View unanswered posts    View active topics

All times are UTC - 6 hours





Post new topic Reply to topic  [ 5 posts ] 
Print view Previous topic   Next topic  
Author Message
Search for:
PostPosted: Thu Sep 25, 2014 9:26 pm 
Offline
Joined: Tue Mar 28, 2006 8:26 pm
Posts: 804
Location: Minneapolis, MN
I want to update bash due to the bug in bash that was revealed on Sept 24.
My Knoppmyth R5.5 machine is still running like a top!

I located the Debian package page and found that the wheezy vintage is just new enough to have newer, fixed packages.
see https://packages.debian.org/wheezy/bash
I also updated the /etc/apt/source.list file with 2 wheezy repositories:
deb http://security.debian.org/debian-security wheezy/updates main
deb http://ftp.us.debian.org/debian wheezy main

I started by downloading the .deb file for bash 4.2, tried to install and got dependency errors:
Code:
root@mythtv:/usr/src# dpkg -i bash_4.2+dfsg-0.1+deb7u1_i386.deb
dpkg: regarding bash_4.2+dfsg-0.1+deb7u1_i386.deb containing bash, pre-dependency problem:
 bash pre-depends on dash (>= 0.5.5.1-2.2)
  dash is installed, but is version 0.5.3-7.
dpkg: error processing bash_4.2+dfsg-0.1+deb7u1_i386.deb (--install):
 pre-dependency problem - not installing bash
Errors were encountered while processing:
 bash_4.2+dfsg-0.1+deb7u1_i386.deb


So I downloaded the .deb file for dash, tried to install and got dependency errors:
Code:
root@mythtv:/usr/src# dpkg -i dash_0.5.7-3_i386.deb
(Reading database ... 97391 files and directories currently installed.)
Preparing to replace dash 0.5.3-7 (using dash_0.5.7-3_i386.deb) ...
Adding `diversion of /bin/sh to /bin/sh.distrib by dash'
Adding `diversion of /usr/share/man/man1/sh.1.gz to /usr/share/man/man1/sh.distrib.1.gz by dash'
Unpacking replacement dash ...
dpkg: dependency problems prevent configuration of dash:
 dash depends on dpkg (>= 1.15.0); however:
  Version of dpkg on system is 1.14.25.
dpkg: error processing dash (--install):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 dash


So I downloaded the .deb file for dpkg, tried to install and got dependency errors:
Code:
root@mythtv:/usr/src# dpkg -i dpkg_1.16.15_i386.deb
dpkg: regarding dpkg_1.16.15_i386.deb containing dpkg, pre-dependency problem:
 dpkg pre-depends on libc6 (>= 2.11)
  libc6 is installed, but is version 2.9-12.
dpkg: error processing dpkg_1.16.15_i386.deb (--install):
 pre-dependency problem - not installing dpkg
Errors were encountered while processing:
 dpkg_1.16.15_i386.deb


So I downloaded the .deb file for libc6, tried to install and got errors:
Code:
root@mythtv:/usr/src# dpkg -i libc6_2.13-38+deb7u4_i386.deb
(Reading database ... 97395 files and directories currently installed.)
Preparing to replace libc6 2.9-12 (using libc6_2.13-38+deb7u4_i386.deb) ...
Removing obsolete conffile /etc/init.d/glibc.sh ...
Checking for services that may need to be restarted...
Checking init scripts...
No packages found matching libc-bin.
dpkg: error processing libc6_2.13-38+deb7u4_i386.deb (--install):
 subprocess pre-installation script returned error exit status 1
Errors were encountered while processing:
 libc6_2.13-38+deb7u4_i386.deb


So I tried a simulated apt-get install of libc6 from wheezy repository and got TONS of dependency errors:
Code:
root@mythtv:/usr/src# apt-get -s install libc6
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
  binutils cpp cpp-4.7 g++ g++-4.7 gcc gcc-4.7 gcc-4.7-base libc-bin libc-dev-bin libc6-dev libc6-i686 libgcc1 libgmp10 libgomp1 libitm1 libmpc2 libmpfr4
  libquadmath0 libstdc++6 libstdc++6-4.7-dev make multiarch-support pkg-config
Suggested packages:
  binutils-doc cpp-doc gcc-4.7-locales g++-multilib g++-4.7-multilib gcc-4.7-doc libstdc++6-4.7-dbg gcc-multilib manpages-dev automake1.9 flex bison gdb gcc-doc
  gcc-4.7-multilib libmudflap0-4.7-dev libgcc1-dbg libgomp1-dbg libitm1-dbg libquadmath0-dbg libmudflap0-dbg libcloog-ppl0 libppl-c2 libppl7 binutils-gold glibc-doc
  libstdc++6-4.7-doc make-doc
The following packages will be REMOVED:
  g++-4.1 gcc-4.1 libstdc++6-4.1-dev
The following NEW packages will be installed:
  cpp-4.7 g++-4.7 gcc-4.7 gcc-4.7-base libc-bin libc-dev-bin libc6-i686 libgmp10 libitm1 libmpc2 libmpfr4 libquadmath0 libstdc++6-4.7-dev multiarch-support
The following packages will be upgraded:
  binutils cpp g++ gcc libc6 libc6-dev libgcc1 libgomp1 libstdc++6 make pkg-config
11 upgraded, 14 newly installed, 3 to remove and 880 not upgraded.
Inst g++ [4:4.1.1-15] (4:4.7.2-1 Debian:7.6/stable) []
Remv g++-4.1 [4.1.2-18] [libstdc++6-4.1-dev ]
Remv libstdc++6-4.1-dev [4.1.2-18] []
Inst gcc-4.7-base (4.7.2-5 Debian:7.6/stable) []
Conf gcc-4.7-base (4.7.2-5 Debian:7.6/stable) []
Inst libc-dev-bin (2.13-38+deb7u2 Debian:7.6/stable) []
Inst libc-bin (2.13-38+deb7u2 Debian:7.6/stable) [libc-bin on libc6] []
Conf libc-bin broken
 Breaks:libc6
 []
Inst libc6 [2.9-12] (2.13-38+deb7u2 Debian:7.6/stable) [libc6-dev ]
Conf libc6 (2.13-38+deb7u2 Debian:7.6/stable) [libc6-dev ]
Inst multiarch-support (2.13-38+deb7u2 Debian:7.6/stable) [libc6-dev ]
Conf multiarch-support (2.13-38+deb7u2 Debian:7.6/stable) [libc6-dev ]
Remv gcc-4.1 [4.1.2-18] [libc6-dev ]
Inst libstdc++6 [4.2.2-4] (4.7.2-5 Debian:7.6/stable) [libc6-dev ]
Conf libstdc++6 (4.7.2-5 Debian:7.6/stable) [libc6-dev ]
Inst binutils [2.18-1] (2.22-8 Debian:7.6/stable) [libc6-dev ]
Inst make [3.81-3] (3.81-8.2 Debian:7.6/stable) [libc6-dev ]
Inst pkg-config [0.21-1] (0.26-1 Debian:7.6/stable) [libc6-dev ]
Inst libc6-dev [2.9-12] (2.13-38+deb7u2 Debian:7.6/stable) []
Inst libgcc1 [1:4.2.2-4] (1:4.7.2-5 Debian:7.6/stable) []
Conf libgcc1 (1:4.7.2-5 Debian:7.6/stable) []
Inst libgmp10 (2:5.0.5+dfsg-2 Debian:7.6/stable) []
Inst libmpfr4 (3.1.0-5 Debian:7.6/stable) []
Inst libmpc2 (0.9-4 Debian:7.6/stable) []
Inst cpp-4.7 (4.7.2-5 Debian:7.6/stable) []
Inst cpp [4:4.2.1-6] (4:4.7.2-1 Debian:7.6/stable) []
Inst libgomp1 [4.2.2-4] (4.7.2-5 Debian:7.6/stable) []
Inst libitm1 (4.7.2-5 Debian:7.6/stable) []
Inst libquadmath0 (4.7.2-5 Debian:7.6/stable) []
Inst gcc-4.7 (4.7.2-5 Debian:7.6/stable) []
Inst gcc [4:4.2.1-6] (4:4.7.2-1 Debian:7.6/stable) []
Inst libstdc++6-4.7-dev (4.7.2-5 Debian:7.6/stable) []
Inst g++-4.7 (4.7.2-5 Debian:7.6/stable)
Inst libc6-i686 (2.13-38+deb7u2 Debian:7.6/stable)
Conf libgmp10 (2:5.0.5+dfsg-2 Debian:7.6/stable)
Conf libmpfr4 (3.1.0-5 Debian:7.6/stable)
Conf libmpc2 (0.9-4 Debian:7.6/stable)
Conf cpp-4.7 (4.7.2-5 Debian:7.6/stable)
Conf cpp (4:4.7.2-1 Debian:7.6/stable)
Conf binutils (2.22-8 Debian:7.6/stable)
Conf libgomp1 (4.7.2-5 Debian:7.6/stable)
Conf libitm1 (4.7.2-5 Debian:7.6/stable)
Conf libquadmath0 (4.7.2-5 Debian:7.6/stable)
Conf gcc-4.7 (4.7.2-5 Debian:7.6/stable)
Conf gcc (4:4.7.2-1 Debian:7.6/stable)
Conf libc-dev-bin (2.13-38+deb7u2 Debian:7.6/stable)
Conf libc6-dev (2.13-38+deb7u2 Debian:7.6/stable)
Conf libstdc++6-4.7-dev (4.7.2-5 Debian:7.6/stable)
Conf g++-4.7 (4.7.2-5 Debian:7.6/stable)
Conf g++ (4:4.7.2-1 Debian:7.6/stable)
Conf make (3.81-8.2 Debian:7.6/stable)
Conf pkg-config (0.26-1 Debian:7.6/stable)
Conf libc6-i686 (2.13-38+deb7u2 Debian:7.6/stable)
E: Conf Broken libc-bin


Does libc6 mainly contain tools for compiling source code and it won't hurt anything in mythtv to update it?

Eric

_________________
KnoppMyth R5.5, Asus A8N-VM CSM (nvidia 6150 onboard video), AMD Athlon 64 dual-core 4200+, two 1GB sticks DDR 400, HD-3000 HDTV card, PVR-150 card, Iguanaworks RS-232 IR receiver/transmitter, Pioneer DVR-110 DVD burner


Top
 Profile  
 
PostPosted: Fri Sep 26, 2014 7:54 am 
Offline
Joined: Wed Dec 10, 2003 8:31 pm
Posts: 1996
Location: /dev/null
I suspect your dependency issues are due to the fact that (I think) the 5.5 series has been deprecated a number of years ago :/ You might have some luck compiling a patched version of bash yourself and installing manually (ie from the make) without a package manger. I have never attempted replacing a shell like this manually though. One thing is clear: if the upstream code is not maintained, you are asking for problems particular with publicly known exploits that are not patched upstream. For example, heartbleed and Bash CVE-2014-6271 to name a few recent ones.

_________________
Retired KM user (R4 - R6.04); friend to LH users.


Top
 Profile  
 
PostPosted: Fri Sep 26, 2014 9:30 am 
Offline
Joined: Tue Mar 28, 2006 8:26 pm
Posts: 804
Location: Minneapolis, MN
For now, I've turned off the port-forwarding in my router, so access from the outside world to the KM R5.5 box is cut off.

Yes, you are correct. The apt repositories that were in R5.5 when it was created are no longer accessable.
If users want access to the vintage Debian packages, they have to add lines to the /etc/apt/sources.list file such as:
deb http://archive.debian.org/debian/ etch main
deb http://archive.debian.org/debian/ lenny main
That will get you pointed to the Debian packages of the 2008-2009 time period.

If you need newer Debian packages, you need to insert lines like:
deb http://ftp.us.debian.org/debian wheezy main
deb http://security.debian.org/debian-security wheezy/updates main

I suppose I could try a forced install (apt-get -f install bash) and simply not upgrade every single dependency?
I'll have to do a system backup before I try something like that, though...I'd hate to break my working R5.5.

Eric

_________________
KnoppMyth R5.5, Asus A8N-VM CSM (nvidia 6150 onboard video), AMD Athlon 64 dual-core 4200+, two 1GB sticks DDR 400, HD-3000 HDTV card, PVR-150 card, Iguanaworks RS-232 IR receiver/transmitter, Pioneer DVR-110 DVD burner


Top
 Profile  
 
PostPosted: Fri Sep 26, 2014 10:52 am 
Offline
Joined: Wed Dec 10, 2003 8:31 pm
Posts: 1996
Location: /dev/null
neutron68 wrote:
If you need newer Debian packages, you need to insert lines like:
deb http://ftp.us.debian.org/debian wheezy main
deb http://security.debian.org/debian-security wheezy/updates main
...


Does debian support those older releases via backports? To my knowledge, debian != centos in this regard.. but even centos has limits to supported releases...

graysky wrote:
One thing is clear: if the upstream code is not maintained, you are asking for problems particular with publicly known exploits that are not patched upstream. For example, heartbleed and Bash CVE-2014-6271 to name a few recent ones.


neutron68 wrote:
I suppose I could try a forced install (apt-get -f install bash) and simply not upgrade every single dependency?
I'll have to do a system backup before I try something like that, though...I'd hate to break my working R5.5.


I suspect you'd hate to have nasty stuff staged from your working R5.5 box via known exploits :p

_________________
Retired KM user (R4 - R6.04); friend to LH users.


Top
 Profile  
 
PostPosted: Fri Sep 26, 2014 12:50 pm 
Offline
Joined: Tue Mar 28, 2006 8:26 pm
Posts: 804
Location: Minneapolis, MN
Yes, I found there are some Debian backports. For example, I also put this repository in my /etc/apt/sources.list file:
deb http://ftp.us.debian.org/debian wheezy-backports main

Quote:
I suspect you'd hate to have nasty stuff staged from your working R5.5 box via known exploits :p

Exactly right!
My R5.5 machine is cut off from Net login until such a time as I can get a bash update.

Trying to update bash and running into dependency hell has given me an insight into what Cecil must go through when he is trying to roll a release of Linhes, where everything works well together.

Eric

_________________
KnoppMyth R5.5, Asus A8N-VM CSM (nvidia 6150 onboard video), AMD Athlon 64 dual-core 4200+, two 1GB sticks DDR 400, HD-3000 HDTV card, PVR-150 card, Iguanaworks RS-232 IR receiver/transmitter, Pioneer DVR-110 DVD burner


Top
 Profile  
 

Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 5 posts ] 


All times are UTC - 6 hours




Who is online

Users browsing this forum: No registered users and 7 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group

Theme Created By ceyhansuyu