[gentoo-dev] Stabilization Detached from Security Bugs

[gentoo-dev] Stabilization Detached from Security Bugs

[John Helmert III]

[-- Attachment #1: Type: text/plain, Size: 500 bytes --]

Hi all,

In the past, stabilization for security bugs would be handled directly
in that security bug. After some discussion on the gentoo-dev mailing
list [1], there was some consensus on modifying this workflow to
separate stabilization from security bugs. Going forward, separate bugs
should be filed for security stabilizations and then the security bug
will have a dependency on its stabilization bug.

Thanks!

[1] https://archives.gentoo.org/gentoo-dev/message/72d1747bb087c0317e492177c9653cc3

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] Stabilization Detached from Security Bugs

[Matt Turner]

\o/

Re: [gentoo-dev] Stabilization Detached from Security Bugs

[Michał Górny]

On Thu, 2021-08-26 at 19:11 -0500, John Helmert III wrote:
> In the past, stabilization for security bugs would be handled directly
> in that security bug. After some discussion on the gentoo-dev mailing
> list [1], there was some consensus on modifying this workflow to
> separate stabilization from security bugs. Going forward, separate bugs
> should be filed for security stabilizations and then the security bug
> will have a dependency on its stabilization bug.

Great!  I can make the field invisible on security bugs when you've
confirmed that all pending stabilizations are finished.  Or without
that, if you prefer ;-).

-- 
Best regards,
Michał Górny

Re: [gentoo-dev] Stabilization Detached from Security Bugs

[John Helmert III]

[-- Attachment #1: Type: text/plain, Size: 1091 bytes --]

On Fri, Aug 27, 2021 at 08:58:35AM +0200, Michał Górny wrote:
> On Thu, 2021-08-26 at 19:11 -0500, John Helmert III wrote:
> > In the past, stabilization for security bugs would be handled directly
> > in that security bug. After some discussion on the gentoo-dev mailing
> > list [1], there was some consensus on modifying this workflow to
> > separate stabilization from security bugs. Going forward, separate bugs
> > should be filed for security stabilizations and then the security bug
> > will have a dependency on its stabilization bug.
> 
> Great!  I can make the field invisible on security bugs when you've
> confirmed that all pending stabilizations are finished.  Or without
> that, if you prefer ;-).

Sure! But let's at least wait until we're done with the pending security
bugs which have CC-ARCHES [1], just to keep churn (and work for us)
a bit lower.

[1] https://bugs.gentoo.org/buglist.cgi?email1=security%40gentoo.org&emailassigned_to1=1&emailtype1=substring&f1=keywords&list_id=5758333&o1=substring&query_format=advanced&resolution=---&v1=CC-ARCHES

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]