Control: tags -1 confirmed On 2023-01-29 22:28:05 +0100, Ferenc Wágner wrote: > control: tags -1 - moreinfo > > Sebastian Ramacher <sramac...@debian.org> writes: > > > On 2023-01-24 17:17:36 +0100, Ferenc Wágner wrote: > > > >> Package: release.debian.org > >> Severity: normal > >> User: release.debian....@packages.debian.org > >> Usertags: transition > >> > >> When reporting #1028286 (transition: xml-security-c) I totally missed > >> that one of the mentioned planned upper layer uploads is the > >> shibboleth-sp 3.3 -> 3.4 upgrade, which, contrary to the xml-security-c > >> transition, actually entails an SONAME change. Since this wasn't > >> explicit in the original bug, we decided to ask for your ACK again. > >> As you can see in the autogenerated tracker at > >> https://release.debian.org/transitions/html/auto-shibboleth-sp.html, > >> there are only two reverse dependencies, both of which are internal to > >> the Shibboleth ecosystem (thus maintained by us) and both build without > >> changes against shibboleth-sp 3.4.1+dfsg-1. > > > > What would be the consequences of postponing this transition to trixie? > > There are no significant functional changes in this transition. Our > main reason for proposing it is to ship bookworm with the "current > stable release" as much as possible, because upstream provides security > support for the latest two stable releases only [1], and Shibboleth, > being security software, heavily depends on being patched in a timely > manner to stay useful. While upstream actively works with us on > preparing updates during the embargo periods, this may not be enough if > we have to backport the fixes ourselves, so we strive to minimize such > exposure. Since this transition affects only two packages, which we > need to rebuild anyway, we'd welcome the additional safety this upgrade > would mean in providing security support for bookworm.
ACK, please go ahead. Cheers > > [1] > https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1134625008/ProductVersioning > -- > Best regards, > Feri. -- Sebastian Ramacher