repost from http://layer-acht.org/thinking/blog/20150205-lts-january-2015/ (it's better formatted there) # My LTS January It was very nice to hear many appreciations for our work on [Squeeze LTS] (https://wiki.debian.org/LTS) during the last weekend at FOSDEM. People really seem to like and use LTS a lot - and start to rely on it. I was approached more than once about Wheezy LTS already... (Most of my FOSDEM time I spent with [reproducible builds] (https://fosdem.org/2015/schedule/event/stretching_out_for_trustworthy_reproducible_builds/) however, though this shall be the topic of another report, coming hopefully soon.) So, about LTS. First I'd like to describe some current practices clearly: * the Squeeze LTS team might fix your package without telling the maintainers in advance nor directly: dak will send a mail as usual, but that might be the only notification you'll get. (Plus the DLA send out to the [debian-lts- announce](https://lists.debian.org/debian-lts-announce/) mailing list.) * when we fix a package we will likely *not* push these changes into whatever VCS is used for packaging. So when you start working on an update (which is great), please check whether there has been an update before. (We don't do this because we are mean, but because we normally don't have commit access to your VCS... * we totally appreciate help from maintainers and everybody else too. We just don't expect it, so we don't go and ask each time there is a DLA to be made. Please do support us & please do talk to us! :-) I hope this clarifies things. And as usual, things are open for discussion and best practices will change over time. In January 2014 I spent 12h on Debian LTS work and managed to get four DLAs released, plus I've marked some CVEs as not affecting squeeze. The DLAs I released were: * [DLA 139-1 for eglibc](https://lists.debian.org/debian-lts- announce/2015/01/msg00012.html) fixing CVE-2015-0235 also known as the "Ghost" vulnerability. The update itself was simple, testing needed some more attention but then there were also many many user requests asking about the update, and some were providing fixes too. And then many people were happy, though one person seriously complained at FOSDEM that the squeeze update was released full six hours after the wheezy update. I think I didn't really reply to that complaint, though obviously this person was right ;) * [DLA 140-1 for rpm](https://lists.debian.org/debian-lts- announce/2015/01/msg00013.html) was quite straightforward to do, thanks to RedHat unsurprisingly providing patches for many rpm releases. There was just a lots of unfuzzying to do... * [DLA 141-1 for libksba](https://lists.debian.org/debian-lts- announce/2015/01/msg00015.html) had an easy to pick git commit in upstreams repo too, except that I had to disable the testsuite, but given the patch is 100% trivial I decided that was a safe thing to do. * [DLA 142-1 for privoxy](https://lists.debian.org/debian-lts- announce/2015/01/msg00016.html) was a bit more annoying, despite clearly available patches from the maintainers upload to sid: first, I had to convert them from quilt to dpatch format, then I found that 2 ouf 6 CVEs were not affecting the squeeze version as the code ain't present and then I spent almost an hour in total to find+fix 10 whitespace difference in 3 patches. At least there was one patch which needed some more serious changes ;-) Thanks to everyone who is supporting Squeeze LTS in whatever form! We like to hear from you, we love your contributions, but it's also totally ok to silently enjoy a good old quality distribution :-) Finally, something for the future: checking for previous DLAs is currently best done via said mailing list archive, as DLAs are not yet integrated into the website due to a dependency loop of blocking bugs... see [#761945] (https://bugs.debian.org/761945) for a starting point.
Attachment:
signature.asc
Description: This is a digitally signed message part.