On Sun, 19 Oct 2025 22:28:14 +0800 xiao sheng wen(肖盛文) <atzlinux@debian.org> wrote: > Hi, > > 在 2025/10/18 06:35, Aaron Rainbolt 写道: > > On Fri, 17 Oct 2025 23:27:09 +0100 > > Simon McVittie <smcv@debian.org> wrote: > > > >> On Fri, 17 Oct 2025 at 14:27:32 -0500, Aaron Rainbolt wrote: > >>> The Debian Policy manual states in section 2.2.1: > >>> > >>>> In addition, the packages in main > >>>> ... > >>>> * must not be so buggy that we refuse to support them... > >>> > >>> I would argue Stardict is this buggy. > >> > >> If that's the case, the first place to report it would be a RC bug > >> against the stardict package (and if the stardict maintainer > >> downgrades the severity of RC bugs in a way that is contrary to > >> project consensus, the group that can overrule them is the release > >> team or the technical committee). > > > > This has already happened. See > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1110370, which was > > filed with severity "critical" and tag "security", and which the > > maintainer changed to severity "wishlist" and removed the "security" > > tag from. The maintainer later upgraded the severity to "Important", > > but still did not leave it release-critical, thus why the > > vulnerability still exists in Trixie. > > About fix this vulnerability in Trixie, Please see: > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1113750 > > The Debian Release Team will review it before next stable point > release. I had overlooked that, thank you for pointing it out. I guess the central "goal" of my email was to try to find a way to keep password or similar leaks. In your opinion, do you think this issue or a similar one has a high chance of occurring again in the future, or do you think that this probably won't be a problem in the long run for Forky and later? If it isn't going to resurface, then I don't think there's any good reason for my initial request for package removal to be considered. Thanks for your time. -- Aaron > Regards, >
Attachment:
pgpkVCwRgS8hY.pgp
Description: OpenPGP digital signature