Hi Matthias,
> I was looking through my notes and I think I rebased the packaging on
> Debian's upstream packaging to make it easier for me to incorporate
> some bigger systemd patches I wrote. No changes that you made should
> have been lost though, or were they?
Without doing a bit of Git archeology it might be difficult to 100%
say but I think everything was merged upstream and, of course, your
package has been in PureOS for bit… let's assume Everything Is Fine.
[…]
> In any case, I think this was my fault, although admittedly I don't
> know what you would like me to do here.
Not asking for any technical action: this was, right from the start,
merely trying to work out what happened as it was somewhat confusing.
Please do let me know how I could have made that clearer for the
future.
Best wishes,
--
Chris Lamb
https://puri.sm
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hi,
In this PureOS issue; https://tracker.pureos.net/T677 it appears that
we have two places to download a PureOS ISO;
- - The PureOS download page (https://pureos.net/download/)
- - And downloads (https://downloads.puri.sm/live/gnome/2018-12-10/)
The downloads page has a more recent release and I wonder if we should
move it to the PureOS "download" page? What is the process?
Regards,
Jeremiah
- --
GnuPG key fingerprint;
798D B834 436A 7BE3 8C97 422D 0DC0 6220 5451 931B
-----BEGIN PGP SIGNATURE-----
iQGzBAEBCgAdFiEEBkkHqXr+u7OUqMKseFgrT+6RsjkFAlxLR/AACgkQeFgrT+6R
sjkBDAv/fnl1D0QaUP0kdG/PRdQ6A984iWUK73/1Qcp3YqOe+2y+jpiiyrfAH10i
9q2esL08F2u/K6LTTYWpREgFNbw/++4WyUW09sgYjdfscicSpmG5zNkjCdjZ9f+i
gyBaFcNvFG/f+gR5LmPz5jAa4heATXa4394trWw4ERbyt/dyVf3qcm3SVfZHKK/Y
o5hdwkb9GbKGvpeVVNSpUfw+PRDnrjYLisuQdMINIWLKmE2BwtTF3UcLmJiElu2W
VnjMcZA9JF4YLXkjUzpMLYIP4FR0XvOJHvCmOqEEtyPWKOhPq5EKVnuaFUihIcXW
LPvgBSpPcaPEk8M8870PKRoHzYcXkQEsrQ/wSnKChJ/fJrYTaX8jtMvcjobjtTae
jCz6c/UDCL7MPfQ4nLEXPheDDoWXC3tRhj9alNxxvkRbXDoqn3/4lAUGOF63GETt
GS+4IeV52N/6piZryiHBIpptzxd705vR9xmrYGMKnsGDvuCKPy0e4JENux6SfLgv
95AwHnXS
=pC+9
-----END PGP SIGNATURE-----
Matthias,
Thank you for your reply.
> > > I just went to refresh my local copy of pureos/core/systemd.git and
> > > noticed that the Git history had completely diverged from my
> > > 238-5pureos1 upload of June 2018.
[…]
> I don't remember changing anything (last commit was by me 5 months
> ago), but the current Git VCS is the exact same systemd uses in
> Debian, which makes merging with the Debian packaging much easier.
> So, this layout is certainly intentional.
Alas, I think you may have misread what I wrote — I had previously
uploaded systemd around June 2018 (based on the very same Debian
packaging you mention), including pushing to our Git repositories
as usual/expected and not doing anything that would prevent merging…
if only to keep the diff minimal and sanity maximal.
However, when I went to do another update in the last few days I
noticed that the history had been entirely scrubbed (see grandfather
mail in this thread.) It is this latter rewriting that made me
curious.
> Didn't you make a systemd upload just recently?
Mm, bhence my "I just went to refresh…" that prompted me to notice
in the first place, the actual upload is not really relevant.
Best wishes,
--
Chris Lamb
https://puri.sm
[Gentle ping on the below?]
§
Matthias,
Thank you for your reply.
> > > I just went to refresh my local copy of pureos/core/systemd.git and
> > > noticed that the Git history had completely diverged from my
> > > 238-5pureos1 upload of June 2018.
[…]
> I don't remember changing anything (last commit was by me 5 months
> ago), but the current Git VCS is the exact same systemd uses in
> Debian, which makes merging with the Debian packaging much easier.
> So, this layout is certainly intentional.
Alas, I think you may have misread what I wrote — I had previously
uploaded systemd around June 2018 (based on the very same Debian
packaging you mention), including pushing to our Git repositories
as usual/expected and not doing anything that would prevent merging…
if only to keep the diff minimal and sanity maximal.
However, when I went to do another update in the last few days I
noticed that the history had been entirely scrubbed (see grandfather
mail in this thread.) It is this latter rewriting that made me
curious.
> Didn't you make a systemd upload just recently?
Mm, bhence my "I just went to refresh…" that prompted me to notice
in the first place, the actual upload is not really relevant.
Best wishes,
--
Chris Lamb
https://puri.sm
Matthias wrote:
> this issue has been fixed in PureOS for 2 days now (since 2019-01-24)
> and in green since yesterday
Mm I understand that, but did you perhaps miss:
> > extra curiosity about the process of expedition in general
^^^^^^^^^^^^^^^^^^^^^
Best wishes,
--
Chris Lamb
https://puri.sm
Hi Jeremiah,
> I will follow up and see where we are. I do know PureOS folks are aware
> of this issue.
JFTR I am part of this PureOS team/folks, hence extra curiosity
about the process of expeditin in general, not specifically for
CVE-2019-3462.
(If we can get this centrally documented for the next person, all
the better...!)
Best wishes,
--
Chris Lamb
https://puri.sm
On Tue, 2019-01-22 at 13:17 +0100, Yves-Alexis Perez wrote:
> -------------------------------------------------------------------------
> Debian Security Advisory DSA-4371-1 security(a)debian.org
> https://www.debian.org/security/ Yves-Alexis Perez
> January 22, 2019 https://www.debian.org/security/faq
> -------------------------------------------------------------------------
>
> Package : apt
> CVE ID : CVE-2019-3462
>
> Max Justicz discovered a vulnerability in APT, the high level package manager.
> The code handling HTTP redirects in the HTTP transport method doesn't properly
> sanitize fields transmitted over the wire. This vulnerability could be used by
> an attacker located as a man-in-the-middle between APT and a mirror to inject
> malicous content in the HTTP connection. This content could then be recognized
> as a valid package by APT and used later for code execution with root
> privileges on the target machine.
> [...]
(This presumably needs to be fixed fairly quickly in PureOS, if only
for the PR.)
What is the way to expedite this?
Best wishes,
--
Chris Lamb
https://puri.sm
Chris Lamb wrote:
> > Package : apt
> > CVE ID : CVE-2019-3462
[…]
> (This presumably needs to be fixed fairly quickly in PureOS, if only
> for the PR.)
>
> What is the way to expedite this?
Ping on this too? :)
Best wishes,
--
Chris Lamb
https://puri.sm
Chris Lamb wrote:
> I just went to refresh my local copy of pureos/core/systemd.git and
> noticed that the Git history had completely diverged from my
> 238-5pureos1 upload of June 2018.
Ping on this?
Best wishes,
--
Chris Lamb
https://puri.sm
Hi Matthias (et al.)
I just went to refresh my local copy of pureos/core/systemd.git and
noticed that the Git history had completely diverged from my
238-5pureos1 upload of June 2018.
Indeed, looking at:
https://source.puri.sm/pureos/core/systemd/activity
.. it looks like the project was deleted and recreated, essentially
scrubbing the history of the aforementioned upload.
I'm not at all a "no history rewriting" snob but I was just
wondering if this was part of some semi-usual process I was unaware
of or a one-off in this particular case and it somehow was not
communicated to the rest of us folks.
Anyway, it would be good to learn if this could happen at the very
least. If this is indeed a possibility, please could you go ahead
and document that on the wiki and post a link back here? :)
Many thanks in advance.
Best wishes,
--
Chris Lamb
https://puri.sm
