ITADN

Consistency of introduced versions and Hackage

#247Closedtchoutri 创建于 2024-11-14
T
tchoutricommented
In https://haskell.github.io/security-advisories/advisory/HSEC-2023-0009.html the "introduced version" that was declared is `0.1`. However it does not exist in Hackage. The earliest version of `git-annex` in Hackage is [3.20110702](https://hackage.haskell.org/package/git-annex-3.20110702). If this is not a typo and `0.1` is indeed the release in which the vulnerability was introduced, the advisory should be amended and follow https://haskell.github.io/security-advisories/advisory/HSEC-2023-0007.html where it is written: ```toml # it was introduced earlier, but this is the earliest version on Hackage introduced = "3.0.3.1" ``` It's not that I like being bureaucratic, it's just that flora.pm's data model expects consistency within Hackage when it comes to referencing versions, and `git-annex-0.1` simply does not exist in Hackage.
关闭于 2024-11-16 7 条评论