Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #224375 > unrolled thread

sources.list for security

Back to article view | Back to linux.debian.user

Contents

  sources.list for security Pierre Frenkiel <p.frenkiel@laposte.net> - 2020-07-05 08:40 +0200
    Re: sources.list for security "der.hans" <deb-user@LuftHans.com> - 2020-07-05 09:00 +0200
    Re: sources.list for security john doe <johndoe65534@mail.com> - 2020-07-05 09:00 +0200
    Re: sources.list for security Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-05 09:40 +0200
      Re: sources.list for security Salvatore Bonaccorso <carnil@debian.org> - 2020-07-05 10:00 +0200
        Re: sources.list for security Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-05 10:50 +0200
          Re: sources.list for security songbird <songbird@anthive.com> - 2020-07-05 16:10 +0200
            Re: sources.list for security Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-05 17:50 +0200
              Re: sources.list for security songbird <songbird@anthive.com> - 2020-07-06 00:20 +0200
                Re: sources.list for security Dan Ritter <dsr@randomstring.org> - 2020-07-06 01:20 +0200
                  Re: sources.list for security songbird <songbird@anthive.com> - 2020-07-06 01:40 +0200
                    Re: sources.list for security Keith bainbridge <keithrbau@gmail.com> - 2020-07-06 04:20 +0200
                    Re: sources.list for security Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-06 08:00 +0200
                      Re: sources.list for security songbird <songbird@anthive.com> - 2020-07-06 19:10 +0200
                Re: sources.list for security Greg Wooledge <wooledg@eeg.ccf.org> - 2020-07-06 14:20 +0200
                  Re: sources.list for security songbird <songbird@anthive.com> - 2020-07-06 19:20 +0200

#224375 — sources.list for security

hi,

I found several proposals for thre security entry

deb http://security.debian.org/ buster/updates main contrib non-free
deb http://security.debian.org/debian-security buster/updates main 
contrib non-free
deb http://deb.debian.org/debian-security/ buster/updates main

which one must be chosen?

best regards,

Pierre Frenkiel

[toc] | [next] | [standalone]

#224378

[Multipart message — attachments visible in raw view] — view raw

Am 05. Jul, 2020 schwätzte Pierre Frenkiel so:

moin moin Pierre,

> I found several proposals for thre security entry
>
> deb http://security.debian.org/ buster/updates main contrib non-free
> deb http://security.debian.org/debian-security buster/updates main contrib 
> non-free
> deb http://deb.debian.org/debian-security/ buster/updates main
>
> which one must be chosen?

Here's what I have in my security file, which was grepped out of
/etc/apt/source.list.

$ cat /etc/apt/sources.list.d/security.list 
deb http://security.debian.org/debian-security buster/updates main contrib
deb-src http://security.debian.org/debian-security buster/updates main
contrib

$ grep secu /etc/apt/sources.list
# deb http://security.debian.org/debian-security buster/updates main contrib
# deb-src http://security.debian.org/debian-security buster/updates main contrib

I'm not using non-free, so don't need that.

If I recall correctly, this system was a Buster install rather than an
upgrade to Buster.

I keep security resources in a seperate file in order to do security-only
updates.

ciao,

der.hans

> best regards,
>
> Pierre Frenkiel
>

-- 
#  https://www.LuftHans.com   https://www.PhxLinux.org
#  "Who decided that holders of government-granted monopolies should
#  determine the future of high tech? I don't remember reading that memo."
#    -- Will Rodger, director of public policy, Computer and Communications
#       Industry Association

[toc] | [prev] | [next] | [standalone]

#224379

On 7/5/2020 8:14 AM, Pierre Frenkiel wrote:
> hi,
>
> I found several proposals for thre security entry
>
> deb http://security.debian.org/ buster/updates main contrib non-free
> deb http://security.debian.org/debian-security buster/updates main
> contrib non-free
> deb http://deb.debian.org/debian-security/ buster/updates main
>
> which one must be chosen?
>

The one you need, they are all identical with the exception of non-free
and contrib.

See (1) for the meaning of those terms.


1)  https://wiki.debian.org/SourcesList#Component

--
John Doe

[toc] | [prev] | [next] | [standalone]

#224384

[Multipart message — attachments visible in raw view] — view raw

On Du, 05 iul 20, 08:14:28, Pierre Frenkiel wrote:
> hi,
> 
> I found several proposals for thre security entry
> 
> deb http://security.debian.org/ buster/updates main contrib non-free
> deb http://security.debian.org/debian-security buster/updates main contrib non-free

[fixed wrapping]

> deb http://deb.debian.org/debian-security/ buster/updates main
>
> which one must be chosen?

According to https://security.debian.org (redirects to 
https://www.debian.org/security) the second entry is correct.

The first one seems to point to the same place as far as I can tell 
(didn't look very deep though).

The third entry appears to be an alternate distribution channel and also 
supports https (in case it matters to you).

I'm using the third, mostly for consistency with the other entries.  
Updated packages have been available as soon as the DSA was sent to 
debian-security-announce.

The 'component' part ('main', etc.) should always match your other 
repositories.

[Rant]
It's confusing that Debian has several schemes for URLs and suites, e.g.  
compare:

    http://security.debian.org/ buster/updates main

with

    http://deb.debian.org/debian buster-updates main


It would be less confusing if all repositories had the same URL and used 
only the 'suite' part to distinguish them ('stable', 'stable-security', 
etc.).

Hopping this will be fixed for 'bullseye'...

(this message is BCCd to Security and FTPMaster teams)

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#224385

hi,

On Sun, Jul 05, 2020 at 10:34:30AM +0300, Andrei POPESCU wrote:
> On Du, 05 iul 20, 08:14:28, Pierre Frenkiel wrote:
> > hi,
> > 
> > I found several proposals for thre security entry
> > 
> > deb http://security.debian.org/ buster/updates main contrib non-free
> > deb http://security.debian.org/debian-security buster/updates main contrib non-free
> 
> [fixed wrapping]
> 
> > deb http://deb.debian.org/debian-security/ buster/updates main
> >
> > which one must be chosen?
> 
> According to https://security.debian.org (redirects to 
> https://www.debian.org/security) the second entry is correct.
> 
> The first one seems to point to the same place as far as I can tell 
> (didn't look very deep though).
> 
> The third entry appears to be an alternate distribution channel and also 
> supports https (in case it matters to you).
> 
> I'm using the third, mostly for consistency with the other entries.  
> Updated packages have been available as soon as the DSA was sent to 
> debian-security-announce.
> 
> The 'component' part ('main', etc.) should always match your other 
> repositories.
> 
> [Rant]
> It's confusing that Debian has several schemes for URLs and suites, e.g.  
> compare:
> 
>     http://security.debian.org/ buster/updates main
> 
> with
> 
>     http://deb.debian.org/debian buster-updates main
> 
> 
> It would be less confusing if all repositories had the same URL and used 
> only the 'suite' part to distinguish them ('stable', 'stable-security', 
> etc.).
> 
> Hopping this will be fixed for 'bullseye'...

Please see

https://lists.debian.org/debian-security/2019/06/msg00015.html

and

https://bugs.debian.org/931785

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#224386

[Multipart message — attachments visible in raw view] — view raw

On Du, 05 iul 20, 09:52:25, Salvatore Bonaccorso wrote:
> 
> https://bugs.debian.org/931785

Oups, completely forgot about that, even though I'm subscribed to -doc.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#224396

Andrei POPESCU wrote:
> On Du, 05 iul 20, 09:52:25, Salvatore Bonaccorso wrote:
>>=20
>> https://bugs.debian.org/931785
>
> Oups, completely forgot about that, even though I'm subscribed to -doc.
>
> Kind regards,
> Andrei

  wishlist for an alias to testing so nobody who 
follows testing will need to keep changing their
sources.list every time there is a release.


  songbird

[toc] | [prev] | [next] | [standalone]

#224398

[Multipart message — attachments visible in raw view] — view raw

On Du, 05 iul 20, 09:38:05, songbird wrote:
> Andrei POPESCU wrote:
> > On Du, 05 iul 20, 09:52:25, Salvatore Bonaccorso wrote:
> >>=20
> >> https://bugs.debian.org/931785
> >
> > Oups, completely forgot about that, even though I'm subscribed to -doc.
> 
>   wishlist for an alias to testing so nobody who 
> follows testing will need to keep changing their
> sources.list every time there is a release.

What more than the 'testing' alias are you looking for?

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#224415

Andrei POPESCU wrote:
> On Du, 05 iul 20, 09:38:05, songbird wrote:
>> Andrei POPESCU wrote:
>> > On Du, 05 iul 20, 09:52:25, Salvatore Bonaccorso wrote:
>> >>=3D20
>> >> https://bugs.debian.org/931785
>> >
>> > Oups, completely forgot about that, even though I'm subscribed to -doc.
>>=20
>>   wishlist for an alias to testing so nobody who=20
>> follows testing will need to keep changing their
>> sources.list every time there is a release.
>
> What more than the 'testing' alias are you looking for?

  the one i should use...


  songbird

[toc] | [prev] | [next] | [standalone]

#224416

songbird wrote: 
> Andrei POPESCU wrote:
> > On Du, 05 iul 20, 09:38:05, songbird wrote:
> >> Andrei POPESCU wrote:
> >> > On Du, 05 iul 20, 09:52:25, Salvatore Bonaccorso wrote:
> >> >>=3D20
> >> >> https://bugs.debian.org/931785
> >> >
> >> > Oups, completely forgot about that, even though I'm subscribed to -doc.
> >>=20
> >>   wishlist for an alias to testing so nobody who=20
> >> follows testing will need to keep changing their
> >> sources.list every time there is a release.
> >
> > What more than the 'testing' alias are you looking for?
> 
>   the one i should use...

What problem have you observed that you want to fix?

Testing is, like stable and unstable, a label for a repository
with a specific policy. 

If you use stable as your repo, you will get automatically
transitioned to the new stable when that is deployed. If you
don't want that to happen, you pick the specific stable version
name, like "jessie" or "buster".

If you use testing as your repo, you will get new
partially-broken packages all the time as they pass the test of
being in unstable for ten days without new RC bugs. Technically,
the testing repo is also available under the name of the next
stable major release, so you could use the name "bullseye" right
now and you would eventually end up with a stable bullseye
system. But if you use "testing", it will always be testing.

Does that help?

-dsr- 

[toc] | [prev] | [next] | [standalone]

#224417

Dan Ritter wrote:
> songbird wrote: 
>> Andrei POPESCU wrote:
...
>> >>   wishlist for an alias to testing so nobody who=20
>> >> follows testing will need to keep changing their
>> >> sources.list every time there is a release.
>> >
>> > What more than the 'testing' alias are you looking for?
>> 
>>   the one i should use...
>
> What problem have you observed that you want to fix?

  i want the line that goes into the /etc/apt/sources.list
file for testing security updates.


...
> Does that help?

  no, i understand all that, i've been using Debian since
around potato.

  some time ago there was a change made to the sources 
list names for security and i never saw the one for 
testing come by (i may have missed it) so i'm asking...  :)


  songbird

[toc] | [prev] | [next] | [standalone]

#224418

On 6/7/20 9:31 am, songbird wrote:
>    some time ago there was a change made to the sources
> list names for security and i never saw the one for
> testing come by (i may have missed it) so i'm asking...:)


Good afternoon


This is what my sources.list looked like when I first installed testing 
early 2019 - with # added to some lines


There is a security line included which may help you.


deb http://deb.debian.org/debian bullseye  main contrib non-free
#deb-src http://deb.debian.org/debian buster main contrib non-free

#deb http://deb.debian.org/debian buster-updates main contrib non-free
#deb-src http://deb.debian.org/debian buster-updates main contrib non-free

#deb http://security.debian.org/debian-security/ buster/updates main 
contrib non-free
#deb-src http://security.debian.org/debian-security/ buster/updates main 
contrib non-free
#deb http://ftp.debian.org/debian buster-backports main



deb http://security.debian.org/debian-security bullseye-security main 
contrib non-free
#deb-src http://security.debian.org/debian-security bullseye-security 
main contrib non-free

#deb http://deb.debian.org/debian/ sid main contrib non-free
#deb http://deb.debian.org/debian/ experimental main contrib non-free


Sorry - I just remembered I could have saved the original file.




-- 

Keith Bainbridge

keithrbau@gmail.com

0447 667468

[toc] | [prev] | [next] | [standalone]

#224424

[Multipart message — attachments visible in raw view] — view raw

On Du, 05 iul 20, 19:31:54, songbird wrote:
> 
>   i want the line that goes into the /etc/apt/sources.list
> file for testing security updates.

'testing' receives security updates via 'unstable', there is no separate 
repository.

https://www.debian.org/security/faq#testing

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#224449

Andrei POPESCU wrote:
...
> 'testing' receives security updates via 'unstable', there is no separate=20
> repository.
>
> https://www.debian.org/security/faq#testing

  ok, thanks!  :)  i am fine with that.

  i had an old line in the sources.list that no longer 
was useful.  got rid of that, cleaned up my lists and 
updated them all again to make sure there's no cruft 
hanging around.


  songbird

[toc] | [prev] | [next] | [standalone]

#224436

> >> >> https://bugs.debian.org/931785

Which says "security suite renamed to bullseye-security (from
buster/updates)".

On Sun, Jul 05, 2020 at 05:44:44PM -0400, songbird wrote:
> >>   wishlist for an alias to testing so nobody who=20
> >> follows testing will need to keep changing their
> >> sources.list every time there is a release.
> >
> > What more than the 'testing' alias are you looking for?
> 
>   the one i should use...

If you are running "eternal testing" (you never convert it to a stable
release), then you HAVE NO security support.  None.  There is no line
you should use for security, because there isn't any security.

(Many years ago, someone created a "security for testing" repository,
and for a little while, it was used, but now it just sits there idle
and devoid of packages.  So, while *technically* there is a testing
security repository, it's not really *useful* and it would be a waste
of time and bandwidth to add it to your sources.)

The announcement in question (#931785) is for what the security
repository will be called when bullseye is *stable* and receives
security support.  People who track bullseye at this time in its
lifespan (while it is in testing) may add the security line in
anticipation of it becoming useful once bullseye becomes stable.

Eternal-testing users should only use the one line that points to
the testing repository (two lines if you want deb-src as well).

[toc] | [prev] | [next] | [standalone]

#224450

Greg Wooledge wrote:
...
> If you are running "eternal testing" (you never convert it to a stable
> release), then you HAVE NO security support.  None.  There is no line
> you should use for security, because there isn't any security.

  false.  security updates come via unstable uploads that
migrate depending upon the policies in place.  i'm quite
ok with that process.


> (Many years ago, someone created a "security for testing" repository,
> and for a little while, it was used, but now it just sits there idle
> and devoid of packages.  So, while *technically* there is a testing
> security repository, it's not really *useful* and it would be a waste
> of time and bandwidth to add it to your sources.)
>
> The announcement in question (#931785) is for what the security
> repository will be called when bullseye is *stable* and receives
> security support.  People who track bullseye at this time in its
> lifespan (while it is in testing) may add the security line in
> anticipation of it becoming useful once bullseye becomes stable.
>
> Eternal-testing users should only use the one line that points to
> the testing repository (two lines if you want deb-src as well).

  debug packages are a third.


  songbird

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web