[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: testing-proposed-updates approval requested for subversion 1.0.0-1sarge2



Hi all,

I'm afraid this message seems to have slipped past me on the list -- and
past others as well, given the apparent lack of response in the archive.
Sorry for that.  Let's see what we can do about remedying that
oversight...

On Tue, 15 Jun 2004 Jeroen van Wolffelaar wrote:

> Being referred to here by Colin Watson, does somebody here know how to
> and have the power to approve the recent upload of subversion in
> testing-proposed-updates of subversion?  It is a security-only
> backport of subversion, the sid version of subversion (some upstream
> versions further) is stuck in sid due to swig and perl breakage, and 
> not going anywhere soon.

> The package fixes some security issues, CAN-2004-0397 and 
> CAN-2004-0413, both remote code execution vulnerabilities.

> The only problem I see is all the other architectures, is there some
> way it can get autobuild, or maybe is even autobuild at this very
> moment? Or does this all need hand-care? Hand-care would be a bummer,
> since it means this issue requires so many attention... which could
> better be spend elsewhere.

Since subversion is still stuck behind perl in unstable, this definitely
seems worth doing.  However, there is the question of architectures.
Autobuilding of testing-proposed-updates is supposed to happen, but:

- arm and mips have never attempted to build this version
- the sparc build failed due to awk weirdness
- the hppa build fails due to invalid compile options when building
  shared library objects
- the m68k build succeeds, but subsequently fails (miserably) the test
  suite.

I've already inquired into the status of t-p-u building for arm and
mips.  The sparc failure may be transient.  The last two problems,
though, are going to require some maintainer investigation before this
update is going to be viable.

Perl needs to get fixed in short order anyway for us to proceed with a
base freeze, so if it looks like it's going to take much longer than a
week to get the t-p-u package fixed up, you may just want to wait until
subversion makes it into testing the natural way.

Regards,
-- 
Steve Langasek
postmodern programmer

Attachment: signature.asc
Description: Digital signature


Reply to: