Re: stable vs. testing: same versions, different status

["Michael S. Gilbert" <michael.s.gilbert@gmail.com>]

On Sun, 28 Jun 2009 18:48:17 +0200 Francesco Poli wrote:
> That's why I am trying to figure out how the manpower issue can be
> solved: because I would love to see DTSAs and all the full security
> support for Debian testing, even when it is apparently harder (i.e.:
> immediately after a release).

the issue is not necessarily manpower itself, but rather the value of
volunteers' time.  it makes little sense to duplicate work for testing
and unstable when unstable will eventually overwrite testing. 

because it is hard for any volunteer to justify doubling their work,
your best bet for better testing security support is to step up to the
plate yourself or to pay someone to do so for you.

> Indeed, but I don't see a "Do not use testing unless we are a few weeks
> from next release" warning.
> And I think that there should *not* be such a warning and that the
> reasons for such a warning should be fought and defeated by the Testing
> Security team.

testing is just too much of a moving target.  the track record for
full support is not a few weeks before release, but rather six months
or so, which is fairly significant chunk of time.  in the meantime a
recomendation to use stable seems a reasonable position to me.

> If users don't use Debian testing, no one will report bugs for packages
> in testing, and bugs won't be discovered until a new release is out,
> that is to say, until it's too late...

regardless of non-expedient security support, plenty of people use
testing and report issues.  in fact the majority of users do not base
any of their decisions on security; hence, this is an extreme
conclusion to draw.  besides, testing is indeed security-supported, it's
just slow.

> I think it should be done automatically at archive level.
> 
> An automatic stable-update --> testing,unstable migration mechanism is
> already in place for point releases, as stated by Nico Golde in
> http://lists.debian.org/debian-security-tracker/2009/06/msg00009.html
> 
> A similar automatic stable-security --> testing-security migration
> mechanism should be implemented, IMHO.

even though there is an existing solution, my argument for it as the
only option is counter-productive; and i do not wish to say no just to
say no.  i would suggest talking to the ftp-masters and the security
team (team@security.debian.org) about whether they would be interested
in implementing your idea.

> BTW, since a point release was issued yesterday, I've just seen the
> stable-update --> testing,unstable migration happen for a number of
> packages (including linux-2.6).
> This caused a number of new "same versions, different status"
> inconsistencies in the tracker:

started fixing these; will fix the rest tomorrow.

mike