2026-11-01 00:32:38 <liske_> I'm aware that the builder is slow but why is this package *older* than on the other archs? or is https://pkgs.alpinelinux.org/packages?name=py3-libifstate_rs&branch=edge&repo=&arch=&origin=&flagged=&maintainer= showing fake packet metadata?
2026-11-01 00:46:58 <jogemu[m]> On 2026-10-14 all architectures had 0.4.2-r0 in the testing repository. On 2026-10-18 it was moved from testing to community, which led to a second build of 0.4.2-r0, this time in the community repository. Because of the long queue the second build is still pending for riscv64. Until this is done you see the older date, which used to be there for the other architectures as well. (Sorry for mixing up the order in my last message)
2026-11-01 01:15:41 <jhuntwork> hi ncopa 
2026-11-01 02:55:20 <jahway603[m]> Can I please have !110784 merged? Thank you.
2026-11-01 07:26:08 <ncopa> hey!
2026-11-01 07:49:50 <Forza> Hi. Morning. I am going to make a MR for an updated scsi-tgt version that fixes a critical RCE. Should I mention the RCE in the title, or just go with "community/scsi-tgt: upgrade to 1.0.98" as normal?
2026-11-01 07:50:44 <ncopa> write "security upgrade to 1.0.98" if it is a single CVE add it as well. "security upgrade to 1.0.98 (CVE-...)"
2026-11-01 07:51:31 <ncopa> if it is many, then add the list of CVEs in commit message body
2026-11-01 07:51:43 <Forza> thanks. No CVE assigned afaik, but the RCE was made public anyways. 
2026-11-01 07:52:39 <ncopa> may be good with a ref: <URL> to a relevant reference
2026-11-01 07:52:51 <Forza> https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/110872
2026-11-01 07:52:58 <Forza> Yea, did that. Does it look ok?
2026-11-01 07:55:05 <ncopa> can you include some ref in the git commit message so people doing git log (without gitlab) can get a clue the security part is about?
2026-11-01 07:55:29 <ncopa> the warez site gives me cert error
2026-11-01 07:55:55 <ncopa> https://github.com/fujita/tgt/compare/v1.0.97...v1.0.98 works. it fairly evident it is a security related fix
2026-11-01 07:57:11 <Forza> Hm yea, the warez site was not greatest. I got the report because someone sent it to the mailing lists. I could try to find a link to the message if that helps?
2026-11-01 07:58:21 <ncopa> the github UL above is enough
2026-11-01 07:58:33 <ncopa> URL*
2026-11-01 07:59:13 <ncopa> I only needed 5 seconds look to understand that it was security related
2026-11-01 07:59:24 <Forza> I did verify the the code myself and was about to make a minimal fix. The main fault is `conn->req.data = task->data + be32_to_cpu(req->offset);` which uses the initiator values unverified. An out of bounds situation is easy to craft.
2026-11-01 08:00:04 <Forza> Should I add a small comment about that?
2026-11-01 08:01:11 <ncopa> *shrug*
2026-11-01 08:01:26 <ncopa> probably better if you submit it upstream first
2026-11-01 08:05:32 <Forza> The upstream has fixed it. I just meant if I should update the MR with the specific issue so it is clear. I updated the MR comment. Maybe that was too much detail?
2026-11-01 08:19:02 <ncopa> Forza: I meant the git commit message. the MR description was fine. now its too much detail :)
2026-11-01 08:19:05 <ncopa> sorry for not being clear
2026-11-01 08:19:16 <ncopa> I meant this one: https://gitlab.alpinelinux.org/forza/aports/-/commit/5700ec80f3b09cf9fdb46f48541f152d8e804ba6.patch
2026-11-01 08:19:48 <ncopa> so do git commit --amend add a link to commit message body, and git push -f it
2026-11-01 08:21:13 <ncopa> so it shows in the local git log
2026-11-01 08:38:56 <Forza> Aha. ok, let me check 
2026-11-01 09:11:40 <Forza> ncopa: I did it, but I am not sure it shows? How do I find the commit/patch line?