On Fri, Jun 05, 2020 at 12:26:12PM +0200, Ansgar wrote: > > > As a project, how can we improve the current entry level to new > > > companies wanting support for their devices? > > > > Is the backports archive not sufficient for this? I see it doesn't > > contain mesa backports at this point and probably other hardware > > enablement, but that could be fixed. > > I wouldn't recommend enabling backports by default for pre-installed > systems as using backports is something a bit fiddly (temporarily > uninstallable packages, sometimes extra pinning to pull in additional > packages or manual intervention is needed, ...).
Not only that, but without proper security support it would be irresponsible to ship a kernel from backports by default. If we're going to encourage hardware vendors to ship packages from backports pre-installed, we need to ensure that it gets the same level of security support as stable. That means support from a team that his visibility into embargoed issues and can publish DSAs to debian-security-announce on the day of a vulnerability disclosure. We can't wait for a package to enter testing and then be backported, and we can't treat backports as a second-class citizen from an infrastructure perspective. noah
