Re: Finding rough consensus on level of vendoring for large upstreams
On Thu, Sep 02, 2021 at 11:38:35PM +0100, Phil Morrell wrote:
>...
> 4. When 2 or 3 are too onerous to maintain, the package MAY use the
> convenience copy but MUST document why in README.source and SHOULD be
> included in the [security-tracker].
>...
The package MUST be listed as being without security support in
the debian-security-support package and the Release Notes,
and it MUST NOT be installed as part of a default installation,
unless the security team has explicitly agreed to support it.
If we are shipping software where Debian cannot provide security support,
then we shouldn't hide the problem from our users.
cu
Adrian
Reply to: