[Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Maarten Vanraes
regarding bug https://bugs.mageia.org/show_bug.cgi?id=5260 after talking with mariadb people and some others, i'm proposing to update mysql 5.5.10 to mariadb-5.5.23 in mga1. however, QA should extra-double-test the php-mysql dependency, as mariadb noted that php-mysql seems to have a very

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Colin Guthrie
'Twas brillig, and Maarten Vanraes at 13/04/12 07:28 did gyre and gimble: after talking with mariadb people and some others, i'm proposing to update mysql 5.5.10 to mariadb-5.5.23 in mga1. I would be pretty strongly against this. I think it's fine we're using mariadb in mga2, but I really

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Guillaume Rousse
Le 13/04/2012 12:45, Colin Guthrie a écrit : 'Twas brillig, and Maarten Vanraes at 13/04/12 07:28 did gyre and gimble: after talking with mariadb people and some others, i'm proposing to update mysql 5.5.10 to mariadb-5.5.23 in mga1. I would be pretty strongly against this. I think it's fine

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread AL13N
Le 13/04/2012 12:45, Colin Guthrie a écrit : 'Twas brillig, and Maarten Vanraes at 13/04/12 07:28 did gyre and gimble: after talking with mariadb people and some others, i'm proposing to update mysql 5.5.10 to mariadb-5.5.23 in mga1. I would be pretty strongly against this. I think it's

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Pascal Terjan
On Fri, Apr 13, 2012 at 12:12, AL13N al...@rmail.be wrote: 1. find all the responsible patches and add them manually == this is my preferred option, but seems not doable, and apparently no-one steps in and mysql isn't maintained (officially) Not possible as most of the unfixed CVE on MySQL

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread David Walser
AL13N alien@... writes: 5. someone has a better idea? considering the response i got, now i'll default to letting someone else handle it, which might mean it never gets fixed. that would also mean for me that mageia1 would be a bad version to get LTS on. The objections to this have been

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Anssi Hannula
13.04.2012 14:12, AL13N kirjoitti: 2. do like other distros and fix to higher mysql 5.5.22 which fixes this issue == this is totally not preferred for me; A) a big change between mysql 5.5.10 and mysql 5.5.22, which means huge QA load B) this also means that the mga1 - mga2 upgrade will

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Colin Guthrie
'Twas brillig, and David Walser at 13/04/12 15:31 did gyre and gimble: The objections to this have been quite unwarranted. It sounds like some people want to institute a new policy that MySQL security bugs won't be fixed. Upgrading to newer versions of things isn't ideal, but sometimes it's

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Maarten Vanraes
Op vrijdag 13 april 2012 13:12:08 schreef AL13N: [] i guess most packagers want option 2 here. i don't think this is a good idea in general and i was of the opinion that the diff between migrating mysql 5.5.22 and mariadb 5.5.23 were quite the same... nonetheless, the package naming

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Thomas Backlund
13.04.2012 19:11, Maarten Vanraes skrev: Op vrijdag 13 april 2012 13:12:08 schreef AL13N: [] i guess most packagers want option 2 here. i don't think this is a good idea in general and i was of the opinion that the diff between migrating mysql 5.5.22 and mariadb 5.5.23 were quite

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Maarten Vanraes
Op vrijdag 13 april 2012 18:19:14 schreef Thomas Backlund: [...] I've started working on mysql-5.5.23 (as it contains another security fix), and will release it to updates_testing for Mageia 1 as soon as possible. bye any chance do you have the CVE for the new one? i remember there was one in

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Thomas Backlund
13.04.2012 19:30, Maarten Vanraes skrev: Op vrijdag 13 april 2012 18:19:14 schreef Thomas Backlund: [...] I've started working on mysql-5.5.23 (as it contains another security fix), and will release it to updates_testing for Mageia 1 as soon as possible. bye any chance do you have the CVE

Re: [Mageia-dev] mysql CVE's in mga1 = have it update to mariadb

2012-04-13 Thread Maarten Vanraes
Op vrijdag 13 april 2012 19:35:15 schreef Thomas Backlund: 13.04.2012 19:30, Maarten Vanraes skrev: [...] bye any chance do you have the CVE for the new one? i remember there was one in mariadb a few days ago, so i want to make sure this is the same one. Unfortunately no CVE yet... it