security/tor and security/tor-devel: Syncing the quarterly branch for CVE-2017-8819

[yuri]

Summary

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224335

[yuri]

@tcberner This is trivial, can this be committed?

[tcberner]

You have to ask for an MFH of the original commit :) then use the mfh script:
https://www.freebsd.org/doc/en_US.ISO8859-1/articles/committers-guide/ports.html#ports-qa-misc-commit-mfh

The section 19.6.1 explains how to go about it (as we forogt the MFH-tag in the original :) )

[yuri]

In D13492#282306, @tcberner wrote:

You have to ask for an MFH of the original commit :) then use the mfh script:
https://www.freebsd.org/doc/en_US.ISO8859-1/articles/committers-guide/ports.html#ports-qa-misc-commit-mfh

The section 19.6.1 explains how to go about it (as we forogt the MFH-tag in the original :) )

Ok, it asks me Do you want to commit? (no = start a shell) [y/n].
Should I press y?
Revision is /head:r455329.

[tcberner]

No, first you ask the ports-secteam as described if you are allowed to

[yuri]

In D13492#282323, @tcberner wrote:

No, first you ask the ports-secteam as described if you are allowed to

Ok, so once I ask, and assuming that they okay it, do I have to ask you here again? :)

[yuri]

In D13492#282323, @tcberner wrote:

No, first you ask the ports-secteam as described if you are allowed to

https://www.freebsd.org/doc/en_US.ISO8859-1/articles/committers-guide/ports.html#ports-qa-misc-commit-mfh says When doing the commit, add the branch name to the MFH: line ... It will automatically notify the Ports Security Team ... They will then decide if the commit can be merged.

This sounds like I should just make a commit with MFH: 2017Q4 and then they decide?

[tcberner]

In D13492#282331, @yuri wrote:

In D13492#282323, @tcberner wrote:

No, first you ask the ports-secteam as described if you are allowed to

Ok, so once I ask, and assuming that they okay it, do I have to ask you here again? :)

Jup :) -- but yea, the script will ask you to commit, as you noticd, but will also give you a path to the sparse checkout a few a lines above.
Before commiting, run svn diff in there, and double check if it makes sense :)