Re: Update - fou4s 0.11.1

On Tue, 27 Jan 2004, Markus Gaugusch wrote:

> This is just a minor bugfix release.
> * Fix broken importing of fou4s gpg key on fresh installs
> * Fix broken AMD64 detection (typo)

There's another (now fixed) problem with the old version: it has trouble
with some patch description files (=> bogus RPM version number "0.0-0").
The bug resulted in an unability to download affected RPMs - an
annoyance, but not a real problem.

Lars Ellenberg posted a patch a few weeks ago:
. handle empty lines within one description block,
  this happend e.g. with suse-8.1 kernel-source-51177 (2003-11-26)

Howver, after I applied that patch to fou4s-0.10.0 on a SuSE 8.2 box
yesterday (I hadn't noticed the new fou4s version yet :-)), I discovered
another issue:

BEFORE:
======
server:/usr/sbin # ./fou4s-0.10.0 --cleancache
server:/usr/sbin # ./fou4s-0.10.0 -e
Warn: Different version structure: XFree86: 0.0-0 > 4.3.0-111 = false
Using buildtime to check again for safety ...
ftp.gwdg.de: Checking [#################################] 100 %
XFree86           0.0-0         (4.3.0-111    ) [dl] security    10089kb


AFTER:
=====
server:/usr/sbin # ./fou4s --cleancache
server:/usr/sbin # ./fou4s -e
ftp.gwdg.de: Checking [#################################] 100 %
XFree86          4.3.0-115     (4.3.0-111    ) [dl] security    10089kb
kdebase3-SuSE    8.2-112       (8.2-102      ) [dl] security     4889kb

See? Another packet just magically appeared - an "old" update from 11/2003
that was never installed! (In fou4s 0.11.1 the problem seems to be fixed,
too.)

It seems that fou4s-0.10.0 simply ignores the patch description
kdebase3-SuSE-51183 (the 8.2-112 upgrade), but doesn't ignore
kdebase3-SuSE-41597 (the 8.2-102 upgrade)...
(I downgraded to kdebase3-SuSE-8.2-19 to check this out.)

Now, it's *definitely* a security issue if some critical fixes are not
installed because fou4s simply ignores them (no warning, no nothing) - so
I guess *everybody* should upgrade ASAP (or at least install Lars' patch)...

(Time for an announcement in suse-security, perhaps?)

Martin

--