On Thu, Mar 14, 2024 at 11:39:41PM +0100, Ola Lundqvist wrote: > > I think we should clarify what we mean with "Minor issue". Is it what is > typically written as "(Minor issue)" after "<no-dsa>" statement or > something else. > I'm asking since it seems to be a common view that we should fix all minor > issues too. I do not agree to that, but others has expressed that opinion. > Can you suggest what might be a useful statement or description of what constitutes a minor issue? I ask because nothing comes to mind. There are a multitude of factors and considerations that contribute to the severity of an issue, that this seems to me like a clear example of the sort of reason that regular LTS contributors are all experienced DD with security-relevant experience. Each case is a matter of professional judgment.
> I think we should add that if LTS has an issue as no-dsa/postponed and > (old-)stable has it fixed, then we should add/keep the package to > dla-needed (or decide to ignore in case it is too invasive) to ensure LTS > gets it fixed as well. At least that was the rule I concluded from the > discussion and why I re-added a few packages back to dla-needed. This seems like something that we already do, or am I mistaken? As in, when a Debian release becomes LTS, one of the things that we do is to review the packages which have outstanding unfixed CVEs and triage them for LTS. > I also think we should add that in the typical case (all > no-dsa/postponed/ignored/fixed and they are few) this means that the > package should be removed from dla-needed.txt. I think it has a merit, > just to keep things tidy. > In fact I think we should typically remove the package from dla-needed if > it should not have been added, with exceptions described above. If we end up moving to a workflow based on Salsa issues, then I think that this will naturally occur. However, if we continue with a workflow based primarily around dla-needed.txt I am not certain where we would keep track of these packages which need work but perhaps not directly for a DLA. Regards, -Roberto -- Roberto C. Sánchez
