3 ms·

Why wasn't automatic updating to this halted immediately? The "grave" bug report was yesterday, but today unattended-upgrades updated me to the affected kernel

Why wasn't automatic updating to this halted immediately? The "grave" bug report was yesterday, but today unattended-upgrades updated me to the affected kernel and I restarted before I heard about the problem.

Kunix 3y ago
I found a few things surprising about this bug too, but this might be due to my own ignorance about how these processes work: - I was expecting the package to either be revoked, or to have a new `6.1.64-2` version being published with the previously good known state. Maybe it wasn't done because it was not possible (mirrors being write-only, and maybe other complications in publishing a 6.1.64-2). - I was expecting some guidelines to be published for affected machines. I've seen questions being asked [1], but no answers to them yet (so users are not sure if it would be safe to rollback to the previous kernel version (6.1.55-1) or not). Maybe it's because the problem is not well understood yet, or maybe there are not enough people available to answer such questions on a weekend? If someone can provide some context about "how these things work", it would be interesting to learn more about this. [^1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057843#33 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057843#33
- Denvercoder9 3y ago
  The `6.1.66-1` release with a fix was uploaded to Debian's infrastructure about 2 hours after the bug was filed, but it takes a bit for it to be compiled for all Debian's architectures (the mipsel builder e.g. needed 9 hours) and for it to propgate through the mirror network.
Denvercoder9 3y ago
The way the Debian update process works doesn't make it possible to halt updates immediately. The servers you're getting the updates from aren't controlled by the Debian project itself, but are operated by third parties. They sync their data from a master machine (which is operated by Debian) 4 times per day. If you're using a mirror that's not under the debian.org domain, there might even be another machine or two in between, each adding some delay. So even if Debian pulled the update immediately, which their archive software isn't really setup to do, it'd take a bit for that to propgate through to the mirrors. If this all seems archaic, keep in mind that all this has been designed 20+ years ago, when bandwidth was quite a bit less abundant.

Kunix 3y ago

I found a few things surprising about this bug too, but this might be due to my own ignorance about how these processes work: - I was expecting the package to either be revoked, or to have a new `6.1.64-2` version being published with the previously good known state. Maybe it wasn't done because it was not possible (mirrors being write-only, and maybe other complications in publishing a 6.1.64-2). - I was expecting some guidelines to be published for affected machines. I've seen questions being asked [1], but no answers to them yet (so users are not sure if it would be safe to rollback to the previous kernel version (6.1.55-1) or not). Maybe it's because the problem is not well understood yet, or maybe there are not enough people available to answer such questions on a weekend? If someone can provide some context about "how these things work", it would be interesting to learn more about this. [^1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057843#33 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057843#33

Denvercoder9 3y ago
The `6.1.66-1` release with a fix was uploaded to Debian's infrastructure about 2 hours after the bug was filed, but it takes a bit for it to be compiled for all Debian's architectures (the mipsel builder e.g. needed 9 hours) and for it to propgate through the mirror network.

Denvercoder9 3y ago

The way the Debian update process works doesn't make it possible to halt updates immediately. The servers you're getting the updates from aren't controlled by the Debian project itself, but are operated by third parties. They sync their data from a master machine (which is operated by Debian) 4 times per day. If you're using a mirror that's not under the debian.org domain, there might even be another machine or two in between, each adding some delay. So even if Debian pulled the update immediately, which their archive software isn't really setup to do, it'd take a bit for that to propgate through to the mirrors. If this all seems archaic, keep in mind that all this has been designed 20+ years ago, when bandwidth was quite a bit less abundant.