[Buildroot] [PATCH] glibc: bump default to version 2.23

[Gustavo Zacarias <gustavo@zacarias.com.ar>]

On 22/06/16 17:38, Arnout Vandecappelle wrote:

>   My take on this: we should follow the stable branch of upstream. Since glibc
> has no concept of stable branches (in fact, none of the libc's do), we really
> should follow upstream releases aggressively.
>
>   In fact, I think it's quite unreasonable that we don't have stable updates for
> glibc (or any other libc). As a distro, it's our responsibility to make sure our
> users get stable updates, particularly for something as important as glibc.
> Since we (currently) don't have the bandwidth to do that, and since there simply
> is no viable upstream to rely on [*], we should probably consider dropping the
> multi-version glibc... Topic for discussion at the next BR developer meeting.
>
>
>   Regards,
>   Arnout
>
>   [*] I've checked if we could use another distro, but most are on glibc 2.19...
> Debian would be an option for glibc 2.22, but for 2.23 and 2.24 there will
> probably no viable distro.

Hi.
My $.02: Ubuntu 16.04 LTS is on 2.23.
In general we haven't seen big regressions with glibc upgrades compared 
to binutils/gcc.
Also, and don't take this as cockyness, i'm like the only one (except 
for Bernd one time) putting out security patches for glibc.
Currently my spare time is pretty thin, and backporting patches for two 
versions of glibc and testing them is much more work than a single version.
If we default to n-1 this means carrying on more patches since generally 
n-1 has more vulnerabilities than n when talking about glibc.
If in consequence i only post patches for n and we default to n-1, well, 
that sucks plain and simple, since we would be shipping known-vulnerable 
by default, and how many users will bother to switch to latest glibc?
Regards.