Control: severity -1 wishlist Control: tags -1 + wontfix On Wed, Aug 26, 2026 at 08:11:24PM +0200, Madalin Ignisca wrote: > I start a fresh vm with Debian 13.6 cloud image, trusting it is built > from release branch, not leaked after updates.
"leaked" is a strong word to use there. > I disable the stable-updates, because I want less paper work (some > audited companies must list every possible element of updates, > disabling the stable-updates, and getting them every 2 months is more > than perfect). > > I try to install next unbound, but can’t, it has a dependency on a > python package, that has a dependency of another python package that > is in unstable now, but I can’t because I limited to stable+security. > > Do you see the bug I try to express? I do. As previously noted, though, this exact same problem can occur with stable-security, yet you seem OK with installing packages from there. Debian's position is that these are no different. > And my proposal it can help everybody: > > Build the cloud release skipping stable-updates, only stable+security, > and keep enabled the stable-updates in apt sources. So, the build gets > 100% release, potentially with some security updated packages. Again, stable-updates and stable-security are considered to be of the same priority. We publish new images when any packages in any of the default suites changes in such a way as to change the package set in the images. A stability regression is no less severe then a security issue. I have previously provided concrete examples of where this was necessary. > You understand the steps that can help all possible situations, and > all system admins, mainly who work in environments with more audit on > each change? I fully understand that compliance requirements are tedious and time consuming. I'm sorry you have to deal with this paperwork. > I repeat, I do not suggest to permanently disable stable-updates. This > must stay, as they were always with Debian. But to the release with > that release lists, not a technically optional update. We do not consider stable-updates to be optional. I'm sorry if this does not match your expectation. Please note that images based on the previously published stable point releases are available and will remain so. You do not need to update to new images when we publish them. If you want to avoid using images built with content from stable-updates, you are free to continue using these images as long as they suit you. noah
