Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

1.0.1 release bumps SONAME unnecessarily #990

Closed
jfeep opened this issue Oct 7, 2021 · 5 comments
Closed

1.0.1 release bumps SONAME unnecessarily #990

jfeep opened this issue Oct 7, 2021 · 5 comments
Assignees

Comments

@jfeep
Copy link

jfeep commented Oct 7, 2021

The 1.0.1 release fixes CVE-2021-32765 by changing the internals of a function. The ABI remains untouched, hence the 1.0.1 release didn't need to change the SONAME.

8d1bfac#r57634172

Let's put HIREDIS_SONAME back to 1.0.0 and release as 1.0.2. This will allow binaries that have linked against /usr/lib64/libhiredis.so.1.0.0 to get the CVE fix with a drop-in upgrade that avoids the need to rebuild programs that link against hiredis.

@michael-grunder
Copy link
Collaborator

michael-grunder commented Oct 7, 2021

I've prepared v1.0.2 here

In terms of #991, my preference would be to bump the SONAME there to 1.0.3-dev because that allows me to distinguish the dev branch (which has many changes from v1.0.2).

Also see #987

Edit: cc @rgacogne just so you are aware you don't need to patch packages if you use 1.0.2

@jfeep
Copy link
Author

jfeep commented Oct 7, 2021

Agree, for master, SONAME can move ahead (e.g. to 1.0.3-dev) allowing room for ABI and API changes as development continues. Then when the next release time comes, you can determine if ABI or API compatibility is possible and determine what the next release number should be (and whether SONAME bump is needed).

#991 should have been targeted at the release/v1.0.2 branch rather than master. Since d4e6f10 fixes the issue on the release/v1.0.2 branch, I'll close PR #991.

This issue can be closed once v1.0.2 gets released. I'll then look at packaging it for openSUSE Tumbleweed

@michael-grunder
Copy link
Collaborator

1.0.2

@jfeep
Copy link
Author

jfeep commented Oct 7, 2021

Thank you @michael-grunder for fixing the SONAME issue. v1.0.2 package is available on openSUSE Tumbleweed.

@jfeep jfeep closed this as completed Oct 7, 2021
@rgacogne
Copy link

rgacogne commented Oct 9, 2021

Thanks @michael-grunder for fixing the issue and for notifying me, much appreciated!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants