4 ms·
Even if you think the cryptography devs did something wrong, doesn't it prove the distro maintainers weren't doing any review? If they didn't catch something ca
by iudqnolq 4y ago
Even if you think the cryptography devs did something wrong, doesn't it prove the distro maintainers weren't doing any review? If they didn't catch something called out in the changelog I don't see how anyone can claim they're catching things you'd need to carefully read the source to find. (I'm not blaming distro maintainers, it would be impossible for them to do actual reviews.)
- bombolo 4y agoUh? Distro maintainers knew… but there was nothing to be done about it… It was end users of the package that didn't know, had a dependency like "<=X" and with the big change in a minor version got the rust version they could not compile (and thus run).
- iudqnolq 4y agoNope, if you check out the original threads it's full of distro maintainers complaining they were surprised. To clarify, these are maintainers of software that depends on cryptography, not maintainers of cryptography. Those maintainers weren't reviewing dependencies on an ongoing basis.