Re: gallery2 outstanding security bugs -- Abondoned by Berninger?
by Jon Ciesla
> On Fri, Dec 19, 2008 at 11:26:28AM -0600, Jon Ciesla wrote:
>> Bill Allombert wrote:
>> >On Thu, Dec 18, 2008 at 11:36:14AM -0800, Lee Howard wrote:
>> >
>> >>Jon Ciesla wrote:
>> >>
>> >>>What about simply keeping it on Sourceforge? Don't one of you have
>> admin
>> >>>access to the project there? I have a SF account currently.
>> >>>
>> >>>As far as bringing libjpeg current, I'm not sure the task would be as
>> >>>herculean as it sounds, activities at fd.o hotwithstanding, not sure
>> what
>> >>>that's about.
>> >>>
>> >>libjpeg is essentially dead.
>> >>
>> >
>> >I disagree with this statement. Upstream is very responsive. However
>> >he is not inclined to put out new release currently, bu thti sdoes not
>> >qualify libjpeg as essentially dead as far as I am concerned.
>> >
>> >
>> Who is 'he' in this case?
>
> Sorry, I meant Guido Vollbeding.
Who's been CCd on this entire thread, spanning many days, and has yet to
reply? !responsive.
> Cheers,
> --
> Bill. <ballombe(a)debian.org>
>
> Imagine a large red swirl here.
>
--
in your fear, speak only peace
in your fear, seek only love
-d. bowie
15 years, 5 months
A way out of the update trap
by Jef Spaleta
How about this. Instead of trying to craft a policy right now which
applies equally to all parts of the distribution.
Let's narrowly define a prioritized list of functionality which we
think is critical and deserves to be a priority when doing update QA.
Here's my short list
1) Packaging Updating at the console (rpm and yum)
2) Package Updating in the desktop (PK and friends)
3) python-matplotlib
4) xeyes
Your list with most likely be different than mine. But can we get
project wide consensus as to the top 2 are really really important to
keep working for 'most' people? Everything else aside.. all the good
and bad ideas about how to do a top to bottom restructuring of updates
generation project wide off the table for a few seconds. Can we agree
that 1 and 2 are critical functionality which deserves extra
precautionary effort to reduce the risk of falling over and dying for
users compared to other functionality? Maybe more important than
security? If an update goes out which could impact rpm,yum,PK and
friends can we make it a policy that those updates require a specific
level of testing, even if it means holding up a security tagged update
until basic functionality of rpm,yum,PK is confirmed?
This is a risk management argument I am making.
-jef"is really thinking about adapting all the Integrated Safety
Management training that was beaten into him while at PPPL and
re-applying it to Fedora packaging"spaleta
15 years, 5 months
Re: gallery2 outstanding security bugs -- Abondoned by Berninger?
by Jon Ciesla
Bill Allombert wrote:
> On Thu, Dec 18, 2008 at 11:36:14AM -0800, Lee Howard wrote:
>
>> Jon Ciesla wrote:
>>
>>> What about simply keeping it on Sourceforge? Don't one of you have admin
>>> access to the project there? I have a SF account currently.
>>>
>>> As far as bringing libjpeg current, I'm not sure the task would be as
>>> herculean as it sounds, activities at fd.o hotwithstanding, not sure what
>>> that's about.
>>>
>> libjpeg is essentially dead.
>>
>
> I disagree with this statement. Upstream is very responsive. However
> he is not inclined to put out new release currently, bu thti sdoes not
> qualify libjpeg as essentially dead as far as I am concerned.
>
>
Who is 'he' in this case?
> Cheers,
> Bill Allombert,
> Debian libjpeg6b maintainer.
>
15 years, 5 months
Strange mono problem with ppc
by Paul F. Johnson
Hi,
I've just checked the development part for ppc and there is nothing
there for the main mono parts (such as mono-core etc) which means it's
impossible to build anything for mono on ppc.
Shouldn't they have been moved over from f10 to devel when we branched?
TTFN
Paul
--
Sie können mich aufreizen und wirklich heiß machen!
15 years, 5 months
Recursively listing dependencies of a package?
by Ville Skyttä
Hello,
Is there a tool that can list recursive dependencies (the whole dep tree) of a
package from repodata? And even better if it can be also told to resolve
things like /bin/sh and libfoo.so.x to package names and output a list of
those package names (+ EVRA) only (not files or Provides).
What I've looked into so far:
yum deplist: is not recursive, or I don't know how to tell it to be. Also a
bit verbose for my taste (lists all providers of deps).
repoquery -R --resolve: otherwise exactly what I'm looking for, but it's not
recursive either. Adding --recursive to the options does not appear to make
any difference.
15 years, 5 months
Re: gallery2 outstanding security bugs -- Abondoned by Berninger?
by Jon Ciesla
> Jon Ciesla wrote:
>>> Jon Ciesla wrote:
>>>
>>>> Understandable. If this person exists, then that is the logical path.
>>>> If
>>>> not, then are distro maintainers to simply soldier on, maintaining
>>>> what
>>>> are, in effect, forks? I have to think that in the absence of the
>>>> Qualified Individual we all desire, a coordinating effort of distro
>>>> maintainers would be preferable to the status quo.
>>>>
>>> I wholeheartedly agree. I'm more than happy to see them all set up
>>> with
>>> the necessary permissions on the Sourceforge site.
>>>
>>
>> Adding Tom Lane back to the thread.
>>
>> So at this point we'd need you, Lee, or someone else with the sf.net
>> project access, to grant the access, and buy-in from interested
>> maintainers, which would be Brian and Tom(unless he wants to designate
>> someone else) so far. I'll research who others are at other distros.
>>
>> I am also willing to contribute, beyond simply meddling. :) I have a
>> sf.net account(limburgher), etc.
>
> John,
>
> I've added you to the Sourceforge project. You should have rights to
> add other project admins.
>
> If you need me to add others please compile and send to me a list of
> sourceforge account names which should be added to the project, and I
> will add them.
Thanks. I should be able to handle that. I'll work out a plan, and a
list of maintainers at other distros, and send something out. I'll be AFK
next week, so this'll probably go out 12/29.
> Thanks,
>
> Lee.
>
--
in your fear, speak only peace
in your fear, seek only love
-d. bowie
15 years, 5 months