Hi, sorry for the late reply.
On Mon, Oct 19, 2026 at 06:15:58PM +0200, Sylvain Beucler wrote:
> Hi,
>
> On 17/10/2026 19:51, Santiago Ruano Rincón wrote:
> > El 01/10/26 a las 02:57, Andreas Henriksson escribió:
> > [snip]
> > > ## gawk
> > >
> > > Did some initial work to backport patches for the outstanding CVEs
> > > as requested in dla-needed.txt for both unstable/testing and bullseye, but
> > > since unstable/testing/... was also unfixed discussion proceeded in
> > > [bts#1142071] and stalled.
> >
> > [snip]
> >
> > As of today, gawk has four CVE open: CVE-2026-40467, CVE-2026-40468,
> > CVE-2026-40469 and CVE-2026-40553. They have been marked as <no-dsa> by
> > the sec team for trixie, and none of them as a severity >= high.
> >
> > As a first comment, I wonder if gawk should be listed in dla-needed.txt.
> > That was a Front Desk decision, but I think we can defer a bookworm
> > update, marking the CVEs as <no-dsa> (postponed), and removing gawk from
> > the work queue. There are packages with more important CVEs that are
> > needing our attention. Andreas, if you agree, would you mind applying
> > the changes please? Otherwise, please, let me know.
I think your judgement is better here. I only worked on this as it was
pretty high up on the `./find-work --lts` output.
> >
> > Second, regarding the unstable NMU, while I value that we can contribute
> > to more recent releases, given the severity of the gawk issues, I think
> > it is important to give maintainer(s) time to prepare the update.
The relevant bug report had already been open and unanswered for ~2 months,
I assumed this was enough indication that the maintainer did not have
time to pursue the update and thus offered to help out.
Salvatore replied to my offer asked me to give "some time"... that was
now over a month ago. If someone is able to quantify "some time" I would
appreciate it, because as far as I know we still have a 0-day NMU policy
going on in Debian Unstable.
I have however not pursued this any more since my initial offer to help out.
> > Especially when the maintainers are active Debian contributors.
> > Actually, in our context, unstable NMUs should be exceptional, and for
> > very severe cases.
> >
> > As a general comment, my suggestion is also to contact the maintainers
> > first before preparing a stable point update. That also helps to avoid
> > double work in case they are already preparing the update. TTBOMK,
> > contrary to *la-needed.txt, there is no general method to know when
> > somebody is working on an unstable update or stable pu.
> >
> > Does the above make sense?
>
> +1.
>
> Generally, unless vulnerabilities appear particularly sensitive to us, we
> shouldn't add a package to dla-needed.txt until the security team had a
> first pass triage. This kind of package can remain present in
> lts-cve-triage.py for a few days, even if that crosses a FD shift.
I would very much appreciate if packages are only added to
{dla,ela}-needed.txt when an update is actually needed/wanted.
That would leave out second-guessing if it's actually wanted.
>
> Cheers!
> Sylvain
Regards,
Andreas Henriksson
