[oi-dev] samba security

[Alasdair Lumsden]

Hi Martin,

On 15 Apr 2012, at 15:10, Martin Walter wrote:
<snip>
>> Unfortunately however the new version probably won't make the stable branch. The stuff in illumos-userland will be destined for /experimental followed by /dev.
> 
> pkg.openindiana.org/experimental is last updated at 2011-11-19 !?
> 
> I think such critical security holes should be fixed asap. Otherwise
> it is really a risk to run Openindiana on big fileservers.

The binary repo was last updated quite a while ago, but work continues on the source side at:

https://hg.openindiana.org/illumos-userland/
and
https://hg.openindiana.org/upstream/oracle/userland-gate

The challenge is manpower - 151a was built using a collection of highly unpalatable build systems that few of our developers want to work on. The reason for the delay between oi_151 and our next big release (not the stable) is that we're completely re-tooling around a single build system. Once done, we'll be able to churn out updates far more easily.

However the retooling effort has been derailed and held up by the fact it started life as oi-build and became a collaborative effort with Nexenta called illumos-userland, which they are going to also use for Illumian. A lot of resources have had to be diverted to sorting out collaborating with them and dealing with the consequences of this. We're nearly there and hopefully things will speed up again once we get into the swing of things.

If you'd like things to proceed faster, I'd like to point out that the devs working on OI are contributing their free time to do this. If you value OI then you're welcome to assist us and help get things updated faster.

The stable release is about backporting critical security fixes, and this one sounds like the kind of thing we should look at backporting. So we will look into it and see what can be done. But it probably won't involve a version bump, more a patch to the older version.

Cheers,

Alasdair