Re: missing recommends are not RC severity
On Tue, Apr 17, 2018 at 09:21:31AM -0400, Jeremy Bicha wrote:
> On Tue, Apr 17, 2018 at 9:16 AM, Holger Levsen <holger@layer-acht.org> wrote:
> > (not sure this makes sense as the practical impact is a normal bug, but
>
> Since I was CC'd on this email and I've filed several Serious bugs for
> this issue, here is what I've been using lately:
>
> "It is my understanding that is a RC bug for package to recommend a
> library that has been removed from Testing because recommended
> packages won't be auto-removed on upgrade."
>
> That means users will have libraries installed that will not get any
> security support. I think that's an RC issue.
>
Except that the reasoning breaks down when you consider that
auto-removal of packages is a function of the package management front
end and not of dpkg itself (which is responsible for validating the
relationships between packages).
There are plenty of available tools to identify system cruft, including
packages that are no longer receiving security support and packages
which do not exist in the current suite/release for which the system is
configured.
Regards,
-Roberto
--
Roberto C. Sánchez
Reply to: