Re: jessie update for mercurial

[Moritz Muehlenhoff <jmm@inutil.org>]

On Thu, Jun 07, 2018 at 08:08:06AM -0400, Antoine Beaupré wrote:
> On 2018-06-07 04:45:06, Chris Lamb wrote:
> > Hi Antoine,
> >
> >> A peculiar thing with the patchset is that it adds the --debug flag to
> >> the test suite: I don't know why, but it's the only way to make it pass
> >> the (new) test-http-permissions.t tests. Otherwise it just hangs there
> >> forever.
> >
> > Personally, it would make me very very hesitant to propose a patch
> > (yet alone release it via security update) when I had not discovered
> > the reason for this.
> >
> > Bear in mind that the cause may not be in the testsuite and could be
> > in the actual run-time code itself — ie. the improved testsuite is
> > simply exposing it, just as it should.
> 
> The problem is the testsuite is forward-ported from wheezy, which itself
> is backported from i don't remember where.

Never do that! If the fix e.g. requires changes in jessie which were stripped
from the wheezy backport as the affected code isn't present there, you
end up with an incomplete security update.

Any backport always needs to be done invidually per release from the upstream 
patch.

Cheers,
        Moritz