Hi! On 10/3/26 1:17 PM, Sylvain Beucler wrote: > Hello, > > On 19/09/2026 09:51, Hans van Kranenburg wrote: >> On 9/19/26 12:09 AM, Sylvain Beucler wrote: >>> I assume this targets >>> CVE-2026-62437,CVE-2026-79602,CVE-2026-79603,CVE-2026-79604 >>> https://security-tracker.debian.org/tracker/source-package/xen >>> >>> In which case we'd request that they be fixed first in unstable, then >>> proposed to trixie, and last pushed to bookworm-lts. >> >> Ah, yes, ok, Fair enough. I was not planning to go full circle with new >> updates right now. >> >> By the way, for Xen we work from upstream stable branch lines, not from >> random patches. And, this one is now on 4.17, and trixie + unstable are >> both on 4.20. So, purely technically version wise it would not matter to >> do them out of order. >> >>> Or, if the above means too much delay, you could publish the current >>> bookworm version as-is and propose another update when everything else >>> is ready, as you wish :) >> >> Let's then first of all just work with what we already prepared earlier >> yes. I mean, I know this effect where I think... "oh but now it's a bit >> later and can't we also..." but that can pretty quickly end up in only >> more delays. :D >> >>> Do you have a draft for the DLA e-mail? >> >> I do not. I think team security mostly just uses the short thing that is >> not very specific, like in: >> https://lists.debian.org/debian-security-announce/2026/msg00335.html > > I downloaded your .dsc from > https://oz.knorrie.org/tmp/xen/xen_4.17.7-0%2Bdeb12u1_source/, checked > that it matched > https://salsa.debian.org/xen-team/debian-xen/-/tree/bookworm-security , > checked debian/changelog and uploaded it to debusine for staging: > > https://debusine.debian.net/debian/developers/work-request/1410281/
Thanks! > I didn't perform additional tests. That's OK. We always check if it builds, and also do smoke testing with some random hardware that we have ourselves. This is to see if there's no accidental unexpected Debian-related thing happening that would cause problems for everyone. For the correct functioning of the Xen software itself, with many many different kinds of hardware an all its different functionality that can possible be used, we always rely on extensive regression testing that happens at upstream. > If you give me the OK I can upload and send the DLA. Yes, this looks good. Hans
