On Thu, 22 Oct 2026, Guilhem Moulin wrote:
Trixie-security uploads land in an embargoed queue where the package can
be be built behind the curtain prior to disclosure and installed into
the archive immediately after disclosure.
There is no such mechanism for LTS uploads at the moment. So while
thankfully the package was prepared and tested prior to disclosure, I
had to wait for the official upstream announcement to dupload or push
the changes to avoid violating the embargo. Uploaded seconds after the
upstream lifted the embargo, literally as fast as my fingers could move
after double checking orig.tar integrity. Furthermore it appears the
upload got unlucky due to busy builds (in restropect I should mooted the
test suite to speed things up).
Thanks for your efforts on getting it out as soon as possible and
explaining the mechanisms at work here.
Normally the advisories are only sent once the package is installed into
the archive for all supported architectures, but I deliberately decided
to make an exception and send it during early build time in this case as
I thought we would get tons of questions about status update otherwise.
Maybe I should have waited though, as questions came anyway and users
were pointed to the https://buildd.d.o page which would have been
available either way.
The way security works for LTS probably needs some thought as LTS is
currently deemed the poor sibling of stable, but when there are serious
security issues like this which could be embargoed and released at the
same time, it probably should be treated equally. Hoping the teams working
on things are able to consider this.
Many Thanks,
john
