Re: dangerous handling of security bugs

On 12.07.2010, at 21:22, Reindl Harald wrote: > Am 12.07.2010 21:16, schrieb Lukas Kahwe Smith: > >> I am sorry but I think you have to accept that this service will not be provided >> by php.net (for which version of PHP should be release the security patches) > > It would be really nice to think about any automatic way to generate > them for latest stable version and attach them to the bugreport > who descrives the problem. > > This time it would be pachtes for 5.3.2 Which would to lead to what? People will stick to 5.3.2 and so when 5.3.4 is released they also want patches for 5.3.2 and 5.3.3 > I know that this means some work, but please think about > that, you can make also the life of distributors easier > and additionally sysadmins have the choice to wait > for the next stable release or take the patches in > their own build-environment if such one exists Bug tickets have a tab with the SVN commits. Now if you are a PHP developer you could implement a tool to fetch the changes from each of the commits listed there to create a single or a set of patch files. This might indeed be useful for some people. That being said there is no guarantee that the so generated patches will fix let alone work when applies to a previous version of PHP. regards, Lukas Kahwe Smith mls@pooteeweet.org