Hello Ivo,
On 28/09/2026 20:57, Ivo Marino wrote:
Prepared fixes for a batch of unbound CVEs against bookworm's 1.17.1. I'd
originally sent this to [email protected], since it doesn't
appear on dla-needed.txt or dsa-needed.txt and none of the CVEs carry a
no-dsa note either, so I wasn't sure which track it belonged on. Moritz
Mühlenhoff clarified that bookworm security updates are entirely LTS's
now, so following up here instead.
As I already mentioned, you need to go through the NM process at
nm.debian.org if you want to contribute to LTS (AFAICS you're still not
registered there). Without DD status, you do not have write access to
the security tracker, to the announcement mailing lists, to the porter
boxes, to debusine, and so on. Unlike NM, we're not structured to work
this way, which probably explains why your contributions remained
unanswered so far.
You misunderstood the dla-needed.txt notes for 'caddy', and here it
seems you missed the 'unbound' entry entirely (which I added earlier
this year). This made you take time from the Security Team on two
occasions. This is a clear sign that you need to study the Debian
context and processes further to avoid basic misunderstandings.
Thanks for your interest in LTS, and good luck with the NM.
Sylvain Beucler
Debian LTS Team
