Hi Moritz, On Thu, Nov 05, 2026 at 07:55:44PM +0000, Moritz Mühlenhoff wrote: > On Wed, Nov 04, 2026 at 11:26:55PM +0100, Philipp Kern wrote: > > Hi, > > > > On 10/29/26 11:30 AM, Moritz Mühlenhoff wrote: > > > On Fri, Oct 23, 2026 at 03:00:21PM +0200, Philipp Kern wrote: > > > > > I'll upload a backport of 8.3 trixie-security. Since Java security > > > > > releases only happen > > > > > quartely we can disable this again opendjk-21/25 are released. > > > The security updates for openjdk 21/25 are released and I very much hope > > > there > > > will be no out-of-band Java security release before Trixie 13.8 being > > > released on > > > 14 Nov 2026, so we can revert this change again. > > > > Because this was all handled within -security and -security continues to be > > added to all build chroots, there was nothing to revert this time around. > > But before that change was made, foo uploaded to trixie-security didn't build > against bar in trixie-security, that change was made for the recent Java > updates?
I believe here is still some confusion here. To my understanding embaroged queue uploads always (or since a long time) already used alwasy as well stable, -security (not sure about -updates) and embargoed uploads itself (this at least since we had once that critical samba update needing first the ldb update, and samba needing that to build and fix the issue completely). And -pu OTOH only enabled on request when we needed something which was already queued for a point release and only needed for building something on security, but without having it as runtime dependency. Philipp, Adam is this correct? So by now we have again building against things in stable, -security and the embargoed policy queue built packages itself? Regards, Salvatore
