Re: Security issue in groovy<2.5.0

[Felix Natter <fnatter@gmx.net>]

hello Debian-java,

Emmanuel Bourg <ebourg@apache.org> writes:
> Le 17/08/2017 à 20:18, Felix Natter a écrit :
>
>> So the question is: Can I package freeplane without the 'securegroovy'
>> library, expecting that groovy 2.5 will be released soon, and will
>> shortly after be packaged for Debian?
>
> Yes ignore securegroovy, we have to directly patch or upgrade our groovy
> package in this case.

I have backported the single GROOVY-8163 [1] [2] commit (plus a missing
import), and pushed the result here:
  https://anonscm.debian.org/cgit/pkg-java/groovy.git

[1] https://issues.apache.org/jira/browse/GROOVY-8163
[2] https://github.com/apache/groovy/commit/0305a38a0cc8f4190a1486c460ebc6f712ad1a07

I have tested this extensively with freeplane.

Could someone please consider sponsoring this?

I assumed a QA upload because lintian complains about missing Uploader:
and because of Paul Wise's advice. Shall I revert to team upload?

Thanks and Best Regards,
-- 
Felix Natter
debian/rules!