Bug 13516

Summary: suricata: Upgrade to version 7
Product: IPFire Reporter: Michael Tremer <michael.tremer>
Component: ---Assignee: Adolf Belka <adolf.belka>
Status: CLOSED FIXED QA Contact:
Severity: - Unknown -    
Priority: - Unknown - CC: adolf.belka, arne.fitzenreiter, peter.mueller
Version: 2   
Hardware: unspecified   
OS: Unspecified   

Description Michael Tremer 2024-01-09 11:15:22 UTC
suricata 7 haČ™ been released and seems to be stable enough for prime time.

As far as I can see, we have all prerequisites so that we should be able to upgrade easily.
Comment 1 Adolf Belka 2024-02-07 10:24:22 UTC
Patch set submitted.

libhtp had to be updated to 0.5.45

elfutils had to be made a core program as suricata-7 requires libelf.so.1 to be available when running. Earlier suricata versions only needed elfutils to be available during the build.

Changing elfutils to a core program required updates of those addons having elfutils as a dependency.

https://lists.ipfire.org/hyperkitty/list/development@lists.ipfire.org/thread/JOSPDTXSJF4WU4NMSDX2QQJK3234YYGX/

https://patchwork.ipfire.org/project/ipfire/list/?series=4150
Comment 2 Michael Tremer 2024-02-07 11:14:18 UTC
(In reply to Adolf Belka from comment #1)
> Patch set submitted.

Great!

I have merged the elfutils part because that is kind of independent from suricata and what can be shipped I would like to ship :)

On Suricata itself I am not so sure if this should be part of c184 because hopefully that will go into testing phase this week. That might be too short notice for Suricata, especially looking at the other changes that we still have left to do.
Comment 3 Adolf Belka 2024-02-07 11:58:11 UTC
(In reply to Michael Tremer from comment #2)
> I have merged the elfutils part because that is kind of independent from
> suricata and what can be shipped I would like to ship :)

Makes sense.

> 
> On Suricata itself I am not so sure if this should be part of c184 because
> hopefully that will go into testing phase this week. That might be too short
> notice for Suricata, especially looking at the other changes that we still
> have left to do.

That is a very good point. All I have done is show that it started. As it is a major version change we shouldn't rush it too fast.