be waiting on Upstream to patch it | 18:45 |
| lubot | <teward001> or for upstream to make a major version release because https://github.com/golang/go/issues/39491 is marked 'fixed' | 18:46 |
| The_LoudSpeaker | yeah just saw | 18:46 |
| The_LoudSpeaker | they are pobably waiting for a new release | 18:46 |
| lubot | <teward001> still labeled 'needs fixed' upstream but the issue is closed so | 18:46 |
| lubot | <teward001> well unless they release by the 17th that apcakge and its rdeps get purged from testing | 18:46 |
| The_LoudSpeaker | and after that from groovy-universe? | 18:47 |
| The_LoudSpeaker | well @teward001 check this: | 18:49 |
| The_LoudSpeaker | <The_LoudSpeaker> utkarsh2102: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964271 is important for micro it seems. | 18:49 |
| The_LoudSpeaker | [zwiebelbot] Debian#964271: golang-x-text: CVE-2020-14040 - https://bugs.debian.org/964271 | 18:49 |
| The_LoudSpeaker | <utkarsh2102> The_LoudSpeaker: there's no need to fix this here | 18:49 |
| The_LoudSpeaker | <utkarsh2102> It's already fixed in golang-golang-x-text. | 18:49 |
| The_LoudSpeaker | <The_LoudSpeaker> the fix is in debian? i mean uploaded? | 18:49 |
| The_LoudSpeaker | <utkarsh2102> In the next upload of micro, we'll switch from golang-x-text to golang-golang-x-text. | 18:49 |
| The_LoudSpeaker | <utkarsh2102> yep. | 18:49 |
| ubot93 | Debian bug 964271 in src:golang-x-text "golang-x-text: CVE-2020-14040" [Grave, Open] | 18:49 |
| ubot93 | The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Deco... <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040> | 18:49 |
| The_LoudSpeaker | <The_LoudSpeaker> okay. once you do that let me know. I got you a sponsor for it in focal-universe | 18:49 |
| The_LoudSpeaker | <utkarsh2102> It was fixed and uploaded on 15th July. | 18:49 |
| The_LoudSpeaker | <utkarsh2102> The_LoudSpeaker: perfect! | 18:49 |
| lubot | <teward001> no you haven't gotten a sponsor yet | 18:50 |
| The_LoudSpeaker | XD | 18:50 |
| lubot | <teward001> oh ALSO | 18:53 |
| lubot | <teward001> NACK becuase E:MissingDependencies | 18:53 |
| The_LoudSpeaker | this is gonna be a chain of SRUs then. | 19:04 |
| lubot | <teward001> yep | 19:31 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!