Re: Bug#220486: Acknowledgement (perl-suid: suidperl security)

[psz@maths.usyd.edu.au (Paul Szabo)]

Dead bod,

>> ... I find it puzzling that Debian has used "known broken" patches (over
>> and above the "upstream" code), instead of the "proper" ones.
> 
> I'm rather confused by this assertion.
> Please clarify exactly which "known broken" patches have been applied,
> and additionally provide the upstream change number of the "proper"
> ones.

I apologize if I was not clear enough.

What I meant to say: Debian has applied patches/changes to the "upstream"
perl5-porters code; these patches/changes were known not to solve the
problem; while at the time fully functional patches had been submitted to
Debian. Why were not the "good" patches used?

(All this discussion and patches are available in
  http://bugs.debian.org/203426
  http://bugs.debian.org/220486
Should I provide excerpts or otherwise point to specific sections?)

Cheers,

Paul Szabo - psz@maths.usyd.edu.au  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia