From owner-cvs-ports@FreeBSD.ORG Tue Oct 4 17:45:14 2005 Return-Path: X-Original-To: cvs-ports@FreeBSD.org Delivered-To: cvs-ports@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A969216A41F; Tue, 4 Oct 2005 17:45:14 +0000 (GMT) (envelope-from kris@obsecurity.org) Received: from elvis.mu.org (elvis.mu.org [192.203.228.196]) by mx1.FreeBSD.org (Postfix) with ESMTP id 555DA43D45; Tue, 4 Oct 2005 17:45:14 +0000 (GMT) (envelope-from kris@obsecurity.org) Received: from obsecurity.dyndns.org (CPE0050040655c8-CM00111ae02aac.cpe.net.cable.rogers.com [70.30.70.180]) by elvis.mu.org (Postfix) with ESMTP id 360C51A3C1D; Tue, 4 Oct 2005 10:45:14 -0700 (PDT) Received: by obsecurity.dyndns.org (Postfix, from userid 1000) id 3D2A651259; Tue, 4 Oct 2005 13:45:12 -0400 (EDT) Date: Tue, 4 Oct 2005 13:45:12 -0400 From: Kris Kennaway To: Dirk Meyer Message-ID: <20051004174511.GA22748@xor.obsecurity.org> References: <200510040735.j947Z8rb069549@repoman.freebsd.org> <200510040735.j947Z8rb069549@repoman.freebsd.org> <20051004144319.GA71102@xor.obsecurity.org> <8AYfVTn/WV@dmeyer.dinoex.sub.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="PNTmBPCT7hxwcZjr" Content-Disposition: inline In-Reply-To: <8AYfVTn/WV@dmeyer.dinoex.sub.org> User-Agent: Mutt/1.4.2.1i Cc: cvs-ports@FreeBSD.org, cvs-all@FreeBSD.org, ports-committers@FreeBSD.org Subject: Re: Valid Sender ? - Re: cvs commit: ports/security/openssl Makefile X-BeenThere: cvs-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Oct 2005 17:45:14 -0000 --PNTmBPCT7hxwcZjr Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Oct 04, 2005 at 07:00:53PM +0200, Dirk Meyer wrote: > Kris Kennaway schrieb:, >=20 > > > Log: > > > - bump SHLIB version > > > The API of openssl 0.9.8 ist compatible but not identical. > > > This version bump might break build of all ports that try > > > to include the opessl in base at the same time. > > > That ports should be fixed. > >=20 > > This change should probably have waited until after 6.0. It's going > > to have significant follow-on effects that may prevent me from fixing > > security vulnerabilities in 6.0-RELEASE packages. Do you think this > > will not be the case? >=20 > No ... > As you might see in the cvs Revision 1.100 is tagged with RELEASE_6_0_0 > The update of openssl 0.9.8 was commited after this. And when you commit a fix to some other port and then it has a security vulnerability, I can't slip the tag without worrying whether you've broken the package on 6.0 with the previous version of openssl. Kris --PNTmBPCT7hxwcZjr Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) iD8DBQFDQr+nWry0BWjoQKURAh/pAKD2fg8Kz2N9Iy8tMaJ2j9I94McQWwCgri3R ih65z9oYlXMkCvj7N0rdS9Q= =tCoW -----END PGP SIGNATURE----- --PNTmBPCT7hxwcZjr--