Subject: separate security tag?

From: Wim Bertels <[email-masked]>
Date: Wed, 10 Dec 2025 12:23:07 +0000

Hello,

in the context of 
https://manpages.debian.org/trixie/unattended-upgrades/unattended-upgrades.8.en.html

could it possible to automatically update only the security updates
within the pgdg repository?

mvg,
Wim

---

From: Christoph Berg <[email-masked]>
Date: Wed, 10 Dec 2025 14:48:29 +0100

Re: Wim Bertels
> within the pgdg repository?

I wouldn't know how to tag the packages in a way that apt would
understand. For security.debian.org, that's based on the whole repo
being "security", but for apt.pg.o, we don't have that.

Christoph

---

From: Wim Bertels <[email-masked]>
Date: Thu, 11 Dec 2025 08:33:32 +0000

> being "security", but for apt.pg.o, we don't have that.

tnx Christoph,
i was assuming that it would be possible somehow,

so the question then becomes:
could it be possible to have a
security.postgresql.org
and
apt.postgresql.org
?

Wim

---

From: Christoph Berg <[email-masked]>
Date: Thu, 11 Dec 2025 12:48:32 +0100

Re: Wim Bertels
> could it be possible to have a

We could have separate suites foo-pgdg-security instead.

But I think that doesn't really solve the problem because it has too
many sub-dimensions. Say you switched to the apt.pg.o version of
pgbouncer because you wanted a newer feature. Would you later want
only security updates for it? If someone else switches to it later for
another feature, would we have to maintain pgbouncer-feature1-security
and pgbouncer-feature2-security? For the server packages, the
discussion is similar.

This would be a huge extra effort, and the problem space is already
complicated enough. If you want stable stable, use what is in Debian.
If you want newer versions, go with apt.pg.o.

I already try to mention CVEs in the package changelogs, though
sometimes I miss them. I could try to make sure that happens more
often.

Christoph

---

From: Wim Bertels <[email-masked]>
Date: Thu, 11 Dec 2025 14:35:54 +0000

Christoph Berg schreef op do 11-12-2025 om 12:48 [+0100]:
> complicated enough. 

i can imagine

thank you for the work done and being done