Re: [OE-core][kirkstone 00/27] Patch review

[Randy MacLeod <randy.macleod@windriver.com>]

On 2022-04-21 10:00, Steve Sakoman wrote:
> On Wed, Apr 20, 2022 at 7:14 PM Randy MacLeod <rwmacleod@gmail.com> wrote:
>>
>> On Wed., Apr. 20, 2022, 10:54 Steve Sakoman, <steve@sakoman.com> wrote:
>>> On Wed, Apr 20, 2022 at 4:08 AM Steve Sakoman via
>>> lists.openembedded.org <steve=sakoman.com@lists.openembedded.org>
>>> wrote:
>>>> Please review this set of patches for kirkstone and have comments back by
>>>> end of day Friday.
>>> I'd particularly like feedback on the security/bug fix version updates
>>> at the end of this series.
>>>
>>> In the past I took these only on request.
>>>
>>> Would people like me to be more proactive on this type of upgrade
>>> (such as this series), or should I continue to take them only on
>>> request?
>> Proactive but reasonably cautious. ;-)
> That's my feeling too.
>
>>>> Passed a-full on autobuilder:
>>>>
>>>> https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3547
>>>>
>>>> The following changes since commit d2ba3b8850d461bc7b773240cdf15b22b31a3f9e:
>>>>
>>>>    lua: fix CVE-2022-28805 (2022-04-19 14:02:08 +0100)
>>>>
>>>> are available in the Git repository at:
>>>>
>>>>    git://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
>>>>    http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
>>>>
>>>> Alexander Kanavin (1):
>>>>    webkitgtk: adjust patch status
>>>>
>>>> Davide Gardenal (1):
>>>>    create-spdx: fix error when symlink cannot be created
>>>>
>>>> Ferry Toth (2):
>>>>    apt: add apt selftest to test signed package feeds
>>>>    package_manager: fix missing dependency on gnupg when signing deb
>>>>      package feeds
>>>>
>>>> Jon Mason (1):
>>>>    qemuarm64: use virtio pci interfaces
>>>>
>>>> Kai Kang (1):
>>>>    update_udev_hwdb: fix multilib issue with systemd
>>>>
>>>> Khem Raj (5):
>>>>    babeltrace: Disable warnings as errors
>>>>    xserver-xorg: Fix build with gcc12
>>>>    systemtap: Fix build with gcc-12
>>>>    gnupg: Disable FORTIFY_SOURCES on mips
>>>>    mdadm: Drop clang specific cflags
>>>>
>>>> Konrad Weihmann (2):
>>>>    git: correct license
>>>>    ncurses: use COPYING file
>>>>
>>>> Martin Jansa (1):
>>>>    systemd-boot: remove outdated EFI_LD comment
>>>>
>>>> Paulo Neves (1):
>>>>    selftest/lic_checksum: Add test for filename containing space
>>>>
>>>> Peter Kjellerstedt (2):
>>>>    u-boot: Correct the SRC_URI
>>>>    u-boot: Inherit pkgconfig
>>>>
>>>> Richard Purdie (1):
>>>>    buildtools-tarball: Only add cert envvars if certs are included
>>>>
>>>> Ross Burton (1):
>>>>    zlib: upgrade to 1.2.12
>>>>
>>>> wangmy (5):
>>>>    linux-firmware: upgrade 20220310 -> 20220411
>>
>> It's firmware so it should be fine but I don't know much about such things. Have  firmware updates ever broken older kernels?
>> Certainly there could be performance degradation. I guess it's a release note item for others to worry about.
> I've been doing these regularly for dunfell and it hasn't been an
> issue in the past two years.
As expected but that's good to hear.
>
>>>>    libsoup: upgrade 3.0.5 -> 3.0.6
>>>>    apt: upgrade 2.4.3 -> 2.4.4
>>>>    libusb1: upgrade 1.0.25 -> 1.0.26
>>>>    libgit2: upgrade 1.4.2 -> 1.4.3
>>>>
>>>> zhengruoqin (3):
>>>>    wireless-regdb: upgrade 2022.02.18 -> 2022.04.08
>>>>    git: upgrade 2.35.2 -> 2.35.3
>>>>    ruby: upgrade 3.1.1 -> 3.1.2
>> These all seem like bug fix only updates.
>> Are you assuming that third number updates don't change API/ABI or looking at commit summaries, git logs, or using a tool?
> Yes, my criteria for including is that they are bug/security only updates.
>
> I don't assume anything from the version number, I review the release
> notes (if any) and the git logs.  In many cases the version updates in
> master don't include this info in the commit message.  In that case I
> add either the release notes or the git log to the commit message when
> cherry-picking from master.
That's great. The only better response would be if we could run API/ABI 
test.
I'll see if that's something that we can work on for release branches 
but no promises

or timeline for that so far.


>
> So it is a time consuming manual process :-)


It is; thanks for the careful work.


>
> BTW, those who include release notes or commit logs in their version
> bumps get smiles and brownie points from me!

+1


../Randy

>
> Steve
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#164762): https://lists.openembedded.org/g/openembedded-core/message/164762
> Mute This Topic: https://lists.openembedded.org/mt/90584508/3616765
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [randy.macleod@windriver.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

-- 
# Randy MacLeod
# Wind River Linux