I am writing to request for the update of libqtxdg.
The package libqtxdg is used by LxQT and DeepinDE. We are now updating
DeepinDE in rawhide which need the libqtxdg 3.0+.
As I see the bug https://bugzilla.redhat.com/show_bug.cgi?id=1520064
hasn't been handled for over half a year. I've filed a PR for this
I am willing to co-maintain this package.
Personally I can reach to one of the package admin off the list and get
this solved, I still want to let this knwon in case other packages are
depending on this.
For the LxQT dependency, I've updated all the affected LxQT package on
my machine. I will file a separate email for that.
Ziqian SUN (Zamir)
GPG : 1D86 6D4A 49CE 4BBD 72CF FCF5 D856 6E11 F2A0 525E
Want to know more about Fedora?
Ready to contribute? See https://whatcanidoforfedora.org/
I was asked to bring this issue to the developer community before
FESCO makes a decision.
In several instances there exists packages in Fedora, in which
package-maintainers did not patch security issues, for multiple reasons
including 1. non-responsive maintainer 2. issue hard to patch 3. no one
This is a risk for the distribution, our users and community as a whole
and not to mentioned bad PR :)
I would like to propose the following:
1. If a CRITICAL or IMPORTANT security issue is open against a package
in Fedora-X and by the time X is EOL and the issue is not addressed,
proactively remove the package from X+1
2. If a MODERATE or LOW security issue is open against a package in
Fedora -X and by the time X+! is EOL, the issue is not addressed, remove
it from X+2
1. Once pkg is patches, it can be rebuild and re-introduced into the distro
2. X/X+1 is the best boundary to remove the insecure packages imo, since
inbetween removals are not possible due to the way mirrors work.
3. Maintain a list somewhere (automated maybe) of the list of packages
removed and why.
4. Have a list of critical pkg, which cannot be removed which will break
The above is not set in stone, but is open for discussion. Let me know
what you guys think!
In the end, i would like you leave you all with this parting link:
Huzaifa Sidhpurwala / Red Hat Product Security Team