Date: Thu, 11 Dec 2025 12:48:32 +0100
From: Christoph Berg <myon@debian.org>
To: Wim Bertels <wim.bertels@ucll.be>
Cc: "pgsql-pkg-debian@postgresql.org" <pgsql-pkg-debian@postgresql.org>
Subject: Re: separate security tag?
Message-ID: <aTqvkMw2Ef6u0hhp@msg.df7cb.de>
Mail-Followup-To: Christoph Berg <myon@debian.org>,
	Wim Bertels <wim.bertels@ucll.be>,
	"pgsql-pkg-debian@postgresql.org" <pgsql-pkg-debian@postgresql.org>
References: <689a929e29a5b0bffd4b0878b963952131ee2f3c.camel@ucll.be>
 <aTl6LUy0tU1s9xer@msg.df7cb.de>
 <2749022a766c1ed575f5adee99da76de480f8a4c.camel@ucll.be>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <2749022a766c1ed575f5adee99da76de480f8a4c.camel@ucll.be>
Archived-At: 
 <https://www.postgresql.org/message-id/aTqvkMw2Ef6u0hhp%40msg.df7cb.de>
Precedence: bulk

Re: Wim Bertels
> so the question then becomes:
> could it be possible to have a
> security.postgresql.org
> and
> apt.postgresql.org

We could have separate suites foo-pgdg-security instead.

But I think that doesn't really solve the problem because it has too
many sub-dimensions. Say you switched to the apt.pg.o version of
pgbouncer because you wanted a newer feature. Would you later want
only security updates for it? If someone else switches to it later for
another feature, would we have to maintain pgbouncer-feature1-security
and pgbouncer-feature2-security? For the server packages, the
discussion is similar.

This would be a huge extra effort, and the problem space is already
complicated enough. If you want stable stable, use what is in Debian.
If you want newer versions, go with apt.pg.o.

I already try to mention CVEs in the package changelogs, though
sometimes I miss them. I could try to make sure that happens more
often.

Christoph