On Wed, Apr 13, 2022, at 21:48, Maxwell G wrote:
On Wednesday, April 13, 2022 4:37:27 PM IDT Mikel Olasagasti wrote:
> FWIU, in order to fix this CVE, a new version of golang-x-crypto and
> rebuilding all dependent packages is required.
If the CVE only affects
golang.org/x/crypto/ssh, couldn't we just rebuild packages
that depend on `golang(golang.org/x/crypto/ssh)`? `golang-x-crypto-devel` has a lot of
dependent packages (over 600), so it would be beneficial to avoid having to rebuild all of
them.
Hi,
If I'm correct, we are looking for:
* packages that depend on
golang.org/x/crypto/ssh
* packages that contain at least a non-devel package (ie: a compiled part)
If my understand of repoquery is correct, this would be the command to get them:
sudo dnf repoquery -q --repo=rawhide{,-source} --whatrequires
"golang(golang.org/x/crypto/ssh)" --recursive | grep src$ | pkgname | sort |
uniq
Which create a 326 packages long list.
We have halfed them (if my query is correct) :-).
Also, keep in a mind that there are several go-sig packages that
FTBFS, which might cause issues during the rebuild. As a new member of the SIG, fixing
some of these is probably a good place to start. Here[1] is a list of all the current open
go-sig FTBFS bugs.
[1]:
https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASS...
This feels like a major issue to automate the process.
Fale
--
Fabio Alessandro Locati
fale.io