megabyte405: can someone look at the abiword package?
[18:41] megabyte405: I've really worked to address all the concerns mentioned, and I believe it's ready to go
[18:41] TeTeT abandonó el canal de chat. ("Ex-Chat")
[18:41] pitti: megabyte405: we are in ultra deep-freeze mode now, that makes it extra hard to do such intrusive changes (just as a warning)
[18:42] slangasek: soren: ...oh
[18:42] megabyte405: pitti: I am aware of that. However, it's just changing one package (nothing depends on Abi), and this has been in progress for some time, and it's been approved. Someone just needs to see that the package is in good shape - that's already been done, and I've addressed all concerns that they brought up
[18:43] persia: megabyte405: Do you have a bug number for the discussion?
[18:43] pitti: megabyte405: right, and up to a week ago this wouldn't have been a problem; but the closer we get to the release, the harder it gets to update it, and since yesterday we only take mission-critical bug fixes
[18:43] pitti: megabyte405: too bad that the timing sucks so much now
[18:43] pitti: megabyte405: we shuold try hard to provide it as an update to hardy, though
[18:43] megabyte405: bug 202174
[18:44] ubotu: Launchpad bug 202174 in abiword "Please update to version 2.6" [Medium,Confirmed] https://launchpad.net/bugs/202174
[18:44] slangasek: megabyte405: the trouble is that now, any packages that we accept, we have to wait for them to get built and then rebuild any CD images that the package is on
[18:44] megabyte405: I don't think we're on any cd images
[18:44] megabyte405: perhaps just Xubuntu, actually
[18:44] pitti: megabyte405: they are on the DVDs
[18:44] seb128: xubuntu is using abiword no?
[18:44] pitti: xubuntu too, right
[18:45] pitti: megabyte405: in three months we'll have a point release (8.04.1); releasing it there would still provide most of the benefits, without breaking the 8.04 release now; WDYT?
[18:45] etretyak entró en el canal de chat.
[18:45] megabyte405: I can do the final changelog merging right now if someone takes a peek at that debdiff and sees that I didn't break anything since the last review, of which I am confident
[18:45] megabyte405: I'm really, really concerned with having 2.4.6 in hardy
[18:46] saivann abandonó el canal de chat. ("Ex-Chat")
[18:46] megabyte405: There was a lot (and I mean a lot - 2.5 years of branch) of cleanup, some of which might have resolved unseen security bits. I know we did make some changes to use standard structures instead of homebuilt stuff (STL vector instead of our own vector class, etc)
[18:47] pedro_ abandonó el canal de chat. ("restart")
[18:47] njpatel abandonó el canal de chat. ("Ex-Chat")
[18:48] pitti: megabyte405: but even the current testing showed some problems and regressions (scrolling AFAIK?), so we'd have another two months to sort them out for 8.04.1
[18:48] james_w abandonó el canal de chat. (Read error: 110 (Connection timed out))
[18:49] megabyte405: there is that scrolling thing, but as I mention in the bug, as that appears on no other platform, I think that's not an abi bug, and in any case, a low level bug like that (workaround: spin your scroll wheel slower) doesn't seem to be a logical blocker for two and a half years of progress
[18:49] megabyte405: 2.4 hasn't been touched in a year and a half
[18:50] tedg abandonó el canal de chat. (Read error: 110 (Connection timed out))
[18:50] megabyte405: and the scrolling bit is the only regression.
[18:51] afflux abandonó el canal de chat. ("Verlassend")
[18:51] hunger abandonó el canal de chat. (Read error: 113 (No route to host))
[18:51] seb128 abandonó el canal de chat. ("Ex-Chat")
[18:51] pitti: (that we heard about so far)
[18:52] megabyte405: I have used it, and it works well
[18:52] megabyte405: to be honest, I've been using the 2.6 branch for about a year and a half
[18:52] megabyte405: on both linux and windows
[18:53] dpm entró en el canal de chat.
[18:53] uwog entró en el canal de chat.
[18:53] mthaddon_ abandonó el canal de chat. ("Off climbing (I hope)")
[18:55] pedro_ entró en el canal de chat.
[18:55] uwog: i just heard that abi 2.6 may not make it into hardy; now that's a fine choise, but keep in mind that 2.4.6 is unmaintained and *does* contain various security issues that were found and fixed in 2.6 (sadly, we don't have a lot, except for 1 recent one)
[18:56] uwog: so if you stick with 4.6 for 5 years, then you have to maintain it yourself
[18:56] uwog: s/4.6/2.4.6
[18:56] pitti: uwog: the proposal was to put it into the hardy point release instead of hardy
[18:57] pitti: uwog: thus we'd be 'stuck' with it for a mere three months
[18:57] uwog: pitti: i'm not too familiar with ubuntu's releases, but if the hardy point release gets to all users, then sure
[18:57] uwog: because especially the security issues scare me
[18:58] pitti: uwog: such a big update is still a biiig exception, and I can't promise that it'll make it, but at this point it's much better than getting it uploaded/fixed/onto CDs/DVDs now and delay the Hardy release for that
[18:58] slangasek: packages included in point releases show up as regular updates to the stable release, just one step removed from security updates
[18:58] kees: uwog: I am unaware of any outstanding security issues in abiword. Do you have a list?
[18:58] pitti: uwog: (security issues: we have to fix them in dapper, etc. as well)
[18:58] uwog: pitti: delaying ubuntu for abi doesn't seem like a good choice
[18:59] slangasek: as for "security issues", yes, we have /other/ supported releases of Ubuntu that include abiword 2.4.6, it would be nice to have some communication about the substance of those security issues instead of using that as a scare tactic only
[18:59] uwog: kees: the issues i'm currently aware of is a recent fix to the applix filter, and maybe one to the ODT importer (we couldn't exploit a buffer overflow, but surely someone else can)
[19:00] uwog: slangasek: i'm very much aware
[19:00] kees: uwog: can you point me to the bug reports, I would like to get CVEs assigned for them.
[19:00] uwog: kees: there were never any bugreports... the code was just committed to our repos.. that's the annoying thing
[19:00] megabyte405: uwog: yeah, sum1 fixed some odt stuff recently - I did include those patches in the package
[19:00] daq4th abandonó el canal de chat. (Remote closed the connection)
[19:01] uwog: megabyte405: the 'fixed array' issues, yes
[19:01] bashohIII abandonó el canal de chat. ("夢よりも現の鷹ぞ頼もしき")
[19:01] uwog: and 2.6.2 has 1 change to the applix plugin that is a buffer overflow
[19:01] uwog: it sucks that we don't have a proper record for 2.5 years of development work; feel free to flame us of it
[19:02] megabyte405: kees: we have an exceptional tester/coder ("sum1") who is very good at reading code/testing things and finding bugs. He started by filing tons of bugs, but now it's generally quicker for him to just fix the bug
[19:02] kees: megabyte405: heh
[19:02] uwog: ah yes, that's better: blame sum1 for fixing the bugs1
[19:02] uwog: s/1/!
[19:02] • megabyte405 realizes it's probably futile to try to find those bug fixes by searching for "buffer" or "overflow" in the thunderbird svn commit mail folder...
[19:02] uwog: megabyte405: might turn up something
[19:03] kees: well, if there are security fixes going in, all the distros would appreciate hearing about it. Can you arrange to either email me (kees@ubuntu.com) or vendor-sec (vendor-sec@lst.de) with details on the security commits? we'd all greatly appreciate it.
[19:03] uwog: after a few hours of searching the massive archive\
[19:03] uwog: megabyte405: can you at least mail the ODT and applix fixes ?
[19:03] megabyte405: uwog: my point exactly on the massive search
[19:03] megabyte405: uwog: are those post-2.6.2?
[19:03] uwog: 1 is post 2.6.2
[19:04] uwog: the applix one is on 2.6.2
[19:04] megabyte405: I'm working off a 2.6.2 source with all of sum1's fixes backported
[19:04] megabyte405: ok
[19:05] `ru abandonó el canal de chat. (Client Quit)
[19:05] megabyte405: I should really just earch for all of sum1's commits...
[19:05] uwog: poor tbird
[19:06] smagoun abandonó el canal de chat.
[19:06] edusilva entró en el canal de chat.
[19:07] james_w entró en el canal de chat.
[19:07] cinamod entró en el canal de chat.