**** BEGIN LOGGING AT Thu Feb 21 02:59:57 2019
Feb 21 16:01:29 <georgem> I was thinking about cherry picking CVE patches and possibly memory leak patches for systemd in sumo from here: https://github.com/systemd/systemd-stable/commits/v237-stable and sending them to the list. Would that be well received?
Feb 21 16:01:41 <rburton> yes
Feb 21 17:56:18 <georgem> Ubuntu seems to have a more complete set of CVE fixes for 237 here: https://packages.ubuntu.com/bionic/systemd I don't see the two memory leak commits that were in v237-stable but maybe they weren't needed. I'll just use the Ubuntu CVE patches and send that to the list for sumo assuming I don't run into any problems.
Feb 21 18:22:29 <armpit> georgem, do they affect the version in thud?
Feb 21 18:33:01 <georgem> armpit: it appears there are 9 patches for v239 (thud) and 10 for v237 (sumo), however it appears systemd in thud has 6 CVE patches already applied on top of it. Might be a bit of mess to sort that out...
Feb 21 18:35:10 <armpit> k
Feb 21 18:36:25 <georgem> Ubuntu has multiple patches for some of the CVEs and without digging further it's not immediately clear whether thud is missing some of them or just has all the changes for certain CVEs combined into a single patch.
Feb 21 18:40:20 <georgem> For CVE-2018-16865 they seem to be combined into a single patch in Thud.
Feb 21 18:49:18 <georgem> Thud is missing CVE-2019-6454 and it might be missing the second patch for CVE-2018-6954. Let me start by seeing if the patches already in Thud apply cleanly to v237 in sumo. If so I'll build that, make sure systemd still works on my target and send those to the list.
**** ENDING LOGGING AT Fri Feb 22 02:59:56 2019