[Pkg-shadow-devel] Wheezy update of shadow?

[Bálint Réczey]

2016-07-26 14:50 GMT+02:00 Serge E. Hallyn <serge at hallyn.com>:
> Quoting Bálint Réczey (balint at balintreczey.hu):
>> (removing LTS list since it is not LTS related)
>>
>> Hi Serge & Shadow Maintainters,
>>
>> 2016-07-23 22:02 GMT+02:00 Bálint Réczey <balint at balintreczey.hu>:
>> > Hi Serge & All,
>> >
>> > 2016-07-21 16:16 GMT+02:00 Serge E. Hallyn <serge at hallyn.com>:
>> >> Quoting Christian PERRIER (bubulle at debian.org):
>> >>> Quoting Chris Lamb (lamby at debian.org):
>> >>> > Hello dear maintainer(s),
>> >>> >
>> >>> > the Debian LTS team would like to fix the security issues which are
>> >>> > currently open in the Wheezy version of shadow:
>> >>> > https://security-tracker.debian.org/tracker/CVE-2016-6251
>> >>> > https://security-tracker.debian.org/tracker/CVE-2016-6252
>> >>> >
>> >>> > Would you like to take care of this yourself?
>> >>>
>> >>> There is probably zero chances that this happens. I handled over the
>> >>> maintenance of shadow to the "team" but the movement is very slow. So
>> >>> I suspect that nearly nothing will happen.
>> >>>
>> >>> As for Nicolas, he is pretty much inactive for years now, so don't
>> >>> expect more from his side.
>> >>>
>> >>>
>> >>> So, well, even though I'm not happy to send suuch news, this is more
>> >>> or less the reality nowadays.
>> >>
>> >> Dimitri, are you able to help here?
>> >>
>> >> I had a candidate package up on mentors for awhile for a new release
>> >> (https://mentors.debian.net/debian/pool/main/s/shadow/shadow_4.3-1~b1.dsc).
>> >> Would be great if someone would either test that and fix it up / push, or
>> >> start over and ditch my work if they prefer.
>> >
>> > I'll check the package tomorrow, both the new release and an update for Wheezy.
>>
>> It seems Serge that you have taken over shadow maintenance and continued
>> development on GitHub [1], but the homepage on Alioth does
>> not list new releases [2] and also has a lot of outdated information.
>>
>> The package on mentors does point to the packaging repo but the repo
>> does not have the commits.
>> Could you please join the packaging team on alioth and continue
>
> I'll try,

Thanks!

>
>> packagint in the repo there?
>
> You mean http://anonscm.debian.org/cgit/pkg-shadow/shadow.git/ right?

Yes.

>
>> I would happily sponsor your changes then.
>>
>> Regarding the package itself I think you can use the 4.3-1 version
>> number if you join the team and
>> cleaning up the lintian warnings/error would also be nice.
>
> I'll see about addressing some of the lintian warnings.
>
>> You could also add yourself to the Uploaders list.
>
> Ok, will do.

Thanks! I assume Christian is also happy with you joining as a maintainer.

Cheers,
Balint