Re: Any objections to removing linux-libre@4.1?

[Leo Famulari <leo@famulari.name>]

[-- Attachment #1: Type: text/plain, Size: 1374 bytes --]

On Sun, Jun 04, 2017 at 02:11:39AM -0400, Mark H Weaver wrote:
> Does anyone here still need linux-libre@4.1 in Guix?  If not, I'd like
> to remove it.
> 
> Upstream security updates for it seem to be quite infrequent (2.5 months
> between the last two releases), and the recent update to 4.1.40
> neglected to include a fix for CVE-2017-6074, which does not inspire
> confidence.
> 
> What do you think?

I don't have a strong objection. If somebody needs this particular Linux release
series later, it will not be difficult for them to recreate.

On the other hand, the 4.1 series has been selected for the Linux Foundation's
Long Term Support Initiative. This program will support Linux releases for
longer than usual, so 4.1 will be in use for longer than most of the Linux LTS
releases.

Besides, kernel bugs are not rare. More will be found and disclosed, and some
will be found and kept private :/

I recommend waiting a few days for more comments. IIRC, we kept this particular
series to work around some bugs related to GuixSD and Libreboot. So, there were
some people using it. I'd hate to "strand" existing users who might not notice
that they are not receiving updates to the 'linux-4.1' package they've specified
in their GuixSD configuration.

If Hydra resources are a concern, perhaps we could keep the package but not
build it.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]