RE: [Python-Dev] Wanted: members for Python Security Response Team

2005-02-05 Thread Raymond Hettinger
> Would it be possible to release a 2.3.4a that has just the fix over and > above the released version? In this case it turns out that the fix nearly > coincided with the release of 2.3.5 and 2.4.1. Would you do an > accelerated > release if this had come up right after they were released? Just

Re: [Python-Dev] Wanted: members for Python Security Response Team

2005-02-05 Thread Skip Montanaro
>> How will Python releases made in response to security bugs be done: >> will they just include the security fix (rather than being taken from >> CVS HEAD), without the usual alpha / beta testing cycle? Or what...? Guido> On python.org, however, we tend to take the maintenance b

Re: [Python-Dev] Wanted: members for Python Security Response Team

2005-02-05 Thread Guido van Rossum
> How will Python releases made in response to security bugs be done: will > they just include the security fix (rather than being taken from CVS > HEAD), without the usual alpha / beta testing cycle? Or what...? Depends where you get the release. *Vendors* (ActiveState, Red Hat, Ubuntu, Debian,

Re: [Python-Dev] Wanted: members for Python Security Response Team

2005-02-04 Thread John J Lee
On Thu, 3 Feb 2005, Guido van Rossum wrote: [...] > hope at least one person from the release team can be involved, e.g. [...] Guido, from python-announce list: [...] > Python 2.3.5 will be released from www.python.org within a few days > containing a fix for this issue. Python 2.4.1 will be rele

Re: [Python-Dev] Wanted: members for Python Security Response Team

2005-02-03 Thread Guido van Rossum
> I noticed the checkins. I think there is one other necessary output: source > patches against all the affected versions need to be made available so > people can apply the patch to an existing installed version without needing > to upgrade. Patches for 2.2, 2.3 and 2.4 are on the website (pytho

Re: [Python-Dev] Wanted: members for Python Security Response Team

2005-02-03 Thread Skip Montanaro
Guido> For discussion about the team's responsibilities and procedures, Guido> please follow up here. I noticed the checkins. I think there is one other necessary output: source patches against all the affected versions need to be made available so people can apply the patch to an existi