bookworm nearly ready

2023-06-10 Thread Paul Gevers
Dear readers, The bookworm release is in it's final stages. Please expect the release to happen in several hours from now which means that updates of systems will see new metadata, e.g. switching bullseye from stable to oldstable. On behalve of the Release Team. Paul OpenPGP_signature Descr

should the Release Notes be updated concerning bookworm security

2023-05-29 Thread Paul Gevers
Dear security team, I know it's a bit late, but are you aware of issues that are worth mentioning in the release notes from your point of view? We have updated the text about golang and rustc in this cycle, chromium got a mention about reduce support time wise and I updated the openjdk versi

Re: Should singularity-container make it to next release?

2023-01-26 Thread Paul Gevers
Hi Nilesh, On 26-01-2023 10:06, Nilesh Patra wrote: I guess something that changed since then is that upstream is aware about it and can help a bit with backporting. However the onus to maintain it in stable is still on the maintainer and security@ (to some extent) It is bit of a high-effort mai

Re: Should singularity-container make it to next release?

2023-01-26 Thread Paul Gevers
Hi, On 25-01-2023 20:14, Moritz Muehlenhoff wrote: On Sat, Jan 21, 2023 at 08:34:40PM +0100, Salvatore Bonaccorso wrote: So in my understanding of the above the situation around singularity-container, which lead for buster to https://bugs.debian.org/917867 and keeping it out of the stable relea

Re: how to deal with widely used packages unsuitable for stable (was Re: [Git][security-tracker-team/security-tracker][master] Add radare2 to dla-needed.txt with comments.)

2019-08-29 Thread Paul Gevers
Hi On 29-08-2019 14:28, Raphael Hertzog wrote: > (Note: pkg-security@tracker.d.o is not a valid email, dropped) > > Hi, > > On Thu, 29 Aug 2019, Holger Levsen wrote: >>> In general, we (Debian) don't have a good answer to this problem and >>> virtualbox is clearly a bad precedent. We really need