On 21 January 2024 6:08:42 pm IST, Alberto Bertogli <albert...@blitiri.com.ar>
wrote:
>
>I gave this a try. This is my first time doing a stable backport (or any
>non-unstable change) so please let me know if I did something wrong, which is
>very likely.
>
>I did the following:
>
>- Created a new `debian/bookworm-backports` branch.
>- Merged upstream's v1.11.1 into it, which incorporates the security fixes.
> ...
>I don't know if this is okay, and if so, what comes next; so please let me
>know how to proceed from here!
Whilst all that is fine for backports, if the version of chasquid in stable is
vulnerable then it needs to go via stable updates, and only *minimal* changes
need to be done on top of the version in stable.
In this case it means backporting just the *patch* on top of the version in
stable. Would this be possible to get done?
I also highly recommend that you take a look at [1] which won't consume much
time.
[1]:
https://www.debian.org/doc/manuals/developers-reference/pkgs.en.html#special-case-uploads-to-the-stable-and-oldstable-distributions
