DEP14 branch naming for backported security updates from Debian in PureOS
Hi, I've looked into the Synchronization issue list in landing and noticed that util-linux, which has PureOS specific modifications, has got a security update in Debian bullseye by version 2.36.1-8+deb11u1. PureOS has currently version 2.36.1-8pureos3. Backporting this security update isn't that difficult. But while working on this I came to the point to commit the modifications. :-) But I feel the branch pureos/latest wouldn't be the correct branch as latest implies that the data is quite the most recent stuff. Yeah, we are talking about landing which follows bullseye, but looking a bit further there a lot of backported versions for PureOS are put into $latest or into pureos/byzantium (correctly in my eyes) within the L5 world I'm thinking putting such security backporting work within packages that have PureOS specific modifications should be done also within a branch pureos/byzantium called. Before doing more work in that corner it would be good to have some consensus about that topic. :-) What do others thinks? Maybe I've overseen some already similar revised packages. -- Regards Carsten Schoenert
Hi, On Sun, Apr 03, 2022 at 12:52:14PM +0200, Carsten Schoenert wrote:
Hi,
I've looked into the Synchronization issue list in landing and noticed that util-linux, which has PureOS specific modifications, has got a security update in Debian bullseye by version 2.36.1-8+deb11u1.
PureOS has currently version 2.36.1-8pureos3.
Backporting this security update isn't that difficult. But while working on this I came to the point to commit the modifications. :-) But I feel the branch pureos/latest wouldn't be the correct branch as latest implies that the data is quite the most recent stuff.
It is my understanding that `pureos/latest` points to the newest version in PureOS. Which in this case would be your security update as 2.36.1-8+deb11u1pureos1 is newer than 2.36.1-8pureos3. Once byzantium + 1 opens `pureos/latest` will move to that (similar to what Debian does) and for what you'd do above you'd use a pureos/byzantium branch. This should be confirmed by Matthias and/or Jeremiah. Cheers, -- Guido
Yeah, we are talking about landing which follows bullseye, but looking a bit further there a lot of backported versions for PureOS are put into $latest or into pureos/byzantium (correctly in my eyes) within the L5 world I'm thinking putting such security backporting work within packages that have PureOS specific modifications should be done also within a branch pureos/byzantium called.
Before doing more work in that corner it would be good to have some consensus about that topic. :-) What do others thinks? Maybe I've overseen some already similar revised packages.
-- Regards Carsten Schoenert
_______________________________________________ PureOS-project mailing list PureOS-project@lists.puri.sm https://lists.puri.sm/listinfo/pureos-project
Hello Guido, thanks for your feedback! Am 04.04.22 um 18:18 schrieb Guido Günther:
It is my understanding that `pureos/latest` points to the newest version in PureOS. Which in this case would be your security update as 2.36.1-8+deb11u1pureos1 is newer than 2.36.1-8pureos3.
I've no problem to follow the explanation of your understanding, just want to be sure I'm following the correct way. From a technical side the naming of the branch doesn't matter in the end but once something is pushed to GitLab it's history.
Once byzantium + 1 opens `pureos/latest` will move to that (similar to what Debian does) and for what you'd do above you'd use a pureos/byzantium branch.
This should be confirmed by Matthias and/or Jeremiah.
Yeah, would be nice to have some feedback too from both. ;) -- Regards Carsten Schoenert
Hi Carsten, On 4/6/22 01:34, Carsten Schoenert wrote:
Hello Guido, thanks for your feedback!
Am 04.04.22 um 18:18 schrieb Guido Günther:
It is my understanding that `pureos/latest` points to the newest version in PureOS. Which in this case would be your security update as 2.36.1-8+deb11u1pureos1 is newer than 2.36.1-8pureos3.
I've no problem to follow the explanation of your understanding, just want to be sure I'm following the correct way. From a technical side the naming of the branch doesn't matter in the end but once something is pushed to GitLab it's history.
Once byzantium + 1 opens `pureos/latest` will move to that (similar to what Debian does) and for what you'd do above you'd use a pureos/byzantium branch.
This should be confirmed by Matthias and/or Jeremiah.
Yeah, would be nice to have some feedback too from both. ;)
Apologies for being so late to the conversation. :-) I have to say firstly that I appreciate your attention to detail and to be honest have not really though through the implications, like you point out, of our policy. With that said, I also prefer Guido's approach and am fine with you adopting it. Best, Jeremiah
participants (3)
-
Carsten Schoenert -
Guido Günther -
Jeremiah C. Foster