On Thu, 22 Oct 2026 at 09:27:53 +0100, john wrote: > It then took nearly 2 hours for the files to appear in security.debian.org > after the update e-mail went out. I suspect a lot of people caused a lot of > load on the servers constantly checking for it to appear! Any reason for the > very long delay? > > php8.4 was available from the repositories for trixie when the announcement > went out.
Trixie-security uploads land in an embargoed queue where the package can be be built behind the curtain prior to disclosure and installed into the archive immediately after disclosure. There is no such mechanism for LTS uploads at the moment. So while thankfully the package was prepared and tested prior to disclosure, I had to wait for the official upstream announcement to dupload or push the changes to avoid violating the embargo. Uploaded seconds after the upstream lifted the embargo, literally as fast as my fingers could move after double checking orig.tar integrity. Furthermore it appears the upload got unlucky due to busy builds (in restropect I should mooted the test suite to speed things up). Normally the advisories are only sent once the package is installed into the archive for all supported architectures, but I deliberately decided to make an exception and send it during early build time in this case as I thought we would get tons of questions about status update otherwise. Maybe I should have waited though, as questions came anyway and users were pointed to the https://buildd.d.o page which would have been available either way. -- Guilhem.
signature.asc
Description: PGP signature
