4 ms·

Debian 13 trixie includes numerous updated software packages (over 63% of all packages from the previous release) I’m not familiar with the metric definition t

Debian 13 trixie includes numerous updated software packages (over 63% of all packages from the previous release) I’m not familiar with the metric definition they use, but I’d be worried if close to 100% of the packages they included in bookworm hadn’t been updated in the roughly 2 years between releases. I use Debian for most of my servers, so I’m sure there is a valid explanation of that phrase.

baobun 1y ago
> I’d be worried if close to 100% of the packages they included in bookworm hadn’t been updated in the roughly 2 years between releases. Code doesn't "go bad" and not everything is affected by ecosystem churn and CVEs. An established package not having updates for 2y is not in and of itself problematic.
b112 1y ago
I don't know why you think it would be different. Are you concerned about security updates? That's not part of the metric, as far as I can see. And even if it was? If you look at the number of packages in Debian, only a small portion have CVEs. There are nearly 30k package sources, and an output of 60k binary packages. Yet we only get a few security updates weekly. Another example? Both trixie and bookworm use the same firefox ESR (extended release) version. Both will get updated when firefox forces everyone to the next ESR. Beyond that, some packages are docs. Some are 'glue' packages, eg scripts to manage Debian. These may not change between releases. Lastly, Debian actually maintains an enormous number of upstream orphaned packages. In those cases, the version number is the same (sometimes), but with security updates slapped on if required. From my perspective, outside of timely and quick security updates, I have zero desire for a lot of churn. Why would I? Churn means work. Churn means changed stability. We get plenty of fun and churn from kernel, and driver related changes (X, Wayland, audio/nic, etc), and desktop apps. And of course from anything running forward, with scissors, like network connected joy.
duskwuff 1y ago
It's not uncommon for small software packages to go years between updates - either because they're a simple utility that's feature-complete and rarely needs bug fixes, or because they're data files (e.g. packages of icons or fonts) which might not need to change at all.
AstroBen 1y ago
Debian stable is just that - unchanging between major Debian versions. They do however push security updates when necessary, so you're not missing out on those
- hsbauauvhabzb 1y ago
  Any chance you know how they manage that? Surely not every package in the repos is supported for the entire 2 year cycle, so if a vuln comes out after a major refactor, it’s surely not easy to backport the patch.
  - AstroBen 1y ago
    Theres some information here they've put out: https://www.debian.org/security/faq https://www.debian.org/security/faq And yeah it must be an incredible amount of work to stay on top of all this
  - pabs3 1y ago
    They auto-import CVE feeds into the security tracker, file bugs for Debian maintainers to fix the issues, curate the tracking data, coordinate with upstreams and other distros to get fixes and so on. Some more on the team web page. https://security-tracker.debian.org/ https://security-tracker.debian.org/ https://security-team.debian.org/ https://security-team.debian.org/
aragilar 1y ago
If upstream makes no releases in that time, then there'll be no upgrades.

baobun 1y ago

> I’d be worried if close to 100% of the packages they included in bookworm hadn’t been updated in the roughly 2 years between releases. Code doesn't "go bad" and not everything is affected by ecosystem churn and CVEs. An established package not having updates for 2y is not in and of itself problematic.

b112 1y ago

I don't know why you think it would be different. Are you concerned about security updates? That's not part of the metric, as far as I can see. And even if it was? If you look at the number of packages in Debian, only a small portion have CVEs. There are nearly 30k package sources, and an output of 60k binary packages. Yet we only get a few security updates weekly. Another example? Both trixie and bookworm use the same firefox ESR (extended release) version. Both will get updated when firefox forces everyone to the next ESR. Beyond that, some packages are docs. Some are 'glue' packages, eg scripts to manage Debian. These may not change between releases. Lastly, Debian actually maintains an enormous number of upstream orphaned packages. In those cases, the version number is the same (sometimes), but with security updates slapped on if required. From my perspective, outside of timely and quick security updates, I have zero desire for a lot of churn. Why would I? Churn means work. Churn means changed stability. We get plenty of fun and churn from kernel, and driver related changes (X, Wayland, audio/nic, etc), and desktop apps. And of course from anything running forward, with scissors, like network connected joy.

duskwuff 1y ago

It's not uncommon for small software packages to go years between updates - either because they're a simple utility that's feature-complete and rarely needs bug fixes, or because they're data files (e.g. packages of icons or fonts) which might not need to change at all.

AstroBen 1y ago

Debian stable is just that - unchanging between major Debian versions. They do however push security updates when necessary, so you're not missing out on those

hsbauauvhabzb 1y ago
Any chance you know how they manage that? Surely not every package in the repos is supported for the entire 2 year cycle, so if a vuln comes out after a major refactor, it’s surely not easy to backport the patch.
- AstroBen 1y ago
  Theres some information here they've put out: https://www.debian.org/security/faq https://www.debian.org/security/faq And yeah it must be an incredible amount of work to stay on top of all this
- pabs3 1y ago
  They auto-import CVE feeds into the security tracker, file bugs for Debian maintainers to fix the issues, curate the tracking data, coordinate with upstreams and other distros to get fixes and so on. Some more on the team web page. https://security-tracker.debian.org/ https://security-tracker.debian.org/ https://security-team.debian.org/ https://security-team.debian.org/

aragilar 1y ago

If upstream makes no releases in that time, then there'll be no upgrades.