On Fri, Apr 25, 2025 at 03:44:15PM +0200, Vincent Bernat wrote:

On 2025-04-24 09:58, Vincent Bernat wrote:
...

Hello,

I plan to upload 3.0.11 instead.

Sorry, I meant 3.0.10, like you did. Uploading it shortly.

Thanks, I've cancelled my NMU.

cu
Adrian

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi Vincent,

On Fri, Apr 25, 2025 at 03:44:15PM +0200, Vincent Bernat wrote:

On 2025-04-24 09:58, Vincent Bernat wrote:

On 2025-04-23 20:57, Adrian Bunk wrote:

Control: tags 1102673 + patch
Control: tags 1102673 + pending

Dear maintainer,

I've prepared an NMU for haproxy (versioned as 3.0.10-0.1) and uploaded it to DELAYED/7. Please feel free to tell me if I should cancel it.

Upgrading to 3.0.10 looked more reasonable to me than backporting just the (one-line) CVE fix, but either is fine for me.

A maintainer upload of either would be my preferred option.

Hello,

I plan to upload 3.0.11 instead.

Sorry, I meant 3.0.10, like you did. Uploading it shortly.

As I do not see it unstable, are you still planning to upload 3.0.10
to make it for trixie?

Regards,
Salvatore

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Control: fixed -1 3.0.10-1

On Thu, May 01, 2025 at 07:50:26AM +0200, Vincent Bernat wrote:

On 2025-04-30 22:59, Salvatore Bonaccorso wrote:

Sorry, I meant 3.0.10, like you did. Uploading it shortly.

As I do not see it unstable, are you still planning to upload 3.0.10
to make it for trixie?

I have uploaded it but I didn't get any email back:

2025-04-25 15:44:32,738 - dput[327712]: uploader.invoke_dput - Uploading haproxy using ftp to ftp-master (host: ftp.upload.debian.org; directory: /pub/UploadQueue/)
2025-04-25 15:44:32,739 - dput[327712]: hook.run_hook - running allowed-distribution: check whether a local profile permits uploads to the target distribution
2025-04-25 15:44:32,743 - dput[327712]: hook.run_hook - running protected-distribution: warn before uploading to distributions where a special policy applies
2025-04-25 15:44:32,746 - dput[327712]: hook.run_hook - running checksum: verify checksums before uploading
2025-04-25 15:44:32,752 - dput[327712]: hook.run_hook - running suite-mismatch: check the target distribution for common errors
2025-04-25 15:44:32,755 - dput[327712]: hook.run_hook - running gpg: check GnuPG signatures before the upload
2025-04-25 15:44:33,545 - dput[327712]: uploader.invoke_dput - Uploading haproxy_3.0.10-1.dsc
2025-04-25 15:44:34,087 - dput[327712]: uploader.invoke_dput - Uploading haproxy_3.0.10.orig.tar.gz
2025-04-25 15:44:35,548 - dput[327712]: uploader.invoke_dput - Uploading haproxy_3.0.10-1.debian.tar.xz
2025-04-25 15:44:36,279 - dput[327712]: uploader.invoke_dput - Uploading haproxy_3.0.10-1_amd64.buildinfo
2025-04-25 15:44:36,822 - dput[327712]: uploader.invoke_dput - Uploading haproxy_3.0.10-1_source.changes

I'll try again.

This time it worked, than you. Not sure we might ask ftp-master to see
what went wrong.

On the specific issue, my gut feeling is that this is quite under
uncommon cicurmstances and a point release update would be enough? But
what is your view on it with your maintainers hat on?

Adrian already proposed the debdiff for bookworm as well, but might it
be sensible to include the other two fixes as well for the open CVEs?

Let me please know your maintainers view on this specfic issue so we
can decide if a DSA or the next point release is enough.

Regards,
Salvatore

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi Vincent, hi Adrian,

On Fri, May 02, 2025 at 07:02:27AM +0200, Vincent Bernat wrote:

On 2025-05-01 09:55, Salvatore Bonaccorso wrote:

This time it worked, than you. Not sure we might ask ftp-master to see
what went wrong.

It is a one time thing, I don't think it is worth their time.

Ok.

On the specific issue, my gut feeling is that this is quite under
uncommon cicurmstances and a point release update would be enough? But
what is your view on it with your maintainers hat on?

Yes, I also think it would be enough. I can prepare it if you want.

Adrian has already prepared in #1104402, so if you are okay with his
variant he just can go ahead with the bookworm-pu.

Adrian already proposed the debdiff for bookworm as well, but might it
be sensible to include the other two fixes as well for the open CVEs?

Both of them are about QUIC/HTTP3, which is not enabled in Bookworm.

Yes right, we have them already marked as ignored in the tracker.

Regards,
Salvatore

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)