Bug#913913: Bug#931524: security.debian.org: bullseye security updates may be silently skipped on systems using apt pinning

Path	csiph.com!goblin3!goblin.stu.neva.ru!bolzen.all.de!fu-berlin.de!bofh.it!news.nic.it!robomod
From	Piotr Engelking <inkerman42@gmail.com>
Newsgroups	linux.debian.bugs.dist, linux.debian.security
Subject	Bug#913913: Bug#931524: security.debian.org: bullseye security updates may be silently skipped on systems using apt pinning
Date	Thu, 09 Jul 2020 12:00:01 +0200
Message-ID	<AqBvr-1th-5@gated-at.bofh.it> (permalink)
References	<yhapc-7se-25@gated-at.bofh.it> <yhfyx-1Ye-1@gated-at.bofh.it> <yhgXE-2W8-11@gated-at.bofh.it> <yhhh0-32l-27@gated-at.bofh.it> <wUTxg-66F-7@gated-at.bofh.it> <yhvtE-3d2-19@gated-at.bofh.it> <yhxvs-4o4-29@gated-at.bofh.it> <wUTxg-66F-7@gated-at.bofh.it> <yhxvs-4o4-29@gated-at.bofh.it>
X-Original-To	931524@bugs.debian.org
X-Mailbox-Line	From debian-bugs-dist-request@lists.debian.org Thu Jul 9 09:51:18 2020
Old-Return-Path	<debbugs@buxtehude.debian.org>
X-Spam-Flag	NO
X-Spam-Score	1.452
Reply-To	Piotr Engelking <inkerman42@gmail.com>, 913913@bugs.debian.org
Resent-To	debian-bugs-dist@lists.debian.org
Resent-Cc	APT Development Team <deity@lists.debian.org>
X-Debian-Pr-Message	followup 913913
X-Debian-Pr-Package	apt
X-Debian-Pr-Source	apt
X-Spam-Bayes	score:0.0000 Tokens: new, 23; hammy, 86; neutral, 42; spammy, 0. spammytokens: hammytokens:0.000-+--Klode, 0.000-+--jakdebianorg, 0.000-+--jak@debian.org, 0.000-+--H*f:sk:2019070, 0.000-+--UD:security.debian.org
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=KxRbSGIiWM8+J8H42MQx6F62HB2MVSxKyn0kCpp5Y7w=; b=pqR7S6C6eplsYNG+/IE8CXxaB43N1ZaAy2F/UBLDqQQnwyHgjDgX7f7kI9g5WA7qon Pzdw4ZGGvgvVGhxNPLDrEjXneeVzwRDa5QRsUjv8IrweOfiDYr65mfE+2zMk9m7IsEBp oxJ/i+nf9qaLSvc/r8eaxC/fHxfXkePCS+dkuHW6I2Mm9Qd/xT3b/S4UbQ1q1HyJwvio af16H7gG0wO8MiswmLbteNa9knsXe2wlzYPXgIun4M0RT9aJSTiAtcVIkrmyMA5SfFfq S1y6+Af6eiRtNRP7P8qEkc8uX9tyL5p+bQxy3TubwhNmHcDIyjEytKtCKhISlDzaUhgI X4rA==
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=KxRbSGIiWM8+J8H42MQx6F62HB2MVSxKyn0kCpp5Y7w=; b=psDlK8nyGqvSjM1v0/Q/B79W1aWMIYnG74an2SfHl63uPkfaBV9Ndkz6OEsCRw8oJ/ C1Zu4lfywNcvfNyiwL8PJ7DbQtefr6Lz/VZ5LA32fXfpBrRfDonIUlqdxk7eACKhTd6B vIlNLkt6PZOn6imCvKYXPmZYZNL6kM/hFrO06PRDEwy9+ZLTvoUtdOq+gBPs5N9Baadb sGm/mNc3PXbuPvH4jqd79lirELZH2UYyebABlQJWrHsuXj2K2ECBxTox71hWchVdRGm1 1VuE0rGc6ODHh9342zjgTev1vZJpLZ8fiWt4pq8O/AoiHrHK1i2A5gNKFZ0XXO5qL4sK RJFA==
X-Gm-Message-State	AOAM532uUm5ubscI/+IVHhmV0dwocJUQG5vZePDc4rOkeX+yZf4pbiX0 /MWyUBzHhOCsabKBNQIl88OvueF+W4HfKIMsRo4OdACHF1o=
X-Google-SMTP-Source	ABdhPJwycnwNmrTYTEJpd0RJOWVwkgook2Slhyga27ZYbNminVEUc8Ce4fVoc7Ha2mdontOKlzahaYoUc5t3nHWhMlA=
X-Received	by 2002:a67:2c89:: with SMTP id s131mr42804331vss.26.1594288231624; Thu, 09 Jul 2020 02:50:31 -0700 (PDT)
MIME-Version	1.0
Content-Type	text/plain; charset="UTF-8"
X-Debian-Message	from BTS
X-Mailing-List	<debian-bugs-dist@lists.debian.org> archive/latest/1612715
List-ID	<debian-bugs-dist.lists.debian.org>
List-URL	<https://lists.debian.org/debian-bugs-dist/>
Approved	robomod@news.nic.it
Lines	13
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Cc	913913@bugs.debian.org, debian-security@lists.debian.org
X-Original-Date	Thu, 9 Jul 2020 11:50:19 +0200
X-Original-Message-ID	<CAGHZ3h1cR+Ap1OG91xPJVLCN4wYCOKHmMM8JQB+xCGJj60wtWQ@mail.gmail.com>
X-Original-References	<CAGHZ3h1R2iQpUbjNs7hoZ-5XdNkAYoDdEb7D+7wxnbeFnBtcxA@mail.gmail.com> <20190707133418.GC21710@eldamar.local> <CAGHZ3h1c=oZSKk9O-fgMR52mOspfEPvKZsQCjM9a5fSF0nkmhQ@mail.gmail.com> <20190707171547.GA3977@debian.org> <154240184568.27363.9372083867833607214.reportbug@hopa.kiewit.dartmouth.edu> <CAGHZ3h3_v1qjN5ttsv76tZKTc6c+zsJKNvXUsuydQn2Ez+nkDA@mail.gmail.com> <20190708104246.GA21388@debian.org> <154240184568.27363.9372083867833607214.reportbug@hopa.kiewit.dartmouth.edu> <20190708104246.GA21388@debian.org>
Xref	csiph.com linux.debian.bugs.dist:1017158 linux.debian.security:5848

Cross-posted to 2 groups.

Show key headers only | View raw

Julian Andres Klode <jak@debian.org>:

> This seems the "best" outcome. In any case, we have about 2 years to
> figure this out and should keep things this way for now.

[...]

> Anyhow, we've got two years to fix this, no need to rush a "fix" out
> now.

One year has passed without rushing a fix, or any other action.

Are there any plans to address the issue before security updates start breaking?

Back to linux.debian.security | Previous | Next | Find similar | Unroll thread

Thread

Bug#913913: Bug#931524: security.debian.org: bullseye security updates may be silently skipped on systems using apt pinning Piotr Engelking <inkerman42@gmail.com> - 2020-07-09 12:00 +0200

csiph-web