Debian Bug report logs - #864745
jessie-pu: package perl/5.20.2-3+deb8u8

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: jessie-pu: package perl/5.20.2-3+deb8u6

Date: Wed, 14 Jun 2017 00:14:33 +0100

[Message part 1 (text/plain, inline)]

Package: release.debian.org
Severity: normal
Tags: jessie
User: release.debian.org@packages.debian.org
Usertags: pu

In July 2016 we released a security update for perl to fix an optional
module loading related vulnerability:

https://www.debian.org/security/2016/dsa-3628

This update included a change that has been since improved by upstream
for better compatibility with existing code. The original update caused
a few packages to FTBFS:

#864302
#864299
#832862
#832866
#832845

As such we believe that it makes sense to update perl in jessie to
include the improved fix, which is scheduled for inclusion in upstream
maintenance releases soon.

The attached patch implements the aforementioned update, and has been
tested against packages build-depending on build in jessie with no
regressions (and we've confirmed that the above bugs have been fixed).

Please let us know if we can upload to jessie-proposed-updates.

Thanks!
Dominic.

-- System Information:
Debian Release: 9.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-2-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

[base.pm.debdiff (text/plain, attachment)]

Message #12 received at 864745@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: 864745@bugs.debian.org

Cc: perl@packages.debian.org

Subject: Update on base.pm jessie point release

Date: Tue, 4 Jul 2017 17:14:50 +0100

Just to confirm that

1) this commit is identical to those now in upstream release candidates.
2) This has now been filed as #867164 (sorry that this was missing before)
3) this particular bug doesn't strictly apply to stretch/sid, but we plan
   to fix it in sid at least for consistency and to fix the minor remaining
   security bug (see #867170)

Thanks,
Dominic.

Message #17 received at 864745@bugs.debian.org (full text, mbox, reply):

From: Cyril Brulebois <kibi@debian.org>

To: Dominic Hargreaves <dom@earth.li>, 864745@bugs.debian.org

Cc: perl@packages.debian.org

Subject: Re: Bug#864745: Update on base.pm jessie point release

Date: Wed, 5 Jul 2017 07:46:39 +0200

[Message part 1 (text/plain, inline)]

Hi Dominic,

Dominic Hargreaves <dom@earth.li> (2017-07-04):
> 1) this commit is identical to those now in upstream release candidates.
> 2) This has now been filed as #867164 (sorry that this was missing before)

Thanks for the update, much appreciated.

I have to say that giving you a green light to update perl in stable with this
kind of fix makes me a little nervous, sorry. :(

> 3) this particular bug doesn't strictly apply to stretch/sid, but we plan
>    to fix it in sid at least for consistency and to fix the minor remaining
>    security bug (see #867170)

I'm not sure how we feel about similar-yet-kind-of-different bugs in
other suites (as in: not sure whether fixing those would be considered
a hard requirement before an update in (old)stable).


KiBi.

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 864745@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Cyril Brulebois <kibi@debian.org>

Cc: 864745@bugs.debian.org, perl@packages.debian.org, debian-perl@lists.debian.org

Subject: Re: Bug#864745: Update on base.pm jessie point release

Date: Thu, 6 Jul 2017 19:37:29 +0100

+ debian-perl as it possible affects how we deal with FTBFS module
packages.

On Wed, Jul 05, 2017 at 07:46:39AM +0200, Cyril Brulebois wrote:
> Hi Dominic,
> 
> Dominic Hargreaves <dom@earth.li> (2017-07-04):
> > 1) this commit is identical to those now in upstream release candidates.
> > 2) This has now been filed as #867164 (sorry that this was missing before)
> 
> Thanks for the update, much appreciated.
> 
> I have to say that giving you a green light to update perl in stable with this
> kind of fix makes me a little nervous, sorry. :(

Okay, it would be useful to know in a bit more detail why you think this,
as it doesn't seem any different from other similar fixes to perl we
have requested in the past (and we've learnt our lesson from lack of
mass rebuild testing where that was an issue previously)

But anyway, there are two options:

1) proceed with the update as proposed. This should be fairly low risk
since we have test-rebuilt all packages build-depending on perl and found
no regressions, and the problem it is fixing only affected a handful
of unusual cases. Given the lack of bug reports, I assume the imperfect
base.pm change hasn't actually affected anyone in the real world, but of
course that might be a rash assumption.

2) work around the problem by patching away the issue like we have
for stretch in the half dozen or so affected packages. This would leave
jessie's perl in a slightly awkward state in carrying around for the
rest of its days a patch that was rejected by upstream in favour
of another one. But in practice it may not make all that difference.
And probably the risk in doing this is slightly less in not touching a
core package, though it is a bit more work.

Overall I'm in favour of 1) but happy to defer to you. Does anyone
else in pkg-perl have an opinion on this?

> > 3) this particular bug doesn't strictly apply to stretch/sid, but we plan
> >    to fix it in sid at least for consistency and to fix the minor remaining
> >    security bug (see #867170)
> 
> I'm not sure how we feel about similar-yet-kind-of-different bugs in
> other suites (as in: not sure whether fixing those would be considered
> a hard requirement before an update in (old)stable).

Even if you reject the patch for jessie, I hope you will consider it
in stretch, as there is actually fixes a minor security issue (in due
course it will end up in a new upstream point release, and it's quite
likely we'll want a wholesale upgrade to that anyway).

Indeed, if that would also make you uncomfortable we should discuss
that in more detail...

I will aim to get the s-p-u bug for that filed soon.

Thanks,
Dominic.

Message #27 received at 864745@bugs.debian.org (full text, mbox, reply):

From: Cyril Brulebois <kibi@debian.org>

To: Dominic Hargreaves <dom@earth.li>

Cc: 864745@bugs.debian.org, perl@packages.debian.org, debian-perl@lists.debian.org

Subject: Re: Bug#864745: Update on base.pm jessie point release

Date: Thu, 6 Jul 2017 21:01:21 +0200

[Message part 1 (text/plain, inline)]

Dominic Hargreaves <dom@earth.li> (2017-07-06):
> + debian-perl as it possible affects how we deal with FTBFS module
> packages.
> 
> On Wed, Jul 05, 2017 at 07:46:39AM +0200, Cyril Brulebois wrote:
> > Hi Dominic,
> > 
> > Dominic Hargreaves <dom@earth.li> (2017-07-04):
> > > 1) this commit is identical to those now in upstream release
> > >    candidates.
> > > 2) This has now been filed as #867164 (sorry that this was missing
> > >    before)
> > 
> > Thanks for the update, much appreciated.
> > 
> > I have to say that giving you a green light to update perl in stable
> > with this kind of fix makes me a little nervous, sorry. :(
> 
> Okay, it would be useful to know in a bit more detail why you think
> this, as it doesn't seem any different from other similar fixes to
> perl we have requested in the past (and we've learnt our lesson from
> lack of mass rebuild testing where that was an issue previously)

Well, I'm not the one having accepted past proposed-updates, and since
I've been active on quite a number of {jessie,stretch}-pu requests over
the past few weeks, that was mainly a hint for other release team
members that I wasn't going to green or red light this request myself.

> But anyway, there are two options:
> 
> 1) proceed with the update as proposed. This should be fairly low risk
> since we have test-rebuilt all packages build-depending on perl and found
> no regressions, and the problem it is fixing only affected a handful
> of unusual cases. Given the lack of bug reports, I assume the imperfect
> base.pm change hasn't actually affected anyone in the real world, but of
> course that might be a rash assumption.
> 
> 2) work around the problem by patching away the issue like we have
> for stretch in the half dozen or so affected packages. This would leave
> jessie's perl in a slightly awkward state in carrying around for the
> rest of its days a patch that was rejected by upstream in favour
> of another one. But in practice it may not make all that difference.
> And probably the risk in doing this is slightly less in not touching a
> core package, though it is a bit more work.
> 
> Overall I'm in favour of 1) but happy to defer to you. Does anyone
> else in pkg-perl have an opinion on this?

I see a third one:

0) Wait from someone else from the release team to comment on this.


Hope this clarifies.


KiBi.

[signature.asc (application/pgp-signature, inline)]

Message #32 received at 864745@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Cyril Brulebois <kibi@debian.org>

Cc: 864745@bugs.debian.org, perl@packages.debian.org, debian-perl@lists.debian.org

Subject: Re: Bug#864745: Update on base.pm jessie point release

Date: Fri, 7 Jul 2017 00:07:38 +0100

On Thu, Jul 06, 2017 at 09:01:21PM +0200, Cyril Brulebois wrote:
> Dominic Hargreaves <dom@earth.li> (2017-07-06):
> > + debian-perl as it possible affects how we deal with FTBFS module
> > packages.
> > 
> > On Wed, Jul 05, 2017 at 07:46:39AM +0200, Cyril Brulebois wrote:
> > > Hi Dominic,
> > > 
> > > Dominic Hargreaves <dom@earth.li> (2017-07-04):
> > > > 1) this commit is identical to those now in upstream release
> > > >    candidates.
> > > > 2) This has now been filed as #867164 (sorry that this was missing
> > > >    before)
> > > 
> > > Thanks for the update, much appreciated.
> > > 
> > > I have to say that giving you a green light to update perl in stable
> > > with this kind of fix makes me a little nervous, sorry. :(
> > 
> > Okay, it would be useful to know in a bit more detail why you think
> > this, as it doesn't seem any different from other similar fixes to
> > perl we have requested in the past (and we've learnt our lesson from
> > lack of mass rebuild testing where that was an issue previously)
> 
> Well, I'm not the one having accepted past proposed-updates, and since
> I've been active on quite a number of {jessie,stretch}-pu requests over
> the past few weeks, that was mainly a hint for other release team
> members that I wasn't going to green or red light this request myself.
> 
> > But anyway, there are two options:
> > 
> > 1) proceed with the update as proposed. This should be fairly low risk
> > since we have test-rebuilt all packages build-depending on perl and found
> > no regressions, and the problem it is fixing only affected a handful
> > of unusual cases. Given the lack of bug reports, I assume the imperfect
> > base.pm change hasn't actually affected anyone in the real world, but of
> > course that might be a rash assumption.
> > 
> > 2) work around the problem by patching away the issue like we have
> > for stretch in the half dozen or so affected packages. This would leave
> > jessie's perl in a slightly awkward state in carrying around for the
> > rest of its days a patch that was rejected by upstream in favour
> > of another one. But in practice it may not make all that difference.
> > And probably the risk in doing this is slightly less in not touching a
> > core package, though it is a bit more work.
> > 
> > Overall I'm in favour of 1) but happy to defer to you. Does anyone
> > else in pkg-perl have an opinion on this?
> 
> I see a third one:
> 
> 0) Wait from someone else from the release team to comment on this.
> 
> 
> Hope this clarifies.

That makes perfect sense, sorry for the misunderstanding!

Dominic.

Message #37 received at 864745@bugs.debian.org (full text, mbox, reply):

From: "Adam D. Barratt" <adam@adam-barratt.org.uk>

To: Dominic Hargreaves <dom@earth.li>, 864745@bugs.debian.org

Subject: Re: Bug#864745: jessie-pu: package perl/5.20.2-3+deb8u6

Date: Mon, 10 Jul 2017 21:24:11 +0100

Control; tags -1 + confirmed

On Wed, 2017-06-14 at 00:14 +0100, Dominic Hargreaves wrote:
> In July 2016 we released a security update for perl to fix an optional
> module loading related vulnerability:
> 
> https://www.debian.org/security/2016/dsa-3628
> 
> This update included a change that has been since improved by upstream
> for better compatibility with existing code. The original update caused
> a few packages to FTBFS:
> 
> #864302
> #864299
> #832862
> #832866
> #832845
> 
> As such we believe that it makes sense to update perl in jessie to
> include the improved fix, which is scheduled for inclusion in upstream
> maintenance releases soon.

Please go ahead.

Regards,

Adam

Message #42 received at 864745@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: "Adam D. Barratt" <adam@adam-barratt.org.uk>

Cc: 864745@bugs.debian.org

Subject: Re: Bug#864745: jessie-pu: package perl/5.20.2-3+deb8u6

Date: Tue, 11 Jul 2017 17:46:15 +0100

On Mon, Jul 10, 2017 at 09:24:11PM +0100, Adam D. Barratt wrote:
> Control; tags -1 + confirmed
> 
> On Wed, 2017-06-14 at 00:14 +0100, Dominic Hargreaves wrote:
> > In July 2016 we released a security update for perl to fix an optional
> > module loading related vulnerability:
> > 
> > https://www.debian.org/security/2016/dsa-3628
> > 
> > This update included a change that has been since improved by upstream
> > for better compatibility with existing code. The original update caused
> > a few packages to FTBFS:
> > 
> > #864302
> > #864299
> > #832862
> > #832866
> > #832845
> > 
> > As such we believe that it makes sense to update perl in jessie to
> > include the improved fix, which is scheduled for inclusion in upstream
> > maintenance releases soon.
> 
> Please go ahead.
> 
> Regards,
> 
> Adam

Thanks, done.

Dominic.

Message #49 received at 864745@bugs.debian.org (full text, mbox, reply):

From: "Adam D. Barratt" <adam@adam-barratt.org.uk>

To: Dominic Hargreaves <dom@earth.li>, 864745@bugs.debian.org

Subject: Re: Bug#864745: jessie-pu: package perl/5.20.2-3+deb8u6

Date: Sat, 15 Jul 2017 22:50:10 +0100

Control: tags -1 + pending

On Tue, 2017-07-11 at 17:46 +0100, Dominic Hargreaves wrote:
> On Mon, Jul 10, 2017 at 09:24:11PM +0100, Adam D. Barratt wrote:
> > Control; tags -1 + confirmed
> > 
> > On Wed, 2017-06-14 at 00:14 +0100, Dominic Hargreaves wrote:
> > > In July 2016 we released a security update for perl to fix an optional
> > > module loading related vulnerability:
> > > 
> > > https://www.debian.org/security/2016/dsa-3628
> > > 
> > > This update included a change that has been since improved by upstream
> > > for better compatibility with existing code. The original update caused
> > > a few packages to FTBFS:
> > > 
> > > #864302
> > > #864299
> > > #832862
> > > #832866
> > > #832845
> > > 
> > > As such we believe that it makes sense to update perl in jessie to
> > > include the improved fix, which is scheduled for inclusion in upstream
> > > maintenance releases soon.
> > 
> > Please go ahead.
> > 
> > Regards,
> > 
> > Adam
> 
> Thanks, done.

Flagged for acceptance.

Regards,

Adam

Message #56 received at 864745-done@bugs.debian.org (full text, mbox, reply):

From: "Adam D. Barratt" <adam@adam-barratt.org.uk>

To: 843701-done@bugs.debian.org, 850440-done@bugs.debian.org, 858310-done@bugs.debian.org, 858846-done@bugs.debian.org, 861926-done@bugs.debian.org, 862167-done@bugs.debian.org, 862169-done@bugs.debian.org, 862173-done@bugs.debian.org, 862327-done@bugs.debian.org, 862353-done@bugs.debian.org, 862438-done@bugs.debian.org, 862456-done@bugs.debian.org, 862481-done@bugs.debian.org, 862498-done@bugs.debian.org, 862891-done@bugs.debian.org, 862960-done@bugs.debian.org, 862964-done@bugs.debian.org, 862976-done@bugs.debian.org, 862983-done@bugs.debian.org, 862986-done@bugs.debian.org, 862997-done@bugs.debian.org, 863049-done@bugs.debian.org, 863562-done@bugs.debian.org, 863682-done@bugs.debian.org, 863953-done@bugs.debian.org, 863970-done@bugs.debian.org, 864267-done@bugs.debian.org, 864745-done@bugs.debian.org, 864770-done@bugs.debian.org, 864910-done@bugs.debian.org, 864986-done@bugs.debian.org, 865102-done@bugs.debian.org, 865483-done@bugs.debian.org, 865763-done@bugs.debian.org, 866333-done@bugs.debian.org, 866517-done@bugs.debian.org, 866643-done@bugs.debian.org, 866967-done@bugs.debian.org, 867119-done@bugs.debian.org, 867328-done@bugs.debian.org, 867562-done@bugs.debian.org, 868106-done@bugs.debian.org, 868210-done@bugs.debian.org, 868211-done@bugs.debian.org, 868230-done@bugs.debian.org, 868241-done@bugs.debian.org, 868243-done@bugs.debian.org, 868567-done@bugs.debian.org

Subject: Closing bugs for 8.9 fixes

Date: Sat, 22 Jul 2017 13:18:56 +0100

Version: 8.9

Hi,

These bugs all relate for updates which were included in today's jessie
point release.

Regards,

Adam

Send a report that this bug log contains spam.