News for hackers. Stuff that matters.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by blcknight on Friday March 29, 2024 @02:01PM (#39867098)
> Debian testing already has a version called '5.6.1+really5.4.5-1' that is really an older version 5.4, repackaged with a newer version to convince apt that it is in fact an upgrade.

I'm surprised .deb doesn't have a better approach. RPM has epoch for this purpose http://novosial.org/rpm/epoch/index.html

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by stefanor on Friday March 29, 2024 @02:15PM (#39867242)
Debian has epochs, but it's a bad idea to use them for this purpose.

Two reasons:

1. Once you bump the epoch, you have to use it forever. 2. The deb filename often doesn't contain the epoch (we use a colon which isn't valid on many filesystems), so an epoch-revert will give the same file name as pre-epoch, which breaks your repository.

So, the current best practice is the +really+ thing.

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by kzrdude on Friday March 29, 2024 @04:04PM (#39868415)
Thanks for the info, the filename thing sounds like a problem, one aspect of the epoch system doesn't work for the purpose then.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by o11c on Friday March 29, 2024 @03:01PM (#39867723)
Honestly, the Gentoo-style global blacklist (package.mask) to force a downgrade is probably a better approach for cases like this. Epochs only make sense if your upstream is insane and does not follow a consistent numbering system.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Wednesday April 03, 2024 @09:10AM (#39917003)
Gentoo also considers the repository (+overlays) to be the entire set of possible versions so simply removing the bad version will cause a downgrade, unlike debian and RPM systems where installing packages outside a repository is supported.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by intel_brain on Friday March 29, 2024 @02:31PM (#39867424)
Got this on OpenSUSE: `5.6.1.revertto5.4-3.2`
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by debianisajoke32 on Friday April 05, 2024 @12:50AM (#39938770)
Stop the cap your honor. There is not a single filesystem that prevents you from using colons in filenames except exfat, I went ahead and checked and ext4, xfs, btrfs, zfs, and even reiserfs let you use any characters you want except \0 and /.

And I fail to see why bumping the epoch would ever be a problem. Using the epoch not a reason why its bad.

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by nicolas_17 on Friday March 29, 2024 @02:14PM (#39867234)
.deb has epochs too, but I think Debian developers avoid it where possible because 1:5.4.5 is interpreted as newer than anything without a colon, so it would break eg. packages that depend on liblzma >= 5.0, < 6. There may be more common cases that aren't coming to mind now.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Wednesday April 03, 2024 @09:09AM (#39916978)
Seems like debian is mixing too many things into the package version - version used for deciding on upgrades and abi version for dependencies should be decoupled like it is in modern RPM distros.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by nicolas_17 on Wednesday April 03, 2024 @12:00PM (#39919147)
If a binary library ABI is backwards-incompatible, they change the package name. I was just guessing at the reason epoch is avoided and that <6 is probably an awful example.

So now I actually bothered to look it up, and it turns out the actual reason is that the epoch changes what version is considered "greater", but it's not part of the .deb filename, so you still can't reuse version numbers used in the past. If you release 5.0, then 5.1, then you want to rollback and release 1:5.0, it's going to break things in the Debian archives. https://www.debian.org/doc/debian-policy/ch-binary.html#uniq...

Additionally, once you add an epoch you're stuck with it forever, while if you use 5.1+really5.0, you can get rid of the kludge when 5.2 is out. https://www.debian.org/doc/debian-policy/ch-controlfields.ht...

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by pja on Friday March 29, 2024 @02:06PM (#39867143)
Debian packages can have epochs too. I’m not sure why the maintainers haven’t just bumped the epoch here.

Maybe they’re expecting a 5.6.x release shortly that fixes all these issues & don’t want to add an epoch for a very short term packaging issue?

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by 5p4n911 on Friday March 29, 2024 @05:06PM (#39869021)
I really like the XBPS way of the reverts keyword in the package template that forces a downgrade from said software version. It's simple but works without any of the troubles RPM epochs have with resolving dependencies as it's just literally a way to tell xbps-install that "yeah, this is a lower version number in the repository but you should update anyway".