Re: Please add warning to download page if tarball isn't patched up with all latest security fixes

["Thomas Harning" <harningt@...>]

Bizarre... Fixes are what point release changes are meant for.
I'd be annoyed if two downloads of a specific release changed over the time-it's like modifying a tag... You just don't do it.



On Thursday Aug 21, 2014 at 9:27 AM, Jonas Thiem , wrote:

Hi *,

I suggest adding a warning to download page if the tarball isn't
patched up with all latest security fixes (e.g. like #1 bug in Lua
5.2.2 published in April 2013 on lua.org/bugs.html, which wasn't fixed
in the tarball up to the release of 5.2.3 in Nov 2013).

I am asking because Red Hat/Fedora appeared to be totally unaware the
tarballs aren't patched up, and in conclusion I assume other
distributions and packagers might possibly also not be aware unless
there is a very obvious note on the download page that this is common
practise for Lua releases.

The response to this bug in 5.2.2 which leads to a crash and possibly
memory corruption I just got from Red Hat Security Alert was "As
Fedora would have rebased to upstream version 5.2.2, I do not know why
the fix is not in there." which indicates they missed how Lua doesn't
update released tarballs.

Regards,
Jonas Thiem