Re: Bug#910398: stretch-pu: package gnupg2/2.1.18-8~deb9u3

[Daniel Kahn Gillmor <dkg@fifthhorseman.net>]

Hi Adam--

On Tue 2018-10-23 16:18:05 +0100, Adam D. Barratt wrote:

> Sure, but that's not what I said. My distinction was between including 
> the gnupg update in the point release versus pushing it more urgently 
> via stable-updates. I never implied the updates shouldn't be released at 
> all.

thanks for the clarification, i didn't understand that distinction.  I'm
glad you're considering it at least for the point release.

> FWIW I don't recognise that characterisation. Yes, I should have 
> confirmed the Security Team's intentions at an earlier point, but I 
> don't consider that buck-passing or the situation deadlocked.

fwiw, i'd heard privately earlier from the security team that they don't
see this fix as in their bailiwick, but they hadn't responded to my
requests for comments in public on the BTS.  So the deadlock
misperception may have been due to what looked like a longer delay from
my vantage point.

I'm glad it's not deadlock!

    --dkg