Re: Bug#986806: CVE-2021-28965

[Salvatore Bonaccorso <carnil@debian.org>]

Hi Pirate,

On Sun, Apr 18, 2021 at 10:26:31PM +0530, Pirate Praveen wrote:
> On Sun, 18 Apr 2021 15:04:56 +0200 Salvatore Bonaccorso <carnil@debian.org>
> wrote:
> > Hi,
> >
> > On Sat, Apr 17, 2021 at 10:34:24PM +0530, Pirate Praveen wrote:
> > >
> > >
> > > On Sat, Apr 17, 2021 at 10:16 pm, Utkarsh Gupta <utkarsh@debian.org>
> wrote:
> > > > Makes sense. Probably the time to RM ruby-rexml from the archive is
> > > > *now*?
> > >
> > > Requested removal from archive in #987101
> >
> > Thanks for filling the removal!
> >
> > I fear this has though some additional work to be done, trying to
> > simulate the removal the following is shown:
> >
> > Will remove the following packages from sid:
> >
> > ruby-rexml |    3.2.4-2 | source, all
> >
> > Maintainer: Debian Ruby Extras Maintainers
> <pkg-ruby-extras-maintainers@lists.alioth.debian.org>
> >
> > ------------------- Reason -------------------
> >
> > ----------------------------------------------
> >
> > Checking reverse dependencies...
> > # Broken Depends:
> > ruby-kramdown: ruby-kramdown
> >
> > # Broken Build-Depends:
> > ruby-kramdown: ruby-rexml
> >
> > Dependency problem found.
> >
> > Can you change tue Build-Depends of ruby-kramdown?
> 
> I think that is a bug in dak, as libruby2.7 Provides ruby-rexml.

Ack, I see.

Regards,
Salvatore