[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#917867: marked as done (singularity-container: not supportable for Stable)

Your message dated Fri, 18 Jan 2019 03:07:12 -0500
with message-id <1ed07ee6-5d4a-07b0-ed91-d4900ea8a281@debian.org>
and subject line singularity-container: upstream clarificaton
has caused the Debian Bug report #917867,
regarding singularity-container: not supportable for Stable
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
917867: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=917867
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: singularity-container
Version: 2.6.1-1
Severity: serious

singularity-container previously had to be removed from stretch [1] due to the
unfeasibility of security support for that version [private communication with
security team and upstream]. While upstream has gotten better about marking
vulnerable versions of the software and using CVEs, it turns out that security
support will remain unfeasible [2]. Security support for the community is only
promised by upstream for the latest release [3]. Therefore,
singularity-container should be blocked from testing so that it does not enter
a stable release.

1. https://bugs.debian.org/898154
2. https://lists.debian.org/debian-hpc/2018/12/msg00029.html
3. https://www.sylabs.io/singularity/

--
Afif Elghraoui

--- End Message ---
--- Begin Message --- 
Version: 2.6.1-1
A clarification from upstream to <https://groups.google.com/a/lbl.gov/d/msg/singularity/kbtX1UekVrg/LCs4ablCDwAJ> indicates that security patches developed for the SingularityPRO LTS versions will always be made available, so we'll have something we can backport to Stable as needed. 


--
Afif Elghraoui | عفيف الغراوي
http://afif.ghraoui.name

--- End Message ---
Reply to: