Regression identified in Service Provider library, new version pushed

[Cantor, Scott]

On 11/17/17, 8:45 AM, "users on behalf of Kristof Bajnok" <users-bounces at shibboleth.net on behalf of bajnokk at niif.hu> wrote:

> Sorry for asking for the obvious, but the security fix affected the C++
> SP and OpenSAML, while the bug affected xmltooling, right?

Yes.

> Then how does the upgrade of SP pull in the xmltooling change? (I've just checked that
> the 2.6.1 SP RPM needs xmltooling >=2.6.0, so that should not have
> required xmltooling upgrade.)

It's a bug fix, it's assumed you're just updating any installed packages to the latest version available from the repository you're using.

RPM specfile requirements can be tricky to manage since there's a tension between strict accuracy over what's actually required to build something and using them to force upgrades of other packages on people. I tend to err on the side of the former.

> Does this dance affect people on Debian? It seems that xmltooling is
> still on 2.6.0 even after the upgrade.

I don't package for Debian and I don't understand it's rules, so I don't know what's available where from whom but I don't think it's possible to make 2.6.1 available in the latest. I know that Ferenc has been busy getting the security patches submitted and they are aware of the regression. I don't think any of the new stuff was even really out the door before I got this fixed.

I am fairly sure that I won't ever package for Debian because I don't have the brain power for it, but it's possible we might start subsidizing the people that are doing it to make sure it continues, and that we'll start officially supporting it for members. I've already been asked about that.
 
-- Scott