policykit-1 121+compat0.1-5 is now in Debian Unstable.
Could I get a clear answer from the Ubuntu Security Team if this is
acceptable to autosync when Ubuntu 23.04 development opens?
** Tags added: block-proposed
** Summary changed:
- [security review] Sync policykit-1 0.120-6 (main) from
I also don't think this is a blocker anymore, as long as polkitd-pkla is
a strong dependency in Ubuntu, so we don't inadvertently stop shipping
it. It would be nice to get a similar list of packages in Ubuntu, as I
suspect we have many more than Debian. We may also need to update the
> I do not intend to take further action to modify those packages. If it is a
> blocker for Ubuntu
> that they are fixed, then someone from Ubuntu will need to do that work.
Given the relationship between the packages has now changed - ie.
polkitd-pkla is not mutually exclusive from the
As of version 121+compat0.1-1, the relationship between packages has
changed to this:
* polkitd always requires polkitd-javascript and duktape, and always
interprets JavaScript policies
* polkitd-pkla is now an optional addon (the upstream polkit-pkla-compat
project, as shipped in e.g. Fedora)
More discussion here: https://salsa.debian.org/utopia-
team/polkit/-/merge_requests/6
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to policykit-1 in Ubuntu.
https://bugs.launchpad.net/bugs/1972654
Title:
[security review]
> There was a proposal to use duktape instead of mozjs for the JavaScript
> interpreter but I don't think that's been merged yet.
This was merged upstream, but unfortunately there has not yet been a
release that contains this change.
I don't really want to use an arbitrary git snapshot for
My understanding is the Debian experimental version doesn't support both
at the same time, it's one or the other depending on which binary
package you install. We definitely don't want that.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is
Marc, the current Debian experimental version supports both PKLA and JS
policy files. Are you saying that you only want one style to be
supported in an Ubuntu release?
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to
We do not want policykit to use the unmaintainable mozjs backend. That
would be a hard NACK from the Security Team.
The duktape backend has been merged upstream. So in order to sync this
to Ubuntu, the following must be done:
1- Get Debian to switch to the duktape backend
2- Get Debian to
9 matches
Mail list logo
