Date: Thu, 29 Apr 2021 12:40:25 +0000 (UTC)
From: Ted Trask <ttrask01@yahoo.com>
To: 
	"~alpine/devel@lists.alpinelinux.org" <~alpine/devel@lists.alpinelinux.org>, 
	Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
Message-ID: <1461898156.1109064.1619700025076@mail.yahoo.com>
In-Reply-To: <AM6PR03MB471108D90553846834729307B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
References: <AM6PR03MB4711B475D15586303F7AD1B8B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com> <755786165.1114022.1619696808923@mail.yahoo.com> <AM6PR03MB471108D90553846834729307B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
Subject: Re: Security dispute over nodejs vulnerability in Alpine - Help!
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

> I=E2=80=99m asking ultimately, is this: If the node community indicated a=
 certain CVE is fixed in version X, why would Alpine indicate a different v=
ersion? Is it merely an issue of testing, and the fact that version X was n=
ot certified to be used with a certain branch of Alpine, or is there a diff=
erent reason?

Alpine Linux does not and will not support mixing repositories. You can do =
so, but you are on your own.

> / # apk add --repository http://dl-cdn.alpinelinux.org/alpine/v3.11/main =
--no-cache nodejs=3D12.22.1-r0
>=C2=A0fetch http://dl-cdn.alpinelinux.org/alpine/v3.11/main/x86_64/APKINDE=
X.tar.gz
>=C2=A0fetch https://dl-cdn.alpinelinux.org/alpine/v3.13/main/x86_64/APKIND=
EX.tar.gz
>=C2=A0fetch=C2=A0https://dl-cdn.alpinelinux.org/alpine/v3.13/community/x86=
_64/APKINDEX.tar.gz

This. What you do here is the cause of the problem. We do not support mixin=
g 3.11 packages and 3.13 packages.

Ted Trask