[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#689147: unblock: gajim/0.15.1-1



On 12/27/2012 10:48 PM, intrigeri wrote:
Control: tag -1 - moreinfo

Hi,

Yann Leboulanger wrote (12 Dec 2012 16:53:48 GMT) :
On 12/12/2012 03:41 PM, intrigeri wrote:
Which means we can now get back to why this update of an embedded
library should be unblocked. Why is this update needed? Is the version
embedded in testing / in unstable (based on) the same as the one
packaged in python-gnupg?
this version of Gajim doesn't only fix this embedded library
But the version embedded fixes some unhandeled errors, as I told you in the previous
mail. Full diff against python-gnupg-0.3.0 attached
Thanks for the additional information, I think we now have everything
needed to make a well-informed decision!

I'm absolutely not sure what is the best thing to do now:

  1. unblock the embedded python-gnupg copy to the "current copy of
     Wheezy's python-gnupg + small change that supposedly improves
     things": take the risk to see a regression in gajim due to changes
     brought by the library update;

Have you seen the diff? I don't see what security issue it could cause. But without it, Gajim can traceback, that is a fact.
  2. revert the embedded python-gnupg copy update: take the risk to
     make it harder to support serious bugs or security issues that may
     be found in python-gnupg in the future.

I'm slightly lending towards #1, but not too satisfied with it,
so I'll let the Release Team make their own opinion on this matter
(not that I could do differently, anyway :)

Note that, even if this unblock is granted, gajim remains RC-buggy in
Wheezy and unstable due to the #693048 security issue.

As all other Gajim versions. Bug is fixed upstream, but not enough tested to be included for the moment. So do what you want, remove Gajim from Debian because of this security issue if you want.

Just note that it's now 3 monthes that debian testing users cannot use video in Gajim because 0.15.1 is still blocked.

--
Yann


Reply to: