Re: Version numbering for security uploads of native packages

2008-03-21 Thread Moritz Muehlenhoff
On 2008-03-16, Adam D. Barratt <[EMAIL PROTECTED]> wrote: > On Sun, 2008-03-16 at 03:47 -0700, Steve Langasek wrote: >> The current binNMU numbering scheme was selected explicitly to allow >> security uploads to sort later by numbering as >> +; e.g., 1.2-5.1+etch1. > > That makes sense, although do

Re: Version numbering for security uploads of native packages

2008-03-20 Thread Reinhard Tartler
Gunnar Wolf <[EMAIL PROTECTED]> writes: > At some point in 2006, a serious flaw is addressed via a NMU, so > it sits at 1.0+sarge1. I still cannot be bothered to take a look at > the damn package. Time passes. In March 2008 it (again) shows it needs > to be taken care of, and you kindly prepare a

Re: Version numbering for security uploads of native packages

2008-03-19 Thread Russ Allbery
Gunnar Wolf <[EMAIL PROTECTED]> writes: > Russ Allbery dijo [Wed, Mar 19, 2008 at 12:05:53PM -0700]: >> 1.0-1sarge1 >> 1.0-1etch1. We don't have this problem currently >> because 1.0-1etch1 << 1.0-1lenny1, but we will again at some point in >> the future, and it would be nice to resolve it once a

Re: Version numbering for security uploads of native packages

2008-03-19 Thread Gunnar Wolf
Russ Allbery dijo [Wed, Mar 19, 2008 at 12:05:53PM -0700]: > >> Yes, sorry. I forgot that those exist as well. :-) > > > Why are we bothering to make something up if everyone is using etch > > etc? > > 1.0-1sarge1 >> 1.0-1etch1. We don't have this problem currently because > 1.0-1etch1 << 1.0-1

Re: Version numbering for security uploads of native packages

2008-03-19 Thread James Vega
On Wed, Mar 19, 2008 at 07:54:46PM +0100, Luk Claes wrote: > Bas Wijnen wrote: > > On Wed, Mar 19, 2008 at 11:37:07AM -0700, Russ Allbery wrote: > >> Bas Wijnen <[EMAIL PROTECTED]> writes: > > >> We have other ways of tracking that information than the version, though. > > > > Yes, and I don't re

Re: Version numbering for security uploads of native packages

2008-03-19 Thread Russ Allbery
Luk Claes <[EMAIL PROTECTED]> writes: > Bas Wijnen wrote: >> Yes, sorry. I forgot that those exist as well. :-) > Why are we bothering to make something up if everyone is using etch > etc? 1.0-1sarge1 >> 1.0-1etch1. We don't have this problem currently because 1.0-1etch1 << 1.0-1lenny1, but we

Re: Version numbering for security uploads of native packages

2008-03-19 Thread Luk Claes
Bas Wijnen wrote: > On Wed, Mar 19, 2008 at 11:37:07AM -0700, Russ Allbery wrote: >> Bas Wijnen <[EMAIL PROTECTED]> writes: >> We have other ways of tracking that information than the version, though. > > Yes, and I don't really care, I just think going from +s1+nmu1 to +s2 > seems to be doing th

Re: Version numbering for security uploads of native packages

2008-03-19 Thread Bas Wijnen
On Wed, Mar 19, 2008 at 11:37:07AM -0700, Russ Allbery wrote: > Bas Wijnen <[EMAIL PROTECTED]> writes: > > > You can base security uploads on NMUs, so I think you could get > > +s1+nmu1+s1+nmu1, etc. Or should it go from +s1 to +s1+nmu1 to +s2 to > > +s2+nmu1? > > I was assuming the latter. > >

Re: Version numbering for security uploads of native packages

2008-03-19 Thread Russ Allbery
Bas Wijnen <[EMAIL PROTECTED]> writes: > You can base security uploads on NMUs, so I think you could get > +s1+nmu1+s1+nmu1, etc. Or should it go from +s1 to +s1+nmu1 to +s2 to > +s2+nmu1? I was assuming the latter. > I prefer the longer versions in this case. When a package gets too many > se

Re: Version numbering for security uploads of native packages

2008-03-19 Thread Bas Wijnen
On Mon, Mar 17, 2008 at 04:46:54PM +0100, Vincent Danjean wrote: > Bas Wijnen wrote: > > Ok, that makes sense. However, with +nmu1, there still is the problem > > of how to name security uploads. With +s1, they sort after +nmu1, which > > I think is wrong. > > > > But we're talking about uploads

Re: Version numbering for security uploads of native packages

2008-03-17 Thread Russ Allbery
Bas Wijnen <[EMAIL PROTECTED]> writes: > Ok, that makes sense. However, with +nmu1, there still is the problem > of how to name security uploads. With +s1, they sort after +nmu1, which > I think is wrong. There's no reason why we have to stick to one suffix. +s1+nmu1 for an NMU after a securit

Re: Version numbering for security uploads of native packages

2008-03-17 Thread Vincent Danjean
Bas Wijnen wrote: > On Sun, Mar 16, 2008 at 06:40:25PM +, Adam D. Barratt wrote: >> On Sun, 2008-03-16 at 11:22 -0700, Russ Allbery wrote: >>> "Adam D. Barratt" <[EMAIL PROTECTED]> writes: On Sun, 2008-03-16 at 09:06 +0100, Bas Wijnen wrote: >> [...] > Good idea. Even better, IMO, wou

Re: Version numbering for security uploads of native packages

2008-03-17 Thread Bas Wijnen
On Sun, Mar 16, 2008 at 06:40:25PM +, Adam D. Barratt wrote: > On Sun, 2008-03-16 at 11:22 -0700, Russ Allbery wrote: > > "Adam D. Barratt" <[EMAIL PROTECTED]> writes: > > > On Sun, 2008-03-16 at 09:06 +0100, Bas Wijnen wrote: > [...] > > >> Good idea. Even better, IMO, would be to use a syste

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Joey Hess
Bas Wijnen wrote: > This does break versions which go from 1 to 1.1 to 1.2 to 2 to 2.1, etc, > but we're talking about native packages, which means we can expect > upstream not to be so crazy. People do this all the time, for completly sane reasons. -- see shy jo signature.asc Description: Di

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Adam D. Barratt
On Sun, 2008-03-16 at 11:22 -0700, Russ Allbery wrote: > "Adam D. Barratt" <[EMAIL PROTECTED]> writes: > > On Sun, 2008-03-16 at 09:06 +0100, Bas Wijnen wrote: [...] > >> Good idea. Even better, IMO, would be to use a system which is in > >> line with non-native packages. How about this rule: > >

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Russ Allbery
"Adam D. Barratt" <[EMAIL PROTECTED]> writes: > On Sun, 2008-03-16 at 09:06 +0100, Bas Wijnen wrote: >> [Adding bug #437392 to Cc, which deals with this issue for normal >> NMUs, because I'm making a suggestion about them.] >> >> On Sat, Mar 15, 2008 at 11:52:55PM +, Adam D. Barratt wrote: >>

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Bas Wijnen
On Sun, Mar 16, 2008 at 08:23:43PM +0900, Charles Plessy wrote: > Le Sun, Mar 16, 2008 at 12:10:13PM +0100, Bas Wijnen a écrit : > > > > This could also lead to a problem in very rare cases: If a program has > > the same version in stable and testing, and gets a security update, then > > they both

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Adam D. Barratt
On Sun, 2008-03-16 at 09:06 +0100, Bas Wijnen wrote: > [Adding bug #437392 to Cc, which deals with this issue for normal > NMUs, because I'm making a suggestion about them.] > > On Sat, Mar 15, 2008 at 11:52:55PM +, Adam D. Barratt wrote: > > devscripts 2.10.19 (soon to be uploaded) will modif

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Charles Plessy
Le Sun, Mar 16, 2008 at 12:10:13PM +0100, Bas Wijnen a écrit : > > This could also lead to a problem in very rare cases: If a program has > the same version in stable and testing, and gets a security update, then > they both get a similar version. For the example, say 1.2-5.1+sarge1 in > stable a

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Adam D. Barratt
On Sun, 2008-03-16 at 03:47 -0700, Steve Langasek wrote: > The current binNMU numbering scheme was selected explicitly to allow > security uploads to sort later by numbering as > +; e.g., 1.2-5.1+etch1. That makes sense, although doesn't seem to match current practice. Was any consideration given

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Raphael Hertzog
On Sun, 16 Mar 2008, Thijs Kinkhorst wrote: > On Sunday 16 March 2008 00:52, Adam D. Barratt wrote: > > We're aware that the Developers Reference specifies that the latter > > format should be used, but it is problematic as -0.1 sorts before +b1 > > and, as such, the NMU will not supersede any prev

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Bas Wijnen
On Sun, Mar 16, 2008 at 03:47:56AM -0700, Steve Langasek wrote: > The current binNMU numbering scheme was selected explicitly to allow > security uploads to sort later by numbering as > +; e.g., 1.2-5.1+etch1. This could also lead to a problem in very rare cases: If a program has the same version

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Thijs Kinkhorst
On Sunday 16 March 2008 11:47, Steve Langasek wrote: > The current binNMU numbering scheme was selected explicitly to allow > security uploads to sort later by numbering as > +; e.g., 1.2-5.1+etch1. Ah, I wasn't aware of that (and no-one seems to be using it currently). The release managers know

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Steve Langasek
On Sun, Mar 16, 2008 at 11:36:20AM +0100, Thijs Kinkhorst wrote: > On Sunday 16 March 2008 00:52, Adam D. Barratt wrote: > > We're aware that the Developers Reference specifies that the latter > > format should be used, but it is problematic as -0.1 sorts before +b1 > > and, as such, the NMU will n

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Thijs Kinkhorst
On Sunday 16 March 2008 00:52, Adam D. Barratt wrote: > We're aware that the Developers Reference specifies that the latter > format should be used, but it is problematic as -0.1 sorts before +b1 > and, as such, the NMU will not supersede any previous binNMUs of the > same package version. > > Whil

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Florian Weimer
* Adam D. Barratt: > Currently, debchange will produce a version number of X-0.1 in such > cases which suffers from the problem described above. It has been > suggested that either one of +s1 / +sec1 / +security1 or 1 > should be used to avoid the issue. For stable and oldstable, we need 1. But

Re: Version numbering for security uploads of native packages

2008-03-16 Thread Bas Wijnen
[Adding bug #437392 to Cc, which deals with this issue for normal NMUs, because I'm making a suggestion about them.] On Sat, Mar 15, 2008 at 11:52:55PM +, Adam D. Barratt wrote: > devscripts 2.10.19 (soon to be uploaded) will modify the behaviour of > "debchange --nmu" to version an NMU of a n

Version numbering for security uploads of native packages

2008-03-15 Thread Adam D. Barratt
[nutshell version for those who can't be bothered to read the full mail :-) - what version number should a security upload of a native package have] Hi, devscripts 2.10.19 (soon to be uploaded) will modify the behaviour of "debchange --nmu" to version an NMU of a native package as X+nmu1 rather t