Re: No DLA for xen, librsvg, libidn?

2016-05-19 Thread Antoine Beaupré
On 2016-05-19 19:22:18, Brian May wrote: > Antoine Beaupré writes: >> I wonder if some of that stuff should be automated. I am fairly new with >> the security process, how often do mistakes like this happen anyways? >> >> And how hard would it be to automate this? > > I would suggest a move useful

Re: No DLA for xen, librsvg, libidn?

2016-05-19 Thread Brian May
Antoine Beaupré writes: > I wonder if some of that stuff should be automated. I am fairly new with > the security process, how often do mistakes like this happen anyways? > > And how hard would it be to automate this? I would suggest a move useful thing to automate would be filling in more detail

Re: No DLA for xen, librsvg, libidn?

2016-05-19 Thread Chris Lamb
> Inline signing is not mandatory (I use MIME-signing with mutt) but > there are enough cases where MIME-signing does not work properly I've also found MIME-signing to be unreliable so I now use inline-signing by default when posting to debian-lts-announce. (My tip is to BCC your personal email

Re: icu package and debdiff [new contributor, first attempt]

2016-05-19 Thread Roberto C . Sánchez
On Thu, May 19, 2016 at 01:24:01PM -0400, Antoine Beaupré wrote: > [Snip lots of excellent feedback] > > Good luck! > > A. > > PS: i had originally garbage-collected my squeeze packages from > people.debian.org because I forgot about this issue. i have put them > back on: > > https://people.de

Re: icu package and debdiff [new contributor, first attempt]

2016-05-19 Thread Antoine Beaupré
On 2016-05-12 15:07:19, Roberto C. Sánchez wrote: > Hi Antoine, > > On Mon, May 09, 2016 at 05:09:30PM +0200, Markus Koschany wrote: >> Hello Roberto, welcome on board! >> >> Am 08.05.2016 um 05:34 schrieb Roberto C. Sánchez: >> >> > I pulled the patch for CVE-2015-4844 from the upstream jdk8u pr

Re: Xen 4.1.6.1 backport + Ubuntu patches ready for testing (take 3)

2016-05-19 Thread Antoine Beaupré
On 2016-05-17 10:54:50, Antoine Beaupré wrote: > I would say just go ahead, and we'll need to do a similar sweep in > data/CVE/list later as well. > > I'll mark this on my TODO and will do so tomorrow if no one else steps > up. Just for the record: I was confused. If the DLA is done and processed

Re: NSS and logjam in wheezy (CVE-2015-4000)

2016-05-19 Thread Antoine Beaupré
On 2016-05-19 02:28:15, Salvatore Bonaccorso wrote: > Hi Guido, > > On Thu, May 19, 2016 at 08:11:37AM +0200, Guido Günther wrote: >> On Wed, May 18, 2016 at 03:12:23PM -0400, Antoine Beaupré wrote: >> > On 2016-03-29 16:28:36, Antoine Beaupré wrote: >> > > On 2016-03-26 04:33:29, Guido Günther wro

Re: what to do with LTS-backports?

2016-05-19 Thread Antoine Beaupré
On 2016-05-19 08:16:51, Rhonda D'Vine wrote: > Hi, > > * Holger Levsen [2016-05-19 13:45:56 CEST]: >> appearantly some maintainers don't want to support backports in >> wheezy-backports anymore, saying wheezy is oldstable now (und >> unsupported by Debian proper, "just" maintained by the Debia

Re: No DLA for xen, librsvg, libidn?

2016-05-19 Thread Raphael Hertzog
On Wed, 18 May 2016, Antoine Beaupré wrote: > On 2016-05-18 03:45:57, Raphael Hertzog wrote: > > On Tue, 17 May 2016, Antoine Beaupré wrote: > >> It would be great to have better consistency here. > > > > Yes, just like we ensure that we get an Accepted mail before sending the > > DLA, we must make

Re: what to do with LTS-backports?

2016-05-19 Thread Rhonda D'Vine
Hi, * Holger Levsen [2016-05-19 13:45:56 CEST]: > appearantly some maintainers don't want to support backports in > wheezy-backports anymore, saying wheezy is oldstable now (und > unsupported by Debian proper, "just" maintained by the Debian LTS team.) That's fine with me, I'm willing to pi

Re: what to do with LTS-backports?

2016-05-19 Thread Holger Levsen
On Thu, May 19, 2016 at 11:45:56AM +, Holger Levsen wrote: > Alternativly, the backports maintainers would need to agree to maintain > those backports for two more years. which should be rather easy by uploading the jessie version to wheezy-backports and following up with backporting jessie se

what to do with LTS-backports?

2016-05-19 Thread Holger Levsen
Hi, appearantly some maintainers don't want to support backports in wheezy-backports anymore, saying wheezy is oldstable now (und unsupported by Debian proper, "just" maintained by the Debian LTS team.) In a way, that's a fair stand, as when they agreed to support the backport for the life time o