Hi Sylvain, On 10/12/26 07:10, Sylvain Beucler wrote:
Hi,Well I don't want to be the only one reviewing your uploads, but here I am ;)
Well hey, it's very much appreciated! I'm just following the docs when it says "work for 2-3 days then announce and allow for 3-4 days for testing," but if this is overly verbose or pedantic, let me know.
Overall this looks good :)
Great, thanks!
On a personal note, I wouldn't bother to rewrite the upstream Git patches so much to conform to DEP-3, even https://dep-team.pages.debian.net/deps/dep3/ (first sample) proposes a lighter approach where most/all the patch header is preserved (and easier to review / diff against upstream). Also I wouldn't bother to re-introduce data that is already present in the security-tracker (debian bug ID, GHSA, etc.), in particular the security-tracker can be fixed/updated, while info copy/pasted in the patch header usually desync over time and may cause confusion later. Usually I do something like: https://salsa.debian.org/lts-team/packages/runc/-/blob/debian/buster/debian/patches/CVE-2022-29162.patch possibly with concise backport notes before the upstream patches. Also note that I include my name so we know who was responsible for the backport if an issue if found while working on a later upload.
I've put the upstream git headers back, with a short backport note and my name above them, in the same shape as your runc CVE-2022-29162 patch. The GHSA links and the Debian bug are gone from the headers. The diffs, the changelog, and the commit messages are unchanged, and the patches still apply cleanly.
But again this is fine-tuning, the upload look good and the testing solid.
Still, very much appreciated. I'll keep this in mind for future LTS work. I'll go ahead and get this uploaded + issue the DLA; patch headers don't require a full re-running of the suite. I've force-pushed to the same fork branch in Salsa. Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
