[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [SECURITY] [DLA 359-1] MySQL 5.5 packages added; end of support for MySQL 5.1



Hi,

Op Wed, Dec 16, 2015 at 12:19:36PM +0100 schreef Holger Levsen:
> Hi Santiago,
> 
> On Mittwoch, 16. Dezember 2015, Santiago Ruano Rincón wrote:

> > mysql-client and mysql-server are empty packages that depends on the
> > actual client and server packages. We needed to bump them, or to be more
> > precise, to not drop them from the mysql-5.5 source package, so they can
> > depend on the mysql-*-5.1 OR mysql-*-5.5 packages.
> 
> ah. the "OR mysql-*5.1" part got lost.
>  
> > Package: mysql-server
> > Source: mysql-5.5
> > Version: 5.5.46-0+deb6u1
> > ...
> > Depends: mysql-server-5.1 | mysql-server-5.5
> 
> leaving this quote here for the benefit of some people bcc:ed ;-)
>  
> > So the mysql server and client shall not be upgraded automatically.

Indeed "Please note that a dist-upgrade will not consider these MySQL 5.5
packages automatically".

> > Sorry if the DLA is not clear enough about this.
> 
> I've just re-read the DLA again and indeed the only time it speaks about 5.1 
> is about it probably suffering vulnerabilities. The DLA totally omits the OR-
> relationship and it's consequences.
> 
> I'm not sure this demands an update of the DLA, but I certainly think it would 
> justify one. Let's see how much more feedback this gets and let's keep this in 
> mind for future DLAs about similar upgrades.

FWIW, I don't think the DLA needs an update.  It clearly gives the right
instructions: "apt-get install mysql-server-5.5" or "apt-get install
mysql-client-5.5".

Indeed, output people get from their apt run might be misleading.  However, I
don't think a DLA is the place to explain the details of that.

> And for those following at home: do upgrade to 5.5!

Yup.

Thanks, Bye,

Joost

-- 
"This particular group of cats is mostly self-herding." -- Bdale Garbee

Attachment: signature.asc
Description: Digital signature


Reply to: