Bug#992330: bullseye-pu: package nova/22.2.2-1+deb11u1 (CVE-2021-3654)

[Thomas Goirand <zigo@debian.org>]

On 8/19/21 9:26 PM, Salvatore Bonaccorso wrote:
> Hi Thomas,
> 
> [not an authoritative answer, but a suggestion below]
> 
> 
> If this is an import of a new upstream version on top of the current
> packaging (plus some adjustment) then please actually use
> 2:22.2.2-0+deb11u1 which sorts before (an immaginary present)
> 2:22.2.2-1 at some point in unstable.
> 
> Alternatively 2:22.2.2-1~deb11u1.
> 
> Regards,
> Salvatore

Hi Salvatore,

Thanks for your suggestion. However, in the official repository
available at http://bullseye-victoria.debian.net, I have:

22.2.2-1~bpo11+1.dsc

Therefore, I prefer to have the version that I'm proposing, so it is
higher than the version from the unofficial backport, which I can delete
when it reaches official Bullseye.

Yes, I know, it's unofficial, so it "shouldn't count", though as you
see, it is taking way too long to get things updated in Debian as we go
through the normal administrative workflow. Also, I do expect OpenStack
users to use these unofficial backport repositories. So I have to find
ways to cover for production use. Please bare with this.

Cheers,

Thomas Goirand (zigo)