Re: Core-updates coordination and plans

[Vagrant Cascadian <vagrant@debian.org>]

[-- Attachment #1: Type: text/plain, Size: 1285 bytes --]

On 2024-01-31, Josselin Poiret wrote:
> One conundrum we have for now: glibc 2.38 has a couple of new CVEs, and
> we have three options:
> 1) change glibc to track the 2.38 release branch → world rebuild.
> 2) graft glibc → bad user experience (and we're not supposed to graft
> outside of master).
> 3) switch to 2.39 → world rebuild + possibly more work fixing new build
> failures.
>
> glibc 2.39 should hopefully release tomorrow (01/02/2024)
>
> What is everyone's opinion regarding those?
>
> IMO, option 2 is the one I'd like to avoid, and between 1 and 3 I'd
> ideally prefer 3 but we don't know yet if there is going to be a lot of
> breakage because of that (feels like usually it's toolchain updates, not
> glibc updates that cause them the most).

How about doing *both* 1 and 3 ... more world rebuilding, sure, but it
means we will have the information to make the correct decision about
which to merge into master. It is *possible* that 2.39 is no worse or
even less broken than the 2.38 release, even if it is likely that 2.38
is more well tested... and even if 2.38 ends up being the glibc to merge
to master, things are better positioned to fairly quickly switch to 2.39
once it becomes a more known quantity...

live well,
  vagrant

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]