Valid Sender ? - Re: cvs commit: ports/security/openssl Makefile

[Kris Kennaway]

On Tue, Oct 04, 2005 at 07:00:53PM +0200, Dirk Meyer wrote:
> Kris Kennaway schrieb:,
> 
> > >   Log:
> > >   - bump SHLIB version
> > >   The API of openssl 0.9.8 ist compatible but not identical.
> > >   This version bump might break build of all ports that try
> > >   to include the opessl in base at the same time.
> > >   That ports should be fixed.
> > 
> > This change should probably have waited until after 6.0.  It's going
> > to have significant follow-on effects that may prevent me from fixing
> > security vulnerabilities in 6.0-RELEASE packages.  Do you think this
> > will not be the case?
> 
> No ...
> As you might see in the cvs Revision 1.100 is tagged with RELEASE_6_0_0
> The update of openssl 0.9.8 was commited after this.

And when you commit a fix to some other port and then it has a
security vulnerability, I can't slip the tag without worrying whether
you've broken the package on 6.0 with the previous version of openssl.

Kris
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/cvs-all/attachments/20051004/f1812fb2/attachment.bin