| Sysop: | Amessyroom |
|---|---|
| Location: | Fayetteville, NC |
| Users: | 28 |
| Nodes: | 6 (0 / 6) |
| Uptime: | 43:44:20 |
| Calls: | 422 |
| Calls today: | 1 |
| Files: | 1,024 |
| Messages: | 90,185 |
I noticed that the changelog in the [2] Salsa Debian
Bookworm branch does not match the one in the source code for [3] Debian 12 >Bookworm.
Could you please advise if I can proceed with proposing the patches for >Bookworm?
On Wed, 14 May 2025 at 10:02:32 +0000, Naaz, Syeda Shagufta wrote:
Could you please advise if I can proceed with proposing the patches for >>Bookworm?
Sure, please open a merge request - but you might need to coordinate
with Sean, who seems to have work-in-progress for some of the other
open CVEs.
Someone who knows this package better than I do should check your
proposed patches to make sure they make sense as a backport of the CVE
fixes.
On Wed, 14 May 2025 at 11:45:47 +0100, Simon McVittie wrote:
On Wed, 14 May 2025 at 10:02:32 +0000, Naaz, Syeda Shagufta wrote:
Could you please advise if I can proceed with proposing the patches for Bookworm?
Sure, please open a merge request - but you might need to coordinate
with Sean, who seems to have work-in-progress for some of the other open CVEs.
Someone who knows this package better than I do should check your
proposed patches to make sure they make sense as a backport of the CVE fixes.
https://salsa.debian.org/gnome-team/libsoup/-/merge_requests/4
Security team: Are you intending to issue a DSA for this, or is this
bookworm stable updates material?
The bookworm stable updates queue is currently frozen for this weekend's point release, so if this is intended to go via stable updates, someone will need to ask permission from the stable release managers after reviewing the changes.
If we are doing either a stable update or a DSA, including a fix for at
least #1091502 would probably also be wise.
It isn't clear to me whether bookworm libsoup2.4 is also vulnerable to CVE-2025-32910/CVE-2025-32912 (#1103516), CVE-2025-32914 (#1103512), CVE-2025-32909 (#1103517), CVE-2025-32906 (#1103521), CVE-2025-46420 (#1104055). If it is, it probably makes sense to address some or all of
those in the same update, rather than issuing one update per CVE.
Please keep the subject line when replying to bug reports: package maintainers
will often see your email out-of-context among thousands of other messages, and it's useful to have an idea of which package you're talking about!
On Wed, 14 May 2025 at 10:02:32 +0000, Naaz, Syeda Shagufta wrote:
I noticed that the changelog in the [2] Salsa Debian
Bookworm branch does not match the one in the source code for [3] Debian 12 >>Bookworm.
It looks as though Sean Whitton released fixes for some other CVEs but didn't update the gnome-team git repository (or perhaps wasn't able to update the gnome-team git repository). I've fetched the changes from https://salsa.debian.org/lts-team/packages/libsoup and pushed them to the gnome-team repository now, so the debian/bookworm branch should be up to date.
Sean, if you can, please push any subsequent work on libsoup2.4 to the relevant branches at https://salsa.debian.org/gnome-team/libsoup at the time that it's finalized/tagged/uploaded. (If you don't have access, I can add you,
but I think DDs might have access to gnome-team repositories anyway?)
On Wed 14 May 2025 at 11:45am +01, Simon McVittie wrote:
Sean, if you can, please push any subsequent work on libsoup2.4 to the
relevant branches at https://salsa.debian.org/gnome-team/libsoup at the time >> that it's finalized/tagged/uploaded. (If you don't have access, I can add you,
but I think DDs might have access to gnome-team repositories anyway?)
Simon, I have generally been making MRs for my updates but it would seem
that I missed some of them. I would be grateful for gnome-team
membership so that I can be sure to push everything.
On Sat, 17 May 2025 at 09:29:56 +0100, Sean Whitton wrote:
On Wed 14 May 2025 at 11:45am +01, Simon McVittie wrote:
Sean, if you can, please push any subsequent work on libsoup2.4 to the
relevant branches at https://salsa.debian.org/gnome-team/libsoup at the time
that it's finalized/tagged/uploaded. (If you don't have access, I can add you,
but I think DDs might have access to gnome-team repositories anyway?)
Simon, I have generally been making MRs for my updates but it would seem >>that I missed some of them. I would be grateful for gnome-team
membership so that I can be sure to push everything.
I can't add you to the team - sorry, I thought I could, but I'd lost track of which groups I'm an Owner in. Instead I've added you to gnome-team/libsoup (which contains source package libsoup2.4) and gnome-team/libsoup3. If you'll be working on other GNOMEish libraries for LTS, for example GLib or GTK, I can
add you to those too, or perhaps an Owner can give you access to the group as a whole.
If you have work-in-progress that you want to track, our convention is to push
branches in the wip/ namespace, like maybe wip/spwhitton/sometopic (or you can
push to a fork, either works). Merge requests also welcome, please mark them as Draft if they aren't ready to land just yet.
At the point where you're ready to upload, please push to the appropriate branch - there's no point in having merge requests to review things that, from
the archive point of view, have already happened.
On Sat, May 17, 2025 at 5:12 AM Simon McVittie <smcv@debian.org> wrote:
On Sat, 17 May 2025 at 09:29:56 +0100, Sean Whitton wrote:
Simon, I have generally been making MRs for my updates but it would seem
that I missed some of them. I would be grateful for gnome-team
membership so that I can be sure to push everything.
I can't add you to the team - sorry, I thought I could, but I'd lost
track of which groups I'm an Owner in. Instead I've added you to
gnome-team/libsoup (which contains source package libsoup2.4) and
gnome-team/libsoup3. If you'll be working on other GNOMEish libraries
for LTS, for example GLib or GTK, I can add you to those too, or perhaps
an Owner can give you access to the group as a whole.
Sean, I added you as a "Developer" for the GNOME team.