Re: Unofficial Debian 'testing' FAQ (was Re: Packages in queue for woody?)
Anthony Towns <ajt@master.debian.org> writes:
> > 1.1 Is testing secure?
>
> That's not a really well formed question.
>
> 1.1 How are security updates for testing managed?
>
> They're not. [...]
>
> might give a better way of looking at it.
Yes, that's much better.
> Security updates generally go in automatically under the usual
> rules (and security updates should generally be uploaded with high or
> emergency/critical urgency to make sure the wait's as short as
> possible),
Ah, so higher urgencies can have shorter wait times? Also, 'as short
as possible' is nice, but it doesn't promise anything; you'd want to
know the maximum wait, rather than the minimum.
> but may be delayed either by architectures failing to build them, or
> because of dependency issues.
Ok, and this is excactly what I'm interested in having explained about
testing. Theoretically, an urgent security fix could have to wait
forever before it enters testing? Security fixes for non-x86
architectures seem to be even more at risk of a longer wait.
> I don't know of any way to make testing significantly more secure without
> either (a) breaking it, or (b) having some people spend significant amounts
> of time tracking the issues.
Yes, that seems to be the dilemma right now.
Greetings,
Jan.
--
Jan Nieuwenhuizen <janneke@gnu.org> | GNU LilyPond - The music typesetter
http://www.xs4all.nl/~jantien | http://www.lilypond.org
Reply to: