2022-11-01 13:26:03 <ikke> OpenSSL announcement archive is apparently under load 
2022-11-01 13:28:18 <Foxboron> haha
2022-11-01 14:27:33 <jvoisin> :D
2022-11-01 16:24:30 <ikke> https://mta.openssl.org/pipermail/openssl-announce/2022-November/000241.html
2022-11-01 16:24:59 <ikke> This works better: https://www.openssl.org/news/cl30.txt
2022-11-02 12:00:36 <omni> new XSAs https://xenbits.xen.org/xsa/
2022-11-02 12:00:41 <omni> but no new releases
2022-11-02 12:01:43 <psykose> business as usual then eh
2022-11-02 12:05:45 <omni> seems to have become the usual business, yeah
2022-11-02 21:25:14 <omni> apparently they do point releases every four months ish
2022-11-03 02:32:03 <omni> !41001 !41002
2022-11-03 04:46:20 <bratkartoffel> new CVE releases for sudo: https://nvd.nist.gov/vuln/detail/CVE-2022-43995
2022-11-03 04:46:49 <bratkartoffel> patch available, but no new release yet: https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050
2022-11-03 08:12:32 <ncopa> sudo fixed now
2022-11-03 08:12:34 <ncopa> thanks
2022-11-03 11:40:33 <omni> !41009 !41010 !41011
2022-11-08 02:04:50 <gasoline> hello to all
2022-11-09 22:53:44 <omni> so I've been pestering the xen project about their release policies again (something some of them hope will change in the future)
2022-11-09 22:54:20 <omni> but from what I've gathered, their stable branches should be very solid
2022-11-09 22:55:43 <omni> they push bug fixes, mostly security fixes, to the staging branches and then that will be picked up by CI that will do rigorous testing and, if tests pass, changes will go into the stable branch(es)
2022-11-09 22:57:44 <omni> so perhaps it's "fine", for now, to follow the tip of xen stable branches, although we'll sometimes have to add huge patch-files to our aports repo
2022-11-10 09:48:15 <psykose> the only usual difference between 'git checkout' and 'tarballs' is having to run autoreconf and submodules
2022-11-10 09:48:24 <psykose> looking at xen autoreconf is ran anyway and the modules are separate
2022-11-10 09:48:31 <psykose> you could just clone a git commit if it works lol
2022-11-10 09:48:39 <psykose> better than giant patch files
2022-11-10 09:48:54 <psykose> dunno, doesn't sound like a terrible idea if the branches are 'that stable', but
2022-11-10 10:29:38 <omni> I tried fetching from their gitweb instead
2022-11-10 10:29:47 <omni> curl -L "https://xenbits.xen.org/gitweb/?p=xen.git;a=patches;h=e818f4f0dabf83a6138cd77d7464495fab7bfc16;hp=f6e26ce7d9317abc41130ead6dc2443a7e2dde00" -o main/xen/xen-stable-4.15-20221101.patch
2022-11-10 10:29:58 <omni> (for our 3.14-stable and 3.15-stable branches)
2022-11-10 10:30:20 <omni> but they seem to have a maximum number of patches in the patch view set to 16
2022-11-10 10:30:28 <omni> and this diff should be 124 patches
2022-11-10 10:31:28 <omni> 583k
2022-11-10 12:19:39 <omni> so here are two things to do the same thing !41224 !41225
2022-11-10 12:19:49 <omni> two ways*
2022-11-10 12:23:19 <omni> I dislike the second one less
2022-11-10 12:36:54 <psykose> those urls are probably not very stable
2022-11-10 12:36:55 <psykose> hm
2022-11-10 12:45:49 <omni> wdym?
2022-11-10 12:46:53 <omni> wouldn't the only unexpected thing they could return be 404?
2022-11-10 12:48:35 <psykose> no, the bottom of the patch has 2.30.2
2022-11-10 12:48:51 <psykose> which is the git version that generated that
2022-11-10 12:49:04 <omni> ah... *sigh*
2022-11-10 12:49:10 <psykose> and ancient
2022-11-10 12:49:17 <psykose> funny
2022-11-10 12:49:35 <psykose> gitlab ones just say 'GitLab', same thing for github
2022-11-10 12:49:42 <psykose> gitlab though had some change elsewhere at some point
2022-11-10 12:49:47 <psykose> as did github like a year or so ago
2022-11-10 12:49:51 <psykose> but now they're mostly ok i guess
2022-11-10 12:50:16 <psykose> the more annoying part is when both changed some compression header for autotarballs
2022-11-10 12:52:02 <omni> I guess the question is if they will update their release policy or their git server version first..
2022-11-10 12:52:48 <psykose> i mean there's a github mirror you can just fetch a commit from
2022-11-10 12:52:51 <psykose> but people balk at that one a little
2022-11-10 12:53:24 <omni> yeah, I've thought of that too
2022-11-10 13:00:13 <omni> if I could persuade them to bump or remove the patchset limit, perhaps I could persuade them to set the version to something static
2022-11-10 13:01:58 <omni> too
2022-11-10 13:59:18 <juba> slt
2022-11-10 13:59:58 <juba> hi
2022-11-10 14:00:07 <ikke> juba: hello
2022-11-10 14:00:26 <ikke> ..
2022-11-15 19:28:43 <minimal> Incoming!
2022-11-15 19:28:45 <minimal> https://lists.gnu.org/archive/html/grub-devel/2022-11/msg00059.html
2022-11-15 19:28:57 <ikke> whoosh
2022-11-15 19:29:16 <minimal> Grub security fixes due shortly
2022-11-15 19:29:32 <minimal> though sounds like them mainly are Secure Boot related
2022-11-16 07:31:15 <ncopa> i am not sure we can fix those
2022-11-16 07:31:52 <ncopa> i think other distros has like 100+ patches for grub
2022-11-16 07:31:58 <ncopa> would be better if they could tag a release
2022-11-16 10:19:46 <Foxboron> ncopa: It was planned.. uh last month
2022-11-16 10:20:00 <Foxboron> I've been bothering the maintainer about this for a while...
2022-11-16 10:58:46 <ncopa> thank you for doing so
2022-11-16 10:59:14 <ncopa> Foxboron: maybe i should help you bothering the maintainer....?
2022-11-16 11:00:18 <Foxboron> The issue is that most major distros that look at the above CVEs as actual issues have their own grub forks at this point
2022-11-16 11:00:52 <Foxboron> So when us non-Secure Boot distros point out the issue there isn't really any pressure to change this. And Daniel is still just one guy
2022-11-16 11:01:14 <Foxboron> Nobody stepped up to help maintain a stable release of grub last year
2022-11-16 11:01:23 <ncopa> :-/
2022-11-16 11:02:59 <Foxboron> It's not a great situation :/
2022-11-16 11:03:23 <ncopa> its a common problem in open source
2022-11-16 14:10:18 <minimal> a GRUB 2.12 release is expected "soon": https://lists.gnu.org/archive/html/grub-devel/2022-10/msg00139.html
2022-11-16 14:12:13 <minimal> however I don't believe all the necessary patches for LUKSv2 "FDE" support in Grub have yet been merged (despite support for this being an advertised GRUB 2.06 feature)
2022-11-18 01:57:02 <omni> so there was a release !41224 !41225
2022-11-30 20:31:01 <ikke> Ugh, A release "Fixes 2 security issues", without mentioning what they are :/