Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5003 > unrolled thread

Re: [SECURITY] [DSA 3666-1] mysql-5.5 security update

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3666-1] mysql-5.5 security update Salvatore Bonaccorso <carnil@debian.org> - 2016-09-16 10:30 +0200
    Re: [SECURITY] [DSA 3666-1] mysql-5.5 security update Moritz Muehlenhoff <jmm@inutil.org> - 2016-09-16 12:00 +0200
    Re: [SECURITY] [DSA 3666-1] mysql-5.5 security update Salvatore Bonaccorso <carnil@debian.org> - 2016-09-16 12:50 +0200
    Re: [SECURITY] [DSA 3666-1] mysql-5.5 security update Hideki Yamane <henrich@debian.or.jp> - 2016-09-19 00:00 +0200

#5003 — Re: [SECURITY] [DSA 3666-1] mysql-5.5 security update

Hi!

On Fri, Sep 16, 2016 at 05:13:57PM +0900, Hideki Yamane wrote:
> Hi,
> 
> Just some question.
> 
> https://packages.debian.org/jessie/mysql-server-core-5.5 says
> armhf 5.5.50-0+deb8u1 it's only arch that have old version.
> 
> mysql-5.5 in armhf, there is no jessie-security log.
> https://buildd.debian.org/status/logs.php?pkg=mysql-5.5&arch=armhf

That's right. mysql-5.5 5.5.52-0+deb8u1 failed various attempts to
build on armhf yet.

> https://tracker.debian.org/pkg/mysql-5.5 doesn't contain 5.5.52-0+deb8u1
> upload information in news item.
> 
> - Do you notice no update for mysql-5.5 armhf?

See above, yes I noticed but nevertheless released the DSA for the
other suites.

>  Is there any plan to rebuild it?

I tried to give back, but witout success. So the build failure needs
to be investigated specific on armhf.

> - Is it intentional to not provide build log for jessie-security?
>  or can we check build log for security updates?

Builds can be done in advance, for embargoed issues. Thus logs should
not be public. But yes, that could defintively be an improvement that
logs can be published *after* a DSA ist released. If you can help
wanna-build team on that matther I'm sure help would be appreciated.
Nobody worked on that part so far.

> - Why there's no info in tracker about 5.5.52-0+deb8u1 upload?

The tracker afaict just rcords the upload to ftp-master. Thus, there
will be a news entry only when the package is accepted into
proposed-updates (unless I'm wrong on that).

Hope that helps,

Regards,
Salvatore

[toc] | [next] | [standalone]

#5005

On Fri, Sep 16, 2016 at 10:27:56AM +0200, Salvatore Bonaccorso wrote:
> > - Why there's no info in tracker about 5.5.52-0+deb8u1 upload?
> 
> The tracker afaict just rcords the upload to ftp-master. Thus, there
> will be a news entry only when the package is accepted into
> proposed-updates (unless I'm wrong on that).

That's correct.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#5006

Hi,

On Fri, Sep 16, 2016 at 10:27:56AM +0200, Salvatore Bonaccorso wrote:
> See above, yes I noticed but nevertheless released the DSA for the
> other suites.

Architectures, ...

I filled #837994 in case of interest. But it might be retested as well
on a porterbox.

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#5008

Hi,

On Fri, 16 Sep 2016 10:27:56 +0200
Salvatore Bonaccorso <carnil@debian.org> wrote:
> > - Is it intentional to not provide build log for jessie-security?
> >  or can we check build log for security updates?
> 
> Builds can be done in advance, for embargoed issues. Thus logs should
> not be public. But yes, that could defintively be an improvement that
> logs can be published *after* a DSA ist released. If you can help
> wanna-build team on that matther I'm sure help would be appreciated.
> Nobody worked on that part so far.
> 
> > - Why there's no info in tracker about 5.5.52-0+deb8u1 upload?
> 
> The tracker afaict just rcords the upload to ftp-master. Thus, there
> will be a news entry only when the package is accepted into
> proposed-updates (unless I'm wrong on that).

 Okay, now it's clear for me, thanks!

 And NOKUBI Takatsugu says it maybe not sufficient to fix non-x86 archs.
 for this issue. see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837984
 I'm not sure whether it's true or not, but can you give a look into it,
 please?


-- 
Regards,

 Hideki Yamane     henrich @ debian.or.jp/org
 http://wiki.debian.org/HidekiYamane

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web