Workflow for handling security issues in testing

From	Jonathan Nieder <jrnieder@gmail.com>
Newsgroups	linux.debian.security, linux.debian.devel.release
Subject	Workflow for handling security issues in testing
Date	2018-05-30 18:10 +0200
Message-ID	<vVbPH-2ht-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

Hi,

https://security-tracker.debian.org/tracker/CVE-2018-11235
(https://public-inbox.org/git/xmqqy3g2flb6.fsf@gitster-ct.c.googlers.com/)
reminded me that I don't fully understand the process for handling
embargoed security issues in sid and testing.

When preparing updates for an embargoed issue in stable
(https://www.debian.org/doc/manuals/developers-reference/ch05.en.html#bug-security),
the packager uploads to security-master and auto-builders are able to
build for supported platforms before the embargo expires.  Once the
embargo expires, the package is released and available quickly for
users to upgrade.

After preparing updates for an embargoed issue in sid, the packager
uploads to ftp-master once the embargo expires.  There is an additional
delay for auto-builders to build the package before the binary package
is available, unless the packager prepares binary packages locally in
advance and uploads them as well.  Is that the recommended practice?

With severity=high, a security fix then takes two more days before it
hits testing.  Is there a way to expedite it?  My experience with
https://bugs.debian.org/871823 was "no".

Is my understanding correct?  Any other points?

Thanks,
Jonathan

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Workflow for handling security issues in testing Jonathan Nieder <jrnieder@gmail.com> - 2018-05-30 18:10 +0200
  Re: Workflow for handling security issues in testing Niels Thykier <niels@thykier.net> - 2018-05-30 21:00 +0200
    Re: Workflow for handling security issues in testing Jonathan Nieder <jrnieder@gmail.com> - 2018-06-01 07:40 +0200
      Re: Workflow for handling security issues in testing Adrian Bunk <bunk@debian.org> - 2018-06-01 21:20 +0200
        Re: Workflow for handling security issues in testing Adrian Bunk <bunk@debian.org> - 2018-06-02 12:10 +0200
      Re: Workflow for handling security issues in testing Niels Thykier <niels@thykier.net> - 2018-06-04 08:00 +0200

csiph-web