<div dir="ltr"><div dir="ltr">Hi<div><br></div><div>Great</div><div><br></div><div><div>Updated packages are now available on<br></div><div><a href="https://apt.inguza.net/jessie-security/clamav">https://apt.inguza.net/jessie-security/clamav</a></div><div><br></div><div>Testing is much appreciated since I have limited experience of clamav myself.</div><div><br></div><div>I can test that the package installs properly but I'm not sure I can regression test it properly myself.</div><div><br></div><div>Anyone who knows how to regression test it properly?</div><div><br></div><div>Best regards</div><div><br></div><div>// Ola</div><br class="gmail-Apple-interchange-newline"></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 15 Apr 2019 at 23:16, Scott Kitterman <<a href="mailto:debian@kitterman.com">debian@kitterman.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">That sounds like the right approach.<br>
<br>
Scott K<br>
<br>
On Monday, April 15, 2019 10:36:31 PM Ola Lundqvist wrote:<br>
> Hi again<br>
> <br>
> I have now compared the 0.100.2 version in stretch to the version 0.100.3<br>
> in stretch updates.<br>
> I can then see that most of the changes that I'm worried about is not<br>
> included.<br>
> <br>
> This means that I will take the .orig file and include a sub-set of the<br>
> updates.<br>
> The remaining updates will be:<br>
> - Symbol updates (unavoidable I think).<br>
> - Copyright update (not sure if it is necessary but I'll include it anyway)<br>
> <br>
> The rest will not be updated.<br>
> <br>
> Best regards<br>
> <br>
> // Ola<br>
> <br>
> On Mon, 15 Apr 2019 at 20:00, Ola Lundqvist <<a href="mailto:ola@inguza.com" target="_blank">ola@inguza.com</a>> wrote:<br>
> > Hi Scott<br>
> > <br>
> > I have now walked through the difference in the debian directories between<br>
> > the version in jessie and stretch updates.<br>
> > I think there is more work than just a simple changelog update.<br>
> > <br>
> > 1) The changelog file contain a lot of changes. I wonder how we generally<br>
> > should it. If I backport a package from current stable should I keep that<br>
> > changelog and just add one entry or should I pretent that the jessie<br>
> > version still apply and add one entry from that one... Not sure myself.<br>
> > 2) /lib/systemd/system/clamav-daemon.socket is no longer installed and a<br>
> > patch introduced to not depend on it<br>
> > 3) Config file moved<br>
> > from /etc/systemd/system/clamav-daemon.socket.d/extend.conf<br>
> > to /etc/systemd/system/clamav-daemon.service.d/extend.conf<br>
> > 4) Changes in postinst. Not sure if it is backwards compatible or not yet.<br>
> > Preliminary not.<br>
> > 5) Debhelper compat updated. Should be ok.<br>
> > 6) Build dependency changes.<br>
> > 7) clamav-dbg package no longer provided<br>
> > 8) so files moved from /usr/lib/libclamav.so to /usr/lib/xxx/libclamav.so<br>
> > and pkgconfig moved accordingly.<br>
> > 9) Support for llvm introduced. Should probably be ok.<br>
> > 10) A LOT of symbols changed. They are delared private so it should be ok.<br>
> > But you never know.<br>
> > <br>
> > It would be helpful if you can help me judge if any of the above means<br>
> > backwards incompatibility.<br>
> > <br>
> > I'm most worried about the following:<br>
> > - Socket change<br>
> > - Config file change<br>
> > - Postinst change<br>
> > - clamav-dbg<br>
> > - Symbol changes<br>
> > <br>
> > Thank you in advance<br>
> > <br>
> > // Ola<br>
> > <br>
> > On Mon, 1 Apr 2019 at 15:13, Scott Kitterman <<a href="mailto:debian@kitterman.com" target="_blank">debian@kitterman.com</a>> wrote:<br>
> >> I believe you've misunderstood.<br>
> >> <br>
> >> The version in stable is 0.100.3 and does not have a soname bump (nor<br>
> >> does it<br>
> >> need one). You should be able to update the LTS with that package with<br>
> >> little<br>
> >> more (maybe no more) than an updated changelog.<br>
> >> <br>
> >> Scott K<br>
> >> <br>
> >> On Monday, April 01, 2019 02:46:34 PM Ola Lundqvist wrote:<br>
> >> > Hi Scott and LTS team<br>
> >> > <br>
> >> > Thank you. I'll see if I can backport the required fixes. That may<br>
> >> > solve<br>
> >> > the library issue.<br>
> >> > <br>
> >> > Alternatively we state that clamav is not supported. Maybe someone in<br>
> >> <br>
> >> the<br>
> >> <br>
> >> > LTS team can advice on that.<br>
> >> > <br>
> >> > Best regards<br>
> >> > <br>
> >> > // Ola<br>
> >> > <br>
> >> > On Sun, 31 Mar 2019 at 22:35, Scott Kitterman <<a href="mailto:debian@kitterman.com" target="_blank">debian@kitterman.com</a>><br>
> >> <br>
> >> wrote:<br>
> >> > > Comments inline.<br>
> >> > > <br>
> >> > > On Sunday, March 31, 2019 09:37:46 PM Ola Lundqvist wrote:<br>
> >> > > > Hi<br>
> >> > > > <br>
> >> > > > I missed to include the clamav maintainers. Sorry about that.<br>
> >> > > > <br>
> >> > > > // Ola<br>
> >> > > > <br>
> >> > > > On Sun, 31 Mar 2019 at 21:21, Ola Lundqvist <<a href="mailto:ola@inguza.com" target="_blank">ola@inguza.com</a>> wrote:<br>
> >> > > > > Dear maintainers, LTS team and Debian Secutiry team<br>
> >> > > > > <br>
> >> > > > > I have started to look at the clamav package update due to<br>
> >> > > > > CVE-2019-1787<br>
> >> > > > > CVE-2019-1788<br>
> >> > > > > CVE-2019-1789<br>
> >> > > > > (the other three vulnerabilities are not affecting jessie or<br>
> >> <br>
> >> stretch<br>
> >> <br>
> >> > > as I<br>
> >> > > <br>
> >> > > > > understand it)<br>
> >> > > <br>
> >> > > That's correct.<br>
> >> > > <br>
> >> > > > > I have understood that the clamav package is typically updated to<br>
> >> <br>
> >> the<br>
> >> <br>
> >> > > > > latest version also in stable and oldstable. However when doing<br>
> >> <br>
> >> so I<br>
> >> <br>
> >> > > > > encountered quite a few things that I would like to ask your<br>
> >> <br>
> >> advice<br>
> >> <br>
> >> > > > > on.<br>
> >> > > > > <br>
> >> > > > > First of all to the maintainers. Do you want to handle also LTS<br>
> >> > > > > (oldstable) and regular security (stable) upload of clamav?<br>
> >> > > <br>
> >> > > Stable is already done through stable proposed updates (which is the<br>
> >> > > normal<br>
> >> > > path for clamav). We leave the LTS releases to the LTS team. Base<br>
> >> <br>
> >> your<br>
> >> <br>
> >> > > work<br>
> >> > > on what's in stable.<br>
> >> > > <br>
> >> > > > > Question to maintainers and Security team. Should we synchronize<br>
> >> <br>
> >> the<br>
> >> <br>
> >> > > > > efforts here and have you already started on the stable update?<br>
> >> > > > > <br>
> >> > > > > If not I have a few questions:<br>
> >> > > > > 1) Do you know the binary compatibility between libclamav7 and<br>
> >> > > <br>
> >> > > libclamav9?<br>
> >> > > <br>
> >> > > > > I have noticed that the package in sid produces libclamav9 while<br>
> >> <br>
> >> the<br>
> >> <br>
> >> > > one<br>
> >> > > <br>
> >> > > > > in jessie provides libclamav7. Do you think this can be an issue?<br>
> >> > > <br>
> >> > > Yes. It's guaranteed to be an issue. We have a stable transition<br>
> >> > > prepared<br>
> >> > > and will do it (once the srm blesses) after the next point release in<br>
> >> > > April.<br>
> >> > > Note that the security team doesn't support clamav.<br>
> >> > > <br>
> >> > > > > 2) Do you think backporting the package in sid is better than<br>
> >> <br>
> >> simply<br>
> >> <br>
> >> > > > > updating to the latest upstream while keeping most scripts in<br>
> >> > > <br>
> >> > > oldstable? I<br>
> >> > > <br>
> >> > > > > had to copy over the split-archive.sh to be able to generate a<br>
> >> <br>
> >> proper<br>
> >> <br>
> >> > > orig<br>
> >> > > <br>
> >> > > > > tarball.<br>
> >> > > <br>
> >> > > No. Use what's in stable proposed updates.<br>
> >> > > <br>
> >> > > > > - I personally think the package in sid have a little too much<br>
> >> <br>
> >> updates<br>
> >> <br>
> >> > > to<br>
> >> > > <br>
> >> > > > > make that safe, especially since it produces new library<br>
> >> > > > > packages.<br>
> >> > > <br>
> >> > > Agreed. That would definitely be a bad idea.<br>
> >> > > <br>
> >> > > > > - On the other hand, I had to do some modifications already to<br>
> >> <br>
> >> make<br>
> >> <br>
> >> > > allow<br>
> >> > > <br>
> >> > > > > the package to be generated and I have not even started building<br>
> >> <br>
> >> yet.<br>
> >> <br>
> >> > > > > There<br>
> >> > > > > may be many fixes needed to make this package work in<br>
> >> > > > > oldstable...<br>
> >> > > <br>
> >> > > I suspect that what's in stable will work in oldstable, but I haven't<br>
> >> > > tried<br>
> >> > > it. It'll certainly take less work than what's in sid.<br>
> >> > > <br>
> >> > > > > I guess we cannot generate new library package version, or?<br>
> >> > > <br>
> >> > > Generally one does not, but for clamav you kind of have to at some<br>
> >> <br>
> >> point.<br>
> >> <br>
> >> > > Note that for libclamav7 -> libclamav9 there are also API changes, so<br>
> >> > > libclamav-dev reverse builld-depends need patching in addition to<br>
> >> > > rebuilding.<br>
> >> > > Once we've done that in stable, it should be easy enough to adapt for<br>
> >> > > oldstable when the time comes. Don't worry about it now.<br>
> >> > > <br>
> >> > > Scott K<br>
> > <br>
> > --<br>
> > <br>
> > --- Inguza Technology AB --- MSc in Information Technology ----<br>
> > <br>
> > | <a href="mailto:ola@inguza.com" target="_blank">ola@inguza.com</a> <a href="mailto:opal@debian.org" target="_blank">opal@debian.org</a> |<br>
> > | <a href="http://inguza.com/" rel="noreferrer" target="_blank">http://inguza.com/</a> Mobile: +46 (0)70-332 1551 |<br>
> > <br>
> > ---------------------------------------------------------------<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div><div><font face="courier new, monospace" size="1"> --- Inguza Technology AB --- MSc in Information Technology ----</font></div><div><font face="courier new, monospace" size="1">| </font><a href="mailto:ola@inguza.com" style="font-family:"courier new",monospace;font-size:x-small" target="_blank">ola@inguza.com</a><span style="font-family:"courier new",monospace;font-size:x-small"> </span><a href="mailto:opal@debian.org" style="font-family:"courier new",monospace;font-size:x-small" target="_blank">opal@debian.org</a><span style="font-family:"courier new",monospace;font-size:x-small"> |</span></div><div><font face="courier new, monospace" size="1">| <a href="http://inguza.com/" target="_blank">http://inguza.com/</a> Mobile: +46 (0)70-332 1551 |</font></div><div><font face="courier new, monospace" size="1"> ---------------------------------------------------------------</font></div></div><div><br></div></div></div></div></div></div></div>