Re: glibc: why are there no upstream-patches or patch-versions?

This is a multi-part message in MIME format...

------------=_1775147018-5099-20776
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Am 02.04.26 um 01:09 schrieb "Douglas R. Reno"
([email protected] via lfs-support Mailing List):
> On 3/18/26 6:18 AM, Rainer Fiebig ([email protected] via lfs-support
> Mailing List) wrote:
>> I'm wondering why there aren't upstream-patches or patch-versions for
>> glibc - not even for security-issues rated as "high".  Does anybody
>> know?  Thanks.
>>
>> Rainer
>>
>>
>>
> 
> Hi Rainer,
> 
> I'd like to first apologize for the delayed reply here, I've been taking
> some much needed time away after the release of *LFS 13.0.

No need for apologies.  I wasn't expecting an immediate reply (or any
reply at all) to a question asked out of curiosity.  In addition, Bruce
has already given some feedback.

Nevertheless: this is a nice surprise, thanks.  And I hope that you
achieved complete restitution. ;)

> 
> I do agree that point releases would be nice. However, the glibc
> developers to maintain backport patches in release branches! A couple of
> examples:
> 
> (for LFS 13.0's version of glibc):
> https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.43/master
> 
> 
> (for LFS 12.4's version of glibc):
> https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.42/master

This is valuable information.  For update-laggards like me, I'd like to add

https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.41/master

> 
> 
> I have been maintaining a LFS 12.4 system in a VM for testing patches
> against that release to provide some basic security support for SysV
> users for now. I'll continue doing that probably until at least LFS 13.1
> or until we get a stable release of Randy's upcoming SysV branch. If
> things get too complicated though with compatibility I may end up not
> testing a given update, but I'll make sure to explicitly note that in
> the advisory.

I've resorted to self-help already by creating my own patches which is
easier with the links given above.  Once I know the commit-number, I
create the patch like this:

git show dbd8335c8ce8af11226ee1514d7a020b15c63345 >
/usr/src/glibc-2.41_CVE-2026-4437.patch

The CVE-related patches are part of my build-instructions for glibc and
are only actually applied if a test ("--dry-run") succeeds.

Thanks again for the info!

Rainer


------------=_1775147018-5099-20776
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-support
Unsubscribe: See the above information page
------------=_1775147018-5099-20776--