2026-08-20 09:06:32 <dne> https://mastodon.social/@bagder/117126405348232504
2026-08-20 11:34:11 <jvoisin> didn't we collectively agree as a society that backports aren't really working security-wise?
2026-08-20 12:20:28 <invoked> jvoisin: yeah. curl will never be "finished software" ... i don't know what people expect from a tool that basically aims to support every modern protocol. to be fair, he has cleaned up/removed some stuff but... is what it is
2026-08-20 16:20:38 <andar1an[m]> Just in case: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
2026-08-24 18:26:27 <idkrnx[m]> jvoisin: It's great for enterprise that needs to tick checkbox for compliance :)
2026-08-24 18:29:45 <jvoisin> meaning it's great for funding
2026-08-25 23:24:21 <omni> speaking of backports, anyone up for backporting fixes to openssl in 3.21-stable? (3.3.x is EoL since April)
2026-08-26 00:42:36 <andar1an[m]> Is it hard? I haven't done before but would be open to learning
2026-08-26 05:02:19 <ikke> andar1an[m]: it's in the category that you should know what you are doing
2026-08-26 07:59:10 <andar1an[m]> Ok, will try to find mr for backports to learn for future then.
2026-08-26 08:15:09 <andar1an[m]> Seems like main difference is branch it gets merged into?
2026-08-26 08:17:36 <andar1an[m]> Is there some specific test suite you need to setup and run for cve backports?
2026-08-26 08:21:04 <andar1an[m]> It seems like a version bump by description
2026-08-26 08:23:45 <dne> this is about backporting the upstream's CVE fixes to openssl 3.3 (which is no longer getting updates/patch releases)
2026-08-26 08:29:00 <ikke> Yeah, this is not a matter of bumping the package version.
2026-08-26 08:36:22 <omni> a quick glance and upstream added tests for at least three of the CVEs, perhaps those tests could be backported as well
2026-08-26 08:41:03 <andar1an[m]> Ah, i had assumed it was version and pkgrel bump for sodiffs, with test suite uodate, not porting changes to old version. my bad
2026-08-26 08:41:16 <dne> 3.21-stable is missing the previous round of CVE fixes as well I believe: https://openssl-library.org/news/secadv/20260609.txt
2026-08-26 08:43:50 <ikke> andar1an[m]: ftr, we avoid bumping SONAMES on stable releases
2026-08-26 08:45:24 <andar1an[m]> Makes sense. Just assumed backports for security was exception
2026-08-26 08:45:44 <ikke> Depends on feasibility and impact
2026-08-26 08:46:01 <ikke> Something like openssl is used a lot, even outside of aports. Breaking changes affect a lot
2026-08-26 08:46:18 <andar1an[m]> Ya, i figured. Will try to watch how this is done when it is.
2026-08-26 08:47:18 <ikke> One option is to check if a different distro has already backported it
2026-08-26 08:48:59 <andar1an[m]> One of my first steps with pkgs is that. Gentoo first, arch and nix after generally
2026-08-26 08:51:34 <andar1an[m]> Anyways, sorry couldn't be more help haha. Maybe in future
2026-08-26 15:41:32 <invoked> yeah. i'd say openssl maintainers are specialists. 
2026-08-26 15:41:42 <invoked> bless 'em
2026-08-26 16:19:56 <andar1an[m]> 💯
2026-08-26 18:41:45 <omni> any thoughts or objections to my recently opened MRs to backport the bubblewrap upgrade to stable releases?
2026-08-27 17:09:03 <andar1an[m]> May I ask a file permission question related to users and groups in this channel?
2026-08-27 17:10:06 <andar1an[m]> Pertains to security, but may be wrong forum
2026-08-27 19:03:15 <andar1an[m]> I think i got to some level of understanding, but if I could bounce to validate would appreciate if someone has time at some point
2026-08-28 11:39:49 <omni> andar1an[m]: not sure this is the right channel for it, as it sounds a bit general, but you also don't need to ask if you can ask a question, just ask
2026-08-28 11:46:41 <andar1an[m]> I didn't want to pollute a security channel
2026-08-28 11:46:49 <andar1an[m]> Sertonix was able to help me
2026-08-28 21:13:13 <bananicorn> Hi, dovecot just published a bunch of CVEs fixed in 2.4.5, alpine has 2.4.4. Among them is also a use-after-free possible RCE with CVSS score of 9.1 and a bunch of DoS bugs.
2026-08-28 21:13:41 <bananicorn> Thought I'd give a heads up since I just happened to read it in oss-security
2026-08-28 22:31:09 <omni> thanks!
2026-08-28 22:31:31 <omni> !107523
2026-08-28 22:39:54 <omni> !107524 !107525
2026-08-28 22:40:15 <omni> oh, drat, bork
2026-08-28 22:41:59 <omni> dovecot in 3.21-stable is at 2.3.21.1, and in 3.22-stable 2.4.1 (perhaps safer to upgrade to 2.4.5 than the other)
2026-08-28 23:53:14 <omni> ncopa: heads-up that there are several openssh MRs for 3.24-stable
2026-08-31 21:07:31 <dne> https://blog.hartwork.org/posts/expat-2-8-4-released/