libgdiplus 2.6.7 in F13 - any objections?

[Christian Krause]

Hi,

In order to fix a security problem in libgdiplus (
https://bugzilla.redhat.com/show_bug.cgi?id=626821 ) it is necessary to
push out an update in F13.

Since F13 will be updated sooner or later to mono 2.6.7 as well, I was
wondering whether it would be possible to push out libgdiplus 2.6.7
(with the security fix) solely first and leave the rest of the mono
stack at 2.6.4 for now. I've roughly checked the commit logs for
libgdiplus and it really doesn't look like that there were any
incompatible (API) changes.

IMHO only programs using WinForms are actually using libgdiplus and a
short test with some example programs did not reveal any issue of using
libgdiplus-2.6.7 with mono 2.6.4.


Any comments or ideas whether this is possible? ;-)

Thanks!


Best regards,
Christian

[C.J. Adams-Collier KF7BMP]

How's the unit test suite log look?
What's the release number/sha1?
What branch does this release come from?
Will you be following the branch for release or security updates?

-73-

C.J., KF7-BravoMikePapa

On Tue, 2010-08-24 at 23:34 +0200, Christian Krause wrote:

>  Hi,
>  
>  In order to fix a security problem in libgdiplus (
>  https://bugzilla.redhat.com/show_bug.cgi?id=626821 ) it is necessary to
>  push out an update in F13.
>  
>  Since F13 will be updated sooner or later to mono 2.6.7 as well, I was
>  wondering whether it would be possible to push out libgdiplus 2.6.7
>  (with the security fix) solely first and leave the rest of the mono
>  stack at 2.6.4 for now. I've roughly checked the commit logs for
>  libgdiplus and it really doesn't look like that there were any
>  incompatible (API) changes.
>  
>  IMHO only programs using WinForms are actually using libgdiplus and a
>  short test with some example programs did not reveal any issue of using
>  libgdiplus-2.6.7 with mono 2.6.4.
>  
>  
>  Any comments or ideas whether this is possible? ;-)
>  
>  Thanks!
>  
>  
>  Best regards,
>  Christian
>  _______________________________________________
>  mono mailing list
>  mono(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/mono

[Christian Krause]

On 08/25/2010 12:32 AM, C.J. Adams-Collier KF7BMP wrote:
>  How's the unit test suite log look? 
Which test suite?

>  What's the release number/sha1? 
mono stack: 2.6.4
update in question:
libgdiplus: 2.6.7

>  What branch does this release come from? 
I don't know from which branch the various mono packages are released by
upstream.

>  Will you be following the branch for release or security updates?
current mono stack in F13:
http://ftp.novell.com/pub/mono/archive/2.6.4/download/

However, it is planned to update it in F13 to 2.6.7 soon.

Best regards,
Christian