Re: gtkwave update for {bookworm,bullseye,buster}-security

[Moritz Mühlenhoff <jmm@inutil.org>]

Hi Adrian,

> attached are proposed debdiffs for updating gtkwave to 3.3.118 in
> {bookworm,bullseye,buster}-security for review for a DSA
> (and as preview for buster).

Thanks!

> General notes:
> 
> I checked a handful CVEs, and they were also present in buster.
> If anyone insists that I check for every single CVE whether it is also
> in buster I can do that, but that would be a lot of work.

Nah, no need.

> As mentioned in #1060407 there are different tarballs for GTK 2 and GTK 3.
> Looking closer I realized that this is actually one tarball that 
> supports GTK 1+2, and one tarball that supports GTK 2+3.
> I did stay at the GTK 1+2 tarball that was already used before 
> for bullseye and buster since there was anyway a different upstream 
> tarball required for the +really version that is required to avoid 
> creating file conflicts with ghwdump when upgrading to bookworm.
> 
> What does the security team consider the best versioning for bullseye?
> In #1060407 I suggested 3.3.104+really3.3.118-0.1, but now I ended up
> preferring 3.3.104+really3.3.118-0+deb11u1

That's fine.

> debdiffs contain only changes to debian/

The bookworm/bullseye debdiffs looks good, please upload to security-master, thanks!

Note that both need -sa, but dak needs some special attention when
uploading to security-master. You'll need to wait for the ACCEPTED mail
before you can upload the next one.

Cheers,
        Moritz