Plans for Shibboleth SP 2.1 debian packages

[Patrik Schnellmann]

Hi all,

Thanks for the backports of Shib 2.2.1, they work well.

Unfortunately, these packages are outdated already due to a security
vulnerability as you may be aware:

http://shibboleth.internet2.edu/secadv/secadv_20091104.txt

As we use the 2.2.1 packages for productions services, it's important to
know when the security fixes make it into the debian packages.

Can you give us an estimation about when updated packages will be available?

Thank you and best regards,
Patrik

Russ Allbery wrote:
> Patrik Schnellmann <patrik.schnellmann at switch.ch> writes:
>> Ferenc Wagner wrote:
>>> Patrik Schnellmann <patrik.schnellmann at switch.ch> writes:
> 
>>>> Now that the 2.2.1 SP is out and Debian finally got its libcurl
>>>> package fixed - could you do a lenny backport for the 2.2 SP? When do
>>>> you think you would find time to do that?
> 
>>> Russ is actively working on packaging the 2.2 SP, ATM he's waiting for
>>> the new opensaml2 to get through the Debian NEW queue.  It usually
>>> happens within a week or so, but ultimately that depends on the ftp
>>> masters.  You'll probably get sid packages by early September if
>>> everything goes well.  It's about mid-September when I can get back to
>>> business, you may expect unofficial lenny backports around that time.
> 
>> Now that it's October, I just wanted to ask about the status of the
>> lenny-backports. When can we expect them?
> 
> xml-security-c and xmltooling are uploaded and available from
> backports.org.  The amd64 builds were very slow, so I was waiting for them
> to clear before uploading opensaml2, and then I got sick.  I plan on
> uploading opensaml2 hopefully today, and shibboleth-sp2 later this week.
> 

-- 
SWITCH
Serving Swiss Universities
--------------------------
Patrik Schnellmann, Software Engineer, Net Services
Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
phone +41 44 2681559, fax +41 44 2681568
patrik.schnellmann at switch.ch, http://www.switch.ch