From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marius Bakke Subject: Re: [PATCH 0/1] Gst-plugins-good security update Date: Sat, 26 Nov 2016 09:51:30 +0100 Message-ID: <87fumehbe5.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> References: Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:39617) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cAYht-0002Bb-0o for guix-devel@gnu.org; Sat, 26 Nov 2016 03:51:40 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cAYhp-0001qH-Iw for guix-devel@gnu.org; Sat, 26 Nov 2016 03:51:37 -0500 Received: from out5-smtp.messagingengine.com ([66.111.4.29]:58644) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cAYhp-0001q7-Bs for guix-devel@gnu.org; Sat, 26 Nov 2016 03:51:33 -0500 In-Reply-To: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari , guix-devel@gnu.org --=-=-= Content-Type: text/plain Leo Famulari writes: > This patch should fix the bugs named here: > > http://seclists.org/oss-sec/2016/q4/517 > > I copied Debian's approach, which is to take all the recent patches for > the vulnerable component (the FLIC decoder). > > My understanding is that the first two patches fix the CVEs, the 3rd > fixes an unrelated bug, and the 4th is a total rewrite of the component, > because "code is terrible, it should be entirely re-written" [0]. > > The CVE bug fixes are not split into discrete patches, so it doesn't > work to make patches for each CVE ID, like we normally do. > > Is this approach (concatenating the patches) okay? I prefer having them separately, so the upstream commit can be clearly referenced in the patch header; and they can be reviewed and modified independently. In this instance it's okay, since I just checked out the 1.10 branch and concatenated the four commits and ended up with the same patch :-) That's not to say it should not be allowed. I think this approach is fine for long patch series, but at only four patches it's not the best precedent. Anyway, thanks for taking care of this, and LGTM! Please push! :-) --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlg5TRIACgkQoqBt8qM6 VPp7uQf/X2srvP0awRmGcjfx1yE6ec8DEzgA8OxmIAaaCrFSeEmjQR6m6c0ZSZFO 2+WhOZLbhVH701YPsTJ0zIho0sBx68Kh6vmdFNKFICEr5Bpk/fnDPHlpLC4KwFyM y1SViaiOcjxhwdkVXB0hFOJTTU4MbBnK2T4yMmXVlXYeB/CRm8CH1qMqOTjUOd+q nFXzXk0dJ3X3Th40WenTYsdpST6LQnkY0UGazLNETCg8qDwNsrjSssYqNY4CNcrn fisU4TfgD75NQP+ufOfAHk9xHWz/BTf5Kb5mHnML2FDZbQmZ6DpU6sq3GaqxPeO+ eX/DnCy7FUjXYXas6IZ99Phxx5rxKA== =KtYO -----END PGP SIGNATURE----- --=-=-=--