Seen an article about big vulnerability discovered in nss package lower than 3.73. Searching on main arch core repo nss was updated to 3.73 but on artix we are still on 3.72. The question is, why we are still on 3.72, is because init system differences or this is just a small delay? Cheers and tnx for the answers in the case will be any :P
nss vuln article (https://www.bleepingcomputer.com/news/security/mozilla-fixes-critical-bug-in-cross-platform-cryptography-library/)
Thx for the link. Noticed an update on nss today but didn't check the changes.
You could update directly from the Arch repo. I didn't see it has any dependencies on systemd. Give them some time to re-package in Artix repo.
Yeah sure will be available in short time to 3.73, very interesting how all this update things work. For example on arch linux kernel is on 5.15.5 on core repo (you would expect this one to be more up to date because it's about core packages) and on extra repo linux-hardened is even newer 5.15.6. Shouldn't be nss on extra repo from arch and not on core? Because we on artix don't have core repo enabled because of those init related changes
Looked closely to the nss 3.72 and on artix the package is slightly bigger than that from arch. So for sure is built differently having in mind artix specifics. Being a very important package as it involves cryptography maybe that's why it needs more time. Someone correct me if i'm talking nonsense here :-[
Seems that they've been working on it.
https://gitea.artixlinux.org/packagesN/nss
Now they pushed the update it was just a small delay