Hi folks You might have heard that the masters of Linux Secure Boot, aka shim reviewers, have spoken. They have told us that our way of handling kernel modules is not longer acceptable. For some context see #1040901.
This means for us that we have to make sure that kernel and modules can't be mixed between different builds. If we want to continue with the current behaviour, where you can keep old kernels usable, we have to rename packages and kernel internal ABI on every upload. This is the first version of a proposal that should work. But it also ignores some Debian and release policy points to avoid some problematic behaviour. For example it should not possible for package names to grow unrestricted. Please share your thoughts or if we have a better solution overall. Regards, Bastian ## Current behaviour Currently in use are the following types: * experimental: Version 6.1~rc2-3~exp4, 6.1.2-3~exp4 ABI 6.1.0-0-arm64 * unstable/testing/stable: Version 6.1.2-3 ABI 6.1.0-1-arm64 * security/LTS: Version 6.1.2-3~deb12u4 ABI 6.1.0-1-arm64 * backports: Version 6.1.2-3~bpo12+4 ABI 6.1.0-0.bpo.1-arm64 But our version check allows allow more variants, including NMU, BinNMU, local versions, +bpo, ~deb11u1~deb10u1. ## Proposed behaviour This tries to make sure everything apart from experimental gets new names and ABI on every upload. * experimental: Keep version 6.1~rc2-3~exp4, 6.1.2-3~exp4 Keep ABI 6.1.0-0-arm64 * unstable/testing/stable: Keep version 6.1.2-3 ABI 6.1.2-3-arm64 * security: Use same version ranges as stable, makes it impossible to do stable and security with the same minor. Version 6.1.2-3 ABI 6.1.2-3-arm64 * backports: Keep version 6.1.2-3~bpo12+4 ABI 6.1.2-3.bpo12.4-arm64 * LTS: Version 6.1.2-3~deb12u4 ABI 6.1.2-3.deb12.4-arm64 * Everything else: Not for Debian archive. Keep version ABI 6.1.2-local ## Removed feature for now ### NMU Can be easily added back by adding "bX" or so to the ABI. ### BinNMU Is impossible to support. The version change requires changes in the names of the created packages. ### Release team prefix The release team mandated debXuY suffix is not used for any stable/security or similar release. Only the LTS one for now uses that. This makes sure we never accrue more then one such suffix in any version, to make sure it does not grow unlimited. New stable uploads always try to gather new upstream minor releases, so we should be safe. -- I have never understood the female capacity to avoid a direct answer to any question. -- Spock, "This Side of Paradise", stardate 3417.3