CentOS virt - Feb 2017 - Xen updates in the Testing Repo for XSA-207 and XSA-208

Given the circumstances, might it make sense to offer formal advisories
of some type for these to indicate when the packages going to live are
for security or other reasons?

On 02/17/2017 09:51 AM, Johnny Hughes wrote:
> These updates have now been pushed to mirror.centos.org and you can get
> them from the main repos.
> 
> On 02/15/2017 08:27 AM, Johnny Hughes wrote:
>> There are xen rpms in the testing repos for XSA 207 and 208 in the
>> testing repos (xen-4.4.4-18.el6,  xen-4.6.3-7.el6, xen-4.6.3-7.el7).
>>
>> You can enable the applicable centos-virt-xen-testing repo in your
>> /etc/yum.repos.d/CentOS-Xen.repo file.
>>
>> Please report positive and negative tests to this list so we can
promote
>> the updates to the main repos.
>>
>> Thanks,
>> Johnny Hughes
>>
>>
>>
>>
>>
>> _______________________________________________
>> CentOS-virt mailing list
>> CentOS-virt at centos.org
>> https://lists.centos.org/mailman/listinfo/centos-virt
>>
> 
> 
> 
> 
> _______________________________________________
> CentOS-virt mailing list
> CentOS-virt at centos.org
> https://lists.centos.org/mailman/listinfo/centos-virt
> 

-- 
Kevin Stange
Chief Technology Officer
Steadfast | Managed Infrastructure, Datacenter and Cloud Services
800 S Wells, Suite 190 | Chicago, IL 60607
312.602.2689 X203 | Fax: 312.602.2688
kevin at steadfast.net | www.steadfast.net

On 02/17/2017 02:32 PM, Kevin Stange wrote:
> Given the circumstances, might it make sense to offer formal advisories
> of some type for these to indicate when the packages going to live are
> for security or other reasons?
>
We release xen every 2nd (even numbered) release as a goal (4.4, 4.6, 4.8)

We don't normally release anything other than security updates.  This is
a SIG that requires community participation .. so far, George Dunlap and
I are really the only people contributing.

This is volunteer work for both of us.  We could stand some more volunteers.

In any event, the updates we release come from here:

https://xenbits.xen.org/xsa/

When they release an XSA, we incorporate it and do a new release.

Support for older releases will be done (currently by only me ..
volunteers welcome) based on this schedule:

https://wiki.xenproject.org/wiki/Xen_Project_Release_Features

So, we will support 4.4 on CentOS-6 until 'March 2017' and 4.6 on
CentOS-6 and CentOS-7 until 'Oct 2018 '.  When the xen project stops
supporting a version, we will also stop supporting it.






> On 02/17/2017 09:51 AM, Johnny Hughes wrote:
>> These updates have now been pushed to mirror.centos.org and you can get
>> them from the main repos.
>>
>> On 02/15/2017 08:27 AM, Johnny Hughes wrote:
>>> There are xen rpms in the testing repos for XSA 207 and 208 in the
>>> testing repos (xen-4.4.4-18.el6,  xen-4.6.3-7.el6,
xen-4.6.3-7.el7).
>>>
>>> You can enable the applicable centos-virt-xen-testing repo in your
>>> /etc/yum.repos.d/CentOS-Xen.repo file.
>>>
>>> Please report positive and negative tests to this list so we can
promote
>>> the updates to the main repos.
>>>
>>> Thanks,
>>> Johnny Hughes



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.centos.org/pipermail/centos-virt/attachments/20170218/ceb2fde4/attachment-0002.sig>

On 02/18/2017 08:14 AM, Johnny Hughes wrote:
> On 02/17/2017 02:32 PM, Kevin Stange wrote:
>> Given the circumstances, might it make sense to offer formal advisories
>> of some type for these to indicate when the packages going to live are
>> for security or other reasons?
>>
> 
> We release xen every 2nd (even numbered) release as a goal (4.4, 4.6, 4.8)
> 
> We don't normally release anything other than security updates.  This
is
> a SIG that requires community participation .. so far, George Dunlap and
> I are really the only people contributing.
What I mean is .. other than the base release in a major version (so the
first 4.6 release), the follow on updates all happen as the result of an
XSA from the list.

It is certainly possible that we COULD release a bugfix update at some
point, but if you look at my git repo:

https://github.com/hughesjr/xen

There is a xen-44 and a xen-46 branch .. you can see all the change and
why from there.  If you look, almost all of them are for XSAs.



<snip>


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.centos.org/pipermail/centos-virt/attachments/20170218/0e3b4c9e/attachment-0002.sig>