Bug 474870

I'd like to add the "bugzilla" package to this response request with the following bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=465958
https://bugzilla.redhat.com/show_bug.cgi?id=466077
https://bugzilla.redhat.com/show_bug.cgi?id=474250

Note that this packager has the following packages listed in koji:

http://koji.fedoraproject.org/koji/userinfo?userID=225

ratpoison:
http://koji.fedoraproject.org/koji/userinfo?userID=225

outstanding bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=473940
https://bugzilla.redhat.com/show_bug.cgi?id=426739
https://bugzilla.redhat.com/show_bug.cgi?id=455084

squidguard:
http://koji.fedoraproject.org/koji/packageinfo?packageID=3866

outstanding bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=452467
https://bugzilla.redhat.com/show_bug.cgi?id=453461
https://bugzilla.redhat.com/show_bug.cgi?id=245377
https://bugzilla.redhat.com/show_bug.cgi?id=247065

wordpress:
http://koji.fedoraproject.org/koji/packageinfo?packageID=4118

Adrian has been keeping this one updated but John does have several security bugs assigned to him:

https://bugzilla.redhat.com/show_bug.cgi?id=421141
https://bugzilla.redhat.com/show_bug.cgi?id=471990
https://bugzilla.redhat.com/show_bug.cgi?id=471991
https://bugzilla.redhat.com/show_bug.cgi?id=471992

bugzilla:
http://koji.fedoraproject.org/koji/packageinfo?packageID=1420

Spot made one rebuild.

bugs assigned:  (Many)
https://bugzilla.redhat.com/show_bug.cgi?id=465958
https://bugzilla.redhat.com/show_bug.cgi?id=465957
https://bugzilla.redhat.com/show_bug.cgi?id=461049
https://bugzilla.redhat.com/show_bug.cgi?id=458848
https://bugzilla.redhat.com/show_bug.cgi?id=471088
etc.

(In reply to comment #0)
> Question:  Why hasn't security-response-team escalated this problem as their
> are outstanding security vulnerabilities?

security-response-team@'s support for Fedora is mostly limited to making sure maintainers get notified about the issues, helping analyse issues and get known / upstream patches.  Actually, it most cases there's little need for us to get involved in real package updating.

(In reply to comment #2)
> wordpress:
> https://bugzilla.redhat.com/show_bug.cgi?id=421141

CVE-2007-6318, looking at the upstream bug, it's not clear whether this issue ever got fixed upstream.

> https://bugzilla.redhat.com/show_bug.cgi?id=471990
> https://bugzilla.redhat.com/show_bug.cgi?id=471991
> https://bugzilla.redhat.com/show_bug.cgi?id=471992

CVE-2008-5113, this is a low impact issue, that requires non-trivial change and the fix should really come upstream.


Given the list, it looks like John is probably busy with his real life and may not have enough time for Fedora.  Have you asked him to orphan some of his packages, or possibly requested co-maintainership?

I believe that was the gist of the recent thread on -devel.

> Have you asked him to orphan some of his
> packages, or possibly requested co-maintainership?

How if he doesn't respond to private emails or bugs?

Second non-responsive maintainer bug opened at:

https://bugzilla.redhat.com//show_bug.cgi?id=476477

I think enough time has elapsed to take this to FESCO.  Joel, you reported, you want to do the honors?

I'll take gallery2 if approved, and would consider others.

*** Bug 476477 has been marked as a duplicate of this bug. ***

Notification to the devel list posted:

https://www.redhat.com/archives/fedora-devel-list/2009-January/msg01757.html

Please orphan and/or release maintainership from John Berninger for all his packages.  Thanks Cry.

Original post to devel list was:

https://www.redhat.com/archives/fedora-devel-list/2008-December/msg00237.html

Yes, I've been unresponsive - my fault, no excuses.  I've not had time to do anything with Fedora recently and should have realized that sooner.  Anyone who would like to take over my packages is more than welcome to do so, as I don't see my time getting freed up in the near future any more than it has been in the recent past.

Can you orphan them in pkgdb, once maintainers volunteer?  

https://admin.fedoraproject.org/pkgdb

I'll take gallery2, and would consider others that you don't have time for and others won't take.

gallery2 and bugzilla have been orphaned - the other big one is wordpress.  squidGuard and ratpoison are (or seem to be) lower-demand packages; anyone that cares to take them can do so.

This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

I can take ratpoison if no one else wants it. ;)

it's all yours

Thanks John for stepping up and orphaning the packages.

Even huger thanks for even packaging and pushing these packages (my favs are wordpress and gallery2) into Fedora in the first place.  Totally awesome.

Thanks!

Joel

I'll take wordpress if no one else wants it.

Adding Adrian.  Adrian, do you want wordpress, or should I take it over.  There's a few security bugs and 2.7 is out.

I take wordpress. There is already a bug open for the 2.7 release. I will update it (I am waiting for 2.7.1). Jon, if you want to co-maintain, you are welcome.

Excellent.

Can someone, preferably John Berninger, announce in fedora-devel-list that these packages are being orphaned. At least announce the remaining packages. I'm anxious to see an updated bugzilla package. There's some new features + security updates in the jump from 3.0.4 (fedora) to 3.2.2 (upstream).

SquidGuard taken.

It seems that all of the projects have been adopted.  I think this bug can be closed now.