Recommend git-bp instead of cvs-bp, and cowbuilder instead of pbuilder-uml. Thanks...

[developers-reference.git] / pkgs.dbk

diff --git a/pkgs.dbk b/pkgs.dbk
index 03a6919e5bbbe3305c540100a252aec66f86ebb3..93a8871e22292739e953d06fb819d7c3c26d0920 100644 (file)
--- a/pkgs.dbk
+++ b/pkgs.dbk
@@ -290,9 +290,9 @@ There are several possible values for this field: <literal>stable</literal>,
 <literal>unstable</literal>.
 </para>
 <para>
-Actually, there are two other possible distributions: <literal>stable-security</literal>
-and <literal>testing-security</literal>, but read
-<xref linkend="bug-security"/> for more information on those.
+Actually, there are other possible distributions:
+<replaceable>codename</replaceable><literal>-security</literal>,
+but read <xref linkend="bug-security"/> for more information on those.
 </para>
 <para>
 It is not possible to upload a package into several distributions at the same
@@ -443,8 +443,8 @@ parameter to put the package into one of the queues.
 <title>Security uploads</title>
 <para>
 Do <emphasis role="strong">NOT</emphasis> upload a package to the security
-upload queue (<literal>oldstable-security</literal>, <literal>stable-security</literal>,
-etc.) without prior authorization from the security team.  If the
+upload queue (on <literal>security-master.debian.org</literal>)
+without prior authorization from the security team.  If the
 package does not exactly meet the team's requirements, it will cause many
 problems and delays in dealing with the unwanted upload.  For details, please
 see <xref linkend="bug-security"/>.
@@ -843,10 +843,9 @@ fixing them themselves, sending security advisories, and maintaining
 <para>
 When you become aware of a security-related bug in a Debian package, whether or
 not you are the maintainer, collect pertinent information about the problem,
-and promptly contact the security team, preferably by filing a ticket in
-their Request Tracker.
-See <ulink url="http://wiki.debian.org/rt.debian.org#Security_Team"></ulink>.
-Alternatively you may email &email-security-team;.
+and promptly contact the security team by emailing &email-security-team;. If
+desired, email can be encrypted with the Debian Security Contact key, see
+<ulink url="https://www.debian.org/security/faq#contact"/> for details.
 <emphasis role="strong">DO NOT UPLOAD</emphasis> any packages for
 <literal>stable</literal> without contacting the team.  Useful information
 includes, for example:
@@ -1122,11 +1121,10 @@ Be sure to verify the following items:
 <listitem>
 <para>
 <emphasis role="strong">Target the right distribution</emphasis>
-in your <filename>debian/changelog</filename>.
-For <literal>stable</literal> this is <literal>stable-security</literal> and
-for <literal>testing</literal> this is <literal>testing-security</literal>, and for the previous
-stable release, this is <literal>oldstable-security</literal>.  Do not target
-<replaceable>distribution</replaceable><literal>-proposed-updates</literal> or
+in your <filename>debian/changelog</filename>:
+<replaceable>codename</replaceable><literal>-security</literal>
+(e.g. <literal>wheezy-security</literal>).
+Do not target <replaceable>distribution</replaceable><literal>-proposed-updates</literal> or
 <literal>stable</literal>!
 </para>
 </listitem>
@@ -1154,8 +1152,9 @@ later distributions.  If in doubt, test it with <literal>dpkg
 --compare-versions</literal>.  Be careful not to re-use a version number that
 you have already used for a previous upload, or one that conflicts with a
 binNMU. The convention is to append
-<literal>+</literal><replaceable>codename</replaceable><literal>1</literal>, e.g.
-<literal>1:2.4.3-4+lenny1</literal>, of course increasing 1 for any subsequent
+<literal>+deb</literal><replaceable>X</replaceable><literal>u1</literal> (where
+<replaceable>X</replaceable> is the major release number), e.g.
+<literal>1:2.4.3-4+deb7u1</literal>, of course increasing 1 for any subsequent
 uploads.
 </para>
 </listitem>
@@ -1194,8 +1193,8 @@ have such a system yourself, you can use a debian.org machine (see
 <title>Uploading the fixed package</title>
 <para>
 Do <emphasis role="strong">NOT</emphasis> upload a package to the security
-upload queue (<literal>oldstable-security</literal>, <literal>stable-security</literal>,
-etc.) without prior authorization from the security team.  If the
+upload queue (on <literal>security-master.debian.org</literal>)
+without prior authorization from the security team.  If the
 package does not exactly meet the team's requirements, it will cause many
 problems and delays in dealing with the unwanted upload.
 </para>
@@ -1976,8 +1975,20 @@ Before doing an NMU, consider the following questions:
 <itemizedlist>
 <listitem>
 <para>
-Does your NMU really fix bugs? Fixing cosmetic issues or changing the
-packaging style in NMUs is discouraged.
+Have you geared the NMU towards helping the maintainer? As there might
+be disagreement on the notion of whether the maintainer actually needs
+help on not, the DELAYED queue exists to give time to the maintainer to
+react and has the beneficial side-effect of allowing for independent
+reviews of the NMU diff.
+</para>
+</listitem>
+<listitem>
+<para>
+Does your NMU really fix bugs? ("Bugs" means any kind of bugs, e.g.
+wishlist bugs for packaging a new upstream version, but care should be
+taken to minimize the impact to the maintainer.) Fixing cosmetic issues
+or changing the packaging style (e.g. switching from cdbs to dh) in NMUs
+is discouraged.
 </para>
 </listitem>
 <listitem>
@@ -2060,7 +2071,7 @@ Other NMUs: 10 days
 
 <para>
 Those delays are only examples. In some cases, such as uploads fixing security
-issues, or fixes for trivial bugs that blocking a transition, it is desirable
+issues, or fixes for trivial bugs that block a transition, it is desirable
 that the fixed package reaches <literal>unstable</literal> sooner.
 </para>