Re: LTS work

[Sebastiaan Couwenberg <sebastic@xs4all.nl>]

On 1/9/26 6:08 PM, Bastien Roucaries wrote:
> Le vendredi 9 janvier 2026, 18:06:20 heure normale d’Europe centrale Sebastiaan Couwenberg a écrit :
> > On 1/9/26 5:51 PM, Bastien Roucaries wrote:
> > > Le vendredi 9 janvier 2026, 06:27:15 heure normale d’Europe centrale Sebastiaan Couwenberg a écrit :
> > > > On 1/8/26 9:22 PM, Bastien Roucaries wrote:
> > > > > Can i get access to team to do LTS/security work ?
> > > >
> > > > Will you also fix those issues in later versions or only in the LTS version?
> > > >
> > > > If you only work on the LTS version you don't need commit access in the team.
> > > I planed to try to fix bookworm but patch is massive
> > >
> > > Any idea ?
> >
> > I guess you're talking about:
> >
> >    https://security-tracker.debian.org/tracker/CVE-2025-60751
> >
> > The commit linked from the tracker doesn't look too bad, which makes me think you're working on something else.
> >
> > Which package and issues are your working on?
> https://security-tracker.debian.org/tracker/CVE-2025-59431

The patch we included for the trixie stable update wasn't that massive:

 https://sources.debian.org/src/mapserver/8.4.0-4%2Bdeb13u1/debian/patches/CVE-2025-59431.patch

If you need much more changes for 8.0.0 in bookwork, I wouldn't bother with it. But then again, you're getting paid for it, so it might be worth the effort for you.

> moeover technically mapserver FTBFS lexer and yacc c generated file are not regenerated at build time...

I have trouble parsing this sentence.

mapserver doesn't FTBFS on bookworm according to reproducible-builds, it might be that the its not possible to generate those sources on bookworm which was fine because we didn't need to.

> Should I open a bug ?

No, users of mapserver on bullseye or bookwork should upgrade to trixie.

Kind Regards,

Bas

--
 PGP Key ID: 4096R/6750F10AE88D4AF1
Fingerprint: 8182 DE41 7056 408D 6146  50D1 6750 F10A E88D 4AF1