Moritz Mühlenhoff <[email protected]> writes: > 1. We're already one wheezy update behind for xen (since some of > the changes were invasive and complex). It would be great if > someone from the Freexian sponsor pool would work on a wheezy > update for Xen. It's probably a solid day of work, though, but > it will also clarify whether it's feasible to continue to support > in Xen in Wheezy LTS (while 4.1 being EOLed by upstream for > quite a while now).
So what needs to happen here? Not sure what is meant by "We're already one wheezy update behind for xen". I see wheezy has version 4.1.4-3+deb7u8 - do we need to attempt to update this to version 4.1.6.1 - the latest 4.1.* version? If so I imagine this would require: - identifying which CVEs are fixed in 4.1.6.1 - updating xen package - updating the kernel packages (if this is required??? Not sure if the kernel code is considered part of the xen release or not anymore) and/or do we attempt to backport the security patches from some newer release? I also note that there are a large number of unfixed vulnerabilities for all versions including sid. https://security-tracker.debian.org/tracker/source-package/xen > 2. Spend some time on investigating what it takes to backport > libav from jessie to wheezy. 11.x is still supported by > libav upstream and we could share triage work for jessie/wheezy > going forwards. 0.8 has simply too much missing. > There will be a few applications which are going to break due to > API changes, possibly exclude some exotic ones from wheezy LTS > support and backport some fixes for important apps from jessie. > (Most of the changes are fairly straightforward, e.g. they renamed > lots of internal constants). Looks like the SONAME has changed. Presumably this means anything depending on libav will need to be rebuilt? How do we handle any packages that might be broken and cannot (feasibly) be fixed? As there are multiple packages involved, is it possible to stage them somewhere and get all packages moved in one atomic operation or do we have to do them one at a time? The later could be potentially risky and break things if both versions end up being included in the one application, especially if versioned symbols not used (I haven't checked). -- Brian May <[email protected]>
