Re: [PATCH] bind: Upgrade 9.11.5 -> 9.11.6

[Adrian Bunk <bunk@stusta.de>]

On Wed, Mar 20, 2019 at 09:33:56AM -0700, akuster808 wrote:
> 
> 
> On 3/20/19 8:55 AM, Adrian Bunk wrote:
> > On Wed, Mar 20, 2019 at 08:21:31AM -0700, akuster808 wrote:
> >> On 3/20/19 7:56 AM, Adrian Bunk wrote:
> >>> On Wed, Mar 20, 2019 at 07:35:53AM -0700, akuster808 wrote:
> >>>> On 3/20/19 7:09 AM, Adrian Bunk wrote:
> >>>>> Copyright hash changed to to year change.
> >>>>  You are missing one of the more important bits of info that would help
> >>>> make the decision if this gets into M4 or waits until after 2.7 releases.
> >>>>
> >>>> Go look at the 9.11.5-p4 release notes.
> >>> What part of the release notes are you referring to?
> >>>
> >>> And why are you talking about release notes for a version
> >>> that is neither of the two versions in this upgrade?
> >> Ah, because the 9.11.5 has patch level updates from -p1 to -p5 that are
> >> not the current 9.11.5 and those changes  are included in 9.11.6.
> > Most items in the 9.11.6 release notes are also in the 9.11.5
> > release notes.
> 
> 9.11.5-P4 
> 
>   * CVE-2018-5744: A specially crafted packet can cause named to leak
>     memory
>     <https://lists.isc.org/pipermail/bind-announce/2019-February/001115.html> 
>     /Michael McNally /
>   * CVE-2018-5745: An assertion failure can occur if a trust anchor
>     rolls over to an unsupported key algorithm when using managed-keys
>     <https://lists.isc.org/pipermail/bind-announce/2019-February/001116.html> 
>     /Michael McNally /
>   * CVE-2019-6465: Controls for zone transfers might not be properly
>     applied to Dynamically Loadable Zones (DLZs) if the zones are
>     writable.
>     <https://lists.isc.org/pipermail/bind-announce/2019-February/001117.html> 
>     /Michael McNally /
> 
> 
> please add just the CVE references to the commit message.

Precedent in master seems to be to not list CVEs fixed in new upstream,
only when CVE fixes get backported.

Justifying my patch with CVE numbers would also be wrong since for only 
these CVE fixes 9.11.5-p4 would be better than 9.11.6.

> >> Also, nowhere was it mentioned this is a bugfix only update.
> > It is not a bugfix only update.
> 
> The 9.11 series is a Extended Supported Version. (ESV) release.  Use the
> software for Production Environments needing infrequent upgrades and no
> new features.
> 
> https://www.isc.org/downloads/software-support-policy/version-numbering/

I am not disputing that it is an LTS series.

But 9.11.5 -> 9.11.6 is not a bugfix only update.

> >> This helps
> >> me in deciding if this is a back port candidate.
> > You are saying you were threatening to veto inclusion into 2.7 because
> > you aren't able to decide whether it should be backported to 2.6?
> 
> Not at all. We have entered 2.7 M3 which includes freezing package
> updates. The ones that have the best chance of getting in are ones that
> are bugfixes and or include CVE fixes. Without any information, the
> chance on being included goes down. Having more info in the commit
> message helps Richard and Ross to decide if they should include it.
>...
> I am the package maintainer and I appreciate folks helping me support
> the packages I maintain with in updates and fixes.

Do whatever you want to do, it's best to end the discussion at this point.

> regards,
> Armin

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed