Bug#867164: perl: base.pm change causes other packages to FTBFS

2017-07-04 Thread Dominic Hargreaves
On Tue, Jul 04, 2017 at 12:53:01PM +0100, Dominic Hargreaves wrote:
> It was discovered that the security fix from last summer caused various
> packages to FTBFS during unrelated QA work:
> 
> request-tracker4_4.2.8-3+deb8u1
> libgraph-writer-dsm-perl_0.006-1
> libclass-c3-xs-perl_0.13-2
> libclass-c3-perl_0.26-1
> libbio-das-lite-perl_2.04-1.1
> 
> This was caused by an early version of a security fix in base.pm
> which was not released by upstream because of these compatibility problems.
> 
> In stretch/sid these packages have been patched to work around the problem;
> it was an oversight that similar workarounds didn't get made in jessie.
> 
> Now that there is an improved patch available from upstream which fixes
> this regression (currently in the 5.24.2-RC1 and 5.22.4-RC1 releases) we
> should apply this in jessie and (for completeness) stretch point releases,
> as well as sid.

This is being tracked for jessie as release team bug #864745.

Dominic.



Bug#867164: perl: base.pm change causes other packages to FTBFS

2017-07-04 Thread Dominic Hargreaves
Source: perl
Version: 5.20.2-3+deb8u6
Severity: serious
Justification: causes other packages to FTBFS
Tags: jessie upstream fixed-upstream

It was discovered that the security fix from last summer caused various
packages to FTBFS during unrelated QA work:

request-tracker4_4.2.8-3+deb8u1
libgraph-writer-dsm-perl_0.006-1
libclass-c3-xs-perl_0.13-2
libclass-c3-perl_0.26-1
libbio-das-lite-perl_2.04-1.1

This was caused by an early version of a security fix in base.pm
which was not released by upstream because of these compatibility problems.

In stretch/sid these packages have been patched to work around the problem;
it was an oversight that similar workarounds didn't get made in jessie.

Now that there is an improved patch available from upstream which fixes
this regression (currently in the 5.24.2-RC1 and 5.22.4-RC1 releases) we
should apply this in jessie and (for completeness) stretch point releases,
as well as sid.

Upstream commit:

https://perl5.git.perl.org/perl.git/commit/1afa2890005f3acdb5794bc9ec34dfd0a7e54c28

with additional documentation in later commits:

https://perl5.git.perl.org/perl.git/shortlog/refs/heads/maint-5.24