Hi,
LTS does support a few non-free packages following sponsors requests,
such as 'firmware-nonfree' or 'unrar-nonfree'.
Also, the list of supported packages is currently built from curated
lists of installed packages provided from the sponsors.
One limitation is that the list needs to be refreshed and I believe
Freexian is currently asking sponsors to provide up-to-date lists of
packages.
Another limitation is that some related packages are implicitly
supported, see for instance Markus' ELTS work
'extra-packages-to-support' about embedded package (private repo).
Consequently it looks like nvidia-graphics-drivers and
nvidia-graphics-drivers-legacy-390xx can be fixed through LTS as related
packages (as explained by Markus below), though maybe not with high
priority. They probably shouldn't be explicitly referenced in
packages-to-support since there's no direct/paid sponsorship on them.
nvidia-graphics-drivers-legacy-340xx (not 390xx) can't be fixed because
it isn't supported upstream anymore, we can keep <ignore>-ing its CVEs.
@Ola I'm not sure what documentation you're referring to that point you
to a different conclusion. Typically I don't think we forbid non-free
uploads, but users shouldn't expect us to support them either (as in
stable).
I realize that this makes nvidia triaging dependent on the LTS
contributors' collective memory and personal initiative, so maybe this
should be more formally decided and documented. I personally don't
particularly wish to involve myself with non-free packages. Maybe you
can coordinate with Markus and/or open a ticket to make sure this
clarification happen?
Cheers!
Sylvain Beucler
Debian LTS Team
On 28/12/2022 23:45, Ola Lundqvist wrote:
Hi fellow LTS developers
As you can see below I had a question to Markus and he answered with
very good information.
My question to you all is whether we should add the
nvidia-graphics-drivers packages to the "packages-to-support" list or if
we should document this in some other way?
Based on the documentation I had at hand I did not draw the same
conclusion as Markus did and I think maybe we should change the
documentation so I could draw that conclusion.
Or have I missed something regarding the documentation we have?
Or is it so that we should in fact not support the
nvidia-graphics-dirvers packages?
Cheers
// Ola
On Wed, 28 Dec 2022 at 00:22, Markus Koschany <a...@debian.org
<mailto:a...@debian.org>> wrote:
Hi Ola,
Am Dienstag, dem 27.12.2022 um 23:48 +0100 schrieb Ola Lundqvist:
> Hi Markus
>
> When triaging nvidia-graphics-drivers CVEs I realized that you
had added
> nvidia-graphics-drivers to dla-needed.txt. My understanding is
that packages
> in non-free are not supported unless explicitly mentioned in
packages-to-
> support file.
>
> The nvidia-graphics-drivers package(s) is not in packages-to-support.
>
> So therefore I'm asking whether adding the package was a mistake
or if I have
> missed something?
I believe nvidia drivers are still supported in LTS because at least
some
nvidia packages are listed in packages-to-support like
nvidia-modprobe or
nvidia-settings. In addition I had uploaded a new
nvidia-graphics-drivers
package back in January 2022 [1] and I think nothing has changed
back then. In
general we even support non-free packages in LTS if the package is quite
important like a driver. Nvidia drivers fits perfectly here. I'm
more reluctant
with leaf packages like otrs2 (because of the non-free Javascript)
but Nvidia
drivers are still important for many users these days. In short you
don't have
to worry about Nvidia drivers in LTS because this is something we try to
support.
[1]
https://lists.debian.org/debian-lts-announce/2022/01/msg00013.html
<https://lists.debian.org/debian-lts-announce/2022/01/msg00013.html>
