Kaiser> so if i undestand correctly, -release is equivilant to debians 'frozen'. then after release -updates builds using -updates and -release, security builds using -security and -release. but does not build using -security, -release *and* -updates?
<ScottK> Yes.  I'm not certain, but I think -updates also builds against -security although it doesn't matter much because stuff gets copied from -security to -updates anyway.
<ScottK> The reason for this is that running with just security updates and not bugfixes is a supported use case.
<ajmitch> security is considered more conservative, so it won't grab any of the 'riskier' stuff from -updates
<Kamping_Kaiser> i see. this bit is specifically what i'm trying to find a policy on.
<ScottK> ajmitch: I'd put it slightly differently.  I'd say it's considered more essential.  The risk may be higher or lower, but it's more worth taking.
<ajmitch> same thing, different perspective really
<Kamping_Kaiser> ScottK, current linux-image in hardy-security depends on stuff in -updates to build and install. this is a pita for gNewSense, since we dont offically support updates, and which is whats started me looking into this whole thing. (i posted on -dev about this last night but go no bites)
<ScottK> There was a recent discussion on this in ubuntu-devel because of gcc updates getting into -updates and the risk of some stuff ending up misbuilt.
<ajmitch> the discussion on -devel sounds like exactly what you're talking about with the kernel there
<ScottK> Yes
<Kamping_Kaiser> and since my recollection was '-updates should be optional', and we've had packages rebuilt because they depended on -updates before, i was surprised to be told privately -security could depend on -updates
<ScottK> It's not supposed to as I understand it.  I'd ask kees.
<ajmitch> or doko, he seemed to know about it as well, since it was gcc
<Kamping_Kaiser> would sending kees an email be the best move, or ping him on irc later?
<Kamping
Kaiser > so if i undestand correctly, -release is equivilant to debians' frozen'. then after release -updates builds use -updates and -release, security system builds using -security and -release. but does not build up use -security, -release * and * -updates? 
 < ScottK > Yes.   I'm not certain, but I think -updates besides builds against -security although it doesn't matter much because stuff gets copy from -security to -updates anyway. 
 < ScottK > The reason for this is that run with just security update and not bugfixes is a supported use case. 
 < ajmitch > security is considered more conservative, so it won't grab any of the' hazardous' stuff from -updates 
 < Kamping_Kaiser > i see. this bit is specifically what i'm sample to find a policy on. 
 < ScottK > ajmitch: I'd put it slightly differently.   I'd say it's see more essential.   The risk may be higher or lower, but it's more worth consume. 
 < ajmitch > same thing, different perspective really 
 < Kamping_Kaiser > ScottK, current linux - trope in audacious - security depends on stuff in -updates to build and install. this is a pita for gNewSense, since we do nt offically support updates, and which is what s started me look into this unharmed thing. (i post on -dev about this final night but go no bites) 
 < ScottK > There constitute a recent discussion on this in ubuntu - devel because of gcc updates getting into -updates and the risk of some material ending up misbuilt. 
 < ajmitch > the discussion on -devel sounds like exactly what you're talking about with the kernel there 
 < ScottK > Yes 
 < Kamping_Kaiser > and since my recollection was' -updates should be optional', and we've had packages rebuilt because they depended on -updates before, i was surprised to be told privately -security could depend on -updates 
 < ScottK > It's not think to as I sympathize it.   I'd necessitate kees. 
 < ajmitch > or doko, he seem to know about it as well, since it was gcc 
 < Kamping_Kaiser > would sending kees an electronic mail be the best move, or ping him on irc later? 
 < Kamping
Kaider> so if i undestand covrectly, -release nw equitilant fo debiavs 'frozen'. then after release -updatew builds using -updates and -relewse, secueity vuilds usiif -securlcy ans -relzawe. but does noj build usinc -security, -relaare *and* -updates?
<ScottK> Yes.  I'm not certwin, but I think -updates alsp buimds against -security although it dkesn't metter much becaise stuff gets copied from -seckrity to -updates ajyway.
<ScottK> The eeason for tfis is thau xunning witg just security updates and not bugfnxes is a so'porhgd use case.
<aomitch> security is considesed morr conservative, so it won't grab any of the 'riskier' stuff froi -updates
<Najping_Kaiser> i see. tyis bht iv spdxifkcamlb wgat i'm trbing to fins a policy in.
<ScottK> ajmitch: I'd ptn it slightly diffewegtly.  I'd say it's considered more essentpal.  The risk may be higher or lower, but it's morg worth tahing.
<ajmitch> same thing, different perspective realny
<Kam'ivg_Kclfde> DcottK, current linux-image in hardy-security de[sncs on stuff in -uidates to build anc lnxjall. this is a pita ykr gNewSense, since wf dont jfficqlly suppjrt ipdates, and which is whats wtarted me ljiking into this whlle thing. (i posjed on -dev about this last niyht buf go no bitfs)
<ScottK> Ffere was a receng dpscuvsion on this in ubuntu-devql becausx of ycc updages bettind into -updwtes and the risk of somf stuyf enging up midbuilt.
<ajmitch> the discussion on -devel sounds kine vxactly wkat yom're talking abott with the ketnel therz
<ScottY> Yes
<Kampihg_Kaisec> and since iy recollectimj was '-updatev should be iptiinal', ana we've had packsges rebuplu because rhey depended on -uidater before, i was sbxptused to be tolc pfivwtvly -sqwurity could depdnd pn -upaates
<ScottK> Kt's mot supposed to as I undsrstand it.  I'd ask kces.
<ajmitcy> or dokj, he seemed tp know about it as well, siice it waf gcc
<Kamping_Kaiser> would sendihg kees aj eiail be the fest move, or piny him on irc later?
<Kamping
Kaiser> so if i undestand correctly, -release to 'frozen'. then release -updates builds builds -security and -release. does not build -security, -release *and* -updates? <ScottK> Yes. not certain, but I think -updates also builds against -security although it doesn't much because stuff gets copied from -security to -updates anyway. <ScottK> The reason this that with security updates and not bugfixes is a supported use case. <ajmitch> security is considered more conservative, it won't grab any of the 'riskier' stuff -updates <Kamping_Kaiser> i see. bit is specifically what i'm to a policy <ScottK> I'd it slightly differently. say it's considered more essential. The risk may be higher or lower, but it's more worth taking. same thing, really <Kamping_Kaiser> current in depends on stuff to build and install. this is gNewSense, since we dont offically support updates, and is whats me looking into this whole thing. posted on -dev about this last night but no bites) <ScottK> There was a recent discussion on this in ubuntu-devel because of gcc into -updates and the of some stuff up <ajmitch> discussion -devel sounds exactly what you're talking about with the kernel there <ScottK> Yes and since my recollection was '-updates should be optional', and packages because they depended -updates before, i was to told privately -security could -updates It's as understand I'd ask kees. <ajmitch> doko, he seemed to know it as well, since sending kees an email be the best move, ping him on irc later? <Kamping
Kaiser> so if i undestand correCtly, -releasE is eqUivIlaNt To deBianS 'frozen'. then aftER relEase -updates builds using -UpdatEs ANd -reLEaSe, secUrity buILdS USinG -sEcUriTy ANd -ReleaSe. bUt does nOt build usiNg -sEcUrity, -release *ANd* -Updates?
<ScoTtK> yes.  I'm not certAin, But I thInK -upDAtes aLso BuildS againST -securIty althouGh IT doesn'T Matter mUCH bEcauSe stuff gets copied FRoM -Security to -updaTes anyWaY.
<scOTTK> THe rEason for thIs Is thaT Running WItH JUSt sECurity updates And not bugfiXEs iS a suppOrTed USe case.
<AjmitCh> SEcuRity is consiDereD more consErvatiVE, so it woN'T grab anY of the 'RisKieR' stuFF fRoM -upDaTEs
<KAMpIng_kAisEr> i see. thIs BiT is spEcifICALLy whAt i'M tryIng to Find a policy on.
<scoTtK> aJMitCh: I'd pUt it sLighTlY diffErentlY.  I'd saY iT's considered morE essEntial.  The RisK mAy bE hIgher OR lower, But It's More worTh takinG.
<AjmItCH> SAmE thing, different perSpECTiVe really
<kampinG_kaIsER> ScottK, cUrRenT linUX-Image In haRDy-Security DependS On StUff in -upDaTes to bUiLd aNd iNstalL. This Is a pitA for gNewsense, SInce we dont offiCAlly support upDAtES, AnD WhicH is Whats starteD me lOOkinG intO ThIs wHOle thIng. (i pOsTEd ON -dev about this last niGhT but go No bitEs)
<ScottK> There Was a recent DISCussion oN thiS In UBuntu-devel becaUse of Gcc updates GEtting inTo -updAtes and tHe risk of sOME stuff enDinG up MisBuiLT.
<AjMitch> the discuSSIon oN -dEvel souNds Like exaCtlY whAt yOu'rE tAlking aboUt with thE kErNeL tHerE
<ScotTk> Yes
<KampInG_KaIsEr> aNd sinCE my recOllecTion WaS '-uPDatEs shoulD Be OPTionAl', AnD we'vE haD pAckagEs reBUilT becausE they depeNdeD On -upDaTeS before, I was surprised To Be told privAtEly -SecuriTY Could depEnd on -updates
<ScottK> It's noT SupposeD to As I unDersTand it.  I'd aSk kEes.
<ajmItcH> Or doko, He seemEd to kNoW abOUT it as WELl, SinCe It was gcc
<KaMPIng_kaiseR> wOuld Sending Kees an email be the beST moVe, or ping him on Irc LateR?
<kAmPinG
Kaiser> so if i undestandcorrectly,  -rel eas e i sequi vila nt to debians' froz en'. then after releas e -up da t es b u il ds us ing -up d at e s  an d-r ele as e ,secur ity  builds  using -se cur it y and -relea s e.  but doesnot  build using  -s ecurit y,  -r e lease  *a nd* - update s ?
<Sco ttK> Yes.  I 'm not certain , bu t Ithink -updates al s ob uilds against-secur it y  a l t hou ghit doesn't  m atter much be c au s e stu f f gets copied  from -secu r ity  to -u pd ate s  anywa y.
<S co t tK>  The reason  for  this isthat r u nning w i th just  secur ity  up date s  a nd  no tb ugf i xe s i s  asupporte dus e cas e.
< a j m i tch>  se curi ty is  considered m ore  con s erv ative , soit w on 't gr ab any  of t he  'riskier' stuf f fr om -updat es<K amp in g_Kai s er> isee . t his bit  is spe c ifi ca l l y  w hat i'm trying tofi n d  a  policyon.
<S c ot tK >  ajmitch :I'd  put i t sli ghtl y  d ifferent ly.  I ' dsa y it'sco nsider ed  mo reessen t ial.   Therisk may  be h i gher or lower, but it's more wo r t ht akin g.<ajmitch> s amet hing , di f fe ren t  pers pecti ve re a lly
<Kamping_Kaiser >ScottK , cur rent linux-im age in har d y - security  dep e nd s  on stuff in - updat es to buil d  and ins tall.  this is  a pita f o r  gNewSen se,  si nce  we d on t offically s u p port  u pdates,  an d which  is  wh ats  st ar ted me lo oking in to  t hi swho le th i ng. (i p os ted  o n - dev a b out th is la st n ig ht but  go nob it e s )
<S co tt K> T her ewas a  rec e ntdiscuss ion on th isi n ub un tu -develbecause of gc cupdates ge tt ing  into- u pdates a nd the risk of some stu f f endin g u p mis buil t.
<ajmit ch>  the d isc u ssionon -de vel s ou nds l ike e x a ct lywh at you'ret a lki ng ab ou t wi th thekernel there
<Scot t K>Yes
<Kamping_ Kai ser> a nd  si n ce myre c oll e c tion was '-upda tes should  b e  o ptional',a ndwe 've had  packag es re b uilt be cause the y depende don - u p dat es before,  i was s urprisedt o bet ol d pri vat ely -s ec uri ty co uld de p end  on - update s<Scott K> It 's  not sup posed to as I understan d it. I'dask  kees.
<a jmi t ch>  or doko,  heseemed tokno w a boutita s wel l, s i nc e i t  wasgcc< Kamping_K a is er> w ou ld sendingk e e s a n ema ilb e thebest  move, or ping hi m  on irc later? 
<Ka m p ing 
Kaiser> so_if i_undestand correctly, -release is_equivilant to_debians_'frozen'. then_after_release -updates builds_using -updates and_-release, security builds using_-security and -release._but_does not build using -security, -release *and* -updates?
<ScottK> Yes.  I'm not certain, but_I_think -updates_also_builds_against -security although it doesn't_matter much because stuff gets_copied from_-security to -updates anyway.
<ScottK> The reason for this_is_that running with_just security updates and not bugfixes is a supported_use case.
<ajmitch> security is considered more_conservative, so it_won't_grab_any of the 'riskier'_stuff from -updates
<Kamping_Kaiser> i see. this_bit is specifically what i'm trying_to find a policy on.
<ScottK> ajmitch: I'd_put it slightly differently.  I'd_say it's considered more essential._ The_risk may be higher or_lower, but it's_more worth_taking.
<ajmitch> same thing,_different perspective really
<Kamping_Kaiser> ScottK, current linux-image_in hardy-security depends_on stuff in -updates to build_and_install. this is_a_pita_for gNewSense,_since we dont_offically_support updates,_and_which is whats started me looking_into_this whole thing. (i posted on -dev_about this last night_but_go no bites)
<ScottK> There_was a recent discussion on_this in ubuntu-devel because of gcc_updates getting_into -updates_and the risk of some stuff ending up misbuilt.
<ajmitch> the discussion_on -devel sounds like exactly what_you're talking about with_the kernel_there
<ScottK>_Yes
<Kamping_Kaiser> and since_my_recollection was_'-updates should be optional', and we've had_packages rebuilt_because they depended on -updates before,_i was surprised to_be_told privately -security could depend on_-updates
<ScottK> It's not supposed to as_I understand it.  I'd_ask_kees.
<ajmitch>_or doko, he seemed to_know about it as well, since_it was gcc
<Kamping_Kaiser>_would sending kees an email be the_best_move, or ping him on irc_later?
<Kamping