Hi Bastien, TLDR I see no major problem that would block the release. Just have some minor notes and questions.
On Wed, Oct 14, 2026 at 10:29:17PM +0200, Bastien Roucaries wrote: > > I have prepared a new bind9 update > https://debusine.debian.net/debian/developers/work-request/1461800/ > https://salsa.debian.org/rouca/lts_bind9/-/commits/debian/bookworm > > Can someone review ? Sorry for taking so long. I have a question that is not directly related to the patches you've backported. In stable, it seems the patch releases are being uploaded to -security [1] and -pu [2]. In bookworm, is there a reason to not pick up 9.18.50 [3] (well, that question would be better suited for deb12u2 rather than deb12u3 :-)? I see the official support for 9.18 has ended [4], but the 9.18 branch seems quite active [5], would packaging a snapshot of the branch be an easier option than cherry-picking the commits? > https://debusine.debian.net/debian/developers/work-request/1461800/ There are some failed rdeps autopkgtests [6][7][8], are they alwaysfail too with 1:9.18.49-1~deb12u2? the view I have from debusine is a bit akward (the regression test with deb2u2 for dnsmasq has no logs available), but says successful, so I'm not able to verify it. > https://salsa.debian.org/rouca/lts_bind9/-/commits/debian/bookworm Personally, I use the patch header Origin with either upstream or backport prefixes to indicate if it's a cherry-pick from upstream that applied cleanly or a patch that had conflicts I had to fix. That makes it easier for people looking at the patches later to identify problems. I think that info would've been helpful for me during the review (though is just a suggestion in case you want to adopt from now on). E.g.: Origin: <upstream|backport>, <upstream's-commit-url> There are some commits with diffs in the worng place. For instance, e572078 has the patch for CVE-2026-19033, but the changelog entry is only added in 995bb3a which contains the patch for CVE-2026-19662. a57dba7 has the patch CVE-2026-75209, but only the following commit (da5e5ff) adds it to the series file together with the fix for CVE-2026-78301. These are not major problems, specially since the source package remains the same even if the commits are a bit twisted. Hope this helps, Charles [1] https://tracker.debian.org/news/1813748/accepted-bind9-192030-1deb13u1-source-into-stable-security/ [2] https://tracker.debian.org/news/1801217/accepted-bind9-192029-1deb13u1-source-into-proposed-updates/ [3] https://github.com/isc-projects/bind9/releases/tag/v9.18.50 [4] https://endoflife.date/bind-9 [5] https://github.com/isc-projects/bind9/commits/bind-9.18/ [6] https://debusine.debian.net/debian/developers/work-request/1461860/ [7] https://debusine.debian.net/debian/developers/work-request/1461901/ [8] https://debusine.debian.net/debian/developers/work-request/1461926/
