Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel.release > #123574

Re: Coordinate response to xz-utils (DSA 5649-1)

Show all headers | View raw

Hi,

On 2024-03-29 23:59, Ansgar 🙀 wrote:
> Hi,
> 
> how should we react to the compromised xz-utils upload?
> 
> Ubuntu is reverting their amd64 binaries to pre-Feb 25 and rebuilding
> stuff.
> 
> On Debian side AFAIU currently amd64 buildds are paused and pending
> reinstall (plus rotation of key material, both OpenPGP and SSH).

All the 8 existing VMs at csail, conova, grnet and ubc have been
shutdown, and their GPG key have been removed on the dak side. Their SSH
key is managed by puppet, so are still enabled at this time, but their
restricted command has been disabled as they are not allowed to build
any architecture.

2 new VMs have been created, x86-grnet-03 and x86-grnet-04. Currently
they only build buster, bullseye and bookworm and the associated
security suites. I didn't enable backports, as it probably needs to be
audited for the builds after Feb 25, like it was done for the security
suites using reproducible builds.

Aurelien

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                     http://aurel32.net

Back to linux.debian.devel.release | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Coordinate response to xz-utils (DSA 5649-1) Ansgar 🙀 <ansgar@43-1.org> - 2024-03-30 00:10 +0100
  Re: Coordinate response to xz-utils (DSA 5649-1) Pierre-Elliott Bécue <peb@debian.org> - 2024-03-30 00:20 +0100
  Re: Coordinate response to xz-utils (DSA 5649-1) Aurelien Jarno <aurel32@debian.org> - 2024-03-30 09:30 +0100
  Re: Coordinate response to xz-utils (DSA 5649-1) Bastian Blank <waldi@debian.org> - 2024-03-30 10:50 +0100
    Re: Coordinate response to xz-utils (DSA 5649-1) Bastian Blank <waldi@debian.org> - 2024-03-30 12:40 +0100

csiph-web