Changeset 064f420

Timestamp:

04/21/2022 03:24:04 PM (2 years ago)

Author:

William Harrington <kb0iic@…>

Branches:

arm

Children:

f9dc44bc

Parents:

3d6553b4

git-author:

Xi Ruoyao <xry111@…> (04/20/2022 10:47:24 AM)

git-committer:

William Harrington <kb0iic@…> (04/21/2022 03:24:04 PM)

Message:

generalize the note about removed and vulnerably releases

File:

• chapter03/packages.xml (modified) (2 diffs)

chapter03/packages.xml

@@ -11 +11 @@
   <title>All Packages</title>
 
+  <note>
+    <para>Read the <ulink url='&secadv;'>security advisories</ulink>
+    before downloading packages to figure out if a newer version of any
+    package should be used to avoid security vulnerabilities.</para>
+
+    <para>The upstreams may remove old releases, especially when these
+    releases contain a security vulnerability.  If one URL below is not
+    reachable, you should read the security advisories first to figure out
+    if a newer version (with the vulnerability fixed) should be used.  If
+    not, try to download the removed package from a mirror.  Although it's
+        possible to download an old release from a mirror even if this release
+        has been removed because of a vulnerability, it's not recommended to
+        use a release known to be vulnerable for building your system.</para>
+  </note>
+
   <para>Download or otherwise obtain the following packages:</para>
 
@@ -174 +189 @@
         <para>Download: <ulink url="&expat-url;"/></para>
         <para>MD5 sum: <literal>&expat-md5;</literal></para>
-        <note>
-          <para>The upstream may remove tarballs of the specific releases of
-          <application>Expat</application> when these releases contain a
-          security vulnerability.  You should refer to
-          <ulink url='&lfs-root;lfs/advisories/'>LFS security advisories</ulink>
-          to figure out which version (with the vulnerability fixed) should
-          be used.  You may download the vulnerable version from a mirror,
-          but it's not recommended.</para>
-        </note>
       </listitem>
     </varlistentry>