Re: Karl O. Pinc 2014-05-29 <1401392744.1042.2@slate>
> Ok. To elaborate, there's no plan for any sort of backporting
> of PG security fixes into the version of PG packaged with
> squeeze (a-la a RH style of supporting very old PG versions
> packaged in old RH distros). Instead, squeeze users must
> upgrade to newer versions of PG, supported by PG, as
> older PG versions go out of support. If, of course,
> squeeze is supported long enough for it's version of PG
> to go out of PG support.
PG is always updated to new upstream versions in stable; we don't
cherry-pick changes. It's probably right to say that PG is the only
package in Debian that has this card blanche for stable update because
of its history of well-behaving minor updates. (There's other packages
that get updated to new versions, i.e. iceweasel/firefox, but that's
because cherry-picking would create an even bigger mess than just
updating.)
So the only policy change would be that users need to use a different
repository. (For the PostgreSQL server packages, the pgapt repository
has more new software that wouldn't go into Debian stable, but people
don't have to use these.)
> I know you mentioned adding comments to the README.Debian file.
> I don't recall the context but
> it might be worth doing this in Jesse/Sid as well
> since those people who will eventually be required
> to rely on the pgapt repo might want to configure
> their system that way from the get-go. (I've
Good point.
> a unconsidered thought: Would it
> be crazy for the Debian pg packages to add a
> /etc/apt/sources.list.d/pgapt file so that
> this happens automatically?)
Too crazy. But we ship a
/usr/share/postgresql-common/pgdg/apt.postgresql.org.sh file in
postgresql-common that automates switching. That's only in jessie/sid
now, but we should push it into the squeeze-lts update too.
Christoph
--
cb@df7cb.de | http://www.df7cb.de/
