Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-30 Thread Alexander Wirt
On Fri, 30 Aug 2019, Raphael Hertzog wrote: > Hi, > > On Fri, 30 Aug 2019, Alexander Wirt wrote: > > > We're not speaking of crap software, we're just speaking of software that > > > can't be maintained multiple years by backports of security patches, where > > > we get fixes only with new

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-30 Thread Raphael Hertzog
Hi, On Fri, 30 Aug 2019, Alexander Wirt wrote: > > We're not speaking of crap software, we're just speaking of software that > > can't be maintained multiple years by backports of security patches, where > > we get fixes only with new upstream versions (mixed with new features). > I don't want to

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-30 Thread Alexander Wirt
On Fri, 30 Aug 2019, Raphael Hertzog wrote: > On Fri, 30 Aug 2019, Alexander Wirt wrote: > > There were several discussions over the last years. And yes, our vision of > > backports does not match the vision of those fastpace/not ready for > > stable/whatever you call them repos. In our vision

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-30 Thread Raphael Hertzog
On Fri, 30 Aug 2019, Alexander Wirt wrote: > There were several discussions over the last years. And yes, our vision of > backports does not match the vision of those fastpace/not ready for > stable/whatever you call them repos. In our vision debian-backports consists > of new (tested, as in "is

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-30 Thread Moritz Mühlenhoff
On Fri, Aug 30, 2019 at 09:17:32AM +0200, Raphael Hertzog wrote: > Hi, > > On Fri, 30 Aug 2019, Pirate Praveen wrote: > > Fast Track repo works exactly like current backports except the packages > > are added from unstable (or experimental during transitions and freeze) > > as they cannot go to

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-30 Thread Alexander Wirt
On Fri, 30 Aug 2019, Raphael Hertzog wrote: > Hi, > > On Fri, 30 Aug 2019, Pirate Praveen wrote: > > Fast Track repo works exactly like current backports except the packages > > are added from unstable (or experimental during transitions and freeze) > > as they cannot go to testing and hence to

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-30 Thread Raphael Hertzog
Hi, On Fri, 30 Aug 2019, Pirate Praveen wrote: > Fast Track repo works exactly like current backports except the packages > are added from unstable (or experimental during transitions and freeze) > as they cannot go to testing and hence to current backports. > > As Paul noted earlier, backports

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-29 Thread Pirate Praveen
[Resending because I got some bounces] On 2019, ഓഗസ്റ്റ് 29 7:50:00 PM IST, Dan Clery wrote: >Isn't this the sort of problem that things like flatpack or snap were >created for? In those solutions either security updates have to handled by each flatpack or snap instead of sharing it

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-29 Thread Pirate Praveen
[Resending because I got some bounces] On 2019, ഓഗസ്റ്റ് 29 7:10:38 PM IST, Abhijith PA wrote: > >Hi, > >On 29/08/19 6:47 pm, Paul Gevers wrote: >> Hi >> >> On 29-08-2019 14:28, Raphael Hertzog wrote: >>> (Note: pkg-security@tracker.d.o is not a valid email, dropped) >>> >>> Hi, >>> >>> On

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-29 Thread Dan Clery
Isn't this the sort of problem that things like flatpack or snap were created for? On Thu, Aug 29, 2019 at 9:57 AM Abhijith PA wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > > Hi, > > On 29/08/19 6:47 pm, Paul Gevers wrote: > > Hi > > > > On 29-08-2019 14:28, Raphael Hertzog

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-29 Thread Abhijith PA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi, On 29/08/19 6:47 pm, Paul Gevers wrote: > Hi > > On 29-08-2019 14:28, Raphael Hertzog wrote: >> (Note: pkg-security@tracker.d.o is not a valid email, dropped) >> >> Hi, >> >> On Thu, 29 Aug 2019, Holger Levsen wrote: In general, we

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-29 Thread Paul Gevers
Hi On 29-08-2019 14:28, Raphael Hertzog wrote: > (Note: pkg-security@tracker.d.o is not a valid email, dropped) > > Hi, > > On Thu, 29 Aug 2019, Holger Levsen wrote: >>> In general, we (Debian) don't have a good answer to this problem and >>> virtualbox is clearly a bad precedent. We really

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-29 Thread Raphael Hertzog
(Note: pkg-security@tracker.d.o is not a valid email, dropped) Hi, On Thu, 29 Aug 2019, Holger Levsen wrote: > > In general, we (Debian) don't have a good answer to this problem and > > virtualbox is clearly a bad precedent. We really need to find a solution > > to this in concertation with the

how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-29 Thread Holger Levsen
hi, (this started as a discussion whether to update radare2 in (old)stable and has since then evolved into a discussion about the problem summarized well by Raphael.) On Thu, Aug 29, 2019 at 01:48:14PM +0200, Raphael Hertzog wrote: > On Thu, 29 Aug 2019, Moritz Mühlenhoff wrote: > > The upstream