On 01/12/2010, at 23:40, Stan Hoeppner wrote: > Victor Duchovni put forth on 12/1/2010 3:41 PM: >> It would be unwise of LaMont or Debian, having selected a particular >> Postfix 2.x release (say 2.7) to not track the patch updates from time to >> time. I understand that Debian stable or backports won't switch from 2.7 >> to 2.8 any time soon, but they should integrate patches in a reasonably >> timely manner (weeks to months, not years). Between 2.7.1 and 2.7.2 we >> have the changes below. They are not "critical", but O/S distributions >> still need to not sit on bug-fixes too long... > > I'm not exactly sure how, or if, this is handled. I don't recall seeing > any updates to 2.5.5-1.1, security or otherwise, since Lenny was > released in Feb 2009. Maybe I don't have the correct set of apt sources > configured? Unlikely but possible I guess.
According to the Debian package database, there haven't been any; http://packages.debian.org/search?suite=all&searchon=names&keywords=postfix Here's the changelog for the 2.5.5 branch in Debian; http://packages.debian.org/changelogs/pool/main/p/postfix/postfix_2.5.5-1.1/changelog And the changelog for the 2.7.1 branch the backport is probably based on; http://packages.debian.org/changelogs/pool/main/p/postfix/postfix_2.7.1-1/changelog It seems they integrate upstream releases in packages while they are in the 'unstable' suite. Things then move into 'testing', which is currently the 'squeeze' release. They've frozen 'squeeze' in August this year, and are working towards release, which probably means they're not introducing any new code. As far as I can tell, 2.7.2 is from last week, correct? If you needed the fixes provided, you could grab the Debian source package, the Postfix source, change the package description file and compile .deb packages for deployment. That's what we would do anyway, once we upgrade our current 2.6.x to the 2.7 branch. Cya, Jona
