On Fri, 09 Aug 2024 at 13:31:02 +0000, Johannes Drexl wrote: > I was under the impression that the software stack of a > stable/oldstable release does not change anymore (safe for security > updates and suchlike), so I'm pretty flabberghasted by this. More so as > I cannot find a mention about this on debian-devel, where I would > assume such decisions would be discussed prior to the actual doing. > > Can somebody please shed some light on this?
debian-devel primarily deals with development of the next version of Debian, and the (old)stable releases are managed by the stable release team. Removals and other more major changes in (old)stable are intentionally rare, but can happen. In the case of salt, it was removed from Debian 11 in the 11.10 point release, as announced in <https://lists.debian.org/debian-stable-announce/2024/06/msg00000.html>. This was requested by a security team member in <https://bugs.debian.org/1070175>, prompted by its removal from unstable in <https://bugs.debian.org/1069654>, which appears to have been caused by not having any volunteers willing to take responsibility for maintaining this security-sensitive package. Older versions of the salt package continue to be available from <https://snapshot.debian.org/package/salt/> but will not receive any security or bug-fix updates. The upstream developers have their own newer Debian-compatible packages available, https://docs.saltproject.io/salt/install-guide/en/latest/topics/install-by-operating-system/debian.html (these are not supported by the Debian project). (Also note that Debian 11 comes to the end of its normal support lifetime in a few days' time, on 2024-08-14, although the Debian LTS subproject plans to provide limited security maintenance for an additional 2 years.) smcv
