From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <alexander.turenko@tarantool.org>
Received: from smtp63.i.mail.ru (smtp63.i.mail.ru [217.69.128.43])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by dev.tarantool.org (Postfix) with ESMTPS id D4782445320
 for <tarantool-patches@dev.tarantool.org>;
 Thu, 16 Jul 2020 21:02:53 +0300 (MSK)
Date: Thu, 16 Jul 2020 21:02:06 +0300
From: Alexander Turenko <alexander.turenko@tarantool.org>
Message-ID: <20200716180206.tamvh5y2qbbuxqnj@tkn_work_nb>
References: <b5fb66465c420ec3a0f642692d769ada6c76b573.1594912145.git.avtikhon@tarantool.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <b5fb66465c420ec3a0f642692d769ada6c76b573.1594912145.git.avtikhon@tarantool.org>
Subject: Re: [Tarantool-patches] [PATCH v1] Bump curl repository to 7.71.1
	version
List-Id: Tarantool development patches <tarantool-patches.dev.tarantool.org>
List-Unsubscribe: <https://lists.tarantool.org/mailman/options/tarantool-patches>, 
 <mailto:tarantool-patches-request@dev.tarantool.org?subject=unsubscribe>
List-Archive: <https://lists.tarantool.org/pipermail/tarantool-patches/>
List-Post: <mailto:tarantool-patches@dev.tarantool.org>
List-Help: <mailto:tarantool-patches-request@dev.tarantool.org?subject=help>
List-Subscribe: <https://lists.tarantool.org/mailman/listinfo/tarantool-patches>, 
 <mailto:tarantool-patches-request@dev.tarantool.org?subject=subscribe>
To: "Alexander V. Tikhonov" <avtikhon@tarantool.org>
Cc: tarantool-patches@dev.tarantool.org

> Bump curl repository to 7.71.1 version

Nit: I would say that we update a submodule here (not a repository),
because 'bump repository' looks as `git push` action for me.

Please, add a prefix (I suggest 'build').

See [1] for example.

>
> Check the new version.

To solve a problem, right? Please, clarify it or at least mention it.
AFAIR, I described the security problem that is related for us in the
issue (there are two security problems, but only one looks related to
us).

> 
> Closes #4698
> ---
> 
> Github: https://github.com/tarantool/tarantool/tree/avtikhon/gh-4698-curl-7-71-1
> Issue: https://github.com/tarantool/tarantool/issues/4698
> 
>  third_party/curl | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/third_party/curl b/third_party/curl
> index 9cd755e1d..12af024bc 160000
> --- a/third_party/curl
> +++ b/third_party/curl
> @@ -1 +1 @@
> -Subproject commit 9cd755e1d768bbf228e7c9faf223b7459f7e0105
> +Subproject commit 12af024bc85606b14ffc415413a7e86e6bbee7eb

Please, checkout the curl-7_71_1 tag, not the HEAD of
curl-7_71_1-tarantool branch, which is for building using CMake. See [2]
starting from words "Please, don't mix".

[1]: https://github.com/tarantool/tarantool/commit/4c2d1eff29848cc2ed47cd1d3ca23152fed2e3b9
[2]: https://lists.tarantool.org/pipermail/tarantool-patches/2020-July/018443.html