Re: The bug (was: Is it safe to install Bookworm on a new machine now?)

["Gareth Evans" <donotspam@fastmail.fm>]

Can anyone please explain:

1. Why upgrades of stable into a potentially seriously compromised state were allowed to continue, twice, rather than pulling the upgrades? or...

2. Why the best temporary solution isn't to revert the kernel to the last known good version so upgrades-other-than-kernel can continue?  There may be some versioning jiggery-pokery needed, but doesn't the +deb12xxx (or other) naming convention take care of that?  I'm sure I've seen packages previously with names like foo-1.3-really-1.2

This really doesn't seem to have been handled well from an official mitigation/communication pov.  There only seems to have been a debian-announce announcement re 12.3 issues.

I'm inclined to think there must be reasons why things that seem obvious have not been done, and keen to understand why, if so.  

Do 1 or 2 above involve disproportionate effort?  Were there backwards-incompatible changes to other things (such as filesystems) in the latest kernel(s), so reversion = breakage for some upgraded systems unaffected by recent issues?

Thanks,
Gareth