> Whenever Sieve spots a new version of a Debian package, it starts a new build. These packages are built in package groups since separate packages often must b

> Whenever Sieve spots a new version of a Debian package, it starts a new build. These packages are built in package groups since separate packages often must be upgraded together. Once the whole group has been built, Google runs a virtualized test suite to ensure no core components and developer workflows are broken. That must have required an impressive amount of effort! > Better still, thanks to the rolling release schedule, Google can patch security holes on the entire fleet quickly without compromising stability. Previously, security engineers had to carefully review each Debian Security Advisory (DSA) to make sure the fix was in. I can only imagine Google upstreams an incredible number of patches from this process.