Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

[Alexander Wirt <formorer@formorer.de>]

On Fri, 30 Aug 2019, Raphael Hertzog wrote:

> On Fri, 30 Aug 2019, Alexander Wirt wrote:
> > There were several discussions over the last years. And yes, our vision of
> > backports does not match the vision of those fastpace/not ready for
> > stable/whatever you call them repos. In our vision debian-backports consists
> > of new (tested, as in "is in testing") features from the next debian release.
> 
> "Tested as in testing" really means "tested by britney using the same
> criteria as other packages" and in my earlier suggestion, I was precisely
> saying that I do want to keep britney's filter between unstable
> and <testing-codename>-backports (i.e. the unused bullseye-backports
> during the bullseye development cycle).
> 
> Why would it be wrong to have virtualbox or mysql or wordpress or radare2
> in the -backports repo?
> 
> We're not speaking of crap software, we're just speaking of software that
> can't be maintained multiple years by backports of security patches, where
> we get fixes only with new upstream versions (mixed with new features).
I don't want to draw that line, someone would have decide if the software is
just crap, the maintainer too lazy or if its really fast pacing. Wordpress is
an example of a software that should really be supported within stable. If
not its just crap. 

Imho we should have packages in testing that will not be part of the next
release. And we don't want any form of automated migrations. Full stop.
People should build and *test* their packages against stable. 

Alex

Attachment: signature.asc
Description: PGP signature