<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE> [Mageia-dev] mysql CVE's in mga1 => have it update to mariadb
</TITLE>
<LINK REL="Index" HREF="index.html" >
<LINK REL="made" HREF="mailto:mageia-dev%40mageia.org?Subject=Re%3A%20%5BMageia-dev%5D%20mysql%20CVE%27s%20in%20mga1%20%3D%3E%20have%20it%20update%20to%20mariadb&In-Reply-To=%3C9b03516f4a3e8f10c70c36622124f321.squirrel%40mail.rmail.be%3E">
<META NAME="robots" CONTENT="index,nofollow">
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<LINK REL="Previous" HREF="014228.html">
<LINK REL="Next" HREF="014233.html">
</HEAD>
<BODY BGCOLOR="#ffffff">
<H1>[Mageia-dev] mysql CVE's in mga1 => have it update to mariadb</H1>
<B>AL13N</B>
<A HREF="mailto:mageia-dev%40mageia.org?Subject=Re%3A%20%5BMageia-dev%5D%20mysql%20CVE%27s%20in%20mga1%20%3D%3E%20have%20it%20update%20to%20mariadb&In-Reply-To=%3C9b03516f4a3e8f10c70c36622124f321.squirrel%40mail.rmail.be%3E"
TITLE="[Mageia-dev] mysql CVE's in mga1 => have it update to mariadb">alien at rmail.be
</A><BR>
<I>Fri Apr 13 13:12:08 CEST 2012</I>
<P><UL>
<LI>Previous message: <A HREF="014228.html">[Mageia-dev] mysql CVE's in mga1 => have it update to mariadb
</A></li>
<LI>Next message: <A HREF="014233.html">[Mageia-dev] mysql CVE's in mga1 => have it update to mariadb
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#14231">[ date ]</a>
<a href="thread.html#14231">[ thread ]</a>
<a href="subject.html#14231">[ subject ]</a>
<a href="author.html#14231">[ author ]</a>
</LI>
</UL>
<HR>
<!--beginarticle-->
<PRE>><i> Le 13/04/2012 12:45, Colin Guthrie a écrit :
</I>>><i> 'Twas brillig, and Maarten Vanraes at 13/04/12 07:28 did gyre and
</I>>><i> gimble:
</I>>>><i> after talking with mariadb people and some others, i'm proposing to
</I>>>><i> update
</I>>>><i> mysql 5.5.10 to mariadb-5.5.23 in mga1.
</I>>><i>
</I>>><i> I would be pretty strongly against this.
</I>>><i>
</I>>><i> I think it's fine we're using mariadb in mga2, but I really don't fancy
</I>>><i> making this switch on a stable distro.
</I>>><i>
</I>>><i> It just seems like a really, really bad idea. Not necessarily
</I>>><i> technically, but in pretty much all other aspects - you have to consider
</I>>><i> how this would be viewed as well - changing something like this for a
</I>>><i> stable distro puts a big question mark over future stability and updates
</I>>><i> etc. too.
</I>><i> Same for me.
</I>><i>
</I>><i> Basically, you're proposing to break the assumption than current policy
</I>><i> ensures end user than a package update from 'updates' repository for
</I>><i> package 'foo' is just a bugfix for 'foo' package. You may have perfectly
</I>><i> valid technical reasons, but you're *silently* changing the rule upon
</I>><i> which people may have established their own policies, which is a very,
</I>><i> very bad idea.
</I>
tbh, iinm the rule is that we like to provide only bugfix/security fix
patches, but there are exceptions when that isn't possible to update to
the full versions fixing this issue.
Well, initially i was against this, but the options to actually fix this
security bug are quite limited:
1. find all the responsible patches and add them manually
==> this is my preferred option, but seems not doable, and apparently
no-one steps in and mysql isn't maintained (officially)
2. do like other distros and fix to higher mysql 5.5.22 which fixes this
issue
==> this is totally not preferred for me;
A) a big change between mysql 5.5.10 and mysql 5.5.22, which means huge
QA load
B) this also means that the mga1 -> mga2 upgrade will have to be
extensively retested
3. go to the cauldron version that fixes these issues which is mariadb-5.5.23
==> this is less preferred for me:
A) a big change between mysql 5.5.10 and mysql 5.5.22, which means huge
QA load
B) however the mga1 -> mga2 upgrade has been tested already, so the
chance of serious issues arising for this is alot less than normallY.
C) since mariadb-5.5.23 is based on mysql-5.5.23, the changes are quite
less than would normally be.
4. don't fix this security issue
==> this is also less preferred for me, for obvious reasons.
5. someone has a better idea?
considering the response i got, now i'll default to letting someone else
handle it, which might mean it never gets fixed. that would also mean for
me that mageia1 would be a bad version to get LTS on.
I'm open to suggestions...
PS: as some people might think it's just a stupid political reason, but
it's not. my reasons are detailed above.
</PRE>
<!--endarticle-->
<HR>
<P><UL>
<!--threads-->
<LI>Previous message: <A HREF="014228.html">[Mageia-dev] mysql CVE's in mga1 => have it update to mariadb
</A></li>
<LI>Next message: <A HREF="014233.html">[Mageia-dev] mysql CVE's in mga1 => have it update to mariadb
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#14231">[ date ]</a>
<a href="thread.html#14231">[ thread ]</a>
<a href="subject.html#14231">[ subject ]</a>
<a href="author.html#14231">[ author ]</a>
</LI>
</UL>
<hr>
<a href="https://www.mageia.org/mailman/listinfo/mageia-dev">More information about the Mageia-dev
mailing list</a><br>
</body></html>