Hello Vincent, Thank you for the recommendation.I was going to propose a wheezy update at first, but I opted for wheezy-backports exactly because of devref 5.5.1:
"Extra care should be taken when uploading to stable. Basically, a package should only be uploaded to stable if one of the following happens:
* a truly critical functionality problem * the package becomes uninstallable * a released architecture lacks the package"The mentioned bug shows itself in at least some Xeon CPUs as far as I can tell, but only impacts encrypted BitTorrent transfers.
The library remains perfectly usable for unencrypted tranfers.I also informed the current maintainer so that he may decide whether this is "a truly critical functionality problem".
In my humble opinion it's not. It may be average or important, not critical. Martino Dell'Ambrogio Security Auditor Web: http://www.tillo.ch/ Email: tillo@tillo.ch On 08/31/2014 12:57 AM, Vincent Cheng wrote:
Hi Martino, On Fri, Aug 29, 2014 at 2:03 AM, Martino Dell'Ambrogio <tillo@tillo.ch> wrote:Package: sponsorship-requests Severity: normal Dear mentors, I am looking for a sponsor for my package "libtorrent-rasterbar" on wheezy-backports. This is a straightforward rebuild of the current testing package. The reason for wanting libtorrent-rasterbar 0.16.x (libtorrent-rasterbar7, python-libtorrent...) on the current stable is that it fixes a crash bug involving OpenSSL and encrypted transfers for any bittorrent client depending on the library.If your intent for providing this backport is to fix a bug in stable, I strongly recommend that you instead fix it in stable proper, i.e. prepare a minimal diff against the package in wheezy and file a wheezy proposed update request against the release.debian.org pseudo-package with reportbug (see devref 5.5.1 [1] for more details). Once the release team approves of the debdiff, you can then request a sponsor here as well (or contact the maintainers/uploaders to see if they'd be interested in fixing the bug in wheezy themselves). Regards, Vincent [1] https://www.debian.org/doc/manuals/developers-reference/pkgs.html#upload-stable
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature