Re: HEADS UP: MIT KRB5 1.22.1 Import

On Thu, Aug 21, 2025 at 9:10 AM Cy Schubert <Cy.Schubert@cschubert.com>
wrote:

> In message <aKcqsXIyYobdRIlY@nuc>, Mark Johnston writes:
> > On Thu, Aug 21, 2025 at 02:36:15AM -0700, Cy Schubert wrote:
> > > In message <86frdlkw30.fsf@ltc.des.dev>,
> =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav
> > ?
> > > = w
> > > rites:
> > > > Cy Schubert <Cy.Schubert@cschubert.com> writes:
> > > > > KRB5 1.22.0 released with a GSSAPI bug (CVE-2025-57736). The point
> patc
> > h=
> > > > =20
> > > > > was applied on Aug 19 (f96110babbe1). 1.22.1 contains the point
> patch p
> > lu=
> > > > s=20
> > > > > an additional GSSAPI patch. I intend to commit it to HEAD after a
> few d
> > ay=
> > > > s=20
> > > > > of testing on Aug 25.
> > > >
> > > > Please post your patch for review (using git arc, as described in the
> > > > committers guide) so others can test it too.
> > >
> > > git arc does not work with vendor merges. There is a way to trick it
> though
> > .
> >
> > What problem do you run into exactly?  Could you provide a recipe for me
> > to reproduce it locally?
>
> It's a vendor import. It's the same problem we have with git rebase and
> git
> diff of a vendor import. (This is why vendor imports use a special
> procedure [see committers guide].)
>

I think you just need to tell arc to use the first parent....

I've created a generic patch and have created a revision with it. But it
> will not be used for the commit because it affects history.
>

Warner