On Mon, 8 Jun 2009 18:47:45 -0400 Michael S. Gilbert wrote: > On Tue, 9 Jun 2009 00:12:18 +0200, Francesco Poli wrote: > > Thank you: this one seems to have been left over > > http://security-tracker.debian.net/tracker/CVE-2009-0787 > > fixed. Thanks! :-) [...] > > I think this should happen automatically. > > > > This is a good reason to implement an automatic stable-security -> > > testing-security migration mechanism, that is triggered whenever the > > package version in testing (and the package version in > > testing-security, if any) is older than the stable-security one, > > as suggested above. > > this would be nice, but it is usually a short timeframe for which there > exist testing and stable versions that match. i think it will > always have to be a manual process involving DTSAs. Short time frame? I still see cases where squeeze and lenny versions of a package are identical and lenny was released back on February 14th... I think the above-described automatic mechanism would benefit testing security, especially in the first post-release times, i.e. when the testing-security team claims that no official testing security support can be provided! -- New location for my website! Update your bookmarks! http://www.inventati.org/frx ..................................................... Francesco Poli . GnuPG key fpr == C979 F34B 27CE 5CD8 DC12 31B5 78F4 279B DD6D FCF4
Attachment:
pgpd_Y8A2GMRX.pgp
Description: PGP signature