-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 Instructions back to the list, in case this is of more general interest.
Dixi quod… >>What is your opinion about staying current with security updates for >>this specifically crafted package? > >If I know I have users I can stay on top of other updates with this >package. For simplicity I’d probably follow uploads to unstable and >rebuild these, with the sysvinit patchset added, within bullseye; I I’ve done that and I’ll keep up with Markus’ uploads to sid as much as possible. (I even had to add a patch to make it buildable on bullseye already, but then the bullseye-security upload is going to need that exact patch, too.) >have successfully used the binary packages coming from that as well >on a buster system, so this should cover three releases. I have indeed tested the latest version on buster, and it works. Though, my testing is (currently) really minimal as I’m not in a Java project at the moment. Nevertheless, my employer, ⮡ tarent, has sponsored some of my time working on this project again. >One thing I have already done is to “split” the packages in my APT >repo so that those I consider “LTS” are available without pulling The repository is available at http://www.mirbsd.org/~tg/Debs/ though the https on that server is TLSv1 only, which your browser may not like without reconfiguration so I’ve set up a mirror at https://caas.mirbsd.org:444/Debs/ (actually the latter is just a view of the main repo storage on the box, so it’ll be inconsistent during package updates for a longer time, say an half hour or so, instead of just for a few seconds as the first URL, but it’s good to obtain the PGP key, for example, using https as extra trust-y anchor; the repo/packages themselves use Secure APT via PGP anyway). Let’s discuss enabling the repository first. If you use the “extrepo” package, it’s as easy as enabling the “wtf-lts” repo, if you’re on buster or bullseye. If you’re on bookworm/testing or sid, you’ll currently need to set up the full “wtf” repository with sid as release; since you wrote you’ll use pinning anyway, this should not be a problem. If you don’t use the “extrepo” package, you’ll need to first let apt know the PGP key. The “modern” but pre-bookworm way is to get https://caas.mirbsd.org:444/Debs/wtf-debian-keyring.gpg and https://caas.mirbsd.org:444/Debs/wtf-debian-keyring.gpg.asc then use the latter with my Debian Developer key to verify the former. My DD key is shipped in the package debian-keyring, and I’m using it to sign this message, too. You can for example do: $ gpg --keyring /usr/share/keyrings/debian-keyring.gpg \ wtf-debian-keyring.gpg.asc Once verified, place wtf-debian-keyring.gpg into /etc/apt/trusted.gpg.d/ (however, see below regarding the keyring packagre) and as next step, add an appropriate sources.list(.d) line, such as: deb http://www.mirbsd.org/~tg/Debs/ bullseye lts The bookworm way is to load https://caas.mirbsd.org:444/Debs/wtf.sources (and .asc again) instead and place that into /etc/apt/sources.list.d/ and it will replace *both* the trusted key *and* the sources.list entry by placing the key with the entry in the new “long” format, so it’s only used for this repository. This doesn’t yet work in bullseye, AFAIK :/ Neither will get you auto-updates for the key. See below for that. >in other “alternative” versions of packages, so it can safely be >added to most systems. The current set of packages for bullseye is: You wrote you need only tomcat and prefer pinning. You can do pinning; basically, you need to pin down all packages from the repository except the binary packages from the tomcat9 source package, which are: libtomcat9-embed-java deb java optional arch=all libtomcat9-java deb java optional arch=all tomcat9 deb java optional arch=all tomcat9-admin deb java optional arch=all tomcat9-common deb java optional arch=all tomcat9-docs deb doc optional arch=all tomcat9-examples deb java optional arch=all tomcat9-user deb java optional arch=all I’ve not had much success with pinning myself, other than to tell apt to never install systemd at all, and to force specific versions for packages. But maybe you figure it out and will share it for everyone? The repository (independent of whether you use the lts or wtf component) uses the following identification: Origin: The MirOS Project Label: wtf Suite: bullseye or sid etc… Codename: bullseye or sid etc… So I think you should be able to pin with o= (space might be tricky) and l= according to apt_preferences(5)… anyway, do tell us if it works (otherwise, we’ll need to prod at it together, until it’s going to). >• wtf-debian-keyring (the keyring package for this repo) You wrote: |Keyring behavior has been changed (to be more cumbersome for an user, I |think) on Bullseye. Does this still work? It does. This package still uses the “oldold” way, in that apt-key(8) is called from postinst. It warns loudly about that. (It might no longer work on bookworm/sid though.) I had planned on splitting this package up into old and newer flavours and have the newer one place a file in /etc/apt/trusted.gpg.d/ as mentioned above, but the “put the key together with the sources entry” method really has benefits, so I’m undecided. For now, if you want the keyring package, either get that over https and trust that or run “apt-key add wtf-debian-keyring.gpg” instead of placing the file in /etc/apt/trusted.gpg.d/ and then install the keyring package using normal apt-get. (The keyring package does ensure the keys are properly removed on purge; it will also do so when I switch the method.) In the RPM world, there’s a concept called “release package” (e.g. you do “yum install epel-release” to install a package which contains both the key and the sources.list equivalent of a repository) and this *MIGHT* be a way to do this on Debian… the /etc/ placement is tricky however, and it’d need lots of packages and the extrepo mechanism isn’t prepared for it either. I think I’ll need to talk to people… (>>TODO) bye, //mirabilos - -- > Wish I had pine to hand :-( I'll give lynx a try, thanks. Michael Schmitz on nntp://news.gmane.org/gmane.linux.debian.ports.68k a.k.a. {news.gmane.org/nntp}#news.gmane.linux.debian.ports.68k in pine -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (MirBSD) Comment: ☃ ЦΤℱ—８ ☕☂☄ iQIcBAEBCQAGBQJipTSSAAoJEHa1NLLpkAfgoukP/A5h4evLIuwFXTmyvfkb04Xh hWoMyUGoiS14UeZyKw+07HFaL1K4BkaDVSTm+owzqzZOUHD+TnC8hpHJTRe4Qwza lp/tVH0d/cJry2iGT7+9Nzsz/HHUDD2AIH+Cygwk7XSUGYeohjirXjvg96+QjNwt acuvbnpckZZzwdq+9cRYh2YHJWnfo/5uE8yVb/vofHHm4tN6/TqbnOaER0zMGKOq 0jQ8KSfZD2o4Noce1KmIcbjkbLLOqeSA9VHVRKXIGCoHphaRXwc+NUXywQjI0UC7 ICLwj3xpaRvKIhpCualOFSWceskZufjtLyO6HHsHvi/VeSwN9BfZSb3fQmUHTaDz gvCbK5Yzs4Ixd2TFE0WpX2QYzqGnDRlvTbGGsywZhI+T/o60sR4cegezIB1Iet0p sCUe+XyZrE1OIbLAwOHoXH/n8NICSLhDUGtXnYQA4bs8HMan20PvWB0WM7Wk2vMS afCwPwkDWzdDUzWegHSpuNiQfr8jxm1Bj9Ime3FCSzz+ENzcJRBg13mmDZeF/JbS ce7tqQ+NX59nh/dwseq4AvReWsBjvQPlpTawNpwHIUhIZMfS84K2SzVBfsXDEfXC DW4/dK+guJ4G13esZHD6hUmzJgIedvzdJ5dE3FWx9RiW2M65UJaP+q8v9bnjpw2g bjjeZm0OuE4+oUWJEE3h =UaNI -----END PGP SIGNATURE-----
