bugmonotone - Bugs: bug #17197, included 3rd party libs creates...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #17197: included 3rd party libs creates mess for security handling in distributions

Submitted by:  Daniel Black <danielblack>
Submitted on:  Tue 25 Jul 2006 04:09:32 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: code cleanupStatus: Later
Privacy: PublicAssigned to: None
Open/Closed: Closed
mtn version --full: 

monotone-0.28

Tue 25 Jul 2006 09:19:32 AM UTC, comment #4:

No problem -- next time this comes up, I'll have a bug report to point people at :-). And we definitely appreciate your diligence in taking care of our joint users!

On the concurrent installation thing, nothing will break horribly; monotone is very self-contained and doesn't much care how you install it. I'm not sure whether I'd bother in particular, but then, our general attitude is to abandon old versions as quickly as possible, as another way of making efficient use of resources; the considerations for a distribution are different than for a development team, though.

If it helps, the larger projects I know of that use monotone have finished migrating off of 0.25 by this point, and now that the new code has been out for 4+ months, it's clear that it's stable and the migration is pretty smooth.

As for some kind of monotone-server package, I'd suggest looking into runit. It's quite excellent, and takes care of the daemonification, logging, and service restarting that monotone proper doesn't do right now. (Partly because runit is so good, we haven't felt a lot of need to build a less-good replacement into monotone itself.)

Nathaniel Smith <njs>
Project Member
Tue 25 Jul 2006 07:43:57 AM UTC, comment #3:

opps missed AUTHORS. This explains licensing well.

Thanks for understanding concerns. I'm sorry for making you reitterate previous emails. I appreciate your assertion that this is a temporary state and you will release security updates of bundled packages if required.

I doubt I have the required manpower to fully support a use of external libraries either. If this changes I'll let you know with approprate patches and make the /usr/bin/mtn --full-version indicate the non-supported configuration.

Thanks for your explaination. It does help and is very reassuring.

monotone-0.28 should be added soon to Gentoo. I'm looking at making the installation of 0.28 and <=monotone-0.25 versions be able to be installed concurrently as suggested here https://bugs.gentoo.org/show_bug.cgi?id=131044#c9. Please tell me if this is a bad idea. I need to resolve info page conflicts and add an initscript todo yet.

Current state in Gentoo monotone is here:
http://packages.gentoo.org/packages/?category=dev-util;name=monotone

Daniel Black <danielblack>
Tue 25 Jul 2006 05:36:08 AM UTC, comment #2:

We do ship lua.

See AUTHORS for an exhaustive discussion of the licensing. All the libraries we ship are placed by their authors under licenses that makes it entirely legitimate for us to not only package them with GPLed code, but ship them under the GPL itself... if that matters.

The splitting out discussion has been done to death, e.g., on the mailing list. We're definitely aware of and understand your concerns, however, we're not really able to split them out right now. We don't have the manpower to support version skew bugs (a ridiculous proportion of e.g. svn bugs are due to library version skew), and every library that we ship is one that we have at some point (perhaps several points) had local changes in (i.e., it was necessary to use our local version, perhaps for subtle reasons).

If it's any consolation, we would certainly make a security release if it turned out there was a security bug in monotone due to problems with our dependencies (for people who don't use packages, we are their "distro", after all...). In somewhat over 3 years, that hasn't happened. We do track upstream pretty closely on all packages, except for netxx and popt which are abandoned (and we maintain locally when necessary), and the botan author tracks monotone development.

You are, of course, welcome to ship a monotone that does not use the bundled libraries. However, if you do so, then I don't see how we can support the result, and it is very likely to break if/when we make local changes again. We hope that this is a temporary state, and that as monotone development settles we'll be able to spend more time worrying about such things, but that's where we are for now.

Hope that helps.

Nathaniel Smith <njs>
Project Member
Tue 25 Jul 2006 04:27:53 AM UTC, comment #1:

additionaly this may causes license problems as monotone is advertised as a GPL program. Netxx, botan is under a BSD license, libidn is under a LGPL license and this isn't very clear in the source code.

Opps - was wrong about the inclusion of boost.

Daniel Black <danielblack>
Tue 25 Jul 2006 04:09:32 AM UTC, original submission:

The included parts of popt, libidn, boost, botan, lua(?), netxx, sqlite in monotone will create security problems for distributions if they have found to have security vulnerabilities.

It would be easier from a distribution point of view to have the option of linking to these other packages included in the distribution. Currently if a security vulnerability is found it is unlikely that the security managers would search every other package to see what bundles the vulnerable version in it. What makes this harder is the lack of versioning information as to what version of the include code is used.

I don't know whether the monotone developers would release a separate version if an included third party code had a vulnerabilty. This would be appreciated if this occurs before a transition to external code occurs.

I appreciate by the comments about popt in configure.ac that this is not always possible/easy.

From a distribution point of view I really appreciate the extensive self-tests included in the distribution.

Appreciate your consideration in addressing this matter.

Daniel
Gentoo Maintainer for monotone.

Daniel Black <danielblack>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue 25 Jul 2006 05:36:08 AM UTCnjsStatusNone=>Later
  Open/ClosedOpen=>Closed

Back to the top


Powered by Savane 3.1-cleanup1