Bug#1035748: unblock: modsecurity/3.0.9-1
hi there,
sorry to join this conversation :),
On Thu, Jun 01, 2023 at 09:52:06PM +0200, Paul Gevers wrote:
> control: tags -1 moreinfo
>
> Hi,
>
> On 28-05-2023 21:30, Alberto Gonzalez Iniesta wrote:
> > 2) The risks on the release quality are almost zero. Only
> > libnginx-mod-http-modsecurity depends on it (being modsecurity a
> > library).
>
> That's not the only part that we mean here. We also mean, how big is the
> risk we introduce new *unknown* issues.
I think there is absolutely no risk. Bot package (libmodsecurity3
and libnginx-mod-http-modsecurity) is totally new packages, we
won't introduce any "unknown" issues.
Or - sorry to say - I don't see what issues do you think about.
> > 4) No idea
>
> Then I don't think so. If your upstream would have a decent stable update
> policy, they wouldn't introduce so many gratuitous changes (e.g. white space
> only).
Unfortunately the vendor releases new versions randomly. :(
> > 6) Yes
>
> I fail to spot it. Can you please point which version?
Hmmm... I don't think so (I mean the correct answer for the 6th
question is no). As I noted above, both packages are totally new.
(But the demand is very big)
> > 7) Its too long but mainly because of line numbers being updated in code
> > comments, like:
> > -#line 1459 "seclang-parser.yy"
> > +#line 1461 "seclang-parser.yy"
> > 8) Not that many code changes
>
> Yet there is a huge amount of white space changes and other changes that
> look gratuitous. This is really not looking like a targeted fix. @Salvatore,
> can we do a targeted security upload via security?
these files (which created the huge diff) are generated by Bison.
These describe the grammar for the SecLang configuration syntax.
This is how a compiler works: if the developer adds a new token,
change a small behavior, then it can result a huge diff.
(A side note: not these files (above) have huge diff, but the
derived ones: seclang-parser.cc, seclang-parser.hh,
seclang-scanner.cc)
> > 9) Not that difficult :-)
>
> Might be, but impossible to review between all the cruft.
The mentioned files have huge diff, but those diff's are because
of those files are compiled.
You can consider these like a .am file, which generated from a
.in file with help of autotools.
I'm not sure anyone wants to review a .am file :)
Sorry again,
and thanks for your time/help.
a.
Reply to: