4 ms·
This phrasing is very misleading. Sid/Unstable and Testing track upstream releases. If an upstream developer releases a new version to fix a vulnerability, Si
by goodpoint 5y ago
This phrasing is very misleading.
Sid/Unstable and Testing track upstream releases.
If an upstream developer releases a new version to fix a vulnerability, Sid gets the upstream fix just like other rolling distro.
If a version in Testing has a vulnerability and Testing entered a pre-release freeze the fix gets backported.
If a version in Stable has a vulnerability the fix gets backported.
This is designed to provide the "best of both worlds".
- dv_dt 5y agoWhile this does cover quite a bit, I think there is a little more that the security team does in terms of coordination, encouraging or even making timely package updates. It’s understandable that some would fall on either side of being ok with that gap or not.