Re: Emacs 29.3 released

[Eli Zaretskii <eliz@gnu.org>]

> From: Michael Albinus <michael.albinus@gmx.de>
> Cc: emacs-devel@gnu.org
> Date: Tue, 26 Mar 2024 15:28:26 +0100
> 
> > Would it be possible to modify the Tramp revision on the release
> > branch so that it would not have the "-pre" suffix, and otherwise
> > leave intact the procedure by which you collect and merge fixes to the
> > release branch?  That would mean that if such an emergency release
> > does happen, you then advance the Tramp version to the next one (say,
> > from 2.6.3 to 2.6.4), and keep updating the release branch with any
> > further fixes.  If that is possible for you, I think it will be the
> > easiest solution for the future, if we ever need to make such
> > emergency releases again (something that I think is quite probable,
> > given that it happened both for Emacs 28 and Emacs 29).
> 
> It would be possible. I could change the Tramp version in the release
> branch to the next anticipated release number. So I could change it now
> to "2.6.3.29.4". However, I see at least two problems:
> 
> - The Tramp version doesn't guarantee any longer uniqueness. Tramp
>   2.6.3.29.4 would differ today and tomorrow. That was the reason to use
>   such an ambiguous version like 2.6.3-pre.
> 
> - We might run into problems on ELPA. A user sees a builtin version of
>   Tramp 2.6.3.29.4, but in order to fix something for her there is also
>   Tramp 2.6.2.9 (let's say). I fear we'll have a hard time to explain,
>   that 2.6.2.9 is newer than 2.6.3.29.4.

Then perhaps make-tarball.txt needs to say that the version of Tramp
should be changed from X.Y.Z-pre to X.Y.Z as part of preparing the
release?  Or even do this automatically in admin/admin.el, as part of
set-version?

> > Alternatively, we could record in make-tarball.txt the fact that such
> > releases must be coordinated with you.  From where I stand, this is
> > less desirable (as it adds a non-trivial prerequisite for such
> > releases, which could mean a delay if you are unavailable for some
> > reason), but still possible.
> 
> Perhaps it must not be coordinated with "me" only. A single
> announcement, that there will be an emergency release within two days
> would have helped. Usually, I scan Emacs related messages every single day.
> 
> If I am unavailable that time, so be it. Not worse than now.

Preparation of a release tarball is a precarious job: since we don't
lock the Git repository while the release is being worked on, it must
be done very quickly; any commits someone does during the time it
takes to do all the steps necessary for producing the tarball is a
setback that requires to go back several steps and start anew.  So any
additional dependency is a disadvantage I'd like to avoid.

> (FWIW, I don't understand yet why 29.3 was such an emergency that it was
> released w/o any warning in advance.)

Because it makes no sense to announce in advance that Emacs has
security vulnerabilities.  It's akin to waving the proverbial red flag
at a bull.