2026-03-03 22:26:07 <omni> https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/98449#note_588373
2026-03-12 23:27:53 <jvoisin> Ariadne: https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt one more reason to no ship sudo, sigh
2026-03-12 23:28:24 <Ariadne> you don't see me disagreeing but people want it
2026-03-12 23:28:47 <Ariadne> part of me kind of wants to pull a chimera and just build a new distro from scratch with only the right things
2026-03-12 23:31:03 <jvoisin> dang, a blogpost of mine is linked in the advisory
2026-03-12 23:31:09 <jvoisin> https://www.wikihow.com/Handle-Fame
2026-03-13 16:36:35 <f_> jvoisin: is fortify-headers expected to work on ancient gcc versions?
2026-03-13 16:37:21 <f_> I get this error when building with gcc6: /usr/include/fortify/fortify-headers.h:56:67: error: missing binary operator before token "("
2026-03-13 16:37:23 <f_>  #if _FORTIFY_SOURCE > 2 && defined __has_builtin && __has_builtin (__builtin_dynamic_object_size)
2026-03-13 16:37:37 <f_> sorry if it's not ontopic here
2026-03-13 16:52:20 <jvoisin> f_: interesting
2026-03-13 16:52:59 <jvoisin> the oldest gcc version I'm testing is gcc9
2026-03-13 16:58:19 <jvoisin> I'll try to add older compilers to the CI
2026-03-13 16:59:01 <jvoisin> tracked here: https://github.com/jvoisin/fortify-headers/issues/83
2026-03-13 17:09:44 <f_> thanks
2026-03-13 17:10:08 <f_> the usecase here is compiling kernels in postmarketOS, that are downstream vendor kernels (think 3.x, 4.x)
2026-03-13 17:10:39 <f_> I caught this while upgrading a bunch of our device ports to armv7 from armhf
2026-03-13 17:10:59 <f_> (because they target armv7 devices, and have no reason to be armhf)
2026-03-13 17:11:37 <f_> jvoisin: pmOS repositories have gcc4 and gcc6 packages, if that helps
2026-03-13 17:11:53 <f_> https://pkgs.postmarketos.org/packages?name=gcc4&branch=master&repo=&arch=&origin= https://pkgs.postmarketos.org/packages?name=gcc6&branch=master&repo=&arch=&origin=
2026-03-14 03:57:38 <UnknownArtistBot> Hi all! check this out, An Unknown Artist - https://www.anunknownartist.com/
2026-03-23 22:43:32 <omni> do these seem ok? !99458 !99490 !99491 !99492
2026-03-23 22:43:48 <omni> https://blog.rust-lang.org/2026/03/21/cve-2026-33056/
2026-03-23 22:44:11 <omni> I'm still not sure about CVE-2026-33055
2026-03-24 09:19:26 <omni> I've come to the conclusion that I don't think CVE-2026-33055 is relevant for cargo
2026-03-25 15:57:50 <omni> main/nodejs should be security upgraded also in 3.20-stable, there are a bunch of fixes since 20.15.1 - https://github.com/nodejs/node/blob/v20.20.2/doc/changelogs/CHANGELOG_V20.md
2026-03-25 16:05:47 <invoked> speaking of node, the npm "CanisterWorm" thing -- while only affecting systemd that anybody knows of -- is still quite a red flag for npm (or an additional red flag)
2026-03-25 16:06:38 <invoked> not that it's npm's fault entirely
2026-03-25 16:06:48 <invoked> but it's their ecosystem
2026-03-25 16:07:54 <invoked> in theory it could've happened on openrc, it's just not a target.
2026-03-25 16:15:28 <omni> not sure what to do with community/nodejs-current in 3.23-stable, the comment says that it is non-LTS but it is 24.9.0, so LTS and also way behind
2026-03-25 16:16:10 <omni> perhaps just upgrade to the latest 24.x, to minimize risk of breakage
2026-03-25 16:16:35 <ikke> Yeah, I would not upgrade to beyond 24
2026-03-25 16:18:57 <omni> I may look at it tomorrow or something, I have some other things to do
2026-03-25 16:19:38 <omni> I just picked the low-hanging fruit
2026-03-25 16:19:56 <ikke> omni: ack, thangs for working on this
2026-03-31 18:20:48 <omni> maybe I'm doing it wrong and shouldn't introduce something new like this !99875
2026-03-31 18:21:12 <omni> that the commit message header should say "update secfixes" or "fix secfixes" or something more common
2026-03-31 18:21:48 <ikke> I'm not against the former
2026-03-31 18:21:52 <ikke> it's a lot more specific
2026-03-31 18:22:15 <ikke> If you look at the history, it's a lot more clear what is happening 
2026-03-31 18:29:25 <omni> right?
2026-03-31 19:20:17 <omni> wrt !99885 !99886 !99887 !99888 !99889
2026-03-31 19:21:18 <omni> there's also mbedtls 4.1 with "security fixes until at least March 2029" https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-4.1.0
2026-03-31 19:21:52 <omni> maybe something to upgrade to before 3.24-release
2026-03-31 19:24:16 <omni> as 3.6 "be supported with bug-fixes and security fixes until at least March 2027", which is even before 3.22-stable is supposed to reach end of support (2027-05-01)