Thanks Jonas, Please forgive my ignorance, but you stated:
> Here is the developer's view on the Debian packaging of Asterisk: > https://tracker.debian.org/pkg/asterisk > > At that page, near the middle, is a listing of 3 CVEs open that affects > bookworm. I visited the tracker, which states "There are 3 open security issues in bookworm". So I click the link. The word bookworm does not appear on the linked page. Maybe that was somehow the wrong link to click. I go back and click each individual CVE link. Each of those links all show asterisk as fixed for all versions (again no bookworm), and the linked bug is archived. It really looks like nothing is wrong there so I'm confused why the CVEs remain on the tracker page. There is no branch called bookworm anywhere for asterisk that I have found, but I understand from another post you made that we can just create one. So if I just make a branch called debian/bookworm, then it will appear in the CVE tracker list? What commit do I base the debian/bookworm branch on? debian/latest? Something else? I still don't know how to go from wanting to help to typing git commit on my backported patch and making progress. Martin
