Re: packaging a static library

2009-12-30 Thread Gregory Maxwell
On Wed, Dec 30, 2009 at 2:05 AM, Ralf Corsepius rc040...@freenet.de wrote: On 12/30/2009 07:29 AM, Jon Masters wrote: One presumes that such auditing is expensive, lengthy, and not often to be repeated. Committing to undertaking a full code audit on every update would seem to be a little

OCaml in Rawhide upgraded to 3.11.2-rc1

2009-12-30 Thread Richard W.M. Jones
All the existing ocaml-* packages in Rawhide depend on ocaml(runtime) = 3.11.1 which means they will all have broken deps and need rebuilding. A simple bumpspec + rebuild should be sufficient. If any provenpackagers are feeling particularly bored this week ... Otherwise I'll try to do it in

Re: Can some provenpackager bump openvpn in EL-5

2009-12-30 Thread Jussi Lehtola
On Wed, 2009-12-30 at 08:55 +0530, Huzaifa Sidhpurwala wrote: Hi, I have this bz open for some time now, with no response. https://bugzilla.redhat.com/show_bug.cgi?id=544944 Can some one with proven packager access bump the EL-5 version to the latest one in devel. Even though any proven

Re: Can some provenpackager bump openvpn in EL-5

2009-12-30 Thread Huzaifa Sidhpurwala
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jussi Lehtola wrote: On Wed, 2009-12-30 at 08:55 +0530, Huzaifa Sidhpurwala wrote: Hi, I have this bz open for some time now, with no response. https://bugzilla.redhat.com/show_bug.cgi?id=544944 Can some one with proven packager access bump the

Re: packaging a static library

2009-12-30 Thread Martin Langhoff
On Wed, Dec 30, 2009 at 8:05 AM, Ralf Corsepius rc040...@freenet.de wrote: Well, I disagree: If they want to use their auditied version, they haven't understood how open source works. They qualify as jerks who prefer to use proprietary forks instead of paying back to upstream and the wider

Re: Can some provenpackager bump openvpn in EL-5

2009-12-30 Thread Jussi Lehtola
On Wed, 2009-12-30 at 16:35 +0530, Huzaifa Sidhpurwala wrote: Jussi Lehtola wrote: Even though any proven packager could do the change, that bug does not fall in the items listed in the proven packager policy [1]. You haven't listed any problems with the current package, you're just

Thinking of contributing to Sugar?

2009-12-30 Thread Sebastian Dziallas
Here's your chance! Join us for the upcoming weekly Fedora Sugar meetings in #fedora-olpc starting tomorrow, Dec 31 on 1500 UTC [1]. We're going to talk about packaging (especially Sugar Activities) and all kinds of stuff that helps us making the F13 Sugar experience better. You don't know

Re: packaging a static library

2009-12-30 Thread Daniel Drake
On Wed, 2009-12-30 at 12:25 +0100, Martin Langhoff wrote: Let's focus on the important bit: we need a frozen version of a library (that, btw, is useful, and is not in Fedora yet :-) ). What's the best practice for that? I don't see why we'd need to embed it statically anywhere (except OFW of

Re: OCaml in Rawhide upgraded to 3.11.2-rc1

2009-12-30 Thread Richard W.M. Jones
On Wed, Dec 30, 2009 at 09:40:13AM +, Richard W.M. Jones wrote: If any provenpackagers are feeling particularly bored this week ... Otherwise I'll try to do it in my spare time this week or next. I did all but about 10 of them. Rich. -- Richard Jones, Virtualization Group, Red Hat

Re: packaging a static library

2009-12-30 Thread Alexander Boström
ons 2009-12-30 klockan 13:37 + skrev Daniel Drake: I guess the approach I will take is to install our audited version as a shared library under a different name (libtommath_olpc?) which the libtommath-audited No sense making it look like it's only for OLPC use. If others want

Re: packaging a static library

2009-12-30 Thread Kevin Kofler
Martin Langhoff wrote: Let's focus on the important bit: we need a frozen version of a library (that, btw, is useful, and is not in Fedora yet :-) ). What's the best practice for that? I don't see why we'd need to embed it statically anywhere (except OFW of course). It's just not allowed. Use

Re: packaging a static library

2009-12-30 Thread Kevin Kofler
Daniel Drake wrote: The upstream library is already in Fedora as a shared library. I guess the approach I will take is to install our audited version as a shared library under a different name (libtommath_olpc?) which the components will then dynamically link against. While that at least

Re: packaging a static library

2009-12-30 Thread Kevin Kofler
Daniel Drake wrote: OLPC has previously had a specific version of tomcrypt/tommath profesionally audited for security reasons. So we obviously want to stick with that version. This is a bad idea and inconsistent with what Fedora is about. If you want that sort of things, you need to go back

Re: ABRT considered painful

2009-12-30 Thread Kevin Kofler
Michael Schwendt wrote: What's wrong with ABRT? My main beef with it is that it reports its crashes to the downstream bug tracker when really the right people to fix them are the upstream developers. KCrash/DrKonqi is much better there. Kevin Kofler -- fedora-devel-list mailing list

Re: packaging a static library

2009-12-30 Thread Tom spot Callaway
On 12/30/2009 03:58 PM, Kevin Kofler wrote: Daniel Drake wrote: The upstream library is already in Fedora as a shared library. I guess the approach I will take is to install our audited version as a shared library under a different name (libtommath_olpc?) which the components will then

Re: packaging a static library

2009-12-30 Thread Kevin Kofler
Tom spot Callaway wrote: FWIW, I'm pretty sure this is not against current Fedora policies, assuming that the libtommath maintainer signs off on it and there is no conflict between the two packages. I guess it's indeed not against the letter of the policies, it's still against their spirit

Re: packaging a static library

2009-12-30 Thread Patrice Dumas
On Wed, Dec 30, 2009 at 04:42:35PM -0500, Tom spot Callaway wrote: FWIW, I'm pretty sure this is not against current Fedora policies, assuming that the libtommath maintainer signs off on it and there is no conflict between the two packages. Indeed, it is just a compat library (and I think

Re: packaging a static library

2009-12-30 Thread Tom spot Callaway
On 12/30/2009 05:01 PM, Kevin Kofler wrote: Tom spot Callaway wrote: FWIW, I'm pretty sure this is not against current Fedora policies, assuming that the libtommath maintainer signs off on it and there is no conflict between the two packages. I guess it's indeed not against the letter of

[Bug 544245] CVE-2009-3585 rt3: session hijack

2009-12-30 Thread bugzilla
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=544245 --- Comment #3 from Fedora Update System upda...@fedoraproject.org 2009-12-31 01:54:45 EDT --- rt3-3.6.10-1.el5 has been

[Bug 544245] CVE-2009-3585 rt3: session hijack

2009-12-30 Thread bugzilla
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=544245 Fedora Update System upda...@fedoraproject.org changed: What|Removed |Added