Looking for contact with Daniel Veillard libxml2 maintainer

[Tomasz Kłoczko]

Hi,

I'm trying to follow procedure described on
https://fedoraproject.org/wiki/Policy_for_nonresponsive_package_maintainers

Daniel seems is not responding for quite long time.
In case of the tickets which I've created it is almost 3 weeks.
However I see in git unreplied pull request for more than 3 months.
Looks like maintainer is unresponsive.

kloczek
-- 
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH

[Daniel Veillard]

On Tue, Jan 16, 2018 at 01:33:28PM +0000, Tomasz Kłoczko wrote:
>  Hi,
>  
>  I'm trying to follow procedure described on
>  https://fedoraproject.org/wiki/Policy_for_nonresponsive_package_maintainers
>  
>  Daniel seems is not responding for quite long time. 
  Really ?

>  In case of the tickets which I've created it is almost 3 weeks.
>  However I see in git unreplied pull request for more than 3 months.
>  Looks like maintainer is unresponsive. 
  If you meam w.r.t. Fedora packaging then I would agree,
if you mean for upstream, well ... no

Daniel

>  kloczek
>  -- 
>  Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH 
-- 
Daniel Veillard      | Red Hat Developers Tools http://developer.redhat.com/
veillard(a)redhat.com  | libxml Gnome XML XSLT toolkit  http://xmlsoft.org/
http://veillard.com/ | virtualization library  http://libvirt.org/

[Tomasz Kłoczko]

On 16 January 2018 at 14:14, Daniel Veillard <veillard(a)redhat.com&gt; wrote:
>  On Tue, Jan 16, 2018 at 01:33:28PM +0000, Tomasz Kłoczko wrote:
> > Hi,
> >
> > I'm trying to follow procedure described on
> > https://fedoraproject.org/wiki/Policy_for_nonresponsive_package_maintainers
> >
> > Daniel seems is not responding for quite long time.
>
>    Really ?
>
> > In case of the tickets which I've created it is almost 3 weeks.
> > However I see in git unreplied pull request for more than 3 months.
> > Looks like maintainer is unresponsive.
>
>    If you meam w.r.t. Fedora packaging then I would agree,
>  if you mean for upstream, well ... no 
Good to see that you are alive ;)

https://src.fedoraproject.org/rpms/libxml2/pull-requests
https://bugzilla.redhat.com/show_bug.cgi?id=1529121

kloczek
--
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH

[Daniel Veillard]

On Tue, Jan 16, 2018 at 02:27:15PM +0000, Tomasz Kłoczko wrote:
>  On 16 January 2018 at 14:14, Daniel Veillard
> <veillard(a)redhat.com&gt; wrote:
>  > On Tue, Jan 16, 2018 at 01:33:28PM +0000, Tomasz Kłoczko wrote:
>  >> Hi,
>  >>
>  >> I'm trying to follow procedure described on
>  >> https://fedoraproject.org/wiki/Policy_for_nonresponsive_package_maintainers
>  >>
>  >> Daniel seems is not responding for quite long time.
>  >
>  >   Really ?
>  >
>  >> In case of the tickets which I've created it is almost 3 weeks.
>  >> However I see in git unreplied pull request for more than 3 months.
>  >> Looks like maintainer is unresponsive.
>  >
>  >   If you meam w.r.t. Fedora packaging then I would agree,
>  > if you mean for upstream, well ... no
>  
>  Good to see that you are alive ;)
>  
>  https://src.fedoraproject.org/rpms/libxml2/pull-requests 
Page not found (404)

With the message:

The requested URL was not found on the server. If you entered the URL manually please
check your spelling and try again.

>  https://bugzilla.redhat.com/show_bug.cgi?id=1529121 
 I think you should find a new maintainer for libxml2, and libxslt, and xmlsec1
because right now I have little time, and since Fedora changes the rules for
spec file all the time, they are not interoperable with RHEL/CentOS so the
net benefit of maintaining them becomes very low.

  thanks,

Daniel

>  kloczek
>  --
>  Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH 
-- 
Daniel Veillard      | Red Hat Developers Tools http://developer.redhat.com/
veillard(a)redhat.com  | libxml Gnome XML XSLT toolkit  http://xmlsoft.org/
http://veillard.com/ | virtualization library  http://libvirt.org/

[Tomasz Kłoczko]

On 16 January 2018 at 17:13, Daniel Veillard <veillard(a)redhat.com&gt; wrote:
[..]
> > https://src.fedoraproject.org/rpms/libxml2/pull-requests
>
>  Page not found (404) 
https://src.fedoraproject.org/rpms/libxml2 -> Pull Requests tab

>  With the message:
>
>  The requested URL was not found on the server. If you entered the URL manually please
> check your spelling and try again.
>
> > https://bugzilla.redhat.com/show_bug.cgi?id=1529121
>
>   I think you should find a new maintainer for libxml2, and libxslt, and xmlsec1
>  because right now I have little time, and since Fedora changes the rules for
>  spec file all the time, they are not interoperable with RHEL/CentOS so the
>  net benefit of maintaining them becomes very low. 
I would be happy start maintaining those packages and/or any other
Fedora packages which you own as admin.
You can give the project by login to FAS and (in case libxml2) go to
https://src.fedoraproject.org/rpms/libxml2/settings -> on the bottom
of the page is "Give the project" and enter "kloczek" in line below,
and press red button below to finalize transfer.

Whoever you will choose to be packages which you own next maintainers
I think that you should have look on attached to pull request patch
fixing lixml2 CVE reported (IIRC) by Google guys if it is still not
included in libxml2 source code tree if this patch is not integrated
in your original libxml2 source tree.
Looks like this patch is now used in chrome/chomium priv libxml2 copies.
https://codereview.chromium.org/2539003002

kloczek
--
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH

[Tomasz Kłoczko]

On 16 January 2018 at 18:01, Tomasz Kłoczko <kloczko.tomasz(a)gmail.com&gt; wrote:
[..]
>  >> https://bugzilla.redhat.com/show_bug.cgi?id=1529121
>  >
>  >  I think you should find a new maintainer for libxml2, and libxslt, and xmlsec1
>  > because right now I have little time, and since Fedora changes the rules for
>  > spec file all the time, they are not interoperable with RHEL/CentOS so the
>  > net benefit of maintaining them becomes very low.
>
>  I would be happy start maintaining those packages and/or any other
>  Fedora packages which you own as admin.
>  You can give the project by login to FAS and (in case libxml2) go to
>  https://src.fedoraproject.org/rpms/libxml2/settings -> on the bottom
>  of the page is "Give the project" and enter "kloczek" in line below,
>  and press red button below to finalize transfer. 
I've been patiently waiting week on some actions or replies.
No other replies (publicly or privately) or actions have been taken in meantime.

Daniel if you really have no time to maintain your packages you should
reassign them to other active packager.
I've offered that I can take your packages however if you are thinking
that you have other/better candidates just please reassign your
packages to such person.
Please do something ..

libxml2 has known CVE so at least please do something about only this package.
Pull request is now one month old. If you don't like my other changes
just please at least fix CVE.
If it will be no new actions to the end of this week I'm going to
raise FESCo ticket to takeover at least libxml2.

I've been already waiting longer than it is described on:
https://fedoraproject.org/wiki/Policy_for_nonresponsive_package_maintaine...

kloczek
--
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH

On Tue, Jan 23, 2018 at 9:07 AM, Tomasz Kłoczko 
<kloczko.tomasz(a)gmail.com&gt; wrote:
>  If it will be no new actions to the end of this week I'm going to
>
>  raise FESCo ticket to takeover at least libxml2. 
Yes, libxml2 is security-critical; we can't wait this long to apply 
security patches. The Fedora package maintainer needs to be able to 
respond in a timely manner. Thanks for working on this, Tomasz.

That said... has the patch been proposed for inclusion upstream? It 
looks like Nick Wellnhofer is taking care of libxml2 upstream these 
days, so it shouldn't need to wait for Daniel. I see you only included 
a link to a Chromium bug report with the patch; IMO that's not good 
enough, because we don't know if Chromium has reported the issue 
upstream or not. The libxml2 issue tracker is at 
https://bugzilla.gnome.org/enter_bug.cgi?product=libxml2.

Michael

[Tomasz Kłoczko]

On 23 January 2018 at 15:59,  <mcatanzaro(a)gnome.org&gt; wrote:
[..]
>  That said... has the patch been proposed for inclusion upstream? It
> looks
>  like Nick Wellnhofer is taking care of libxml2 upstream these days, so it
>  shouldn't need to wait for Daniel. I see you only included a link to a
>  Chromium bug report with the patch; IMO that's not good enough, because we
>  don't know if Chromium has reported the issue upstream or not. The libxml2
>  issue tracker is at
>  https://bugzilla.gnome.org/enter_bug.cgi?product=libxml2. 
Everything at the moment is only in the ticket:
https://bugzilla.redhat.com/show_bug.cgi?id=1529121
As I have gnome bugzilla account as well will ASAP try create necessary ticket.

CVE patch is in partial pull request patch and can be cherry picket
using git (and resolve patch conflict by delete all libxml2.spec
changes)
https://src.fedoraproject.org/fork/kloczek/rpms/libxml2/c/eb936f5b802a454...

Or even c&p or download from:
https://src.fedoraproject.org/fork/kloczek/rpms/libxml2/raw/eb936f5b802a4...
and added manually to existing latest libxml2.spec.

kloczek
-- 
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH

[Tomasz Kłoczko]

On 23 January 2018 at 16:24, Tomasz Kłoczko <kloczko.tomasz(a)gmail.com&gt; wrote:
>  On 23 January 2018 at 15:59,  <mcatanzaro(a)gnome.org&gt; wrote:
>  [..]
> > That said... has the patch been proposed for inclusion upstream? It looks
> > like Nick Wellnhofer is taking care of libxml2 upstream these days, so it
> > shouldn't need to wait for Daniel. I see you only included a link to a
> > Chromium bug report with the patch; IMO that's not good enough, because we
> > don't know if Chromium has reported the issue upstream or not. The libxml2
> > issue tracker is at
> > https://bugzilla.gnome.org/enter_bug.cgi?product=libxml2.
>
>  Everything at the moment is only in the ticket:
>  https://bugzilla.redhat.com/show_bug.cgi?id=1529121
>  As I have gnome bugzilla account as well will ASAP try create necessary ticket. 
Just found a bit more in RH bugzilla searching for "CVE-2016-9597"
https://bugzilla.redhat.com/show_bug.cgi?id=1408305
and more is here:
https://access.redhat.com/errata/RHSA-2016:2957

Looks like at the moment this bug is affecting at least jboss.
Because this patch has been added to chrome source tree it is quite
possible that it affects generally gnome desktop as well.

Strange only is that looks like this bug already is known more than year!

kloczek
--
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH

On Tue, Jan 23, 2018 at 10:45 AM, Tomasz Kłoczko 
<kloczko.tomasz(a)gmail.com&gt; wrote:
>  Strange only is that looks like this bug already is known more than 
>  year! 
Looks like two years... I followed the chain of links in the Red Hat 
bugs, which claim this is already reported as 
https://bugzilla.gnome.org/show_bug.cgi?id=762100 and fixed by
https://git.gnome.org/browse/libxml2/commit/?id=bdd66182ef53fe1f7209ab653....

If that's correct (a big "if" ;) then our libxml2 package should not be 
vulnerable.

Michael

[Tomasz Kłoczko]

On 23 January 2018 at 17:04,  <mcatanzaro(a)gnome.org&gt; wrote:
[..]
> > Strange only is that looks like this bug already is known more
> than year!
>
>
>  Looks like two years... I followed the chain of links in the Red Hat bugs,
>  which claim this is already reported as
>  https://bugzilla.gnome.org/show_bug.cgi?id=762100 and fixed by
>
> https://git.gnome.org/browse/libxml2/commit/?id=bdd66182ef53fe1f7209ab653....
>  If that's correct (a big "if" ;) then our libxml2 package should not be
>  vulnerable. 
(I had an issue with reset password)
Just opened https://bugzilla.gnome.org/show_bug.cgi?id=792840

kloczek
-- 
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH

[Michael Schwendt]

On Tue, 16 Jan 2018 18:13:40 +0100, Daniel Veillard wrote:

>  > https://src.fedoraproject.org/rpms/libxml2/pull-requests  
>  
>  Page not found (404) 
It loads fine here and shows five pull requests.

A temporary 404 would be a Fedora infrastructure problem to
report somewhere.