[OE-core] [PATCH] bind: Upgrade 9.11.5 -> 9.11.6

[akuster808]

On 3/20/19 8:55 AM, Adrian Bunk wrote:
> On Wed, Mar 20, 2019 at 08:21:31AM -0700, akuster808 wrote:
>> On 3/20/19 7:56 AM, Adrian Bunk wrote:
>>> On Wed, Mar 20, 2019 at 07:35:53AM -0700, akuster808 wrote:
>>>> On 3/20/19 7:09 AM, Adrian Bunk wrote:
>>>>> Copyright hash changed to to year change.
>>>>  You are missing one of the more important bits of info that would help
>>>> make the decision if this gets into M4 or waits until after 2.7 releases.
>>>>
>>>> Go look at the 9.11.5-p4 release notes.
>>> What part of the release notes are you referring to?
>>>
>>> And why are you talking about release notes for a version
>>> that is neither of the two versions in this upgrade?
>> Ah, because the 9.11.5 has patch level updates from -p1 to -p5 that are
>> not the current 9.11.5 and those changes  are included in 9.11.6.
> Most items in the 9.11.6 release notes are also in the 9.11.5
> release notes.

9.11.5-P4 

  * CVE-2018-5744: A specially crafted packet can cause named to leak
    memory
    <https://lists.isc.org/pipermail/bind-announce/2019-February/001115.html> 
    /Michael McNally /
  * CVE-2018-5745: An assertion failure can occur if a trust anchor
    rolls over to an unsupported key algorithm when using managed-keys
    <https://lists.isc.org/pipermail/bind-announce/2019-February/001116.html> 
    /Michael McNally /
  * CVE-2019-6465: Controls for zone transfers might not be properly
    applied to Dynamically Loadable Zones (DLZs) if the zones are
    writable.
    <https://lists.isc.org/pipermail/bind-announce/2019-February/001117.html> 
    /Michael McNally /


please add just the CVE references to the commit message.


>> Also, nowhere was it mentioned this is a bugfix only update.
> It is not a bugfix only update.

The 9.11 series is a Extended Supported Version. (ESV) release.  Use the
software for Production Environments needing infrequent upgrades and no
new features.

https://www.isc.org/downloads/software-support-policy/version-numbering/

>
>> This helps
>> me in deciding if this is a back port candidate.
> You are saying you were threatening to veto inclusion into 2.7 because
> you aren't able to decide whether it should be backported to 2.6?

Not at all. We have entered 2.7 M3 which includes freezing package
updates. The ones that have the best chance of getting in are ones that
are bugfixes and or include CVE fixes. Without any information, the
chance on being included goes down. Having more info in the commit
message helps Richard and Ross to decide if they should include it.

>
>> Keywords to look for: Bugfix only, CVE's, ABI changes, dependency
>> changes, depreciated functions and new features.
>>
>> I are hoping a little do-diligence in being applied to package updates
>> otherwise automation will save us all a bunch of time.
> Doing the 9.11.5 -> 9.11.6 upgrade in master is something I wouldn't 
> have suggested if I wouldn't have considered it reasonable.
Master tends to have  a very liberal update policy, it should now be
closed for stabilization with the possible exceptions I mentioned before.
>
> Upgrading bind 9.11.4 -> 9.11.6 in thud is a case where 
> automation or keywords in a commit cannot make the decision.
> It doesn't look like a clear case either way to me.
>
> The recipe maintainer might be better qualified to analyse
> whether or not this is a backport candidate.

I am the package maintainer and I appreciate folks helping me support
the packages I maintain with in updates and fixes.

regards,
Armin
>
>> Thanks,
>> Armin
> cu
> Adrian
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openembedded.org/pipermail/openembedded-core/attachments/20190320/02d42b77/attachment-0001.html>