libgcrypt - CVE-2013-4242

[poma]

Hi,

repoquery --enablerepo=updates --repoid=updates -i libgcrypt-1.5.3-1.fc19
No packages marked for update/Nothing to do

http://koji.fedoraproject.org/koji/buildinfo?buildID=438177
Tags 	f19-updates
Completed	Fri, 26 Jul 2013 …
Today		Wed, 32 Jul 2013 …

poma

[Michael Schwendt]

On Wed, 31 Jul 2013 21:43:28 +0200, poma wrote:
> Hi,
>
> repoquery --enablerepo=updates --repoid=updates -i libgcrypt-1.5.3-1.fc19
> No packages marked for update/Nothing to do

What are you trying to point out?
Check out the details in the Fedora Updates System "bodhi" instead:
https://admin.fedoraproject.org/updates/FEDORA-2013-13678/libgcrypt-1.5.3-1....
> http://koji.fedoraproject.org/koji/buildinfo?buildID=438177
> Tags 	f19-updates
> Completed	Fri, 26 Jul 2013 …
> Today		Wed, 32 Jul 2013 …

"32 Jul"? ;-)

[Adam Williamson]

On Wed, 2013-07-31 at 22:09 +0200, Michael Schwendt wrote:
> On Wed, 31 Jul 2013 21:43:28 +0200, poma wrote:
> > Hi,
> >
> > repoquery --enablerepo=updates --repoid=updates -i libgcrypt-1.5.3-1.fc19
> > No packages marked for update/Nothing to do
>
> What are you trying to point out?

I'm guessing he's talking about this:

https://bugzilla.redhat.com/show_bug.cgi?id=960642

[poma]

On 31.07.2013 22:09, Michael Schwendt wrote:
> On Wed, 31 Jul 2013 21:43:28 +0200, poma wrote:
> > Hi,
> >
> > repoquery --enablerepo=updates --repoid=updates -i libgcrypt-1.5.3-1.fc19
> > No packages marked for update/Nothing to do
>
> What are you trying to point out?
> Check out the details in the Fedora Updates System "bodhi" instead:
> https://admin.fedoraproject.org/updates/FEDORA-2013-13678/libgcrypt-1.5.3-1....
> > http://koji.fedoraproject.org/koji/buildinfo?buildID=438177
> > Tags 	f19-updates
> > Completed	Fri, 26 Jul 2013 …
> > Today		Wed, 32 Jul 2013 …
>
> "32 Jul"? ;-)

:)

OK I thought on this,

Example 1 - lvm2
- koji:
  Information for build lvm2-2.02.98-10.fc19
  Tags 	f19-updates

- admin:
  lvm2-2.02.98-10.fc19 bugfix update
  Status:	stable
  Pushed: 	True

Example 2 - splix
- koji:
  Information for build splix-2.0.1-0.18.20121128svn.fc19
  Tags 	f19-updates-testing

- admin:
  splix-2.0.1-0.18.20121128svn.fc19 bugfix update
  Status:	testing
  Pushed: 	True

Example 3 - libgcrypt
- koji:
  Information for build libgcrypt-1.5.3-1.fc19
  Tags 	f19-updates

- admin:
  libgcrypt-1.5.3-1.fc19 security update
  Status:	testing
  Requested: 	stable
  Pushed: 	False

Summary:
- Example 1 - 'koji' is in accordance with 'admin' => updates
- Example 2 - 'koji' is in accordance with 'admin' => updates-testing
- Example 3 - 'koji' -> updates isn't in accordance with
              'admin' -> updates-testing

poma

[Michael Schwendt]

On Thu, 01 Aug 2013 04:21:15 +0200, poma wrote:
> Example 3 - libgcrypt
>
> koji:
> Information for build libgcrypt-1.5.3-1.fc19
> Tags 	f19-updates
>
> admin:
> libgcrypt-1.5.3-1.fc19 security update
> Status:	testing
> Requested: 	stable
> Pushed: 	False
>
> Summary:
> Example 1 - 'koji' is in accordance with 'admin' => updates
> Example 2 - 'koji' is in accordance with 'admin' => updates-testing
> Example 3 - 'koji' -> updates isn't in accordance with
>             'admin' -> updates-testing

The "Status" field in bodhi is not the same as the tag in koji.
When bodhi pushes packages, it adjusts the tags in koji,

bodhi - 2013-07-31 15:52:43
  This update is currently being pushed to the Fedora 19 stable updates repository.

and creates a temporary inconsistency between what koji tells about
the package (that it's tagged for "stable" already) and what bodhi's
own Status (the previous Test Update) tells. This will be like that
until the updates repo is regenerated, which takes some time.
Topic might be more suitable for the following list:
https://lists.fedoraproject.org/mailman/listinfo/buildsys

[poma]

On 01.08.2013 10:07, Michael Schwendt wrote:
> On Thu, 01 Aug 2013 04:21:15 +0200, poma wrote:
> > Example 3 - libgcrypt
> >
> > koji:
> > Information for build libgcrypt-1.5.3-1.fc19
> > Tags 	f19-updates
> >
> > admin:
> > libgcrypt-1.5.3-1.fc19 security update
> > Status:	testing
> > Requested: 	stable
> > Pushed: 	False
> >
> > Summary:
> > Example 1 - 'koji' is in accordance with 'admin' => updates
> > Example 2 - 'koji' is in accordance with 'admin' => updates-testing
> > Example 3 - 'koji' -> updates isn't in accordance with
> >             'admin' -> updates-testing
>
> The "Status" field in bodhi is not the same as the tag in koji.
> When bodhi pushes packages, it adjusts the tags in koji,
>
> bodhi - 2013-07-31 15:52:43
>   This update is currently being pushed to the Fedora 19 stable updates repository.
>
> and creates a temporary inconsistency between what koji tells about
> the package (that it's tagged for "stable" already) and what bodhi's
> own Status (the previous Test Update) tells. This will be like that
> until the updates repo is regenerated, which takes some time.
> Topic might be more suitable for the following list:
> https://lists.fedoraproject.org/mailman/listinfo/buildsys

Among others there are 'speed of sound' and 'speed of light',
and this one could be called 'speed of week'. :)
Hey Mich, thanks for summarize.

poma

[Patrick O'Callaghan]

On 31 Jul 2013 20:43, "poma"  wrote:
> Hi,
>
> repoquery --enablerepo=updates --repoid=updates -i libgcrypt-1.5.3-1.fc19
> No packages marked for update/Nothing to do
>
> http://koji.fedoraproject.org/koji/buildinfo?buildID=438177
> Tags    f19-updates
> Completed       Fri, 26 Jul 2013 …
> Today           Wed, 32 Jul 2013 …

July 32nd? Maybe your machine is in a parallel universe ...

poc