Hi Santiago, Thank you very much for the review!
On 11/8/26 14:56, Santiago Ruano Rincón wrote: [snip]
diff -Nru srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch --- srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch 1969-12-31 18:00:00.000000000 -0600 +++ srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch 2026-11-06 09:52:27.000000000 -0600 @@ -0,0 +1,304 @@ +Origin: https://github.com/Haivision/srt/commit/d17cc7b4dbe4658eb3ac71c7eec3c71780553250Very small nitpick (for next update): according to dep-3, the origin field should include the "backport" tag: Origin: backport, https://github.com/Haivision/srt/commit/d17cc7b4dbe4658eb3ac71c7eec3c71780553250 (and maybe, to make it more clear, list the other commits as well)
Will do in the future, thank you! [snip]>> diff -Nru srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch
--- srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch 1969-12-31 18:00:00.000000000 -0600 +++ srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch 2026-11-06 09:52:27.000000000 -0600 @@ -0,0 +1,31 @@ +Origin: https://github.com/Haivision/srt/commit/e020c3bb8e04e204b36f9fb56cdcbb6756cd0d28AFAICS, these changes were not included into trixie. Do you know why?
Trixie already includes the check in CVE-2026-55868.patch, not CVE-2026-55869.patch. My proposed Bookworm update puts that check in a separate patch, which makes it look like an extra fix. Please let me know if you have any further questions; feedback is still welcome. Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
