[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: fixing in oldstable before unstable (was Re: Wheezy update of tre?)


Do we really want LTS mailinglist filled with a lot of unstable bug updates?

I think we should file a bug with unstable version number, but write that the origin is that it was found in wheezy. Is that the same as "found" follow up?
The other alternative is that we file the bug with wheezy version number and then close that one in wheezy-security upload.

If we file the bug with wheezy version number and not closing it in wheezy upload, then it will look like the issue is still there in bts.

// Ola

On 21 October 2016 at 12:27, Guido Günther <agx@sigxcpu.org> wrote:
On Fri, Oct 21, 2016 at 11:14:24AM +0100, Chris Lamb wrote:
> Guido Günther wrote:
> > > or at least amend LTS-policies to always file a bug if one fixes a bug
> > > in LTS which is still open in sid.
> >
> > I think the later part is already LTS policy since at latest
> > Debconf 16. It's up to us to handle things like that.
> Let's make this more concrete. Do we have a template? If not, how about:
>   To: submit@bugs.debian.org
>   Subject: ${SOURCE}: CVE-2016-1234: ${CVE_DESCRIPTION}
>   Source: ${SOURCE}
>   Version: ${VERSION}
>   Severity: serious
>   Tags: security
>   X-Debbugs-Cc: debian-lts@lists.debian.org
>   Hi,
>   The following vulnerabilities have been published for ${SOURCE}:
>   https://security-tracker.debian.org/tracker/CVE-2016-1234
>   If you fix the vulnerability please also make sure to include the
>   CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
>   Please adjust the affected versions in the BTS as needed.

I'd just use bin/report-vuln ?

> Open questions for me are:
> a) What Version we submit with? Wheezy's? Or unstable's, and then follow-up
> with "found"?

I'd say unstable and then "found".
 -- Guido

 --- Inguza Technology AB --- MSc in Information Technology ----
/  ola@inguza.com                    Folkebogatan 26            \
|  opal@debian.org                   654 68 KARLSTAD            |
|  http://inguza.com/                Mobile: +46 (0)70-332 1551 |
\  gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9  /

Reply to: