Re: Unofficial Debian 'testing' FAQ (was Re: Packages in queue for woody?)
On Sat, Dec 08, 2001 at 07:46:11PM +0100, Jan Nieuwenhuizen wrote:
> Jules Bean <jules@jellybean.co.uk> writes:
> I'm missing the most important question:
> 1.1 Is testing secure?
That's not a really well formed question.
1.1 How are security updates for testing managed?
They're not. [...]
might give a better way of looking at it.
Security updates generally go in automatically under the usual
rules (and security updates should generally be uploaded with high or
emergency/critical urgency to make sure the wait's as short as possible),
but may be delayed either by architectures failing to build them, or
because of dependency issues.
There's support in the code for (or, at least, I'm willing to support)
a security team to upload security fixes compiled with the versions of
various libraries in testing to woody-proposed-updates and have them
be added immediately, but there's no security team who have the time to
track security problems in testing/unstable and do uploads, or for that
matter, machines to do the uploads from.
> At least, that is how I understand it; maybe things have changed?
I don't know of any way to make testing significantly more secure without
either (a) breaking it, or (b) having some people spend significant amounts
of time tracking the issues. I'm
Cheers,
aj
Reply to: