X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=developers-reference.git;a=blobdiff_plain;f=pkgs.dbk;h=873c42c4e7d0678c609153727434f581e58401f8;hp=07b3f85b6d3932a3d02736f7808611417bec4574;hb=192df44824cca867c032346c74c654dfe40974f0;hpb=353000ffb797d38970738f4454ea46be66e061ec diff --git a/pkgs.dbk b/pkgs.dbk index 07b3f85..873c42c 100644 --- a/pkgs.dbk +++ b/pkgs.dbk @@ -290,9 +290,9 @@ There are several possible values for this field: stable, unstable. -Actually, there are two other possible distributions: stable-security -and testing-security, but read - for more information on those. +Actually, there are other possible distributions: +codename-security, +but read for more information on those. It is not possible to upload a package into several distributions at the same @@ -443,8 +443,8 @@ parameter to put the package into one of the queues. Security uploads Do NOT upload a package to the security -upload queue (oldstable-security, stable-security, -etc.) without prior authorization from the security team. If the +upload queue (on security-master.debian.org) +without prior authorization from the security team. If the package does not exactly meet the team's requirements, it will cause many problems and delays in dealing with the unwanted upload. For details, please see . @@ -843,10 +843,9 @@ fixing them themselves, sending security advisories, and maintaining When you become aware of a security-related bug in a Debian package, whether or not you are the maintainer, collect pertinent information about the problem, -and promptly contact the security team, preferably by filing a ticket in -their Request Tracker. -See . -Alternatively you may email &email-security-team;. +and promptly contact the security team by emailing &email-security-team;. If +desired, email can be encrypted with the Debian Security Contact key, see + for details. DO NOT UPLOAD any packages for stable without contacting the team. Useful information includes, for example: @@ -1122,11 +1121,10 @@ Be sure to verify the following items: Target the right distribution -in your debian/changelog. -For stable this is stable-security and -for testing this is testing-security, and for the previous -stable release, this is oldstable-security. Do not target -distribution-proposed-updates or +in your debian/changelog: +codename-security +(e.g. wheezy-security). +Do not target distribution-proposed-updates or stable! @@ -1154,8 +1152,9 @@ later distributions. If in doubt, test it with dpkg --compare-versions. Be careful not to re-use a version number that you have already used for a previous upload, or one that conflicts with a binNMU. The convention is to append -+codename1, e.g. -1:2.4.3-4+lenny1, of course increasing 1 for any subsequent ++debXu1 (where +X is the major release number), e.g. +1:2.4.3-4+deb7u1, of course increasing 1 for any subsequent uploads. @@ -1194,8 +1193,8 @@ have such a system yourself, you can use a debian.org machine (see Uploading the fixed package Do NOT upload a package to the security -upload queue (oldstable-security, stable-security, -etc.) without prior authorization from the security team. If the +upload queue (on security-master.debian.org) +without prior authorization from the security team. If the package does not exactly meet the team's requirements, it will cause many problems and delays in dealing with the unwanted upload. @@ -1520,12 +1519,13 @@ still be present in the snapshot archive. The version control system used by the previous maintainer might contain useful -changes, so it might be a good idea to have a look there. Check if the control +changes, so it might be a good idea to have a look there. Check if the control file of the previous package contained any headers linking to the version control system for the package and if it still exists. -Package removals from unstable (not testing, stable or oldstable) trigger the +Package removals from unstable (not testing, +stable or oldstable) trigger the closing of all bugs related to the package. You should look through all the closed bugs (including archived bugs) and unarchive and reopen any that were closed in a version ending in +rm and still apply. Any that @@ -2137,26 +2137,17 @@ It also has the benefit of making it visually clear that a package in the archive was not made by the official maintainer. - If you upload a package to testing or stable, you sometimes need to "fork" the version number tree. This is the case for security uploads, for example. For this, a version of the form -+debXYuZ -should be used, where X and -Y are the major and minor release numbers, and -Z is a counter starting at 1. -When the release number is not yet known (often the case for -testing, at the beginning of release cycles), the lowest -release number higher than the last stable release number must be used. For -example, while Lenny (Debian 5.0) is stable, a security NMU to stable for a -package at version 1.5-3 would have version -1.5-3+deb50u1, whereas a security NMU to Squeeze would get -version 1.5-3+deb60u1. After the release of Squeeze, security -uploads to the testing distribution will be versioned -+deb61uZ, until it is known whether that release will be -Debian 6.1 or Debian 7.0 (if that becomes the case, uploads will be versioned -as +deb70uZ). ++debXuY +should be used, where X is the major release number, +and Y is a counter starting at 1. +For example, while Wheezy (Debian 7.0) is stable, a security NMU to stable for +a package at version 1.5-3 would have version +1.5-3+deb7u1, whereas a security NMU to Jessie would get +version 1.5-3+deb8u1.