Date: Tue, 31 Dec 2024 11:50:45 -0500
From: Bruce Momjian <bruce@momjian.us>
To: Christoph Berg <myon@debian.org>
Cc: Michael Paquier <michael@paquier.xyz>, Tom Lane <tgl@sss.pgh.pa.us>,
	Roberto =?utf-8?B?Qy4gU8OhbmNoZXo=?= <roberto@debian.org>,
	pgsql-hackers@lists.postgresql.org
Subject: Re: Backport of CVE-2024-10978 fix to older pgsql versions (11, 9.6,
 and 9.4)
Message-ID: <Z3Qg5bDU3NnYW7AW@momjian.us>
References: <3999105.1735610459@sss.pgh.pa.us>
 <Z3NHkW31MfTaV9u1@paquier.xyz>
 <Z3O-UihodQaydNhX@msg.df7cb.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Z3O-UihodQaydNhX@msg.df7cb.de>
Archived-At: <https://www.postgresql.org/message-id/Z3Qg5bDU3NnYW7AW%40momjian.us>
Precedence: bulk

On Tue, Dec 31, 2024 at 10:50:10AM +0100, Christoph Berg wrote:
> > Maybe, if we were doing an only-critical-fixes LTS release series,
> > it'd be easier for downstream outfits to consume that instead of
> > cherry-picking security fixes.  I'm just speculating though.
> > It's entirely possible that packagers would ignore our opinions
> > and keep on cherry-picking only security fixes, in which case
> > we'd be doing a lot of work for little return.
> 
> ... if there were a PostgreSQL LTS series, Debian would probably use it.
> 
> Overall, I think the current 5-year support window is good enough.
> I don't see PostgreSQL supporting 10 years, so ELTS efforts will
> always have to do some patching on their own.

Thanks, that was very helpful.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Do not let urgent matters crowd out time for investment in the future.