(CC'ing you though I suppose you're subscribed to sec. bugs in some way) Quoting Florian Weimer ([EMAIL PROTECTED]): > * Christian Perrier: > > > To security team: as I said, I'm unsure that I'll be able to work on > > packages for etch. I'll at least try building with that patch. As > > usual, I may need guidance to upload to the right place if you're OK > > for us to upload for etch. > > You should prepare an upload with distribution stable-security, urgency > high, and upload it to: > > <ftp://security-master.debian.org/pub/SecurityUploadQueue>
OK, that upload is ready. So is another upload of 3.0.30, for unstable, security=high. It should deal with testing-security as well as I think that the transition shouldn't be blocked by an external factor (dependency packages). > > I could do that for you. The problem is regression testing, which I can > do only to an extremely limited extent. When it comes at samba, regression testing is *anyway* possible on an extremely limited extent. There are way too many use cases which require big infrastructures for testing (often "server member of an Active Directory domain"), so we mostly rely on the good communication with our upstream (as it happened for the last sec. issues which were jerky for that reason and also because upstream themselves are sometimes late wrt regression testing). > > > What about sarge? It is affected as well (samba is 3.0.14 there) but is it > > still officially supported wrt security updates? > > sarge is officially out of support. OK. I'll confirm that in users mailing lists for samba just to be sure that some users are aware of that and don't expect packages from us. (unofficial packages could be easy to build, though) I may have very well missed that but has the official "out of support" for sarge been announced somewhere. It definitely was announced when etch was released, but a reminder would help our users (assuming nothing has been sent, which, as I said, I'm unsure of). --
signature.asc
Description: Digital signature
