Question about GURU's dev-ml/ollama

[redblade7]

Hi,

Recently dev-ml/ollama was added to the GURU repository. Today I heard of a serious security bug in the news with ollama, fixed in version 0.1.34. But the dev-ml/ollama is version "9999" and running "ollama --version" reports version number "0.0.0" Does anyone know anything about this ebuild or what version it is, or whether the security bug will be fixed?

Thank you!

[Hu]

Normally, a version -9999 ebuild is whatever was current in master at the moment you built it. Therefore, whether it includes the fix of interest depends on whether that fix was in master when you last built that version.

The internally reported version of 0.0.0 is probably because the upstream project does not maintain a proper version number in source control, and instead patches that in as part of the release process. If so, the reported version is meaningless.

I cannot comment on when or if the upstream project will fix the bug. Since you did not link to any of the news, I do not know what security bug you mean.

[redblade7]

Normally, a version -9999 ebuild is whatever was current in master at the moment you built it. Therefore, whether it includes the fix of interest depends on whether that fix was in master when you last built that version.

The internally reported version of 0.0.0 is probably because the upstream project does not maintain a proper version number in source control, and instead patches that in as part of the release process. If so, the reported version is meaningless.

I cannot comment on when or if the upstream project will fix the bug. Since you did not link to any of the news, I do not know what security bug you mean.

https://www.theregister.com/2024/06/24/rce_ollama_wiz/

[Banana]

The commits from the mentioned tag in the news, are merged into the main branch, which is the default branch in the repo. The ebuild does use this repo and its default branch. So the fix should be in there.

[eugene-bright]

"ollama --version" reports version number "0.0.0"

Here is the ebuild fix, the version will be reported correctly as soon as it's accepted (for the new builds of course)
https://github.com/gentoo/guru/pull/205