On Wed, Aug 16, 2023 at 06:20:37PM +0200, Cyril Brulebois wrote:
> Mattia Rizzolo <mattia@debian.org> (2023-08-16):
> > In general, I'd expect you to be building against
> > stable+stable-updates+stable-security, and I suspect you haven't been
> > otherwise you would not have met this issue.
> >
> > Then, once a package has been published through -security, it *also*
> > propagates through -updates after a while anyway.
>
> No.
Sorry, I clearly wrote my email too fast. Everywhere I mentioned
"-updates" I was really only talking about stable-proposed-updates (aka
proposed-updates), not stable-updates.
> > Indeed, you could see
> > it in this case as well in https://tracker.debian.org/pkg/curl :
> > [2023-07-26] Accepted curl 7.88.1-10+deb12u1 (source) into stable-security (Debian FTP Masters) (signed by: Samuel Henrique)
> > [2023-07-30] Accepted curl 7.88.1-10+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Samuel Henrique)
> > In this case, 4 days... But then u2 came along:
> > [2023-08-05] Accepted curl 7.88.1-10+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Samuel Henrique)
> > So u1 was removed from -updates, but since -security nearly never
> > removes old versions there it stays outdated.
> >
> > So, I'd tempt to double check your setup, as your particular case it's
> > a tad hard to hit if the build host is configured correctly.
>
> There seems to be much confusion here:
> - security updates can show up in *stable-proposed-updates* (and get
> replaced as that's the case here).
You said "can", but AFAIK that's pretty much "always" unless something
went wrong somewhere or there are good reason from the SRM side to
reject a security update which.. I guess can happen.
> - you start your mail advocating for including *stable-updates* in the
> build setup, which is definitely a different thing!
Indeed.
In my mind I know very well that proposed-updates and stable-updates are
different things, but my email was indeed very confusing.
But yes, I am advocating for a biuld setups to include
stable-proposed-updates when building for stable and/or
stable-backports.
--
regards,
Mattia Rizzolo
GPG Key: 66AE 2B4A FCCF 3F52 DA18 4D18 4B04 3FCD B944 4540 .''`.
More about me: https://mapreri.org : :' :
Launchpad user: https://launchpad.net/~mapreri `. `'`
Debian QA page: https://qa.debian.org/developer.php?login=mattia `-
Attachment:
signature.asc
Description: PGP signature