Bug 460098 – net-misc/openconnect-4.08 looks newer than 4.99

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Pacho Ramos 2013-03-03 11:13:47 UTC]

This will be problematic as 4.99 has already gone to stable in some arches, but:
http://www.infradead.org/openconnect/changelog.html -> if you see dates, you will see 4.08 is newer than 4.99
http://git.infradead.org/users/dwmw2/openconnect.git/shortlog -> looks to confirm it

Reproducible: Always

[Comment 1 Matthew Schultz 2013-03-04 02:35:55 UTC]

Not sure how to deal with this other than bring 4.08 into the tree, then when it is stabilized, remove 4.99 from the tree.

[Comment 2 Matthew Schultz 2013-03-04 02:44:50 UTC]

I just confirmed, that you can simply do this: cp openconnect-4.99.ebuild openconnect-4.08.ebuild.  Also setting a minimum MTU will likely fix the problem with bug 446142.

[Comment 3 Markos Chandras (RETIRED) 2013-03-04 09:14:08 UTC]

I am very confused. Which one contains the security fix for the bugs that block this one?

[Comment 4 Matthew Schultz 2013-03-04 13:37:36 UTC]

(In reply to comment #3)
> I am very confused. Which one contains the security fix for the bugs that
> block this one?

4.08 fixes CVE-2012-6128.

[Comment 5 Markos Chandras (RETIRED) 2013-03-04 13:50:45 UTC]

(In reply to comment #4)
> (In reply to comment #3)
> > I am very confused. Which one contains the security fix for the bugs that
> > block this one?
> 
> 4.08 fixes CVE-2012-6128.

Ok thanks

Is there a chance to ask upstream to learn how to tag versions properly and that 4.99 > 4.08 in the modern world?

[Comment 6 Matthew Schultz 2013-03-04 17:14:49 UTC]

(In reply to comment #5)
> (In reply to comment #4)
> > (In reply to comment #3)
> > > I am very confused. Which one contains the security fix for the bugs that
> > > block this one?
> > 
> > 4.08 fixes CVE-2012-6128.
> 
> Ok thanks
> 
> Is there a chance to ask upstream to learn how to tag versions properly and
> that 4.99 > 4.08 in the modern world?

After communicating with upstream, 4.99 does in fact contain the CVE-2012-6128 fix.  Apparently 4.08 contains some things backported from 4.99 since they consider 4.99 to be a beta.  Don't ask me why they do not say it's a beta in the changelog.  I could not confirm if any of the other fixes in 4.08 are also in 4.99 but based on the backport statement, I would assume they are.  So I think this bug might be able to be closed since it's a non-issue.

[Comment 7 Markos Chandras (RETIRED) 2013-03-04 17:52:50 UTC]

(In reply to comment #6)
> (In reply to comment #5)
> > (In reply to comment #4)
> > > (In reply to comment #3)
> > > > I am very confused. Which one contains the security fix for the bugs that
> > > > block this one?
> > > 
> > > 4.08 fixes CVE-2012-6128.
> > 
> > Ok thanks
> > 
> > Is there a chance to ask upstream to learn how to tag versions properly and
> > that 4.99 > 4.08 in the modern world?
> 
> After communicating with upstream, 4.99 does in fact contain the
> CVE-2012-6128 fix.  Apparently 4.08 contains some things backported from
> 4.99 since they consider 4.99 to be a beta.  Don't ask me why they do not
> say it's a beta in the changelog.  I could not confirm if any of the other
> fixes in 4.08 are also in 4.99 but based on the backport statement, I would
> assume they are.  So I think this bug might be able to be closed since it's
> a non-issue.

so let me get this straight. 4.99 is a newer version (5.0_beta or whatever) and 4.08 is some older version + patches from 4.99. Ugh...

[Comment 8 Matthew Schultz 2013-03-04 19:06:29 UTC]

(In reply to comment #7)
> (In reply to comment #6)
> > (In reply to comment #5)
> > > (In reply to comment #4)
> > > > (In reply to comment #3)
> > > > > I am very confused. Which one contains the security fix for the bugs that
> > > > > block this one?
> > > > 
> > > > 4.08 fixes CVE-2012-6128.
> > > 
> > > Ok thanks
> > > 
> > > Is there a chance to ask upstream to learn how to tag versions properly and
> > > that 4.99 > 4.08 in the modern world?
> > 
> > After communicating with upstream, 4.99 does in fact contain the
> > CVE-2012-6128 fix.  Apparently 4.08 contains some things backported from
> > 4.99 since they consider 4.99 to be a beta.  Don't ask me why they do not
> > say it's a beta in the changelog.  I could not confirm if any of the other
> > fixes in 4.08 are also in 4.99 but based on the backport statement, I would
> > assume they are.  So I think this bug might be able to be closed since it's
> > a non-issue.
> 
> so let me get this straight. 4.99 is a newer version (5.0_beta or whatever)
> and 4.08 is some older version + patches from 4.99. Ugh...

Yeah, pretty much.  So I don't know if we should bother bringing in 4.08 to the tree since 4.99 is already stable.

[Comment 9 Pacho Ramos 2013-03-04 19:08:56 UTC]

Per:
http://git.infradead.org/users/dwmw2/openconnect.git/shortlog

looks like 4.08 is newer than 4.99, it also looks to be a "stable" release (over 4.99) and also solves bug 460096. I would then "bump" it to the tree, stable it due security reasons and hard-mask 4.99

[Comment 10 Markos Chandras (RETIRED) 2013-03-04 19:26:00 UTC]

We never ha+*openconnect-4.08 (04 Mar 2013)
+
+  04 Mar 2013; Markos Chandras <[e-mail]> +openconnect-4.08.ebuild:
+  Upstream lacks math skills and for them 4.08 is greater than 4.99. Fixes bug
+  #460098. Mask 4.99 until all the mess is sorted
+