Bug#987353: CVE-2020-8903 CVE-2020-8907 CVE-2020-8933
On Thu, May 13, 2021 at 09:56:53PM +0100, Marcin Kulisz wrote:
>
> I hope that we're be able to change it, but for me fundamental
> question is if Google is interested in participating in effort to
> keep those packages in Debian main and if so what resources can be
> committed to do so. From my side I can say that I'll try to find
> time to work on the relevant packages or to sponsor uploads if
> somebody else want to take on this task.
I'd be interested in helping; while I happen to work for Google, this
would only be in my personal compacity. One caveat, though, which is
why I've hesitated in replying, is I don't have any experience
packaging Python applications.
In particular, if the Google SDK requires python packages that are
either newer or older than what is packaged in Debian, Debian's
prohibition of private copies of dependencies could make this quite
painful (if nothing else, just simply testing to make sure things
still work with variations in the Python packages available in
Debian)....
- Ted
Reply to: