Ola Lundqvist <ola@inguza.com> writes:
> In this case I think we should issue one DLA and tell all the packages that
> have been updated at the same time. This require some rephrasing compared
> to a standard DLA but I do not think we should have a lot of them.
>
> This considering that we have fixed all the packages that require re-build.
>
> I think it will be difficult to syncronize the fix of several
> vulnerabilities. This could be done in some specific cases, but generally I
> think we should accept that we have multiple uploads.
I think the problem here, like you say, generally the fix to the library
needs to be done first and uploaded first, before the dependency
packages.
During which time, people might complain that there was a package
uploaded without a DLA. Which is fair enough.
The big problem with trying to upload multiple packages at the same time
is that the autobuilders could pick up the old library on some
architectures (i.e. the library hasn't been built on that platform yet).
Really need to make sure that the library has been uploaded and built on
all platforms before you upload the dependencies.
--
Brian May <bam@debian.org>