<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<br>
<div class="moz-cite-prefix">On 3/20/19 8:55 AM, Adrian Bunk wrote:<br>
</div>
<blockquote type="cite" cite="mid:20190320155530.GA1365@localhost">
<pre class="moz-quote-pre" wrap="">On Wed, Mar 20, 2019 at 08:21:31AM -0700, akuster808 wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On 3/20/19 7:56 AM, Adrian Bunk wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On Wed, Mar 20, 2019 at 07:35:53AM -0700, akuster808 wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
On 3/20/19 7:09 AM, Adrian Bunk wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Copyright hash changed to to year change.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap=""> You are missing one of the more important bits of info that would help
make the decision if this gets into M4 or waits until after 2.7 releases.
Go look at the 9.11.5-p4 release notes.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">What part of the release notes are you referring to?
And why are you talking about release notes for a version
that is neither of the two versions in this upgrade?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Ah, because the 9.11.5 has patch level updates from -p1 to -p5 that are
not the current 9.11.5 and those changes are included in 9.11.6.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Most items in the 9.11.6 release notes are also in the 9.11.5
release notes.
</pre>
</blockquote>
<br>
<pre>9.11.5-P4 </pre>
<ul>
<li><a
href="https://lists.isc.org/pipermail/bind-announce/2019-February/001115.html">CVE-2018-5744:
A specially crafted packet can cause named to leak memory
</a><a name="1115"> </a>
<i>Michael McNally
</i>
</li>
<li><a
href="https://lists.isc.org/pipermail/bind-announce/2019-February/001116.html">CVE-2018-5745:
An assertion failure can occur if a trust anchor rolls over to
an unsupported key algorithm when using managed-keys
</a><a name="1116"> </a>
<i>Michael McNally
</i>
</li>
<li><a
href="https://lists.isc.org/pipermail/bind-announce/2019-February/001117.html">CVE-2019-6465:
Controls for zone transfers might not be properly applied to
Dynamically Loadable Zones (DLZs) if the zones are writable.
</a><a name="1117"> </a>
<i>Michael McNally
</i></li>
</ul>
<p><br>
</p>
<p>please add just the CVE references to the commit message.</p>
<p><br>
</p>
<blockquote type="cite" cite="mid:20190320155530.GA1365@localhost">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Also, nowhere was it mentioned this is a bugfix only update.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
It is not a bugfix only update.</pre>
</blockquote>
<br>
The 9.11 series is a Extended Supported Version. (ESV) release. Use
the software for Production Environments needing infrequent upgrades
and no new features.<br>
<br>
<a class="moz-txt-link-freetext" href="https://www.isc.org/downloads/software-support-policy/version-numbering/">https://www.isc.org/downloads/software-support-policy/version-numbering/</a><br>
<br>
<blockquote type="cite" cite="mid:20190320155530.GA1365@localhost">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">This helps
me in deciding if this is a back port candidate.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
You are saying you were threatening to veto inclusion into 2.7 because
you aren't able to decide whether it should be backported to 2.6?</pre>
</blockquote>
<br>
Not at all. We have entered 2.7 M3 which includes freezing package
updates. The ones that have the best chance of getting in are ones
that are bugfixes and or include CVE fixes. Without any information,
the chance on being included goes down. Having more info in the
commit message helps Richard and Ross to decide if they should
include it.<br>
<br>
<blockquote type="cite" cite="mid:20190320155530.GA1365@localhost">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Keywords to look for: Bugfix only, CVE's, ABI changes, dependency
changes, depreciated functions and new features.
I are hoping a little do-diligence in being applied to package updates
otherwise automation will save us all a bunch of time.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Doing the 9.11.5 -> 9.11.6 upgrade in master is something I wouldn't
have suggested if I wouldn't have considered it reasonable.</pre>
</blockquote>
Master tends to have a very liberal update policy, it should now be
closed for stabilization with the possible exceptions I mentioned
before.<br>
<blockquote type="cite" cite="mid:20190320155530.GA1365@localhost">
<pre class="moz-quote-pre" wrap="">
Upgrading bind 9.11.4 -> 9.11.6 in thud is a case where
automation or keywords in a commit cannot make the decision.
It doesn't look like a clear case either way to me.
The recipe maintainer might be better qualified to analyse
whether or not this is a backport candidate.</pre>
</blockquote>
<br>
I am the package maintainer and I appreciate folks helping me
support the packages I maintain with in updates and fixes.<br>
<br>
regards,<br>
Armin<br>
<blockquote type="cite" cite="mid:20190320155530.GA1365@localhost">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Thanks,
Armin
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
cu
Adrian
</pre>
</blockquote>
<br>
</body>
</html>