[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: CAN to CVE: changing changelogs?



On Thursday 27 October 2005 23:34, Henrique de Moraes Holschuh wrote:
> To me it is a technical matter, as the changelogs are a tool for a
> technical job.

To me, changelogs are primarily a way of informing the user of changes in 
a package. Including references to fixed security issues is definitely a 
part of that.

However, when "upstream" policy on a numbering scheme is changed, going 
back 10 years in changelogs (/me is exaggerating to make a point) and 
fixing historic references to old entries that were perfectly valid at 
the time they were written is not a technical matter. I would agree more 
with the qualification of "revisionist history" made earlier.

Of course adding _missing_ references to fixed security issues would be 
like fixing a minor bug in the changelog. However, that also should not 
be taken too far: adding entries going back more than half a year (?) 
seems hardly relevant.

Attachment: pgpgv7FjSzvYd.pgp
Description: PGP signature


Reply to: