Bug 200908 - security/openssl 2015Q2 branch still unpatched
Summary: security/openssl 2015Q2 branch still unpatched
Status: Closed Overcome By Events
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Ports Security Team
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-16 14:55 UTC by Fabiano Sidler
Modified: 2015-07-06 17:36 UTC (History)
2 users (show)

See Also:
dinoex: maintainer-feedback-
dinoex: merge-quarterly+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Fabiano Sidler 2015-06-16 14:55:55 UTC 
Can someone patch the 2015Q2 branch to a version not vulnerable according to VulnXML file?
Comment 1 Dirk Meyer freebsd_committer freebsd_triage 2015-06-17 05:51:39 UTC 
The update to 1.0.2c is not ABI compatible
Comment 2 Fabiano Sidler 2015-06-18 12:23:36 UTC 
What do you mean? I'm talking about the port, not binary packages...
Comment 3 florian.heigl 2015-06-28 21:33:00 UTC 
Problem still stands.
This current status is rendering the whole branch pretty questionable.

Regarding ABI compatibility: The same (issues) occured when the OpenSSL in base got updated due to Heartbleed. Some applications like proftpd were affected.
This didn't stop anyone.

Also... It's not going the right way:
It's a branch for providing stable packages with security fixes only.
If some fixes are left out intentionally due to compat issues, this should be announced and not handled like this.

If there's a delay because the patch is more tricky / noone knows how to do it (and i doubt that), or because it needs upgrading / rebuilding a lot of packages, then is there any idea of a "when"?
Comment 4 Dirk Meyer freebsd_committer freebsd_triage 2015-06-29 19:46:50 UTC 
The Security updates had been done without informing the maintainer.


Please decide which patches should be merged to quaterly or not

I do not merge patches not validated by me.
Comment 5 Antoine Brodin freebsd_committer freebsd_triage 2015-06-29 20:28:08 UTC 
Over to maintainer
Comment 6 Jason Unovitch freebsd_committer freebsd_triage 2015-07-05 16:15:30 UTC 
"Overcome by events" for this PR? Referring to bug 201192 comment 8, the 2015Q2 branch is no longer supported now that 2015Q3 is out.
Comment 7 florian.heigl 2015-07-05 16:40:00 UTC 
If noone thinks that it's something to step back and think about that this patch didn't make it any it wasn't considered important to get it in Q2 before cutting the Q3, and that now everyone can switch to Q3 without any prior testing just to get the single fix...
And that the port maintainer wasn't pinged
And that Q3 was delayed yet it was no reason to fix it in the Q2 first.

Then yeah, let's just close it.

I'll take myself off the CC list so I don't have to think about this any longer.
Comment 8 Xin LI freebsd_committer freebsd_triage 2015-07-06 17:36:11 UTC 
Mark this one as closed as the 2015Q2 branch is not supported anymore and 2015Q3 already have latest OpenSSL (1.0.2c).