Re: Expanding the scope (slightly) of dla-needed.txt

2024-03-16 Thread Sean Whitton
Hello, On Thu 14 Mar 2024 at 04:47pm -04, Roberto C. Sánchez wrote: > - it is important update the notes on packages in dla-needed.txt to > indicate what work has been done and what remains I think that we should be also reviewing old notes and deleting those that don't matter anymore. I've

Accepted curl 7.64.0-4+deb10u9 (source) into oldoldstable

2024-03-16 Thread Debian FTP Masters
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Sun, 28 Jan 2024 21:15:21 + Source: curl Architecture: source Version: 7.64.0-4+deb10u9 Distribution: buster-security Urgency: medium Maintainer: Alessandro Ghedini Changed-By: Bastien Roucariès Changes: curl

Re: Guidance for CVE triage and listing packages in dla-needed.txt

2024-03-16 Thread Ola Lundqvist
Aha! Where can I find instructions on how that file is organized? I have security-tracker directory in /home/ola/freexian/services/deblts/lts/ but what should I have in this git dir? I guess debian-lts repo directory should be there so I moved it there and it seems to work. // Ola On Sat, 16

Re: Guidance for CVE triage and listing packages in dla-needed.txt

2024-03-16 Thread Sylvain Beucler
Hi, On 16/03/2024 21:53, Ola Lundqvist wrote: Do we have a bug in the script? ola@tigereye:~/git/debian-lts$ ./find-work | grep "^\*" + exec bin/package-operations --lts --find-work -f :online Working directory of         g...@gitlab.com:freexian-lts/debian-lts.git

Re: Guidance for CVE triage and listing packages in dla-needed.txt

2024-03-16 Thread Ola Lundqvist
Hi Sylvain Is it really true that "find-work" order by priority. I know it did so in the past but the output I get right now looks very much like alphabetical order. It could be a coincidence but I find it unlikely that the priority order would result in alphabetical order. Do we have a bug in

Re: Expanding the scope (slightly) of dla-needed.txt

2024-03-16 Thread Sylvain Beucler
Hi, On 14/03/2024 21:47, Roberto C. Sánchez wrote: - FD should be confirming that package removals from dla-needed.txt are valid (i.e., that the package does not require any work towards an upload to (old)stable) Phrased that way, I don't really like the idea of FD checking on his