[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#1057755: Qt WebEngine Security Support In Stable



Patrick,


On Wednesday, December 13, 2023 1:14:27 PM MST Patrick Franz wrote:

> > For the Qt and KDE maintainers, how feasible would it be

> > to always make sure an LTS release of Qt is what is shipped in stable

> > releases?

>

> Probably not very feasible.

>

> One issue is that Debian & Qt have different release schedules. Debian

> releases happen roughly every 2 years whereas Qt LTS releases happen

> every 18 months (if they keep the schedule).

> That means that it aligns well for some releases (like trixie), but

> badly for other releases. In the worst case, Qt could be close to 2

> years old when Debian is released if we stick to LTS releases.


Qt has LTS releases about every 18 months and supports them for 36 months (three years).  This means there are always two active LTS releases.  Unless there is an unusually long freeze, stable should end up with a release that has somewhere between 1and 2 years of support.  It might not be perfect, but it is a lot better than what we currently have.


> Another complication is that the KDE regularly requires quite recent

> versions of its dependencies. The KDE 6 megarelease in February requires

> Qt 6.6 and has done so since the first alpha release. In other words, a

> 6-months old LTS Qt was already too old.

> If we have to stick to old KDE versions, the entire KDE stack might be

> out of support before Debian even gets to its first freeze.


The transition to KDE 6 is a bit of a unique situation.  I would imagine that it would need to mature a bit before most people want to be using it (thinking of the old KDE 4 transition, or even the one to KDE 5).  By the time KDE 6 is ready to propagate to stable, I would imagine that there will be a version that is based on an LTS release of Qt.


Looking at KDE’s release information, I see that KDE has an LTS release about 1-2 years.  I am assuming these KDE LTS releases are compatible with Qt LTS releases, although if anyone has any information to the contrary please share.


https://community.kde.org/Schedules/Plasma_5


https://endoflife.date/kde-plasma


How feasible would it be to make sure that stable always ships with paired LTS releases of KDE and Qt?  As you point out above, those release windows might not line up exactly with Debian’s release window, but it seems like it would be an improvement on the current situation.  Beyond security support issues, there would probably be a lot of stability benefits (like KMail not breaking as often).


If you don’t think it is feasible to ship LTS versions of KDE and Qt in stable, how do you propose handling proper security support for KDE and Qt?


--

Soren Stoutner

soren@stoutner.com

Attachment: signature.asc
Description: This is a digitally signed message part.


Reply to: