Le mardi 27 octobre 2026, 05:03:49 heure normale d’Europe centrale Carlos Henrique Lima Melara a écrit : > Hi Bastien, > > TLDR I see no major problem that would block the release. Just have some > minor notes and questions. > > On Wed, Oct 14, 2026 at 10:29:17PM +0200, Bastien Roucaries wrote: > > > > I have prepared a new bind9 update > > https://debusine.debian.net/debian/developers/work-request/1461800/ > > https://salsa.debian.org/rouca/lts_bind9/-/commits/debian/bookworm > > > > Can someone review ? > > Sorry for taking so long. I have a question that is not directly related > to the patches you've backported. In stable, it seems the patch releases > are being uploaded to -security [1] and -pu [2]. In bookworm, is there a > reason to not pick up 9.18.50 [3] (well, that question would be better > suited for deb12u2 rather than deb12u3 :-)? I see the official support > for 9.18 has ended [4], but the 9.18 branch seems quite active [5], > would packaging a snapshot of the branch be an easier option than > cherry-picking the commits?
9.18.50 does not only include security fixes but it may be an option for later release. > > > https://debusine.debian.net/debian/developers/work-request/1461800/ > > There are some failed rdeps autopkgtests [6][7][8], are they alwaysfail too > with > 1:9.18.49-1~deb12u2? the view I have from debusine is a bit akward (the > regression test with deb2u2 for dnsmasq has no logs available), but says > successful, so I'm not able to verify it. No new regression or unrelated to bind. I manually checked > > > https://salsa.debian.org/rouca/lts_bind9/-/commits/debian/bookworm > > Personally, I use the patch header Origin with either upstream or > backport prefixes to indicate if it's a cherry-pick from upstream that > applied cleanly or a patch that had conflicts I had to fix. That makes > it easier for people looking at the patches later to identify problems. > I think that info would've been helpful for me during the review (though > is just a suggestion in case you want to adopt from now on). E.g.: > > Origin: <upstream|backport>, <upstream's-commit-url> > > There are some commits with diffs in the worng place. For instance, > e572078 has the patch for CVE-2026-19033, but the changelog entry is > only added in 995bb3a which contains the patch for CVE-2026-19662. > a57dba7 has the patch CVE-2026-75209, but only the following commit > (da5e5ff) adds it to the series file together with the fix for > CVE-2026-78301. These are not major problems, specially since the source > package remains the same even if the commits are a bit twisted. Yes I see this. Do not mention upstream but will do next time. For the twisted side agreed but this is upstream... > > Hope this helps, > Charles > > [1] > https://tracker.debian.org/news/1813748/accepted-bind9-192030-1deb13u1-source-into-stable-security/ > [2] > https://tracker.debian.org/news/1801217/accepted-bind9-192029-1deb13u1-source-into-proposed-updates/ > [3] https://github.com/isc-projects/bind9/releases/tag/v9.18.50 > [4] https://endoflife.date/bind-9 > [5] https://github.com/isc-projects/bind9/commits/bind-9.18/ > [6] https://debusine.debian.net/debian/developers/work-request/1461860/ > [7] https://debusine.debian.net/debian/developers/work-request/1461901/ > [8] https://debusine.debian.net/debian/developers/work-request/1461926/ >
signature.asc
Description: This is a digitally signed message part.
