On Wednesday, April 13, 2022 4:37:27 PM IDT Mikel Olasagasti wrote:
FWIU, in order to fix this CVE, a new version of golang-x-crypto and
rebuilding all dependent packages is required.
If the CVE only affects
golang.org/x/crypto/ssh, couldn't we just rebuild packages
that depend on `golang(golang.org/x/crypto/ssh)`? `golang-x-crypto-devel` has a lot of
dependent packages (over 600), so it would be beneficial to avoid having to rebuild all of
them.
Also, keep in a mind that there are several go-sig packages that FTBFS, which might cause
issues during the rebuild. As a new member of the SIG, fixing some of these is probably a
good place to start. Here[1] is a list of all the current open go-sig FTBFS bugs.
[1]:
https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASS...
I applied today to be a member of
go-sig[4] to help with this and other tasks, but don't know how long
it will take to be accepted.
If you don't get a timely response on the ticket, you can also try asking in
#fedora-golang.
--
Thanks,
Maxwell G (@gotmax23)
Pronouns: He/Him/Him