The next release (6.2.62) and betas (6.2.61b) of Sympa

[ikedas]

Hi @everyone.

• Due date of the next stable (6.2.62) is proposed to be 20st Mar. 2021.
• Maybe the first beta (6.2.61b.1) will come out in Feb.

Especially this release will finish fixes for CVE-2020-26880. See also related thread.

See also the milestone 6.2.62.

[racke]

Good. It is the 20th March by the way. Any details about the fixes for CVE-2020-26880?

[ikedas]

I think fixes on the code have been done on #946 (& #1031). Another fix we have to do is, I think, updating/adding documentation about safer configuration.

[xavierba]

March 20th seems a very distant date when a fix for such a bad security issue is available...
Shouldn't only that fix warrant a release asap ?

[ikedas]

This date was what I proposed and haven't been disagreed. See the thread. Anyway I think we need slightly large amount of time to work for this fix --- In fact, updating documentation hasn't been done at all.

[ikedas]

6.2.61b.1 comes in 18 Feb

The first beta will be out.

• See Closed issues in the next milestone.

We have to work for documentation about critical changes, in addition to testing. Thanks for help!

(Sorry but I'll be in trip for some days around this weekend. That's why I decided to release beta in Thursday.)

[ikedas]

Done!

[ikedas]

@racke, How may we update #1074 ?

[ikedas]

6.2.62 is proposed to be 20th Mar. 2021

How are your process of updating the documentation going?

[racke]

Sorry I'm swamped at the moment, will try to take a look at the weekend.

[ikedas]

How is the works for documentation?

[ikedas]

I don't see any progress.

Release of 6.2.62 would be better to be postponed.

[racke]

Still lack of time for the documentation. I agree on postponing the release. Two weeks?

[ikedas]

I have no objection to two weeks.

(I can accept a postponement of up to a month.: I'm going on vacation for a week at the end of April. I think we'd be better to decide after a week, at 25 Mar., whether to postpone it again.)

[ikedas]

@racke, can you give a list of the documentation works you are going to do?

I have a plan to write an advisory about #1091 .

[ikedas]

There seems to be no progress. We'd be better ---

• to release 6.2.61b.2 by now,
• to postpone 6.2.62 one more week.

[ikedas]

I think you said we should document what will be changed on the next release.

[racke]

OK, will go sifting through the changes. Also going to prepare some documentation about avoid setuid.

[ikedas]

I'll author the advisory above in this week (sorry for delay).
Anyways I hope we'll release 6.2.62 around 20th Apr.

[racke]

OK I'm starting the release announcement draft.

[racke]

https://github.com/sympa-community/sympa/releases/tag/untagged-7ae71b2a9ec06e2bf202 (copy of 6.2.60).

I'll provide the information for the 6.2.62 release.

[ikedas]

I have no idea on how to do with #1074 . How should we do?

[racke]

I try to rebase it and and important information to the top. What should be the release date?

[ikedas]

Thanks. I don’t know the date by now. Please read my posts in the last month.

[ikedas]

Can we close #1009 , and why? If we can’t, what should we do?

[ikedas]

Check sympa-community/sympa-community.github.io#80 .
For discussion please post to #1091 .

[ikedas]

I decoded closing the comments on the advisory above at 24th Apr, 0 a.m. UTC.

[ikedas]

Sorry for delay. If no objection, 6.2.62 will be released in the morning of 27th April (UTC).

[racke]

Sounds good to me 👍

[ikedas]

Done!
Thank you for help!

[racke]

@ikedas ... thanks a lot for the release !!!