guix-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH 0/1] Gst-plugins-good security update


From: Marius Bakke
Subject: Re: [PATCH 0/1] Gst-plugins-good security update
Date: Sat, 26 Nov 2016 09:51:30 +0100
User-agent: Notmuch/0.23.2 (https://notmuchmail.org) Emacs/25.1.1 (x86_64-unknown-linux-gnu)

Leo Famulari <address@hidden> writes:

> This patch should fix the bugs named here:
>
> http://seclists.org/oss-sec/2016/q4/517
>
> I copied Debian's approach, which is to take all the recent patches for
> the vulnerable component (the FLIC decoder).
>
> My understanding is that the first two patches fix the CVEs, the 3rd
> fixes an unrelated bug, and the 4th is a total rewrite of the component,
> because "code is terrible, it should be entirely re-written" [0].
>
> The CVE bug fixes are not split into discrete patches, so it doesn't
> work to make patches for each CVE ID, like we normally do.
>
> Is this approach (concatenating the patches) okay?

I prefer having them separately, so the upstream commit can be clearly
referenced in the patch header; and they can be reviewed and modified
independently.

In this instance it's okay, since I just checked out the 1.10 branch and
concatenated the four commits and ended up with the same patch :-)

That's not to say it should not be allowed. I think this approach is
fine for long patch series, but at only four patches it's not the best
precedent.

Anyway, thanks for taking care of this, and LGTM! Please push! :-)

Attachment: signature.asc
Description: PGP signature


reply via email to

[Prev in Thread] Current Thread [Next in Thread]