Re: Working with gbp and older releases
On wto, lut 18, 2014 at 01:29:06 -0800, Russ Allbery wrote:
> Tobias Frost <tobi@frost.de> writes:
>
> > Never had a CVE myself, but I think this is the way to go:
> > technically you don't need a debian bug, you could just write (random
> > example here [1])
>
> > maradns (version-1) unstable; urgency=high
>
> > * new upstream release
> > - fixes CVE-xxxx-xxxx, CVE-xxxx-xxxx ...
>
> > but I would file one "cover" bugs smth like "Serveral security bugs" and
> > listing alls CVE's in the bug's text and just add a Closes: # to the new
> > upstream release line.
>
> I think you were also saying this, but just to be very clear: please also
> include the CVE numbers directly in debian/changelog in the entry for
> whatever release they were fixed in, not just in the bug text. The
> security team's tracking of open security vulnerabilities relies on being
> able to analyze the debian/changelog file to determine when CVEs were
> closed in the Debian packaging.
Do I need to take experimental under consideration, i.e. modify
changelog for experimental releases ?
>
> > For the CVE's already fixed by a older version than 1.4.12, it is
> > allowed to modify the old changelog entries, when the fix was actually
> > added.
>
> Yup.
I am currently working on a package, testing it etc. I will upload to
mentors for a review tomorrow.
--
Pozdrawiam,
Dariusz Dwornikowski, Assistant
Institute of Computing Science, Poznań University of Technology
www.cs.put.poznan.pl/ddwornikowski/
room 2.7.2 BTiCW | tel. +48 61 665 29 41
Reply to: