Re: [Kolab-devel] Erlang security update breaks guam on Debian 10

--===============2161992133664332858==
Content-Type: multipart/signed; boundary="nextPart3637280.72vocr9iq0";
 micalg="pgp-sha256"; protocol="application/pgp-signature"

--nextPart3637280.72vocr9iq0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"; protected-headers="v1"
From: Christoph Erhardt <[email protected]>
Date: Mon, 17 Jul 2023 23:13:50 +0200
Message-ID: <5910020.8F6SAcFxjW@delle>
In-Reply-To: <dcb4e805d2374e3a9d0da796b020a2e3@kube>
MIME-Version: 1.0

Hi Christian,

unfortunately I'm not familiar with the admin side of OBS. The most plausible 
thing I have found would be this settings page:

  https://obs.kolabsys.com/repositories/Debian:10.0

The mirror URLs configured there lead to a 404, though. It seems there's a 
path component (`/dists/`) missing in the middle.

  Broken: https://mirror.switch.ch/ftp/mirror/debian/buster
 Working: https://mirror.switch.ch/ftp/mirror/debian/dists/buster

Maybe this will suffice to trigger a download-on-demand [1] on the next 
package build.

Best,
Christoph

[1] https://openbuildservice.org/help/manuals/obs-user-guide/
cha.obs.concepts.html#concept_dod

On Monday, 17 July 2023 07:12:51 CEST Christian Mollekopf wrote:
> On Saturday, 15 July 2023 00:04:21 CEST you wrote:
> > Hi all,
> > 
> > if my understanding is correct, CVE-2022-37026 allows an authentication
> > bypass by clients when using certificate-based authentication, while
> > 'normal' user/ password-based authentication is not affected.
> > 
> > If that is indeed the case, then I believe our quick fix doesn't entail an
> > immediate risk to Guam users.
> > 
> > Nevertheless, I do feel somewhat strongly about doing things the right
> > way. In our case this would mean:
> > 1. Make OBS pull the latest Debian 10 packages, including erlang-base.
> > 2. Revert the patch that enables ERTS bundling for Guam.
> > 3. Rebuild Guam.
> 
> I'd rather have it bundled than wake up to our packages no longer starting
> because the upstream erts package changed, so for unbundling we need to
> figure which erts version to pin first IMO.
> > I'm happy to take care of steps 2 and 3, but step 1 needs to be done by an
> > OBS admin. Christian? Jeroen?
> 
> Do you happen to know how to trigger such an update?
> I have access, but to me it seems the OBS mostly expects to build agains a
> static repository.
> 
> Cheers,
> Christian
> 
> > Best,
> > Christoph
> > 
> > _______________________________________________
> > users mailing list
> > [email protected]
> > https://lists.kolab.org/mailman/listinfo/users
> 
> _______________________________________________
> devel mailing list
> [email protected]
> https://lists.kolab.org/mailman/listinfo/devel


--nextPart3637280.72vocr9iq0
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEwp5/nkNlccrQ2UKH4yzDBS9Gs8IFAmS1rw4ACgkQ4yzDBS9G
s8JHuQ//XykCZcJGB1TJnfC7rK0vDuoEOXr0aQSI2o7uTLNXFo7WDdV4IPKX/aC0
ZvTFhvwUBsjo4kf9H9iDlbLmZ7AOvkZ+h5BUBm0vra86vDU+xV4TZLXe3LkC0+qu
R8bob44aSdBMqPwXq/poJJ4vWcE5k2AKRcV5/FMoDJfE2/rEnIao+XRdezNK1NrG
uCUotwNIizaU2pXiPLAIgIV+MOWWgAW9AfO4oW4UQ9RVq5BTtB/YE9duyOhSRBEj
znDTbOH3Zc8pE7iR+888xOE+kCOmP0GbOdC+uH4AUef8bm2TVt/i38JyAhXzhR+v
YN6gCtSBpIv35bcl6hQe5iEue2eLHTht5/CRckBcv+A5g4ZFNbNbC7shV+bOjMiY
XAiRQNLD2QN5Nh/hrefVMK1fGZP41chPOzYkBaLsdoZpChEmU7a74LOswWvUlGS+
VtAz6dQYmSJ5QITN1NhKpp1pfrTfZMei6+FTmOYjHRqKLengX20zBzTV5R8Mk44L
oFMSoxXBGsTkztwLq9GOlpYsGAmOj3FHQzeMho1+/ccmzBBWvWrVTxPOIBOoN6aQ
mdwig5Spho/NyH8avy+5Fvc15id4BJOiZ0NNrLmucY+DB7S9qAi9m9eMCn61gnWN
aAaZGEZcBKQVy9rbzKiJsSXaLZulOXfxVvs/b4MGV+UWslW1lsA=
=1HKb
-----END PGP SIGNATURE-----

--nextPart3637280.72vocr9iq0--


--===============2161992133664332858==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
devel mailing list
[email protected]
https://lists.kolab.org/mailman/listinfo/devel
--===============2161992133664332858==--