On Wed, 24 May 2017 13:02:51 +0000 Scott Kitterman <debian@kitterman.com> wrote: > On May 24, 2017 7:19:43 AM EDT, Rhonda D'Vine <rhonda@deb.at> wrote: > >* Raphael Hertzog <hertzog@debian.org> [2017-05-24 13:00:41 CEST]: > >> On Wed, 24 May 2017, Adrian Bunk wrote: > >> > If the person who did two years ago the jessie backport of a > >package > >> > used by DSA retired from Debian a year ago or is one of the > >> > many > >MIA > >> > developers, how are the machines maintained by DSA kept secure > >today? > >> > >> Adrian, you keep diverting the discussion to something entirely > >> else. I'm stopping here. You are bringing into light known problems > >> that have currently no good answers. But those problems exist with > >> the current policy already. So they are irrelevant in the > >> discussion of my requested change. My request is not making that > >> worse or better. > > > > No, Adrian doesn't do that, that's a very core point. The way you > >handle it noone is able to pick up the package in the way you do it > >without serious effort. You are the user of the package and thus > >have the very internal motivation to keep it there. If you are gone > >noone is > >able to pick it up because it doesn't follow the rules. It is very > >much > >not irrelevant, as much as you like to claim that. > > ... > > This is not correct. Updating the package to the latest 1.8 version > took me less than half an hour. Upgrading the packages using django to accept 1.8 took the LAVA software team of 6 FTE developers 6 MONTHS of work. > The effort to update the package in > backports is trivial for anyone with the level of packaging knowledge > any DD should have. "Serious effort" is way off base. This is not about packaging! This is about upstream changes being required to manage the upgrade from 1.7 to 1.8 and then beyond. It was a MASSIVE effort to get from 1.7 to 1.8, it delayed other upstream development by almost an entire release cycle. -- Neil Williams ============= http://www.linux.codehelp.co.uk/
Attachment:
pgpntrJKc2om6.pgp
Description: OpenPGP digital signature