Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #63503 > unrolled thread

Re: firmware-nonfree update

Back to article view | Back to linux.debian.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: firmware-nonfree update Ben Hutchings <ben@decadent.org.uk> - 2019-03-05 23:10 +0100
    Re: firmware-nonfree update Ben Hutchings <ben@decadent.org.uk> - 2019-03-25 18:30 +0100
      Re: firmware-nonfree update Ben Hutchings <ben@decadent.org.uk> - 2019-03-26 18:10 +0100
      Re: firmware-nonfree update Ben Hutchings <ben@decadent.org.uk> - 2019-04-02 06:30 +0200

#63503 — Re: firmware-nonfree update

[Multipart message — attachments visible in raw view] — view raw

On Fri, 2019-03-01 at 14:05 +0100, Emilio Pozuelo Monfort wrote:
> Hi Ben,
> 
> I have prepared an update for CVE-2018-5383/firmware-nonfree by backporting the
> fixed firmware from the upstream repo that I could find. See my two commits in:
> 
> https://salsa.debian.org/pochu/firmware-nonfree/commits/jessie-security
> 
> I built the packages and compared one of the non-affected packages (qlogic) and
> only the changelog has changed. Comparing atheros, the two drivers are updated,
> and for intel some of the files are updated. However I see that for intel there
> are some drivers that we don't ship in that version of firmware-nonfree, e.g.
> ibt-{17,18}-*. For those, I wonder if we should update and ship them. If there's
> any user with that hardware, they would need a firmware update I suppose.

firmware-nonfree is meant to support the kernel version(s) shipped in
the same suite, in the previous release, or in intermediate versions. 
So for jessie that's 3.2-4.9 inclusive.  If one of those kernel
versions may request the added files then they should be packaged. 
Otherwise it's not necessary - users installing a newer kernel package
from another suite can get the firmware packages from there too.

> (It
> may be unlikely for old suites to have users with new hardware, however it's
> possible and users that don't have it will be unaffected by the new firmware, so
> it wouldn't hurt to ship it.)
> 
> My branch is for jessie but I can prepare it for stretch too if you think that's
> worth it.

The current jessie-security version of firmware-nonfree is really a
backport from stretch.  So I would prefer it if you update the stretch
branch first and then merge that to jessie-security.

Ben.

-- 
Ben Hutchings
friends: People who know you well, but like you anyway.

[toc] | [next] | [standalone]

#63691

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2019-03-05 at 22:00 +0000, Ben Hutchings wrote:
> On Fri, 2019-03-01 at 14:05 +0100, Emilio Pozuelo Monfort wrote:
[...]
> > (It
> > may be unlikely for old suites to have users with new hardware, however it's
> > possible and users that don't have it will be unaffected by the new firmware, so
> > it wouldn't hurt to ship it.)
> > 
> > My branch is for jessie but I can prepare it for stretch too if you think that's
> > worth it.
> 
> The current jessie-security version of firmware-nonfree is really a
> backport from stretch.  So I would prefer it if you update the stretch
> branch first and then merge that to jessie-security.

I've merged your changes to stretch, uploaded to stretch, and then
merged stretch to jessie-security.  Let me know if you want to do the
upload to jessie-security or if I should do it.

Ben.

-- 
Ben Hutchings
I'm not a reverse psychological virus.
Please don't copy me into your signature.

[toc] | [prev] | [next] | [standalone]

#63696

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2019-03-26 at 17:51 +0100, Emilio Pozuelo Monfort wrote:
> On 25/03/2019 18:20, Ben Hutchings wrote:
> > On Tue, 2019-03-05 at 22:00 +0000, Ben Hutchings wrote:
> > > On Fri, 2019-03-01 at 14:05 +0100, Emilio Pozuelo Monfort wrote:
> > [...]
> > > > (It
> > > > may be unlikely for old suites to have users with new hardware, however it's
> > > > possible and users that don't have it will be unaffected by the new firmware, so
> > > > it wouldn't hurt to ship it.)
> > > > 
> > > > My branch is for jessie but I can prepare it for stretch too if you think that's
> > > > worth it.
> > > 
> > > The current jessie-security version of firmware-nonfree is really a
> > > backport from stretch.  So I would prefer it if you update the stretch
> > > branch first and then merge that to jessie-security.
> > 
> > I've merged your changes to stretch, uploaded to stretch, and then
> > merged stretch to jessie-security.  Let me know if you want to do the
> > upload to jessie-security or if I should do it.
> 
> I don't mind either way. We should use -4~deb8u2 rather than -5~deb8u1 so that
> we don't (temporarily) have a higher version in jessie than stretch until the
> point release.

I disagree.  An upgrade should not undo security fixes, if we can avoid
it.

Ben.

-- 
Ben Hutchings
Beware of bugs in the above code;
I have only proved it correct, not tried it. - Donald Knuth

[toc] | [prev] | [next] | [standalone]

#63745

[Multipart message — attachments visible in raw view] — view raw

On Mon, 2019-03-25 at 17:20 +0000, Ben Hutchings wrote:
> On Tue, 2019-03-05 at 22:00 +0000, Ben Hutchings wrote:
> > On Fri, 2019-03-01 at 14:05 +0100, Emilio Pozuelo Monfort wrote:
> [...]
> > > (It
> > > may be unlikely for old suites to have users with new hardware, however it's
> > > possible and users that don't have it will be unaffected by the new firmware, so
> > > it wouldn't hurt to ship it.)
> > > 
> > > My branch is for jessie but I can prepare it for stretch too if you think that's
> > > worth it.
> > 
> > The current jessie-security version of firmware-nonfree is really a
> > backport from stretch.  So I would prefer it if you update the stretch
> > branch first and then merge that to jessie-security.
> 
> I've merged your changes to stretch, uploaded to stretch, and then
> merged stretch to jessie-security.  Let me know if you want to do the
> upload to jessie-security or if I should do it.

I've now uploaded and sent the DLA.

Ben.

-- 
Ben Hutchings
Klipstein's 4th Law of Prototyping and Production:
                               A fail-safe circuit will destroy others.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web