[Talk] Home Edition security updates

[grizzler]

it might be just a problem on the security tracker site.

When I wrote that message, the update was only visible in the package tracker as being in unstable. Nothing on the DSA page (not even right now!), nothing on the mailing list (that message finally appeared about 11 hours later). The security tracker was the only place it showed correctly (that's where I got the DSA number from).

Updating all those separate locations doesn't always happen on time, e.g. the DSA page is almost never up to date when the mailing list message appears. I have no idea how this stuff is linked together, but I would be surprised if it was all done entirely manually.

[grizzler]

the kernel that will be included shortly in jessie and will be the kernel of the next Stable fixes this issue
https://bugs.debian.org/cgi-bin/bugrepo ... =742226#52

Oh, right. Nice. That update also contains fixes for vulnerabilities mentioned here: https://www.debian.org/security/2014/dsa-3060 (and Ben promised to include the fix for this as well...).

Security update coming up...

I don't like pushing these kernel updates without at least some testing by others, so anyone feel like testing this one when it's available?

[zerozero]

i will test it as soon as it's available in jessie
ofc that with intel gpu is a somehow limited testing

[grizzler]

i will test it as soon as it's available in jessie

Thanks.

ofc that with intel gpu is a somehow limited testing

Yep. I'm hoping some of the nvidia users will join in as well...

[grizzler]

It's arrived...

Code: Select all

p07@asus:~$ rmadison linux
debian:
....
 linux | 3.16.7-2                | jessie            | source
 linux | 3.16.7-2                | sid               | source
 linux | 3.17-1~exp1             | experimental      | source

Edits
Also required may be (I think) new versions of:
linux-latest
nvidia-graphics-drivers
nvidia-modprobe
nvidia-graphics-modules
nvidia-settings
nvidia-xconfig

[zerozero]

yeahh i was posting the same.
updated the intel box and preparing the amd (will take about an hour)

Code: Select all

The following NEW packages will be installed:
  liblsmash2 linux-headers-3.16.0-4-amd64 linux-headers-3.16.0-4-common linux-image-3.16.0-4-amd64

[grizzler]

What to do with that nvidia stuff...

Bad timing for this update to come through as well. I have an appointment in about half an hour and I won't be near my computer until much later today (maybe not before this evening...).

[Snap]

What to do with that nvidia stuff...

Oh, boy...

[zerozero]

as i was expecting the intel box updated without problems;
with the amd box i'm having big problems not directly related with the new kernel: i was trying to update a system from the latest UP to current jessie and the update path is utterly broken (not kernel related)
i have to leave now, will debug that issue later.

[grizzler]

Thanks. I've updated a couple of VMs and two partitions on my old laptop (amd graphics). No problems. My main machine (intel) is tracking testing and as such was already updated.

Now we need also some testers with nvidia graphics...

[Snap]

Are you sure the drivers are relevant in Virtual machines? I never had to change anything from the defaults or dealing with drivers in VMs since the host already has Nvidia and IMHO it's the one who matters and plays with them. Not the guests. I can install new kernels with zero issues in the VMs but not in my bare metal install. That's another story.

[zerozero]

solved; simple(ish) but odd (i will post about it in another place)
fglrx works updating from the previous kernel (as Frank already posted)

Code: Select all

zerozero@solydxk ~ $ inxi -SGxx; apt policy fglrx-driver
System:    Host: solydxk Kernel: 3.16.0-4-amd64 x86_64 (64 bit gcc: 4.8.3) 
           Desktop: KDE 4.14.2 (Qt 4.8.6) dm: lightdm Distro: SolydXK 1 solydxk 
Graphics:  Card: Advanced Micro Devices [AMD/ATI] Wrestler [Radeon HD 7340] bus-ID: 00:01.0 chip-ID: 1002:9808
           Display Server: X.Org 1.16.1 driver: fglrx Resolution: 1366x768@60.00hz
           GLX Renderer: AMD Radeon HD 7340 Graphics
           GLX Version: 4.4.12968 - CPC 14.201.1006.1002 Direct Rendering: Yes
fglrx-driver:
  Installed: 1:14.9+ga14.201-2
  Candidate: 1:14.9+ga14.201-2
  Version table:
 *** 1:14.9+ga14.201-2 0
        500 http://ftp.debian.org/debian/ testing/non-free amd64 Packages
        100 /var/lib/dpkg/status
zerozero@solydxk ~ $ 

[grizzler]

Are you sure the drivers are relevant in Virtual machines?

The graphics drivers? No, I don't think so. Updating the VMs is just part of the routine.
The VMs are on my main machine anyway. Most of my hardware uses Intel graphics. The only thing I have here that doesn't is the old laptop.

[Arjen Balfoort]

I've updated my main machine to testing.
New kernel, no nvidia problems whatsoever after reboot.

[grizzler]

That's with all nvidia packages as they currently are in Testing, I assume?

I'm just wondering what will happen if I push those to the security repo. No idea if they 'fit in' with the 2014.10.15 UP.

If no-one with a machine on that UP and nvidia graphics comes forward to test things, I guess all I can do is check whether there are dependency issues in theory and hope for the best...

Edit
Aargh! One of the nvidia packages isn't even in Testing at this time (nvidia-graphics-modules was removed 8 Nov - the one with the new kernel's version number is stuck in Unstable)!

[just]

Frank, here's a computer with solydk64-201411-dev iso installed, using the UP 2014.10.15 (as UM informs), having the NVIDIA card, running currently on Intel video drivers, not NVIDIA ones, using a Production repos (I believe, never touched sources.list after installing the dev iso), and ready to be completely destroyed with any kind of test you need/want.

I never made a part of the Test Squad, never made a serious testing for SolydXK. Can I be of some help with NVIDIA tests? Should it be enough to switch repos to Testing, as specified in the ZZ's post?

In short: what can I do to help you test NVIDIA?

[grizzler]

Frank, here's a computer with solydk64-201411-dev iso installed, using the UP 2014.10.15 (as UM informs), having the NVIDIA card, running currently on Intel video drivers, not NVIDIA ones, using a Production repos (I believe, never touched sources.list after installing the dev iso), and ready to be completely destroyed with any kind of test you need/want.

LOL! Thanks!

In short: what can I do to help you test NVIDIA?

I wish I could tell you in great detail. Unfortunately, I have no experience with nvidia whatsoever. I assume you have to install nvidia drivers and configure them in some way. Can someone else please fill in the blanks here? Thanks!

Once that's done, you need to add Debian's Testing repo to your sources.list, or rather, add a file to /etc/apt/sources.list.d/ (e.g. called 'jessie.list') which contains the single line

Code: Select all

deb http://ftp.debian.org/debian testing main contrib non-free

and apt update to include that repository's packages list.
Then you install only the new kernel and new versions of the nvidia drivers and after that, remove the jessie.list file and apt update again to remove the repo.

However, there may be a problem with all that, because as I mentioned in the edit to my previous posting, the nvidia packages appear to be incomplete in Testing at this time. I'm not sure yet whether using Unstable instead of Testing won't drag in versions that are too new. Need to check that.

[just]

everything is 99% clear for me in your answer. i'm rather experienced with nvidia-optimus drivers, so don't believe that somebody's else help is needed.

backing up the / partition right now. after that will start to follow your brief guidelines. hope to finish in a day. still have one or two not too clear points about the repos, but will try to find the answers on my own.

thanks.

[grizzler]

everything is 99% clear for me in your answer. i'm rather experienced with nvidia-optimus drivers, so don't believe that somebody's else help is needed.

Great!

backing up the / partition right now. after that will start to follow your brief guidelines. hope to finish in a day. still have one or two not too clear points about the repos, but will try to find the answers on my own.

If I can clarify things, by all means ask.

I just checked and I don't think it would be a good idea to use Unstable instead of Testing. There's one package that has a newer version there and looking at the changes I think using that could break things.
I'll try to come up with a solution for this later today.

[just]

just to keep you updated. so far:

1. having an nvidia-optimus, removed all the nouveau stuff before installing nvidia drivers. the intent was to have a clear drivers config: intel + nvidia. nvidia-optimus doesn't require 11 packages = 111 MB of nouveau stuff.

computer continued to work, but with nouveau removed i've lost some (few) 3D desktop effects. installed bumblebee-nvidia drivers. computer continued to work, but 3D still didn't turn back completely.

decided to not waste more time removing nouveau, restored the / from backup, reinstalled again all bumblebee-nvidia stuff on top of nouveau. have followed the canonical way for nvidia-optimus installation, in brief.

bumblebee-nvidia shines as a crazy diamond right now here. all this luxury with the default sources.list, included with solydk64-201411-dev. that is:

Code: Select all

deb http://home.solydxk.com/production solydxk main upstream import
deb http://debian.solydxk.com/production testing main contrib non-free
deb http://debian.solydxk.com/security testing/updates main contrib non-free
deb http://community.solydxk.com/production solydxk main

the first point of your guide - initial install and test of the nvidia drivers- finisches here. the / is already backed up again in its current state.

2. i'm about to pass to the second one - add the jessie.list to 4 existing ones. and here my first doubt arrives. the final result will be:

Code: Select all

deb http://home.solydxk.com/production solydxk main upstream import
deb http://debian.solydxk.com/production testing main contrib non-free
deb http://debian.solydxk.com/security testing/updates main contrib non-free
deb http://community.solydxk.com/production solydxk main

from the default /etc/apt/sources.list, plus,

Code: Select all

deb http://ftp.debian.org/debian testing main contrib non-free

from the newly created /etc/apt/sources.list.d/jessie.list, resulting in 5 repos.

my question is simple - do you think these 5 repos are OK? Yes/No only, nothing more.

in any case, your eventual answer will take too long to arrive, so right now i'm proceeding with 5 repos (above), to see what will happen.