<!entity % commondata SYSTEM "common.ent" > %commondata;
<!-- CVS revision of this document -->
- <!entity cvs-rev "$Revision: 1.117 $">
+ <!entity cvs-rev "$Revision: 1.125 $">
<!-- if you are translating this document, please notate the CVS
revision of the developers reference here -->
<!--
administrator at &email-listmaster;. More information on available
mailing lists can be found in <ref id="mailing-lists">.
&email-debian-devel-announce; is another list which is mandatory
-for anyone who wish to follow Debian's development.
+for anyone who wishes to follow Debian's development.
<p>
You should subscribe and lurk (that is, read without posting) for a
bit before doing any coding, and you should post about your intentions
<sect id="key-maint">Maintaining your public key
<p>
Be very careful with your private keys. Do not place them on any
-public servers or multiuser machines, such as
-<tt>&master-host;</tt>. Back your keys up; keep a copy offline.
+public servers or multiuser machines, such as the Debian servers
+(see <ref id="server-machines">). Back your keys up; keep a copy offline.
Read the documentation that comes with your software; read the <url
id="&url-pgp-faq;" name="PGP FAQ">.
<p>
<chapt id="resources">Resources for Debian Developers
<p>
In this chapter you will find a very brief road map of the Debian
-mailing lists, the main Debian servers, other Debian machines
+mailing lists, the Debian machines
which may be available to you as a developer, and all the other
resources that are available to help you in your maintainer work.
<sect id="mailing-lists">Mailing lists
<p>
-The mailing list server is at <tt>&lists-host;</tt>. Mail
+The mailing list server is at <tt>&lists-host;</tt>.
+ <p>
+Online archives of mailing lists are available at <url
+id="&url-lists-archives;">.
+
+ <sect1 id="core-devel-mailing-lists">Core development mailing lists
+ <p>
+The core Debian mailing lists that developers should use are:
+<list>
+ <item>&email-debian-devel-announce;, used to announce important things to
+ developers.
+ All developers are expected to be subscribed to this list.
+ </item>
+ <item>&email-debian-devel;, used to discuss various development related
+ technical issues.
+ </item>
+ <item>&email-debian-policy;, where the Debian Policy is discussed and
+ voted on.
+ </item>
+ <item>&email-debian-project;, used to discuss various non-technical
+ issues related to the project.
+ </item>
+</list>
+ <p>
+There are
+other mailing lists available for a variety of special topics; see
+<url id="&url-debian-lists-subscribe;"> for a list.
+
+ <sect1 id="mailing-lists-subunsub">Subscribing and unsubscribing
+ <p>
+To subscribe to or unsubscribe from any of the Debian mailing lists, email
<tt>debian-<var>foo</var>-REQUEST@&lists-host;</tt>, where
<tt>debian-<var>foo</var></tt> is the name of the list, with the word
<tt>subscribe</tt> in the <em>Subject</em> to subscribe to the list or
-<tt>unsubscribe</tt> to unsubscribe. More detailed instructions on
-how to subscribe and unsubscribe to the mailing lists can be found at
-<url id="&url-debian-lists-subscribe;">, <url id="&url-debian-lists;">
-or locally in &file-mail-lists; if you have the
-<package>doc-debian</package> package installed.
+<tt>unsubscribe</tt> to unsubscribe.
+ <p>
+If you prefer to use a web page to subscribe to multiple mailing lists,
+there's one at <url id="&url-debian-lists-subscribe;">.
+ <p>
+You can download the current list of mailing lists and basic usage
+instructions from <url id="&url-debian-lists-txt;">
+or install the <package>doc-debian</package> package and have it
+locally in &file-mail-lists;.
+
+ <sect1 id="mailing-lists-rules">Basic rules for use
<p>
When replying to messages on the mailing list, please do not send a
carbon copy (<tt>CC</tt>) to the original poster unless they explicitly
request to be copied. Anyone who posts to a mailing list should read
it to see the responses.
<p>
-The following are the core Debian mailing lists: &email-debian-devel;,
-&email-debian-policy;, &email-debian-user;, &email-debian-private;,
-&email-debian-announce;, and &email-debian-devel-announce;. All
-developers are expected to be subscribed to at least
-&email-debian-devel-announce;. There are
-other mailing lists available for a variety of special topics; see
-<url id="&url-debian-lists-subscribe;"> for a list. Cross-posting
-(sending the same message to multiple lists) is discouraged.
+Cross-posting (sending the same message to multiple lists) is discouraged.
+As ever on the net, please trim down the quoting of articles you're
+replying to. In general, please adhere to the usual conventions for
+posting messages. Please read the <url name="code of conduct"
+id="&url-debian-lists;"> for more information.
+
+ <sect1 id="mailing-lists-special">Special lists
<p>
&email-debian-private; is a special mailing list for private
discussions amongst Debian developers. It is meant to be used for
&email-debian-private; unless it is really necessary. Moreover, do
<em>not</em> forward email from that list to anyone. Archives of this
list are not available on the web for obvious reasons, but you can see
-them using your shell account on <tt>&master-host;</tt> and looking
+them using your shell account on <tt>lists.debian.org</tt> and looking
in the <file>~debian/archive/debian-private</file> directory.
<p>
&email-debian-email; is a special mailing list used as a grab-bag
for Debian related correspondence such as contacting upstream authors
about licenses, bugs, etc. or discussing the project with others where it
might be useful to have the discussion archived somewhere.
- <p>
-As ever on the net, please trim down the quoting of articles you're
-replying to. In general, please adhere to the usual conventions for
-posting messages.
- <p>
-Online archives of mailing lists are available at <url
-id="&url-lists-archives;">.
<sect id="irc-channels">IRC channels
<p>
should not speak there of issues that are discussed in
&email-debian-private;. There's a key protected channel
<em>#debian-private</em> for that purpose. The key is available
-in the archives of debian-private in <file>&master-host;:&file-debian-private-archive;</file>, just <prgn>zgrep</prgn> for <em>#debian-private</em> in
+in the archives of debian-private in
+<file>master.debian.org:&file-debian-private-archive;</file>,
+just <prgn>zgrep</prgn> for <em>#debian-private</em> in
all the files.
<p>
There are other additional channels dedicated to specific subjects.
are linked from <url id="&url-devel-docs;" name="The Developers' Corner">.
Take the time to browse all the links, you will learn many more things.
- <sect id="server-machines">Debian servers
+
+ <sect id="server-machines">Debian machines
+ <p>
+Debian has several computers working as servers, most of which serve
+critical functions in the Debian project. Most of the machines are used
+for porting activities, and they all have a permanent connection to the
+Internet.
+ <p>
+Most of the machines are available for individual developers to use,
+as long as the developers follow the rules set forth in the
+<url name="Debian Machine Usage Policies" id="&url-dmup;">.
+ <p>
+Generally speaking, you can use these machines for Debian-related purposes
+as you see fit. Please be kind to system administrators, and do not use
+up tons and tons of disk space, network bandwidth, or CPU without first
+getting the approval of the admins. Usually these machines are run by
+volunteers.
+ <p>
+Please take care to protect your Debian passwords and SSH keys installed on
+Debian machines. Avoid login or upload methods which send passwords over
+the Internet in the clear, such as telnet, FTP, POP etc.
+ <p>
+Please do not put any material that doesn't relate to Debian on the Debian
+servers, unless you have prior permission.
<p>
-Debian servers are well known servers which serve critical functions
-in the Debian project. Every developer should know what these servers
-are and what they do.
+The current list of Debian machines is available at
+<url id="&url-devel-machines;">. That web page contains machine names,
+contact information, information about who can log in, SSH keys etc.
<p>
If you have a problem with the operation of a Debian server, and you
think that the system operators need to be notified of this problem,
-please find the contact address for the particular machine at <url
-id="&url-devel-machines;">. If you have a non-operating problems
-(such as packages to be removed, suggestions for the web site, etc.),
+the Debian system administrator team is reachable at
+<email>debian-admin@lists.debian.org</email>.
+ <p>
+If you have a problem with a certain service, not related to the system
+administration (such as packages to be removed from the archive,
+suggestions for the web site, etc.),
generally you'll report a bug against a ``pseudo-package''. See <ref
id="submit-bug"> for information on how to submit bugs.
- <sect1 id="servers-master">The master server
+ <sect1 id="servers-bugs">The bugs server
<p>
-<tt>&master-host;</tt> is the canonical location for the Bug Tracking
+<tt>bugs.debian.org</tt> is the canonical location for the Bug Tracking
System (BTS). If you plan on doing some statistical analysis or
processing of Debian bugs, this would be the place to do it. Please
describe your plans on &email-debian-devel; before implementing
anything, however, to reduce unnecessary duplication of effort or
wasted processing time.
<p>
-All Debian developers have accounts on <tt>&master-host;</tt>.
-Please take care to protect your password to this machine. Try to
-avoid login or upload methods which send passwords over the Internet
-in the clear.
- <p>
-If you find a problem with <tt>&master-host;</tt> such as disk
-full, suspicious activity, or whatever, send an email to
-&email-debian-admin;.
+All Debian developers have accounts on <tt>bugs.debian.org</tt>.
<sect1 id="servers-ftp-master">The ftp-master server
<p>
-The ftp-master server, <tt>&ftp-master-host;</tt> (or
-<tt>auric.debian.org</tt>), holds the canonical copy of the Debian
+The <tt>ftp-master.debian.org</tt> server holds the canonical copy of the Debian
archive (excluding the non-US packages). Generally, package uploads
go to this server; see <ref id="upload">.
<p>
an email to &email-ftpmaster;, but also see the procedures in
<ref id="archive-manip">.
- <sect1 id="servers-www">The WWW server
+ <sect1 id="servers-non-us">The non-US server
<p>
-The main web server, <tt>&www-host;</tt>, is also known as
-<tt>klecker.debian.org</tt>. All developers are given accounts on this
-machine.
+The non-US server, <tt>non-us.debian.org</tt>,
+holds the canonical copy of the non-US part of the Debian archive.
+If you need to upload a package into one of the non-US sections, upload it
+to this server; see <ref id="upload-non-us">.
<p>
-If you have some Debian-specific information which you want to serve
-on the web, you can do this by putting material in the
-<file>public_html</file> directory under your home directory. You should
-do this on <tt>klecker.debian.org</tt>. Any material you put in those areas
-are accessible via the URL
-<tt>http://people.debian.org/~<var>user-id</var>/</tt>.
-You should only use this particular location because it will be backed up,
-whereas on other hosts it won't. Please do not put any material on Debian
-servers not relating to Debian, unless you have prior permission.
-Send mail to &email-debian-devel; if you have any questions.
+Problems with the non-US package archive should generally be submitted as
+bugs against the <package>nonus.debian.org</package> pseudo-package (notice
+the lack of hyphen between "non" and "us" in the pseudo-package name
+— that's for backwards compatibility). Remember to check whether or
+not someone else has already reported the problem on the
+<url id="http://bugs.debian.org/nonus.debian.org" name="Bug Tracking System">.
+
+ <sect1 id="servers-www">The www-master server
+ <p>
+The main web server is <tt>www-master.debian.org</tt>.
+It holds the official web pages, the face
+of Debian for most newbies.
<p>
If you find a problem with the Debian web server, you should generally
submit a bug against the pseudo-package,
-<package>www.debian.org</package>. First check whether or not someone
+<package>www.debian.org</package>. Remember to check whether or not someone
else has already reported the problem on the
<url id="http://bugs.debian.org/www.debian.org" name="Bug Tracking System">.
+ <sect1 id="servers-people">The people web server
+ <p>
+<tt>people.debian.org</tt> is the server used
+for developers' own web pages about anything related to Debian.
+ <p>
+If you have some Debian-specific information which you want to serve
+on the web, you can do this by putting material in the
+<file>public_html</file> directory under your home directory on
+<tt>people.debian.org</tt>.
+This will be accessible at the URL
+<tt>http://people.debian.org/~<var>your-user-id</var>/</tt>.
+ <p>
+You should only use this particular location because it will be backed up,
+whereas on other hosts it won't.
+ <p>
+Usually the only reason to use a different host is when you need to publish
+materials subject to the U.S. export restrictions, in which case you can use
+one of the other servers located outside the United States, such as the
+aforementioned <tt>non-us.debian.org</tt>.
+ <p>
+Send mail to &email-debian-devel; if you have any questions.
<sect1 id="servers-cvs">The CVS server
<p>
-<tt>cvs.debian.org</tt> is also known as <tt>klecker.debian.org</tt>,
-discussed above. If you need to use a publicly accessible CVS
+Our CVS server is located on <tt>cvs.debian.org</tt>.
+ <p>
+If you need to use a publicly accessible CVS
server, for instance, to help coordinate work on a package between
many different developers, you can request a CVS area on the server.
<p>
the Debian account that should own the CVS root area, and why you need it.
- <sect1 id="devel-db">The Developers Database
+ <sect id="devel-db">The Developers Database
<p>
The Developers Database, at <url id="&url-debian-db;">, is an LDAP
directory for managing Debian developer attributes. You can use this
that newer push mirroring techniques ensure that mirrors are as
up-to-date as they can be.
<p>
-The main web page listing the available public FTP (and, usually,
-HTTP) servers can be found at <url id="&url-debian-mirrors;">. More
+The main web page listing the available public FTP/HTTP
+servers can be found at <url id="&url-debian-mirrors;">. More
information concerning Debian mirrors can be found at <url
id="&url-debian-mirroring;">. This useful page includes information
and tools which can be helpful if you are interested in setting up
have accounts on these machines.
- <sect id="other-machines">Other Debian developer machines
- <p>
-There are other Debian machines which may be made available to you.
-You can use these for Debian-related purposes as you see fit. Please
-be kind to system administrators, and do not use up tons and tons of
-disk space, network bandwidth, or CPU without first getting the
-approval of the local maintainers. Usually these machines are run by
-volunteers. Generally, these machines are for porting activities.
- <p>
-Aside from the servers mentioned in <ref id="server-machines">, there
-is a list of machines available to Debian developers at <url
-id="&url-devel-machines;">.
-
-
-
<sect id="archive">The Debian archive
<p>
The &debian-formal; distribution consists of a lot of packages
packages actually are, and which is handled by the archive maintenance
database and the accompanying programs. The former contains the
distributions, <em>stable</em>, <em>testing</em> and <em>unstable</em>.
-Each of those distribution directories is divided in equivalent
-subdirectories purpose of which is equal, so we will only explain how it
-looks in stable. The <file>Packages</file> and <file>Sources</file> files in the
+The <file>Packages</file> and <file>Sources</file> files in the
distribution subdirectories can reference files in the <file>pool/</file>
-directory.
+directory. The directory tree below each of the distributions is arranged
+in an identical manner. What we describe below for <em>stable</em> is
+equally applicable to the <em>unstable</em> and <em>testing</em>
+distributions.
<p>
<file>dists/stable</file> contains three directories, namely <file>main</file>,
-<file>contrib</file>, and <file>non-free</file>.
+<file>contrib</file>, and <file>non-free</file>.
<p>
In each of the areas, there is a directory for the source packages
(<file>source</file>) and a directory for each supported architecture
to make sure everything in this distribution is working properly, it is
sometimes literally unstable.
<p>
-The testing distribution is generated automatically by taking
+<ref id="testing"> is generated automatically by taking
packages from unstable if they satisfy certain criteria. Those
criteria should ensure a good quality for packages within testing.
-<ref id="testing-scripts"> are launched each day after the
+The update to testing is launched each day after the
new packages have been installed.
<p>
After a period of development, once the release manager deems fit, the
<em>testing</em> distribution is frozen, meaning that the policies
-which control how packages move from <em>unstable</em> to testing are
+which control how packages move from <em>unstable</em> to <em>testing</em> are
tightened. Packages which are too buggy are removed. No changes are
allowed into <em>testing</em> except for bug fixes. After some time
has elapsed, depending on progress, the <em>testing</em> distribution
<em>unstable</em>.
<p>
An alternative to <em>experimental</em> is to use your personal web space
-on <tt>people.debian.org</tt> (<tt>klecker.debian.org</tt>).
+on <tt>people.debian.org</tt>.
<sect1 id="codenames">Release code names
easily upload a package in one of the delayed directories:
<example>DELAY=5 dupload --to delayed <changes-file></example>
- <sect id="testing-scripts">
- <heading>The testing scripts</heading>
+ <sect id="testing">
+ <heading>The "testing" distribution</heading>
<p>
-The testing scripts are run each day after the installation of the
+The scripts that update the <em>testing</em> distribution are run each day
+after the installation of the
updated packages. They generate the <file>Packages</file> files for
the <em>testing</em> distribution, but they do so in an intelligent manner
trying to avoid any inconsistency and trying to use only
id="&url-testing-maint;">. Alternatively, it is possible to use
the <prgn>grep-excuses</prgn> program part of the
<package>devscripts</package> package. It can be easily put in a crontab
-to keep someone informed of the progression of his packages in testing.
+to keep someone informed of the progression of his packages in <em>testing</em>.
<p>
The <file>update_excuses</file> file does not always give the precise reason
why the package is refused, one may have to find it on their own by looking
id="&url-testing-faq;" name="testing FAQ"> gives some more information
about the usual problems which may be causing such troubles.
<p>
-Sometimes, some packages never enter testing because the set of
+Sometimes, some packages never enter <em>testing</em> because the set of
inter-relationship is too complicated and can not be sorted out
by the scripts. In that case, the release manager must be
contacted, and he will force the inclusion of the packages.
libdbd-mysql-perl | 1.2219-1 | unstable | source, alpha, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390, sparc
</example>
<p>
-In this example, you can see that the version in unstable differs from
-the version in testing and that there has been a binary-only NMU of the
+In this example, you can see that the version in <em>unstable</em> differs from
+the version in <em>testing</em> and that there has been a binary-only NMU of the
package for the alpha architecture. Each time the package has been
recompiled on most of the architectures.
<item>
In the future, you may receive regular summary mails to keep you
informed of the package's status (bug statistics, porting overview,
-progression in testing, ...).
+progression in <em>testing</em>, ...).
</taglist>
<p>
You can also decide to receive some more information:
on your changes file: <example>dinstall -n foo.changes</example>.
Note that <prgn>dput</prgn> can do this for you automatically.
- <sect2 id="upload-non-us">Uploading to <tt>non-US</tt> (pandora)
+ <sect2 id="upload-non-us">Uploading to <tt>non-US</tt>
<p>
As discussed above, export controlled software should not be uploaded
to <tt>ftp-master</tt>. Instead, upload the package to
make a release based on a new upstream version then the person making
the release should start with the <var>debian-revision</var> value
`0.1'. The usual maintainer of a package should start their
-<var>debian-revision</var> numbering at `1'. Note that if you do
-this, you'll have to invoke <prgn>dpkg-buildpackage</prgn> with the
-<tt>-sa</tt> switch to force the build system to pick up the new
-source package (normally it only looks for Debian revisions of '0' or
-'1' — it's not yet clever enough to know about `0.1').
+<var>debian-revision</var> numbering at `1'.
<sect2 id="nmu-changelog">
read <ref id="upload-bugfix">.
</enumlist>
+ <sect1 id="bug-security">Handling security-related bugs
+ <p>
+Due to their sensitive nature, security-related bugs must be handled
+carefully. The Debian Security Team exists to coordinate this
+activity, keeping track of outstanding security problems, helping
+maintainers with security problems or fix them themselves, sending
+security advisories, and maintaining security.debian.org.
+
+<!-- information about the security database goes here once it's ready -->
+
+ <sect2 id="bug-security-you">What to do when you learn of a
+ security problem
+ <p>
+When you become aware of a security-related bug in a Debian package,
+whether or not you are the maintainer, collect pertinent information
+about the problem, and promptly contact the security team at
+&email-security-team;.
+Useful information includes, for example:
+
+<list compact>
+ <item>What versions of the package are known to be affected by the
+ bug.
+
+ <item>The nature of the exposure (root compromise, user compromise,
+ remote/local attack)
+
+ <item>The nature of the fix, if any is available (patches are
+ especially helpful)
+</list>
+
+ <sect2 id="bug-security-confidentiality">Confidentiality
+ <p>
+Unlike most other activities within Debian, information about security
+issues must sometimes be kept private for a time. Whether this is the
+case depends on the nature of the problem and corresponding fix, and
+whether it is already a matter of public knowledge.
+<p>
+There are a few ways a developer can learn of a security problem:
+
+<list compact>
+ <item>he notices it on a public forum (mailing list, website, etc.)
+ <item>someone files a bug report
+ <item>someone informs him via private email
+</list>
+
+ In the first two cases, the information is public and it is important
+ to have a fix as soon as possible. In the last case, however, it
+ might not be public information. In that case there are a few
+ possible options for dealing with the problem:
+
+<list>
+ <item>if it is a trivial problem (like insecure temporary files)
+ there is no need to keep the problem a secret and a fix should be
+ made and released.
+
+ <item>if the problem is severe (remotely exploitable, possibility to
+ gain root privileges) it is preferable to share the information with
+ other vendors and coordinate a release. The security team keeps
+ contacts with the various organizations and individuals and can take
+ care of that.
+</list>
+
+<p>
+ In all cases if the person who reports the problem asks to not
+ disclose the information that should be respected, with the obvious
+ exception of informing the security team (make sure you tell the
+ security team that the information can not be disclosed).
+
+<p>
+Please note that if secrecy is needed you can also not upload a fix to
+unstable (or anywhere else), since the changelog and diff information
+for unstable is public.
+
+<p>
+There are two reasons for releasing information even though secrecy is
+requested: the problem has been known for too long, or the information
+has become public.
+
+ <sect2 id="bug-security-advisories">Security Advisories
+ <p>
+Security advisories are only issued for the current, released stable
+distribution, not for testing or unstable. When released, advisories
+are sent to the &email-debian-security-announce;
+mailing list and posted on <url
+id="&url-debian-security-advisories;" name="the security web page">.
+Security advisories are written and posted by the security
+team. However they certainly do not mind if a maintainer can supply
+some of the information for them, or write part of the
+text. Information that should be in an advisory includes:
+
+<list compact>
+ <item>A description of the problem and its scope, including:
+ <list>
+ <item>The type of problem (privilege escalation, denial of
+ service, etc.)
+ <item>How it can be exploited
+ <item>Whether it is remotely or locally exploitable
+ <item>How the problem was fixed
+ </list>
+ <item>Version numbers of affected packages
+ <item>Version numbers of fixed packages
+ <item>Information on where to obtain the updated packages
+</list>
+
+ <sect2 id="bug-security-building">Preparing packages to
+ address security issues
+ <p>
+One way that you can assist the security team in their duties is to
+provide fixed packages suitable for a security advisory for the stable
+Debian release.
+ <p>
+ When an update is made to the stable release, care must be taken to
+ avoid changing system behaviour or introducing new bugs. In order to
+ do this, make as few changes as possible to fix the bug. Users and
+ administrators rely on the exact behaviour of a release once it is
+ made, so any change we make can possibly break someone's system.
+ This is especially true of libraries: make sure you never change the
+ API or ABI, no matter how small the change.
+<p>
+This means that moving to a new upstream version is not a good
+solution. Instead, the relevant changes should be backported to the
+version present in the current stable Debian release. Generally,
+upstream maintainers are willing to help if needed. If not, the
+Debian security team may be able to help.
+<p>
+In some cases, it is not possible to backport a security fix, for
+example when large amounts of sourcecode need to be modified or
+rewritten. If this happens, it may be necessary to move to a new
+upstream version. However, you must always coordinate that with the
+security team beforehand.
+<p>
+Related to this is another important guideline: always test your
+changes. If you have an exploit available, try it and see if it
+indeed succeeds on the unpatched package and fails on the fixed
+package. Test other, normal actions as well, as sometimes a security
+fix can break seemingly unrelated features in subtle ways.
+
+When packaging the fix, keep the following points in mind:
+
+<list>
+ <item>Make sure you target the right distribution in your
+ debian/changelog. For stable this is stable-security and for
+ testing this is testing-security. Do not target
+ <em>distribution</em>-proposed-updates!
+
+ <item>Make sure the version number is proper. It must be greater
+ than the current package, but less than package versions in later
+ distributions. If in doubt, test it with <tt>dpkg
+ --compare-versions</tt>. For testing, this means there must be
+ a greater version in unstable. If there is none yet (for example,
+ if testing and unstable have the same version) you must upload a
+ new version to unstable first.
+
+ <item>Do not make source-only uploads if your package has any
+ binary-all packages. The buildd infrastructure will not build
+ those. This point applies to normal package uploads as well.
+
+ <item>Always upload with full source (use the <tt>-sa</tt> option
+ for <prgn>dpkg-buildpackage</prgn>).
+
+ <item>Be sure to use the exact same .orig.tar.gz as used in the
+ normal archive, otherwise it is not possible to move the security
+ fix into the main archives later.
+
+ <item>Be sure, when compiling a package, to compile on a clean
+ system which only has packages installed from the distribution you
+ are building for. If you do not have such a system yourself, you
+ can use a debian.org machine (see <ref id="server-machines">)
+ or setup a chroot (see <ref id="pbuilder"> and
+ <ref if="debootstrap">).
+</list>
+
+ <sect2 id="bug-security-upload">Uploading the fixed package
+ <p>
+Once you have created and tested the new package, it needs to be
+uploaded so it can be installed in the archives. For security uploads,
+the place to upload to is
+<tt>ftp://security.debian.org/pub/SecurityUploadQueue/</tt> .
+
+<p>
+Once an upload to the security queue has been accepted the package
+will automatically be rebuilt for all architectures and stored for
+verification by the security team.
+
+<p>
+Uploads waiting for acceptance or verification are only accessible by
+the security team. This is necessary since there might be fixes for
+security problems that can not be disclosed yet.
+
+<p>
+If a member of the security team accepts a package it will be
+installed on security.debian.org as well as the proper
+<em>distribution</em>-proposed-updates on ftp-master or in the non-US
+archive.
<sect1 id="upload-bugfix">When bugs are closed by new uploads
<p>
~ianmdlvl / developers-reference.git / blobdiff