On Mon, Sep 28, 2026 at 11:22:58PM +0100, Ben Morris wrote: > On Mon, 18 May 2026 17:10:57 +0200 Julian Andres Klode <[email protected]> > wrote: > > > I'm not keen on touching the acquire code in stable releases given the > > severe regression potential without having said fixes in a stable > > release (whether Debian or Ubuntu) for a couple of months. > > I appreciate the concern about regression, but I want to emphasise that the > present situation is already rather serious. > > I came across > https://www.reddit.com/r/debian/comments/1ws65v5/problem_when_installing_certain_packages/ > today. These posts are a regular occurrence over there. It's not a > particularly high-traffic forum, so one must assume that they are the tip of > an iceberg. >
On the opposite, I'd argue this almost never happens. > I am less concerned by the inconvenience experienced by users having to seek > out this workaround than by the potentially very large number of machines > out there which just aren't receiving security updates due to this bug. > Posts which turn out to be about this bug seem to present almost exclusively > as difficulty installing a package. Desktop users who have already installed > the software that they need may take a very long time to notice that no > updates are being installed. Server admins could easily be reassured that > updates are still being checked by reading recent entries in > unattended-upgrades.log. > > Shouldn't this be treated as a security issue, due to its ability to prevent > other known security issues from being patched? Categorizing it as a security issue does not magically make it fixable. As per [1] the change seems to have caused a regression causing APT to confuse two parallel downloads. Given that I saw this around twice in the last 3 months vs only seeing this bug once or twice in 20 years I'm inclined to not backport this fix. [1] https://salsa.debian.org/apt-team/apt/-/merge_requests/559#note_767468 -- debian developer - deb.li/jak | jak-linux.org - free software dev ubuntu core developer i speak de, en
