1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
|
Hi fellow developers,
It's been some time since our last email. Much has happened since then
with regards to the security support of Debian's testing distribution.
General security support for testing
------------------------------------
The Debian Testing Security team is very near to providing full
security support for the testing distribution. At the time of the last
email, two blockers for full security support were present. However,
we now are able to process embargoed issues (more on that below), so
we are happy to announce that only one blocker remains. The only
remaining blocker for full security support at this point is the
kernel. We are talking to the kernel security team about providing
testing-security support, but at the moment this task lacks
manpower. If you are willing to work on this, please feel free to
contact us. Otherwise, in terms of security at this point we recommend
using the stable kernel or if that is not an option, the unstable
kernel. Also, we would like to state that packages that are not
security supported for stable are likewise unsupported for
testing. This list includes all packages in contrib and non-free, as
well as the ones that are marked unsupported (for example,
kfreebsd). The maintainers are solely responsible for security and
there won't be any DTSAs for such packages.
Security status of the current testing distribution (lenny)
-----------------------------------------------------------
With some pride we can say that testing has never been in such good
shape security wise. The tracker reflects very accurately the current
known security issues in the testing distribution[0]. Our new
announcement emails[1] provide a notification for users whenever a new
security fix reaches testing, whether through migration from unstable
or DTSA for testing-security. Also fewer packages are getting removed
from testing because of security issues.
In order to reach a wider audience with security updates for testing
and due to the beta1 release of the lenny installer including the
testing-security repository in the apt-sources, this new mailing list
was created. We highly recommend that every user who runs Debian
testing and is concerned about security subscribes[1] to this list
Note: this list is a replacement of the old secure-testing-announce
list hosted on alioth which has been removed.
Security status of the next testing distribution (lenny+1)
----------------------------------------------------------
After the release of lenny, there will probably be no security support
for the new testing distribution for some time. It is not clear yet
how long this state will last. Users of testing who need security
support are advised to change their sources.list entries from
"testing" to "lenny" now and only switch to lenny+1 after the begin of
its security support is announced. There will be another announcement
with more details well before the release of lenny.
Embargoed issues and access to wider security information
---------------------------------------------------------
Parts of the Testing Security Team have been added to the
team@security.debian.org alias and are thus also subscribed to the
vendor-sec mailing list where embargoed security issues are
coordinated and discussed between Linux vendors before being released
to the public. The embargoed security queue on security-master will be
used to prepare DTSAs for such issues. This is a major change as the
Testing Security Team was not able to prepare updates for security
issues under embargo before. If a DTSA was prepared for an embargoed
issue in your package, you will either be contacted by us before the
release or you will be notified through the BTS. Either way, you will
most likely get an RC bug against your package including the patch
used for the DTSA. This way you can prepare updates for unstable and
the current unfixed unstable package does not migrate to testing,
where it would overwrite the DTSA.
Freeze of lenny coming up
-------------------------
With the lenny release approaching, the Debian release team will at
some stage freeze the testing archive. This means it is even more
important to stay in close contact with the Debian Testing Security
team to coordinate security updates for the testing distribution. If
one of your packages is affected by an unembargoed security issue,
please contact us through the public list of the team[2] and fix the
issue in unstable with high urgency. Please send as much information
as possible, including patches, ways to reproduce the issue and
further descriptions. If we ask you to prepare a DTSA, please follow
the instructions on the testing-security webpage[3] and go ahead with
the upload. If your package is affected by an embargoed issue, email
the private list[4] and if we should ask you to upload a DTSA, use the
embargoed upload queue (which is the same than for stable/oldstable).
Handling of security in the unstable distribution
-------------------------------------------------
First of all, unstable does not have official security support. The
illusion that the Debian Testing Security team also officially
supports unstable is not true. Security issues in unstable, especially
when the package is not in testing, are not regarded as high urgency
and are only dealt with when there is enough spare time.
However, it is true that most of our security updates migrate through
unstable to prevent doubled workload. For this purpose, we urge every
maintainer to upload their security fixes with high urgency and
mention the CVE ids (if given) in their changelogs. Because we let
fixes migrate, it often happens that we NMU packages. An up to date
list of NMUs done by the security team can be found in our
repository[5]. These NMUs are done as the need arises and do not
always follow the given NMU rules, because security updates are
treated with higher urgency.
Call for new members:
---------------------
The team is still looking for new members. If you are interested in
joining the Debian Testing Security team, please speak up and either
write to the public mailing list[2] or approach us on the internal
mailing list[6]. Note that you do not have to be a DD for all tasks.
Check out our call for help[7] for more information about the tasks
and the requirements if you want to join the team. We also look for
people with experienced knowledge regarding the kernel. We would like
to start security support for the kernel packages in testing and
prepare DTSAs for the unembargoed kernel issues. For this task, it
would be good to have one or two designated people in the Debian
Testing Security team to only concentrate on this task. If you are
interested, please speak up.
Yours,
Testing Security
[0]: http://security-tracker.debian.net/tracker/status/release/testing
[1]: http://lists.debian.org/debian-testing-security-announce
[2]: secure-testing-team@lists.alioth.debian.org
[3]: http://testing-security.debian.net/uploading.html
[4]: team@security.debian.org
[5]: http://svn.debian.org/wsvn/secure-testing/data/NMU/list?op=file&rev=0&sc=0
[6]: team@testing-security.debian.net
[7]: http://lists.debian.org/debian-devel-announce/2008/03/msg00007.html
|
